diff options
| -rw-r--r-- | php-bug67326.patch | 32 | ||||
| -rw-r--r-- | php-reg67072.patch | 26 | ||||
| -rw-r--r-- | php55.spec | 11 |
3 files changed, 68 insertions, 1 deletions
diff --git a/php-bug67326.patch b/php-bug67326.patch new file mode 100644 index 0000000..2e7b0b1 --- /dev/null +++ b/php-bug67326.patch @@ -0,0 +1,32 @@ +From 4fcb9a9d1b1063a65fbeb27395de4979c75bd962 Mon Sep 17 00:00:00 2001 +From: Remi Collet <remi@php.net> +Date: Tue, 3 Jun 2014 11:05:00 +0200 +Subject: [PATCH] Fix bug #67326 fileinfo: cdf_read_short_sector insufficient + boundary check + +Upstream fix https://github.com/file/file/commit/6d209c1c489457397a5763bca4b28e43aac90391.patch +Only revelant part applied +--- + ext/fileinfo/libmagic/cdf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c +index 4712e84..16649f1 100644 +--- a/ext/fileinfo/libmagic/cdf.c ++++ b/ext/fileinfo/libmagic/cdf.c +@@ -365,10 +365,10 @@ cdf_read_short_sector(const cdf_stream_t *sst, void *buf, size_t offs, + size_t ss = CDF_SHORT_SEC_SIZE(h); + size_t pos = CDF_SHORT_SEC_POS(h, id); + assert(ss == len); +- if (pos > CDF_SEC_SIZE(h) * sst->sst_len) { ++ if (pos + len > CDF_SEC_SIZE(h) * sst->sst_len) { + DPRINTF(("Out of bounds read %" SIZE_T_FORMAT "u > %" + SIZE_T_FORMAT "u\n", +- pos, CDF_SEC_SIZE(h) * sst->sst_len)); ++ pos + len, CDF_SEC_SIZE(h) * sst->sst_len)); + return -1; + } + (void)memcpy(((char *)buf) + offs, +-- +1.9.2 + diff --git a/php-reg67072.patch b/php-reg67072.patch new file mode 100644 index 0000000..6905db8 --- /dev/null +++ b/php-reg67072.patch @@ -0,0 +1,26 @@ +diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c +index 003bac9..ed6a69c 100644 +--- a/ext/standard/var_unserializer.c ++++ b/ext/standard/var_unserializer.c +@@ -396,7 +396,7 @@ static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce) + + (*p) += 2; + +- if (ce->serialize == NULL) { ++ if (ce->serialize == NULL || ZEND_INTERNAL_CLASS != ce->type) { + object_init_ex(*rval, ce); + } else { + /* If this class implements Serializable, it should not land here but in object_custom(). The passed string +diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re +index b3f5d29..b5f092b 100644 +--- a/ext/standard/var_unserializer.re ++++ b/ext/standard/var_unserializer.re +@@ -400,7 +400,7 @@ static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce) + + (*p) += 2; + +- if (ce->serialize == NULL) { ++ if (ce->serialize == NULL || ZEND_INTERNAL_CLASS != ce->type) { + object_init_ex(*rval, ce); + } else { + /* If this class implements Serializable, it should not land here but in object_custom(). The passed string @@ -126,7 +126,7 @@ Version: 5.5.13 %if 0%{?snapdate:1}%{?rcver:1} Release: 0.1.%{?snapdate}%{?rcver}%{?dist} %else -Release: 1%{?dist} +Release: 2%{?dist} %endif # All files licensed under PHP version 3.01, except # Zend is licensed under Zend @@ -187,6 +187,8 @@ Patch47: php-5.4.9-phpinfo.patch Patch91: php-5.3.7-oci8conf.patch # Upstream fixes (100+) +Patch100: php-reg67072.patch +Patch101: php-bug67326.patch # Security fixes (200+) @@ -904,6 +906,8 @@ rm -rf ext/json %patch91 -p1 -b .remi-oci8 # upstream patches +%patch100 -p1 -b .reg67072 +%patch101 -p1 -b .bug67326 # security patches @@ -1894,6 +1898,11 @@ fi %changelog +* Tue Jun 3 2014 Remi Collet <remi@fedoraproject.org> 5.5.13-2 +- fileinfo: fix insufficient boundary check +- workaround regression introduce in fix for 67072 in + serialize/unzerialize functions + * Wed May 28 2014 Remi Collet <remi@fedoraproject.org> 5.5.13-1 - Update to 5.5.13 http://www.php.net/releases/5_5_13.php |