/[smeserver]/rpms/php/sme8/php-5.3.3-CVE-2014-4698.patch
ViewVC logotype

Annotation of /rpms/php/sme8/php-5.3.3-CVE-2014-4698.patch

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph


Revision 1.1 - (hide annotations) (download)
Sat Oct 18 10:16:16 2014 UTC (10 years ago) by vip-ire
Branch: MAIN
CVS Tags: php-5_3_3-17_el5_sme, php-5_3_3-16_el5_sme, HEAD
* Sat Oct 18 2014 Daniel Berteaud <daniel@firewall-services.com> - 5.3.3-16.sme
- Resync with upstream php53, which include (see [SME: 8574])
- spl: fix use-after-free in ArrayIterator due to object
  change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- gd: fix NULL pointer dereference in gdImageCreateFromXpm.
  CVE-2014-2497
- fileinfo: fix incomplete fix for CVE-2012-1571 in
  cdf_read_property_info. CVE-2014-3587
- core: fix incomplete fix for CVE-2014-4049 DNS TXT
  record parsing. CVE-2014-3597

1 vip-ire 1.1 Patch adapted for PHP 5.3.3
2    
3     Orginal patch:
4     From 22882a9d89712ff2b6ebc20a689a89452bba4dcd Mon Sep 17 00:00:00 2001
5     From: Xinchen Hui <laruence@php.net>
6     Date: Wed, 2 Jul 2014 17:57:42 +0800
7     Subject: [PATCH] Fixed bug #67539 (ArrayIterator use-after-free due to object
8     change during sorting)
9    
10     ---
11     NEWS | 2 ++
12     ext/spl/spl_array.c | 7 +++++++
13     ext/spl/tests/bug67539.phpt | 15 +++++++++++++++
14     3 files changed, 24 insertions(+)
15     create mode 100644 ext/spl/tests/bug67539.phpt
16    
17     diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
18     index 8392e72..0fe47b6 100644
19     --- a/ext/spl/spl_array.c
20     +++ b/ext/spl/spl_array.c
21     @@ -1661,8 +1661,15 @@
22     {
23     const unsigned char *p, *s;
24     zval *pmembers, *pflags = NULL;
25     + HashTable *aht;
26     long flags;
27    
28     + aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
29     + if (aht->nApplyCount > 0) {
30     + zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
31     + return;
32     + }
33     +
34     /* storage */
35     s = p = buf;
36    
37     diff --git a/ext/spl/tests/bug67539.phpt b/ext/spl/tests/bug67539.phpt
38     new file mode 100644
39     index 0000000..8bab2a8
40     --- /dev/null
41     +++ b/ext/spl/tests/bug67539.phpt
42     @@ -0,0 +1,15 @@
43     +--TEST--
44     +Bug #67539 (ArrayIterator use-after-free due to object change during sorting)
45     +--FILE--
46     +<?php
47     +
48     +$it = new ArrayIterator(array_fill(0,2,'X'), 1 );
49     +
50     +function badsort($a, $b) {
51     + $GLOBALS['it']->unserialize($GLOBALS['it']->serialize());
52     + return TRUE;
53     +}
54     +
55     +$it->uksort('badsort');
56     +--EXPECTF--
57     +Warning: Modification of ArrayObject during sorting is prohibited in %sbug67539.php on line %d
58     --
59     1.9.2
60    

admin@koozali.org
ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed