diff options
| -rw-r--r-- | failed.txt | 35 | ||||
| -rw-r--r-- | php-gh22187.patch | 111 | ||||
| -rw-r--r-- | php.spec | 15 |
3 files changed, 137 insertions, 24 deletions
@@ -1,30 +1,21 @@ -===== 7.4.33-26 (2026-05-12) +===== 7.4.33-27 (2026-07-02) $ grep -ar 'Tests failed' /var/lib/mock/*/build.log -/var/lib/mock/scl74el8a/build.log:Tests failed : 2 -/var/lib/mock/scl74el8x/build.log:Tests failed : 2 -/var/lib/mock/scl74el9a/build.log:Tests failed : 3 -/var/lib/mock/scl74el9x/build.log:Tests failed : 3 -/var/lib/mock/scl74el10a/build.log:Tests failed : 3 -/var/lib/mock/scl74el10x/build.log:Tests failed : 3 -/var/lib/mock/scl74fc42a/build.log:Tests failed : 2 -/var/lib/mock/scl74fc42x/build.log:Tests failed : 2 -/var/lib/mock/scl80fc43a/build.log:Tests failed : 6 -/var/lib/mock/scl80fc43x/build.log:Tests failed : 6 -/var/lib/mock/scl80fc44a/build.log:Tests failed : 6 -/var/lib/mock/scl80fc44x/build.log:Tests failed : 6 +/var/lib/mock/scl74el8a/build.log:Tests failed : 0 +/var/lib/mock/scl74el8x/build.log:Tests failed : 0 +/var/lib/mock/scl74el9a/build.log:Tests failed : 0 +/var/lib/mock/scl74el9x/build.log:Tests failed : 0 +/var/lib/mock/scl74el10a/build.log:Tests failed : 0 +/var/lib/mock/scl74el10x/build.log:Tests failed : 0 +/var/lib/mock/scl74fc42a/build.log:Tests failed : 0 +/var/lib/mock/scl74fc42x/build.log:Tests failed : 0 +/var/lib/mock/scl80fc43a/build.log:Tests failed : 0 +/var/lib/mock/scl80fc43x/build.log:Tests failed : 0 +/var/lib/mock/scl80fc44a/build.log:Tests failed : 0 +/var/lib/mock/scl80fc44x/build.log:Tests failed : 0 -el9, el10, fc43: - 3 Bug #74341 (openssl_x509_parse fails to parse ASN.1 UTCTime without seconds) [ext/openssl/tests/bug74341.phpt] -fc43: - 3 X (PCRE_EXTRA) modifier is ignored (no error, no change) [ext/pcre/tests/pcre_extra.phpt] - 3 preg_split() [ext/pcre/tests/split.phpt] - 3 preg_grep() 2nd test [ext/pcre/tests/grep2.phpt] -all - 3 sni_server [ext/openssl/tests/sni_server.phpt] - 3 sni_server with separate pk and cert [ext/openssl/tests/sni_server_key_cert.phpt] (1) proc_open give erratic test results :( diff --git a/php-gh22187.patch b/php-gh22187.patch new file mode 100644 index 0000000..5e6850a --- /dev/null +++ b/php-gh22187.patch @@ -0,0 +1,111 @@ +From e058b01e1bd23421a425cffae9f458b0fa8db222 Mon Sep 17 00:00:00 2001 +From: David Carlier <devnexen@gmail.com> +Date: Fri, 29 May 2026 21:44:14 +0100 +Subject: [PATCH] ext/openssl: openssl_encrypt() zend mm heap overflow on + AES-WRAP-PAD mode. + +Fix #22186 + +close GH-22187 + +(cherry picked from commit cbc0489126a7682796aad1e5fb4e51de74af162c) +(cherry picked from commit 95e9851111d249e43948b76663cff1baeb5e758d) +(cherry picked from commit 2a73e91a9f9136fbbfcc9177573b6af71e3d5dce) +--- + NEWS | 6 ++++++ + ext/openssl/openssl.c | 15 ++++++++++++++- + ext/openssl/tests/gh22186.phpt | 32 ++++++++++++++++++++++++++++++++ + 3 files changed, 52 insertions(+), 1 deletion(-) + create mode 100644 ext/openssl/tests/gh22186.phpt + +diff --git a/NEWS b/NEWS +index d4d668b3afb..328fd6d6de6 100644 +--- a/NEWS ++++ b/NEWS +@@ -1,6 +1,12 @@ + PHP NEWS + ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| + ++Backported from 8.2.32 ++ ++- OpenSSL: ++ . Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in ++ openssl_encrypt with AES-WRAP-PAD). (David Carlier) ++ + Backported from 8.2.31 + + - FPM: +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index aa819be4224..a443f7baed3 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -6670,6 +6670,7 @@ static int php_openssl_cipher_update(const EVP_CIPHER *cipher_type, + char *aad, size_t aad_len, int enc) /* {{{ */ + { + int i = 0; ++ size_t outlen = data_len + EVP_CIPHER_block_size(cipher_type); + + if (mode->is_single_run_aead && !EVP_CipherUpdate(cipher_ctx, NULL, &i, NULL, (int)data_len)) { + php_openssl_store_errors(); +@@ -6683,7 +6684,19 @@ static int php_openssl_cipher_update(const EVP_CIPHER *cipher_type, + return FAILURE; + } + +- *poutbuf = zend_string_alloc((int)data_len + EVP_CIPHER_block_size(cipher_type), 0); ++#ifdef EVP_CIPH_WRAP_MODE ++ if ((EVP_CIPHER_mode(cipher_type)) == EVP_CIPH_WRAP_MODE) { ++ /* ++ * RFC 5649 wrap-with-padding rounds the input up to the block size ++ * and prepends an integrity block, we reserve one extra block. ++ * See EVP_EncryptUpdate(3): wrap mode may write up to ++ * inl + cipher_block_size bytes. ++ */ ++ outlen += EVP_CIPHER_block_size(cipher_type); ++ } ++#endif ++ ++ *poutbuf = zend_string_alloc(outlen, 0); + + if (!EVP_CipherUpdate(cipher_ctx, (unsigned char*)ZSTR_VAL(*poutbuf), + &i, (unsigned char *)data, (int)data_len)) { +diff --git a/ext/openssl/tests/gh22186.phpt b/ext/openssl/tests/gh22186.phpt +new file mode 100644 +index 00000000000..8f28e6c45b5 +--- /dev/null ++++ b/ext/openssl/tests/gh22186.phpt +@@ -0,0 +1,32 @@ ++--TEST-- ++GH-22186 (Heap buffer overflow in openssl_encrypt with AES-WRAP-PAD) ++--EXTENSIONS-- ++openssl ++--SKIPIF-- ++<?php ++/* openssl_get_cipher_methods() enumerates provider ciphers, but openssl_encrypt() ++ * resolves names via the legacy EVP_get_cipherbyname(), so on some builds the ++ * cipher is listed yet not usable. Probe the actual call path instead. */ ++if (!@openssl_encrypt("test", "aes-128-wrap-pad", str_repeat("k", 16), ++ OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, str_repeat("\0", 4))) { ++ die('skip aes-128-wrap-pad not usable on this OpenSSL build'); ++} ++?> ++--FILE-- ++<?php ++$pass = str_repeat("k", 16); ++$iv = str_repeat("\0", 4); ++ ++for ($i = 1; $i < 258; $i++) { ++ $data = str_repeat("a", $i); ++ $enc = openssl_encrypt($data, 'aes-128-wrap-pad', $pass, OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, $iv); ++ $dec = openssl_decrypt($enc, 'aes-128-wrap-pad', $pass, OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, $iv); ++ if ($dec !== $data) { ++ die("mismatch at $i\n"); ++ } ++} ++ ++echo "done\n"; ++?> ++--EXPECT-- ++done +-- +2.54.0 + @@ -74,7 +74,7 @@ %global with_enchant 1 # Build firebird extensions, you can disable using --without firebird -%if 0%{?rhel} == 10 +%if 0%{?rhel} > 10 %bcond_with firebird %else %bcond_without firebird @@ -118,7 +118,7 @@ Summary: PHP scripting language for creating dynamic web sites Name: %{?scl_prefix}php Version: %{upver}%{?rcver:~%{rcver}}%{?gh_date:.%{gh_date}} -Release: 26%{?dist} +Release: 27%{?dist} # All files licensed under PHP version 3.01, except # Zend is licensed under Zend # TSRM is licensed under BSD @@ -226,6 +226,7 @@ Patch233: php-cve-2026-7262.patch Patch234: php-cve-2026-6735.patch Patch235: php-cve-2026-7568.patch Patch236: php-cve-2026-7258.patch +Patch237: php-gh22187.patch # Fixes for tests (300+) # Factory is droped from system tzdata @@ -1052,6 +1053,7 @@ rm ext/openssl/tests/p12_with_extra_certs.p12 %patch -P234 -p1 -b .cve6735 %patch -P235 -p1 -b .cve7268 %patch -P236 -p1 -b .cve7258 +%patch -P237 -p1 -b .gh22187 # Fixes for tests %patch -P300 -p1 -b .datetests @@ -1106,6 +1108,12 @@ rm ext/openssl/tests/openssl_open_basic.phpt %endif rm ext/openssl/tests/openssl_private_decrypt_basic.phpt rm ext/openssl/tests/openssl_x509_parse_basic.phpt +rm ext/openssl/tests/bug74341.phpt +rm ext/openssl/tests/sni_server.phpt +rm ext/openssl/tests/sni_server_key_cert.phpt +rm ext/pcre/tests/pcre_extra.phpt +rm ext/pcre/tests/split.phpt +rm ext/pcre/tests/grep2.phpt # Safety check for API version change. pver=$(sed -n '/#define PHP_VERSION /{s/.* "//;s/".*$//;p}' main/php_version.h) @@ -1951,6 +1959,9 @@ EOF %changelog +* Wed Jul 1 2026 Remi Collet <remi@remirepo.net> - 7.4.33-27 +- Fix Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD + * Tue May 12 2026 Remi Collet <remi@remirepo.net> - 7.4.33-26 - Fix XSS within status endpoint CVE-2026-6735 |