From 5ac2073268949fd0a3014d7b89b8eaa02430a368 Mon Sep 17 00:00:00 2001 From: bsiegert Date: Mon, 24 Jun 2024 18:12:30 +0000 Subject: [PATCH] Pullup ticket #6867 - requested by taca lang/php82: security fix Revisions pulled up: - lang/php/phpversion.mk 1.430,1.435 - lang/php82/Makefile 1.9 - lang/php82/distinfo 1.21-1.22 - lang/php82/patches/patch-build_php.m4 1.1 - lang/php82/patches/patch-configure deleted - lang/php82/patches/patch-sapi_apache2handler_config.m4 1.1 --- Module Name: pkgsrc Committed By: taca Date: Fri Jun 7 13:58:44 UTC 2024 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php82: Makefile distinfo Added Files: pkgsrc/lang/php82/patches: patch-build_php.m4 patch-sapi_apache2handler_config.m4 Removed Files: pkgsrc/lang/php82/patches: patch-configure Log Message: lang/php82: update to 8.2.20 pkgsrc change: Instead of patch configure, patch m4 files and use autoconf to generate configure. PHP 8.2.20 (2024-06-06) - CGI: . Fixed buffer limit on Windows, replacing read call usage by _read. (David Carlier) . Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577) (nielsdos) - CLI: . Fixed bug GH-14189 (PHP Interactive shell input state incorrectly handles quoted heredoc literals.). (nielsdos) - Core: . Fixed bug GH-13970 (Incorrect validation of #[Attribute] flags type for non-compile-time expressions). (ilutov) . Fixed bug GH-14140 (Floating point bug in range operation on Apple Silicon hardware). (Derick, Saki) - DOM: . Fix crashes when entity declaration is removed while still having entity references. (nielsdos) . Fix references not handled correctly in C14N. (nielsdos) . Fix crash when calling childNodes next() when iterator is exhausted. (nielsdos) . Fix crash in ParentNode::append() when dealing with a fragment containing text nodes. (nielsdos) - FFI: . Fixed bug GH-14215 (Cannot use FFI::load on CRLF header file with apache2handler). (nielsdos) - Filter: . Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458) (nielsdos) - FPM: . Fix bug GH-14175 (Show decimal number instead of scientific notation in systemd status). (Benjamin Cremer) - Hash: . ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__` (Saki Takamachi) - Intl: . Fixed build regression on systems without C++17 compilers. (Calvin Buckley, Peter Kokot) - Ini: . Fixed bug GH-14100 (Corrected spelling mistake in php.ini files). (Marcus Xavier) - MySQLnd: . Fix bug GH-14255 (mysqli_fetch_assoc reports error from nested query). (Kamil Tekiela) - Opcache: . Fixed bug GH-14109 (Fix accidental persisting of internal class constant in shm). (ilutov) - OpenSSL: . The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. (CVE-2024-2408) - Standard: . Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585) (nielsdos) - XML: . Fixed bug GH-14124 (Segmentation fault with XML extension under certain memory limit). (nielsdos) - XMLReader: . Fixed bug GH-14183 (XMLReader::open() can't be overridden). (nielsdos) --- Module Name: pkgsrc Committed By: taca Date: Fri Jun 7 23:11:41 UTC 2024 Modified Files: pkgsrc/lang/php81: Makefile Makefile.php pkgsrc/lang/php82: Makefile Makefile.php pkgsrc/lang/php83: Makefile Makefile.php pkgsrc/www/ap-php: Makefile pkgsrc/www/php-fpm: Makefile Log Message: Fix build problem of www/ap-php and www/php-fpm. Switch these packages to use autoconf, too. --- Module Name: pkgsrc Committed By: taca Date: Fri May 10 15:07:21 UTC 2024 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php82: distinfo pkgsrc/lang/php82/patches: patch-configure Log Message: lang/php82: update to PHP 8.2.19 (2024-05-09) - Core: . Fixed bug GH-13772 (Invalid execute_data->opline pointers in observ= er fcall handlers when JIT is enabled). (Bob) . Fixed bug GH-13931 (Applying zero offset to null pointer in Zend/zend_opcode.c). (nielsdos) . Fixed bug GH-13942 (Align the behavior of zend-max-execution-timers= with other timeout implementations). (K=E9vin Dunglas) . Fixed bug GH-14003 (Broken cleanup of unfinished calls with callabl= e convert parameters). (ilutov) . Fixed bug GH-14013 (Erroneous dnl appended in configure). (Peter Ko= kot) . Fixed bug GH-10232 (If autoloading occurs during constant resolutio= n filename and lineno are identified incorrectly). (ranvis) . Fixed bug GH-13727 (Missing void keyword). (Peter Kokot) - Fibers: . Fixed bug GH-13903 (ASAN false positive underflow when executing co= py()). (nielsdos) - FPM: . Fixed bug GH-13563 (Setting bool values via env in FPM config fails= ). (Jakub Zelenka) - Intl: . Fixed build for icu 74 and onwards. (dunglas) - MySQLnd: . Fix shift out of bounds on 32-bit non-fast-path platforms. (nielsdo= s) - Opcache: . Fixed incorrect assumptions across compilation units for static cal= ls. (ilutov) - OpenSSL: . Fixed bug GH-10495 (feof on OpenSSL stream hangs indefinitely). (Jakub Zelenka) - PDO SQLite: . Fix GH-13984 (Buffer size is now checked before memcmp). (Saki Taka= machi) . Fix GH-13998 (Manage refcount of agg_context->val correctly). (Saki Takamachi) - Phar: . Fixed bug GH-13836 (Renaming a file in a Phar to an already existin= g filename causes a NULL pointer dereference). (nielsdos) . Fixed bug GH-13833 (Applying zero offset to null pointer in zend_ha= sh.c). (nielsdos) . Fix potential NULL pointer dereference before calling EVP_SignInit.= (icy17) - PHPDBG: . Fixed bug GH-13827 (Null pointer access of type 'zval' in phpdbg_fr= ame). (nielsdos) - Posix: . Fix usage of reentrant functions in ext/posix. (Arnaud) - Session: . Fixed bug GH-13856 (Member access within null pointer of type 'ps_f= iles' in ext/session/mod_files.c). (nielsdos) . Fixed bug GH-13891 (memleak and segfault when using ini_set with session.trans_sid_hosts). (nielsdos, kamil-tekiela) . Fixed buffer _read/_write size limit on windows for the file mode. = (David Carlier) - Streams: . Fixed file_get_contents() on Windows fails with "errno=3D22 Invalid= argument". (Damian W=F3jcik) . Fixed bug GH-13264 (Part 1 - Memory leak on stream filter failure).= (Jakub Zelenka) . Fixed bug GH-13860 (Incorrect PHP_STREAM_OPTION_CHECK_LIVENESS case= in ext/openssl/xp_ssl.c - causing use of dead socket). (nielsdos) . Fixed bug GH-11678 (Build fails on musl 1.2.4 - lfs64). (Arnaud) - Treewide: . Fix gcc-14 Wcalloc-transposed-args warnings. (Cristian Rodr=EDguez)= --- Module Name: pkgsrc Committed By: taca Date: Fri Jun 7 23:11:41 UTC 2024 Modified Files: pkgsrc/lang/php81: Makefile Makefile.php pkgsrc/lang/php82: Makefile Makefile.php pkgsrc/lang/php83: Makefile Makefile.php pkgsrc/www/ap-php: Makefile pkgsrc/www/php-fpm: Makefile Log Message: Fix build problem of www/ap-php and www/php-fpm. Switch these packages to use autoconf, too. --- lang/php/phpversion.mk | 4 +- lang/php82/Makefile | 9 ++- lang/php82/distinfo | 11 ++-- lang/php82/patches/patch-build_php.m4 | 17 ++++++ lang/php82/patches/patch-configure | 59 ------------------- .../patch-sapi_apache2handler_config.m4 | 25 ++++++++ 6 files changed, 56 insertions(+), 69 deletions(-) create mode 100644 lang/php82/patches/patch-build_php.m4 delete mode 100644 lang/php82/patches/patch-configure create mode 100644 lang/php82/patches/patch-sapi_apache2handler_config.m4 diff --git a/lang/php/phpversion.mk b/lang/php/phpversion.mk index 4b8a9a851fce..4b17025ce244 100644 --- a/lang/php/phpversion.mk +++ b/lang/php/phpversion.mk @@ -1,4 +1,4 @@ -# $NetBSD: phpversion.mk,v 1.426.2.7 2024/06/24 18:04:51 bsiegert Exp $ +# $NetBSD: phpversion.mk,v 1.426.2.8 2024/06/24 18:12:30 bsiegert Exp $ # # This file selects a PHP version, based on the user's preferences and # the installed packages. It does not add a dependency on the PHP @@ -92,7 +92,7 @@ PHP56_VERSION= 5.6.40 PHP74_VERSION= 7.4.33 PHP80_VERSION= 8.0.30 PHP81_VERSION= 8.1.29 -PHP82_VERSION= 8.2.18 +PHP82_VERSION= 8.2.20 PHP83_VERSION= 8.3.8 # Define API version or initial release of major version. diff --git a/lang/php82/Makefile b/lang/php82/Makefile index 6acb2c72d6f1..2ed5cd51b24e 100644 --- a/lang/php82/Makefile +++ b/lang/php82/Makefile @@ -1,4 +1,4 @@ -# $NetBSD: Makefile,v 1.7 2023/11/24 06:01:26 taca Exp $ +# $NetBSD: Makefile,v 1.7.4.1 2024/06/24 18:12:30 bsiegert Exp $ # # We can't omit PKGNAME here to handle PKG_OPTIONS. @@ -10,7 +10,7 @@ LICENSE= php TEST_TARGET= test -USE_TOOLS+= gmake lex +USE_TOOLS+= autoconf gmake lex LIBTOOL_OVERRIDE= # empty PHP_CHECK_INSTALLED= No @@ -45,7 +45,7 @@ REPLACE_PHP= ext/phar/phar/phar.php run-tests.php SUBST_CLASSES+= path SUBST_MESSAGE.path= Fixing common paths. SUBST_STAGE.path= pre-configure -SUBST_FILES.path= configure +SUBST_FILES.path= build/php.m4 SUBST_FILES.path+= php.ini-development php.ini-production SUBST_FILES.path+= sapi/cgi/Makefile.frag SUBST_VARS.path= CGIDIR @@ -65,6 +65,9 @@ INSTALL_UNSTRIPPED= yes CFLAGS+= -DSQLITE_ENABLE_LOCKING_STYLE=0 -DSQLITE_WITHOUT_ZONEMALLOC .endif +pre-configure: + cd ${WRKSRC} && autoconf -f + post-install: cd ${WRKSRC}; ${INSTALL_DATA} php.ini-development php.ini-production \ ${DESTDIR}${EGDIR} diff --git a/lang/php82/distinfo b/lang/php82/distinfo index c332629b5fb4..3affd1f45357 100644 --- a/lang/php82/distinfo +++ b/lang/php82/distinfo @@ -1,9 +1,9 @@ -$NetBSD: distinfo,v 1.19.2.1 2024/04/22 12:36:39 bsiegert Exp $ +$NetBSD: distinfo,v 1.19.2.2 2024/06/24 18:12:30 bsiegert Exp $ -BLAKE2s (php-8.2.18.tar.xz) = 6571715c96a8064a61bd868f483f27a85ce0594cb540cd7c28a226abe1eb29c0 -SHA512 (php-8.2.18.tar.xz) = 8bdd6e5aa19dac80745d258a43f7330a3096d47dc66cbef0054b8f9eb9ace5e87d841a4001185a783241a416975753c922425e977f50b2716ce643b6a7bf351f -Size (php-8.2.18.tar.xz) = 12089400 bytes -SHA1 (patch-configure) = 80256ba9788c66d960954516394620c9f789d744 +BLAKE2s (php-8.2.20.tar.xz) = a8407aabb71ce0540f0545c0048ce5ef3744033b2b1517c51fe4c98333d4f02b +SHA512 (php-8.2.20.tar.xz) = c659ed4809b6507aa428b483c85c7322815ac9d7d8e4bfe575513a5e69c5a680b8d089fd98a19f83d3a00df3de61468809f21408455913aa24d519776e44abc5 +Size (php-8.2.20.tar.xz) = 12097568 bytes +SHA1 (patch-build_php.m4) = 4743b23e479c4ac904f18def41d5577f3a965af0 SHA1 (patch-ext_enchant_enchant.c) = 7d999de1b2fde2ea11e4a6e16e7b59c085924b9b SHA1 (patch-ext_phar_Makefile.frag) = 53ea5c58b0bc27d236118d5750a74b1cba43e5dd SHA1 (patch-ext_standard_php__fopen__wrapper.c) = 0a2c19c18f089448a8d842e99738b292ab9e5640 @@ -12,6 +12,7 @@ SHA1 (patch-ext_xsl_php__xsl.h) = cf930c5d6d9dab29b12558d265c67d3534a006fd SHA1 (patch-main_streams_streams.c) = d699ce7d3a300ffb39494b3f1fa5e0958f714483 SHA1 (patch-php.ini-development) = 373d76cc7a022b578f1d5e296d1f0ac88bc26b72 SHA1 (patch-php.ini-production) = 5ab7fa6bf8403907160b0a62b56c1ee527f8eda6 +SHA1 (patch-sapi_apache2handler_config.m4) = 5f98557568cc2abc34fab5d3f123803c9a81c0af SHA1 (patch-sapi_cgi_Makefile.frag) = f4cd64d334884c49787d8854115c8cd69cc79bb8 SHA1 (patch-sapi_cli_Makefile.frag) = 1cd29d09042863acbf5330e406410fdcf75d06b3 SHA1 (patch-sapi_fpm_php-fpm.conf.in) = acf9b4e70d4c5ea2b96e37e7bbf9005379ecc4d0 diff --git a/lang/php82/patches/patch-build_php.m4 b/lang/php82/patches/patch-build_php.m4 new file mode 100644 index 000000000000..8c73c901474f --- /dev/null +++ b/lang/php82/patches/patch-build_php.m4 @@ -0,0 +1,17 @@ +$NetBSD: patch-build_php.m4,v 1.1.2.2 2024/06/24 18:12:31 bsiegert Exp $ + +Do not include "PKG_CONFIG*" in CONFIGURE_OPTIONS. + +--- build/php.m4.orig 2024-06-04 13:22:51.000000000 +0000 ++++ build/php.m4 +@@ -2151,6 +2151,10 @@ EOF + else + break + fi ++ case "$CURRENT_ARG" in ++ \'PKG_CONFIG\=*) CURRENT_ARG="'PKG_CONFIG=@TOOLS_PATH.pkg-config@'";; ++ \'PKG_CONFIG_LIBDIR\=*) CURRENT_ARG="'PKG_CONFIG_LIBDIR=@PHP_PKGCONFIG_PATH@'";; ++ esac + AS_ECHO(["$CURRENT_ARG \\"]) >>$1 + CONFIGURE_OPTIONS="$CONFIGURE_OPTIONS $CURRENT_ARG" + done diff --git a/lang/php82/patches/patch-configure b/lang/php82/patches/patch-configure deleted file mode 100644 index 4385efb0396a..000000000000 --- a/lang/php82/patches/patch-configure +++ /dev/null @@ -1,59 +0,0 @@ -$NetBSD: patch-configure,v 1.17.2.1 2024/04/22 12:36:39 bsiegert Exp $ - -* Do not include "PKG_CONFIG*" in CONFIGURE_OPTIONS. -* Don't autodetect maintainer-zts. -* Shell portability. - ---- configure.orig 2024-04-09 18:46:23.000000000 +0000 -+++ configure -@@ -3732,6 +3732,10 @@ EOF - else - break - fi -+ case "$CURRENT_ARG" in -+ \'PKG_CONFIG\=*) CURRENT_ARG="'PKG_CONFIG=@TOOLS_PATH.pkg-config@'";; -+ \'PKG_CONFIG_LIBDIR\=*) CURRENT_ARG="'PKG_CONFIG_LIBDIR=@PHP_PKGCONFIG_PATH@'";; -+ esac - $as_echo "$CURRENT_ARG \\" >>config.nice - CONFIGURE_OPTIONS="$CONFIGURE_OPTIONS $CURRENT_ARG" - done -@@ -7023,30 +7027,6 @@ EOF - ;; - esac - -- if test "$APACHE_VERSION" -lt 2004001; then -- APXS_MPM=`$APXS -q MPM_NAME` -- if test "$APXS_MPM" != "prefork" && test "$APXS_MPM" != "peruser" && test "$APXS_MPM" != "itk"; then -- -- enable_zts=yes -- if test "$pthreads_working" != "yes"; then -- as_fn_error $? "ZTS currently requires working POSIX threads. We were unable to verify that your system supports Pthreads." "$LINENO" 5 -- fi -- -- fi -- else -- APACHE_THREADED_MPM=`$APXS_HTTPD -V 2>/dev/null | grep 'threaded:.*yes'` -- if test -n "$APACHE_THREADED_MPM"; then -- -- enable_zts=yes -- if test "$pthreads_working" != "yes"; then -- as_fn_error $? "ZTS currently requires working POSIX threads. We were unable to verify that your system supports Pthreads." "$LINENO" 5 -- fi -- -- fi -- fi -- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 --$as_echo "yes" >&6; } -- - PHP_VAR_SUBST="$PHP_VAR_SUBST APXS" - - else -@@ -78313,7 +78293,7 @@ $as_echo "#define HAVE_TIDYBUFFIO_H 1" > - fi - - TIDY_LIBDIR=$TIDY_DIR/$PHP_LIBDIR -- if test "$TIDY_LIB_NAME" == 'tidyp'; then -+ if test "$TIDY_LIB_NAME" = 'tidyp'; then - - $as_echo "#define HAVE_TIDYP_H 1" >>confdefs.h - diff --git a/lang/php82/patches/patch-sapi_apache2handler_config.m4 b/lang/php82/patches/patch-sapi_apache2handler_config.m4 new file mode 100644 index 000000000000..e736220bce99 --- /dev/null +++ b/lang/php82/patches/patch-sapi_apache2handler_config.m4 @@ -0,0 +1,25 @@ +$NetBSD: patch-sapi_apache2handler_config.m4,v 1.1.2.2 2024/06/24 18:12:31 bsiegert Exp $ + +Don't autodetect maintainer-zts. + +--- sapi/apache2handler/config.m4.orig 2024-06-04 13:22:51.000000000 +0000 ++++ sapi/apache2handler/config.m4 +@@ -108,18 +108,6 @@ if test "$PHP_APXS2" != "no"; then + ;; + esac + +- if test "$APACHE_VERSION" -lt 2004001; then +- APXS_MPM=`$APXS -q MPM_NAME` +- if test "$APXS_MPM" != "prefork" && test "$APXS_MPM" != "peruser" && test "$APXS_MPM" != "itk"; then +- PHP_BUILD_THREAD_SAFE +- fi +- else +- APACHE_THREADED_MPM=`$APXS_HTTPD -V 2>/dev/null | grep 'threaded:.*yes'` +- if test -n "$APACHE_THREADED_MPM"; then +- PHP_BUILD_THREAD_SAFE +- fi +- fi +- AC_MSG_RESULT(yes) + PHP_SUBST(APXS) + else + AC_MSG_RESULT(no)