Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Pullup ticket #6867 - requested by taca
lang/php82: security fix
Revisions pulled up:
- lang/php/phpversion.mk 1.430,1.435
- lang/php82/Makefile 1.9
- lang/php82/distinfo 1.21-1.22
- lang/php82/patches/patch-build_php.m4 1.1
- lang/php82/patches/patch-configure deleted
- lang/php82/patches/patch-sapi_apache2handler_config.m4 1.1
---
Module Name: pkgsrc
Committed By: taca
Date: Fri Jun 7 13:58:44 UTC 2024
Modified Files:
pkgsrc/lang/php: phpversion.mk
pkgsrc/lang/php82: Makefile distinfo
Added Files:
pkgsrc/lang/php82/patches: patch-build_php.m4
patch-sapi_apache2handler_config.m4
Removed Files:
pkgsrc/lang/php82/patches: patch-configure
Log Message:
lang/php82: update to 8.2.20
pkgsrc change:
Instead of patch configure, patch m4 files and use autoconf to generate
configure.
PHP 8.2.20 (2024-06-06)
- CGI:
. Fixed buffer limit on Windows, replacing read call usage by _read.
(David Carlier)
. Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection
in PHP-CGI). (CVE-2024-4577) (nielsdos)
- CLI:
. Fixed bug GH-14189 (PHP Interactive shell input state incorrectly handles
quoted heredoc literals.). (nielsdos)
- Core:
. Fixed bug GH-13970 (Incorrect validation of #[Attribute] flags type for
non-compile-time expressions). (ilutov)
. Fixed bug GH-14140 (Floating point bug in range operation on Apple Silicon
hardware). (Derick, Saki)
- DOM:
. Fix crashes when entity declaration is removed while still having entity
references. (nielsdos)
. Fix references not handled correctly in C14N. (nielsdos)
. Fix crash when calling childNodes next() when iterator is exhausted.
(nielsdos)
. Fix crash in ParentNode::append() when dealing with a fragment
containing text nodes. (nielsdos)
- FFI:
. Fixed bug GH-14215 (Cannot use FFI::load on CRLF header file with
apache2handler). (nielsdos)
- Filter:
. Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL).
(CVE-2024-5458) (nielsdos)
- FPM:
. Fix bug GH-14175 (Show decimal number instead of scientific notation in
systemd status). (Benjamin Cremer)
- Hash:
. ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__`
(Saki Takamachi)
- Intl:
. Fixed build regression on systems without C++17 compilers. (Calvin Buckley,
Peter Kokot)
- Ini:
. Fixed bug GH-14100 (Corrected spelling mistake in php.ini files).
(Marcus Xavier)
- MySQLnd:
. Fix bug GH-14255 (mysqli_fetch_assoc reports error from
nested query). (Kamil Tekiela)
- Opcache:
. Fixed bug GH-14109 (Fix accidental persisting of internal class constant in
shm). (ilutov)
- OpenSSL:
. The openssl_private_decrypt function in PHP, when using PKCS1 padding
(OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack
unless it is used with an OpenSSL version that includes the changes from this pull
request: openssl/openssl#13817 (rsa_pkcs1_implicit_rejection).
These changes are part of OpenSSL 3.2 and have also been backported to stable
versions of various Linux distributions, as well as to the PHP builds provided for
Windows since the previous release. All distributors and builders should ensure that
this version is used to prevent PHP from being vulnerable. (CVE-2024-2408)
- Standard:
. Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874).
(CVE-2024-5585) (nielsdos)
- XML:
. Fixed bug GH-14124 (Segmentation fault with XML extension under certain
memory limit). (nielsdos)
- XMLReader:
. Fixed bug GH-14183 (XMLReader::open() can't be overridden). (nielsdos)
---
Module Name: pkgsrc
Committed By: taca
Date: Fri Jun 7 23:11:41 UTC 2024
Modified Files:
pkgsrc/lang/php81: Makefile Makefile.php
pkgsrc/lang/php82: Makefile Makefile.php
pkgsrc/lang/php83: Makefile Makefile.php
pkgsrc/www/ap-php: Makefile
pkgsrc/www/php-fpm: Makefile
Log Message:
Fix build problem of www/ap-php and www/php-fpm.
Switch these packages to use autoconf, too.
---
Module Name: pkgsrc
Committed By: taca
Date: Fri May 10 15:07:21 UTC 2024
Modified Files:
pkgsrc/lang/php: phpversion.mk
pkgsrc/lang/php82: distinfo
pkgsrc/lang/php82/patches: patch-configure
Log Message:
lang/php82: update to
PHP 8.2.19 (2024-05-09)
- Core:
. Fixed bug GH-13772 (Invalid execute_data->opline pointers in observ=
er fcall
handlers when JIT is enabled). (Bob)
. Fixed bug GH-13931 (Applying zero offset to null pointer in
Zend/zend_opcode.c). (nielsdos)
. Fixed bug GH-13942 (Align the behavior of zend-max-execution-timers=
with
other timeout implementations). (K=E9vin Dunglas)
. Fixed bug GH-14003 (Broken cleanup of unfinished calls with callabl=
e convert
parameters). (ilutov)
. Fixed bug GH-14013 (Erroneous dnl appended in configure). (Peter Ko=
kot)
. Fixed bug GH-10232 (If autoloading occurs during constant resolutio=
n
filename and lineno are identified incorrectly). (ranvis)
. Fixed bug GH-13727 (Missing void keyword). (Peter Kokot)
- Fibers:
. Fixed bug GH-13903 (ASAN false positive underflow when executing co=
py()).
(nielsdos)
- FPM:
. Fixed bug GH-13563 (Setting bool values via env in FPM config fails=
).
(Jakub Zelenka)
- Intl:
. Fixed build for icu 74 and onwards. (dunglas)
- MySQLnd:
. Fix shift out of bounds on 32-bit non-fast-path platforms. (nielsdo=
s)
- Opcache:
. Fixed incorrect assumptions across compilation units for static cal=
ls.
(ilutov)
- OpenSSL:
. Fixed bug GH-10495 (feof on OpenSSL stream hangs indefinitely).
(Jakub Zelenka)
- PDO SQLite:
. Fix GH-13984 (Buffer size is now checked before memcmp). (Saki Taka=
machi)
. Fix GH-13998 (Manage refcount of agg_context->val correctly).
(Saki Takamachi)
- Phar:
. Fixed bug GH-13836 (Renaming a file in a Phar to an already existin=
g
filename causes a NULL pointer dereference). (nielsdos)
. Fixed bug GH-13833 (Applying zero offset to null pointer in zend_ha=
sh.c).
(nielsdos)
. Fix potential NULL pointer dereference before calling EVP_SignInit.=
(icy17)
- PHPDBG:
. Fixed bug GH-13827 (Null pointer access of type 'zval' in phpdbg_fr=
ame).
(nielsdos)
- Posix:
. Fix usage of reentrant functions in ext/posix. (Arnaud)
- Session:
. Fixed bug GH-13856 (Member access within null pointer of type 'ps_f=
iles' in
ext/session/mod_files.c). (nielsdos)
. Fixed bug GH-13891 (memleak and segfault when using ini_set with
session.trans_sid_hosts). (nielsdos, kamil-tekiela)
. Fixed buffer _read/_write size limit on windows for the file mode. =
(David Carlier)
- Streams:
. Fixed file_get_contents() on Windows fails with "errno=3D22 Invalid=
argument". (Damian W=F3jcik)
. Fixed bug GH-13264 (Part 1 - Memory leak on stream filter failure).=
(Jakub Zelenka)
. Fixed bug GH-13860 (Incorrect PHP_STREAM_OPTION_CHECK_LIVENESS case=
in
ext/openssl/xp_ssl.c - causing use of dead socket). (nielsdos)
. Fixed bug GH-11678 (Build fails on musl 1.2.4 - lfs64). (Arnaud)
- Treewide:
. Fix gcc-14 Wcalloc-transposed-args warnings. (Cristian Rodr=EDguez)=
---
Module Name: pkgsrc
Committed By: taca
Date: Fri Jun 7 23:11:41 UTC 2024
Modified Files:
pkgsrc/lang/php81: Makefile Makefile.php
pkgsrc/lang/php82: Makefile Makefile.php
pkgsrc/lang/php83: Makefile Makefile.php
pkgsrc/www/ap-php: Makefile
pkgsrc/www/php-fpm: Makefile
Log Message:
Fix build problem of www/ap-php and www/php-fpm.
Switch these packages to use autoconf, too.- Loading branch information