/[smeserver]/rpms/php/sme8/php-5.3.3-CVE-2012-0831.patch
ViewVC logotype

Annotation of /rpms/php/sme8/php-5.3.3-CVE-2012-0831.patch

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph

Revision 1.1 - (hide annotations) (download)
Mon Dec 16 10:46:46 2013 UTC (10 years, 11 months ago) by vip-ire
Branch: MAIN
CVS Tags: php-5_3_3-14_el5_sme, php-5_3_3-17_el5_sme, php-5_3_3-15_el5_sme, php-5_3_3-16_el5_sme, HEAD 
* Mon Dec 16 2013 Daniel Berteaud <daniel@firewall-services.com> - 5.3.3-14.sme
- Resync with upstream php53, which include:
- add security fix for CVE-2013-6420
- add security fix for CVE-2013-4248
- add upstream reproducer for error_handler (#951075)
- add security fixes for CVE-2006-7243
- add security fixes for CVE-2012-2688, CVE-2012-0831,
  CVE-2011-1398, CVE-2013-1643
- fix segfault in error_handler with
  allow_call_time_pass_reference = Off (#951075)
- fix double free when destroy_zend_class fails (#951076)
- fix possible buffer overflow in pdo_odbc (#869694)
- php script hangs when it exceeds max_execution_time
  when inside an ODBC call (#864954)
- fix zend garbage collector (#892695)
- fix transposed memset arguments in libzip (#953818)
- fix possible segfault in pdo_mysql (#869693)
- fix imap_open DISABLE_AUTHENTICATOR param ignores array (#859369)
- fix stream support in fileinfo (#869697)
- fix setDate when DateTime created from timestamp (#869691)
- fix permission on source files (#869688)
- add php(language) and missing provides (#837044)
-
- fix copy doesn't report failure on partial copy (#951413)
1 vip-ire 1.1
2     https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-0831
3     https://bugs.php.net/bug.php?id=61043
4    
5     http://git.php.net/?p=php-src.git;a=commitdiff;h=87c038be06b8b0eb721270f98c858fd701f5d54b
6     http://git.php.net/?p=php-src.git;a=commitdiff;h=d1fd5432e1576865dbeb7650b7c7e0fa0bd3a4e1
7    
8     changes to fpm not applied
9    
10     diff -up php-5.3.3/main/php_variables.c.cve0831 php-5.3.3/main/php_variables.c
11     --- php-5.3.3/main/php_variables.c.cve0831 2012-10-16 14:15:43.050835624 +0200
12     +++ php-5.3.3/main/php_variables.c 2012-10-16 14:17:00.383028652 +0200
13     @@ -446,7 +446,10 @@ void _php_import_environment_variables(z
14    
15     /* turn off magic_quotes while importing environment variables */
16     int magic_quotes_gpc = PG(magic_quotes_gpc);
17     - PG(magic_quotes_gpc) = 0;
18     +
19     + if (magic_quotes_gpc) {
20     + zend_alter_ini_entry_ex("magic_quotes_gpc", sizeof("magic_quotes_gpc"), "0", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_ACTIVATE, 1 TSRMLS_CC);
21     + }
22    
23     for (env = environ; env != NULL && *env != NULL; env++) {
24     p = strchr(*env, '=');
25     @@ -465,7 +468,10 @@ void _php_import_environment_variables(z
26     if (t != buf && t != NULL) {
27     efree(t);
28     }
29     - PG(magic_quotes_gpc) = magic_quotes_gpc;
30     +
31     + if (magic_quotes_gpc) {
32     + zend_alter_ini_entry_ex("magic_quotes_gpc", sizeof("magic_quotes_gpc"), "1", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_ACTIVATE, 1 TSRMLS_CC);
33     + }
34     }
35    
36     zend_bool php_std_auto_global_callback(char *name, uint name_len TSRMLS_DC)
37     @@ -589,7 +595,9 @@ static inline void php_register_server_v
38     zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_SERVER]);
39     }
40     PG(http_globals)[TRACK_VARS_SERVER] = array_ptr;
41     - PG(magic_quotes_gpc) = 0;
42     + if (magic_quotes_gpc) {
43     + zend_alter_ini_entry_ex("magic_quotes_gpc", sizeof("magic_quotes_gpc"), "0", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_ACTIVATE, 1 TSRMLS_CC);
44     + }
45    
46     /* Server variables */
47     if (sapi_module.register_server_variables) {
48     @@ -614,7 +622,9 @@ static inline void php_register_server_v
49     php_register_variable_ex("REQUEST_TIME", &new_entry, array_ptr TSRMLS_CC);
50     }
51    
52     - PG(magic_quotes_gpc) = magic_quotes_gpc;
53     + if (magic_quotes_gpc) {
54     + zend_alter_ini_entry_ex("magic_quotes_gpc", sizeof("magic_quotes_gpc"), "1", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_ACTIVATE, 1 TSRMLS_CC);
55     + }
56     }
57     /* }}} */
58    
59     diff -up php-5.3.3/sapi/cgi/cgi_main.c.cve0831 php-5.3.3/sapi/cgi/cgi_main.c
60     --- php-5.3.3/sapi/cgi/cgi_main.c.cve0831 2012-10-16 14:16:27.310946658 +0200
61     +++ php-5.3.3/sapi/cgi/cgi_main.c 2012-10-16 14:17:00.384028655 +0200
62     @@ -625,7 +625,9 @@ void cgi_php_import_environment_variable
63     int filter_arg = (array_ptr == PG(http_globals)[TRACK_VARS_ENV])?PARSE_ENV:PARSE_SERVER;
64    
65     /* turn off magic_quotes while importing environment variables */
66     - PG(magic_quotes_gpc) = 0;
67     + if (magic_quotes_gpc) {
68     + zend_alter_ini_entry_ex("magic_quotes_gpc", sizeof("magic_quotes_gpc"), "0", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_ACTIVATE, 1 TSRMLS_CC);
69     + }
70     for (zend_hash_internal_pointer_reset_ex(request->env, &pos);
71     zend_hash_get_current_key_ex(request->env, &var, &var_len, &idx, 0, &pos) == HASH_KEY_IS_STRING &&
72     zend_hash_get_current_data_ex(request->env, (void **) &val, &pos) == SUCCESS;
73     @@ -637,7 +639,9 @@ void cgi_php_import_environment_variable
74     php_register_variable_safe(var, *val, new_val_len, array_ptr TSRMLS_CC);
75     }
76     }
77     - PG(magic_quotes_gpc) = magic_quotes_gpc;
78     + if (magic_quotes_gpc) {
79     + zend_alter_ini_entry_ex("magic_quotes_gpc", sizeof("magic_quotes_gpc"), "1", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_ACTIVATE, 1 TSRMLS_CC);
80     + }
81     }
82     }
83    
admin@koozali.org
 ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed