Projects
home:rottame:vhosts-ng:php74
php7
Log In
Username
Password
Problem getting expanded diff: bad link: conflict in file php7.spec
×
We truncated the diff of some files because they were too big. If you want to see the full diff for every file,
click here
.
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
Expand all
Collapse all
Changes of Revision 14
View file
php7.changes
Changed
@@ -1,228 +1,346 @@ ------------------------------------------------------------------- -Tue Sep 3 14:47:13 UTC 2024 - Angelo Grossini <angelo@intercom.it> +Tue Oct 20 08:07:40 UTC 2026 - Petr Gajdos <pgajdos@suse.com> -- don't build mod_php +- added patches bsc#1286027 + CVE-2026-109618: memory corruption leading to RCE + CVE-2026-109619: memory corruption leading to RCE + * php7-CVE-2026-109618,109619.patch ------------------------------------------------------------------- -Thu Aug 29 09:38:34 UTC 2024 - Arjen de Korte <suse+build@de-korte.org> +Thu Oct 1 13:34:05 UTC 2026 - Petr Gajdos <pgajdos@suse.com> -- Fix build with GCC14 - -------------------------------------------------------------------- -Thu Jun 20 09:38:53 UTC 2024 - pgajdos@suse.com - -- drop unmaintained apache-rex usage +- added patches + CVE-2025-1218: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser bsc#1282981 + * php7-CVE-2025-1218.patch + CVE-2026-91765: Denial of Service via unbounded recursion in SOAP parser bsc#1282875 + * php7-CVE-2026-91765.patch + CVE-2026-91766: Credential disclosure via cross-origin HTTP redirects bsc#1282876 + * php7-CVE-2026-91766.patch ------------------------------------------------------------------- -Thu Jun 20 09:37:22 UTC 2024 - pgajdos@suse.com +Wed Sep 30 13:01:41 UTC 2026 - Petr Gajdos <pgajdos@suse.com> -- security update - added patches - fix CVE-2024-2756 bsc#1222857, host/secure cookie bypass due to partial fix - + php7-CVE-2024-2756.patch - fix CVE-2024-3096 bsc#1222858, password_verify can erroneously return true, opening ATO risk - + php7-CVE-2024-3096.patch - fix CVE-2024-5458 bsc#1226073, filter bypass in filter_var FILTER_VALIDATE_URL - + php7-CVE-2024-5458.patch + CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing bsc#1283216 + * php7-CVE-2025-14181.patch + CVE-2026-6103: Archive entry injection via integer overflow in TAR parser bsc#1282980 + * php7-CVE-2026-6103.patch + CVE-2026-91767: Information disclosure via crafted TLS server certificate bsc#1282877 + * php7-CVE-2026-91767.patch + CVE-2026-91768: Access control bypass via partial IPv6 address comparison bsc#1282878 + * php7-CVE-2026-91768.patch + CVE-2026-91769: OpenSSL stream peer verification falls back to the Common Name whenever no `subjectAltName` matches, allowing trusted certificate impersonation bsc#1283044 + * php7-CVE-2026-91769.patch + CVE-2026-92842: Information disclosure via out-of-bounds read in stream filters bsc#1282985 + * php7-CVE-2026-92842.patch + CVE-2026-93682: Out-of-bounds read via empty HTTP redirect Location header bsc#1282986 + * php7-CVE-2026-93682.patch ------------------------------------------------------------------- -Fri May 31 13:50:46 UTC 2024 - Angelo Grossini <angelo@intercom.it> +Wed Sep 2 12:22:01 UTC 2026 - Petr Gajdos <pgajdos@suse.com> -- set session.save_path to /tmp +- backport fix for bsc#1205782 (bsc#1276531) ------------------------------------------------------------------- -Thu May 30 19:18:43 UTC 2024 - Arjen de Korte <suse+build@de-korte.org> +Fri Aug 28 07:29:46 UTC 2026 - Petr Gajdos <pgajdos@suse.com> -- Fix check for newer versions of ICU - + php7-fix-newer-versions-icu.patch +- modified patches CVE-2026-7260 bsc#1273077 + * php7-CVE-2026-7260.patch (fix the string free) ------------------------------------------------------------------- -Thu Aug 24 11:19:01 UTC 2023 - pgajdos@suse.com +Fri Jul 31 10:26:15 UTC 2026 - Petr Gajdos <pgajdos@suse.com> -- security update - added patches - fix CVE-2023-3823 bsc#1214106, XML loading external entity without being enabled - + php7-CVE-2023-3823.patch - fix CVE-2023-3824 bsc#1214103, buffer overflows in phar_dir_read() - + php7-CVE-2023-3824.patch - -------------------------------------------------------------------- -Wed Aug 16 10:33:05 UTC 2023 - Angelo Grossini <rottame@intercom.it> - -- provides php embed - -------------------------------------------------------------------- -Wed Aug 16 09:08:11 UTC 2023 - Angelo Grossini <rottame@intercom.it> - -- vhng versioning for extensions (for real) + CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout bsc#1273075 + * php7-CVE-2026-17543.patch + CVE-2026-7260: Stack overflow in phar with circular symlinks bsc#1273077 + * php7-CVE-2026-7260.patch + CVE-2026-9672: Upgrade libgd bsc#1273078 + * php7-CVE-2026-9672.patch ------------------------------------------------------------------- -Wed Aug 16 09:06:21 UTC 2023 - Angelo Grossini <rottame@intercom.it> +Tue Jul 7 09:06:36 UTC 2026 - Petr Gajdos <pgajdos@suse.com> -- vhng versioning for extensions +- added patches + CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. bsc#1270351 + * php7-CVE-2026-14355.patch ------------------------------------------------------------------- -Mon Aug 7 15:11:50 UTC 2023 - Angelo Grossini <rottame@intercom.it> +Wed May 13 10:05:17 UTC 2026 - Petr Gajdos <pgajdos@suse.com> -- normalize ini filenames +- added patches + CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution bsc#1264776 + * php7-CVE-2026-6722.patch + CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS bsc#1264775 + * php7-CVE-2026-6735.patch + CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access and denial of service bsc#1264774 + * php7-CVE-2026-7258.patch + CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when SOAP_PERSISTENCE_SESSION is configured can lead to memory corruption, information disclosure and process crashes bsc#1264772 + * php7-CVE-2026-7261.patch + CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is configured can lead to a denial of service bsc#1264771 + * php7-CVE-2026-7262.patch + CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect the availability of the PHPprocess bsc#1264769 + * php7-CVE-2026-7568.patch ------------------------------------------------------------------- -Thu Jun 15 08:02:29 UTC 2023 - pgajdos@suse.com +Wed Jan 7 11:38:04 UTC 2026 - Petr Gajdos <pgajdos@suse.com> - security update - added patches - fix CVE-2023-3247 bsc#1212349, Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP - + php7-CVE-2023-3247.patch + CVE-2025-14178 bsc#1255711, heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE + * php7-CVE-2025-14178.patch ------------------------------------------------------------------- -Thu Apr 20 21:19:59 UTC 2023 - Arjen de Korte <suse+build@de-korte.org> +Fri Jul 11 08:37:03 UTC 2025 - pgajdos@suse.com -- The %_restart_on_update macro was removed from systemd-rpm-macros. - Remove %posttrans for FPM as it wasn't working as intended anyway. - boo#1210576 +- security update +- added patches + CVE-2025-1220 bsc#1246167, unprocessed null bytes in hostnames can lead to SSRF + + php7-CVE-2025-1220.patch + CVE-2025-1735 bsc#1246146, pgsql extension does not properly handle errors within escape functions + + php7-CVE-2025-1735.patch + CVE-2025-6491 bsc#1246148, NULL pointer dereference when processing a SoapVar with a fully qualified name that is longer than 2G + + php7-CVE-2025-6491.patch ------------------------------------------------------------------- -Tue Mar 14 13:16:57 UTC 2023 - pgajdos@suse.com +Tue Mar 18 13:00:11 UTC 2025 - pgajdos@suse.com -- fix potential buffer overflow bsc#1208199 +- security update - modified patches - % php-systzdata-v19.patch (refreshed) - -------------------------------------------------------------------- -Tue Mar 7 14:13:10 UTC 2023 - Angelo Grossini <rottame@intercom.it> - -- enable imap extension + % php-php-config.patch (-p1) + % php-phpize.patch (-p1) +- added patches + fix CVE-2024-11235 bsc#1239666, Reference counting in php_request_shutdown causes Use-After-Free + + php7-CVE-2024-11235.patch + fix CVE-2025-1217 bsc#1239664, Header parser of `http` stream wrapper does not handle folded headers + + php7-CVE-2025-1217.patch + fix CVE-2025-1734 bsc#1239668, Streams HTTP wrapper does not fail for headers with invalid name and no colon + + php7-CVE-2025-1734.patch + fix CVE-2025-1736 bsc#1239670, Stream HTTP wrapper header check might omit basic auth header + + php7-CVE-2025-1736.patch + fix CVE-2025-1861 bsc#1239669, Stream HTTP wrapper truncate redirect location to 1024 bytes + + php7-CVE-2025-1861.patch + fix CVE-2025-1219 bsc#1239667, libxml streams use wrong `content-type` header when requesting a redirected resource + + php8-CVE-2025-1219.patch ------------------------------------------------------------------- -Tue Mar 7 11:32:35 UTC 2023 - Angelo Grossini <rottame@intercom.it> +Tue Nov 26 13:46:54 UTC 2024 - pgajdos@suse.com -- enable dblib extension +- security update +- added patches + fix CVE-2024-11233 bsc#1233702, single-byte buffer overread due to missing bounds check when processing input with convert.quoted-printable-decode filters + + php7-CVE-2024-11233.patch + fix CVE-2024-11234 bsc#1233703, configuring streams with a proxy and the 'request_fulluri' context option might allow for CRLF injection in URIs + + php7-CVE-2024-11234.patch + fix CVE-2024-8929 bsc#1233651, In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests ... + + php7-CVE-2024-8929.patch ------------------------------------------------------------------- -Thu Feb 16 21:13:28 UTC 2023 - Arjen de Korte <suse+build@de-korte.org> +Fri Oct 11 08:55:51 UTC 2024 - pgajdos@suse.com
View file
php7.spec
Changed
@@ -1,7 +1,7 @@ # -# spec file +# spec file for package php7 # -# Copyright (c) 2024 SUSE LLC +# Copyright (c) 2021 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -105,33 +105,102 @@ Patch19: php-build-reproducible-phar.patch # https://github.com/php/php-src/commit/b3646440b1808abf0874b6f89027ce53ec5da03f Patch20: php7-gd-removed-unused-constants.patch -# https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d -Patch21: php7-signedness-php_filter_validate_domain.patch # CVE-2022-31631 bsc#1206958, Due to an integer overflow PDO:quote() may return unquoted string -Patch22: php7-CVE-2022-31631.patch -# fix "error: 'usmDESPrivProtocol' undeclared" -Patch23: fix-NETSNMP_DISABLE_DES.patch -# CVE-2023-0567 - Password_verify() always return true with some hash -Patch24: php7-CVE-2023-0567-a.patch -Patch25: php7-CVE-2023-0567-b.patch -# CVE-2023-0568 - 1-byte array overrun in common path resolve code -Patch26: php7-CVE-2023-0568.patch -# CVE-2023-0662 - DOS vulnerability when parsing multipart request body -Patch27: php7-CVE-2023-0662.patch +Patch21: php7-CVE-2022-31631.patch +# CVE-2023-0568 bsc#1208366, NULL byte off-by-one in php_check_specific_open_basedir +Patch22: php7-CVE-2023-0568.patch +# https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 bsc#1208388 +Patch23: php7-crypt-possible-buffer-overread.patch +# CVE-2023-0662 bsc#1208367, DoS vulnerability when parsing multipart request body +Patch24: php7-CVE-2023-0662.patch +# CVE-2022-4900 bsc#1209537, potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable +Patch25: php7-CVE-2022-4900.patch # CVE-2023-3247 bsc#1212349, Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP -Patch28: php7-CVE-2023-3247.patch -# CVE-2023-3823 bsc#1214106, XML loading external entity without being enabled -Patch29: php7-CVE-2023-3823.patch +Patch26: php7-CVE-2023-3247.patch # CVE-2023-3824 bsc#1214103, buffer overflows in phar_dir_read() -Patch30: php7-CVE-2023-3824.patch -# PATCH-FIX-UPSTREAM https://github.com/php/php-src/pull/14186 -Patch31: php7-fix-newer-versions-icu.patch -# CVE-2024-2756 bsc#1222857, host/secure cookie bypass due to partial fix -Patch32: php7-CVE-2024-2756.patch +Patch27: php7-CVE-2023-3824.patch +# CVE-2023-3823 bsc#1214106, XML loading external entity without being enabled +Patch28: php7-CVE-2023-3823.patch # CVE-2024-3096 bsc#1222858, password_verify can erroneously return true, opening ATO risk -Patch33: php7-CVE-2024-3096.patch +Patch29: php7-CVE-2024-3096.patch +# CVE-2024-2756 bsc#1222857, host/secure cookie bypass due to partial fix +Patch30: php7-CVE-2024-2756.patch # CVE-2024-5458 bsc#1226073, filter bypass in filter_var FILTER_VALIDATE_URL -Patch34: php7-CVE-2024-5458.patch +Patch31: php7-CVE-2024-5458.patch +# CVE-2024-8927 bsc#1231358, cgi.force_redirect configuration is bypassable due to an environment variable collision +Patch32: php7-CVE-2024-8927.patch +# CVE-2024-8925 bsc#1231360, erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed +Patch33: php7-CVE-2024-8925.patch +# CVE-2024-9026 bsc#1231382, pollution of worker output logs in PHP-FPM +Patch34: php7-CVE-2024-9026.patch +# CVE-2024-11233 bsc#1233702, single-byte buffer overread due to missing bounds check when processing input with convert.quoted-printable-decode filters +Patch35: php7-CVE-2024-11233.patch +# CVE-2024-11234 bsc#1233703, configuring streams with a proxy and the 'request_fulluri' context option might allow for CRLF injection in URIs +Patch36: php7-CVE-2024-11234.patch +# CVE-2024-8929 bsc#1233651, In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests ... +Patch38: php7-CVE-2024-8929.patch +# CVE-2024-11235 bsc#1239666, Reference counting in php_request_shutdown causes Use-After-Free +Patch39: php7-CVE-2024-11235.patch +# CVE-2025-1217 bsc#1239664, Header parser of `http` stream wrapper does not handle folded headers +Patch40: php7-CVE-2025-1217.patch +# CVE-2025-1734 bsc#1239668, Streams HTTP wrapper does not fail for headers with invalid name and no colon +Patch41: php7-CVE-2025-1734.patch +# CVE-2025-1861 bsc#1239669, Stream HTTP wrapper truncate redirect location to 1024 bytes +Patch42: php7-CVE-2025-1861.patch +# CVE-2025-1736 bsc#1239670, Stream HTTP wrapper header check might omit basic auth header +Patch43: php7-CVE-2025-1736.patch +# CVE-2025-1219 bsc#1239667, libxml streams use wrong `content-type` header when requesting a redirected resource +Patch44: php7-CVE-2025-1219.patch +# CVE-2025-6491 bsc#1246148, NULL pointer dereference when processing a SoapVar with a fully qualified name that is longer than 2G +Patch45: php7-CVE-2025-6491.patch +# CVE-2025-1220 bsc#1246167, unprocessed null bytes in hostnames can lead to SSRF +Patch46: php7-CVE-2025-1220.patch +# CVE-2025-1735 bsc#1246146, pgsql extension does not properly handle errors within escape functions +Patch47: php7-CVE-2025-1735.patch +# CVE-2025-14178 bsc#1255711, heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE +Patch48: php7-CVE-2025-14178.patch +# CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect the availability of the PHPprocess bsc#1264769 +Patch49: php7-CVE-2026-7568.patch +# CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when SOAP_PERSISTENCE_SESSION is configured can lead to memory corruption, information disclosure and process crashes bsc#1264772 +Patch50: php7-CVE-2026-7261.patch +# CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution bsc#1264776 +Patch51: php7-CVE-2026-6722.patch +# CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is configured can lead to a denial of service bsc#1264771 +Patch52: php7-CVE-2026-7262.patch +# CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access and denial of service bsc#1264774 +Patch53: php7-CVE-2026-7258.patch +# CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS bsc#1264775 +Patch54: php7-CVE-2026-6735.patch +# CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. bsc#1270351 +Patch55: php7-CVE-2026-14355.patch +# CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout bsc#1273075 +Patch56: php7-CVE-2026-17543.patch +# CVE-2026-9672: Upgrade libgd bsc#1273078 +Patch57: php7-CVE-2026-9672.patch +# CVE-2026-7260: Stack overflow in phar with circular symlinks bsc#1273077 +Patch58: php7-CVE-2026-7260.patch +# CVE-2026-93682: Out-of-bounds read via empty HTTP redirect Location header bsc#1282986 +Patch59: php7-CVE-2026-93682.patch +# CVE-2026-92842: Information disclosure via out-of-bounds read in stream filters bsc#1282985 +Patch60: php7-CVE-2026-92842.patch +# CVE-2026-6103: Archive entry injection via integer overflow in TAR parser bsc#1282980 +Patch61: php7-CVE-2026-6103.patch +# CVE-2026-91768: Access control bypass via partial IPv6 address comparison bsc#1282878 +Patch62: php7-CVE-2026-91768.patch +# CVE-2026-91769: OpenSSL stream peer verification falls back to the Common Name whenever no `subjectAltName` matches, allowing trusted certificate impersonation bsc#1283044 +Patch63: php7-CVE-2026-91769.patch +# CVE-2026-91767: Information disclosure via crafted TLS server certificate bsc#1282877 +Patch64: php7-CVE-2026-91767.patch +# CVE-2026-14181: Integer overflow to buffer overflow in soap HTTP parsing bsc#1283216 +Patch65: php7-CVE-2025-14181.patch +# CVE-2026-91765: Denial of Service via unbounded recursion in SOAP parser bsc#1282875 +Patch66: php7-CVE-2026-91765.patch +# CVE-2026-91766: Credential disclosure via cross-origin HTTP redirects bsc#1282876 +Patch67: php7-CVE-2026-91766.patch +# CVE-2025-1218: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser bsc#1282981 +Patch68: php7-CVE-2025-1218.patch +# CVE-2026-109618: memory corruption leading to RCE|CVE-2026-109619: memory corruption leading to RCE +Patch69: php7-CVE-2026-109618,109619.patch BuildRequires: apache-rpm-macros BuildRequires: autoconf BuildRequires: bison @@ -145,7 +214,6 @@ BuildRequires: libacl-devel BuildRequires: libapparmor-devel BuildRequires: libbz2-devel -BuildRequires: libopenssl-1_1-devel BuildRequires: libtidy-devel BuildRequires: libtiff-devel BuildRequires: libtool @@ -176,6 +244,7 @@ BuildRequires: pkgconfig(libzip) >= 0.11 BuildRequires: pkgconfig(odbc) BuildRequires: pkgconfig(oniguruma) +BuildRequires: libopenssl-1_1-devel BuildRequires: pkgconfig(sqlite3) > 3.7.4 BuildRequires: pkgconfig(zlib) >= 1.2.0.4 %if %{build_firebird} @@ -190,14 +259,18 @@ BuildRequires: pkgconfig(libargon2) %endif %if "%{flavor}" == "test" +BuildRequires: apache-rex BuildRequires: mod_php_any = %{version} BuildRequires: php-cli = %{version} BuildRequires: php-fpm = %{version} +%apache_rex_deps %endif %if "%{flavor}" == "" Requires: php-sapi = %{version} Requires: timezone +Requires(pre): group(www) +Requires(pre): user(wwwrun) Recommends: php-ctype = %{version} Recommends: php-dom = %{version} Recommends: php-iconv = %{version} @@ -364,8 +437,6 @@ BuildRequires: php = %{version} BuildRequires: pkgconfig(libsystemd) >= 209 Requires: php = %{version} -Requires: group(www) -Requires: user(wwwrun) Provides: php-fpm = %{version} Provides: php-fpm(vhng) = %{php_vhng_branch} Provides: php-sapi = %{version} @@ -1107,8 +1178,8 @@ ./buildconf --force # export flags -CFLAGS="%{optflags} -O3 -fPIE -fPIC -DPIC -D_GNU_SOURCE -fno-strict-aliasing -fpermissive" -CXXFLAGS="%{optflags} -O3 -fPIE -fPIC -DPIC -D_GNU_SOURCE -fno-strict-aliasing -fpermissive" +CFLAGS="%{optflags} -O3 -fPIE -fPIC -DPIC -D_GNU_SOURCE -fno-strict-aliasing" +CXXFLAGS="%{optflags} -O3 -fPIE -fPIC -DPIC -D_GNU_SOURCE -fno-strict-aliasing" %if %{build_firebird} CFLAGS="$CFLAGS -I/usr/include/firebird" CXXFLAGS="$CXXFLAGS -I/usr/include/firebird" @@ -1127,8 +1198,6 @@ export EXTENSION_DIR=%{extension_dir} # Fix build-cli for arm and aarch64 export LIBS=-ltinfo -# Some extensions are broken when linking with -z now -export SUSE_ZNOW=0 # build function Build() @@ -1205,9 +1274,8 @@
View file
fix-NETSNMP_DISABLE_DES.patch
Deleted
@@ -1,31 +0,0 @@ ---- a/ext/snmp/snmp.c -+++ b/ext/snmp/snmp.c -@@ -1225,19 +1225,22 @@ static int netsnmp_session_set_auth_prot - Set the security protocol in the snmpv3 session */ - static int netsnmp_session_set_sec_protocol(struct snmp_session *s, char *prot) - { -+#ifndef NETSNMP_DISABLE_DES - if (!strcasecmp(prot, "DES")) { - s->securityPrivProto = usmDESPrivProtocol; - s->securityPrivProtoLen = USM_PRIV_PROTO_DES_LEN; -+ return (0); -+ } -+#endif - #ifdef HAVE_AES -- } else if (!strcasecmp(prot, "AES128") || !strcasecmp(prot, "AES")) { -+ if (!strcasecmp(prot, "AES128") || !strcasecmp(prot, "AES")) { - s->securityPrivProto = usmAESPrivProtocol; - s->securityPrivProtoLen = USM_PRIV_PROTO_AES_LEN; --#endif -- } else { -- php_error_docref(NULL, E_WARNING, "Unknown security protocol '%s'", prot); -- return (-1); -+ return (0); - } -- return (0); -+#endif -+ php_error_docref(NULL, E_WARNING, "Unknown security protocol '%s'", prot); -+ return (-1); - } - /* }}} */ -
View file
php-ini.patch
Changed
@@ -29,3 +29,12 @@ ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links +@@ -1354,7 +1355,7 @@ session.save_handler = files + ; where MODE is the octal representation of the mode. Note that this + ; does not overwrite the process's umask. + ; http://php.net/session.save-path +-;session.save_path = "/tmp" ++session.save_path = "/var/lib/php7" + + ; Whether to use strict session mode. + ; Strict session mode does not accept an uninitialized session ID, and
View file
php-php-config.patch
Changed
@@ -4,7 +4,7 @@ Index: scripts/php-config.in =================================================================== ---- a/scripts/php-config.in +--- a/scripts/php-config.in.orig +++ b/scripts/php-config.in @@ -6,7 +6,7 @@ datarootdir="@datarootdir@" exec_prefix="@exec_prefix@"
View file
php-phpize.patch
Changed
@@ -5,7 +5,7 @@ Index: scripts/Makefile.frag =================================================================== ---- a/scripts/Makefile.frag +--- a/scripts/Makefile.frag.orig +++ b/scripts/Makefile.frag @@ -3,8 +3,8 @@ # Build environment install @@ -20,7 +20,7 @@ scripts/phpize.m4 \ Index: scripts/phpize.in =================================================================== ---- a/scripts/phpize.in +--- a/scripts/phpize.in.orig +++ b/scripts/phpize.in @@ -4,8 +4,8 @@ prefix='@prefix@'
View file
php7-CVE-2023-0567-a.patch -> php7-CVE-2022-4900.patch
Changed
@@ -1,142 +1,29 @@ -From c840f71524067aa474c00c3eacfb83bd860bfc8a Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= <tim@bastelstu.be> -Date: Mon, 23 Jan 2023 21:15:24 +0100 -Subject: PATCH crypt: Fix validation of malformed BCrypt hashes -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -PHP’s implementation of crypt_blowfish differs from the upstream Openwall -version by adding a “PHP Hack”, which allows one to cut short the BCrypt salt -by including a `$` character within the characters that represent the salt. - -Hashes that are affected by the “PHP Hack” may erroneously validate any -password as valid when used with `password_verify` and when comparing the -return value of `crypt()` against the input. - -The PHP Hack exists since the first version of PHP’s own crypt_blowfish -implementation that was added in 1e820eca02dcf322b41fd2fe4ed2a6b8309f8ab5. - -No clear reason is given for the PHP Hack’s existence. This commit removes it, -because BCrypt hashes containing a `$` character in their salt are not valid -BCrypt hashes. ---- - ext/standard/crypt_blowfish.c | 8 -- - .../tests/crypt/bcrypt_salt_dollar.phpt | 82 +++++++++++++++++++ - 2 files changed, 82 insertions(+), 8 deletions(-) - create mode 100644 ext/standard/tests/crypt/bcrypt_salt_dollar.phpt - -diff --git a/ext/standard/crypt_blowfish.c b/ext/standard/crypt_blowfish.c -index 3806a290aee4..351d40308089 100644 ---- a/ext/standard/crypt_blowfish.c -+++ b/ext/standard/crypt_blowfish.c -@@ -371,7 +371,6 @@ static const unsigned char BF_atoi640x60 = { - #define BF_safe_atoi64(dst, src) \ - { \ - tmp = (unsigned char)(src); \ -- if (tmp == '$') break; /* PHP hack */ \ - if ((unsigned int)(tmp -= 0x20) >= 0x60) return -1; \ - tmp = BF_atoi64tmp; \ - if (tmp > 63) return -1; \ -@@ -399,13 +398,6 @@ static int BF_decode(BF_word *dst, const char *src, int size) - *dptr++ = ((c3 & 0x03) << 6) | c4; - } while (dptr < end); +Index: php-7.4.33/sapi/cli/php_cli_server.c +=================================================================== +--- php-7.4.33.orig/sapi/cli/php_cli_server.c ++++ php-7.4.33/sapi/cli/php_cli_server.c +@@ -517,13 +517,8 @@ static int sapi_cli_server_startup(sapi_ + if (php_cli_server_workers_max > 1) { + zend_long php_cli_server_worker; -- if (end - dptr == size) { -- return -1; -- } +- php_cli_server_workers = calloc( +- php_cli_server_workers_max, sizeof(pid_t)); +- if (!php_cli_server_workers) { +- php_cli_server_workers_max = 1; - -- while (dptr < end) /* PHP hack */ -- *dptr++ = 0; -- - return 0; - } +- return SUCCESS; +- } ++ php_cli_server_workers = pecalloc( ++ php_cli_server_workers_max, sizeof(pid_t), 1); + + php_cli_server_master = getpid(); + +@@ -2361,7 +2356,7 @@ static void php_cli_server_dtor(php_cli_ + !WIFSIGNALED(php_cli_server_worker_status)); + } -diff --git a/ext/standard/tests/crypt/bcrypt_salt_dollar.phpt b/ext/standard/tests/crypt/bcrypt_salt_dollar.phpt -new file mode 100644 -index 000000000000..32e335f4b087 ---- /dev/null -+++ b/ext/standard/tests/crypt/bcrypt_salt_dollar.phpt -@@ -0,0 +1,82 @@ -+--TEST-- -+bcrypt correctly rejects salts containing $ -+--FILE-- -+<?php -+for ($i = 0; $i < 23; $i++) { -+ $salt = '$2y$04$' . str_repeat('0', $i) . '$'; -+ $result = crypt("foo", $salt); -+ var_dump($salt); -+ var_dump($result); -+ var_dump($result === $salt); -+} -+?> -+--EXPECT-- -+string(8) "$2y$04$$" -+string(2) "*0" -+bool(false) -+string(9) "$2y$04$0$" -+string(2) "*0" -+bool(false) -+string(10) "$2y$04$00$" -+string(2) "*0" -+bool(false) -+string(11) "$2y$04$000$" -+string(2) "*0" -+bool(false) -+string(12) "$2y$04$0000$" -+string(2) "*0" -+bool(false) -+string(13) "$2y$04$00000$" -+string(2) "*0" -+bool(false) -+string(14) "$2y$04$000000$" -+string(2) "*0" -+bool(false) -+string(15) "$2y$04$0000000$" -+string(2) "*0" -+bool(false) -+string(16) "$2y$04$00000000$" -+string(2) "*0" -+bool(false) -+string(17) "$2y$04$000000000$" -+string(2) "*0" -+bool(false) -+string(18) "$2y$04$0000000000$" -+string(2) "*0" -+bool(false) -+string(19) "$2y$04$00000000000$" -+string(2) "*0" -+bool(false) -+string(20) "$2y$04$000000000000$" -+string(2) "*0" -+bool(false) -+string(21) "$2y$04$0000000000000$" -+string(2) "*0" -+bool(false) -+string(22) "$2y$04$00000000000000$" -+string(2) "*0" -+bool(false) -+string(23) "$2y$04$000000000000000$" -+string(2) "*0" -+bool(false) -+string(24) "$2y$04$0000000000000000$" -+string(2) "*0" -+bool(false) -+string(25) "$2y$04$00000000000000000$" -+string(2) "*0" -+bool(false) -+string(26) "$2y$04$000000000000000000$" -+string(2) "*0" -+bool(false) -+string(27) "$2y$04$0000000000000000000$" -+string(2) "*0" -+bool(false) -+string(28) "$2y$04$00000000000000000000$" -+string(2) "*0" -+bool(false) -+string(29) "$2y$04$000000000000000000000$" -+string(2) "*0" -+bool(false) -+string(30) "$2y$04$0000000000000000000000$" -+string(60) "$2y$04$000000000000000000000u2a2UpVexIt9k3FMJeAVr3c04F5tcI8K" -+bool(false) +- free(php_cli_server_workers); ++ pefree(php_cli_server_workers, 1); + } + #endif + } /* }}} */
View file
php7-CVE-2023-0568.patch
Changed
@@ -1,26 +1,8 @@ -From ec10b28d64decbc54aa1e585dce580f0bd7a5953 Mon Sep 17 00:00:00 2001 -From: Niels Dossche <7771979+nielsdos@users.noreply.github.com> -Date: Fri, 27 Jan 2023 19:28:27 +0100 -Subject: PATCH Fix array overrun when appending slash to paths - -Fix it by extending the array sizes by one character. As the input is -limited to the maximum path length, there will always be place to append -the slash. As the php_check_specific_open_basedir() simply uses the -strings to compare against each other, no new failures related to too -long paths are introduced. -We'll let the DOM and XML case handle a potentially too long path in the -library code. ---- - ext/dom/document.c | 2 +- - ext/xmlreader/php_xmlreader.c | 2 +- - main/fopen_wrappers.c | 6 +++--- - 3 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/ext/dom/document.c b/ext/dom/document.c -index dbbabb8bffde..fa6a6377ad5c 100644 ---- a/ext/dom/document.c -+++ b/ext/dom/document.c -@@ -1174,7 +1174,7 @@ static xmlDocPtr dom_document_parser(zval *id, int mode, char *source, size_t so +Index: php-7.4.33/ext/dom/document.c +=================================================================== +--- php-7.4.33.orig/ext/dom/document.c ++++ php-7.4.33/ext/dom/document.c +@@ -1379,7 +1379,7 @@ static xmlDocPtr dom_document_parser(zva int validate, recover, resolve_externals, keep_blanks, substitute_ent; int resolved_path_len; int old_error_reporting = 0; @@ -29,11 +11,11 @@ if (id != NULL) { intern = Z_DOMOBJ_P(id); -diff --git a/ext/xmlreader/php_xmlreader.c b/ext/xmlreader/php_xmlreader.c -index ecc52aa1d6f4..d8f8105010c7 100644 ---- a/ext/xmlreader/php_xmlreader.c -+++ b/ext/xmlreader/php_xmlreader.c -@@ -1024,7 +1024,7 @@ PHP_METHOD(XMLReader, XML) +Index: php-7.4.33/ext/xmlreader/php_xmlreader.c +=================================================================== +--- php-7.4.33.orig/ext/xmlreader/php_xmlreader.c ++++ php-7.4.33/ext/xmlreader/php_xmlreader.c +@@ -1038,7 +1038,7 @@ PHP_METHOD(xmlreader, XML) xmlreader_object *intern = NULL; char *source, *uri = NULL, *encoding = NULL; int resolved_path_len, ret = 0; @@ -42,11 +24,11 @@ xmlParserInputBufferPtr inputbfr; xmlTextReaderPtr reader; -diff --git a/main/fopen_wrappers.c b/main/fopen_wrappers.c -index 39a9c82d5984..5e4a619c8fe7 100644 ---- a/main/fopen_wrappers.c -+++ b/main/fopen_wrappers.c -@@ -129,10 +129,10 @@ PHPAPI ZEND_INI_MH(OnUpdateBaseDir) +Index: php-7.4.33/main/fopen_wrappers.c +=================================================================== +--- php-7.4.33.orig/main/fopen_wrappers.c ++++ php-7.4.33/main/fopen_wrappers.c +@@ -138,10 +138,10 @@ PHPAPI ZEND_INI_MH(OnUpdateBaseDir) */ PHPAPI int php_check_specific_open_basedir(const char *basedir, const char *path) {
View file
php7-CVE-2023-0662.patch
Changed
@@ -1,27 +1,10 @@ -From 716de0cff539f46294ef70fe75d548cd66766370 Mon Sep 17 00:00:00 2001 -From: Jakub Zelenka <bukka@php.net> -Date: Thu, 19 Jan 2023 14:31:25 +0000 -Subject: PATCH Introduce max_multipart_body_parts INI - -This fixes GHSA-54hq-v5wp-fqgv DOS vulnerabality by limitting number of -parsed multipart body parts as currently all parts were always parsed. ---- - main/main.c | 1 + - main/rfc1867.c | 11 ++ - ...-54hq-v5wp-fqgv-max-body-parts-custom.phpt | 53 +++++++++ - ...54hq-v5wp-fqgv-max-body-parts-default.phpt | 54 +++++++++ - .../ghsa-54hq-v5wp-fqgv-max-file-uploads.phpt | 52 +++++++++ - sapi/fpm/tests/tester.inc | 106 +++++++++++++++--- - 6 files changed, 262 insertions(+), 15 deletions(-) - create mode 100644 sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-body-parts-custom.phpt - create mode 100644 sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-body-parts-default.phpt - create mode 100644 sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-file-uploads.phpt - -diff --git a/main/main.c b/main/main.c +iff --git a/main/main.c b/main/main.c index 40684f32dc14..c58ea58bf5ac 100644 ---- a/main/main.c -+++ b/main/main.c -@@ -751,6 +751,7 @@ PHP_INI_BEGIN() +Index: php-7.4.33/main/main.c +=================================================================== +--- php-7.4.33.orig/main/main.c ++++ php-7.4.33/main/main.c +@@ -836,6 +836,7 @@ PHP_INI_BEGIN() PHP_INI_ENTRY("disable_functions", "", PHP_INI_SYSTEM, NULL) PHP_INI_ENTRY("disable_classes", "", PHP_INI_SYSTEM, NULL) PHP_INI_ENTRY("max_file_uploads", "20", PHP_INI_SYSTEM|PHP_INI_PERDIR, NULL) @@ -29,11 +12,11 @@ STD_PHP_INI_BOOLEAN("allow_url_fopen", "1", PHP_INI_SYSTEM, OnUpdateBool, allow_url_fopen, php_core_globals, core_globals) STD_PHP_INI_BOOLEAN("allow_url_include", "0", PHP_INI_SYSTEM, OnUpdateBool, allow_url_include, php_core_globals, core_globals) -diff --git a/main/rfc1867.c b/main/rfc1867.c -index b43cfae5a1e2..3086e8da3dbe 100644 ---- a/main/rfc1867.c -+++ b/main/rfc1867.c -@@ -687,6 +687,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */ +Index: php-7.4.33/main/rfc1867.c +=================================================================== +--- php-7.4.33.orig/main/rfc1867.c ++++ php-7.4.33/main/rfc1867.c +@@ -694,6 +694,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ void *event_extra_data = NULL; unsigned int llen = 0; int upload_cnt = INI_INT("max_file_uploads"); @@ -41,7 +24,7 @@ const zend_encoding *internal_encoding = zend_multibyte_get_internal_encoding(); php_rfc1867_getword_t getword; php_rfc1867_getword_conf_t getword_conf; -@@ -708,6 +709,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */ +@@ -715,6 +716,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ return; } @@ -53,7 +36,7 @@ /* Get the boundary */ boundary = strstr(content_type_dup, "boundary"); if (!boundary) { -@@ -792,6 +798,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */ +@@ -799,6 +805,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ char *pair = NULL; int end = 0; @@ -65,331 +48,3 @@ while (isspace(*cd)) { ++cd; } -diff --git a/sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-body-parts-custom.phpt b/sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-body-parts-custom.phpt -new file mode 100644 -index 000000000000..d2239ac3c410 ---- /dev/null -+++ b/sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-body-parts-custom.phpt -@@ -0,0 +1,53 @@ -+--TEST-- -+FPM: GHSA-54hq-v5wp-fqgv - max_multipart_body_parts ini custom value -+--SKIPIF-- -+<?php include "skipif.inc"; ?> -+--FILE-- -+<?php -+ -+require_once "tester.inc"; -+ -+$cfg = <<<EOT -+global -+error_log = {{FILE:LOG}} -+unconfined -+listen = {{ADDR}} -+pm = dynamic -+pm.max_children = 5 -+pm.start_servers = 1 -+pm.min_spare_servers = 1 -+pm.max_spare_servers = 3 -+php_admin_valuehtml_errors = false -+php_admin_valuemax_input_vars = 20 -+php_admin_valuemax_file_uploads = 5 -+php_admin_valuemax_multipart_body_parts = 10 -+php_flagdisplay_errors = On -+EOT; -+ -+$code = <<<EOT -+<?php -+var_dump(count(\$_POST)); -+EOT; -+ -+$tester = new FPM\Tester($cfg, $code); -+$tester->start(); -+$tester->expectLogStartNotices(); -+echo $tester -+ ->request(stdin: -+ 'parts' => -+ 'count' => 30, -+ -+ ) -+ ->getBody(); -+$tester->terminate(); -+$tester->close(); -+ -+?> -+--EXPECT-- -+Warning: Unknown: Multipart body parts limit exceeded 10. To increase the limit change max_multipart_body_parts in php.ini. in Unknown on line 0 -+int(10) -+--CLEAN-- -+<?php -+require_once "tester.inc"; -+FPM\Tester::clean(); -+?> -diff --git a/sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-body-parts-default.phpt b/sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-body-parts-default.phpt -new file mode 100644 -index 000000000000..42b5afbf9ee7 ---- /dev/null -+++ b/sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-body-parts-default.phpt -@@ -0,0 +1,54 @@ -+--TEST-- -+FPM: GHSA-54hq-v5wp-fqgv - max_multipart_body_parts ini default -+--SKIPIF-- -+<?php include "skipif.inc"; ?> -+--FILE-- -+<?php -+ -+require_once "tester.inc"; -+ -+$cfg = <<<EOT -+global -+error_log = {{FILE:LOG}} -+unconfined -+listen = {{ADDR}} -+pm = dynamic -+pm.max_children = 5 -+pm.start_servers = 1 -+pm.min_spare_servers = 1 -+pm.max_spare_servers = 3 -+php_admin_valuehtml_errors = false -+php_admin_valuemax_input_vars = 20 -+php_admin_valuemax_file_uploads = 5 -+php_flagdisplay_errors = On -+EOT; -+ -+$code = <<<EOT -+<?php -+var_dump(count(\$_POST)); -+EOT; -+ -+$tester = new FPM\Tester($cfg, $code); -+$tester->start(); -+$tester->expectLogStartNotices(); -+echo $tester -+ ->request(stdin: -+ 'parts' => -+ 'count' => 30, -+ -+ ) -+ ->getBody(); -+$tester->terminate(); -+$tester->close(); -+ -+?> -+--EXPECT-- -+Warning: Unknown: Input variables exceeded 20. To increase the limit change max_input_vars in php.ini. in Unknown on line 0 -+ -+Warning: Unknown: Multipart body parts limit exceeded 25. To increase the limit change max_multipart_body_parts in php.ini. in Unknown on line 0 -+int(20) -+--CLEAN-- -+<?php -+require_once "tester.inc"; -+FPM\Tester::clean(); -+?> -diff --git a/sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-file-uploads.phpt b/sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-file-uploads.phpt -new file mode 100644 -index 000000000000..da81174c7280 ---- /dev/null -+++ b/sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-file-uploads.phpt -@@ -0,0 +1,52 @@ -+--TEST-- -+FPM: GHSA-54hq-v5wp-fqgv - exceeding max_file_uploads
View file
php7-CVE-2023-0567-b.patch -> php7-CVE-2024-11233.patch
Changed
@@ -1,37 +1,31 @@ -From a92acbad873a05470af1a47cb785a18eadd827b5 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= <tim@bastelstu.be> -Date: Mon, 23 Jan 2023 22:13:57 +0100 -Subject: PATCH crypt: Fix possible buffer overread in php_crypt() - ---- - ext/standard/crypt.c | 1 + - ext/standard/tests/password/password_bcrypt_short.phpt | 8 ++++++++ - 2 files changed, 9 insertions(+) - create mode 100644 ext/standard/tests/password/password_bcrypt_short.phpt - -diff --git a/ext/standard/crypt.c b/ext/standard/crypt.c -index 8c105cf910e8..8316c8b96063 100644 ---- a/ext/standard/crypt.c -+++ b/ext/standard/crypt.c -@@ -135,6 +135,7 @@ PHPAPI zend_string *php_crypt(const char *password, const int pass_len, const ch - } else if ( - salt0 == '$' && - salt1 == '2' && -+ salt2 != 0 && - salt3 == '$') { - char outputPHP_MAX_SALT_LEN + 1; +Index: php-7.4.33/ext/standard/filters.c +=================================================================== +--- php-7.4.33.orig/ext/standard/filters.c ++++ php-7.4.33/ext/standard/filters.c +@@ -1128,6 +1128,9 @@ static php_conv_err_t php_conv_qprint_de + } break; + + case 5: { ++ if (icnt == 0) { ++ goto out; ++ } + if (!inst->lbchars && lb_cnt == 1 && *ps == '\n') { + /* auto-detect soft line breaks, found network line break */ + lb_cnt = lb_ptr = 0; +@@ -1141,15 +1144,13 @@ static php_conv_err_t php_conv_qprint_de + /* soft line break */ + lb_cnt = lb_ptr = 0; + scan_stat = 0; +- } else if (icnt > 0) { ++ } else { + if (*ps == (unsigned char)inst->lbcharslb_cnt) { + lb_cnt++; + ps++, icnt--; + } else { + scan_stat = 6; /* no break for short-cut */ + } +- } else { +- goto out; + } + } break; -diff --git a/ext/standard/tests/password/password_bcrypt_short.phpt b/ext/standard/tests/password/password_bcrypt_short.phpt -new file mode 100644 -index 000000000000..085bc8a23904 ---- /dev/null -+++ b/ext/standard/tests/password/password_bcrypt_short.phpt -@@ -0,0 +1,8 @@ -+--TEST-- -+Test that password_hash() does not overread buffers when a short hash is passed -+--FILE-- -+<?php -+var_dump(password_verify("foo", '$2')); -+?> -+--EXPECT-- -+bool(false)
View file
php7-CVE-2024-11234.patch
Added
@@ -0,0 +1,54 @@ +From 426a6d4539ebee34879ac5de857036bb6ff0e732 Mon Sep 17 00:00:00 2001 +From: Jakub Zelenka <bukka@php.net> +Date: Fri, 8 Nov 2024 23:43:47 +0100 +Subject: PATCH Fix GHSA-c5f2-jwm7-mmq2: stream HTTP fulluri CRLF injection + +--- + ext/standard/http_fopen_wrapper.c | 18 ++++++++---- + .../tests/http/ghsa-c5f2-jwm7-mmq2.phpt | 28 +++++++++++++++++++ + 2 files changed, 40 insertions(+), 6 deletions(-) + create mode 100644 ext/standard/tests/http/ghsa-c5f2-jwm7-mmq2.phpt + +Index: php-7.4.33/ext/standard/http_fopen_wrapper.c +=================================================================== +--- php-7.4.33.orig/ext/standard/http_fopen_wrapper.c ++++ php-7.4.33/ext/standard/http_fopen_wrapper.c +@@ -186,6 +186,11 @@ static php_stream *php_stream_url_wrap_h + return NULL; + } + ++ /* Should we send the entire path in the request line, default to no. */ ++ if (context && (tmpzval = php_stream_context_get_option(context, "http", "request_fulluri")) != NULL) { ++ request_fulluri = zend_is_true(tmpzval); ++ } ++ + use_ssl = resource->scheme && (ZSTR_LEN(resource->scheme) > 4) && ZSTR_VAL(resource->scheme)4 == 's'; + /* choose default ports */ + if (use_ssl && resource->port == 0) +@@ -205,6 +210,13 @@ static php_stream *php_stream_url_wrap_h + } + } + ++ if (request_fulluri && (strchr(path, '\n') != NULL || strchr(path, '\r') != NULL)) { ++ php_stream_wrapper_log_error(wrapper, options, "HTTP wrapper full URI path does not allow CR or LF characters"); ++ php_url_free(resource); ++ zend_string_release(transport_string); ++ return NULL; ++ } ++ + if (context && (tmpzval = php_stream_context_get_option(context, wrapper->wops->label, "timeout")) != NULL) { + double d = zval_get_double(tmpzval); + #ifndef PHP_WIN32 +@@ -385,12 +397,6 @@ finish: + smart_str_appends(&req_buf, "GET "); + } + +- /* Should we send the entire path in the request line, default to no. */ +- if (!request_fulluri && context && +- (tmpzval = php_stream_context_get_option(context, "http", "request_fulluri")) != NULL) { +- request_fulluri = zend_is_true(tmpzval); +- } +- + if (request_fulluri) { + /* Ask for everything */ + smart_str_appends(&req_buf, path);
View file
php7-CVE-2024-11235.patch
Added
@@ -0,0 +1,19 @@ +Index: php-7.4.33/Zend/zend_opcode.c +=================================================================== +--- php-7.4.33.orig/Zend/zend_opcode.c ++++ php-7.4.33/Zend/zend_opcode.c +@@ -780,6 +780,14 @@ static void zend_calc_live_ranges( + opnum--; + opline--; + ++ /* SEPARATE always redeclares its op1. For the purposes of live-ranges, ++ * its declaration is irrelevant. Don't terminate the current live-range ++ * to avoid breaking special handling of COPY_TMP. */ ++ if (opline->opcode == ZEND_SEPARATE) { ++ ZEND_ASSERT(opline->op1.var == opline->result.var); ++ continue; ++ } ++ + if ((opline->result_type & (IS_TMP_VAR|IS_VAR)) && !is_fake_def(opline)) { + uint32_t var_num = EX_VAR_TO_NUM(opline->result.var) - var_offset; + /* Defs without uses can occur for two reasons: Either because the result is
View file
php7-CVE-2024-8925.patch
Added
@@ -0,0 +1,18 @@ +Index: php-7.4.33/main/rfc1867.c +=================================================================== +--- php-7.4.33.orig/main/rfc1867.c ++++ php-7.4.33/main/rfc1867.c +@@ -759,6 +759,13 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ + boundary_len = boundary_end-boundary; + } + ++ /* Boundaries larger than FILLUNIT-strlen("\r\n--") characters lead to ++ * erroneous parsing */ ++ if (boundary_len > FILLUNIT-strlen("\r\n--")) { ++ sapi_module.sapi_error(E_WARNING, "Boundary too large in multipart/form-data POST data"); ++ return; ++ } ++ + /* Initialize the buffer */ + if (!(mbuff = multipart_buffer_new(boundary, boundary_len))) { + sapi_module.sapi_error(E_WARNING, "Unable to initialize the input buffer");
View file
php7-CVE-2024-8927.patch
Added
@@ -0,0 +1,34 @@ +Index: php-7.4.33/sapi/cgi/cgi_main.c +=================================================================== +--- php-7.4.33.orig/sapi/cgi/cgi_main.c ++++ php-7.4.33/sapi/cgi/cgi_main.c +@@ -1928,18 +1928,17 @@ int main(int argc, char *argv) + + /* check force_cgi after startup, so we have proper output */ + if (cgi && CGIG(force_redirect)) { +- /* Apache will generate REDIRECT_STATUS, +- * Netscape and redirect.so will generate HTTP_REDIRECT_STATUS. +- * redirect.so and installation instructions available from +- * http://www.koehntopp.de/php. +- * -- kk@netuse.de +- */ +- if (!getenv("REDIRECT_STATUS") && +- !getenv ("HTTP_REDIRECT_STATUS") && +- /* this is to allow a different env var to be configured +- * in case some server does something different than above */ +- (!CGIG(redirect_status_env) || !getenv(CGIG(redirect_status_env))) +- ) { ++ /* This is to allow a different environment variable to be configured ++ * in case the we cannot auto-detect which environment variable to use. ++ * Checking this first to allow user overrides in case the environment ++ * variable can be set by an untrusted party. */ ++ const char *redirect_status_env = CGIG(redirect_status_env); ++ if (!redirect_status_env) { ++ /* Apache will generate REDIRECT_STATUS. */ ++ redirect_status_env = "REDIRECT_STATUS"; ++ } ++ ++ if (!getenv(redirect_status_env)) { + zend_try { + SG(sapi_headers).http_response_code = 400; + PUTS("<b>Security Alert!</b> The PHP CGI cannot be accessed directly.\n\n\
View file
php7-CVE-2024-8929.patch
Added
@@ -0,0 +1,283 @@ +Index: php-7.4.33/ext/mysqlnd/mysqlnd_ps_codec.c +=================================================================== +--- php-7.4.33.orig/ext/mysqlnd/mysqlnd_ps_codec.c ++++ php-7.4.33/ext/mysqlnd/mysqlnd_ps_codec.c +@@ -52,11 +52,45 @@ struct st_mysqlnd_perm_bind mysqlnd_ps_f + #define MYSQLND_PS_SKIP_RESULT_W_LEN -1 + #define MYSQLND_PS_SKIP_RESULT_STR -2 + ++static inline void ps_fetch_over_read_error(const zend_uchar ** row) ++{ ++ php_error_docref(NULL, E_WARNING, "Malformed server packet. Field length pointing after the end of packet"); ++ *row = NULL; ++} ++ ++static inline int ps_fetch_is_packet_over_read_with_variable_length(const unsigned int pack_len, ++ const zend_uchar ** row, const zend_uchar *p, unsigned int length) ++{ ++ if (pack_len == 0) { ++ return 0; ++ } ++ size_t length_len = *row - p; ++ if (length_len > pack_len || length > pack_len - length_len) { ++ ps_fetch_over_read_error(row); ++ return 1; ++ } ++ return 0; ++} ++ ++static inline int ps_fetch_is_packet_over_read_with_static_length(const unsigned int pack_len, ++ const zend_uchar ** row, unsigned int length) ++{ ++ if (pack_len > 0 && length > pack_len) { ++ ps_fetch_over_read_error(row); ++ return 1; ++ } ++ return 0; ++} ++ + /* {{{ ps_fetch_from_1_to_8_bytes */ + void + ps_fetch_from_1_to_8_bytes(zval * zv, const MYSQLND_FIELD * const field, const unsigned int pack_len, + const zend_uchar ** row, unsigned int byte_count) + { ++ if (UNEXPECTED(ps_fetch_is_packet_over_read_with_static_length(pack_len, row, byte_count))) { ++ return; ++ } ++ + char tmp22; + size_t tmp_len = 0; + zend_bool is_bit = field->type == MYSQL_TYPE_BIT; +@@ -178,6 +212,11 @@ ps_fetch_float(zval * zv, const MYSQLND_ + float fval; + double dval; + DBG_ENTER("ps_fetch_float"); ++ ++ if (UNEXPECTED(ps_fetch_is_packet_over_read_with_static_length(pack_len, row, 4))) { ++ return; ++ } ++ + float4get(fval, *row); + (*row)+= 4; + DBG_INF_FMT("value=%f", fval); +@@ -200,6 +239,11 @@ ps_fetch_double(zval * zv, const MYSQLND + { + double value; + DBG_ENTER("ps_fetch_double"); ++ ++ if (UNEXPECTED(ps_fetch_is_packet_over_read_with_static_length(pack_len, row, 8))) { ++ return; ++ } ++ + float8get(value, *row); + ZVAL_DOUBLE(zv, value); + (*row)+= 8; +@@ -216,9 +260,14 @@ ps_fetch_time(zval * zv, const MYSQLND_F + struct st_mysqlnd_time t; + zend_ulong length; /* First byte encodes the length*/ + char * value; ++ const zend_uchar *p = *row; + DBG_ENTER("ps_fetch_time"); + + if ((length = php_mysqlnd_net_field_length(row))) { ++ if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) { ++ return; ++ } ++ + const zend_uchar * to = *row; + + t.time_type = MYSQLND_TIMESTAMP_TIME; +@@ -273,9 +322,14 @@ ps_fetch_date(zval * zv, const MYSQLND_F + struct st_mysqlnd_time t = {0}; + zend_ulong length; /* First byte encodes the length*/ + char * value; ++ const zend_uchar *p = *row; + DBG_ENTER("ps_fetch_date"); + + if ((length = php_mysqlnd_net_field_length(row))) { ++ if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) { ++ return; ++ } ++ + const zend_uchar * to = *row; + + t.time_type = MYSQLND_TIMESTAMP_DATE; +@@ -310,9 +364,14 @@ ps_fetch_datetime(zval * zv, const MYSQL + struct st_mysqlnd_time t; + zend_ulong length; /* First byte encodes the length*/ + char * value; ++ const zend_uchar *p = *row; + DBG_ENTER("ps_fetch_datetime"); + + if ((length = php_mysqlnd_net_field_length(row))) { ++ if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) { ++ return; ++ } ++ + const zend_uchar * to = *row; + + t.time_type = MYSQLND_TIMESTAMP_DATETIME; +@@ -371,7 +430,11 @@ ps_fetch_string(zval * zv, const MYSQLND + For now just copy, before we make it possible + to write \0 to the row buffer + */ ++ const zend_uchar *p = *row; + const zend_ulong length = php_mysqlnd_net_field_length(row); ++ if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) { ++ return; ++ } + DBG_ENTER("ps_fetch_string"); + DBG_INF_FMT("len = %lu", length); + DBG_INF("copying from the row buffer"); +@@ -387,7 +450,11 @@ ps_fetch_string(zval * zv, const MYSQLND + static void + ps_fetch_bit(zval * zv, const MYSQLND_FIELD * const field, const unsigned int pack_len, const zend_uchar ** row) + { ++ const zend_uchar *p = *row; + const zend_ulong length = php_mysqlnd_net_field_length(row); ++ if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) { ++ return; ++ } + ps_fetch_from_1_to_8_bytes(zv, field, pack_len, row, length); + } + /* }}} */ +Index: php-7.4.33/ext/mysqlnd/mysqlnd_result.c +=================================================================== +--- php-7.4.33.orig/ext/mysqlnd/mysqlnd_result.c ++++ php-7.4.33/ext/mysqlnd/mysqlnd_result.c +@@ -505,7 +505,7 @@ mysqlnd_query_read_result_set_header(MYS + if (FAIL == (ret = result->m.read_result_metadata(result, conn))) { + /* For PS, we leave them in Prepared state */ + if (!stmt && conn->current_result) { +- mnd_efree(conn->current_result); ++ conn->current_result->m.free_result(conn->current_result, TRUE); + conn->current_result = NULL; + } + DBG_ERR("Error occurred while reading metadata"); +Index: php-7.4.33/ext/mysqlnd/mysqlnd_wireprotocol.c +=================================================================== +--- php-7.4.33.orig/ext/mysqlnd/mysqlnd_wireprotocol.c ++++ php-7.4.33/ext/mysqlnd/mysqlnd_wireprotocol.c +@@ -715,7 +715,14 @@ php_mysqlnd_auth_response_read(MYSQLND_C + + /* There is a message */ + if (packet->header.size > (size_t) (p - buf) && (net_len = php_mysqlnd_net_field_length(&p))) { +- packet->message_len = MIN(net_len, buf_len - (p - begin)); ++ /* p can get past packet size when getting field length so it needs to be checked first ++ * and after that it can be checked that the net_len is not greater than the packet size */ ++ if ((p - buf) > packet->header.size || packet->header.size - (p - buf) < net_len) { ++ DBG_ERR_FMT("OK packet message length is past the packet size"); ++ php_error_docref(NULL, E_WARNING, "OK packet message length is past the packet size"); ++ DBG_RETURN(FAIL); ++ } ++ packet->message_len = net_len; + packet->message = mnd_pestrndup((char *)p, packet->message_len, FALSE); + } else { + packet->message = NULL; +@@ -1113,6 +1120,17 @@ php_mysqlnd_rset_header_read(MYSQLND_CON + BAIL_IF_NO_MORE_DATA; + /* Check for additional textual data */ + if (packet->header.size > (size_t) (p - buf) && (len = php_mysqlnd_net_field_length(&p))) { ++ /* p can get past packet size when getting field length so it needs to be checked first ++ * and after that it can be checked that the len is not greater than the packet size */ ++ if ((p - buf) > packet->header.size || packet->header.size - (p - buf) < len) { ++ size_t local_file_name_over_read = ((p - buf) - packet->header.size) + len; ++ DBG_ERR_FMT("RSET_HEADER packet additional data length is past %zu bytes the packet size", ++ local_file_name_over_read); ++ php_error_docref(NULL, E_WARNING, ++ "RSET_HEADER packet additional data length is past %zu bytes the packet size", ++ local_file_name_over_read); ++ DBG_RETURN(FAIL); ++ } + packet->info_or_local_file.s = mnd_emalloc(len + 1); + if (packet->info_or_local_file.s) { + memcpy(packet->info_or_local_file.s, p, len); +@@ -1272,22 +1290,16 @@ php_mysqlnd_rset_field_read(MYSQLND_CONN + } + + +- /*
View file
php7-CVE-2024-9026.patch
Added
@@ -0,0 +1,13 @@ +Index: php-7.4.33/sapi/fpm/fpm/fpm_stdio.c +=================================================================== +--- php-7.4.33.orig/sapi/fpm/fpm/fpm_stdio.c ++++ php-7.4.33/sapi/fpm/fpm/fpm_stdio.c +@@ -177,7 +177,7 @@ stdio_read: + if ((sizeof(FPM_STDIO_CMD_FLUSH) - cmd_pos) <= in_buf && + !memcmp(buf, &FPM_STDIO_CMD_FLUSHcmd_pos, sizeof(FPM_STDIO_CMD_FLUSH) - cmd_pos)) { + zlog_stream_finish(log_stream); +- start = cmd_pos; ++ start = sizeof(FPM_STDIO_CMD_FLUSH) - cmd_pos; + } else { + zlog_stream_str(log_stream, &FPM_STDIO_CMD_FLUSH0, cmd_pos); + }
View file
php7-CVE-2025-1217.patch
Added
@@ -0,0 +1,483 @@ +Index: php-7.4.33/ext/standard/http_fopen_wrapper.c +=================================================================== +--- php-7.4.33.orig/ext/standard/http_fopen_wrapper.c ++++ php-7.4.33/ext/standard/http_fopen_wrapper.c +@@ -30,6 +30,7 @@ + + #include <stdio.h> + #include <stdlib.h> ++#include <stdbool.h> + #include <errno.h> + #include <sys/types.h> + #include <sys/stat.h> +@@ -82,6 +83,22 @@ + #define HTTP_WRAPPER_HEADER_INIT 1 + #define HTTP_WRAPPER_REDIRECTED 2 + ++zend_string *zend_string_concat3( ++ const char *str1, size_t str1_len, ++ const char *str2, size_t str2_len, ++ const char *str3, size_t str3_len) ++{ ++ size_t len = str1_len + str2_len + str3_len; ++ zend_string *res = zend_string_alloc(len, 0); ++ ++ memcpy(ZSTR_VAL(res), str1, str1_len); ++ memcpy(ZSTR_VAL(res) + str1_len, str2, str2_len); ++ memcpy(ZSTR_VAL(res) + str1_len + str2_len, str3, str3_len); ++ ZSTR_VAL(res)len = '\0'; ++ ++ return res; ++} ++ + static inline void strip_header(char *header_bag, char *lc_header_bag, + const char *lc_header_name) + { +@@ -116,6 +133,171 @@ static zend_bool check_has_header(const + return 0; + } + ++typedef struct _php_stream_http_response_header_info { ++ php_stream_filter *transfer_encoding; ++ size_t file_size; ++ bool follow_location; ++ char locationHTTP_HEADER_BLOCK_SIZE; ++} php_stream_http_response_header_info; ++ ++static void php_stream_http_response_header_info_init( ++ php_stream_http_response_header_info *header_info) ++{ ++ header_info->transfer_encoding = NULL; ++ header_info->file_size = 0; ++ header_info->follow_location = 1; ++ header_info->location0 = '\0'; ++} ++ ++/* Trim white spaces from response header line and update its length */ ++static bool php_stream_http_response_header_trim(char *http_header_line, ++ size_t *http_header_line_length) ++{ ++ char *http_header_line_end = http_header_line + *http_header_line_length - 1; ++ while (http_header_line_end >= http_header_line && ++ (*http_header_line_end == '\n' || *http_header_line_end == '\r')) { ++ http_header_line_end--; ++ } ++ ++ /* The primary definition of an HTTP header in RFC 7230 states: ++ * > Each header field consists of a case-insensitive field name followed ++ * > by a colon (":"), optional leading whitespace, the field value, and ++ * > optional trailing whitespace. */ ++ ++ /* Strip trailing whitespace */ ++ bool space_trim = (*http_header_line_end == ' ' || *http_header_line_end == '\t'); ++ if (space_trim) { ++ do { ++ http_header_line_end--; ++ } while (http_header_line_end >= http_header_line && ++ (*http_header_line_end == ' ' || *http_header_line_end == '\t')); ++ } ++ http_header_line_end++; ++ *http_header_line_end = '\0'; ++ *http_header_line_length = http_header_line_end - http_header_line; ++ ++ return space_trim; ++} ++ ++/* Process folding headers of the current line and if there are none, parse last full response ++ * header line. It returns NULL if the last header is finished, otherwise it returns updated ++ * last header line. */ ++static zend_string *php_stream_http_response_headers_parse(php_stream *stream, ++ php_stream_context *context, int options, zend_string *last_header_line_str, ++ char *header_line, size_t *header_line_length, int response_code, ++ zval *response_header, php_stream_http_response_header_info *header_info) ++{ ++ char *last_header_line = ZSTR_VAL(last_header_line_str); ++ size_t last_header_line_length = ZSTR_LEN(last_header_line_str); ++ char *last_header_line_end = ZSTR_VAL(last_header_line_str) + ZSTR_LEN(last_header_line_str) - 1; ++ ++ /* Process non empty header line. */ ++ if (header_line && (*header_line != '\n' && *header_line != '\r')) { ++ /* Removing trailing white spaces. */ ++ if (php_stream_http_response_header_trim(header_line, header_line_length) && ++ *header_line_length == 0) { ++ /* Only spaces so treat as an empty folding header. */ ++ return last_header_line_str; ++ } ++ ++ /* Process folding headers if starting with a space or a tab. */ ++ if (header_line && (*header_line == ' ' || *header_line == '\t')) { ++ char *http_folded_header_line = header_line; ++ size_t http_folded_header_line_length = *header_line_length; ++ /* Remove the leading white spaces. */ ++ while (*http_folded_header_line == ' ' || *http_folded_header_line == '\t') { ++ http_folded_header_line++; ++ http_folded_header_line_length--; ++ } ++ /* It has to have some characters because it would get returned after the call ++ * php_stream_http_response_header_trim above. */ ++ ZEND_ASSERT(http_folded_header_line_length > 0); ++ /* Concatenate last header line, space and current header line. */ ++ zend_string *extended_header_str = zend_string_concat3( ++ last_header_line, last_header_line_length, ++ " ", 1, ++ http_folded_header_line, http_folded_header_line_length); ++ zend_string_efree(last_header_line_str); ++ last_header_line_str = extended_header_str; ++ /* Return new header line. */ ++ return last_header_line_str; ++ } ++ } ++ ++ /* Find header separator position. */ ++ char *last_header_value = memchr(last_header_line, ':', last_header_line_length); ++ if (last_header_value) { ++ last_header_value++; /* Skip ':'. */ ++ ++ /* Strip leading whitespace. */ ++ while (last_header_value < last_header_line_end ++ && (*last_header_value == ' ' || *last_header_value == '\t')) { ++ last_header_value++; ++ } ++ } else { ++ /* There is no colon. Set the value to the end of the header line, which is effectively ++ * an empty string. */ ++ last_header_value = last_header_line_end; ++ } ++ ++ bool store_header = true; ++ zval *tmpzval = NULL; ++ ++ if (!strncasecmp(last_header_line, "Location:", sizeof("Location:")-1)) { ++ /* Check if the location should be followed. */ ++ if (context && (tmpzval = php_stream_context_get_option(context, "http", "follow_location")) != NULL) { ++ header_info->follow_location = zval_is_true(tmpzval); ++ } else if (!((response_code >= 300 && response_code < 304) ++ || 307 == response_code || 308 == response_code)) { ++ /* The redirection should not be automatic if follow_location is not set and ++ * response_code not in (300, 301, 302, 303 and 307) ++ * see http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3.1 ++ * RFC 7238 defines 308: http://tools.ietf.org/html/rfc7238 */ ++ header_info->follow_location = 0; ++ } ++ strlcpy(header_info->location, last_header_value, sizeof(header_info->location)); ++ } else if (!strncasecmp(last_header_line, "Content-Type:", sizeof("Content-Type:")-1)) { ++ php_stream_notify_info(context, PHP_STREAM_NOTIFY_MIME_TYPE_IS, last_header_value, 0); ++ } else if (!strncasecmp(last_header_line, "Content-Length:", sizeof("Content-Length:")-1)) { ++ header_info->file_size = atoi(last_header_value); ++ php_stream_notify_file_size(context, header_info->file_size, last_header_line, 0); ++ } else if ( ++ !strncasecmp(last_header_line, "Transfer-Encoding:", sizeof("Transfer-Encoding:")-1) ++ && !strncasecmp(last_header_value, "Chunked", sizeof("Chunked")-1) ++ ) { ++ /* Create filter to decode response body. */ ++ if (!(options & STREAM_ONLY_GET_HEADERS)) { ++ zend_long decode = 1; ++ ++ if (context && (tmpzval = php_stream_context_get_option(context, "http", "auto_decode")) != NULL) { ++ decode = zend_is_true(tmpzval); ++ } ++ if (decode) { ++ if (header_info->transfer_encoding != NULL) { ++ /* Prevent a memory leak in case there are more transfer-encoding headers. */ ++ php_stream_filter_free(header_info->transfer_encoding); ++ } ++ header_info->transfer_encoding = php_stream_filter_create( ++ "dechunk", NULL, php_stream_is_persistent(stream)); ++ if (header_info->transfer_encoding != NULL) { ++ /* Do not store transfer-encoding header. */ ++ store_header = false; ++ } ++ } ++ } ++ } ++ ++ if (store_header) { ++ zval http_header; ++ ZVAL_NEW_STR(&http_header, last_header_line_str); ++ zend_hash_next_index_insert(Z_ARRVAL_P(response_header), &http_header); ++ } else { ++ zend_string_efree(last_header_line_str);
View file
php7-CVE-2025-1218.patch
Added
@@ -0,0 +1,1027 @@ +From 114dbb74368e6a6cd6e48ddb4a76dbe8728b84e2 Mon Sep 17 00:00:00 2001 +From: Jakub Zelenka <bukka@php.net> +Date: Sun, 12 Jul 2026 23:37:54 +0200 +Subject: PATCH Fix GHSA-r6x9-5r99-36j7: Various packet overreads in mysqlnd + wireprotocol + +Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com> +Index: php-7.4.33/ext/mysqlnd/mysqlnd_ps.c +=================================================================== +--- php-7.4.33.orig/ext/mysqlnd/mysqlnd_ps.c ++++ php-7.4.33/ext/mysqlnd/mysqlnd_ps.c +@@ -373,6 +373,9 @@ mysqlnd_stmt_prepare_read_eof(MYSQLND_ST + if (FAIL == (ret = PACKET_READ(conn, &fields_eof))) { + if (stmt->result) { + stmt->result->m.free_result_contents(stmt->result); ++ /* The memset() below resets the statement, so release what it still owns first. */ ++ conn->m->free_reference(conn); ++ mnd_efree(stmt->execute_cmd_buffer.buffer); + /* XXX: This will crash, because we will null also the methods. + But seems it happens in extreme cases or doesn't. Should be fixed by exporting a function + (from mysqlnd_driver.c?) to do the reset. +Index: php-7.4.33/ext/mysqlnd/mysqlnd_ps_codec.c +=================================================================== +--- php-7.4.33.orig/ext/mysqlnd/mysqlnd_ps_codec.c ++++ php-7.4.33/ext/mysqlnd/mysqlnd_ps_codec.c +@@ -65,7 +65,9 @@ static inline int ps_fetch_is_packet_ove + return 0; + } + size_t length_len = *row - p; +- if (length_len > pack_len || length > pack_len - length_len) { ++ /* This assert should never fire, otherwise we invoked UB earlier */ ++ ZEND_ASSERT(length_len <= pack_len); ++ if (length > pack_len - length_len) { + ps_fetch_over_read_error(row); + return 1; + } +@@ -159,6 +161,18 @@ ps_fetch_from_1_to_8_bytes(zval * zv, co + } + /* }}} */ + ++/* The declared length has to cover the fixed offsets that the field type reads. */ ++static inline zend_bool ps_fetch_is_length_too_short(const zend_uchar ** row, const zend_ulong length, ++ const unsigned int min_length) ++{ ++ if (UNEXPECTED(length < min_length)) { ++ php_error_docref(NULL, E_WARNING, "Malformed server packet. Field length is too short for the field type"); ++ *row = NULL; ++ return 1; ++ } ++ return 0; ++} ++ + + /* {{{ ps_fetch_null */ + static void +@@ -263,11 +277,15 @@ ps_fetch_time(zval * zv, const MYSQLND_F + const zend_uchar *p = *row; + DBG_ENTER("ps_fetch_time"); + +- if ((length = php_mysqlnd_net_field_length(row))) { ++ if ((length = php_mysqlnd_net_field_length(row, pack_len))) { + if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) { + return; + } + ++ if (UNEXPECTED(ps_fetch_is_length_too_short(row, length, 8))) { ++ return; ++ } ++ + const zend_uchar * to = *row; + + t.time_type = MYSQLND_TIMESTAMP_TIME; +@@ -277,7 +295,7 @@ ps_fetch_time(zval * zv, const MYSQLND_F + t.hour = (unsigned int) to5; + t.minute = (unsigned int) to6; + t.second = (unsigned int) to7; +- t.second_part = (length > 8) ? (zend_ulong) sint4korr(to+8) : 0; ++ t.second_part = (length >= 12) ? (zend_ulong) sint4korr(to+8) : 0; + t.year = t.month= 0; + if (t.day) { + /* Convert days to hours at once */ +@@ -325,11 +343,15 @@ ps_fetch_date(zval * zv, const MYSQLND_F + const zend_uchar *p = *row; + DBG_ENTER("ps_fetch_date"); + +- if ((length = php_mysqlnd_net_field_length(row))) { ++ if ((length = php_mysqlnd_net_field_length(row, pack_len))) { + if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) { + return; + } + ++ if (UNEXPECTED(ps_fetch_is_length_too_short(row, length, 4))) { ++ return; ++ } ++ + const zend_uchar * to = *row; + + t.time_type = MYSQLND_TIMESTAMP_DATE; +@@ -341,7 +363,7 @@ ps_fetch_date(zval * zv, const MYSQLND_F + t.month = (unsigned int) to2; + t.day = (unsigned int) to3; + +- (*row)+= length; ++ (*row) += length; + } else { + memset(&t, 0, sizeof(t)); + t.time_type = MYSQLND_TIMESTAMP_DATE; +@@ -367,11 +389,15 @@ ps_fetch_datetime(zval * zv, const MYSQL + const zend_uchar *p = *row; + DBG_ENTER("ps_fetch_datetime"); + +- if ((length = php_mysqlnd_net_field_length(row))) { ++ if ((length = php_mysqlnd_net_field_length(row, pack_len))) { + if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) { + return; + } + ++ if (UNEXPECTED(ps_fetch_is_length_too_short(row, length, 4))) { ++ return; ++ } ++ + const zend_uchar * to = *row; + + t.time_type = MYSQLND_TIMESTAMP_DATETIME; +@@ -381,16 +407,16 @@ ps_fetch_datetime(zval * zv, const MYSQL + t.month = (unsigned int) to2; + t.day = (unsigned int) to3; + +- if (length > 4) { ++ if (length >= 7) { + t.hour = (unsigned int) to4; + t.minute = (unsigned int) to5; + t.second = (unsigned int) to6; + } else { + t.hour = t.minute = t.second= 0; + } +- t.second_part = (length > 7) ? (zend_ulong) sint4korr(to+7) : 0; ++ t.second_part = (length >= 11) ? (zend_ulong) sint4korr(to+7) : 0; + +- (*row)+= length; ++ (*row) += length; + } else { + memset(&t, 0, sizeof(t)); + t.time_type = MYSQLND_TIMESTAMP_DATETIME; +@@ -431,7 +457,7 @@ ps_fetch_string(zval * zv, const MYSQLND + to write \0 to the row buffer + */ + const zend_uchar *p = *row; +- const zend_ulong length = php_mysqlnd_net_field_length(row); ++ const zend_ulong length = php_mysqlnd_net_field_length(row, pack_len); + if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) { + return; + } +@@ -451,7 +477,7 @@ static void + ps_fetch_bit(zval * zv, const MYSQLND_FIELD * const field, const unsigned int pack_len, const zend_uchar ** row) + { + const zend_uchar *p = *row; +- const zend_ulong length = php_mysqlnd_net_field_length(row); ++ const zend_ulong length = php_mysqlnd_net_field_length(row, pack_len); + if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) { + return; + } +Index: php-7.4.33/ext/mysqlnd/mysqlnd_wireprotocol.c +=================================================================== +--- php-7.4.33.orig/ext/mysqlnd/mysqlnd_wireprotocol.c ++++ php-7.4.33/ext/mysqlnd/mysqlnd_wireprotocol.c +@@ -26,11 +26,18 @@ + #include "mysqlnd_statistics.h" + #include "mysqlnd_debug.h" + +-#define BAIL_IF_NO_MORE_DATA \ +- if (UNEXPECTED((size_t)(p - begin) > packet->header.size)) { \ ++#define BAIL_PREMATURE_END do { \ + php_error_docref(NULL, E_WARNING, "Premature end of data (mysqlnd_wireprotocol.c:%u)", __LINE__); \ + goto premature_end; \ +- } \ ++ } while (0) ++ ++/* Bail out unless the packet still has the required number of bytes left to read. */ ++#define BAIL_IF_NOT_ENOUGH_DATA_EX(min_required_bytes) \ ++ if (UNEXPECTED((size_t)(p - begin) + (min_required_bytes) > packet->header.size)) { \ ++ BAIL_PREMATURE_END; \ ++ } ++ ++#define BAIL_IF_NOT_ENOUGH_DATA BAIL_IF_NOT_ENOUGH_DATA_EX(1) + + + static const char *unknown_sqlstate= "HY000"; +@@ -92,10 +99,14 @@ static enum_mysqlnd_collected_stats pack + /* {{{ php_mysqlnd_net_field_length + Get next field's length */ + zend_ulong +-php_mysqlnd_net_field_length(const zend_uchar **packet) ++php_mysqlnd_net_field_length(const zend_uchar **packet, size_t remaining_size) + { + register const zend_uchar *p= (const zend_uchar *)*packet; + ++ if (UNEXPECTED(remaining_size == 0)) { ++ return MYSQLND_INVALID_NET_FIELD_LENGTH;
View file
php7-CVE-2025-1219.patch
Added
@@ -0,0 +1,89 @@ +Index: php-7.4.33/ext/libxml/libxml.c +=================================================================== +--- php-7.4.33.orig/ext/libxml/libxml.c ++++ php-7.4.33/ext/libxml/libxml.c +@@ -420,42 +420,53 @@ php_libxml_input_buffer_create_filename( + if (Z_TYPE(s->wrapperdata) == IS_ARRAY) { + zval *header; + +- ZEND_HASH_FOREACH_VAL_IND(Z_ARRVAL(s->wrapperdata), header) { ++ /* Scan backwards: The header array might contain the headers for multiple responses, if ++ * a redirect was followed. ++ */ ++ ZEND_HASH_REVERSE_FOREACH_VAL_IND(Z_ARRVAL(s->wrapperdata), header) { + const char buf = "Content-Type:"; +- if (Z_TYPE_P(header) == IS_STRING && +- !zend_binary_strncasecmp(Z_STRVAL_P(header), Z_STRLEN_P(header), buf, sizeof(buf)-1, sizeof(buf)-1)) { +- char *needle = estrdup("charset="); +- char *haystack = estrndup(Z_STRVAL_P(header), Z_STRLEN_P(header)); +- char *encoding = php_stristr(haystack, needle, Z_STRLEN_P(header), sizeof("charset=")-1); ++ if (Z_TYPE_P(header) == IS_STRING) { ++ /* If no colon is found in the header, we assume it's the HTTP status line and bail out. */ ++ char *colon = memchr(Z_STRVAL_P(header), ':', Z_STRLEN_P(header)); ++ char *space = memchr(Z_STRVAL_P(header), ' ', Z_STRLEN_P(header)); ++ if (colon == NULL || space < colon) { ++ break; ++ } ++ ++ if (!zend_binary_strncasecmp(Z_STRVAL_P(header), Z_STRLEN_P(header), buf, sizeof(buf)-1, sizeof(buf)-1)) { ++ char *needle = estrdup("charset="); ++ char *haystack = estrndup(Z_STRVAL_P(header), Z_STRLEN_P(header)); ++ char *encoding = php_stristr(haystack, needle, Z_STRLEN_P(header), sizeof("charset=")-1); + +- if (encoding) { +- char *end; ++ if (encoding) { ++ char *end; + +- encoding += sizeof("charset=")-1; +- if (*encoding == '"') { +- encoding++; +- } +- end = strchr(encoding, ';'); +- if (end == NULL) { +- end = encoding + strlen(encoding); +- } +- end--; /* end == encoding-1 isn't a buffer underrun */ +- while (*end == ' ' || *end == '\t') { +- end--; +- } +- if (*end == '"') { +- end--; +- } +- if (encoding >= end) continue; +- *(end+1) = '\0'; +- enc = xmlParseCharEncoding(encoding); +- if (enc <= XML_CHAR_ENCODING_NONE) { +- enc = XML_CHAR_ENCODING_NONE; ++ encoding += sizeof("charset=")-1; ++ if (*encoding == '"') { ++ encoding++; ++ } ++ end = strchr(encoding, ';'); ++ if (end == NULL) { ++ end = encoding + strlen(encoding); ++ } ++ end--; /* end == encoding-1 isn't a buffer underrun */ ++ while (*end == ' ' || *end == '\t') { ++ end--; ++ } ++ if (*end == '"') { ++ end--; ++ } ++ if (encoding >= end) continue; ++ *(end+1) = '\0'; ++ enc = xmlParseCharEncoding(encoding); ++ if (enc <= XML_CHAR_ENCODING_NONE) { ++ enc = XML_CHAR_ENCODING_NONE; ++ } + } ++ efree(haystack); ++ efree(needle); ++ break; /* found content-type */ + } +- efree(haystack); +- efree(needle); +- break; /* found content-type */ + } + } ZEND_HASH_FOREACH_END(); + }
View file
php7-CVE-2025-1220.patch
Added
@@ -0,0 +1,89 @@ +From 27e67cc3712ce0bc94fd4b2bfbb7155d89ec52d6 Mon Sep 17 00:00:00 2001 +From: Jakub Zelenka <bukka@php.net> +Date: Thu, 10 Apr 2025 15:15:36 +0200 +Subject: PATCH Fix GHSA-3cr5-j632-f35r: Null byte in hostnames + +This fixes stream_socket_client() and fsockopen(). + +Specifically it adds a check to parse_ip_address_ex and it also makes +sure that the \0 is not ignored in fsockopen() hostname formatting. +--- + ext/standard/fsock.c | 27 +++++++++++++++++-- + .../tests/network/ghsa-3cr5-j632-f35r.phpt | 21 +++++++++++++++ + .../tests/streams/ghsa-3cr5-j632-f35r.phpt | 26 ++++++++++++++++++ + main/streams/xp_socket.c | 9 ++++--- + 4 files changed, 78 insertions(+), 5 deletions(-) + create mode 100644 ext/standard/tests/network/ghsa-3cr5-j632-f35r.phpt + create mode 100644 ext/standard/tests/streams/ghsa-3cr5-j632-f35r.phpt + +Index: php-7.4.33/ext/standard/fsock.c +=================================================================== +--- php-7.4.33.orig/ext/standard/fsock.c ++++ php-7.4.33/ext/standard/fsock.c +@@ -25,6 +25,28 @@ + #include "php_network.h" + #include "file.h" + ++static size_t php_fsockopen_format_host_port(char **message, const char *prefix, size_t prefix_len, ++ const char *host, size_t host_len, zend_long port) ++{ ++ char portbuf32; ++ int portlen = snprintf(portbuf, sizeof(portbuf), ":" ZEND_LONG_FMT, port); ++ size_t total_len = prefix_len + host_len + portlen; ++ ++ char *result = emalloc(total_len + 1); ++ ++ if (prefix_len > 0) { ++ memcpy(result, prefix, prefix_len); ++ } ++ memcpy(result + prefix_len, host, host_len); ++ memcpy(result + prefix_len + host_len, portbuf, portlen); ++ ++ resulttotal_len = '\0'; ++ ++ *message = result; ++ ++ return total_len; ++} ++ + /* {{{ php_fsockopen() */ + + static void php_fsockopen_stream(INTERNAL_FUNCTION_PARAMETERS, int persistent) +@@ -59,11 +81,12 @@ static void php_fsockopen_stream(INTERNA + ZEND_PARSE_PARAMETERS_END_EX(RETURN_FALSE); + + if (persistent) { +- spprintf(&hashkey, 0, "pfsockopen__%s:" ZEND_LONG_FMT, host, port); ++ php_fsockopen_format_host_port(&hashkey, "pfsockopen__", strlen("pfsockopen__"), host, ++ host_len, port); + } + + if (port > 0) { +- hostname_len = spprintf(&hostname, 0, "%s:" ZEND_LONG_FMT, host, port); ++ hostname_len = php_fsockopen_format_host_port(&hostname, "", 0, host, host_len, port); + } else { + hostname_len = host_len; + hostname = host; +Index: php-7.4.33/main/streams/xp_socket.c +=================================================================== +--- php-7.4.33.orig/main/streams/xp_socket.c ++++ php-7.4.33/main/streams/xp_socket.c +@@ -580,12 +580,15 @@ static inline char *parse_ip_address_ex( + char *colon; + char *host = NULL; + +-#ifdef HAVE_IPV6 +- char *p; ++ if (memchr(str, '\0', str_len)) { ++ *err = strpprintf(0, "The hostname must not contain null bytes", str); ++ return NULL; ++ } + ++#ifdef HAVE_IPV6 + if (*(str) == '' && str_len > 1) { + /* IPV6 notation to specify raw address with port (i.e. fe80::1:80) */ +- p = memchr(str + 1, '', str_len - 2); ++ char *p = memchr(str + 1, '', str_len - 2); + if (!p || *(p + 1) != ':') { + if (get_err) { + *err = strpprintf(0, "Failed to parse IPv6 address \"%s\"", str);
View file
php7-CVE-2025-14178.patch
Added
@@ -0,0 +1,25 @@ +Index: php-7.4.33/ext/standard/array.c +=================================================================== +--- php-7.4.33.orig/ext/standard/array.c ++++ php-7.4.33/ext/standard/array.c +@@ -3813,7 +3813,7 @@ static zend_always_inline void php_array + int argc, i; + zval *src_entry; + HashTable *src, *dest; +- uint32_t count = 0; ++ uint64_t count = 0; + + ZEND_PARSE_PARAMETERS_START(0, -1) + Z_PARAM_VARIADIC('+', args, argc) +@@ -3833,6 +3833,11 @@ static zend_always_inline void php_array + count += zend_hash_num_elements(Z_ARRVAL_P(arg)); + } + ++ if (UNEXPECTED(count >= HT_MAX_SIZE)) { ++ zend_throw_error(NULL, "The total number of elements must be lower than %u", HT_MAX_SIZE); ++ RETURN_NULL(); ++ } ++ + if (argc == 2) { + zval *ret = NULL; +
View file
php7-CVE-2025-14181.patch
Added
@@ -0,0 +1,83 @@ +From e01f6fad9f4d10d3cda37a07f6e5d1619944dafc Mon Sep 17 00:00:00 2001 +From: Nora Dossche <7771979+ndossche@users.noreply.github.com> +Date: Sun, 13 Sep 2026 18:30:55 +0200 +Subject: PATCH Fix GHSA-cj93-vc83-wgqv + +Co-authored-by: Jakub Zelenka <bukka@php.net> +--- + ext/soap/php_http.c | 19 ++- + ext/soap/tests/bugs/GHSA-cj93-vc83-wgqv.phpt | 155 +++++++++++++++++++ + 2 files changed, 167 insertions(+), 7 deletions(-) + create mode 100644 ext/soap/tests/bugs/GHSA-cj93-vc83-wgqv.phpt + +Index: php-7.4.33/ext/soap/php_http.c +=================================================================== +--- php-7.4.33.orig/ext/soap/php_http.c ++++ php-7.4.33/ext/soap/php_http.c +@@ -1135,7 +1135,7 @@ try_again: + char *t = ZSTR_VAL(phpurl->path); + char *p = strrchr(t, '/'); + if (p) { +- zend_string *s = zend_string_alloc((p - t) + ZSTR_LEN(new_url->path) + 2, 0); ++ zend_string *s = zend_string_safe_alloc(1, p - t, ZSTR_LEN(new_url->path) + 2, 0); + strncpy(ZSTR_VAL(s), t, (p - t) + 1); + ZSTR_VAL(s)(p - t) + 1 = 0; + strcat(ZSTR_VAL(s), ZSTR_VAL(new_url->path)); +@@ -1428,7 +1428,8 @@ static zend_string* get_http_body(php_st + { + zend_string *http_buf = NULL; + char *header; +- int header_close = close, header_chunked = 0, header_length = 0, http_buf_size = 0; ++ int header_close = close, header_chunked = 0, header_length = 0; ++ size_t http_buf_size = 0; + + if (!close) { + header = get_http_header_value(headers, "Connection: "); +@@ -1458,14 +1459,14 @@ static zend_string* get_http_body(php_st + done = FALSE; + + while (!done) { +- int buf_size = 0; ++ unsigned int buf_size = 0; + + php_stream_gets(stream, headerbuf, sizeof(headerbuf)); + if (sscanf(headerbuf, "%x", &buf_size) > 0 ) { + if (buf_size > 0) { + size_t len_size = 0; + +- if (http_buf_size + buf_size + 1 < 0) { ++ if (buf_size >= ZSTR_MAX_LEN - http_buf_size) { + if (http_buf) { + zend_string_release_ex(http_buf, 0); + } +@@ -1473,7 +1474,7 @@ static zend_string* get_http_body(php_st + } + + if (http_buf) { +- http_buf = zend_string_realloc(http_buf, http_buf_size + buf_size, 0); ++ http_buf = zend_string_safe_realloc(http_buf, 1, http_buf_size, buf_size, 0); + } else { + http_buf = zend_string_alloc(buf_size, 0); + } +@@ -1532,7 +1533,7 @@ static zend_string* get_http_body(php_st + } + + } else if (header_length) { +- if (header_length < 0 || header_length >= INT_MAX) { ++ if (header_length < 0 || header_length >= ZSTR_MAX_LEN) { + return NULL; + } + http_buf = zend_string_alloc(header_length, 0); +@@ -1547,7 +1548,11 @@ static zend_string* get_http_body(php_st + do { + ssize_t len_read; + if (http_buf) { +- http_buf = zend_string_realloc(http_buf, http_buf_size + 4096, 0); ++ if (UNEXPECTED(http_buf_size >= ZSTR_MAX_LEN - 4096)) { ++ zend_string_efree(http_buf); ++ return NULL; ++ } ++ http_buf = zend_string_realloc(http_buf, http_buf_size + 4096, 0); + } else { + http_buf = zend_string_alloc(4096, 0); + }
View file
php7-CVE-2025-1734.patch
Added
@@ -0,0 +1,126 @@ +From 0548c4c1756724a89ef8310709419b08aadb2b3b Mon Sep 17 00:00:00 2001 +From: Jakub Zelenka <bukka@php.net> +Date: Sun, 19 Jan 2025 17:49:53 +0100 +Subject: PATCH Fix GHSA-pcmh-g36c-qc44: http headers without colon +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The header line must contain colon otherwise it is invalid and it needs +to fail. + +Reviewed-by: Tim Düsterhus <tim@tideways-gmbh.com> +--- + ext/standard/http_fopen_wrapper.c | 51 ++++++++++++++----- + ext/standard/tests/http/bug47021.phpt | 22 ++++---- + ext/standard/tests/http/bug75535.phpt | 4 +- + .../tests/http/ghsa-pcmh-g36c-qc44-001.phpt | 51 +++++++++++++++++++ + .../tests/http/ghsa-pcmh-g36c-qc44-002.phpt | 51 +++++++++++++++++++ + 5 files changed, 154 insertions(+), 25 deletions(-) + create mode 100644 ext/standard/tests/http/ghsa-pcmh-g36c-qc44-001.phpt + create mode 100644 ext/standard/tests/http/ghsa-pcmh-g36c-qc44-002.phpt + +Index: php-7.4.33/ext/standard/http_fopen_wrapper.c +=================================================================== +--- php-7.4.33.orig/ext/standard/http_fopen_wrapper.c ++++ php-7.4.33/ext/standard/http_fopen_wrapper.c +@@ -136,6 +136,7 @@ static zend_bool check_has_header(const + typedef struct _php_stream_http_response_header_info { + php_stream_filter *transfer_encoding; + size_t file_size; ++ bool error; + bool follow_location; + char locationHTTP_HEADER_BLOCK_SIZE; + } php_stream_http_response_header_info; +@@ -145,6 +146,7 @@ static void php_stream_http_response_hea + { + header_info->transfer_encoding = NULL; + header_info->file_size = 0; ++ header_info->error = false; + header_info->follow_location = 1; + header_info->location0 = '\0'; + } +@@ -182,10 +184,11 @@ static bool php_stream_http_response_hea + /* Process folding headers of the current line and if there are none, parse last full response + * header line. It returns NULL if the last header is finished, otherwise it returns updated + * last header line. */ +-static zend_string *php_stream_http_response_headers_parse(php_stream *stream, +- php_stream_context *context, int options, zend_string *last_header_line_str, +- char *header_line, size_t *header_line_length, int response_code, +- zval *response_header, php_stream_http_response_header_info *header_info) ++static zend_string *php_stream_http_response_headers_parse(php_stream_wrapper *wrapper, ++ php_stream *stream, php_stream_context *context, int options, ++ zend_string *last_header_line_str, char *header_line, size_t *header_line_length, ++ int response_code, zval *response_header, ++ php_stream_http_response_header_info *header_info) + { + char *last_header_line = ZSTR_VAL(last_header_line_str); + size_t last_header_line_length = ZSTR_LEN(last_header_line_str); +@@ -227,6 +230,19 @@ static zend_string *php_stream_http_resp + /* Find header separator position. */ + char *last_header_value = memchr(last_header_line, ':', last_header_line_length); + if (last_header_value) { ++ /* Verify there is no space in header name */ ++ char *last_header_name = last_header_line + 1; ++ while (last_header_name < last_header_value) { ++ if (*last_header_name == ' ' || *last_header_name == '\t') { ++ header_info->error = true; ++ php_stream_wrapper_log_error(wrapper, options, ++ "HTTP invalid response format (space in header name)!"); ++ zend_string_efree(last_header_line_str); ++ return NULL; ++ } ++ ++last_header_name; ++ } ++ + last_header_value++; /* Skip ':'. */ + + /* Strip leading whitespace. */ +@@ -235,9 +251,12 @@ static zend_string *php_stream_http_resp + last_header_value++; + } + } else { +- /* There is no colon. Set the value to the end of the header line, which is effectively +- * an empty string. */ +- last_header_value = last_header_line_end; ++ /* There is no colon which means invalid response so error. */ ++ header_info->error = true; ++ php_stream_wrapper_log_error(wrapper, options, ++ "HTTP invalid response format (no colon in header line)!"); ++ zend_string_efree(last_header_line_str); ++ return NULL; + } + + bool store_header = true; +@@ -943,10 +962,16 @@ finish: + + if (last_header_line_str != NULL) { + /* Parse last header line. */ +- last_header_line_str = php_stream_http_response_headers_parse(stream, context, +- options, last_header_line_str, http_header_line, &http_header_line_length, +- response_code, response_header, &header_info); +- if (last_header_line_str != NULL) { ++ last_header_line_str = php_stream_http_response_headers_parse(wrapper, stream, ++ context, options, last_header_line_str, http_header_line, ++ &http_header_line_length, response_code, response_header, &header_info); ++ if (EXPECTED(last_header_line_str == NULL)) { ++ if (UNEXPECTED(header_info.error)) { ++ php_stream_close(stream); ++ stream = NULL; ++ goto out; ++ } ++ } else { + /* Folding header present so continue. */ + continue; + } +@@ -976,8 +1001,8 @@ finish: + + /* If the stream was closed early, we still want to process the last line to keep BC. */ + if (last_header_line_str != NULL) { +- php_stream_http_response_headers_parse(stream, context, options, last_header_line_str, +- NULL, NULL, response_code, response_header, &header_info); ++ php_stream_http_response_headers_parse(wrapper, stream, context, options, ++ last_header_line_str, NULL, NULL, response_code, response_header, &header_info); + } + + if (!reqok || (header_info.location0 != '\0' && header_info.follow_location)) {
View file
php7-CVE-2025-1735.patch
Added
@@ -0,0 +1,354 @@ +From a2cdff5583ad2bfe9a27fba71e2b1fc423296dc0 Mon Sep 17 00:00:00 2001 +From: Jakub Zelenka <bukka@php.net> +Date: Tue, 4 Mar 2025 17:23:01 +0100 +Subject: PATCH Fix GHSA-hrwm-9436-5mv3: pgsql escaping no error checks + +This adds error checks for escape function is pgsql and pdo_pgsql +extensions. It prevents possibility of storing not properly escaped +data which could potentially lead to some security issues. +--- + ext/pdo_pgsql/pgsql_driver.c | 10 +- + ext/pdo_pgsql/tests/ghsa-hrwm-9436-5mv3.phpt | 24 ++++ + ext/pgsql/pgsql.c | 126 ++++++++++++++++--- + ext/pgsql/tests/ghsa-hrwm-9436-5mv3.phpt | 64 ++++++++++ + 4 files changed, 203 insertions(+), 21 deletions(-) + create mode 100644 ext/pdo_pgsql/tests/ghsa-hrwm-9436-5mv3.phpt + create mode 100644 ext/pgsql/tests/ghsa-hrwm-9436-5mv3.phpt + +Index: php-7.4.33/ext/pdo_pgsql/pgsql_driver.c +=================================================================== +--- php-7.4.33.orig/ext/pdo_pgsql/pgsql_driver.c ++++ php-7.4.33/ext/pdo_pgsql/pgsql_driver.c +@@ -323,11 +323,15 @@ static int pgsql_handle_quoter(pdo_dbh_t + unsigned char *escaped; + pdo_pgsql_db_handle *H = (pdo_pgsql_db_handle *)dbh->driver_data; + size_t tmp_len; ++ int err; + + switch (paramtype) { + case PDO_PARAM_LOB: + /* escapedlen returned by PQescapeBytea() accounts for trailing 0 */ + escaped = PQescapeByteaConn(H->server, (unsigned char *)unquoted, unquotedlen, &tmp_len); ++ if (escaped == NULL) { ++ return NULL; ++ } + *quotedlen = tmp_len + 1; + *quoted = emalloc(*quotedlen + 1); + memcpy((*quoted)+1, escaped, *quotedlen-2); +@@ -339,7 +343,11 @@ static int pgsql_handle_quoter(pdo_dbh_t + default: + *quoted = safe_emalloc(2, unquotedlen, 3); + (*quoted)0 = '\''; +- *quotedlen = PQescapeStringConn(H->server, *quoted + 1, unquoted, unquotedlen, NULL); ++ *quotedlen = PQescapeStringConn(H->server, *quoted + 1, unquoted, unquotedlen, &err); ++ if (err) { ++ efree(quoted); ++ return NULL; ++ } + (*quoted)*quotedlen + 1 = '\''; + (*quoted)*quotedlen + 2 = '\0'; + *quotedlen += 2; +Index: php-7.4.33/ext/pgsql/pgsql.c +=================================================================== +--- php-7.4.33.orig/ext/pgsql/pgsql.c ++++ php-7.4.33/ext/pgsql/pgsql.c +@@ -4393,10 +4393,16 @@ PHP_FUNCTION(pg_escape_string) + to = zend_string_safe_alloc(ZSTR_LEN(from), 2, 0, 0); + #ifdef HAVE_PQESCAPE_CONN + if (link) { ++ int err; + if ((pgsql = (PGconn *)zend_fetch_resource2(link, "PostgreSQL link", le_link, le_plink)) == NULL) { + RETURN_FALSE; + } +- ZSTR_LEN(to) = PQescapeStringConn(pgsql, ZSTR_VAL(to), ZSTR_VAL(from), ZSTR_LEN(from), NULL); ++ ZSTR_LEN(to) = PQescapeStringConn(pgsql, ZSTR_VAL(to), ZSTR_VAL(from), ZSTR_LEN(from), &err); ++ if (err) { ++ zend_argument_value_error(ZEND_NUM_ARGS(), "Escaping string failed"); ++ zend_string_efree(to); ++ RETURN_THROWS(); ++ } + } else + #endif + { +@@ -4446,6 +4452,11 @@ PHP_FUNCTION(pg_escape_bytea) + #endif + to = (char *)PQescapeBytea((unsigned char*)from, from_len, &to_len); + ++ if (to == NULL) { ++ zend_argument_value_error(ZEND_NUM_ARGS(), "Escape failure"); ++ RETURN_THROWS(); ++ } ++ + RETVAL_STRINGL(to, to_len-1); /* to_len includes additional '\0' */ + PQfreemem(to); + } +@@ -5529,7 +5540,7 @@ PHP_PGSQL_API int php_pgsql_meta_data(PG + char *escaped; + smart_str querystr = {0}; + size_t new_len; +- int i, num_rows; ++ int i, num_rows, err; + zval elem; + + if (!*table_name) { +@@ -5570,7 +5581,14 @@ PHP_PGSQL_API int php_pgsql_meta_data(PG + "WHERE a.attnum > 0 AND c.relname = '"); + } + escaped = (char *)safe_emalloc(strlen(tmp_name2), 2, 1); +- new_len = PQescapeStringConn(pg_link, escaped, tmp_name2, strlen(tmp_name2), NULL); ++ new_len = PQescapeStringConn(pg_link, escaped, tmp_name2, strlen(tmp_name2), &err); ++ if (err) { ++ php_error_docref(NULL, E_WARNING, "Escaping table name '%s' failed", table_name); ++ efree(src); ++ efree(escaped); ++ smart_str_free(&querystr); ++ return FAILURE; ++ } + if (new_len) { + smart_str_appendl(&querystr, escaped, new_len); + } +@@ -5578,7 +5596,14 @@ PHP_PGSQL_API int php_pgsql_meta_data(PG + + smart_str_appends(&querystr, "' AND n.nspname = '"); + escaped = (char *)safe_emalloc(strlen(tmp_name), 2, 1); +- new_len = PQescapeStringConn(pg_link, escaped, tmp_name, strlen(tmp_name), NULL); ++ new_len = PQescapeStringConn(pg_link, escaped, tmp_name, strlen(tmp_name), &err); ++ if (err) { ++ php_error_docref(NULL, E_WARNING, "Escaping table namespace '%s' failed", table_name); ++ efree(src); ++ efree(escaped); ++ smart_str_free(&querystr); ++ return FAILURE; ++ } + if (new_len) { + smart_str_appendl(&querystr, escaped, new_len); + } +@@ -5850,7 +5875,7 @@ PHP_PGSQL_API int php_pgsql_convert(PGco + { + zend_string *field = NULL; + zval meta, *def, *type, *not_null, *has_default, *is_enum, *val, new_val; +- int err = 0, skip_field; ++ int err = 0, escape_err = 0, skip_field; + php_pgsql_data_type data_type; + + assert(pg_link != NULL); +@@ -6101,10 +6126,16 @@ PHP_PGSQL_API int php_pgsql_convert(PGco + /* PostgreSQL ignores \0 */ + str = zend_string_alloc(Z_STRLEN_P(val) * 2, 0); + /* better to use PGSQLescapeLiteral since PGescapeStringConn does not handle special \ */ +- ZSTR_LEN(str) = PQescapeStringConn(pg_link, ZSTR_VAL(str), Z_STRVAL_P(val), Z_STRLEN_P(val), NULL); +- str = zend_string_truncate(str, ZSTR_LEN(str), 0); +- ZVAL_NEW_STR(&new_val, str); +- php_pgsql_add_quotes(&new_val, 1); ++ ZSTR_LEN(str) = PQescapeStringConn(pg_link, ZSTR_VAL(str), ++ Z_STRVAL_P(val), Z_STRLEN_P(val), &escape_err); ++ if (escape_err) { ++ err = 1; ++ } else { ++ str = zend_string_truncate(str, ZSTR_LEN(str), 0); ++ ZVAL_NEW_STR(&new_val, str); ++ php_pgsql_add_quotes(&new_val, 1); ++ } ++ + } + break; + +@@ -6126,7 +6157,15 @@ PHP_PGSQL_API int php_pgsql_convert(PGco + } + PGSQL_CONV_CHECK_IGNORE(); + if (err) { +- php_error_docref(NULL, E_NOTICE, "Expects NULL, string, long or double value for PostgreSQL '%s' (%s)", Z_STRVAL_P(type), ZSTR_VAL(field)); ++ if (escape_err) { ++ php_error_docref(NULL, E_NOTICE, ++ "String value escaping failed for PostgreSQL '%s' (%s)", ++ Z_STRVAL_P(type), ZSTR_VAL(field)); ++ } else { ++ php_error_docref(NULL, E_NOTICE, ++ "Expects NULL, string, long or double value for PostgreSQL '%s' (%s)", ++ Z_STRVAL_P(type), ZSTR_VAL(field)); ++ } + } + break; + +@@ -6406,6 +6445,12 @@ PHP_PGSQL_API int php_pgsql_convert(PGco + #else + tmp = PQescapeBytea(Z_STRVAL_P(val), (unsigned char *)Z_STRLEN_P(val), &to_len); + #endif ++ if (tmp == NULL) { ++ php_error_docref(NULL, E_NOTICE, "Escaping value failed for %s field (%s)", Z_STRVAL_P(type), ZSTR_VAL(field)); ++ err = 1; ++ break; ++ } ++ + ZVAL_STRINGL(&new_val, (char *)tmp, to_len - 1); /* PQescapeBytea's to_len includes additional '\0' */ + PQfreemem(tmp); + php_pgsql_add_quotes(&new_val, 1); +@@ -6488,6 +6533,12 @@ PHP_PGSQL_API int php_pgsql_convert(PGco + zend_hash_update(Z_ARRVAL_P(result), field, &new_val); + } else { + char *escaped = PGSQLescapeIdentifier(pg_link, ZSTR_VAL(field), ZSTR_LEN(field)); ++ if (escaped == NULL) { ++ /* This cannot fail because of invalid string but only due to failed memory allocation */ ++ php_error_docref(NULL, E_NOTICE, "Escaping field '%s' failed", ZSTR_VAL(field)); ++ err = 1; ++ break; ++ } + add_assoc_zval(result, escaped, &new_val); + PGSQLfree(escaped); + } +@@ -6566,7 +6617,7 @@ static int do_exec(smart_str *querystr,
View file
php7-CVE-2025-1736.patch
Added
@@ -0,0 +1,13 @@ +Index: php-7.4.33/ext/standard/http_fopen_wrapper.c +=================================================================== +--- php-7.4.33.orig/ext/standard/http_fopen_wrapper.c ++++ php-7.4.33/ext/standard/http_fopen_wrapper.c +@@ -126,7 +126,7 @@ static inline void strip_header(char *he + static zend_bool check_has_header(const char *headers, const char *header) { + const char *s = headers; + while ((s = strstr(s, header))) { +- if (s == headers || *(s-1) == '\n') { ++ if (s == headers || (*(s-1) == '\n' && *(s-2) == '\r')) { + return 1; + } + s++;
View file
php7-CVE-2025-1861.patch
Added
@@ -0,0 +1,215 @@ +From ac1a054bb3eb5994a199e8b18cca28cbabf5943e Mon Sep 17 00:00:00 2001 +From: Jakub Zelenka <bukka@php.net> +Date: Tue, 4 Mar 2025 09:01:34 +0100 +Subject: PATCH Fix GHSA-52jp-hrpf-2jff: http redirect location truncation + +It converts the allocation of location to be on heap instead of stack +and errors if the location length is greater than 8086 bytes. +--- + ext/standard/http_fopen_wrapper.c | 87 ++++++++++++------- + .../tests/http/ghsa-52jp-hrpf-2jff-001.phpt | 58 +++++++++++++ + .../tests/http/ghsa-52jp-hrpf-2jff-002.phpt | 55 ++++++++++++ + 3 files changed, 168 insertions(+), 32 deletions(-) + create mode 100644 ext/standard/tests/http/ghsa-52jp-hrpf-2jff-001.phpt + create mode 100644 ext/standard/tests/http/ghsa-52jp-hrpf-2jff-002.phpt + +Index: php-7.4.33/ext/standard/http_fopen_wrapper.c +=================================================================== +--- php-7.4.33.orig/ext/standard/http_fopen_wrapper.c ++++ php-7.4.33/ext/standard/http_fopen_wrapper.c +@@ -70,15 +70,16 @@ + + #include "php_fopen_wrappers.h" + +-#define HTTP_HEADER_BLOCK_SIZE 1024 +-#define PHP_URL_REDIRECT_MAX 20 +-#define HTTP_HEADER_USER_AGENT 1 +-#define HTTP_HEADER_HOST 2 +-#define HTTP_HEADER_AUTH 4 +-#define HTTP_HEADER_FROM 8 +-#define HTTP_HEADER_CONTENT_LENGTH 16 +-#define HTTP_HEADER_TYPE 32 +-#define HTTP_HEADER_CONNECTION 64 ++#define HTTP_HEADER_BLOCK_SIZE 1024 ++#define HTTP_HEADER_MAX_LOCATION_SIZE 8182 /* 8192 - 10 (size of "Location: ") */ ++#define PHP_URL_REDIRECT_MAX 20 ++#define HTTP_HEADER_USER_AGENT 1 ++#define HTTP_HEADER_HOST 2 ++#define HTTP_HEADER_AUTH 4 ++#define HTTP_HEADER_FROM 8 ++#define HTTP_HEADER_CONTENT_LENGTH 16 ++#define HTTP_HEADER_TYPE 32 ++#define HTTP_HEADER_CONNECTION 64 + + #define HTTP_WRAPPER_HEADER_INIT 1 + #define HTTP_WRAPPER_REDIRECTED 2 +@@ -138,17 +139,15 @@ typedef struct _php_stream_http_response + size_t file_size; + bool error; + bool follow_location; +- char locationHTTP_HEADER_BLOCK_SIZE; ++ char *location; ++ size_t location_len; + } php_stream_http_response_header_info; + + static void php_stream_http_response_header_info_init( + php_stream_http_response_header_info *header_info) + { +- header_info->transfer_encoding = NULL; +- header_info->file_size = 0; +- header_info->error = false; ++ memset(header_info, 0, sizeof(php_stream_http_response_header_info)); + header_info->follow_location = 1; +- header_info->location0 = '\0'; + } + + /* Trim white spaces from response header line and update its length */ +@@ -274,7 +273,22 @@ static zend_string *php_stream_http_resp + * RFC 7238 defines 308: http://tools.ietf.org/html/rfc7238 */ + header_info->follow_location = 0; + } +- strlcpy(header_info->location, last_header_value, sizeof(header_info->location)); ++ size_t last_header_value_len = strlen(last_header_value); ++ if (last_header_value_len > HTTP_HEADER_MAX_LOCATION_SIZE) { ++ header_info->error = true; ++ php_stream_wrapper_log_error(wrapper, options, ++ "HTTP Location header size is over the limit of %d bytes", ++ HTTP_HEADER_MAX_LOCATION_SIZE); ++ zend_string_efree(last_header_line_str); ++ return NULL; ++ } ++ if (header_info->location_len == 0) { ++ header_info->location = emalloc(last_header_value_len + 1); ++ } else if (header_info->location_len <= last_header_value_len) { ++ header_info->location = erealloc(header_info->location, last_header_value_len + 1); ++ } ++ header_info->location_len = last_header_value_len; ++ memcpy(header_info->location, last_header_value, last_header_value_len + 1); + } else if (!strncasecmp(last_header_line, "Content-Type:", sizeof("Content-Type:")-1)) { + php_stream_notify_info(context, PHP_STREAM_NOTIFY_MIME_TYPE_IS, last_header_value, 0); + } else if (!strncasecmp(last_header_line, "Content-Length:", sizeof("Content-Length:")-1)) { +@@ -557,6 +571,8 @@ finish: + } + } + ++ php_stream_http_response_header_info_init(&header_info); ++ + if (stream == NULL) + goto out; + +@@ -934,8 +950,6 @@ finish: + } + } + +- php_stream_http_response_header_info_init(&header_info); +- + /* read past HTTP headers */ + while (!php_stream_eof(stream)) { + size_t http_header_line_length; +@@ -1005,29 +1019,28 @@ finish: + last_header_line_str, NULL, NULL, response_code, response_header, &header_info); + } + +- if (!reqok || (header_info.location0 != '\0' && header_info.follow_location)) { ++ if (!reqok || (header_info.location != NULL && header_info.follow_location)) { + if (!header_info.follow_location || (((options & STREAM_ONLY_GET_HEADERS) || ignore_errors) && redirect_max <= 1)) { + goto out; + } + +- if (header_info.location0 != '\0') ++ if (header_info.location != NULL) + php_stream_notify_info(context, PHP_STREAM_NOTIFY_REDIRECTED, header_info.location, 0); + + php_stream_close(stream); + stream = NULL; + +- if (header_info.location0 != '\0') { ++ if (header_info.location != NULL) { + +- char new_pathHTTP_HEADER_BLOCK_SIZE; +- char loc_pathHTTP_HEADER_BLOCK_SIZE; ++ char *new_path = NULL; + +- *new_path='\0'; + if (strlen(header_info.location) < 8 || + (strncasecmp(header_info.location, "http://", sizeof("http://")-1) && + strncasecmp(header_info.location, "https://", sizeof("https://")-1) && + strncasecmp(header_info.location, "ftp://", sizeof("ftp://")-1) && + strncasecmp(header_info.location, "ftps://", sizeof("ftps://")-1))) + { ++ char *loc_path = NULL; + if (*header_info.location != '/') { + if (*(header_info.location+1) != '\0' && resource->path) { + char *s = strrchr(ZSTR_VAL(resource->path), '/'); +@@ -1045,31 +1058,35 @@ finish: + if (resource->path && + ZSTR_VAL(resource->path)0 == '/' && + ZSTR_VAL(resource->path)1 == '\0') { +- snprintf(loc_path, sizeof(loc_path) - 1, "%s%s", +- ZSTR_VAL(resource->path), header_info.location); ++ spprintf(&loc_path, 0, "%s%s", ZSTR_VAL(resource->path), header_info.location); + } else { +- snprintf(loc_path, sizeof(loc_path) - 1, "%s/%s", +- ZSTR_VAL(resource->path), header_info.location); ++ spprintf(&loc_path, 0, "%s/%s", ZSTR_VAL(resource->path), header_info.location); + } + } else { +- snprintf(loc_path, sizeof(loc_path) - 1, "/%s", header_info.location); ++ spprintf(&loc_path, 0, "/%s", header_info.location); + } + } else { +- strlcpy(loc_path, header_info.location, sizeof(loc_path)); ++ loc_path = header_info.location; ++ header_info.location = NULL; + } + if ((use_ssl && resource->port != 443) || (!use_ssl && resource->port != 80)) { +- snprintf(new_path, sizeof(new_path) - 1, "%s://%s:%d%s", ZSTR_VAL(resource->scheme), ZSTR_VAL(resource->host), resource->port, loc_path); ++ spprintf(&new_path, 0, "%s://%s:%d%s", ZSTR_VAL(resource->scheme), ++ ZSTR_VAL(resource->host), resource->port, loc_path); + } else { +- snprintf(new_path, sizeof(new_path) - 1, "%s://%s%s", ZSTR_VAL(resource->scheme), ZSTR_VAL(resource->host), loc_path); ++ spprintf(&new_path, 0, "%s://%s%s", ZSTR_VAL(resource->scheme), ++ ZSTR_VAL(resource->host), loc_path); + } ++ efree(loc_path); + } else { +- strlcpy(new_path, header_info.location, sizeof(new_path)); ++ new_path = header_info.location; ++ header_info.location = NULL; + } + + php_url_free(resource); + /* check for invalid redirection URLs */ + if ((resource = php_url_parse(new_path)) == NULL) { + php_stream_wrapper_log_error(wrapper, options, "Invalid redirect URL! %s", new_path); ++ efree(new_path); + goto out; + } + +@@ -1081,6 +1098,7 @@ finish: + while (s < e) { \ + if (iscntrl(*s)) { \ + php_stream_wrapper_log_error(wrapper, options, "Invalid redirect URL! %s", new_path); \ ++ efree(new_path); \ + goto out; \ + } \ + s++; \ +@@ -1096,6 +1114,7 @@ finish: + stream = php_stream_url_wrap_http_ex( + wrapper, new_path, mode, options, opened_path, context,
View file
php7-CVE-2025-6491.patch
Added
@@ -0,0 +1,44 @@ +From 0298837252fda06e0f86be3dfe91f166f45e85d4 Mon Sep 17 00:00:00 2001 +From: Ahmed Lekssays <lekssaysahmed@gmail.com> +Date: Tue, 3 Jun 2025 09:00:55 +0000 +Subject: PATCH Fix GHSA-453j-q27h-5p8x + +Libxml versions prior to 2.13 cannot correctly handle a call to +xmlNodeSetName() with a name longer than 2G. It will leave the node +object in an invalid state with a NULL name. This later causes a NULL +pointer dereference when using the name during message serialization. + +To solve this, implement a workaround that resets the name to the +sentinel name if this situation arises. + +Versions of libxml of 2.13 and higher are not affected. + +This can be exploited if a SoapVar is created with a fully qualified +name that is longer than 2G. This would be possible if some application +code uses a namespace prefix from an untrusted source like from a remote +SOAP service. + +Co-authored-by: Niels Dossche <7771979+nielsdos@users.noreply.github.com> +--- + ext/soap/soap.c | 6 ++-- + ext/soap/tests/soap_qname_crash.phpt | 48 ++++++++++++++++++++++++++++ + 2 files changed, 52 insertions(+), 2 deletions(-) + create mode 100644 ext/soap/tests/soap_qname_crash.phpt + +Index: php-7.4.33/ext/soap/soap.c +=================================================================== +--- php-7.4.33.orig/ext/soap/soap.c ++++ php-7.4.33/ext/soap/soap.c +@@ -4457,8 +4457,10 @@ static xmlNodePtr serialize_zval(zval *v + } + xmlParam = master_to_xml(enc, val, style, parent); + zval_ptr_dtor(&defval); +- if (!strcmp((char*)xmlParam->name, "BOGUS")) { +- xmlNodeSetName(xmlParam, BAD_CAST(paramName)); ++ if (xmlParam != NULL) { ++ if (xmlParam->name == NULL || strcmp((char*)xmlParam->name, "BOGUS") == 0) { ++ xmlNodeSetName(xmlParam, BAD_CAST(paramName)); ++ } + } + return xmlParam; + }
View file
php7-CVE-2026-109618,109619.patch
Added
@@ -0,0 +1,936 @@ +From 712e60f9edfd03f0960fc4fc3c2c375f42b90aa2 Mon Sep 17 00:00:00 2001 +From: Arnaud Le Blanc <arnaud.lb@gmail.com> +Date: Sun, 18 Oct 2026 20:09:54 +0200 +Subject: PATCH Avoid state corruption via bailout + +Minimal mitigation for EOL version. + +Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618) +Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) + +Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com> +--- + Zend/zend_API.h | 1 + + Zend/zend_alloc.c | 68 ++++++++++++++++++++--------- + Zend/zend_alloc.h | 2 + + Zend/zend_execute_API.c | 13 ++++++ + Zend/zend_hash.c | 13 ++++-- + Zend/zend_hash.h | 1 + + Zend/zend_llist.c | 2 + + Zend/zend_multiply.h | 4 +- + Zend/zend_strtod.c | 4 +- + Zend/zend_types.h | 26 +++++++----- + Zend/zend_vm_def.h | 11 ++++- + Zend/zend_vm_execute.h | 94 +++++++++++++++++++++++++++++++++++++---- + ext/session/session.c | 2 +- + main/SAPI.c | 5 +++ + main/main.c | 6 +++ + main/php_variables.c | 8 ++-- + main/rfc1867.c | 39 ++++++++++++++--- + 17 files changed, 240 insertions(+), 59 deletions(-) + +Index: php-7.4.33/Zend/zend_API.h +=================================================================== +--- php-7.4.33.orig/Zend/zend_API.h ++++ php-7.4.33/Zend/zend_API.h +@@ -380,6 +380,7 @@ ZEND_API char *zend_get_type_by_const(in + + #define array_init(arg) ZVAL_ARR((arg), zend_new_array(0)) + #define array_init_size(arg, size) ZVAL_ARR((arg), zend_new_array(size)) ++#define array_init_singleton(arg) ZVAL_ARR((arg), zend_new_array_singleton()) + ZEND_API int object_init(zval *arg); + ZEND_API int object_init_ex(zval *arg, zend_class_entry *ce); + ZEND_API int object_and_properties_init(zval *arg, zend_class_entry *ce, HashTable *properties); +Index: php-7.4.33/Zend/zend_alloc.c +=================================================================== +--- php-7.4.33.orig/Zend/zend_alloc.c ++++ php-7.4.33/Zend/zend_alloc.c +@@ -57,6 +57,7 @@ + #include "zend_operators.h" + #include "zend_multiply.h" + #include "zend_bitset.h" ++#include "zend_execute.h" + #include <signal.h> + + #ifdef HAVE_UNISTD_H +@@ -363,7 +364,42 @@ static ZEND_COLD ZEND_NORETURN void zend + #if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID) + kill(getpid(), SIGSEGV); + #endif +- exit(1); ++ _exit(1); ++} ++ ++ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...) ++{ ++ zend_string *script_filename = NULL; ++ uint32_t script_lineno = 0; ++ ++ if (zend_is_executing()) { ++ script_filename = zend_get_executed_filename_ex(); ++ script_lineno = zend_get_executed_lineno(); ++ } else if (zend_is_compiling()) { ++ script_filename = zend_get_compiled_filename(); ++ script_lineno = zend_get_compiled_lineno(); ++ } ++ ++ va_list args; ++ va_start(args, format); ++ ++ char buf1024; ++ vsnprintf(buf, sizeof(buf), format, args); ++ ++ va_end(args); ++ ++ fprintf(stderr, ++ "\nFatal error: %s in %s on line %d\n", ++ buf, ++ script_filename ? ZSTR_VAL(script_filename) : "Unknown", ++ script_lineno); ++ ++ /* See http://support.microsoft.com/kb/190351 */ ++# ifdef ZEND_WIN32 ++ fflush(stderr); ++# endif ++ ++ _exit(1); + } + + static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap, +@@ -375,22 +411,14 @@ static ZEND_COLD ZEND_NORETURN void zend + #endif + size_t size) + { ++ (void) heap; + +- heap->overflow = 1; +- zend_try { +- zend_error_noreturn(E_ERROR, +- format, +- limit, +-#if ZEND_DEBUG +- filename, +- lineno, +-#endif +- size); +- } zend_catch { +- } zend_end_try(); +- heap->overflow = 0; +- zend_bailout(); +- exit(1); ++ zend_mm_safe_error_ex(format, limit, ++#if ZEND_DEBUG ++ filename, ++ lineno, ++#endif ++ size); + } + + #ifdef _WIN32 +@@ -1318,7 +1346,7 @@ static zend_always_inline void *zend_mm_ + size = MAX(size, 1); + size = ZEND_MM_ALIGNED_SIZE(size) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)); + if (UNEXPECTED(size < real_size)) { +- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info))); ++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info))); + return NULL; + } + #endif +@@ -1762,7 +1790,7 @@ static void *zend_mm_alloc_huge(zend_mm_ + void *ptr; + + if (UNEXPECTED(new_size < size)) { +- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", size, alignment); ++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", size, alignment); + } + + #if ZEND_MM_LIMIT +@@ -2617,7 +2645,7 @@ ZEND_API char* ZEND_FASTCALL _estrdup(co + + length = strlen(s); + if (UNEXPECTED(length + 1 == 0)) { +- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length); ++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length); + } + p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); + memcpy(p, s, length+1); +@@ -2629,7 +2657,7 @@ ZEND_API char* ZEND_FASTCALL _estrndup(c + char *p; + + if (UNEXPECTED(length + 1 == 0)) { +- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length); ++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length); + } + p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); + memcpy(p, s, length); +@@ -2643,7 +2671,7 @@ ZEND_API char* ZEND_FASTCALL zend_strndu + char *p; + + if (UNEXPECTED(length + 1 == 0)) { +- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length); ++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length); + } + p = (char *) malloc(length + 1); + if (UNEXPECTED(p == NULL)) { +@@ -2974,7 +3002,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_e + static ZEND_COLD ZEND_NORETURN void zend_out_of_memory(void) + { + fprintf(stderr, "Out of memory\n"); +- exit(1); ++ _exit(1); + } + + ZEND_API void * __zend_malloc(size_t len) +Index: php-7.4.33/Zend/zend_alloc.h +=================================================================== +--- php-7.4.33.orig/Zend/zend_alloc.h ++++ php-7.4.33/Zend/zend_alloc.h +@@ -402,6 +402,8 @@ static void apc_init_heap(void) + size_t zend_mm_globals_size(void); + #endif + ++ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...); ++ + END_EXTERN_C() + + #endif +Index: php-7.4.33/Zend/zend_execute_API.c +=================================================================== +--- php-7.4.33.orig/Zend/zend_execute_API.c
View file
php7-CVE-2026-14355.patch
Added
@@ -0,0 +1,49 @@ +From 169226847426368c62992af43c2c39b0fdbff4d5 Mon Sep 17 00:00:00 2001 +From: David Carlier <devnexen@gmail.com> +Date: Fri, 29 May 2026 21:44:14 +0100 +Subject: PATCH ext/openssl: openssl_encrypt() zend mm heap overflow on + AES-WRAP-PAD mode. + +Fix #22186 + +close GH-22187 +--- + NEWS | 4 ++++ + ext/openssl/openssl.c | 17 +++++++++++++++-- + ext/openssl/tests/gh22186.phpt | 32 ++++++++++++++++++++++++++++++++ + 3 files changed, 51 insertions(+), 2 deletions(-) + create mode 100644 ext/openssl/tests/gh22186.phpt + +Index: php-7.4.33/ext/openssl/openssl.c +=================================================================== +--- php-7.4.33.orig/ext/openssl/openssl.c ++++ php-7.4.33/ext/openssl/openssl.c +@@ -6670,6 +6670,7 @@ static int php_openssl_cipher_update(con + char *aad, size_t aad_len, int enc) /* {{{ */ + { + int i = 0; ++ size_t outlen = data_len + EVP_CIPHER_block_size(cipher_type); + + if (mode->is_single_run_aead && !EVP_CipherUpdate(cipher_ctx, NULL, &i, NULL, (int)data_len)) { + php_openssl_store_errors(); +@@ -6683,7 +6684,19 @@ static int php_openssl_cipher_update(con + return FAILURE; + } + +- *poutbuf = zend_string_alloc((int)data_len + EVP_CIPHER_block_size(cipher_type), 0); ++#ifdef EVP_CIPH_WRAP_MODE ++ if ((EVP_CIPHER_mode(cipher_type)) == EVP_CIPH_WRAP_MODE) { ++ /* ++ * RFC 5649 wrap-with-padding rounds the input up to the block size ++ * and prepends an integrity block, we reserve one extra block. ++ * See EVP_EncryptUpdate(3): wrap mode may write up to ++ * inl + cipher_block_size bytes. ++ */ ++ outlen += EVP_CIPHER_block_size(cipher_type); ++ } ++#endif ++ ++ *poutbuf = zend_string_alloc(outlen, 0); + + if (!EVP_CipherUpdate(cipher_ctx, (unsigned char*)ZSTR_VAL(*poutbuf), + &i, (unsigned char *)data, (int)data_len)) {
View file
php7-CVE-2026-17543.patch
Added
@@ -0,0 +1,34 @@ +From ab048bd83b578119cf81b456526d50498421d617 Mon Sep 17 00:00:00 2001 +From: Ilija Tovilo <ilija.tovilo@me.com> +Date: Mon, 27 Jul 2026 16:49:38 +0200 +Subject: PATCH Fix SQL injection in ext-pgsql via E'...' backslash breakout + +php_pgsql_add_quotes() quotes the string with E'...', but PQescapeStringConn() +does not escape \ unless standard_conforming_strings is off. +PQescapeStringConn() is meant to be used with '', so do that instead. + +Fixes GHSA-7qpv-r5mr-78m4 +--- + ext/pgsql/pgsql.c | 3 +- + ext/pgsql/tests/10pg_convert_9.phpt | 18 +++++- + ext/pgsql/tests/10pg_convert_json_array.phpt | 4 +- + ext/pgsql/tests/12pg_insert_9.phpt | 2 +- + ext/pgsql/tests/14pg_update_9.phpt | 2 +- + ext/pgsql/tests/GHSA-7qpv-r5mr-78m4.phpt | 58 ++++++++++++++++++++ + ext/pgsql/tests/bug64609.phpt | 2 +- + ext/pgsql/tests/bug68638.phpt | 2 +- + 8 files changed, 81 insertions(+), 10 deletions(-) + create mode 100644 ext/pgsql/tests/GHSA-7qpv-r5mr-78m4.phpt + +Index: php-7.4.33/ext/pgsql/pgsql.c +=================================================================== +--- php-7.4.33.orig/ext/pgsql/pgsql.c ++++ php-7.4.33/ext/pgsql/pgsql.c +@@ -5839,7 +5839,6 @@ static int php_pgsql_add_quotes(zval *sr + assert(Z_TYPE_P(src) == IS_STRING); + assert(should_free == 1 || should_free == 0); + +- smart_str_appendc(&str, 'E'); + smart_str_appendc(&str, '\''); + smart_str_appendl(&str, Z_STRVAL_P(src), Z_STRLEN_P(src)); + smart_str_appendc(&str, '\'');
View file
php7-CVE-2026-6103.patch
Added
@@ -0,0 +1,154 @@ +From 0994e2e887cd993866b5e4d7dba2fade5caeefec Mon Sep 17 00:00:00 2001 +From: Jakub Zelenka <bukka@php.net> +Date: Sun, 13 Sep 2026 22:37:00 +0200 +Subject: PATCH Fix GHSA-j3wh-g957-2m85: phar tar entry injection + +Reject entry sizes that cannot be parsed or represented, and skip the data +blocks of every entry type that carries data. Both left the stream on +attacker controlled data that was then parsed as a tar header. +--- + ext/phar/phar_internal.h | 5 + + ext/phar/tar.c | 80 +++++++++++++++- + .../tar/GHSA-j3wh-g957-2m85-longlink.phpt | 50 ++++++++++ + .../tests/tar/GHSA-j3wh-g957-2m85-size.phpt | 92 +++++++++++++++++++ + .../tar/GHSA-j3wh-g957-2m85-typeflag.phpt | 79 ++++++++++++++++ + 5 files changed, 301 insertions(+), 5 deletions(-) + create mode 100644 ext/phar/tests/tar/GHSA-j3wh-g957-2m85-longlink.phpt + create mode 100644 ext/phar/tests/tar/GHSA-j3wh-g957-2m85-size.phpt + create mode 100644 ext/phar/tests/tar/GHSA-j3wh-g957-2m85-typeflag.phpt + +Index: php-7.4.33/ext/phar/phar_internal.h +=================================================================== +--- php-7.4.33.orig/ext/phar/phar_internal.h ++++ php-7.4.33/ext/phar/phar_internal.h +@@ -113,8 +113,13 @@ + #define TAR_FILE '0' + #define TAR_LINK '1' + #define TAR_SYMLINK '2' ++#define TAR_CHAR '3' ++#define TAR_BLOCK '4' + #define TAR_DIR '5' ++#define TAR_FIFO '6' + #define TAR_NEW '8' ++#define TAR_LONGLINK 'K' ++#define TAR_LONGNAME 'L' + #define TAR_GLOBAL_HDR 'g' + #define TAR_FILE_HDR 'x' + +Index: php-7.4.33/ext/phar/tar.c +=================================================================== +--- php-7.4.33.orig/ext/phar/tar.c ++++ php-7.4.33/ext/phar/tar.c +@@ -37,6 +37,52 @@ static uint32_t phar_tar_number(char *bu + } + /* }}} */ + ++static zend_bool phar_tar_type_has_data(char typeflag) ++{ ++ switch (typeflag) { ++ case TAR_LINK: ++ case TAR_SYMLINK: ++ case TAR_CHAR: ++ case TAR_BLOCK: ++ case TAR_DIR: ++ case TAR_FIFO: ++ return 0; ++ default: ++ return 1; ++ } ++} ++ ++static zend_bool phar_tar_size(const char *buf, size_t len, uint32_t *result) ++{ ++ uint64_t num = 0; ++ size_t i = 0; ++ ++ while (i < len && bufi == ' ') { ++ ++i; ++ } ++ ++ /* GNU base-256 encoding is only used for sizes that do not fit the octal field */ ++ if (i < len && (((unsigned char) bufi) & 0x80)) { ++ return 0; ++ } ++ ++ while (i < len && bufi >= '0' && bufi <= '7') { ++ num = num * 8 + (bufi - '0'); ++ ++i; ++ } ++ ++ while (i < len && (bufi == ' ' || bufi == '\0')) { ++ ++i; ++ } ++ ++ if (i != len || num > UINT32_MAX - 511) { ++ return 0; ++ } ++ ++ *result = (uint32_t) num; ++ return 1; ++} ++ + /* adapted from format_octal() in libarchive + * + * Copyright (c) 2003-2009 Tim Kientzle +@@ -280,8 +326,32 @@ int phar_parse_tarfile(php_stream* fp, c + } + } + +- size = entry.uncompressed_filesize = entry.compressed_filesize = +- phar_tar_number(hdr->size, sizeof(hdr->size)); ++ if (!phar_tar_size(hdr->size, sizeof(hdr->size), &size)) { ++ if (error) { ++ spprintf(error, 4096, "phar error: \"%s\" is a corrupted tar file (invalid entry size)", fname); ++ } ++ if (last_was_longlink) { ++ pefree(entry.filename, myphar->is_persistent); ++ } ++ php_stream_close(fp); ++ phar_destroy_phar_data(myphar); ++ return FAILURE; ++ } ++ entry.uncompressed_filesize = entry.compressed_filesize = size; ++ ++ /* GNU long link names are not supported, so refuse the record instead of ++ * registering it as an entry and dropping the link target of the entry that follows */ ++ if (hdr->typeflag == TAR_LONGLINK) { ++ if (error) { ++ spprintf(error, 4096, "phar error: \"%s\" is a tar file with an unsupported GNU long link entry", fname); ++ } ++ if (last_was_longlink) { ++ pefree(entry.filename, myphar->is_persistent); ++ } ++ php_stream_close(fp); ++ phar_destroy_phar_data(myphar); ++ return FAILURE; ++ } + + /* skip global/file headers (pax) */ + if (!old && (hdr->typeflag == TAR_GLOBAL_HDR || hdr->typeflag == TAR_FILE_HDR)) { +@@ -369,13 +439,13 @@ bail: + goto bail; + } + +- if (!last_was_longlink && hdr->typeflag == 'L') { ++ if (!last_was_longlink && hdr->typeflag == TAR_LONGNAME) { + last_was_longlink = 1; + /* support the ././@LongLink system for storing long filenames */ + entry.filename_len = entry.uncompressed_filesize; + + /* Check for overflow - bug 61065 */ +- if (entry.filename_len == UINT_MAX || entry.filename_len == 0) { ++ if (entry.filename_len == 0 || entry.filename_len > totalsize) { + if (error) { + spprintf(error, 4096, "phar error: \"%s\" is a corrupted tar file (invalid entry size)", fname); + } +@@ -585,7 +655,7 @@ bail: + + size = (size+511)&~511; + +- if (((hdr->typeflag == '\0') || (hdr->typeflag == TAR_FILE)) && size > 0) { ++ if (phar_tar_type_has_data(hdr->typeflag) && size > 0) { + next: + /* this is not good enough - seek succeeds even on truncated tars */ + php_stream_seek(fp, size, SEEK_CUR);
View file
php7-CVE-2026-6722.patch
Added
@@ -0,0 +1,35 @@ +From aee3b3ac9b816b0def1c462695b483b49a83148e Mon Sep 17 00:00:00 2001 +From: Ilija Tovilo <ilija.tovilo@me.com> +Date: Sun, 3 May 2026 19:56:53 +0200 +Subject: PATCH GHSA-85c2-q967-79q5: soap Fix stale SOAP_GLOBAL(ref_map) + pointer with Apache Map + +Fixes GHSA-85c2-q967-79q5 +Fixes CVE-2026-6722 +--- + ext/soap/php_encoding.c | 3 +- + ext/soap/tests/GHSA-85c2-q967-79q5.phpt | 61 +++++++++++++++++++++++++ + 2 files changed, 63 insertions(+), 1 deletion(-) + create mode 100644 ext/soap/tests/GHSA-85c2-q967-79q5.phpt + +Index: php-7.4.33/ext/soap/php_encoding.c +=================================================================== +--- php-7.4.33.orig/ext/soap/php_encoding.c ++++ php-7.4.33/ext/soap/php_encoding.c +@@ -367,6 +367,7 @@ static zend_bool soap_check_xml_ref(zval + static void soap_add_xml_ref(zval *data, xmlNodePtr node) + { + if (SOAP_GLOBAL(ref_map)) { ++ Z_TRY_ADDREF_P(data); + zend_hash_index_update(SOAP_GLOBAL(ref_map), (zend_ulong)node, data); + } + } +@@ -3428,7 +3429,7 @@ void encode_reset_ns() + } else { + SOAP_GLOBAL(ref_map) = emalloc(sizeof(HashTable)); + } +- zend_hash_init(SOAP_GLOBAL(ref_map), 0, NULL, NULL, 0); ++ zend_hash_init(SOAP_GLOBAL(ref_map), 0, NULL, ZVAL_PTR_DTOR, 0); + } + + void encode_finish()
View file
php7-CVE-2026-6735.patch
Added
@@ -0,0 +1,76 @@ +From 99a5ad7441de9914246c7863adb6997396008b9d Mon Sep 17 00:00:00 2001 +From: Jakub Zelenka <bukka@php.net> +Date: Sun, 3 May 2026 20:01:41 +0200 +Subject: PATCH GHSA-7qg2-v9fj-4mwv: fpm XSS within status endpoint + +Fixes GHSA-7qg2-v9fj-4mwv +Fixes CVE-2026-6735 +--- + sapi/fpm/fpm/fpm_status.c | 34 +++++++++++-- + .../tests/ghsa-7qg2-v9fj-4mwv-status-xss.phpt | 48 +++++++++++++++++++ + 2 files changed, 78 insertions(+), 4 deletions(-) + create mode 100644 sapi/fpm/tests/ghsa-7qg2-v9fj-4mwv-status-xss.phpt + +Index: php-7.4.33/sapi/fpm/fpm/fpm_status.c +=================================================================== +--- php-7.4.33.orig/sapi/fpm/fpm/fpm_status.c ++++ php-7.4.33/sapi/fpm/fpm/fpm_status.c +@@ -483,8 +483,8 @@ int fpm_status_handle_request(void) /* { + if (full_syntax) { + unsigned int i; + int first; +- zend_string *tmp_query_string; +- char *query_string; ++ zend_string *tmp_query_string, *tmp_request_uri_string; ++ char *query_string, *request_uri_string; + struct timeval duration, now; + #ifdef HAVE_FPM_LQ + float cpu; +@@ -511,13 +511,27 @@ int fpm_status_handle_request(void) /* { + } + } + ++ request_uri_string = NULL; ++ tmp_request_uri_string = NULL; ++ if (proc.request_uri0 != '\0') { ++ if (encode) { ++ tmp_request_uri_string = php_escape_html_entities_ex( ++ (const unsigned char *) proc.request_uri, ++ strlen(proc.request_uri), 1, ENT_DISALLOWED | ENT_HTML_DOC_XML1 | ENT_COMPAT, ++ NULL, /* double_encode */ 1); ++ request_uri_string = ZSTR_VAL(tmp_request_uri_string); ++ } else { ++ request_uri_string = proc.request_uri; ++ } ++ } ++ + query_string = NULL; + tmp_query_string = NULL; + if (proc.query_string0 != '\0') { + if (!encode) { + query_string = proc.query_string; + } else { +- tmp_query_string = php_escape_html_entities_ex((unsigned char *)proc.query_string, strlen(proc.query_string), 1, ENT_HTML_IGNORE_ERRORS & ENT_COMPAT, NULL, 1); ++ tmp_query_string = php_escape_html_entities_ex((unsigned char *)proc.query_string, strlen(proc.query_string), 1, ENT_DISALLOWED | ENT_HTML_DOC_XML1 | ENT_COMPAT, NULL, 1); + query_string = ZSTR_VAL(tmp_query_string); + } + } +@@ -545,7 +559,7 @@ int fpm_status_handle_request(void) /* { + proc.requests, + duration.tv_sec * 1000000UL + duration.tv_usec, + proc.request_method0 != '\0' ? proc.request_method : "-", +- proc.request_uri0 != '\0' ? proc.request_uri : "-", ++ request_uri_string ? request_uri_string : "-", + query_string ? "?" : "", + query_string ? query_string : "", + proc.content_length, +@@ -558,6 +572,9 @@ int fpm_status_handle_request(void) /* { + PUTS(buffer); + efree(buffer); + ++ if (tmp_request_uri_string) { ++ zend_string_free(tmp_request_uri_string); ++ } + if (tmp_query_string) { + zend_string_free(tmp_query_string); + }
View file
php7-CVE-2026-7258.patch
Added
@@ -0,0 +1,1588 @@ +From a38418777f65780d9d622197677e90567690fc07 Mon Sep 17 00:00:00 2001 +From: Ilija Tovilo <ilija.tovilo@me.com> +Date: Sun, 3 May 2026 20:03:18 +0200 +Subject: PATCH GHSA-m8rr-4c36-8gq4: Consistently pass unsigned char to + ctype.h functions + +Fixes GHSA-m8rr-4c36-8gq4 +Fixes CVE-2026-7258 +--- + Zend/zend_compile.c | 2 +- + Zend/zend_ini.c | 6 +++--- + Zend/zend_operators.c | 8 ++++---- + Zend/zend_virtual_cwd.c | 10 +++++----- + Zend/zend_virtual_cwd.h | 2 +- + ext/com_dotnet/com_extension.c | 4 ++-- + ext/date/lib/parse_date.c | 10 +++++----- + ext/date/lib/parse_date.re | 10 +++++----- + ext/date/lib/parse_iso_intervals.c | 4 ++-- + ext/date/lib/parse_iso_intervals.re | 4 ++-- + ext/date/lib/timelib.c | 2 +- + ext/filter/logical_filters.c | 10 +++++----- + ext/ftp/ftp.c | 10 +++++----- + ext/gd/libgd/gd_xbm.c | 2 +- + ext/imap/php_imap.c | 2 +- + ext/intl/locale/locale_methods.c | 2 +- + ext/mbstring/mbstring.c | 4 ++-- + ext/mbstring/php_mbregex.c | 2 +- + ext/pcre/php_pcre.c | 4 ++-- + ext/pdo/pdo.c | 2 +- + ext/pdo/pdo_sql_parser.re | 2 +- + ext/pdo/pdo_stmt.c | 2 +- + ext/standard/dl.c | 2 +- + ext/standard/exec.c | 2 +- + ext/standard/file.c | 2 +- + ext/standard/filters.c | 2 +- + ext/standard/formatted_print.c | 8 ++++---- + ext/standard/ftp_fopen_wrapper.c | 12 ++++++------ + ext/standard/html.c | 4 ++-- + ext/standard/math.c | 6 +++--- + ext/standard/metaphone.c | 18 ++++++++--------- + ext/standard/quot_print.c | 8 ++++---- + ext/standard/scanf.c | 10 +++++----- + ext/standard/soundex.c | 2 +- + ext/standard/string.c | 14 +++++++------- + ext/standard/strnatcmp.c | 30 ++++++++++++++--------------- + ext/standard/type.c | 2 +- + ext/standard/url.c | 20 +++++++++---------- + ext/standard/url_scanner_ex.re | 6 +++--- + ext/standard/versioning.c | 16 +++++++-------- + main/SAPI.c | 6 +++--- + main/fopen_wrappers.c | 6 +++--- + main/php_ini.c | 2 +- + main/php_ini_builder.c | 2 +- + main/php_variables.c | 4 ++-- + main/rfc1867.c | 12 ++++++------ + main/snprintf.c | 14 +++++++------- + main/spprintf.c | 14 +++++++------- + main/streams/streams.c | 4 ++-- + main/streams/transports.c | 2 +- + sapi/cli/php_cli_server.c | 2 +- + sapi/fpm/fpm/fpm_conf.c | 4 ++-- + sapi/litespeed/lsapi_main.c | 4 ++-- + sapi/litespeed/lsapilib.c | 6 +++--- + sapi/phpdbg/phpdbg_cmd.c | 4 ++-- + sapi/phpdbg/phpdbg_prompt.c | 2 +- + sapi/phpdbg/phpdbg_utils.c | 10 +++++----- + win32/sendmail.c | 6 +++--- + 58 files changed, 186 insertions(+), 186 deletions(-) + +Index: php-7.4.33/Zend/zend_compile.c +=================================================================== +--- php-7.4.33.orig/Zend/zend_compile.c ++++ php-7.4.33/Zend/zend_compile.c +@@ -1772,7 +1772,7 @@ ZEND_API size_t zend_dirname(char *path, + /* Note that on Win32 CWD is per drive (heritage from CP/M). + * This means dirname("c:foo") maps to "c:." or "c:" - which means CWD on C: drive. + */ +- if ((2 <= len) && isalpha((int)((unsigned char *)path)0) && (':' == path1)) { ++ if ((2 <= len) && isalpha((unsigned char)path0) && (':' == path1)) { + /* Skip over the drive spec (if any) so as not to change */ + path += 2; + len_adjust += 2; +Index: php-7.4.33/Zend/zend_operators.c +=================================================================== +--- php-7.4.33.orig/Zend/zend_operators.c ++++ php-7.4.33/Zend/zend_operators.c +@@ -2804,8 +2804,8 @@ ZEND_API int ZEND_FASTCALL zend_binary_s + + len = MIN(len1, len2); + while (len--) { +- c1 = zend_tolower((int)*(unsigned char *)s1++); +- c2 = zend_tolower((int)*(unsigned char *)s2++); ++ c1 = zend_tolower((unsigned char)*(s1++)); ++ c2 = zend_tolower((unsigned char)*(s2++)); + if (c1 != c2) { + return c1 - c2; + } +@@ -2825,8 +2825,8 @@ ZEND_API int ZEND_FASTCALL zend_binary_s + } + len = MIN(length, MIN(len1, len2)); + while (len--) { +- c1 = zend_tolower((int)*(unsigned char *)s1++); +- c2 = zend_tolower((int)*(unsigned char *)s2++); ++ c1 = zend_tolower((unsigned char)*(s1++)); ++ c2 = zend_tolower((unsigned char)*(s2++)); + if (c1 != c2) { + return c1 - c2; + } +Index: php-7.4.33/Zend/zend_virtual_cwd.c +=================================================================== +--- php-7.4.33.orig/Zend/zend_virtual_cwd.c ++++ php-7.4.33/Zend/zend_virtual_cwd.c +@@ -201,7 +201,7 @@ void virtual_cwd_main_cwd_init(uint8_t r + main_cwd_state.cwd_length = strlen(cwd); + #ifdef ZEND_WIN32 + if (main_cwd_state.cwd_length >= 2 && cwd1 == ':') { +- cwd0 = toupper(cwd0); ++ cwd0 = toupper((unsigned char)cwd0); + } + #endif + main_cwd_state.cwd = strdup(cwd); +@@ -279,7 +279,7 @@ CWD_API char *virtual_getcwd_ex(size_t * + *length = state->cwd_length+1; + retval = (char *) emalloc(*length+1); + memcpy(retval, state->cwd, *length); +- retval0 = toupper(retval0); ++ retval0 = toupper((unsigned char)retval0); + retval*length-1 = DEFAULT_SLASH; + retval*length = '\0'; + return retval; +@@ -1120,7 +1120,7 @@ CWD_API int virtual_file_ex(cwd_state *s + if (resolved_pathstart == 0) { + goto verify; + } +- resolved_pathstart = toupper(resolved_pathstart); ++ resolved_pathstart = toupper((unsigned char)resolved_pathstart); + start++; + } + resolved_pathstart++ = DEFAULT_SLASH; +@@ -1128,13 +1128,13 @@ CWD_API int virtual_file_ex(cwd_state *s + if (resolved_pathstart == 0) { + goto verify; + } +- resolved_pathstart = toupper(resolved_pathstart); ++ resolved_pathstart = toupper((unsigned char)resolved_pathstart); + start++; + } + resolved_pathstart++ = DEFAULT_SLASH; + } else if (IS_ABSOLUTE_PATH(resolved_path, path_length)) { + /* skip DRIVE name */ +- resolved_path0 = toupper(resolved_path0); ++ resolved_path0 = toupper((unsigned char)resolved_path0); + resolved_path2 = DEFAULT_SLASH; + start = 3; + } +Index: php-7.4.33/Zend/zend_virtual_cwd.h +=================================================================== +--- php-7.4.33.orig/Zend/zend_virtual_cwd.h ++++ php-7.4.33/Zend/zend_virtual_cwd.h +@@ -84,7 +84,7 @@ typedef unsigned short mode_t; + #define IS_UNC_PATH(path, len) \ + (len >= 2 && IS_SLASH(path0) && IS_SLASH(path1)) + #define IS_ABSOLUTE_PATH(path, len) \ +- (len >= 2 && (/* is local */isalpha(path0) && path1 == ':' || /* is UNC */IS_SLASH(path0) && IS_SLASH(path1))) ++ (len >= 2 && (/* is local */isalpha((unsigned char)(path)0) && path1 == ':' || /* is UNC */IS_SLASH(path0) && IS_SLASH(path1))) + + #else + #ifdef HAVE_DIRENT_H +Index: php-7.4.33/ext/com_dotnet/com_extension.c +=================================================================== +--- php-7.4.33.orig/ext/com_dotnet/com_extension.c ++++ php-7.4.33/ext/com_dotnet/com_extension.c +@@ -241,11 +241,11 @@ static PHP_INI_MH(OnTypeLibFileUpdate) + } + + /* Remove leading/training white spaces on search_string */ +- while (isspace(*typelib_name)) {/* Ends on '\0' in worst case */ ++ while (isspace((unsigned char)*typelib_name)) {/* Ends on '\0' in worst case */ + typelib_name ++; + } + ptr = typelib_name + strlen(typelib_name) - 1; +- while ((ptr != typelib_name) && isspace(*ptr)) { ++ while ((ptr != typelib_name) && isspace((unsigned char)*ptr)) { + *ptr = '\0'; + ptr--; + } +Index: php-7.4.33/ext/date/lib/parse_date.re +=================================================================== +--- php-7.4.33.orig/ext/date/lib/parse_date.re ++++ php-7.4.33/ext/date/lib/parse_date.re +@@ -477,7 +477,7 @@ static timelib_sll timelib_get_nr(char * + + static void timelib_skip_day_suffix(char **ptr) + { +- if (isspace(**ptr)) { ++ if (isspace((unsigned char)**ptr)) { + return; + } + if (!timelib_strncasecmp(*ptr, "nd", 2) || !timelib_strncasecmp(*ptr, "rd", 2) ||!timelib_strncasecmp(*ptr, "st", 2) || !timelib_strncasecmp(*ptr, "th", 2)) {
View file
php7-CVE-2026-7260.patch
Added
@@ -0,0 +1,93 @@ +From 2e0fa0a44441d74bf8cc4e1ce1c8af9cd4209f52 Mon Sep 17 00:00:00 2001 +From: Jakub Zelenka <bukka@php.net> +Date: Sun, 3 May 2026 19:26:31 +0200 +Subject: PATCH Fix GHSA-vc5h-9ppw-p5f3: phar circular symlink crash + +Prevents infinite recursion in phar_get_link_source. +--- + .../tests/tar/files/circular_symlinks.tar | Bin 0 -> 10240 bytes + .../tar/files/circular_symlinks_long.tar | Bin 0 -> 215040 bytes + .../tests/tar/files/circular_symlinks_rho.tar | Bin 0 -> 10240 bytes + .../ghsa-vc5h-9ppw-p5f3-symlink-circular.phpt | 27 ++++++++++ + ext/phar/util.c | 51 ++++++++++++++---- + 5 files changed, 67 insertions(+), 11 deletions(-) + create mode 100644 ext/phar/tests/tar/files/circular_symlinks.tar + create mode 100644 ext/phar/tests/tar/files/circular_symlinks_long.tar + create mode 100644 ext/phar/tests/tar/files/circular_symlinks_rho.tar + create mode 100644 ext/phar/tests/tar/ghsa-vc5h-9ppw-p5f3-symlink-circular.phpt + +Index: php-7.4.33/ext/phar/util.c +=================================================================== +--- php-7.4.33.orig/ext/phar/util.c ++++ php-7.4.33/ext/phar/util.c +@@ -57,30 +57,59 @@ static char *phar_get_link_location(phar + } + /* }}} */ + +-phar_entry_info *phar_get_link_source(phar_entry_info *entry) /* {{{ */ ++static phar_entry_info *phar_follow_one_link(phar_entry_info *entry) + { + phar_entry_info *link_entry; + char *link; + +- if (!entry->link) { +- return entry; +- } +- + link = phar_get_link_location(entry); + if (NULL != (link_entry = zend_hash_str_find_ptr(&(entry->phar->manifest), entry->link, strlen(entry->link))) || + NULL != (link_entry = zend_hash_str_find_ptr(&(entry->phar->manifest), link, strlen(link)))) { + if (link != entry->link) { + efree(link); + } +- return phar_get_link_source(link_entry); +- } else { +- if (link != entry->link) { +- efree(link); ++ return link_entry; ++ } ++ ++ if (link != entry->link) { ++ efree(link); ++ } ++ return NULL; ++} ++ ++phar_entry_info *phar_get_link_source(phar_entry_info *entry) ++{ ++ phar_entry_info *slow, *fast; ++ ++ if (!entry->link) { ++ return entry; ++ } ++ ++ /* ++ * Use Floyd's cycle detection algorithm to follow the symlink chain without unbounded ++ * recursion. Each entry has at most one outgoing link, so if a cycle exists the fast pointer ++ * will eventually meet the slow one. Otherwise the fast pointer reaches the end first. ++ */ ++ slow = fast = entry; ++ while (1) { ++ fast = phar_follow_one_link(fast); ++ if (!fast || !fast->link) { ++ return fast; ++ } ++ fast = phar_follow_one_link(fast); ++ if (!fast || !fast->link) { ++ return fast; ++ } ++ ++ /* no need to check slow as it's always behind */ ++ slow = phar_follow_one_link(slow); ++ ++ if (slow == fast) { ++ /* circular symlink chain */ ++ return NULL; + } +- return NULL; + } + } +-/* }}} */ + + /* retrieve a phar_entry_info's current file pointer for reading contents */ + php_stream *phar_get_efp(phar_entry_info *entry, int follow_links) /* {{{ */
View file
php7-CVE-2026-7261.patch
Added
@@ -0,0 +1,42 @@ +From db2a7f9348fd5dda5fd162061786a664c417bf5b Mon Sep 17 00:00:00 2001 +From: Ilija Tovilo <ilija.tovilo@me.com> +Date: Sun, 3 May 2026 19:57:16 +0200 +Subject: PATCH GHSA-m33r-qmcv-p97q: soap Fix use-after-free after header + parsing failure with SOAP_PERSISTENCE_SESSION + +Fixes GHSA-m33r-qmcv-p97q +Fixes CVE-2026-7261 +--- + ext/soap/soap.c | 12 ++++- + ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt | 58 +++++++++++++++++++++++++ + 2 files changed, 68 insertions(+), 2 deletions(-) + create mode 100644 ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt + +Index: php-7.4.33/ext/soap/soap.c +=================================================================== +--- php-7.4.33.orig/ext/soap/soap.c ++++ php-7.4.33/ext/soap/soap.c +@@ -1807,13 +1807,21 @@ PHP_METHOD(SoapServer, handle) + php_output_discard(); + soap_server_fault_ex(function, &h->retval, h); + efree(fn_name); +- if (service->type == SOAP_CLASS && soap_obj) {zval_ptr_dtor(soap_obj);} ++ if (service->type == SOAP_CLASS && soap_obj) { ++ if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION) { ++ zval_ptr_dtor(soap_obj); ++ } ++ } + goto fail; + } else if (EG(exception)) { + php_output_discard(); + _soap_server_exception(service, function, ZEND_THIS); + efree(fn_name); +- if (service->type == SOAP_CLASS && soap_obj) {zval_ptr_dtor(soap_obj);} ++ if (service->type == SOAP_CLASS && soap_obj) { ++ if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION) { ++ zval_ptr_dtor(soap_obj); ++ } ++ } + goto fail; + } + } else if (h->mustUnderstand) {
View file
php7-CVE-2026-7262.patch
Added
@@ -0,0 +1,27 @@ +From 79551ab8b1a97760c739e372f9bc359619f3554d Mon Sep 17 00:00:00 2001 +From: Ilija Tovilo <ilija.tovilo@me.com> +Date: Sat, 25 Apr 2026 00:44:37 +0200 +Subject: PATCH GHSA-hmxp-6pc4-f3vv: soap Fix broken Apache map value NULL + check + +Fixes GHSA-hmxp-6pc4-f3vv +Fixes CVE-2026-7262 +--- + ext/soap/php_encoding.c | 2 +- + ext/soap/tests/GHSA-hmxp-6pc4-f3vv.phpt | 39 +++++++++++++++++++++++++ + 2 files changed, 40 insertions(+), 1 deletion(-) + create mode 100644 ext/soap/tests/GHSA-hmxp-6pc4-f3vv.phpt + +Index: php-7.4.33/ext/soap/php_encoding.c +=================================================================== +--- php-7.4.33.orig/ext/soap/php_encoding.c ++++ php-7.4.33/ext/soap/php_encoding.c +@@ -2706,7 +2706,7 @@ static zval *to_zval_map(zval *ret, enco + } + + xmlValue = get_node(item->children, "value"); +- if (!xmlKey) { ++ if (!xmlValue) { + soap_error0(E_ERROR, "Encoding: Can't decode apache map, missing value"); + } +
View file
php7-CVE-2026-7568.patch
Added
@@ -0,0 +1,40 @@ +From 47def8ce1db1fdbffcfc1f5bb11877a0e22d4b32 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= <tim@tideways-gmbh.com> +Date: Sun, 3 May 2026 20:02:57 +0200 +Subject: PATCH GHSA-96wq-48vp-hh57: metaphone Fix signed integer overflow + of char array offset + +Fixes GHSA-96wq-48vp-hh57 +Fixes CVE-2026-7568 +--- + ext/standard/metaphone.c | 6 +++--- + ext/standard/tests/GHSA-96wq-48vp-hh57.phpt | 22 +++++++++++++++++++++ + 2 files changed, 25 insertions(+), 3 deletions(-) + create mode 100644 ext/standard/tests/GHSA-96wq-48vp-hh57.phpt + +Index: php-7.4.33/ext/standard/metaphone.c +=================================================================== +--- php-7.4.33.orig/ext/standard/metaphone.c ++++ php-7.4.33/ext/standard/metaphone.c +@@ -122,10 +122,10 @@ static const char _codes26 = + + /* Allows us to safely look ahead an arbitrary # of letters */ + /* I probably could have just used strlen... */ +-static char Lookahead(char *word, int how_far) ++static char Lookahead(char *word, size_t how_far) + { + char letter_ahead = '\0'; /* null by default */ +- int idx; ++ size_t idx; + for (idx = 0; wordidx != '\0' && idx < how_far; idx++); + /* Edge forward in the string... */ + +@@ -167,7 +167,7 @@ static char Lookahead(char *word, int ho + */ + static int metaphone(unsigned char *word, size_t word_len, zend_long max_phonemes, zend_string **phoned_word, int traditional) + { +- int w_idx = 0; /* point in the phonization we're at. */ ++ size_t w_idx = 0; /* point in the phonization we're at. */ + size_t p_idx = 0; /* end of the phoned phrase */ + size_t max_buffer_len = 0; /* maximum length of the destination buffer */ +
View file
php7-CVE-2026-91765.patch
Added
@@ -0,0 +1,241 @@ +From 3655b79c7bfa90db004d75a3b282ed0f538f4836 Mon Sep 17 00:00:00 2001 +From: Alexandre Daubois <alex.daubois@gmail.com> +Date: Thu, 17 Sep 2026 08:09:08 +0200 +Subject: PATCH Fix GHSA-rgrp-mwpx-f6rm: unbounded recursion in ext/soap XML + parsing and decoding + +--- + ext/soap/php_encoding.c | 7 ++ + ext/soap/php_soap.h | 3 + + ext/soap/php_xml.c | 102 ++++++++++++++---- + ext/soap/soap.c | 1 + + .../tests/GHSA-rgrp-mwpx-f6rm-href-chain.phpt | 47 ++++++++ + .../tests/GHSA-rgrp-mwpx-f6rm-href-cycle.phpt | 43 ++++++++ + ext/soap/tests/GHSA-rgrp-mwpx-f6rm.phpt | 89 +++++++++++++++ + 7 files changed, 272 insertions(+), 20 deletions(-) + create mode 100644 ext/soap/tests/GHSA-rgrp-mwpx-f6rm-href-chain.phpt + create mode 100644 ext/soap/tests/GHSA-rgrp-mwpx-f6rm-href-cycle.phpt + create mode 100644 ext/soap/tests/GHSA-rgrp-mwpx-f6rm.phpt + +Index: php-7.4.33/ext/soap/php_encoding.c +=================================================================== +--- php-7.4.33.orig/ext/soap/php_encoding.c ++++ php-7.4.33/ext/soap/php_encoding.c +@@ -558,7 +558,12 @@ static zval *master_to_zval_int(zval *re + } + } + if (encode->to_zval) { ++ if (SOAP_GLOBAL(decode_depth) >= SOAP_MAX_DECODE_DEPTH) { ++ soap_error0(E_ERROR, "Encoding: Nesting level too deep"); ++ } ++ SOAP_GLOBAL(decode_depth)++; + ret = encode->to_zval(ret, &encode->details, data); ++ SOAP_GLOBAL(decode_depth)--; + } + return ret; + } +@@ -3424,6 +3429,7 @@ void encode_reset_ns() + { + SOAP_GLOBAL(cur_uniq_ns) = 0; + SOAP_GLOBAL(cur_uniq_ref) = 0; ++ SOAP_GLOBAL(decode_depth) = 0; + if (SOAP_GLOBAL(ref_map)) { + zend_hash_destroy(SOAP_GLOBAL(ref_map)); + } else { +@@ -3436,6 +3442,7 @@ void encode_finish() + { + SOAP_GLOBAL(cur_uniq_ns) = 0; + SOAP_GLOBAL(cur_uniq_ref) = 0; ++ SOAP_GLOBAL(decode_depth) = 0; + if (SOAP_GLOBAL(ref_map)) { + zend_hash_destroy(SOAP_GLOBAL(ref_map)); + efree(SOAP_GLOBAL(ref_map)); +Index: php-7.4.33/ext/soap/php_soap.h +=================================================================== +--- php-7.4.33.orig/ext/soap/php_soap.h ++++ php-7.4.33/ext/soap/php_soap.h +@@ -152,6 +152,8 @@ struct _soapService { + #define SOAP_SSL_METHOD_SSLv3 2 + #define SOAP_SSL_METHOD_SSLv23 3 + ++#define SOAP_MAX_XML_DEPTH 2048 ++#define SOAP_MAX_DECODE_DEPTH (SOAP_MAX_XML_DEPTH * 2) + + ZEND_BEGIN_MODULE_GLOBALS(soap) + HashTable defEncNs; /* mapping of default namespaces to prefixes */ +@@ -177,6 +179,7 @@ ZEND_BEGIN_MODULE_GLOBALS(soap) + HashTable wsdl_cache; + int cur_uniq_ref; + HashTable *ref_map; ++ unsigned int decode_depth; + ZEND_END_MODULE_GLOBALS(soap) + + #ifdef ZTS +Index: php-7.4.33/ext/soap/php_xml.c +=================================================================== +--- php-7.4.33.orig/ext/soap/php_xml.c ++++ php-7.4.33/ext/soap/php_xml.c +@@ -37,36 +37,72 @@ static int is_blank(const xmlChar* str) + return 1; + } + +-/* removes all empty text, comments and other insignoficant nodes */ ++/* removes all empty text, comments and other insignoficant nodes. ++ * Iterative because recursion overflows the stack on a deep document. */ + static void cleanup_xml_node(xmlNodePtr node) + { +- xmlNodePtr trav; +- xmlNodePtr del = NULL; ++ xmlNodePtr parent = node; ++ xmlNodePtr trav = node->children; + +- trav = node->children; + while (trav != NULL) { +- if (del != NULL) { +- xmlUnlinkNode(del); +- xmlFreeNode(del); +- del = NULL; +- } ++ xmlNodePtr next = trav->next; ++ + if (trav->type == XML_TEXT_NODE) { + if (is_blank(trav->content)) { +- del = trav; ++ xmlUnlinkNode(trav); ++ xmlFreeNode(trav); + } + } else if ((trav->type != XML_ELEMENT_NODE) && + (trav->type != XML_CDATA_SECTION_NODE)) { +- del = trav; ++ xmlUnlinkNode(trav); ++ xmlFreeNode(trav); + } else if (trav->children != NULL) { +- cleanup_xml_node(trav); ++ parent = trav; ++ trav = trav->children; ++ continue; + } +- trav = trav->next; ++ ++ while (next == NULL) { ++ if (parent == node) { ++ return; ++ } ++ next = parent->next; ++ parent = parent->parent; ++ } ++ trav = next; + } +- if (del != NULL) { +- xmlUnlinkNode(del); +- xmlFreeNode(del); ++} ++ ++#if LIBXML_VERSION < 21300 ++static int is_nesting_too_deep(xmlNodePtr node) ++{ ++ xmlNodePtr trav = node->children; ++ unsigned int depth = 0; ++ ++ while (trav != NULL) { ++ /* An entity reference borrows its declaration as child list, and that ++ * declaration hangs off the DTD, so descending leaves the document. */ ++ if (trav->children != NULL && ++ trav->type != XML_ENTITY_REF_NODE && ++ trav->type != XML_DTD_NODE) { ++ if (++depth > SOAP_MAX_XML_DEPTH) { ++ return TRUE; ++ } ++ trav = trav->children; ++ continue; ++ } ++ while (trav->next == NULL) { ++ trav = trav->parent; ++ if (trav == node) { ++ return FALSE; ++ } ++ depth--; ++ } ++ trav = trav->next; + } ++ return FALSE; + } ++#endif + + static void soap_ignorableWhitespace(void *ctx, const xmlChar *ch, int len) + { +@@ -124,6 +160,15 @@ xmlDocPtr soap_xmlParseFile(const char * + */ + + if (ret) { ++#if LIBXML_VERSION < 21300 ++ if (is_nesting_too_deep((xmlNodePtr)ret)) { ++ /* php_sdl.c reports xmlGetLastError() as the reason, and libxml2 did ++ * not fail here, so drop the error an earlier parse left behind. */ ++ xmlResetLastError(); ++ xmlFreeDoc(ret); ++ return NULL; ++ } ++#endif + cleanup_xml_node((xmlNodePtr)ret); + } + return ret; +@@ -171,6 +216,13 @@ xmlDocPtr soap_xmlParseMemory(const void + xmlCleanupParser(); + */ + ++#if LIBXML_VERSION < 21300 ++ if (ret && is_nesting_too_deep((xmlNodePtr)ret)) { ++ xmlFreeDoc(ret); ++ ret = NULL; ++ } ++#endif ++ + /* + if (ret) { + cleanup_xml_node((xmlNodePtr)ret); +@@ -293,6 +345,8 @@ xmlNodePtr get_node_with_attribute_ex(xm + + xmlNodePtr get_node_with_attribute_recursive_ex(xmlNodePtr node, char *name, char *name_ns, char *attribute, char *value, char *attr_ns)
View file
php7-CVE-2026-91766.patch
Added
@@ -0,0 +1,184 @@ +From 5af9465ca890be679033d5fb0dc89b6ea071326b Mon Sep 17 00:00:00 2001 +From: Alexandre Daubois <alex.daubois@gmail.com> +Date: Mon, 14 Sep 2026 09:12:03 +0200 +Subject: PATCH Fix GHSA-fpwc-w8rq-cr92: strip credentials from user headers + on cross-origin redirects + +Authorization, Cookie and Proxy-Authorization set through the http context +were forwarded verbatim when follow_location sent the request to another +origin. They are now stripped from the user header bag whenever the +redirect target differs in scheme, host or port, including when the header +name is repeated or the bag uses malformed line endings. + +Co-authored-by: Jakub Zelenka <bukka@php.net> +--- + ext/standard/http_fopen_wrapper.c | 109 +++++++++--- + ext/standard/tests/http/bug61548.phpt | 2 - + .../tests/http/ghsa-fpwc-w8rq-cr92.phpt | 159 ++++++++++++++++++ + 3 files changed, 248 insertions(+), 22 deletions(-) + create mode 100644 ext/standard/tests/http/ghsa-fpwc-w8rq-cr92.phpt + +Index: php-7.4.33/ext/standard/http_fopen_wrapper.c +=================================================================== +--- php-7.4.33.orig/ext/standard/http_fopen_wrapper.c ++++ php-7.4.33/ext/standard/http_fopen_wrapper.c +@@ -83,6 +83,8 @@ + + #define HTTP_WRAPPER_HEADER_INIT 1 + #define HTTP_WRAPPER_REDIRECTED 2 ++#define HTTP_WRAPPER_STRIP_AUTH 8 ++ + + zend_string *zend_string_concat3( + const char *str1, size_t str1_len, +@@ -99,27 +101,68 @@ zend_string *zend_string_concat3( + + return res; + } ++static char *next_header_line(char *line) ++{ ++ while (*line != '\0' && *line != '\r' && *line != '\n') { ++ line++; ++ } ++ if (*line == '\r') { ++ line++; ++ } ++ if (*line == '\n') { ++ line++; ++ } ++ ++ return line; ++} + ++/* Removes every line whose header name matches, along with the folded ++ * continuation lines carrying the rest of its value. Neither a repeated header ++ * nor an occurrence of the name inside another header's value may leave the real ++ * header behind, as that would defeat HTTP_WRAPPER_STRIP_AUTH. */ + static inline void strip_header(char *header_bag, char *lc_header_bag, + const char *lc_header_name) + { +- char *lc_header_start = strstr(lc_header_bag, lc_header_name); +- if (lc_header_start +- && (lc_header_start == lc_header_bag || *(lc_header_start-1) == '\n') +- ) { +- char *header_start = header_bag + (lc_header_start - lc_header_bag); +- char *lc_eol = strchr(lc_header_start, '\n'); ++ size_t name_len = strlen(lc_header_name); ++ char *lc_line = lc_header_bag; + +- if (lc_eol) { +- char *eol = header_start + (lc_eol - lc_header_start); +- size_t eollen = strlen(lc_eol); ++ while (*lc_line != '\0') { ++ if (strncmp(lc_line, lc_header_name, name_len) != 0) { ++ lc_line = next_header_line(lc_line); ++ continue; ++ } + +- memmove(lc_header_start, lc_eol+1, eollen); +- memmove(header_start, eol+1, eollen); +- } else { +- *lc_header_start = '\0'; +- *header_start = '\0'; ++ /* the whitespace RFC 7230 forbids before the colon is tolerated by some ++ * servers, so it must not hide the header from us either */ ++ const char *lc_colon = lc_line + name_len; ++ while (*lc_colon == ' ' || *lc_colon == '\t') { ++ lc_colon++; ++ } ++ ++ if (*lc_colon != ':') { ++ lc_line = next_header_line(lc_line); ++ continue; ++ } ++ ++ char *lc_next = next_header_line(lc_line); ++ while (*lc_next == ' ' || *lc_next == '\t') { ++ lc_next = next_header_line(lc_next); ++ } ++ ++ if (*lc_next == '\0') { ++ /* drop the preceding line break too, or the one appended after the bag ++ * would close the header block early */ ++ while (lc_line > lc_header_bag ++ && (*(lc_line - 1) == '\r' || *(lc_line - 1) == '\n')) { ++ --lc_line; ++ } + } ++ ++ size_t tail_len = strlen(lc_next) + 1; ++ char *line = header_bag + (lc_line - lc_header_bag); ++ ++ memmove(line, header_bag + (lc_next - lc_header_bag), tail_len); ++ memmove(lc_line, lc_next, tail_len); + } + } + +@@ -688,8 +731,23 @@ finish: + + if (!header_init) { + /* strip POST headers on redirect */ +- strip_header(user_headers, t, "content-length:"); +- strip_header(user_headers, t, "content-type:"); ++ strip_header(user_headers, t, "content-length"); ++ strip_header(user_headers, t, "content-type"); ++ } ++ ++ if (flags & HTTP_WRAPPER_STRIP_AUTH) { ++ strip_header(user_headers, t, "authorization"); ++ strip_header(user_headers, t, "cookie"); ++ if (!use_proxy) { ++ strip_header(user_headers, t, "proxy-authorization"); ++ } ++ } ++ ++ if (*user_headers == '\0') { ++ /* everything got stripped, keeping the empty bag would append a ++ * stray CRLF and end the header block early */ ++ efree(user_headers); ++ user_headers = NULL; + } + + if (check_has_header(t, "user-agent:")) { +@@ -1082,14 +1140,22 @@ finish: + header_info.location = NULL; + } + +- php_url_free(resource); +- /* check for invalid redirection URLs */ +- if ((resource = php_url_parse(new_path)) == NULL) { ++ php_url *new_resource = php_url_parse(new_path); ++ if (new_resource == NULL) { + php_stream_wrapper_log_error(wrapper, options, "Invalid redirect URL! %s", new_path); + efree(new_path); + goto out; + } + ++ int default_port = use_ssl ? 443 : 80; ++ bool same_origin = zend_string_equals_ci(resource->scheme, new_resource->scheme) ++ && zend_string_equals_ci(resource->host, new_resource->host) ++ && (resource->port ? resource->port : default_port) ++ == (new_resource->port ? new_resource->port : default_port); ++ ++ php_url_free(resource); ++ resource = new_resource; ++ + #define CHECK_FOR_CNTRL_CHARS(val) { \ + if (val) { \ + unsigned char *s, *e; \ +@@ -1111,9 +1177,14 @@ finish: + CHECK_FOR_CNTRL_CHARS(resource->pass); + CHECK_FOR_CNTRL_CHARS(resource->path); + } ++ ++ int new_flags = HTTP_WRAPPER_REDIRECTED | (flags & HTTP_WRAPPER_STRIP_AUTH); ++ if (!same_origin) { ++ new_flags |= HTTP_WRAPPER_STRIP_AUTH; ++ } + stream = php_stream_url_wrap_http_ex( + wrapper, new_path, mode, options, opened_path, context, +- --redirect_max, HTTP_WRAPPER_REDIRECTED, response_header STREAMS_CC); ++ --redirect_max, new_flags, response_header STREAMS_CC); + efree(new_path); + } else { + php_stream_wrapper_log_error(wrapper, options, "HTTP request failed! %s", tmp_line);
View file
php7-CVE-2026-91767.patch
Added
@@ -0,0 +1,37 @@ +From 78cc82b37a340840c6fbff676f513eb4e3d96533 Mon Sep 17 00:00:00 2001 +From: Jakub Zelenka <bukka@php.net> +Date: Mon, 10 Aug 2026 14:15:35 +0200 +Subject: PATCH Fix GHSA-xr7j-rvgx-xq5p: OOB read in + php_openssl_matches_wildcard_name() + +The memchr() length underflowed when the wildcard prefix and suffix +overlapped in the subject name (e.g. CN "a*aaaa" against peer name "aaaa"). +--- + ext/openssl/tests/GHSA-xr7j-rvgx-xq5p.phpt | 67 ++++++++++++++++++++++ + ext/openssl/xp_ssl.c | 5 +- + 2 files changed, 69 insertions(+), 3 deletions(-) + create mode 100644 ext/openssl/tests/GHSA-xr7j-rvgx-xq5p.phpt + +Index: php-7.4.33/ext/openssl/xp_ssl.c +=================================================================== +--- php-7.4.33.orig/ext/openssl/xp_ssl.c ++++ php-7.4.33/ext/openssl/xp_ssl.c +@@ -389,8 +389,7 @@ static zend_bool php_openssl_x509_finger + static zend_bool php_openssl_matches_wildcard_name(const char *subjectname, const char *certname) /* {{{ */ + { + char *wildcard = NULL; +- ptrdiff_t prefix_len; +- size_t suffix_len, subject_len; ++ size_t prefix_len, suffix_len, subject_len; + + if (strcasecmp(subjectname, certname) == 0) { + return 1; +@@ -409,7 +408,7 @@ static zend_bool php_openssl_matches_wil + + suffix_len = strlen(wildcard + 1); + subject_len = strlen(subjectname); +- if (suffix_len <= subject_len) { ++ if (suffix_len + prefix_len <= subject_len) { + /* 2) suffix must match + * 3) no . between prefix and suffix + **/
View file
php7-CVE-2026-91768.patch
Added
@@ -0,0 +1,27 @@ +From dcdfcf86fcf7f42fa98dd3d000f310ebdad41965 Mon Sep 17 00:00:00 2001 +From: Alexandre Daubois <alex.daubois@gmail.com> +Date: Tue, 25 Aug 2026 11:23:52 +0200 +Subject: PATCH Fix GHSA-62xp-839h-2637: FastCGI allowed_clients compared + only 96 bits of IPv6 addresses + +--- + main/fastcgi.c | 2 +- + ...a-62xp-839h-2637-ipv6-allowed-clients.phpt | 52 +++++++++++++++++++ + ...xp-839h-2637-v4mapped-allowed-clients.phpt | 52 +++++++++++++++++++ + 3 files changed, 105 insertions(+), 1 deletion(-) + create mode 100644 sapi/fpm/tests/ghsa-62xp-839h-2637-ipv6-allowed-clients.phpt + create mode 100644 sapi/fpm/tests/ghsa-62xp-839h-2637-v4mapped-allowed-clients.phpt + +Index: php-7.4.33/main/fastcgi.c +=================================================================== +--- php-7.4.33.orig/main/fastcgi.c ++++ php-7.4.33/main/fastcgi.c +@@ -1343,7 +1343,7 @@ static int fcgi_is_allowed() { + if (client_sa.sa.sa_family == AF_INET6) { + for (i = 0; allowed_clientsi.sa.sa_family ; i++) { + if (allowed_clientsi.sa.sa_family == AF_INET6 +- && !memcmp(&client_sa.sa_inet6.sin6_addr, &allowed_clientsi.sa_inet6.sin6_addr, 12)) { ++ && !memcmp(&client_sa.sa_inet6.sin6_addr, &allowed_clientsi.sa_inet6.sin6_addr, sizeof(client_sa.sa_inet6.sin6_addr))) { + return 1; + } + #ifdef IN6_IS_ADDR_V4MAPPED
View file
php7-CVE-2026-91769.patch
Added
@@ -0,0 +1,97 @@ +From 0bb308eb4cf699e707efbcf97ffb70e46a176be7 Mon Sep 17 00:00:00 2001 +From: Jakub Zelenka <bukka@php.net> +Date: Mon, 10 Aug 2026 22:25:55 +0200 +Subject: PATCH Fix GHSA-vvx9-73fr-5jjx: do not fall back to CN if the cert + has a service ID + +RFC 6125 6.4.4 forbids matching CN-ID if the certificate presents a DNS-ID, +SRV-ID or URI-ID. Falling back allowed a CA that validated only one of those +identities to leave an unvalidated CN to be matched as a host name. + +IP-ID is left out as it is out of scope of RFC 6125 and suppressing CN there +would break IP-only SAN certificates. +--- + ext/openssl/tests/san_absent_cn_fallback.phpt | 61 ++++++++++++++++++ + ext/openssl/tests/san_no_cn_fallback.phpt | 64 +++++++++++++++++++ + ext/openssl/tests/san_peer_matching.phpt | 2 +- + ext/openssl/tests/san_srv_no_cn_fallback.phpt | 57 +++++++++++++++++ + ext/openssl/tests/san_uri_no_cn_fallback.phpt | 57 +++++++++++++++++ + ext/openssl/xp_ssl.c | 28 +++++++- + 6 files changed, 265 insertions(+), 4 deletions(-) + create mode 100644 ext/openssl/tests/san_absent_cn_fallback.phpt + create mode 100644 ext/openssl/tests/san_no_cn_fallback.phpt + create mode 100644 ext/openssl/tests/san_srv_no_cn_fallback.phpt + create mode 100644 ext/openssl/tests/san_uri_no_cn_fallback.phpt + +Index: php-7.4.33/ext/openssl/xp_ssl.c +=================================================================== +--- php-7.4.33.orig/ext/openssl/xp_ssl.c ++++ php-7.4.33/ext/openssl/xp_ssl.c +@@ -421,7 +421,8 @@ static zend_bool php_openssl_matches_wil + } + /* }}} */ + +-static zend_bool php_openssl_matches_san_list(X509 *peer, const char *subject_name) /* {{{ */ ++static zend_bool php_openssl_matches_san_list( ++ X509 *peer, const char *subject_name, zend_bool *has_service_id) + { + int i, len; + unsigned char *cert_name = NULL; +@@ -430,10 +431,14 @@ static zend_bool php_openssl_matches_san + GENERAL_NAMES *alt_names = X509_get_ext_d2i(peer, NID_subject_alt_name, 0, 0); + int alt_name_count = sk_GENERAL_NAME_num(alt_names); + ++ *has_service_id = 0; ++ + for (i = 0; i < alt_name_count; i++) { + GENERAL_NAME *san = sk_GENERAL_NAME_value(alt_names, i); + + if (san->type == GEN_DNS) { ++ *has_service_id = 1; ++ + ASN1_STRING_to_UTF8(&cert_name, san->d.dNSName); + if ((size_t)ASN1_STRING_length(san->d.dNSName) != strlen((const char*)cert_name)) { + OPENSSL_free(cert_name); +@@ -472,6 +477,16 @@ static zend_bool php_openssl_matches_san + * Because IP SAN names are officially deprecated and are + * not allowed by CAs starting in 2015. Deal with it. + */ ++ } else if (san->type == GEN_URI) { ++ *has_service_id = 1; ++ } else if (san->type == GEN_OTHERNAME) { ++ char oid32; ++ ++ /* SRV-ID, matched by OID because NID_SRVName needs OpenSSL 3.0 */ ++ if (OBJ_obj2txt(oid, sizeof(oid), san->d.otherName->type_id, 1) > 0 ++ && strcmp(oid, "1.3.6.1.5.5.7.8.7") == 0) { ++ *has_service_id = 1; ++ } + } + } + +@@ -479,7 +494,6 @@ static zend_bool php_openssl_matches_san + + return 0; + } +-/* }}} */ + + static zend_bool php_openssl_matches_common_name(X509 *peer, const char *subject_name) /* {{{ */ + { +@@ -585,8 +599,16 @@ static int php_openssl_apply_peer_verifi + } + + if (peer_name) { +- if (php_openssl_matches_san_list(peer, peer_name)) { ++ zend_bool has_service_id = 0; ++ ++ if (php_openssl_matches_san_list(peer, peer_name, &has_service_id)) { + return SUCCESS; ++ } else if (has_service_id) { ++ /* CN must be ignored if the certificate presents a service identity. */ ++ php_error_docref(NULL, E_WARNING, ++ "Peer certificate subjectAltName did not match expected name `%s'", ++ peer_name); ++ return FAILURE; + } else if (php_openssl_matches_common_name(peer, peer_name)) { + return SUCCESS; + } else {
View file
php7-CVE-2026-92842.patch
Added
@@ -0,0 +1,31 @@ +Index: php-7.4.33/ext/standard/filters.c +=================================================================== +--- php-7.4.33.orig/ext/standard/filters.c ++++ php-7.4.33/ext/standard/filters.c +@@ -367,7 +367,7 @@ static php_conv_err_t php_conv_base64_en + inst->line_ccnt = line_len; + inst->line_len = line_len; + if (lbchars != NULL) { +- inst->lbchars = (lbchars_dup ? pestrdup(lbchars, persistent) : lbchars); ++ inst->lbchars = (lbchars_dup ? pestrndup(lbchars, lbchars_len, persistent) : lbchars); + inst->lbchars_len = lbchars_len; + } else { + inst->lbchars = NULL; +@@ -976,7 +976,7 @@ static php_conv_err_t php_conv_qprint_en + inst->line_ccnt = line_len; + inst->line_len = line_len; + if (lbchars != NULL) { +- inst->lbchars = (lbchars_dup ? pestrdup(lbchars, persistent) : lbchars); ++ inst->lbchars = (lbchars_dup ? pestrndup(lbchars, lbchars_len, persistent) : lbchars); + inst->lbchars_len = lbchars_len; + } else { + inst->lbchars = NULL; +@@ -1189,7 +1189,7 @@ static php_conv_err_t php_conv_qprint_de + inst->next_char = 0; + inst->lb_ptr = inst->lb_cnt = 0; + if (lbchars != NULL) { +- inst->lbchars = (lbchars_dup ? pestrdup(lbchars, persistent) : lbchars); ++ inst->lbchars = (lbchars_dup ? pestrndup(lbchars, lbchars_len, persistent) : lbchars); + inst->lbchars_len = lbchars_len; + } else { + inst->lbchars = NULL;
View file
php7-CVE-2026-93682.patch
Added
@@ -0,0 +1,41 @@ +From 547566f17a12b4900efb69a7cf8cd325d00613a2 Mon Sep 17 00:00:00 2001 +From: Ilia Alshanetsky <ilia@ilia.ws> +Date: Mon, 24 Aug 2026 12:05:47 -0400 +Subject: PATCH http Fix out-of-bounds read on empty Location header + +An empty Location header allocates a single byte for the NUL +terminator, so reading location1 in the relative-redirect branch +over-reads heap memory and could append a garbage-derived path to the +redirect target instead of the correct host root. Use location_len +instead of strlen, and skip the relative join when location_len is 0, +so the second byte is never read. + +Closes GH-23467 +--- + ext/standard/http_fopen_wrapper.c | 4 +-- + .../http/http_empty_location_redirect.phpt | 36 +++++++++++++++++++ + 2 files changed, 38 insertions(+), 2 deletions(-) + create mode 100644 ext/standard/tests/http/http_empty_location_redirect.phpt + +Index: php-7.4.33/ext/standard/http_fopen_wrapper.c +=================================================================== +--- php-7.4.33.orig/ext/standard/http_fopen_wrapper.c ++++ php-7.4.33/ext/standard/http_fopen_wrapper.c +@@ -1034,7 +1034,7 @@ finish: + + char *new_path = NULL; + +- if (strlen(header_info.location) < 8 || ++ if (header_info.location_len < 8 || + (strncasecmp(header_info.location, "http://", sizeof("http://")-1) && + strncasecmp(header_info.location, "https://", sizeof("https://")-1) && + strncasecmp(header_info.location, "ftp://", sizeof("ftp://")-1) && +@@ -1042,7 +1042,7 @@ finish: + { + char *loc_path = NULL; + if (*header_info.location != '/') { +- if (*(header_info.location+1) != '\0' && resource->path) { ++ if (header_info.location_len > 0 && resource->path) { + char *s = strrchr(ZSTR_VAL(resource->path), '/'); + if (!s) { + s = ZSTR_VAL(resource->path);
View file
php7-CVE-2026-9672.patch
Added
@@ -0,0 +1,42 @@ +From fcd691b377d02285740744bee17c0f298be227d5 Mon Sep 17 00:00:00 2001 +From: Ilija Tovilo <ilija.tovilo@me.com> +Date: Tue, 28 Jul 2026 02:48:11 +0200 +Subject: PATCH libgd patch for CVE-2026-9672 + +Patch by Pierre Joye (pierrejoye). +--- + ext/gd/libgd/gd_gif_in.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c +index 1f697236107f..e055f9024455 100644 +--- a/ext/gd/libgd/gd_gif_in.c ++++ b/ext/gd/libgd/gd_gif_in.c +@@ -450,7 +450,7 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i + sd->table1i = i; + } + for (; i < (1<<MAX_LWZ_BITS); ++i) +- sd->table0i = sd->table10 = 0; ++ sd->table0i = sd->table1i = 0; + + sd->sp = sd->stack; + +@@ -494,6 +494,8 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i + + if (count != 0) + return -2; ++ ++ return -2; + } + + incode = code; +@@ -560,7 +562,7 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned char (*cmap) + int v; + int xpos = 0, ypos = 0, pass = 0; + int i; +- LZW_STATIC_DATA sd; ++ LZW_STATIC_DATA sd = {0}; + + + /* +
View file
php7-crypt-possible-buffer-overread.patch
Added
@@ -0,0 +1,12 @@ +Index: php-7.4.33/ext/standard/crypt.c +=================================================================== +--- php-7.4.33.orig/ext/standard/crypt.c ++++ php-7.4.33/ext/standard/crypt.c +@@ -151,6 +151,7 @@ PHPAPI zend_string *php_crypt(const char + } else if ( + salt0 == '$' && + salt1 == '2' && ++ salt2 != 0 && + salt3 == '$') { + char outputPHP_MAX_SALT_LEN + 1; +
View file
php7-fix-newer-versions-icu.patch
Deleted
@@ -1,36 +0,0 @@ -diff -purN a/build/php.m4 b/build/php.m4 ---- a/build/php.m4 2022-10-31 11:36:05.000000000 +0100 -+++ b/build/php.m4 2024-05-30 21:17:33.622778211 +0200 -@@ -1910,9 +1910,8 @@ AC_DEFUN(PHP_SETUP_ICU, - ICU_CFLAGS="$ICU_CFLAGS -DU_NO_DEFAULT_INCLUDE_UTF_HEADERS=1" - ICU_CXXFLAGS="$ICU_CXXFLAGS -DUNISTR_FROM_CHAR_EXPLICIT=explicit -DUNISTR_FROM_STRING_EXPLICIT=explicit" - -- if test "$PKG_CONFIG icu-io --atleast-version=60"; then -- ICU_CFLAGS="$ICU_CFLAGS -DU_HIDE_OBSOLETE_UTF_OLD_H=1" -- fi -+ AS_IF($PKG_CONFIG icu-io --atleast-version=60, -+ ICU_CFLAGS="$ICU_CFLAGS -DU_HIDE_OBSOLETE_UTF_OLD_H=1") - - ICU_CFLAGS="$ICU_CFLAGS -DU_DEFINE_FALSE_AND_TRUE=1" - ) -diff -purN a/ext/intl/config.m4 b/ext/intl/config.m4 ---- a/ext/intl/config.m4 2022-10-31 11:36:14.000000000 +0100 -+++ b/ext/intl/config.m4 2024-05-30 21:23:44.630021359 +0200 -@@ -83,7 +83,16 @@ if test "$PHP_INTL" != "no"; then - breakiterator/codepointiterator_methods.cpp" - - PHP_REQUIRE_CXX() -- PHP_CXX_COMPILE_STDCXX(11, mandatory, PHP_INTL_STDCXX) -+ -+ AC_MSG_CHECKING(if intl requires -std=gnu++17) -+ AS_IF($PKG_CONFIG icu-uc --atleast-version=74, -+ AC_MSG_RESULT(yes) -+ PHP_CXX_COMPILE_STDCXX(17, mandatory, PHP_INTL_STDCXX) -+ , -+ AC_MSG_RESULT(no) -+ PHP_CXX_COMPILE_STDCXX(11, mandatory, PHP_INTL_STDCXX) -+ ) -+ - PHP_INTL_CXX_FLAGS="$INTL_COMMON_FLAGS $PHP_INTL_STDCXX $ICU_CXXFLAGS" - if test "$ext_shared" = "no"; then - PHP_ADD_SOURCES(PHP_EXT_DIR(intl), $PHP_INTL_CXX_SOURCES, $PHP_INTL_CXX_FLAGS)
View file
_link
Changed
@@ -1,4 +1,4 @@ -<link project="openSUSE.org:devel:languages:php:php74" baserev="1eef1f726a8f2d34912260d3197e77d2"> +<link project="openSUSE.org:devel:languages:php:php74" baserev="f7bd93c9f1bf9cc8d906e66094ff488e"> <patches> <branch/> </patches>
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.