mirror of
https://github.com/chialab/docker-php.git
synced 2026-11-06 12:40:34 -04:00
feat: apply more backported patches from the Debian PHP team
This commit is contained in:
le0m
@@ -14,53 +14,29 @@ For development environments, you might want to choose an [image with XDebug ins
|
||||
|
||||
If you use Open Telemetry in your project, you may be interested in an [image with the OTel PHP extension](https://hub.docker.com/r/chialab/php-otel/).
|
||||
|
||||
If you are really desperate and need PHP 5.6 with support for MySQL 8.x, check the [php-compat](https://hub.docker.com/r/chialab/php-compat/) image.
|
||||
If you need PHP 5.6 to connect to a MySQL 8.x server that keeps `caching_sha2_password` as its default authentication plugin, check the [php-compat](https://hub.docker.com/r/chialab/php-compat/) image.
|
||||
|
||||
## Available tags
|
||||
- `latest`
|
||||
- `5.6`
|
||||
- `5.6-apache`
|
||||
- `5.6-fpm`
|
||||
- `7.0`
|
||||
- `7.0-apache`
|
||||
- `7.0-fpm`
|
||||
- `7.1`
|
||||
- `7.1-apache`
|
||||
- `7.1-fpm`
|
||||
- `7.2`
|
||||
- `7.2-apache`
|
||||
- `7.2-fpm`
|
||||
- `7.3`
|
||||
- `7.3-apache`
|
||||
- `7.3-fpm`
|
||||
- `7.4`
|
||||
- `7.4-apache`
|
||||
- `7.4-fpm`
|
||||
- `8.0`
|
||||
- `8.0-apache`
|
||||
- `8.0-fpm`
|
||||
- `8.1`
|
||||
- `8.1-apache`
|
||||
- `8.1-fpm`
|
||||
- `8.2`
|
||||
- `8.2-apache`
|
||||
- `8.2-fpm`
|
||||
- `8.3`
|
||||
- `8.3-apache`
|
||||
- `8.3-fpm`
|
||||
- `8.4`
|
||||
- `8.4-apache`
|
||||
- `8.4-fpm`
|
||||
- `8.5`
|
||||
- `8.5-apache`
|
||||
- `8.5-fpm`
|
||||
- `latest`, `alpine`
|
||||
- `8.5`, `8.5-apache`, `8.5-fpm`, `8.5-alpine`, `8.5-fpm-alpine`
|
||||
- `8.4`, `8.4-apache`, `8.4-fpm`, `8.4-alpine`, `8.4-fpm-alpine`
|
||||
- `8.3`, `8.3-apache`, `8.3-fpm`, `8.3-alpine`, `8.3-fpm-alpine`
|
||||
- `8.2`, `8.2-apache`, `8.2-fpm`, `8.2-alpine`, `8.2-fpm-alpine`
|
||||
- `8.1`, `8.1-apache`, `8.1-fpm`, `8.1-alpine`, `8.1-fpm-alpine`
|
||||
- `8.0`, `8.0-apache`, `8.0-fpm`, `8.0-alpine`, `8.0-fpm-alpine`
|
||||
- `7.4`, `7.4-apache`, `7.4-fpm`, `7.4-alpine`, `7.4-fpm-alpine`
|
||||
- `7.3`, `7.3-apache`, `7.3-fpm`, `7.3-alpine`, `7.3-fpm-alpine`
|
||||
- `7.2`, `7.2-apache`, `7.2-fpm`, `7.2-alpine`, `7.2-fpm-alpine`
|
||||
- `7.1`, `7.1-apache`, `7.1-fpm`, `7.1-alpine`, `7.1-fpm-alpine`
|
||||
- `7.0`, `7.0-apache`, `7.0-fpm`
|
||||
- `5.6`, `5.6-apache`, `5.6-fpm`
|
||||
|
||||
As you might have guessed, all tags are built on top of the corresponding tag of the official image. Not all tags are supported in order to easen maintenance.
|
||||
|
||||
### Security backports for EOL versions
|
||||
The official images of unsupported PHP versions (5.6 to 8.1) no longer receive security fixes. For those versions we rebuild PHP from the official images' Dockerfiles (see [`eol/`](eol/)), on the same OS release, with security patches applied to the PHP sources. The image layout doesn't change, so `docker-php-ext-*` and `install-php-extensions` keep working.
|
||||
|
||||
The `PHP_PATCHES` environment variable and the `it.chialab.php.patches` label list what has been applied. `PHP_VERSION` and `php -v` still report the upstream version, so vulnerability scanners may keep flagging fixed issues.
|
||||
The patches are the security and bug-fix backports maintained for [deb.sury.org](https://deb.sury.org), taken from the Debian PHP team's [packaging repository](https://salsa.debian.org/php-team/php). Debian packaging changes, changed defaults and deb.sury.org's version-check telemetry are left out. The `PHP_PATCHES` environment variable and the `it.chialab.php.patches` label name the deb.sury.org build the patches come from (e.g. `deb.sury.org-7.4.33-31`). `PHP_VERSION` and `php -v` still report the upstream version, so vulnerability scanners may keep flagging fixed issues.
|
||||
|
||||
## Installed extensions
|
||||
The following modules and extensions have been enabled,
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
ARG BASE_IMAGE=chialab/php:5.6
|
||||
FROM ${BASE_IMAGE}
|
||||
LABEL maintainer="dev@chialab.io"
|
||||
|
||||
# Rebuild the MySQL extensions against MariaDB's libmysqlclient instead of mysqlnd: it can connect
|
||||
# to MySQL 8+ servers whose default authentication plugin (caching_sha2_password) mysqlnd 5.6
|
||||
# doesn't know, as long as the account itself uses mysql_native_password.
|
||||
RUN set -eux; \
|
||||
apt-get update; \
|
||||
apt-get install -y --no-install-recommends libmariadbclient-dev-compat; \
|
||||
rm -rf /var/lib/apt/lists/*; \
|
||||
rm -f "$PHP_INI_DIR"/conf.d/docker-php-ext-mysql.ini "$PHP_INI_DIR"/conf.d/docker-php-ext-mysqli.ini "$PHP_INI_DIR"/conf.d/docker-php-ext-pdo_mysql.ini; \
|
||||
docker-php-ext-configure mysql --with-mysql=/usr; \
|
||||
docker-php-ext-configure mysqli --with-mysqli=/usr/bin/mysql_config; \
|
||||
docker-php-ext-configure pdo_mysql --with-pdo-mysql=/usr; \
|
||||
docker-php-ext-install mysql mysqli pdo_mysql
|
||||
@@ -1,272 +0,0 @@
|
||||
#
|
||||
# This is taken from the official PHP image's Dockerfile (https://github.com/docker-library/php/tree/783878384a8f3953ed571e5a34ba0fe546726c85)
|
||||
# and slightly fixed to work in this day and age.
|
||||
#
|
||||
|
||||
FROM debian:stretch-slim
|
||||
|
||||
LABEL maintainer="dev@chialab.io"
|
||||
|
||||
# Fix Debian 9 (Stretch) source list, because it has been moved to archive, and update packages.
|
||||
RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
|
||||
-e 's/security.debian.org/archive.debian.org/g' \
|
||||
-e '/stretch-updates/d' /etc/apt/sources.list \
|
||||
&& apt-get update && apt-get upgrade -y
|
||||
|
||||
# prevent Debian's PHP packages from being installed
|
||||
# https://github.com/docker-library/php/pull/542
|
||||
RUN set -eux; \
|
||||
{ \
|
||||
echo 'Package: php*'; \
|
||||
echo 'Pin: release *'; \
|
||||
echo 'Pin-Priority: -1'; \
|
||||
} > /etc/apt/preferences.d/no-debian-php
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
# (see persistent deps below)
|
||||
ENV PHPIZE_DEPS \
|
||||
autoconf \
|
||||
dpkg-dev \
|
||||
file \
|
||||
g++ \
|
||||
gcc \
|
||||
libc-dev \
|
||||
make \
|
||||
pkg-config \
|
||||
re2c
|
||||
|
||||
# persistent / runtime deps
|
||||
RUN apt-get update && apt-get install -y \
|
||||
$PHPIZE_DEPS \
|
||||
ca-certificates \
|
||||
curl \
|
||||
xz-utils \
|
||||
--no-install-recommends && rm -r /var/lib/apt/lists/*
|
||||
|
||||
ENV PHP_INI_DIR /usr/local/etc/php
|
||||
RUN mkdir -p $PHP_INI_DIR/conf.d
|
||||
|
||||
##<autogenerated>##
|
||||
##</autogenerated>##
|
||||
|
||||
# Apply stack smash protection to functions using local buffers and alloca()
|
||||
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
|
||||
# Enable optimization (-O2)
|
||||
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
|
||||
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
|
||||
# https://github.com/docker-library/php/issues/272
|
||||
ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
|
||||
ENV PHP_CPPFLAGS="$PHP_CFLAGS"
|
||||
ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
|
||||
|
||||
ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
|
||||
|
||||
ENV PHP_VERSION 5.6.40
|
||||
ENV PHP_URL="https://www.php.net/distributions/php-5.6.40.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-5.6.40.tar.xz.asc"
|
||||
ENV PHP_SHA256="1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c" PHP_MD5=""
|
||||
|
||||
RUN set -xe; \
|
||||
\
|
||||
fetchDeps=' \
|
||||
wget \
|
||||
'; \
|
||||
if ! command -v gpg > /dev/null; then \
|
||||
fetchDeps="$fetchDeps \
|
||||
dirmngr \
|
||||
gnupg \
|
||||
"; \
|
||||
fi; \
|
||||
apt-get update; \
|
||||
apt-get install -y --no-install-recommends $fetchDeps; \
|
||||
rm -rf /var/lib/apt/lists/*; \
|
||||
\
|
||||
mkdir -p /usr/src; \
|
||||
cd /usr/src; \
|
||||
\
|
||||
wget -O php.tar.xz "$PHP_URL"; \
|
||||
\
|
||||
if [ -n "$PHP_SHA256" ]; then \
|
||||
echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
|
||||
fi; \
|
||||
if [ -n "$PHP_MD5" ]; then \
|
||||
echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \
|
||||
fi; \
|
||||
\
|
||||
if [ -n "$PHP_ASC_URL" ]; then \
|
||||
wget -O php.tar.xz.asc "$PHP_ASC_URL"; \
|
||||
export GNUPGHOME="$(mktemp -d)"; \
|
||||
for key in $GPG_KEYS; do \
|
||||
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
|
||||
done; \
|
||||
gpg --batch --verify php.tar.xz.asc php.tar.xz; \
|
||||
command -v gpgconf > /dev/null && gpgconf --kill all; \
|
||||
rm -rf "$GNUPGHOME"; \
|
||||
fi; \
|
||||
\
|
||||
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps
|
||||
|
||||
COPY --from=php:5.6 /usr/local/bin/docker-php-source /usr/local/bin/
|
||||
|
||||
# Security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
savedAptMark="$(apt-mark showmanual)"; \
|
||||
apt-get update; \
|
||||
apt-get install -y --no-install-recommends \
|
||||
libcurl4-openssl-dev \
|
||||
libedit-dev \
|
||||
libsqlite3-dev \
|
||||
libssl1.0-dev \
|
||||
libxml2-dev \
|
||||
zlib1g-dev \
|
||||
libmariadb2 libmariadbclient-dev-compat \
|
||||
${PHP_EXTRA_BUILD_DEPS:-} \
|
||||
; \
|
||||
rm -rf /var/lib/apt/lists/*; \
|
||||
\
|
||||
export \
|
||||
CFLAGS="$PHP_CFLAGS" \
|
||||
CPPFLAGS="$PHP_CPPFLAGS" \
|
||||
LDFLAGS="$PHP_LDFLAGS" \
|
||||
; \
|
||||
docker-php-source extract; \
|
||||
cd /usr/src/php; \
|
||||
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||
debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
|
||||
# https://bugs.php.net/bug.php?id=74125
|
||||
if [ ! -d /usr/include/curl ]; then \
|
||||
ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
|
||||
fi; \
|
||||
./configure \
|
||||
--build="$gnuArch" \
|
||||
--with-config-file-path="$PHP_INI_DIR" \
|
||||
--with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
|
||||
\
|
||||
# make sure invalid --configure-flags are fatal errors intead of just warnings
|
||||
--enable-option-checking=fatal \
|
||||
\
|
||||
# https://github.com/docker-library/php/issues/439
|
||||
--with-mhash \
|
||||
\
|
||||
# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
|
||||
--enable-ftp \
|
||||
# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
|
||||
--enable-mbstring \
|
||||
# Use MariaDB's libmysqlclient library instead of mysqlnd to be able to communicate with MySQL 8+, which uses new locales of the utf8mb4 family that are unknown to old mysqlnd
|
||||
--disable-mysqlnd \
|
||||
--with-mysql="/usr" \
|
||||
--with-mysqli="/usr/bin/mysql_config" \
|
||||
--with-pdo-mysql="/usr" \
|
||||
\
|
||||
--with-curl \
|
||||
--with-libedit \
|
||||
--with-openssl \
|
||||
--with-zlib \
|
||||
\
|
||||
# bundled pcre does not support JIT on s390x
|
||||
# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
|
||||
$(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
|
||||
--with-libdir="lib/$debMultiarch" \
|
||||
\
|
||||
${PHP_EXTRA_CONFIGURE_ARGS:-} \
|
||||
; \
|
||||
make -j "$(nproc)"; \
|
||||
make install; \
|
||||
find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
|
||||
make clean; \
|
||||
\
|
||||
# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
|
||||
cp -v php.ini-* "$PHP_INI_DIR/"; \
|
||||
\
|
||||
cd /; \
|
||||
docker-php-source delete; \
|
||||
\
|
||||
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||
apt-mark auto '.*' > /dev/null; \
|
||||
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
|
||||
find /usr/local -type f -executable -exec ldd '{}' ';' \
|
||||
| awk '/=>/ { print $(NF-1) }' \
|
||||
| sort -u \
|
||||
| xargs -r dpkg-query --search \
|
||||
| cut -d: -f1 \
|
||||
| sort -u \
|
||||
| xargs -r apt-mark manual \
|
||||
; \
|
||||
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||
\
|
||||
php --version; \
|
||||
\
|
||||
# https://github.com/docker-library/php/issues/443
|
||||
pecl update-channels; \
|
||||
rm -rf /tmp/pear ~/.pearrc
|
||||
|
||||
COPY --from=php:5.6 /usr/local/bin/docker-php-ext-* /usr/local/bin/docker-php-entrypoint /usr/local/bin/
|
||||
|
||||
ENTRYPOINT ["docker-php-entrypoint"]
|
||||
##<autogenerated>##
|
||||
CMD ["php", "-a"]
|
||||
##</autogenerated>##
|
||||
|
||||
# Download script to install PHP extensions and dependencies
|
||||
ADD https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/
|
||||
|
||||
RUN chmod +x /usr/local/bin/install-php-extensions
|
||||
|
||||
# PEAR < 1.10.18 can't read pecl.php.net responses anymore.
|
||||
RUN pear upgrade --force https://pear.php.net/get/PEAR-1.10.18.tgz
|
||||
|
||||
# retry: PECL sometimes replies "No releases available" on CI runners.
|
||||
RUN retry() { for i in 1 2 3; do "$@" && return; sleep 10; done; return 1; }; \
|
||||
DEBIAN_FRONTEND=noninteractive apt-get update -q \
|
||||
&& DEBIAN_FRONTEND=noninteractive apt-get install -qq -y \
|
||||
curl \
|
||||
git \
|
||||
zip unzip \
|
||||
# iconv, mbstring and pdo_sqlite are omitted as they are already installed
|
||||
&& PHP_EXTENSIONS=" \
|
||||
amqp \
|
||||
bcmath \
|
||||
bz2 \
|
||||
calendar \
|
||||
event \
|
||||
exif \
|
||||
gd \
|
||||
gettext \
|
||||
imagick \
|
||||
intl \
|
||||
ldap \
|
||||
mcrypt \
|
||||
memcached \
|
||||
mysql \
|
||||
mysqli \
|
||||
opcache \
|
||||
pdo_mysql \
|
||||
pdo_pgsql \
|
||||
pgsql \
|
||||
redis \
|
||||
soap \
|
||||
sockets \
|
||||
xsl \
|
||||
zip \
|
||||
" \
|
||||
&& retry install-php-extensions $PHP_EXTENSIONS
|
||||
|
||||
# Install Composer.
|
||||
ENV PATH=$PATH:/root/composer/vendor/bin \
|
||||
COMPOSER_ALLOW_SUPERUSER=1 \
|
||||
COMPOSER_HOME=/root/composer
|
||||
RUN cd /opt \
|
||||
# Download installer and check for its integrity.
|
||||
&& curl -sSL https://getcomposer.org/installer > composer-setup.php \
|
||||
&& curl -sSL https://composer.github.io/installer.sha384sum > composer-setup.sha384sum \
|
||||
&& sha384sum --check composer-setup.sha384sum \
|
||||
# Install Composer 2.
|
||||
&& php composer-setup.php --install-dir=/usr/local/bin --filename=composer --2 \
|
||||
# Remove installer files.
|
||||
&& rm /opt/composer-setup.php /opt/composer-setup.sha384sum
|
||||
@@ -1,337 +0,0 @@
|
||||
#
|
||||
# This is taken from the official PHP image's Dockerfile (https://github.com/docker-library/php/tree/783878384a8f3953ed571e5a34ba0fe546726c85)
|
||||
# and slightly fixed to work in this day and age.
|
||||
#
|
||||
|
||||
FROM debian:stretch-slim
|
||||
|
||||
LABEL maintainer="dev@chialab.io"
|
||||
|
||||
# Fix Debian 9 (Stretch) source list, because it has been moved to archive, and update packages.
|
||||
RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
|
||||
-e 's/security.debian.org/archive.debian.org/g' \
|
||||
-e '/stretch-updates/d' /etc/apt/sources.list \
|
||||
&& apt-get update && apt-get upgrade -y
|
||||
|
||||
# prevent Debian's PHP packages from being installed
|
||||
# https://github.com/docker-library/php/pull/542
|
||||
RUN set -eux; \
|
||||
{ \
|
||||
echo 'Package: php*'; \
|
||||
echo 'Pin: release *'; \
|
||||
echo 'Pin-Priority: -1'; \
|
||||
} > /etc/apt/preferences.d/no-debian-php
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
# (see persistent deps below)
|
||||
ENV PHPIZE_DEPS \
|
||||
autoconf \
|
||||
dpkg-dev \
|
||||
file \
|
||||
g++ \
|
||||
gcc \
|
||||
libc-dev \
|
||||
make \
|
||||
pkg-config \
|
||||
re2c
|
||||
|
||||
# persistent / runtime deps
|
||||
RUN apt-get update && apt-get install -y \
|
||||
$PHPIZE_DEPS \
|
||||
ca-certificates \
|
||||
curl \
|
||||
xz-utils \
|
||||
--no-install-recommends && rm -r /var/lib/apt/lists/*
|
||||
|
||||
ENV PHP_INI_DIR /usr/local/etc/php
|
||||
RUN mkdir -p $PHP_INI_DIR/conf.d
|
||||
|
||||
##<autogenerated>##
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
apache2 \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
ENV APACHE_CONFDIR /etc/apache2
|
||||
ENV APACHE_ENVVARS $APACHE_CONFDIR/envvars
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
# generically convert lines like
|
||||
# export APACHE_RUN_USER=www-data
|
||||
# into
|
||||
# : ${APACHE_RUN_USER:=www-data}
|
||||
# export APACHE_RUN_USER
|
||||
# so that they can be overridden at runtime ("-e APACHE_RUN_USER=...")
|
||||
sed -ri 's/^export ([^=]+)=(.*)$/: ${\1:=\2}\nexport \1/' "$APACHE_ENVVARS"; \
|
||||
\
|
||||
# setup directories and permissions
|
||||
. "$APACHE_ENVVARS"; \
|
||||
for dir in \
|
||||
"$APACHE_LOCK_DIR" \
|
||||
"$APACHE_RUN_DIR" \
|
||||
"$APACHE_LOG_DIR" \
|
||||
/var/www/html \
|
||||
; do \
|
||||
rm -rvf "$dir"; \
|
||||
mkdir -p "$dir"; \
|
||||
chown "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$dir"; \
|
||||
# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743)
|
||||
chmod 777 "$dir"; \
|
||||
done; \
|
||||
\
|
||||
# logs should go to stdout / stderr
|
||||
ln -sfT /dev/stderr "$APACHE_LOG_DIR/error.log"; \
|
||||
ln -sfT /dev/stdout "$APACHE_LOG_DIR/access.log"; \
|
||||
ln -sfT /dev/stdout "$APACHE_LOG_DIR/other_vhosts_access.log"; \
|
||||
chown -R --no-dereference "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$APACHE_LOG_DIR"
|
||||
|
||||
# Apache + PHP requires preforking Apache for best results
|
||||
RUN a2dismod mpm_event && a2enmod mpm_prefork
|
||||
|
||||
# PHP files should be handled by PHP, and should be preferred over any other file type
|
||||
RUN { \
|
||||
echo '<FilesMatch \.php$>'; \
|
||||
echo '\tSetHandler application/x-httpd-php'; \
|
||||
echo '</FilesMatch>'; \
|
||||
echo; \
|
||||
echo 'DirectoryIndex disabled'; \
|
||||
echo 'DirectoryIndex index.php index.html'; \
|
||||
echo; \
|
||||
echo '<Directory /var/www/>'; \
|
||||
echo '\tOptions -Indexes'; \
|
||||
echo '\tAllowOverride All'; \
|
||||
echo '</Directory>'; \
|
||||
} | tee "$APACHE_CONFDIR/conf-available/docker-php.conf" \
|
||||
&& a2enconf docker-php
|
||||
|
||||
ENV PHP_EXTRA_BUILD_DEPS apache2-dev
|
||||
ENV PHP_EXTRA_CONFIGURE_ARGS --with-apxs2 --disable-cgi
|
||||
##</autogenerated>##
|
||||
|
||||
# Apply stack smash protection to functions using local buffers and alloca()
|
||||
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
|
||||
# Enable optimization (-O2)
|
||||
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
|
||||
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
|
||||
# https://github.com/docker-library/php/issues/272
|
||||
ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
|
||||
ENV PHP_CPPFLAGS="$PHP_CFLAGS"
|
||||
ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
|
||||
|
||||
ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
|
||||
|
||||
ENV PHP_VERSION 5.6.40
|
||||
ENV PHP_URL="https://www.php.net/distributions/php-5.6.40.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-5.6.40.tar.xz.asc"
|
||||
ENV PHP_SHA256="1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c" PHP_MD5=""
|
||||
|
||||
RUN set -xe; \
|
||||
\
|
||||
fetchDeps=' \
|
||||
wget \
|
||||
'; \
|
||||
if ! command -v gpg > /dev/null; then \
|
||||
fetchDeps="$fetchDeps \
|
||||
dirmngr \
|
||||
gnupg \
|
||||
"; \
|
||||
fi; \
|
||||
apt-get update; \
|
||||
apt-get install -y --no-install-recommends $fetchDeps; \
|
||||
rm -rf /var/lib/apt/lists/*; \
|
||||
\
|
||||
mkdir -p /usr/src; \
|
||||
cd /usr/src; \
|
||||
\
|
||||
wget -O php.tar.xz "$PHP_URL"; \
|
||||
\
|
||||
if [ -n "$PHP_SHA256" ]; then \
|
||||
echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
|
||||
fi; \
|
||||
if [ -n "$PHP_MD5" ]; then \
|
||||
echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \
|
||||
fi; \
|
||||
\
|
||||
if [ -n "$PHP_ASC_URL" ]; then \
|
||||
wget -O php.tar.xz.asc "$PHP_ASC_URL"; \
|
||||
export GNUPGHOME="$(mktemp -d)"; \
|
||||
for key in $GPG_KEYS; do \
|
||||
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
|
||||
done; \
|
||||
gpg --batch --verify php.tar.xz.asc php.tar.xz; \
|
||||
command -v gpgconf > /dev/null && gpgconf --kill all; \
|
||||
rm -rf "$GNUPGHOME"; \
|
||||
fi; \
|
||||
\
|
||||
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps
|
||||
|
||||
COPY --from=php:5.6-apache /usr/local/bin/docker-php-source /usr/local/bin/
|
||||
|
||||
# Security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
savedAptMark="$(apt-mark showmanual)"; \
|
||||
apt-get update; \
|
||||
apt-get install -y --no-install-recommends \
|
||||
libcurl4-openssl-dev \
|
||||
libedit-dev \
|
||||
libsqlite3-dev \
|
||||
libssl1.0-dev \
|
||||
libxml2-dev \
|
||||
zlib1g-dev \
|
||||
libmariadb2 libmariadbclient-dev-compat \
|
||||
${PHP_EXTRA_BUILD_DEPS:-} \
|
||||
; \
|
||||
rm -rf /var/lib/apt/lists/*; \
|
||||
\
|
||||
export \
|
||||
CFLAGS="$PHP_CFLAGS" \
|
||||
CPPFLAGS="$PHP_CPPFLAGS" \
|
||||
LDFLAGS="$PHP_LDFLAGS" \
|
||||
; \
|
||||
docker-php-source extract; \
|
||||
cd /usr/src/php; \
|
||||
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||
debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
|
||||
# https://bugs.php.net/bug.php?id=74125
|
||||
if [ ! -d /usr/include/curl ]; then \
|
||||
ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
|
||||
fi; \
|
||||
./configure \
|
||||
--build="$gnuArch" \
|
||||
--with-config-file-path="$PHP_INI_DIR" \
|
||||
--with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
|
||||
\
|
||||
# make sure invalid --configure-flags are fatal errors intead of just warnings
|
||||
--enable-option-checking=fatal \
|
||||
\
|
||||
# https://github.com/docker-library/php/issues/439
|
||||
--with-mhash \
|
||||
\
|
||||
# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
|
||||
--enable-ftp \
|
||||
# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
|
||||
--enable-mbstring \
|
||||
# Use MariaDB's libmysqlclient library instead of mysqlnd to be able to communicate with MySQL 8+, which uses new locales of the utf8mb4 family that are unknown to old mysqlnd
|
||||
--disable-mysqlnd \
|
||||
--with-mysql="/usr" \
|
||||
--with-mysqli="/usr/bin/mysql_config" \
|
||||
--with-pdo-mysql="/usr" \
|
||||
\
|
||||
--with-curl \
|
||||
--with-libedit \
|
||||
--with-openssl \
|
||||
--with-zlib \
|
||||
\
|
||||
# bundled pcre does not support JIT on s390x
|
||||
# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
|
||||
$(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
|
||||
--with-libdir="lib/$debMultiarch" \
|
||||
\
|
||||
${PHP_EXTRA_CONFIGURE_ARGS:-} \
|
||||
; \
|
||||
make -j "$(nproc)"; \
|
||||
make install; \
|
||||
find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
|
||||
make clean; \
|
||||
\
|
||||
# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
|
||||
cp -v php.ini-* "$PHP_INI_DIR/"; \
|
||||
\
|
||||
cd /; \
|
||||
docker-php-source delete; \
|
||||
\
|
||||
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||
apt-mark auto '.*' > /dev/null; \
|
||||
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
|
||||
find /usr/local -type f -executable -exec ldd '{}' ';' \
|
||||
| awk '/=>/ { print $(NF-1) }' \
|
||||
| sort -u \
|
||||
| xargs -r dpkg-query --search \
|
||||
| cut -d: -f1 \
|
||||
| sort -u \
|
||||
| xargs -r apt-mark manual \
|
||||
; \
|
||||
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||
\
|
||||
php --version; \
|
||||
\
|
||||
# https://github.com/docker-library/php/issues/443
|
||||
pecl update-channels; \
|
||||
rm -rf /tmp/pear ~/.pearrc
|
||||
|
||||
COPY --from=php:5.6-apache /usr/local/bin/docker-php-ext-* /usr/local/bin/docker-php-entrypoint /usr/local/bin/
|
||||
|
||||
ENTRYPOINT ["docker-php-entrypoint"]
|
||||
##<autogenerated>##
|
||||
COPY --from=php:5.6-apache /usr/local/bin/apache2-foreground /usr/local/bin/
|
||||
WORKDIR /var/www/html
|
||||
|
||||
EXPOSE 80
|
||||
CMD ["apache2-foreground"]
|
||||
##</autogenerated>##
|
||||
|
||||
# Download script to install PHP extensions and dependencies
|
||||
ADD https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/
|
||||
|
||||
RUN chmod +x /usr/local/bin/install-php-extensions
|
||||
|
||||
# PEAR < 1.10.18 can't read pecl.php.net responses anymore.
|
||||
RUN pear upgrade --force https://pear.php.net/get/PEAR-1.10.18.tgz
|
||||
|
||||
# retry: PECL sometimes replies "No releases available" on CI runners.
|
||||
RUN retry() { for i in 1 2 3; do "$@" && return; sleep 10; done; return 1; }; \
|
||||
DEBIAN_FRONTEND=noninteractive apt-get update -q \
|
||||
&& DEBIAN_FRONTEND=noninteractive apt-get install -qq -y \
|
||||
curl \
|
||||
git \
|
||||
zip unzip \
|
||||
# iconv, mbstring and pdo_sqlite are omitted as they are already installed
|
||||
&& PHP_EXTENSIONS=" \
|
||||
amqp \
|
||||
bcmath \
|
||||
bz2 \
|
||||
calendar \
|
||||
event \
|
||||
exif \
|
||||
gd \
|
||||
gettext \
|
||||
imagick \
|
||||
intl \
|
||||
ldap \
|
||||
mcrypt \
|
||||
memcached \
|
||||
mysql \
|
||||
mysqli \
|
||||
opcache \
|
||||
pdo_mysql \
|
||||
pdo_pgsql \
|
||||
pgsql \
|
||||
redis \
|
||||
soap \
|
||||
sockets \
|
||||
xsl \
|
||||
zip \
|
||||
" \
|
||||
&& retry install-php-extensions $PHP_EXTENSIONS \
|
||||
&& if command -v a2enmod; then a2enmod rewrite; fi
|
||||
|
||||
# Install Composer.
|
||||
ENV PATH=$PATH:/root/composer/vendor/bin \
|
||||
COMPOSER_ALLOW_SUPERUSER=1 \
|
||||
COMPOSER_HOME=/root/composer
|
||||
RUN cd /opt \
|
||||
# Download installer and check for its integrity.
|
||||
&& curl -sSL https://getcomposer.org/installer > composer-setup.php \
|
||||
&& curl -sSL https://composer.github.io/installer.sha384sum > composer-setup.sha384sum \
|
||||
&& sha384sum --check composer-setup.sha384sum \
|
||||
# Install Composer 2.
|
||||
&& php composer-setup.php --install-dir=/usr/local/bin --filename=composer --2 \
|
||||
# Remove installer files.
|
||||
&& rm /opt/composer-setup.php /opt/composer-setup.sha384sum
|
||||
@@ -1,312 +0,0 @@
|
||||
#
|
||||
# This is taken from the official PHP image's Dockerfile (https://github.com/docker-library/php/tree/783878384a8f3953ed571e5a34ba0fe546726c85)
|
||||
# and slightly fixed to work in this day and age.
|
||||
#
|
||||
|
||||
FROM debian:stretch-slim
|
||||
|
||||
LABEL maintainer="dev@chialab.io"
|
||||
|
||||
# Fix Debian 9 (Stretch) source list, because it has been moved to archive, and update packages.
|
||||
RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
|
||||
-e 's/security.debian.org/archive.debian.org/g' \
|
||||
-e '/stretch-updates/d' /etc/apt/sources.list \
|
||||
&& apt-get update && apt-get upgrade -y
|
||||
|
||||
# prevent Debian's PHP packages from being installed
|
||||
# https://github.com/docker-library/php/pull/542
|
||||
RUN set -eux; \
|
||||
{ \
|
||||
echo 'Package: php*'; \
|
||||
echo 'Pin: release *'; \
|
||||
echo 'Pin-Priority: -1'; \
|
||||
} > /etc/apt/preferences.d/no-debian-php
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
# (see persistent deps below)
|
||||
ENV PHPIZE_DEPS \
|
||||
autoconf \
|
||||
dpkg-dev \
|
||||
file \
|
||||
g++ \
|
||||
gcc \
|
||||
libc-dev \
|
||||
make \
|
||||
pkg-config \
|
||||
re2c
|
||||
|
||||
# persistent / runtime deps
|
||||
RUN apt-get update && apt-get install -y \
|
||||
$PHPIZE_DEPS \
|
||||
ca-certificates \
|
||||
curl \
|
||||
xz-utils \
|
||||
--no-install-recommends && rm -r /var/lib/apt/lists/*
|
||||
|
||||
ENV PHP_INI_DIR /usr/local/etc/php
|
||||
RUN mkdir -p $PHP_INI_DIR/conf.d
|
||||
|
||||
##<autogenerated>##
|
||||
ENV PHP_EXTRA_CONFIGURE_ARGS --enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data --disable-cgi
|
||||
##</autogenerated>##
|
||||
|
||||
# Apply stack smash protection to functions using local buffers and alloca()
|
||||
# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64)
|
||||
# Enable optimization (-O2)
|
||||
# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default)
|
||||
# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated)
|
||||
# https://github.com/docker-library/php/issues/272
|
||||
ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2"
|
||||
ENV PHP_CPPFLAGS="$PHP_CFLAGS"
|
||||
ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"
|
||||
|
||||
ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3
|
||||
|
||||
ENV PHP_VERSION 5.6.40
|
||||
ENV PHP_URL="https://www.php.net/distributions/php-5.6.40.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-5.6.40.tar.xz.asc"
|
||||
ENV PHP_SHA256="1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c" PHP_MD5=""
|
||||
|
||||
RUN set -xe; \
|
||||
\
|
||||
fetchDeps=' \
|
||||
wget \
|
||||
'; \
|
||||
if ! command -v gpg > /dev/null; then \
|
||||
fetchDeps="$fetchDeps \
|
||||
dirmngr \
|
||||
gnupg \
|
||||
"; \
|
||||
fi; \
|
||||
apt-get update; \
|
||||
apt-get install -y --no-install-recommends $fetchDeps; \
|
||||
rm -rf /var/lib/apt/lists/*; \
|
||||
\
|
||||
mkdir -p /usr/src; \
|
||||
cd /usr/src; \
|
||||
\
|
||||
wget -O php.tar.xz "$PHP_URL"; \
|
||||
\
|
||||
if [ -n "$PHP_SHA256" ]; then \
|
||||
echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \
|
||||
fi; \
|
||||
if [ -n "$PHP_MD5" ]; then \
|
||||
echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \
|
||||
fi; \
|
||||
\
|
||||
if [ -n "$PHP_ASC_URL" ]; then \
|
||||
wget -O php.tar.xz.asc "$PHP_ASC_URL"; \
|
||||
export GNUPGHOME="$(mktemp -d)"; \
|
||||
for key in $GPG_KEYS; do \
|
||||
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
|
||||
done; \
|
||||
gpg --batch --verify php.tar.xz.asc php.tar.xz; \
|
||||
command -v gpgconf > /dev/null && gpgconf --kill all; \
|
||||
rm -rf "$GNUPGHOME"; \
|
||||
fi; \
|
||||
\
|
||||
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps
|
||||
|
||||
COPY --from=php:5.6-fpm /usr/local/bin/docker-php-source /usr/local/bin/
|
||||
|
||||
# Security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
savedAptMark="$(apt-mark showmanual)"; \
|
||||
apt-get update; \
|
||||
apt-get install -y --no-install-recommends \
|
||||
libcurl4-openssl-dev \
|
||||
libedit-dev \
|
||||
libsqlite3-dev \
|
||||
libssl1.0-dev \
|
||||
libxml2-dev \
|
||||
zlib1g-dev \
|
||||
libmariadb2 libmariadbclient-dev-compat \
|
||||
${PHP_EXTRA_BUILD_DEPS:-} \
|
||||
; \
|
||||
rm -rf /var/lib/apt/lists/*; \
|
||||
\
|
||||
export \
|
||||
CFLAGS="$PHP_CFLAGS" \
|
||||
CPPFLAGS="$PHP_CPPFLAGS" \
|
||||
LDFLAGS="$PHP_LDFLAGS" \
|
||||
; \
|
||||
docker-php-source extract; \
|
||||
cd /usr/src/php; \
|
||||
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||
debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
|
||||
# https://bugs.php.net/bug.php?id=74125
|
||||
if [ ! -d /usr/include/curl ]; then \
|
||||
ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \
|
||||
fi; \
|
||||
./configure \
|
||||
--build="$gnuArch" \
|
||||
--with-config-file-path="$PHP_INI_DIR" \
|
||||
--with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \
|
||||
\
|
||||
# make sure invalid --configure-flags are fatal errors intead of just warnings
|
||||
--enable-option-checking=fatal \
|
||||
\
|
||||
# https://github.com/docker-library/php/issues/439
|
||||
--with-mhash \
|
||||
\
|
||||
# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236)
|
||||
--enable-ftp \
|
||||
# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195)
|
||||
--enable-mbstring \
|
||||
# Use MariaDB's libmysqlclient library instead of mysqlnd to be able to communicate with MySQL 8+, which uses new locales of the utf8mb4 family that are unknown to old mysqlnd
|
||||
--disable-mysqlnd \
|
||||
--with-mysql="/usr" \
|
||||
--with-mysqli="/usr/bin/mysql_config" \
|
||||
--with-pdo-mysql="/usr" \
|
||||
\
|
||||
--with-curl \
|
||||
--with-libedit \
|
||||
--with-openssl \
|
||||
--with-zlib \
|
||||
\
|
||||
# bundled pcre does not support JIT on s390x
|
||||
# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT
|
||||
$(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \
|
||||
--with-libdir="lib/$debMultiarch" \
|
||||
\
|
||||
${PHP_EXTRA_CONFIGURE_ARGS:-} \
|
||||
; \
|
||||
make -j "$(nproc)"; \
|
||||
make install; \
|
||||
find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \
|
||||
make clean; \
|
||||
\
|
||||
# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable)
|
||||
cp -v php.ini-* "$PHP_INI_DIR/"; \
|
||||
\
|
||||
cd /; \
|
||||
docker-php-source delete; \
|
||||
\
|
||||
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
|
||||
apt-mark auto '.*' > /dev/null; \
|
||||
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
|
||||
find /usr/local -type f -executable -exec ldd '{}' ';' \
|
||||
| awk '/=>/ { print $(NF-1) }' \
|
||||
| sort -u \
|
||||
| xargs -r dpkg-query --search \
|
||||
| cut -d: -f1 \
|
||||
| sort -u \
|
||||
| xargs -r apt-mark manual \
|
||||
; \
|
||||
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
|
||||
\
|
||||
php --version; \
|
||||
\
|
||||
# https://github.com/docker-library/php/issues/443
|
||||
pecl update-channels; \
|
||||
rm -rf /tmp/pear ~/.pearrc
|
||||
|
||||
COPY --from=php:5.6-fpm /usr/local/bin/docker-php-ext-* /usr/local/bin/docker-php-entrypoint /usr/local/bin/
|
||||
|
||||
ENTRYPOINT ["docker-php-entrypoint"]
|
||||
##<autogenerated>##
|
||||
WORKDIR /var/www/html
|
||||
|
||||
RUN set -ex \
|
||||
&& cd /usr/local/etc \
|
||||
&& if [ -d php-fpm.d ]; then \
|
||||
# for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf"
|
||||
sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \
|
||||
cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \
|
||||
else \
|
||||
# PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency
|
||||
mkdir php-fpm.d; \
|
||||
cp php-fpm.conf.default php-fpm.d/www.conf; \
|
||||
{ \
|
||||
echo '[global]'; \
|
||||
echo 'include=etc/php-fpm.d/*.conf'; \
|
||||
} | tee php-fpm.conf; \
|
||||
fi \
|
||||
&& { \
|
||||
echo '[global]'; \
|
||||
echo 'error_log = /proc/self/fd/2'; \
|
||||
echo; \
|
||||
echo '[www]'; \
|
||||
echo '; if we send this to /proc/self/fd/1, it never appears'; \
|
||||
echo 'access.log = /proc/self/fd/2'; \
|
||||
echo; \
|
||||
echo 'clear_env = no'; \
|
||||
echo; \
|
||||
echo '; Ensure worker stdout and stderr are sent to the main error log.'; \
|
||||
echo 'catch_workers_output = yes'; \
|
||||
} | tee php-fpm.d/docker.conf \
|
||||
&& { \
|
||||
echo '[global]'; \
|
||||
echo 'daemonize = no'; \
|
||||
echo; \
|
||||
echo '[www]'; \
|
||||
echo 'listen = 9000'; \
|
||||
} | tee php-fpm.d/zz-docker.conf
|
||||
|
||||
EXPOSE 9000
|
||||
CMD ["php-fpm"]
|
||||
##</autogenerated>##
|
||||
|
||||
# Download script to install PHP extensions and dependencies
|
||||
ADD https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/
|
||||
|
||||
RUN chmod +x /usr/local/bin/install-php-extensions
|
||||
|
||||
# PEAR < 1.10.18 can't read pecl.php.net responses anymore.
|
||||
RUN pear upgrade --force https://pear.php.net/get/PEAR-1.10.18.tgz
|
||||
|
||||
# retry: PECL sometimes replies "No releases available" on CI runners.
|
||||
RUN retry() { for i in 1 2 3; do "$@" && return; sleep 10; done; return 1; }; \
|
||||
DEBIAN_FRONTEND=noninteractive apt-get update -q \
|
||||
&& DEBIAN_FRONTEND=noninteractive apt-get install -qq -y \
|
||||
curl \
|
||||
git \
|
||||
zip unzip \
|
||||
# iconv, mbstring and pdo_sqlite are omitted as they are already installed
|
||||
&& PHP_EXTENSIONS=" \
|
||||
amqp \
|
||||
bcmath \
|
||||
bz2 \
|
||||
calendar \
|
||||
event \
|
||||
exif \
|
||||
gd \
|
||||
gettext \
|
||||
imagick \
|
||||
intl \
|
||||
ldap \
|
||||
mcrypt \
|
||||
memcached \
|
||||
mysql \
|
||||
mysqli \
|
||||
opcache \
|
||||
pdo_mysql \
|
||||
pdo_pgsql \
|
||||
pgsql \
|
||||
redis \
|
||||
soap \
|
||||
sockets \
|
||||
xsl \
|
||||
zip \
|
||||
" \
|
||||
&& retry install-php-extensions $PHP_EXTENSIONS
|
||||
|
||||
# Install Composer.
|
||||
ENV PATH=$PATH:/root/composer/vendor/bin \
|
||||
COMPOSER_ALLOW_SUPERUSER=1 \
|
||||
COMPOSER_HOME=/root/composer
|
||||
RUN cd /opt \
|
||||
# Download installer and check for its integrity.
|
||||
&& curl -sSL https://getcomposer.org/installer > composer-setup.php \
|
||||
&& curl -sSL https://composer.github.io/installer.sha384sum > composer-setup.sha384sum \
|
||||
&& sha384sum --check composer-setup.sha384sum \
|
||||
# Install Composer 2.
|
||||
&& php composer-setup.php --install-dir=/usr/local/bin --filename=composer --2 \
|
||||
# Remove installer files.
|
||||
&& rm /opt/composer-setup.php /opt/composer-setup.sha384sum
|
||||
+2
-1
@@ -2,6 +2,7 @@ SHELL := /bin/bash
|
||||
ALL: build
|
||||
.PHONY: build test push
|
||||
|
||||
PARENT_IMAGE := chialab/php
|
||||
IMAGE := chialab/php-compat
|
||||
VERSION ?= latest
|
||||
PHP_VERSION = $(firstword $(subst -, ,$(VERSION)))
|
||||
@@ -43,7 +44,7 @@ endif
|
||||
|
||||
build:
|
||||
@echo " =====> Building $(REGISTRY)$(IMAGE):$(VERSION)..."
|
||||
docker image build --quiet --build-context patches=../eol/patches -f Dockerfile.$(VERSION) -t $(REGISTRY)$(IMAGE):$(VERSION) .
|
||||
docker image build --quiet --build-arg 'BASE_IMAGE=$(PARENT_IMAGE):$(VERSION)' -t $(REGISTRY)$(IMAGE):$(VERSION) .
|
||||
|
||||
test:
|
||||
@echo -e "=====> Testing loaded extensions... \c"
|
||||
|
||||
+5
-3
@@ -22,9 +22,11 @@ Compatibility docker images.
|
||||
|
||||
### PHP 5.6
|
||||
|
||||
Built from the latest official PHP 5.6 Dockerfiles ([this](https://github.com/docker-library/php/tree/783878384a8f3953ed571e5a34ba0fe546726c85) commit),
|
||||
with PHP compiled to use MariaDB's `libmysqlclient` connector. This fixes connections with MySQL 8.0+, which uses a default
|
||||
collation not recognized by the official image's `mysqlnd` connector (`utf8mb4`).
|
||||
Built on top of [`chialab/php:5.6`](../README.md) (same tag), with the `mysql`, `mysqli` and `pdo_mysql` extensions rebuilt
|
||||
against MariaDB's `libmysqlclient` connector instead of `mysqlnd`. Unlike `mysqlnd` 5.6, it can connect to MySQL 8.0+ servers
|
||||
whose default authentication plugin is `caching_sha2_password`, as long as the account uses `mysql_native_password`. Accounts
|
||||
using `caching_sha2_password` aren't supported, and the `mysqlnd`-only APIs (such as `mysqli_stmt::get_result()`) aren't
|
||||
available.
|
||||
|
||||
## Available tags
|
||||
- `5.6`
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/37a17e9a4ea67d5422411675b8564860dcf4cc22/php-37a17e9a4ea67d5422411675b8564860dcf4cc22.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:stretch-slim
|
||||
|
||||
# chialab: Debian stretch has been moved to archive.debian.org.
|
||||
@@ -176,11 +181,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/fab4
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-5.6.40-105"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-5.6.40-105"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.5.6,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/37a17e9a4ea67d5422411675b8564860dcf4cc22/php-37a17e9a4ea67d5422411675b8564860dcf4cc22.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:stretch-slim
|
||||
|
||||
# chialab: Debian stretch has been moved to archive.debian.org.
|
||||
@@ -116,11 +121,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/fab4
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-5.6.40-105"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-5.6.40-105"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.5.6,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/37a17e9a4ea67d5422411675b8564860dcf4cc22/php-37a17e9a4ea67d5422411675b8564860dcf4cc22.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:stretch-slim
|
||||
|
||||
# chialab: Debian stretch has been moved to archive.debian.org.
|
||||
@@ -117,11 +122,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/fab4
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-5.6.40-105"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-5.6.40-105"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.5.6,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/9521952fd4f62fc7a1ddafa42588c07b93736e04/php-9521952fd4f62fc7a1ddafa42588c07b93736e04.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:stretch-slim
|
||||
|
||||
# chialab: Debian stretch has been moved to archive.debian.org.
|
||||
@@ -170,11 +175,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/0e5c
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.0,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.0.33-93"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.0.33-93"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.0,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/9521952fd4f62fc7a1ddafa42588c07b93736e04/php-9521952fd4f62fc7a1ddafa42588c07b93736e04.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:stretch-slim
|
||||
|
||||
# chialab: Debian stretch has been moved to archive.debian.org.
|
||||
@@ -110,11 +115,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/0e5c
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.0,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.0.33-93"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.0.33-93"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.0,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/9521952fd4f62fc7a1ddafa42588c07b93736e04/php-9521952fd4f62fc7a1ddafa42588c07b93736e04.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:stretch-slim
|
||||
|
||||
# chialab: Debian stretch has been moved to archive.debian.org.
|
||||
@@ -111,11 +116,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/0e5c
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.0,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.0.33-93"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.0.33-93"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.0,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/a88ccf5051d416b9f47faf85df9b7b875e111a71/php-a88ccf5051d416b9f47faf85df9b7b875e111a71.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM alpine:3.10
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
@@ -102,11 +107,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/2bf3
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.1.33-81"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.1.33-81"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.1,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
apk add --no-cache --virtual .build-deps \
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/a88ccf5051d416b9f47faf85df9b7b875e111a71/php-a88ccf5051d416b9f47faf85df9b7b875e111a71.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:buster-slim
|
||||
|
||||
# chialab: Debian buster has been moved to archive.debian.org.
|
||||
@@ -174,11 +179,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/2bf3
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.1.33-81"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.1.33-81"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.1,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/a88ccf5051d416b9f47faf85df9b7b875e111a71/php-a88ccf5051d416b9f47faf85df9b7b875e111a71.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:buster-slim
|
||||
|
||||
# chialab: Debian buster has been moved to archive.debian.org.
|
||||
@@ -114,11 +119,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/2bf3
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.1.33-81"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.1.33-81"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.1,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/a88ccf5051d416b9f47faf85df9b7b875e111a71/php-a88ccf5051d416b9f47faf85df9b7b875e111a71.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM alpine:3.10
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
@@ -103,11 +108,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/2bf3
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.1.33-81"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.1.33-81"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.1,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
apk add --no-cache --virtual .build-deps \
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/a88ccf5051d416b9f47faf85df9b7b875e111a71/php-a88ccf5051d416b9f47faf85df9b7b875e111a71.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:buster-slim
|
||||
|
||||
# chialab: Debian buster has been moved to archive.debian.org.
|
||||
@@ -115,11 +120,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/2bf3
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.1.33-81"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.1.33-81"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.1,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e0bcd488d9f8da024d9e1a254113539a846cac6d/php-e0bcd488d9f8da024d9e1a254113539a846cac6d.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM alpine:3.12
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
@@ -94,11 +99,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/20eb
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.2.34-66"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.2.34-66"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.2,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
apk add --no-cache --virtual .build-deps \
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e0bcd488d9f8da024d9e1a254113539a846cac6d/php-e0bcd488d9f8da024d9e1a254113539a846cac6d.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:buster-slim
|
||||
|
||||
# chialab: Debian buster has been moved to archive.debian.org.
|
||||
@@ -167,11 +172,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/20eb
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.2.34-66"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.2.34-66"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.2,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e0bcd488d9f8da024d9e1a254113539a846cac6d/php-e0bcd488d9f8da024d9e1a254113539a846cac6d.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:buster-slim
|
||||
|
||||
# chialab: Debian buster has been moved to archive.debian.org.
|
||||
@@ -106,11 +111,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/20eb
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.2.34-66"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.2.34-66"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.2,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e0bcd488d9f8da024d9e1a254113539a846cac6d/php-e0bcd488d9f8da024d9e1a254113539a846cac6d.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM alpine:3.12
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
@@ -96,11 +101,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/20eb
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.2.34-66"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.2.34-66"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.2,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
apk add --no-cache --virtual .build-deps \
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e0bcd488d9f8da024d9e1a254113539a846cac6d/php-e0bcd488d9f8da024d9e1a254113539a846cac6d.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:buster-slim
|
||||
|
||||
# chialab: Debian buster has been moved to archive.debian.org.
|
||||
@@ -108,11 +113,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/20eb
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.2.34-66"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.2.34-66"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.2,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/ecf76f6726bee03657a2c608240685732312fe54/php-ecf76f6726bee03657a2c608240685732312fe54.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM alpine:3.15
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
@@ -92,11 +97,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/35d0
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.3.33-35"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.3.33-35"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.3,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
apk add --no-cache --virtual .build-deps \
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/ecf76f6726bee03657a2c608240685732312fe54/php-ecf76f6726bee03657a2c608240685732312fe54.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:bullseye-slim
|
||||
|
||||
# chialab: Debian bullseye has been moved to archive.debian.org.
|
||||
@@ -163,11 +168,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/35d0
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.3.33-35"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.3.33-35"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.3,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/ecf76f6726bee03657a2c608240685732312fe54/php-ecf76f6726bee03657a2c608240685732312fe54.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:bullseye-slim
|
||||
|
||||
# chialab: Debian bullseye has been moved to archive.debian.org.
|
||||
@@ -105,11 +110,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/35d0
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.3.33-35"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.3.33-35"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.3,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/ecf76f6726bee03657a2c608240685732312fe54/php-ecf76f6726bee03657a2c608240685732312fe54.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM alpine:3.15
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
@@ -92,11 +97,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/35d0
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.3.33-35"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.3.33-35"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.3,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
apk add --no-cache --virtual .build-deps \
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/ecf76f6726bee03657a2c608240685732312fe54/php-ecf76f6726bee03657a2c608240685732312fe54.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:bullseye-slim
|
||||
|
||||
# chialab: Debian bullseye has been moved to archive.debian.org.
|
||||
@@ -105,11 +110,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/35d0
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.3.33-35"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.3.33-35"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.3,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e9c428802984a79e6e2e1f505404322e6fe7ba8d/php-e9c428802984a79e6e2e1f505404322e6fe7ba8d.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM alpine:3.16
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
@@ -92,11 +97,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/1361
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.4.33-31"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.4.33-31"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.4,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
apk add --no-cache --virtual .build-deps \
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e9c428802984a79e6e2e1f505404322e6fe7ba8d/php-e9c428802984a79e6e2e1f505404322e6fe7ba8d.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:bullseye-slim
|
||||
|
||||
# chialab: Debian bullseye has been moved to archive.debian.org.
|
||||
@@ -163,11 +168,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/1361
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.4.33-31"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.4.33-31"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.4,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e9c428802984a79e6e2e1f505404322e6fe7ba8d/php-e9c428802984a79e6e2e1f505404322e6fe7ba8d.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:bullseye-slim
|
||||
|
||||
# chialab: Debian bullseye has been moved to archive.debian.org.
|
||||
@@ -105,11 +110,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/1361
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.4.33-31"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.4.33-31"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.4,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e9c428802984a79e6e2e1f505404322e6fe7ba8d/php-e9c428802984a79e6e2e1f505404322e6fe7ba8d.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM alpine:3.16
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
@@ -92,11 +97,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/1361
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.4.33-31"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.4.33-31"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.4,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
apk add --no-cache --virtual .build-deps \
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e9c428802984a79e6e2e1f505404322e6fe7ba8d/php-e9c428802984a79e6e2e1f505404322e6fe7ba8d.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:bullseye-slim
|
||||
|
||||
# chialab: Debian bullseye has been moved to archive.debian.org.
|
||||
@@ -105,11 +110,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/1361
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-7.4.33-31"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-7.4.33-31"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.7.4,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/abebea27da1d5cf90a0e83ab81ea3e708886aebb/php-abebea27da1d5cf90a0e83ab81ea3e708886aebb.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM alpine:3.16
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
@@ -92,11 +97,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/df46
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-8.0.30-25"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-8.0.30-25"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.8.0,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
apk add --no-cache --virtual .build-deps \
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/abebea27da1d5cf90a0e83ab81ea3e708886aebb/php-abebea27da1d5cf90a0e83ab81ea3e708886aebb.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:bullseye-slim
|
||||
|
||||
# chialab: Debian bullseye has been moved to archive.debian.org.
|
||||
@@ -163,11 +168,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/df46
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-8.0.30-25"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-8.0.30-25"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.8.0,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/abebea27da1d5cf90a0e83ab81ea3e708886aebb/php-abebea27da1d5cf90a0e83ab81ea3e708886aebb.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:bullseye-slim
|
||||
|
||||
# chialab: Debian bullseye has been moved to archive.debian.org.
|
||||
@@ -105,11 +110,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/df46
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-8.0.30-25"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-8.0.30-25"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.8.0,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/abebea27da1d5cf90a0e83ab81ea3e708886aebb/php-abebea27da1d5cf90a0e83ab81ea3e708886aebb.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM alpine:3.16
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
@@ -92,11 +97,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/df46
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-8.0.30-25"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-8.0.30-25"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.8.0,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
apk add --no-cache --virtual .build-deps \
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/abebea27da1d5cf90a0e83ab81ea3e708886aebb/php-abebea27da1d5cf90a0e83ab81ea3e708886aebb.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:bullseye-slim
|
||||
|
||||
# chialab: Debian bullseye has been moved to archive.debian.org.
|
||||
@@ -105,11 +110,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/df46
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-8.0.30-25"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-8.0.30-25"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.8.0,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/4e430ad99622d9fabcee27d6dba438c81de716eb/php-4e430ad99622d9fabcee27d6dba438c81de716eb.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM alpine:3.21
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
@@ -89,11 +94,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/5c03
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-8.1.34-9"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-8.1.34-9"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.8.1,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
apk add --no-cache --virtual .build-deps \
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/4e430ad99622d9fabcee27d6dba438c81de716eb/php-4e430ad99622d9fabcee27d6dba438c81de716eb.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:trixie-slim
|
||||
|
||||
# prevent Debian's PHP packages from being installed
|
||||
@@ -158,11 +163,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/5c03
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-8.1.34-9"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-8.1.34-9"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.8.1,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/4e430ad99622d9fabcee27d6dba438c81de716eb/php-4e430ad99622d9fabcee27d6dba438c81de716eb.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:trixie-slim
|
||||
|
||||
# prevent Debian's PHP packages from being installed
|
||||
@@ -98,11 +103,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/5c03
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-8.1.34-9"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-8.1.34-9"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.8.1,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/4e430ad99622d9fabcee27d6dba438c81de716eb/php-4e430ad99622d9fabcee27d6dba438c81de716eb.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM alpine:3.21
|
||||
|
||||
# dependencies required for running "phpize"
|
||||
@@ -89,11 +94,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/5c03
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-8.1.34-9"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-8.1.34-9"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.8.1,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
apk add --no-cache --virtual .build-deps \
|
||||
|
||||
+10
-4
@@ -4,6 +4,11 @@
|
||||
# with the changes marked "chialab:".
|
||||
#
|
||||
|
||||
# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES.
|
||||
FROM scratch AS deb-patches
|
||||
ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/4e430ad99622d9fabcee27d6dba438c81de716eb/php-4e430ad99622d9fabcee27d6dba438c81de716eb.tar.gz?path=debian/patches
|
||||
ADD --unpack=true $DEB_PATCHES /
|
||||
|
||||
FROM debian:trixie-slim
|
||||
|
||||
# prevent Debian's PHP packages from being installed
|
||||
@@ -98,11 +103,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/5c03
|
||||
ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/
|
||||
|
||||
# chialab: security backports for this EOL version (see eol/patches).
|
||||
ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619"
|
||||
LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619"
|
||||
RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \
|
||||
ENV PHP_PATCHES="deb.sury.org-8.1.34-9"
|
||||
LABEL it.chialab.php.patches="deb.sury.org-8.1.34-9"
|
||||
RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \
|
||||
--mount=type=bind,from=patches,source=series.8.1,target=/usr/src/php-series \
|
||||
--mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \
|
||||
docker-php-source-patch /usr/src/php-patches
|
||||
docker-php-source-patch /usr/src/php-series /usr/src/deb-patches
|
||||
|
||||
RUN set -eux; \
|
||||
\
|
||||
|
||||
+36
-9
@@ -6,16 +6,23 @@ applied to the sources, and use the result as the base image instead of `php:<ta
|
||||
|
||||
- `<X.Y>/<flavor>/Dockerfile`: the official Dockerfiles, one per tag suffix (`cli`, `apache`,
|
||||
`fpm`, `alpine`, `fpm-alpine`).
|
||||
- `patches/`: `docker-php-source-patch` and one `<X.Y>/series` of patches per version, passed to
|
||||
the build as the `patches` named context.
|
||||
- `patches/`: `docker-php-source-patch` and one `series.<X.Y>` per version, passed to the build
|
||||
as the `patches` named context.
|
||||
|
||||
The patches are deb.sury.org's, from the Debian PHP team's
|
||||
[repository on Salsa](https://salsa.debian.org/php-team/php). Each Dockerfile downloads
|
||||
`debian/patches` from the Salsa commit in its `DEB_PATCHES` into a `deb-patches` stage. Each
|
||||
`series.<X.Y>` is an allow-list over that `series`: it names every patch in the same order, with
|
||||
the ones left out commented as `# <reason>: <name>`. `docker-php-source-patch` fails the build if
|
||||
the two lists differ, so a new deb.sury.org revision can't add a patch nobody has reviewed.
|
||||
|
||||
The build picks a directory up on its own: if `eol/<X.Y>/<flavor>` exists, the Makefile and
|
||||
`build-images.yml` build it as the base image. No workflow lists EOL versions.
|
||||
|
||||
## Adding a version
|
||||
|
||||
Add it once there is a security patch to apply: `make test` fails an EOL image whose
|
||||
`PHP_PATCHES` is empty. Until then, keep building on the official image.
|
||||
Add it once deb.sury.org publishes patches for it: `make test` fails an EOL image whose `PHP_PATCHES`
|
||||
is empty. Until then, keep building on the official image.
|
||||
|
||||
1. **Find the source.** Take the last [docker-library/php](https://github.com/docker-library/php)
|
||||
commit that still has the `<X.Y>/` directory. For each flavor, pick the variant the plain
|
||||
@@ -30,12 +37,32 @@ Add it once there is a security patch to apply: `make test` fails an EOL image w
|
||||
first `COPY`, and replace the `COPY docker-php-*` and `COPY apache2-foreground` lines with
|
||||
`ADD --chmod=755 $DOCKER_PHP_SCRIPTS/<script> …`, one URL per script, as the other
|
||||
versions do (`ADD` gives downloaded files mode 600);
|
||||
- add the patch step right after `docker-php-source` is added, as in the other versions:
|
||||
`ENV PHP_PATCHES`, `LABEL it.chialab.php.patches` and the `RUN` that bind-mounts
|
||||
`patches/<X.Y>` and runs `docker-php-source-patch`;
|
||||
- add the `deb-patches` stage before the first `FROM`, and the patch step right after
|
||||
`docker-php-source` is added, as in the other versions: `ENV PHP_PATCHES`,
|
||||
`LABEL it.chialab.php.patches` and the `RUN` that bind-mounts `deb-patches` and
|
||||
`patches/series.<X.Y>` and runs `docker-php-source-patch`;
|
||||
- once the OS release is archived, or a download host or keyserver disappears, fix it the
|
||||
same way the older versions do.
|
||||
4. **Add the patches** to `patches/<X.Y>/` and list them in its `series`, with a comment
|
||||
linking where each one comes from.
|
||||
4. **Pin deb.sury.org's patches**: see below. The `.github/workflows/track-patches.yml` job picks
|
||||
the version up on its own.
|
||||
5. **Update the range** of EOL versions in the main [README](../README.md).
|
||||
|
||||
## Updating deb.sury.org's patches
|
||||
|
||||
The `Track deb.sury.org patches` workflow opens an issue when deb.sury.org publishes a build of an
|
||||
EOL version from a newer commit, listing the patches added to its `series`.
|
||||
|
||||
1. **Find the commit.** deb.sury.org's build versions end in `gbp` and the first 6 hex digits of the
|
||||
Salsa commit (`8.1.34-9+0~20261021.82+debian13~1.gbp4e430a`), listed in
|
||||
`https://packages.sury.org/php/dists/trixie/main/source/Sources.gz`.
|
||||
2. **Update every flavour's Dockerfile** of the version: the full commit in `DEB_PATCHES`, and
|
||||
the deb.sury.org revision without epoch in `PHP_PATCHES` and the label
|
||||
(`deb.sury.org-8.1.34-9`).
|
||||
3. **Review each new patch** and add it to `patches/series.<X.Y>`, either applied or commented out
|
||||
with its reason. Apply security and bug-fix backports and the test changes that come with them;
|
||||
leave out Debian packaging and paths, build changes for libraries or toolchains other than the
|
||||
version's base image, changed defaults and new features.
|
||||
4. **Build and test** every flavour (`make build test VERSION=<tag>`). A patch that changes a
|
||||
`config.m4` only takes effect for extensions built later with `phpize`; one that changes a
|
||||
`.re` file takes effect because `re2c`, in `PHPIZE_DEPS`, regenerates its output.
|
||||
|
||||
|
||||
@@ -1,529 +0,0 @@
|
||||
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
|
||||
Date: Sun, 18 Oct 2026 20:09:54 +0200
|
||||
Subject: Avoid state corruption via bailout
|
||||
|
||||
Minimal mitigation for EOL version.
|
||||
|
||||
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
|
||||
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
|
||||
|
||||
Backported from the PHP 7.4 version:
|
||||
- zend_mm_safe_error_ex() keeps the PHP 5.6 way of finding the script
|
||||
file and line (TSRM, EG(in_execution)).
|
||||
- The overflow errors of safe_address() and _safe_emalloc_string(), and
|
||||
the "String size overflow" errors of concat_function() and
|
||||
add_*_to_string() (which back ZEND_CONCAT and ZEND_ADD_* in 5.6) exit
|
||||
the same way.
|
||||
- GPC arrays start with 2 buckets: nTableMask == 0 marks an uninitialized
|
||||
hash table in 5.6, so a single bucket cannot be used.
|
||||
- SG(callback_func) is also reset in sapi_deactivate().
|
||||
- PHP 5.6 already clears the user error/exception handlers before
|
||||
destroying them; EG(error_handling) and EG(exception) are reset after
|
||||
the object store is freed.
|
||||
- "|| 1" instead of "|| true" in the session upload progress callback.
|
||||
- The max_multipart_body_parts hunk of the 7.4 patch is left out, the
|
||||
code is already there.
|
||||
|
||||
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
|
||||
---
|
||||
Zend/zend_API.c | 9 ++++
|
||||
Zend/zend_API.h | 2 +
|
||||
Zend/zend_alloc.c | 110 +++++++++++++++++++---------------------
|
||||
Zend/zend_alloc.h | 6 +++
|
||||
Zend/zend_execute_API.c | 4 ++
|
||||
Zend/zend_llist.c | 2 +
|
||||
Zend/zend_operators.c | 8 +--
|
||||
Zend/zend_strtod.c | 2 +-
|
||||
ext/session/session.c | 2 +-
|
||||
main/SAPI.c | 6 +++
|
||||
main/main.c | 5 ++
|
||||
main/php_variables.c | 6 +--
|
||||
main/rfc1867.c | 27 +++++++---
|
||||
13 files changed, 114 insertions(+), 75 deletions(-)
|
||||
|
||||
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
|
||||
index 0757cc92..89cdca5f 100644
|
||||
--- a/Zend/zend_API.c
|
||||
+++ b/Zend/zend_API.c
|
||||
@@ -1016,6 +1016,15 @@ ZEND_API int _array_init(zval *arg, uint size ZEND_FILE_LINE_DC) /* {{{ */
|
||||
}
|
||||
/* }}} */
|
||||
|
||||
+ZEND_API int _array_init_singleton(zval *arg ZEND_FILE_LINE_DC) /* {{{ */
|
||||
+{
|
||||
+ _array_init(arg, 0 ZEND_FILE_LINE_RELAY_CC);
|
||||
+ /* nTableMask == 0 marks an uninitialized table, so 2 is the smallest usable size */
|
||||
+ Z_ARRVAL_P(arg)->nTableSize = 2;
|
||||
+ return SUCCESS;
|
||||
+}
|
||||
+/* }}} */
|
||||
+
|
||||
static int zend_merge_property(zval **value TSRMLS_DC, int num_args, va_list args, const zend_hash_key *hash_key) /* {{{ */
|
||||
{
|
||||
/* which name should a numeric property have ? */
|
||||
diff --git a/Zend/zend_API.h b/Zend/zend_API.h
|
||||
index 41aa65f2..c17dacd5 100644
|
||||
--- a/Zend/zend_API.h
|
||||
+++ b/Zend/zend_API.h
|
||||
@@ -363,10 +363,12 @@ ZEND_API char *zend_get_type_by_const(int type);
|
||||
|
||||
#define array_init(arg) _array_init((arg), 0 ZEND_FILE_LINE_CC)
|
||||
#define array_init_size(arg, size) _array_init((arg), (size) ZEND_FILE_LINE_CC)
|
||||
+#define array_init_singleton(arg) _array_init_singleton((arg) ZEND_FILE_LINE_CC)
|
||||
#define object_init(arg) _object_init((arg) ZEND_FILE_LINE_CC TSRMLS_CC)
|
||||
#define object_init_ex(arg, ce) _object_init_ex((arg), (ce) ZEND_FILE_LINE_CC TSRMLS_CC)
|
||||
#define object_and_properties_init(arg, ce, properties) _object_and_properties_init((arg), (ce), (properties) ZEND_FILE_LINE_CC TSRMLS_CC)
|
||||
ZEND_API int _array_init(zval *arg, uint size ZEND_FILE_LINE_DC);
|
||||
+ZEND_API int _array_init_singleton(zval *arg ZEND_FILE_LINE_DC);
|
||||
ZEND_API int _object_init(zval *arg ZEND_FILE_LINE_DC TSRMLS_DC);
|
||||
ZEND_API int _object_init_ex(zval *arg, zend_class_entry *ce ZEND_FILE_LINE_DC TSRMLS_DC);
|
||||
ZEND_API int _object_and_properties_init(zval *arg, zend_class_entry *ce, HashTable *properties ZEND_FILE_LINE_DC TSRMLS_DC);
|
||||
diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
|
||||
index c7babe12..f84d25ae 100644
|
||||
--- a/Zend/zend_alloc.c
|
||||
+++ b/Zend/zend_alloc.c
|
||||
@@ -91,7 +91,7 @@ static void zend_mm_panic(const char *message)
|
||||
#if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID)
|
||||
kill(getpid(), SIGSEGV);
|
||||
#endif
|
||||
- exit(1);
|
||||
+ _exit(1);
|
||||
}
|
||||
|
||||
/*******************/
|
||||
@@ -1740,6 +1740,42 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, int full_shutdown, int silent
|
||||
}
|
||||
}
|
||||
|
||||
+ZEND_API void zend_mm_safe_error_ex(const char *format, ...)
|
||||
+{
|
||||
+ const char *error_filename;
|
||||
+ uint error_lineno;
|
||||
+ va_list args;
|
||||
+ char buf[1024];
|
||||
+ TSRMLS_FETCH();
|
||||
+
|
||||
+ if (zend_is_compiling(TSRMLS_C)) {
|
||||
+ error_filename = zend_get_compiled_filename(TSRMLS_C);
|
||||
+ error_lineno = zend_get_compiled_lineno(TSRMLS_C);
|
||||
+ } else if (EG(in_execution)) {
|
||||
+ error_filename = EG(active_op_array)?EG(active_op_array)->filename:NULL;
|
||||
+ error_lineno = EG(opline_ptr)?(*EG(opline_ptr))->lineno:0;
|
||||
+ } else {
|
||||
+ error_filename = NULL;
|
||||
+ error_lineno = 0;
|
||||
+ }
|
||||
+ if (!error_filename) {
|
||||
+ error_filename = "Unknown";
|
||||
+ }
|
||||
+
|
||||
+ va_start(args, format);
|
||||
+ vsnprintf(buf, sizeof(buf), format, args);
|
||||
+ va_end(args);
|
||||
+
|
||||
+ fprintf(stderr, "\nFatal error: %s in %s on line %d\n", buf, error_filename, error_lineno);
|
||||
+
|
||||
+/* See http://support.microsoft.com/kb/190351 */
|
||||
+#ifdef PHP_WIN32
|
||||
+ fflush(stderr);
|
||||
+#endif
|
||||
+
|
||||
+ _exit(1);
|
||||
+}
|
||||
+
|
||||
static void zend_mm_safe_error(zend_mm_heap *heap,
|
||||
const char *format,
|
||||
size_t limit,
|
||||
@@ -1749,59 +1785,15 @@ static void zend_mm_safe_error(zend_mm_heap *heap,
|
||||
#endif
|
||||
size_t size)
|
||||
{
|
||||
- if (heap->reserve) {
|
||||
- _zend_mm_free_int(heap, heap->reserve ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC);
|
||||
- heap->reserve = NULL;
|
||||
- }
|
||||
- if (heap->overflow == 0) {
|
||||
- const char *error_filename;
|
||||
- uint error_lineno;
|
||||
- TSRMLS_FETCH();
|
||||
- if (zend_is_compiling(TSRMLS_C)) {
|
||||
- error_filename = zend_get_compiled_filename(TSRMLS_C);
|
||||
- error_lineno = zend_get_compiled_lineno(TSRMLS_C);
|
||||
- } else if (EG(in_execution)) {
|
||||
- error_filename = EG(active_op_array)?EG(active_op_array)->filename:NULL;
|
||||
- error_lineno = EG(opline_ptr)?(*EG(opline_ptr))->lineno:0;
|
||||
- } else {
|
||||
- error_filename = NULL;
|
||||
- error_lineno = 0;
|
||||
- }
|
||||
- if (!error_filename) {
|
||||
- error_filename = "Unknown";
|
||||
- }
|
||||
- heap->overflow = 1;
|
||||
- zend_try {
|
||||
- zend_error_noreturn(E_ERROR,
|
||||
- format,
|
||||
- limit,
|
||||
+ (void) heap;
|
||||
+
|
||||
+ zend_mm_safe_error_ex(format,
|
||||
+ limit,
|
||||
#if ZEND_DEBUG
|
||||
- filename,
|
||||
- lineno,
|
||||
+ filename,
|
||||
+ lineno,
|
||||
#endif
|
||||
- size);
|
||||
- } zend_catch {
|
||||
- if (heap->overflow == 2) {
|
||||
- fprintf(stderr, "\nFatal error: ");
|
||||
- fprintf(stderr,
|
||||
- format,
|
||||
- limit,
|
||||
-#if ZEND_DEBUG
|
||||
- filename,
|
||||
- lineno,
|
||||
-#endif
|
||||
- size);
|
||||
- fprintf(stderr, " in %s on line %d\n", error_filename, error_lineno);
|
||||
- }
|
||||
-/* See http://support.microsoft.com/kb/190351 */
|
||||
-#ifdef PHP_WIN32
|
||||
- fflush(stderr);
|
||||
-#endif
|
||||
- } zend_end_try();
|
||||
- } else {
|
||||
- heap->overflow = 2;
|
||||
- }
|
||||
- zend_bailout();
|
||||
+ size);
|
||||
}
|
||||
|
||||
static zend_mm_free_block *zend_mm_search_large_block(zend_mm_heap *heap, size_t true_size)
|
||||
@@ -2472,7 +2464,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
|
||||
"rm"(offset));
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return res;
|
||||
@@ -2501,7 +2493,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
|
||||
|
||||
#undef LP_SUFF
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return res;
|
||||
@@ -2522,7 +2514,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
|
||||
"1"(0));
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return res;
|
||||
@@ -2542,7 +2534,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
|
||||
"r"(offset));
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return res;
|
||||
@@ -2555,7 +2547,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
|
||||
zend_ulong64 res = (zend_ulong64)nmemb * (zend_ulong64)size + (zend_ulong64)offset;
|
||||
|
||||
if (UNEXPECTED(res > (zend_ulong64)0xFFFFFFFFL)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return (size_t) res;
|
||||
@@ -2570,7 +2562,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
|
||||
double _delta = (double)res - _d;
|
||||
|
||||
if (UNEXPECTED((_d + _delta ) != _d)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return res;
|
||||
@@ -2582,7 +2574,7 @@ ZEND_API void *_safe_emalloc_string(size_t nmemb, size_t size, size_t offset ZEN
|
||||
{
|
||||
size_t str_size = safe_address(nmemb, size, offset);
|
||||
if (UNEXPECTED(str_size > INT_MAX)) {
|
||||
- zend_error_noreturn(E_ERROR, "String allocation overflow, max size is %d", INT_MAX);
|
||||
+ zend_mm_safe_error_ex("String allocation overflow, max size is %d", INT_MAX);
|
||||
}
|
||||
return emalloc_rel(str_size);
|
||||
}
|
||||
diff --git a/Zend/zend_alloc.h b/Zend/zend_alloc.h
|
||||
index 719f9c5c..dab0599a 100644
|
||||
--- a/Zend/zend_alloc.h
|
||||
+++ b/Zend/zend_alloc.h
|
||||
@@ -57,6 +57,12 @@ ZEND_API char *zend_strndup(const char *s, unsigned int length) ZEND_ATTRIBUTE_M
|
||||
ZEND_API void *_emalloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC ZEND_ATTRIBUTE_ALLOC_SIZE(1);
|
||||
ZEND_API void *_safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
|
||||
ZEND_API void *_safe_emalloc_string(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
|
||||
+
|
||||
+#if defined(__GNUC__) && __GNUC__ >= 3 && !defined(__INTEL_COMPILER) && !defined(DARWIN) && !defined(__hpux) && !defined(_AIX) && !defined(__osf__)
|
||||
+ZEND_API void zend_mm_safe_error_ex(const char *format, ...) __attribute__ ((noreturn));
|
||||
+#else
|
||||
+ZEND_API void zend_mm_safe_error_ex(const char *format, ...);
|
||||
+#endif
|
||||
ZEND_API void *_safe_malloc(size_t nmemb, size_t size, size_t offset) ZEND_ATTRIBUTE_MALLOC;
|
||||
ZEND_API void _efree(void *ptr ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
|
||||
ZEND_API void *_ecalloc(size_t nmemb, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC ZEND_ATTRIBUTE_ALLOC_SIZE2(1,2);
|
||||
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
|
||||
index bf754d25..a7a7b9ba 100644
|
||||
--- a/Zend/zend_execute_API.c
|
||||
+++ b/Zend/zend_execute_API.c
|
||||
@@ -307,6 +307,10 @@ void shutdown_executor(TSRMLS_D) /* {{{ */
|
||||
}
|
||||
} zend_end_try();
|
||||
|
||||
+ /* may be used by zend_error before init_executor */
|
||||
+ EG(error_handling) = EH_NORMAL;
|
||||
+ EG(exception) = NULL;
|
||||
+
|
||||
zend_try {
|
||||
clean_non_persistent_constants(TSRMLS_C);
|
||||
} zend_end_try();
|
||||
diff --git a/Zend/zend_llist.c b/Zend/zend_llist.c
|
||||
index 3d597a37..5be49408 100644
|
||||
--- a/Zend/zend_llist.c
|
||||
+++ b/Zend/zend_llist.c
|
||||
@@ -115,6 +115,8 @@ ZEND_API void zend_llist_destroy(zend_llist *l)
|
||||
current = next;
|
||||
}
|
||||
|
||||
+ l->head = NULL;
|
||||
+ l->tail = NULL;
|
||||
l->count = 0;
|
||||
}
|
||||
|
||||
diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
|
||||
index 450153ff..192592b0 100644
|
||||
--- a/Zend/zend_operators.c
|
||||
+++ b/Zend/zend_operators.c
|
||||
@@ -1400,7 +1400,7 @@ ZEND_API int add_char_to_string(zval *result, const zval *op1, const zval *op2)
|
||||
char *buf;
|
||||
|
||||
if (UNEXPECTED(length < 0)) {
|
||||
- zend_error(E_ERROR, "String size overflow");
|
||||
+ zend_mm_safe_error_ex("String size overflow");
|
||||
}
|
||||
|
||||
buf = str_erealloc(Z_STRVAL_P(op1), length + 1);
|
||||
@@ -1419,7 +1419,7 @@ ZEND_API int add_string_to_string(zval *result, const zval *op1, const zval *op2
|
||||
char *buf;
|
||||
|
||||
if (UNEXPECTED(length < 0)) {
|
||||
- zend_error(E_ERROR, "String size overflow");
|
||||
+ zend_mm_safe_error_ex("String size overflow");
|
||||
}
|
||||
|
||||
buf = str_erealloc(Z_STRVAL_P(op1), length + 1);
|
||||
@@ -1465,7 +1465,7 @@ ZEND_API int concat_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{
|
||||
if (Z_STRLEN_P(result) < 0 || (int) (Z_STRLEN_P(op1) + Z_STRLEN_P(op2)) < 0) {
|
||||
efree(Z_STRVAL_P(result));
|
||||
ZVAL_EMPTY_STRING(result);
|
||||
- zend_error(E_ERROR, "String size overflow");
|
||||
+ zend_mm_safe_error_ex("String size overflow");
|
||||
}
|
||||
|
||||
Z_STRVAL_P(result) = safe_erealloc(Z_STRVAL_P(result), res_len, 1, 1);
|
||||
@@ -1478,7 +1478,7 @@ ZEND_API int concat_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{
|
||||
char *buf;
|
||||
|
||||
if (Z_STRLEN_P(op1) < 0 || Z_STRLEN_P(op2) < 0 || (int) (Z_STRLEN_P(op1) + Z_STRLEN_P(op2)) < 0) {
|
||||
- zend_error(E_ERROR, "String size overflow");
|
||||
+ zend_mm_safe_error_ex("String size overflow");
|
||||
}
|
||||
buf = (char *) safe_emalloc(length, 1, 1);
|
||||
|
||||
diff --git a/Zend/zend_strtod.c b/Zend/zend_strtod.c
|
||||
index 7ec0366e..a035a154 100644
|
||||
--- a/Zend/zend_strtod.c
|
||||
+++ b/Zend/zend_strtod.c
|
||||
@@ -501,7 +501,7 @@ static Bigint * Balloc(int k)
|
||||
rv = (Bigint *)MALLOC(sizeof(Bigint) + (x-1)*sizeof(Long));
|
||||
if (!rv) {
|
||||
_THREAD_PRIVATE_MUTEX_UNLOCK(dtoa_mutex);
|
||||
- zend_error(E_ERROR, "Balloc() failed to allocate memory");
|
||||
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
|
||||
}
|
||||
rv->k = k;
|
||||
rv->maxwds = x;
|
||||
diff --git a/ext/session/session.c b/ext/session/session.c
|
||||
index 2fe9651a..650ef174 100644
|
||||
--- a/ext/session/session.c
|
||||
+++ b/ext/session/session.c
|
||||
@@ -2669,7 +2669,7 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
|
||||
if (php_session_rfc1867_orig_callback) {
|
||||
retval = php_session_rfc1867_orig_callback(event, event_data, extra TSRMLS_CC);
|
||||
}
|
||||
- if (!PS(rfc1867_enabled)) {
|
||||
+ if (!PS(rfc1867_enabled) || 1) {
|
||||
return retval;
|
||||
}
|
||||
|
||||
diff --git a/main/SAPI.c b/main/SAPI.c
|
||||
index 49ffc1c9..660012da 100644
|
||||
--- a/main/SAPI.c
|
||||
+++ b/main/SAPI.c
|
||||
@@ -528,18 +528,23 @@ SAPI_API void sapi_deactivate(TSRMLS_D)
|
||||
}
|
||||
if (SG(request_info).auth_user) {
|
||||
efree(SG(request_info).auth_user);
|
||||
+ SG(request_info).auth_user = NULL;
|
||||
}
|
||||
if (SG(request_info).auth_password) {
|
||||
efree(SG(request_info).auth_password);
|
||||
+ SG(request_info).auth_password = NULL;
|
||||
}
|
||||
if (SG(request_info).auth_digest) {
|
||||
efree(SG(request_info).auth_digest);
|
||||
+ SG(request_info).auth_digest = NULL;
|
||||
}
|
||||
if (SG(request_info).content_type_dup) {
|
||||
efree(SG(request_info).content_type_dup);
|
||||
+ SG(request_info).content_type_dup = NULL;
|
||||
}
|
||||
if (SG(request_info).current_user) {
|
||||
efree(SG(request_info).current_user);
|
||||
+ SG(request_info).current_user = NULL;
|
||||
}
|
||||
if (sapi_module.deactivate) {
|
||||
sapi_module.deactivate(TSRMLS_C);
|
||||
@@ -557,6 +562,7 @@ SAPI_API void sapi_deactivate(TSRMLS_D)
|
||||
SG(callback_run) = 0;
|
||||
if (SG(callback_func)) {
|
||||
zval_ptr_dtor(&SG(callback_func));
|
||||
+ SG(callback_func) = NULL;
|
||||
}
|
||||
SG(request_info).headers_read = 0;
|
||||
SG(global_request_time) = 0;
|
||||
diff --git a/main/main.c b/main/main.c
|
||||
index ab55b5b8..1f6618bd 100644
|
||||
--- a/main/main.c
|
||||
+++ b/main/main.c
|
||||
@@ -1880,6 +1880,8 @@ void php_request_shutdown(void *dummy)
|
||||
for (i=0; i<NUM_TRACK_VARS; i++) {
|
||||
if (PG(http_globals)[i]) {
|
||||
zval_ptr_dtor(&PG(http_globals)[i]);
|
||||
+ /* May be accessed before php_request_startup() */
|
||||
+ PG(http_globals)[i] = NULL;
|
||||
}
|
||||
}
|
||||
} zend_end_try();
|
||||
@@ -1937,6 +1939,9 @@ void php_request_shutdown(void *dummy)
|
||||
#ifdef HAVE_DTRACE
|
||||
DTRACE_REQUEST_SHUTDOWN(SAFE_FILENAME(SG(request_info).path_translated), SAFE_FILENAME(SG(request_info).request_uri), (char *)SAFE_FILENAME(SG(request_info).request_method));
|
||||
#endif /* HAVE_DTRACE */
|
||||
+
|
||||
+ /* May be accessed before php_request_startup() */
|
||||
+ PG(modules_activated) = 0;
|
||||
}
|
||||
/* }}} */
|
||||
|
||||
diff --git a/main/php_variables.c b/main/php_variables.c
|
||||
index fbd9562e..606a4b03 100644
|
||||
--- a/main/php_variables.c
|
||||
+++ b/main/php_variables.c
|
||||
@@ -191,7 +191,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
|
||||
if (!index) {
|
||||
MAKE_STD_ZVAL(gpc_element);
|
||||
- array_init(gpc_element);
|
||||
+ array_init_singleton(gpc_element);
|
||||
if (zend_hash_next_index_insert(symtable1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p) == FAILURE) {
|
||||
zval_ptr_dtor(&gpc_element);
|
||||
zval_dtor(val);
|
||||
@@ -208,7 +208,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
if (zend_symtable_find(symtable1, index, index_len + 1, (void **) &gpc_element_p) == FAILURE
|
||||
|| Z_TYPE_PP(gpc_element_p) != IS_ARRAY) {
|
||||
MAKE_STD_ZVAL(gpc_element);
|
||||
- array_init(gpc_element);
|
||||
+ array_init_singleton(gpc_element);
|
||||
zend_symtable_update(symtable1, index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
|
||||
}
|
||||
}
|
||||
@@ -406,7 +406,7 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
|
||||
case PARSE_GET:
|
||||
case PARSE_COOKIE:
|
||||
ALLOC_ZVAL(array_ptr);
|
||||
- array_init(array_ptr);
|
||||
+ array_init_singleton(array_ptr);
|
||||
INIT_PZVAL(array_ptr);
|
||||
switch (arg) {
|
||||
case PARSE_POST:
|
||||
diff --git a/main/rfc1867.c b/main/rfc1867.c
|
||||
index 2b3e47f9..fdb671d2 100644
|
||||
--- a/main/rfc1867.c
|
||||
+++ b/main/rfc1867.c
|
||||
@@ -400,6 +400,14 @@ static int find_boundary(multipart_buffer *self, char *boundary TSRMLS_DC)
|
||||
return 0;
|
||||
}
|
||||
|
||||
+static zend_bool php_mime_should_save_hdr(const char *name)
|
||||
+{
|
||||
+ return !strcasecmp(name, "Content-Disposition")
|
||||
+ || !strcasecmp(name, "Content-Type");
|
||||
+}
|
||||
+
|
||||
+static char *php_mime_get_hdr_value(zend_llist header, char *key);
|
||||
+
|
||||
/* parse headers */
|
||||
static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header TSRMLS_DC)
|
||||
{
|
||||
@@ -441,10 +449,15 @@ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header T
|
||||
}
|
||||
|
||||
*value = '\0';
|
||||
- do { value++; } while(isspace(*value));
|
||||
-
|
||||
- key = estrdup(line);
|
||||
- smart_str_appends(&buf_value, value);
|
||||
+ /* Keep only headers we use, and ignore duplicates */
|
||||
+ if (!php_mime_should_save_hdr(line)
|
||||
+ || php_mime_get_hdr_value(*header, line)) {
|
||||
+ key = NULL;
|
||||
+ } else {
|
||||
+ key = estrdup(line);
|
||||
+ do { value++; } while(isspace(*value));
|
||||
+ smart_str_appends(&buf_value, value);
|
||||
+ }
|
||||
} else if (buf_value.c) { /* If no ':' on the line, add to previous line */
|
||||
smart_str_appends(&buf_value, line);
|
||||
} else {
|
||||
@@ -517,11 +530,11 @@ static char *php_ap_getword(const zend_encoding *encoding, char **line, char sto
|
||||
return res;
|
||||
}
|
||||
|
||||
-static char *substring_conf(char *start, int len, char quote)
|
||||
+static char *substring_conf(char *start, size_t len, char quote)
|
||||
{
|
||||
char *result = emalloc(len + 1);
|
||||
char *resp = result;
|
||||
- int i;
|
||||
+ size_t i;
|
||||
|
||||
for (i = 0; i < len && start[i] != quote; ++i) {
|
||||
if (start[i] == '\\' && (start[i + 1] == '\\' || (quote && start[i + 1] == quote))) {
|
||||
@@ -556,7 +569,7 @@ static char *php_ap_getword_conf(const zend_encoding *encoding, char *str TSRMLS
|
||||
while (*strend && !isspace(*strend)) {
|
||||
++strend;
|
||||
}
|
||||
- return substring_conf(str, strend - str, 0);
|
||||
+ return substring_conf(str, (size_t)(strend - str), 0);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
# https://salsa.debian.org/php-team/php/-/tree/7401dd5c10042b6b875370027d775f9c542171b8/debian/patches (Sury 5.6.40-104)
|
||||
0261-Avoid-state-corruption-via-bailout.patch
|
||||
@@ -1,25 +0,0 @@
|
||||
From: Remi Collet <remi@remirepo.net>
|
||||
Date: Fri, 22 Nov 2024 15:24:16 +0100
|
||||
Subject: backport ZSTR_MAX_LEN
|
||||
|
||||
(cherry picked from commit 37056ad634d9c44bac0d6c8e730eafaec1344840)
|
||||
(cherry picked from commit ff868946218d6d1661a0c35757e2058cb3ed23ec)
|
||||
(cherry picked from commit 351dee5281697c14712e261f560d671e1661e51a)
|
||||
---
|
||||
Zend/zend_string.h | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/Zend/zend_string.h b/Zend/zend_string.h
|
||||
index 113e5ca..e3286e1 100644
|
||||
--- a/Zend/zend_string.h
|
||||
+++ b/Zend/zend_string.h
|
||||
@@ -61,6 +61,9 @@ END_EXTERN_C()
|
||||
|
||||
#define _ZSTR_STRUCT_SIZE(len) (_ZSTR_HEADER_SIZE + len + 1)
|
||||
|
||||
+#define ZSTR_MAX_OVERHEAD (ZEND_MM_ALIGNED_SIZE(_ZSTR_HEADER_SIZE + 1))
|
||||
+#define ZSTR_MAX_LEN (SIZE_MAX - ZSTR_MAX_OVERHEAD)
|
||||
+
|
||||
#define ZSTR_ALLOCA_ALLOC(str, _len, use_heap) do { \
|
||||
(str) = (zend_string *)do_alloca(ZEND_MM_ALIGNED_SIZE_EX(_ZSTR_STRUCT_SIZE(_len), 8), (use_heap)); \
|
||||
GC_REFCOUNT(str) = 1; \
|
||||
@@ -1,701 +0,0 @@
|
||||
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
|
||||
Date: Sun, 18 Oct 2026 20:09:54 +0200
|
||||
Subject: Avoid state corruption via bailout
|
||||
|
||||
Minimal mitigation for EOL version.
|
||||
|
||||
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
|
||||
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
|
||||
|
||||
Backported from the PHP 7.4 version:
|
||||
- There is no fast shutdown in shutdown_executor() before PHP 7.2 (the
|
||||
opcache one runs before the error handlers are destroyed), so the user
|
||||
error/exception handlers, EG(error_handling) and EG(exception) are reset
|
||||
after the cleanup blocks, where a bailout cannot skip it.
|
||||
- array_init_singleton() is implemented in zend_API.c, there is no
|
||||
zend_new_array(); HT_HASH_RESET() uses memset(), so the SSE2 change is
|
||||
not needed.
|
||||
- ZEND_FAST_CONCAT has no string fast path, so only ZEND_CONCAT gets the
|
||||
length checks.
|
||||
- "|| 1" instead of "|| true" in the session upload progress callback
|
||||
(no stdbool.h).
|
||||
- The max_multipart_body_parts hunk of the 7.4 patch is left out, the
|
||||
code is already there.
|
||||
- ZEND_CONCAT uses zend_string_realloc(); the estrdup() and hash table
|
||||
overflow messages use the 7.1+ formats (the old ones passed int
|
||||
arguments for %zu, which vsnprintf() cannot take).
|
||||
|
||||
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
|
||||
---
|
||||
Zend/zend_API.c | 8 +++++
|
||||
Zend/zend_API.h | 2 ++
|
||||
Zend/zend_alloc.c | 66 +++++++++++++++++++++++++++++------------
|
||||
Zend/zend_alloc.h | 2 ++
|
||||
Zend/zend_execute_API.c | 8 +++++
|
||||
Zend/zend_hash.c | 6 ++--
|
||||
Zend/zend_llist.c | 2 ++
|
||||
Zend/zend_multiply.h | 4 +--
|
||||
Zend/zend_strtod.c | 4 +--
|
||||
Zend/zend_vm_def.h | 6 ++++
|
||||
Zend/zend_vm_execute.h | 54 +++++++++++++++++++++++++++++++++
|
||||
ext/session/session.c | 2 +-
|
||||
main/SAPI.c | 5 ++++
|
||||
main/main.c | 5 ++++
|
||||
main/php_variables.c | 8 ++---
|
||||
main/rfc1867.c | 29 +++++++++++++-----
|
||||
16 files changed, 172 insertions(+), 39 deletions(-)
|
||||
|
||||
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
|
||||
index d7b22791..8622ef67 100644
|
||||
--- a/Zend/zend_API.c
|
||||
+++ b/Zend/zend_API.c
|
||||
@@ -1062,6 +1062,14 @@ ZEND_API int _array_init(zval *arg, uint32_t size ZEND_FILE_LINE_DC) /* {{{ */
|
||||
}
|
||||
/* }}} */
|
||||
|
||||
+ZEND_API int _array_init_singleton(zval *arg ZEND_FILE_LINE_DC) /* {{{ */
|
||||
+{
|
||||
+ _array_init(arg, 0 ZEND_FILE_LINE_RELAY_CC);
|
||||
+ Z_ARRVAL_P(arg)->nTableSize = 1;
|
||||
+ return SUCCESS;
|
||||
+}
|
||||
+/* }}} */
|
||||
+
|
||||
/* This function should be called after the constructor has been called
|
||||
* because it may call __set from the uninitialized object otherwise. */
|
||||
ZEND_API void zend_merge_properties(zval *obj, HashTable *properties) /* {{{ */
|
||||
diff --git a/Zend/zend_API.h b/Zend/zend_API.h
|
||||
index 9f2e2c6b..a1cd888b 100644
|
||||
--- a/Zend/zend_API.h
|
||||
+++ b/Zend/zend_API.h
|
||||
@@ -375,10 +375,12 @@ ZEND_API char *zend_get_type_by_const(int type);
|
||||
|
||||
#define array_init(arg) _array_init((arg), 0 ZEND_FILE_LINE_CC)
|
||||
#define array_init_size(arg, size) _array_init((arg), (size) ZEND_FILE_LINE_CC)
|
||||
+#define array_init_singleton(arg) _array_init_singleton((arg) ZEND_FILE_LINE_CC)
|
||||
#define object_init(arg) _object_init((arg) ZEND_FILE_LINE_CC)
|
||||
#define object_init_ex(arg, ce) _object_init_ex((arg), (ce) ZEND_FILE_LINE_CC)
|
||||
#define object_and_properties_init(arg, ce, properties) _object_and_properties_init((arg), (ce), (properties) ZEND_FILE_LINE_CC)
|
||||
ZEND_API int _array_init(zval *arg, uint32_t size ZEND_FILE_LINE_DC);
|
||||
+ZEND_API int _array_init_singleton(zval *arg ZEND_FILE_LINE_DC);
|
||||
ZEND_API int _object_init(zval *arg ZEND_FILE_LINE_DC);
|
||||
ZEND_API int _object_init_ex(zval *arg, zend_class_entry *ce ZEND_FILE_LINE_DC);
|
||||
ZEND_API int _object_and_properties_init(zval *arg, zend_class_entry *ce, HashTable *properties ZEND_FILE_LINE_DC);
|
||||
diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
|
||||
index be41aa3e..62c72a33 100644
|
||||
--- a/Zend/zend_alloc.c
|
||||
+++ b/Zend/zend_alloc.c
|
||||
@@ -58,6 +58,7 @@
|
||||
#include "zend_globals.h"
|
||||
#include "zend_operators.h"
|
||||
#include "zend_multiply.h"
|
||||
+#include "zend_execute.h"
|
||||
|
||||
#ifdef HAVE_SIGNAL_H
|
||||
# include <signal.h>
|
||||
@@ -369,7 +370,42 @@ static ZEND_COLD ZEND_NORETURN void zend_mm_panic(const char *message)
|
||||
#if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID)
|
||||
kill(getpid(), SIGSEGV);
|
||||
#endif
|
||||
- exit(1);
|
||||
+ _exit(1);
|
||||
+}
|
||||
+
|
||||
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...)
|
||||
+{
|
||||
+ zend_string *script_filename = NULL;
|
||||
+ uint32_t script_lineno = 0;
|
||||
+
|
||||
+ if (zend_is_executing()) {
|
||||
+ script_filename = zend_get_executed_filename_ex();
|
||||
+ script_lineno = zend_get_executed_lineno();
|
||||
+ } else if (zend_is_compiling()) {
|
||||
+ script_filename = zend_get_compiled_filename();
|
||||
+ script_lineno = zend_get_compiled_lineno();
|
||||
+ }
|
||||
+
|
||||
+ va_list args;
|
||||
+ va_start(args, format);
|
||||
+
|
||||
+ char buf[1024];
|
||||
+ vsnprintf(buf, sizeof(buf), format, args);
|
||||
+
|
||||
+ va_end(args);
|
||||
+
|
||||
+ fprintf(stderr,
|
||||
+ "\nFatal error: %s in %s on line %d\n",
|
||||
+ buf,
|
||||
+ script_filename ? ZSTR_VAL(script_filename) : "Unknown",
|
||||
+ script_lineno);
|
||||
+
|
||||
+ /* See http://support.microsoft.com/kb/190351 */
|
||||
+# ifdef ZEND_WIN32
|
||||
+ fflush(stderr);
|
||||
+# endif
|
||||
+
|
||||
+ _exit(1);
|
||||
}
|
||||
|
||||
static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
|
||||
@@ -381,22 +417,14 @@ static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
|
||||
#endif
|
||||
size_t size)
|
||||
{
|
||||
+ (void) heap;
|
||||
|
||||
- heap->overflow = 1;
|
||||
- zend_try {
|
||||
- zend_error_noreturn(E_ERROR,
|
||||
- format,
|
||||
- limit,
|
||||
+ zend_mm_safe_error_ex(format, limit,
|
||||
#if ZEND_DEBUG
|
||||
- filename,
|
||||
- lineno,
|
||||
+ filename,
|
||||
+ lineno,
|
||||
#endif
|
||||
- size);
|
||||
- } zend_catch {
|
||||
- } zend_end_try();
|
||||
- heap->overflow = 0;
|
||||
- zend_bailout();
|
||||
- exit(1);
|
||||
+ size);
|
||||
}
|
||||
|
||||
#ifdef _WIN32
|
||||
@@ -1381,7 +1409,7 @@ static zend_always_inline void *zend_mm_alloc_heap(zend_mm_heap *heap, size_t si
|
||||
size = MAX(size, 1);
|
||||
size = ZEND_MM_ALIGNED_SIZE(size) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info));
|
||||
if (UNEXPECTED(size < real_size)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
|
||||
return NULL;
|
||||
}
|
||||
#endif
|
||||
@@ -2567,7 +2595,7 @@ ZEND_API char* ZEND_FASTCALL _estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_
|
||||
|
||||
length = strlen(s);
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", 1, length, 1);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
|
||||
if (UNEXPECTED(p == NULL)) {
|
||||
@@ -2582,7 +2610,7 @@ ZEND_API char* ZEND_FASTCALL _estrndup(const char *s, size_t length ZEND_FILE_LI
|
||||
char *p;
|
||||
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", 1, length, 1);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
|
||||
if (UNEXPECTED(p == NULL)) {
|
||||
@@ -2599,7 +2627,7 @@ ZEND_API char* ZEND_FASTCALL zend_strndup(const char *s, size_t length)
|
||||
char *p;
|
||||
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", 1, length, 1);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) malloc(length + 1);
|
||||
if (UNEXPECTED(p == NULL)) {
|
||||
@@ -2874,7 +2902,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
|
||||
static ZEND_COLD ZEND_NORETURN void zend_out_of_memory(void)
|
||||
{
|
||||
fprintf(stderr, "Out of memory\n");
|
||||
- exit(1);
|
||||
+ _exit(1);
|
||||
}
|
||||
|
||||
ZEND_API void * __zend_malloc(size_t len)
|
||||
diff --git a/Zend/zend_alloc.h b/Zend/zend_alloc.h
|
||||
index 529bd618..d8fc31a3 100644
|
||||
--- a/Zend/zend_alloc.h
|
||||
+++ b/Zend/zend_alloc.h
|
||||
@@ -392,6 +392,8 @@ static void apc_init_heap(void)
|
||||
|
||||
*/
|
||||
|
||||
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...);
|
||||
+
|
||||
END_EXTERN_C()
|
||||
|
||||
#endif
|
||||
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
|
||||
index ff2d22f1..b083a782 100644
|
||||
--- a/Zend/zend_execute_API.c
|
||||
+++ b/Zend/zend_execute_API.c
|
||||
@@ -299,6 +299,10 @@ void shutdown_executor(void) /* {{{ */
|
||||
zend_stack_clean(&EG(user_exception_handlers), (void (*)(void *))ZVAL_PTR_DTOR, 1);
|
||||
} zend_end_try();
|
||||
|
||||
+ /* may be used by zend_error before init_executor */
|
||||
+ ZVAL_UNDEF(&EG(user_error_handler));
|
||||
+ ZVAL_UNDEF(&EG(user_exception_handler));
|
||||
+
|
||||
zend_try {
|
||||
/* Cleanup static data for functions and arrays.
|
||||
* We need a separate cleanup stage because of the following problem:
|
||||
@@ -378,6 +382,10 @@ void shutdown_executor(void) /* {{{ */
|
||||
}
|
||||
} zend_end_try();
|
||||
|
||||
+ /* may be used by zend_error before init_executor */
|
||||
+ EG(error_handling) = EH_NORMAL;
|
||||
+ EG(exception) = NULL;
|
||||
+
|
||||
zend_try {
|
||||
#if 0&&ZEND_DEBUG
|
||||
signal(SIGSEGV, original_sigsegv_handler);
|
||||
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
|
||||
index 9a1b10bb..44508684 100644
|
||||
--- a/Zend/zend_hash.c
|
||||
+++ b/Zend/zend_hash.c
|
||||
@@ -103,7 +103,7 @@ static uint32_t zend_always_inline zend_hash_check_size(uint32_t nSize)
|
||||
if (nSize < HT_MIN_SIZE) {
|
||||
nSize = HT_MIN_SIZE;
|
||||
} else if (UNEXPECTED(nSize >= HT_MAX_SIZE)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
|
||||
}
|
||||
|
||||
#if defined(ZEND_WIN32)
|
||||
@@ -189,7 +189,7 @@ static void ZEND_FASTCALL zend_hash_packed_grow(HashTable *ht)
|
||||
{
|
||||
HT_ASSERT(GC_REFCOUNT(ht) == 1);
|
||||
if (ht->nTableSize >= HT_MAX_SIZE) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
|
||||
}
|
||||
HANDLE_BLOCK_INTERRUPTIONS();
|
||||
ht->nTableSize += ht->nTableSize;
|
||||
@@ -893,7 +893,7 @@ static void ZEND_FASTCALL zend_hash_do_resize(HashTable *ht)
|
||||
zend_hash_rehash(ht);
|
||||
HANDLE_UNBLOCK_INTERRUPTIONS();
|
||||
} else {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/Zend/zend_llist.c b/Zend/zend_llist.c
|
||||
index 677b7da4..f9f7abbb 100644
|
||||
--- a/Zend/zend_llist.c
|
||||
+++ b/Zend/zend_llist.c
|
||||
@@ -114,6 +114,8 @@ ZEND_API void zend_llist_destroy(zend_llist *l)
|
||||
current = next;
|
||||
}
|
||||
|
||||
+ l->head = NULL;
|
||||
+ l->tail = NULL;
|
||||
l->count = 0;
|
||||
}
|
||||
|
||||
diff --git a/Zend/zend_multiply.h b/Zend/zend_multiply.h
|
||||
index c66e1924..e535a1ff 100644
|
||||
--- a/Zend/zend_multiply.h
|
||||
+++ b/Zend/zend_multiply.h
|
||||
@@ -272,7 +272,7 @@ static zend_always_inline size_t zend_safe_address_guarded(size_t nmemb, size_t
|
||||
size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return ret;
|
||||
@@ -285,7 +285,7 @@ static zend_always_inline size_t zend_safe_addmult(size_t nmemb, size_t size, si
|
||||
size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return ret;
|
||||
diff --git a/Zend/zend_strtod.c b/Zend/zend_strtod.c
|
||||
index d15048b7..d2f73822 100644
|
||||
--- a/Zend/zend_strtod.c
|
||||
+++ b/Zend/zend_strtod.c
|
||||
@@ -600,7 +600,7 @@ Balloc
|
||||
rv = (Bigint *)MALLOC(sizeof(Bigint) + (x-1)*sizeof(ULong));
|
||||
if (!rv) {
|
||||
FREE_DTOA_LOCK(0);
|
||||
- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
|
||||
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
|
||||
}
|
||||
#else
|
||||
len = (sizeof(Bigint) + (x-1)*sizeof(ULong) + sizeof(double) - 1)
|
||||
@@ -613,7 +613,7 @@ Balloc
|
||||
rv = (Bigint*)MALLOC(len*sizeof(double));
|
||||
if (!rv) {
|
||||
FREE_DTOA_LOCK(0);
|
||||
- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
|
||||
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
|
||||
}
|
||||
#endif
|
||||
rv->k = k;
|
||||
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
|
||||
index b2f9bbdf..3832471f 100644
|
||||
--- a/Zend/zend_vm_def.h
|
||||
+++ b/Zend/zend_vm_def.h
|
||||
@@ -290,11 +290,17 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_realloc(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
|
||||
index 1fd66037..9eecd684 100644
|
||||
--- a/Zend/zend_vm_execute.h
|
||||
+++ b/Zend/zend_vm_execute.h
|
||||
@@ -4602,11 +4602,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_CONST_HANDLE
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_realloc(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -8638,11 +8644,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_CV_HANDLER(Z
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_realloc(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -10521,11 +10533,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_TMPVAR_HANDL
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_realloc(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -30441,11 +30459,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CONST_HANDLER(Z
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_realloc(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -35757,11 +35781,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_realloc(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -38475,11 +38505,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_TMPVAR_HANDLER(
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_realloc(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -41529,11 +41565,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CONST_HANDL
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_realloc(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -43947,11 +43989,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CV_HANDLER(
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_realloc(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -45096,11 +45144,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_TMPVAR_HAND
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_realloc(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
diff --git a/ext/session/session.c b/ext/session/session.c
|
||||
index 48a15b67..0d76b9b0 100644
|
||||
--- a/ext/session/session.c
|
||||
+++ b/ext/session/session.c
|
||||
@@ -2960,7 +2960,7 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
|
||||
if (php_session_rfc1867_orig_callback) {
|
||||
retval = php_session_rfc1867_orig_callback(event, event_data, extra);
|
||||
}
|
||||
- if (!PS(rfc1867_enabled)) {
|
||||
+ if (!PS(rfc1867_enabled) || 1) {
|
||||
return retval;
|
||||
}
|
||||
|
||||
diff --git a/main/SAPI.c b/main/SAPI.c
|
||||
index 018ef23b..e9854aca 100644
|
||||
--- a/main/SAPI.c
|
||||
+++ b/main/SAPI.c
|
||||
@@ -516,18 +516,23 @@ SAPI_API void sapi_deactivate(void)
|
||||
}
|
||||
if (SG(request_info).auth_user) {
|
||||
efree(SG(request_info).auth_user);
|
||||
+ SG(request_info).auth_user = NULL;
|
||||
}
|
||||
if (SG(request_info).auth_password) {
|
||||
efree(SG(request_info).auth_password);
|
||||
+ SG(request_info).auth_password = NULL;
|
||||
}
|
||||
if (SG(request_info).auth_digest) {
|
||||
efree(SG(request_info).auth_digest);
|
||||
+ SG(request_info).auth_digest = NULL;
|
||||
}
|
||||
if (SG(request_info).content_type_dup) {
|
||||
efree(SG(request_info).content_type_dup);
|
||||
+ SG(request_info).content_type_dup = NULL;
|
||||
}
|
||||
if (SG(request_info).current_user) {
|
||||
efree(SG(request_info).current_user);
|
||||
+ SG(request_info).current_user = NULL;
|
||||
}
|
||||
if (sapi_module.deactivate) {
|
||||
sapi_module.deactivate();
|
||||
diff --git a/main/main.c b/main/main.c
|
||||
index 91f9ead1..eec25c7c 100644
|
||||
--- a/main/main.c
|
||||
+++ b/main/main.c
|
||||
@@ -1844,6 +1844,8 @@ void php_request_shutdown(void *dummy)
|
||||
|
||||
for (i=0; i<NUM_TRACK_VARS; i++) {
|
||||
zval_ptr_dtor(&PG(http_globals)[i]);
|
||||
+ /* May be accessed before php_request_startup() */
|
||||
+ ZVAL_UNDEF(&PG(http_globals)[i]);
|
||||
}
|
||||
} zend_end_try();
|
||||
|
||||
@@ -1897,6 +1899,9 @@ void php_request_shutdown(void *dummy)
|
||||
#ifdef HAVE_DTRACE
|
||||
DTRACE_REQUEST_SHUTDOWN(SAFE_FILENAME(SG(request_info).path_translated), SAFE_FILENAME(SG(request_info).request_uri), (char *)SAFE_FILENAME(SG(request_info).request_method));
|
||||
#endif /* HAVE_DTRACE */
|
||||
+
|
||||
+ /* May be accessed before php_request_startup() */
|
||||
+ PG(modules_activated) = 0;
|
||||
}
|
||||
/* }}} */
|
||||
|
||||
diff --git a/main/php_variables.c b/main/php_variables.c
|
||||
index 46de3477..afeb88cb 100644
|
||||
--- a/main/php_variables.c
|
||||
+++ b/main/php_variables.c
|
||||
@@ -187,7 +187,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
}
|
||||
|
||||
if (!index) {
|
||||
- array_init(&gpc_element);
|
||||
+ array_init_singleton(&gpc_element);
|
||||
if ((gpc_element_p = zend_hash_next_index_insert(symtable1, &gpc_element)) == NULL) {
|
||||
zval_ptr_dtor(&gpc_element);
|
||||
zval_dtor(val);
|
||||
@@ -204,7 +204,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
gpc_element_p = zend_symtable_str_find(symtable1, index, index_len);
|
||||
if (!gpc_element_p) {
|
||||
zval tmp;
|
||||
- array_init(&tmp);
|
||||
+ array_init_singleton(&tmp);
|
||||
gpc_element_p = zend_symtable_str_update_ind(symtable1, index, index_len, &tmp);
|
||||
} else {
|
||||
if (Z_TYPE_P(gpc_element_p) == IS_INDIRECT) {
|
||||
@@ -212,7 +212,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
}
|
||||
if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) {
|
||||
zval_ptr_dtor(gpc_element_p);
|
||||
- array_init(gpc_element_p);
|
||||
+ array_init_singleton(gpc_element_p);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -405,7 +405,7 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
|
||||
case PARSE_POST:
|
||||
case PARSE_GET:
|
||||
case PARSE_COOKIE:
|
||||
- array_init(&array);
|
||||
+ array_init_singleton(&array);
|
||||
switch (arg) {
|
||||
case PARSE_POST:
|
||||
zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_POST]);
|
||||
diff --git a/main/rfc1867.c b/main/rfc1867.c
|
||||
index 5d255ae3..672da20d 100644
|
||||
--- a/main/rfc1867.c
|
||||
+++ b/main/rfc1867.c
|
||||
@@ -405,6 +405,14 @@ static int find_boundary(multipart_buffer *self, char *boundary)
|
||||
return 0;
|
||||
}
|
||||
|
||||
+static zend_bool php_mime_should_save_hdr(const char *name)
|
||||
+{
|
||||
+ return !strcasecmp(name, "Content-Disposition")
|
||||
+ || !strcasecmp(name, "Content-Type");
|
||||
+}
|
||||
+
|
||||
+static char *php_mime_get_hdr_value(zend_llist header, char *key);
|
||||
+
|
||||
/* parse headers */
|
||||
static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
|
||||
{
|
||||
@@ -445,10 +453,15 @@ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
|
||||
}
|
||||
|
||||
*value = '\0';
|
||||
- do { value++; } while (isspace(*value));
|
||||
-
|
||||
- key = estrdup(line);
|
||||
- smart_string_appends(&buf_value, value);
|
||||
+ /* Keep only headers we use, and ignore duplicates */
|
||||
+ if (!php_mime_should_save_hdr(line)
|
||||
+ || php_mime_get_hdr_value(*header, line)) {
|
||||
+ key = NULL;
|
||||
+ } else {
|
||||
+ key = estrdup(line);
|
||||
+ do { value++; } while (isspace(*value));
|
||||
+ smart_string_appends(&buf_value, value);
|
||||
+ }
|
||||
} else if (buf_value.c) { /* If no ':' on the line, add to previous line */
|
||||
smart_string_appends(&buf_value, line);
|
||||
} else {
|
||||
@@ -522,11 +535,11 @@ static char *php_ap_getword(const zend_encoding *encoding, char **line, char sto
|
||||
return res;
|
||||
}
|
||||
|
||||
-static char *substring_conf(char *start, int len, char quote)
|
||||
+static char *substring_conf(char *start, size_t len, char quote)
|
||||
{
|
||||
char *result = emalloc(len + 1);
|
||||
char *resp = result;
|
||||
- int i;
|
||||
+ size_t i;
|
||||
|
||||
for (i = 0; i < len && start[i] != quote; ++i) {
|
||||
if (start[i] == '\\' && (start[i + 1] == '\\' || (quote && start[i + 1] == quote))) {
|
||||
@@ -554,14 +567,14 @@ static char *php_ap_getword_conf(const zend_encoding *encoding, char *str)
|
||||
char quote = *str;
|
||||
|
||||
str++;
|
||||
- return substring_conf(str, (int)strlen(str), quote);
|
||||
+ return substring_conf(str, strlen(str), quote);
|
||||
} else {
|
||||
char *strend = str;
|
||||
|
||||
while (*strend && !isspace(*strend)) {
|
||||
++strend;
|
||||
}
|
||||
- return substring_conf(str, strend - str, 0);
|
||||
+ return substring_conf(str, (size_t)(strend - str), 0);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
# https://salsa.debian.org/php-team/php/-/tree/dbe6804422b175d8542b91699384afe5beebeab2/debian/patches (Sury 7.0.33-92)
|
||||
0211-backport-ZSTR_MAX_LEN.patch
|
||||
0230-Avoid-state-corruption-via-bailout.patch
|
||||
@@ -1,24 +0,0 @@
|
||||
From: Remi Collet <remi@remirepo.net>
|
||||
Date: Fri, 22 Nov 2024 15:24:16 +0100
|
||||
Subject: backport ZSTR_MAX_LEN
|
||||
|
||||
(cherry picked from commit 37056ad634d9c44bac0d6c8e730eafaec1344840)
|
||||
(cherry picked from commit ff868946218d6d1661a0c35757e2058cb3ed23ec)
|
||||
---
|
||||
Zend/zend_string.h | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/Zend/zend_string.h b/Zend/zend_string.h
|
||||
index dbc3f3b..b15f78c 100644
|
||||
--- a/Zend/zend_string.h
|
||||
+++ b/Zend/zend_string.h
|
||||
@@ -62,6 +62,9 @@ END_EXTERN_C()
|
||||
|
||||
#define _ZSTR_STRUCT_SIZE(len) (_ZSTR_HEADER_SIZE + len + 1)
|
||||
|
||||
+#define ZSTR_MAX_OVERHEAD (ZEND_MM_ALIGNED_SIZE(_ZSTR_HEADER_SIZE + 1))
|
||||
+#define ZSTR_MAX_LEN (SIZE_MAX - ZSTR_MAX_OVERHEAD)
|
||||
+
|
||||
#define ZSTR_ALLOCA_ALLOC(str, _len, use_heap) do { \
|
||||
(str) = (zend_string *)do_alloca(ZEND_MM_ALIGNED_SIZE_EX(_ZSTR_STRUCT_SIZE(_len), 8), (use_heap)); \
|
||||
GC_REFCOUNT(str) = 1; \
|
||||
@@ -1,698 +0,0 @@
|
||||
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
|
||||
Date: Sun, 18 Oct 2026 20:09:54 +0200
|
||||
Subject: Avoid state corruption via bailout
|
||||
|
||||
Minimal mitigation for EOL version.
|
||||
|
||||
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
|
||||
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
|
||||
|
||||
Backported from the PHP 7.4 version:
|
||||
- There is no fast shutdown in shutdown_executor() before PHP 7.2 (the
|
||||
opcache one runs before the error handlers are destroyed), so the user
|
||||
error/exception handlers, EG(error_handling) and EG(exception) are reset
|
||||
after the cleanup blocks, where a bailout cannot skip it.
|
||||
- array_init_singleton() is implemented in zend_API.c, there is no
|
||||
zend_new_array(); HT_HASH_RESET() uses memset(), so the SSE2 change is
|
||||
not needed.
|
||||
- ZEND_FAST_CONCAT has no string fast path, so only ZEND_CONCAT gets the
|
||||
length checks.
|
||||
- "|| 1" instead of "|| true" in the session upload progress callback
|
||||
(no stdbool.h).
|
||||
- The max_multipart_body_parts hunk of the 7.4 patch is left out, the
|
||||
code is already there.
|
||||
|
||||
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
|
||||
---
|
||||
Zend/zend_API.c | 8 +++++
|
||||
Zend/zend_API.h | 2 ++
|
||||
Zend/zend_alloc.c | 66 +++++++++++++++++++++++++++++------------
|
||||
Zend/zend_alloc.h | 2 ++
|
||||
Zend/zend_execute_API.c | 8 +++++
|
||||
Zend/zend_hash.c | 6 ++--
|
||||
Zend/zend_llist.c | 2 ++
|
||||
Zend/zend_multiply.h | 4 +--
|
||||
Zend/zend_strtod.c | 4 +--
|
||||
Zend/zend_vm_def.h | 6 ++++
|
||||
Zend/zend_vm_execute.h | 54 +++++++++++++++++++++++++++++++++
|
||||
ext/session/session.c | 2 +-
|
||||
main/SAPI.c | 5 ++++
|
||||
main/main.c | 5 ++++
|
||||
main/php_variables.c | 8 ++---
|
||||
main/rfc1867.c | 29 +++++++++++++-----
|
||||
16 files changed, 172 insertions(+), 39 deletions(-)
|
||||
|
||||
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
|
||||
index 3dcf0671..bdff6616 100644
|
||||
--- a/Zend/zend_API.c
|
||||
+++ b/Zend/zend_API.c
|
||||
@@ -1063,6 +1063,14 @@ ZEND_API int _array_init(zval *arg, uint32_t size ZEND_FILE_LINE_DC) /* {{{ */
|
||||
}
|
||||
/* }}} */
|
||||
|
||||
+ZEND_API int _array_init_singleton(zval *arg ZEND_FILE_LINE_DC) /* {{{ */
|
||||
+{
|
||||
+ _array_init(arg, 0 ZEND_FILE_LINE_RELAY_CC);
|
||||
+ Z_ARRVAL_P(arg)->nTableSize = 1;
|
||||
+ return SUCCESS;
|
||||
+}
|
||||
+/* }}} */
|
||||
+
|
||||
/* This function should be called after the constructor has been called
|
||||
* because it may call __set from the uninitialized object otherwise. */
|
||||
ZEND_API void zend_merge_properties(zval *obj, HashTable *properties) /* {{{ */
|
||||
diff --git a/Zend/zend_API.h b/Zend/zend_API.h
|
||||
index 79267ac0..b48477c4 100644
|
||||
--- a/Zend/zend_API.h
|
||||
+++ b/Zend/zend_API.h
|
||||
@@ -379,10 +379,12 @@ ZEND_API char *zend_get_type_by_const(int type);
|
||||
|
||||
#define array_init(arg) _array_init((arg), 0 ZEND_FILE_LINE_CC)
|
||||
#define array_init_size(arg, size) _array_init((arg), (size) ZEND_FILE_LINE_CC)
|
||||
+#define array_init_singleton(arg) _array_init_singleton((arg) ZEND_FILE_LINE_CC)
|
||||
#define object_init(arg) _object_init((arg) ZEND_FILE_LINE_CC)
|
||||
#define object_init_ex(arg, ce) _object_init_ex((arg), (ce) ZEND_FILE_LINE_CC)
|
||||
#define object_and_properties_init(arg, ce, properties) _object_and_properties_init((arg), (ce), (properties) ZEND_FILE_LINE_CC)
|
||||
ZEND_API int _array_init(zval *arg, uint32_t size ZEND_FILE_LINE_DC);
|
||||
+ZEND_API int _array_init_singleton(zval *arg ZEND_FILE_LINE_DC);
|
||||
ZEND_API int _object_init(zval *arg ZEND_FILE_LINE_DC);
|
||||
ZEND_API int _object_init_ex(zval *arg, zend_class_entry *ce ZEND_FILE_LINE_DC);
|
||||
ZEND_API int _object_and_properties_init(zval *arg, zend_class_entry *ce, HashTable *properties ZEND_FILE_LINE_DC);
|
||||
diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
|
||||
index d87b066f..235fc8d9 100644
|
||||
--- a/Zend/zend_alloc.c
|
||||
+++ b/Zend/zend_alloc.c
|
||||
@@ -59,6 +59,7 @@
|
||||
#include "zend_operators.h"
|
||||
#include "zend_multiply.h"
|
||||
#include "zend_bitset.h"
|
||||
+#include "zend_execute.h"
|
||||
|
||||
#ifdef HAVE_SIGNAL_H
|
||||
# include <signal.h>
|
||||
@@ -362,7 +363,42 @@ static ZEND_COLD ZEND_NORETURN void zend_mm_panic(const char *message)
|
||||
#if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID)
|
||||
kill(getpid(), SIGSEGV);
|
||||
#endif
|
||||
- exit(1);
|
||||
+ _exit(1);
|
||||
+}
|
||||
+
|
||||
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...)
|
||||
+{
|
||||
+ zend_string *script_filename = NULL;
|
||||
+ uint32_t script_lineno = 0;
|
||||
+
|
||||
+ if (zend_is_executing()) {
|
||||
+ script_filename = zend_get_executed_filename_ex();
|
||||
+ script_lineno = zend_get_executed_lineno();
|
||||
+ } else if (zend_is_compiling()) {
|
||||
+ script_filename = zend_get_compiled_filename();
|
||||
+ script_lineno = zend_get_compiled_lineno();
|
||||
+ }
|
||||
+
|
||||
+ va_list args;
|
||||
+ va_start(args, format);
|
||||
+
|
||||
+ char buf[1024];
|
||||
+ vsnprintf(buf, sizeof(buf), format, args);
|
||||
+
|
||||
+ va_end(args);
|
||||
+
|
||||
+ fprintf(stderr,
|
||||
+ "\nFatal error: %s in %s on line %d\n",
|
||||
+ buf,
|
||||
+ script_filename ? ZSTR_VAL(script_filename) : "Unknown",
|
||||
+ script_lineno);
|
||||
+
|
||||
+ /* See http://support.microsoft.com/kb/190351 */
|
||||
+# ifdef ZEND_WIN32
|
||||
+ fflush(stderr);
|
||||
+# endif
|
||||
+
|
||||
+ _exit(1);
|
||||
}
|
||||
|
||||
static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
|
||||
@@ -374,22 +410,14 @@ static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
|
||||
#endif
|
||||
size_t size)
|
||||
{
|
||||
+ (void) heap;
|
||||
|
||||
- heap->overflow = 1;
|
||||
- zend_try {
|
||||
- zend_error_noreturn(E_ERROR,
|
||||
- format,
|
||||
- limit,
|
||||
+ zend_mm_safe_error_ex(format, limit,
|
||||
#if ZEND_DEBUG
|
||||
- filename,
|
||||
- lineno,
|
||||
+ filename,
|
||||
+ lineno,
|
||||
#endif
|
||||
- size);
|
||||
- } zend_catch {
|
||||
- } zend_end_try();
|
||||
- heap->overflow = 0;
|
||||
- zend_bailout();
|
||||
- exit(1);
|
||||
+ size);
|
||||
}
|
||||
|
||||
#ifdef _WIN32
|
||||
@@ -1336,7 +1364,7 @@ static zend_always_inline void *zend_mm_alloc_heap(zend_mm_heap *heap, size_t si
|
||||
size = MAX(size, 1);
|
||||
size = ZEND_MM_ALIGNED_SIZE(size) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info));
|
||||
if (UNEXPECTED(size < real_size)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
|
||||
return NULL;
|
||||
}
|
||||
#endif
|
||||
@@ -2523,7 +2551,7 @@ ZEND_API char* ZEND_FASTCALL _estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_
|
||||
|
||||
length = strlen(s);
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
|
||||
if (UNEXPECTED(p == NULL)) {
|
||||
@@ -2538,7 +2566,7 @@ ZEND_API char* ZEND_FASTCALL _estrndup(const char *s, size_t length ZEND_FILE_LI
|
||||
char *p;
|
||||
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
|
||||
if (UNEXPECTED(p == NULL)) {
|
||||
@@ -2555,7 +2583,7 @@ ZEND_API char* ZEND_FASTCALL zend_strndup(const char *s, size_t length)
|
||||
char *p;
|
||||
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) malloc(length + 1);
|
||||
if (UNEXPECTED(p == NULL)) {
|
||||
@@ -2830,7 +2858,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
|
||||
static ZEND_COLD ZEND_NORETURN void zend_out_of_memory(void)
|
||||
{
|
||||
fprintf(stderr, "Out of memory\n");
|
||||
- exit(1);
|
||||
+ _exit(1);
|
||||
}
|
||||
|
||||
ZEND_API void * __zend_malloc(size_t len)
|
||||
diff --git a/Zend/zend_alloc.h b/Zend/zend_alloc.h
|
||||
index b195534a..ae14ab9e 100644
|
||||
--- a/Zend/zend_alloc.h
|
||||
+++ b/Zend/zend_alloc.h
|
||||
@@ -399,6 +399,8 @@ static void apc_init_heap(void)
|
||||
|
||||
*/
|
||||
|
||||
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...);
|
||||
+
|
||||
END_EXTERN_C()
|
||||
|
||||
#endif
|
||||
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
|
||||
index 5cb87df6..bb4ee17d 100644
|
||||
--- a/Zend/zend_execute_API.c
|
||||
+++ b/Zend/zend_execute_API.c
|
||||
@@ -301,6 +301,10 @@ void shutdown_executor(void) /* {{{ */
|
||||
zend_stack_clean(&EG(user_exception_handlers), (void (*)(void *))ZVAL_PTR_DTOR, 1);
|
||||
} zend_end_try();
|
||||
|
||||
+ /* may be used by zend_error before init_executor */
|
||||
+ ZVAL_UNDEF(&EG(user_error_handler));
|
||||
+ ZVAL_UNDEF(&EG(user_exception_handler));
|
||||
+
|
||||
zend_try {
|
||||
/* Cleanup static data for functions and arrays.
|
||||
* We need a separate cleanup stage because of the following problem:
|
||||
@@ -380,6 +384,10 @@ void shutdown_executor(void) /* {{{ */
|
||||
}
|
||||
} zend_end_try();
|
||||
|
||||
+ /* may be used by zend_error before init_executor */
|
||||
+ EG(error_handling) = EH_NORMAL;
|
||||
+ EG(exception) = NULL;
|
||||
+
|
||||
zend_try {
|
||||
#if 0&&ZEND_DEBUG
|
||||
signal(SIGSEGV, original_sigsegv_handler);
|
||||
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
|
||||
index dc443838..647280d2 100644
|
||||
--- a/Zend/zend_hash.c
|
||||
+++ b/Zend/zend_hash.c
|
||||
@@ -101,7 +101,7 @@ static zend_always_inline uint32_t zend_hash_check_size(uint32_t nSize)
|
||||
if (nSize < HT_MIN_SIZE) {
|
||||
nSize = HT_MIN_SIZE;
|
||||
} else if (UNEXPECTED(nSize >= HT_MAX_SIZE)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
|
||||
}
|
||||
|
||||
#if defined(ZEND_WIN32)
|
||||
@@ -187,7 +187,7 @@ static void ZEND_FASTCALL zend_hash_packed_grow(HashTable *ht)
|
||||
{
|
||||
HT_ASSERT(GC_REFCOUNT(ht) == 1);
|
||||
if (ht->nTableSize >= HT_MAX_SIZE) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
|
||||
}
|
||||
ht->nTableSize += ht->nTableSize;
|
||||
HT_SET_DATA_ADDR(ht, perealloc2(HT_GET_DATA_ADDR(ht), HT_SIZE(ht), HT_USED_SIZE(ht), ht->u.flags & HASH_FLAG_PERSISTENT));
|
||||
@@ -866,7 +866,7 @@ static void ZEND_FASTCALL zend_hash_do_resize(HashTable *ht)
|
||||
pefree(old_data, ht->u.flags & HASH_FLAG_PERSISTENT);
|
||||
zend_hash_rehash(ht);
|
||||
} else {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/Zend/zend_llist.c b/Zend/zend_llist.c
|
||||
index f771bd29..030472c7 100644
|
||||
--- a/Zend/zend_llist.c
|
||||
+++ b/Zend/zend_llist.c
|
||||
@@ -114,6 +114,8 @@ ZEND_API void zend_llist_destroy(zend_llist *l)
|
||||
current = next;
|
||||
}
|
||||
|
||||
+ l->head = NULL;
|
||||
+ l->tail = NULL;
|
||||
l->count = 0;
|
||||
}
|
||||
|
||||
diff --git a/Zend/zend_multiply.h b/Zend/zend_multiply.h
|
||||
index 8bece847..e80cc218 100644
|
||||
--- a/Zend/zend_multiply.h
|
||||
+++ b/Zend/zend_multiply.h
|
||||
@@ -272,7 +272,7 @@ static zend_always_inline size_t zend_safe_address_guarded(size_t nmemb, size_t
|
||||
size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return ret;
|
||||
@@ -285,7 +285,7 @@ static zend_always_inline size_t zend_safe_addmult(size_t nmemb, size_t size, si
|
||||
size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return ret;
|
||||
diff --git a/Zend/zend_strtod.c b/Zend/zend_strtod.c
|
||||
index 3aa99f8d..01c1779d 100644
|
||||
--- a/Zend/zend_strtod.c
|
||||
+++ b/Zend/zend_strtod.c
|
||||
@@ -600,7 +600,7 @@ Balloc
|
||||
rv = (Bigint *)MALLOC(sizeof(Bigint) + (x-1)*sizeof(ULong));
|
||||
if (!rv) {
|
||||
FREE_DTOA_LOCK(0);
|
||||
- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
|
||||
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
|
||||
}
|
||||
#else
|
||||
len = (sizeof(Bigint) + (x-1)*sizeof(ULong) + sizeof(double) - 1)
|
||||
@@ -613,7 +613,7 @@ Balloc
|
||||
rv = (Bigint*)MALLOC(len*sizeof(double));
|
||||
if (!rv) {
|
||||
FREE_DTOA_LOCK(0);
|
||||
- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
|
||||
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
|
||||
}
|
||||
#endif
|
||||
rv->k = k;
|
||||
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
|
||||
index 27edd6fc..47531760 100644
|
||||
--- a/Zend/zend_vm_def.h
|
||||
+++ b/Zend/zend_vm_def.h
|
||||
@@ -316,11 +316,17 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
|
||||
index af3c1815..287a30e5 100644
|
||||
--- a/Zend/zend_vm_execute.h
|
||||
+++ b/Zend/zend_vm_execute.h
|
||||
@@ -4428,11 +4428,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_CONST_HANDLE
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -8513,11 +8519,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_CV_HANDLER(Z
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -10525,11 +10537,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_TMPVAR_HANDL
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -36525,11 +36543,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CONST_HANDLER(Z
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -43623,11 +43647,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -47732,11 +47762,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_TMPVAR_HANDLER(
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -52089,11 +52125,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CONST_HANDL
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -54663,11 +54705,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CV_HANDLER(
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -55947,11 +55995,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_TMPVAR_HAND
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
diff --git a/ext/session/session.c b/ext/session/session.c
|
||||
index d3226ee1..ec3c85b3 100644
|
||||
--- a/ext/session/session.c
|
||||
+++ b/ext/session/session.c
|
||||
@@ -2851,7 +2851,7 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
|
||||
if (php_session_rfc1867_orig_callback) {
|
||||
retval = php_session_rfc1867_orig_callback(event, event_data, extra);
|
||||
}
|
||||
- if (!PS(rfc1867_enabled)) {
|
||||
+ if (!PS(rfc1867_enabled) || 1) {
|
||||
return retval;
|
||||
}
|
||||
|
||||
diff --git a/main/SAPI.c b/main/SAPI.c
|
||||
index 8176561a..63ef3617 100644
|
||||
--- a/main/SAPI.c
|
||||
+++ b/main/SAPI.c
|
||||
@@ -515,18 +515,23 @@ SAPI_API void sapi_deactivate(void)
|
||||
}
|
||||
if (SG(request_info).auth_user) {
|
||||
efree(SG(request_info).auth_user);
|
||||
+ SG(request_info).auth_user = NULL;
|
||||
}
|
||||
if (SG(request_info).auth_password) {
|
||||
efree(SG(request_info).auth_password);
|
||||
+ SG(request_info).auth_password = NULL;
|
||||
}
|
||||
if (SG(request_info).auth_digest) {
|
||||
efree(SG(request_info).auth_digest);
|
||||
+ SG(request_info).auth_digest = NULL;
|
||||
}
|
||||
if (SG(request_info).content_type_dup) {
|
||||
efree(SG(request_info).content_type_dup);
|
||||
+ SG(request_info).content_type_dup = NULL;
|
||||
}
|
||||
if (SG(request_info).current_user) {
|
||||
efree(SG(request_info).current_user);
|
||||
+ SG(request_info).current_user = NULL;
|
||||
}
|
||||
if (sapi_module.deactivate) {
|
||||
sapi_module.deactivate();
|
||||
diff --git a/main/main.c b/main/main.c
|
||||
index 037a2202..3fa2de32 100644
|
||||
--- a/main/main.c
|
||||
+++ b/main/main.c
|
||||
@@ -1892,6 +1892,8 @@ void php_request_shutdown(void *dummy)
|
||||
|
||||
for (i=0; i<NUM_TRACK_VARS; i++) {
|
||||
zval_ptr_dtor(&PG(http_globals)[i]);
|
||||
+ /* May be accessed before php_request_startup() */
|
||||
+ ZVAL_UNDEF(&PG(http_globals)[i]);
|
||||
}
|
||||
} zend_end_try();
|
||||
|
||||
@@ -1945,6 +1947,9 @@ void php_request_shutdown(void *dummy)
|
||||
#ifdef HAVE_DTRACE
|
||||
DTRACE_REQUEST_SHUTDOWN(SAFE_FILENAME(SG(request_info).path_translated), SAFE_FILENAME(SG(request_info).request_uri), (char *)SAFE_FILENAME(SG(request_info).request_method));
|
||||
#endif /* HAVE_DTRACE */
|
||||
+
|
||||
+ /* May be accessed before php_request_startup() */
|
||||
+ PG(modules_activated) = 0;
|
||||
}
|
||||
/* }}} */
|
||||
|
||||
diff --git a/main/php_variables.c b/main/php_variables.c
|
||||
index e8fcaa08..31c4089b 100644
|
||||
--- a/main/php_variables.c
|
||||
+++ b/main/php_variables.c
|
||||
@@ -207,7 +207,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
}
|
||||
|
||||
if (!index) {
|
||||
- array_init(&gpc_element);
|
||||
+ array_init_singleton(&gpc_element);
|
||||
if ((gpc_element_p = zend_hash_next_index_insert(symtable1, &gpc_element)) == NULL) {
|
||||
zval_ptr_dtor(&gpc_element);
|
||||
zval_dtor(val);
|
||||
@@ -224,7 +224,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
gpc_element_p = zend_symtable_str_find(symtable1, index, index_len);
|
||||
if (!gpc_element_p) {
|
||||
zval tmp;
|
||||
- array_init(&tmp);
|
||||
+ array_init_singleton(&tmp);
|
||||
gpc_element_p = zend_symtable_str_update_ind(symtable1, index, index_len, &tmp);
|
||||
} else {
|
||||
if (Z_TYPE_P(gpc_element_p) == IS_INDIRECT) {
|
||||
@@ -232,7 +232,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
}
|
||||
if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) {
|
||||
zval_ptr_dtor(gpc_element_p);
|
||||
- array_init(gpc_element_p);
|
||||
+ array_init_singleton(gpc_element_p);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -425,7 +425,7 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
|
||||
case PARSE_POST:
|
||||
case PARSE_GET:
|
||||
case PARSE_COOKIE:
|
||||
- array_init(&array);
|
||||
+ array_init_singleton(&array);
|
||||
switch (arg) {
|
||||
case PARSE_POST:
|
||||
zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_POST]);
|
||||
diff --git a/main/rfc1867.c b/main/rfc1867.c
|
||||
index cac8af84..b219c9f2 100644
|
||||
--- a/main/rfc1867.c
|
||||
+++ b/main/rfc1867.c
|
||||
@@ -407,6 +407,14 @@ static int find_boundary(multipart_buffer *self, char *boundary)
|
||||
return 0;
|
||||
}
|
||||
|
||||
+static zend_bool php_mime_should_save_hdr(const char *name)
|
||||
+{
|
||||
+ return !strcasecmp(name, "Content-Disposition")
|
||||
+ || !strcasecmp(name, "Content-Type");
|
||||
+}
|
||||
+
|
||||
+static char *php_mime_get_hdr_value(zend_llist header, char *key);
|
||||
+
|
||||
/* parse headers */
|
||||
static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
|
||||
{
|
||||
@@ -447,10 +455,15 @@ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
|
||||
}
|
||||
|
||||
*value = '\0';
|
||||
- do { value++; } while (isspace(*value));
|
||||
-
|
||||
- key = estrdup(line);
|
||||
- smart_string_appends(&buf_value, value);
|
||||
+ /* Keep only headers we use, and ignore duplicates */
|
||||
+ if (!php_mime_should_save_hdr(line)
|
||||
+ || php_mime_get_hdr_value(*header, line)) {
|
||||
+ key = NULL;
|
||||
+ } else {
|
||||
+ key = estrdup(line);
|
||||
+ do { value++; } while (isspace(*value));
|
||||
+ smart_string_appends(&buf_value, value);
|
||||
+ }
|
||||
} else if (buf_value.c) { /* If no ':' on the line, add to previous line */
|
||||
smart_string_appends(&buf_value, line);
|
||||
} else {
|
||||
@@ -524,11 +537,11 @@ static char *php_ap_getword(const zend_encoding *encoding, char **line, char sto
|
||||
return res;
|
||||
}
|
||||
|
||||
-static char *substring_conf(char *start, int len, char quote)
|
||||
+static char *substring_conf(char *start, size_t len, char quote)
|
||||
{
|
||||
char *result = emalloc(len + 1);
|
||||
char *resp = result;
|
||||
- int i;
|
||||
+ size_t i;
|
||||
|
||||
for (i = 0; i < len && start[i] != quote; ++i) {
|
||||
if (start[i] == '\\' && (start[i + 1] == '\\' || (quote && start[i + 1] == quote))) {
|
||||
@@ -556,14 +569,14 @@ static char *php_ap_getword_conf(const zend_encoding *encoding, char *str)
|
||||
char quote = *str;
|
||||
|
||||
str++;
|
||||
- return substring_conf(str, (int)strlen(str), quote);
|
||||
+ return substring_conf(str, strlen(str), quote);
|
||||
} else {
|
||||
char *strend = str;
|
||||
|
||||
while (*strend && !isspace(*strend)) {
|
||||
++strend;
|
||||
}
|
||||
- return substring_conf(str, strend - str, 0);
|
||||
+ return substring_conf(str, (size_t)(strend - str), 0);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
# https://salsa.debian.org/php-team/php/-/tree/7a33180834a6169b933132f697b9286bc2bc3c3f/debian/patches (Sury 7.1.33-80)
|
||||
0167-backport-ZSTR_MAX_LEN.patch
|
||||
0186-Avoid-state-corruption-via-bailout.patch
|
||||
@@ -1,23 +0,0 @@
|
||||
From: Remi Collet <remi@remirepo.net>
|
||||
Date: Fri, 22 Nov 2024 15:24:16 +0100
|
||||
Subject: backport ZSTR_MAX_LEN
|
||||
|
||||
(cherry picked from commit 37056ad634d9c44bac0d6c8e730eafaec1344840)
|
||||
---
|
||||
Zend/zend_string.h | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/Zend/zend_string.h b/Zend/zend_string.h
|
||||
index 784b88e..5f7a9ea 100644
|
||||
--- a/Zend/zend_string.h
|
||||
+++ b/Zend/zend_string.h
|
||||
@@ -74,6 +74,9 @@ END_EXTERN_C()
|
||||
|
||||
#define _ZSTR_STRUCT_SIZE(len) (_ZSTR_HEADER_SIZE + len + 1)
|
||||
|
||||
+#define ZSTR_MAX_OVERHEAD (ZEND_MM_ALIGNED_SIZE(_ZSTR_HEADER_SIZE + 1))
|
||||
+#define ZSTR_MAX_LEN (SIZE_MAX - ZSTR_MAX_OVERHEAD)
|
||||
+
|
||||
#define ZSTR_ALLOCA_ALLOC(str, _len, use_heap) do { \
|
||||
(str) = (zend_string *)do_alloca(ZEND_MM_ALIGNED_SIZE_EX(_ZSTR_STRUCT_SIZE(_len), 8), (use_heap)); \
|
||||
GC_REFCOUNT(str) = 1; \
|
||||
@@ -1,893 +0,0 @@
|
||||
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
|
||||
Date: Sun, 18 Oct 2026 20:09:54 +0200
|
||||
Subject: Avoid state corruption via bailout
|
||||
|
||||
Minimal mitigation for EOL version.
|
||||
|
||||
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
|
||||
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
|
||||
|
||||
Backported from the PHP 7.4 version:
|
||||
- shutdown_executor() frees the object store before the error handlers,
|
||||
so the fast shutdown resets are done just before
|
||||
zend_objects_store_free_object_storage().
|
||||
- "|| 1" instead of "|| true" in the session upload progress callback
|
||||
(no stdbool.h).
|
||||
- The max_multipart_body_parts hunk of the 7.4 patch is left out, the
|
||||
code is already there.
|
||||
- array_init_singleton() is implemented in zend_API.c, there is no
|
||||
zend_new_array(); HT_HASH_RESET() uses memset(), so the SSE2 change is
|
||||
not needed.
|
||||
|
||||
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
|
||||
---
|
||||
Zend/zend_API.c | 8 +++
|
||||
Zend/zend_API.h | 2 +
|
||||
Zend/zend_alloc.c | 68 +++++++++++++++++--------
|
||||
Zend/zend_alloc.h | 2 +
|
||||
Zend/zend_execute_API.c | 15 ++++++
|
||||
Zend/zend_hash.c | 6 +--
|
||||
Zend/zend_llist.c | 2 +
|
||||
Zend/zend_multiply.h | 4 +-
|
||||
Zend/zend_strtod.c | 4 +-
|
||||
Zend/zend_vm_def.h | 12 +++++
|
||||
Zend/zend_vm_execute.h | 108 ++++++++++++++++++++++++++++++++++++++++
|
||||
ext/session/session.c | 2 +-
|
||||
main/SAPI.c | 5 ++
|
||||
main/main.c | 5 ++
|
||||
main/php_variables.c | 8 +--
|
||||
main/rfc1867.c | 29 ++++++++---
|
||||
16 files changed, 240 insertions(+), 40 deletions(-)
|
||||
|
||||
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
|
||||
index 604450e9..738266cf 100644
|
||||
--- a/Zend/zend_API.c
|
||||
+++ b/Zend/zend_API.c
|
||||
@@ -1093,6 +1093,14 @@ ZEND_API int _array_init(zval *arg, uint32_t size ZEND_FILE_LINE_DC) /* {{{ */
|
||||
}
|
||||
/* }}} */
|
||||
|
||||
+ZEND_API int _array_init_singleton(zval *arg ZEND_FILE_LINE_DC) /* {{{ */
|
||||
+{
|
||||
+ _array_init(arg, 0 ZEND_FILE_LINE_RELAY_CC);
|
||||
+ Z_ARRVAL_P(arg)->nTableSize = 1;
|
||||
+ return SUCCESS;
|
||||
+}
|
||||
+/* }}} */
|
||||
+
|
||||
/* This function should be called after the constructor has been called
|
||||
* because it may call __set from the uninitialized object otherwise. */
|
||||
ZEND_API void zend_merge_properties(zval *obj, HashTable *properties) /* {{{ */
|
||||
diff --git a/Zend/zend_API.h b/Zend/zend_API.h
|
||||
index 38407703..763c64ab 100644
|
||||
--- a/Zend/zend_API.h
|
||||
+++ b/Zend/zend_API.h
|
||||
@@ -392,10 +392,12 @@ ZEND_API char *zend_get_type_by_const(int type);
|
||||
|
||||
#define array_init(arg) _array_init((arg), 0 ZEND_FILE_LINE_CC)
|
||||
#define array_init_size(arg, size) _array_init((arg), (size) ZEND_FILE_LINE_CC)
|
||||
+#define array_init_singleton(arg) _array_init_singleton((arg) ZEND_FILE_LINE_CC)
|
||||
#define object_init(arg) _object_init((arg) ZEND_FILE_LINE_CC)
|
||||
#define object_init_ex(arg, ce) _object_init_ex((arg), (ce) ZEND_FILE_LINE_CC)
|
||||
#define object_and_properties_init(arg, ce, properties) _object_and_properties_init((arg), (ce), (properties) ZEND_FILE_LINE_CC)
|
||||
ZEND_API int _array_init(zval *arg, uint32_t size ZEND_FILE_LINE_DC);
|
||||
+ZEND_API int _array_init_singleton(zval *arg ZEND_FILE_LINE_DC);
|
||||
ZEND_API int _object_init(zval *arg ZEND_FILE_LINE_DC);
|
||||
ZEND_API int _object_init_ex(zval *arg, zend_class_entry *ce ZEND_FILE_LINE_DC);
|
||||
ZEND_API int _object_and_properties_init(zval *arg, zend_class_entry *ce, HashTable *properties ZEND_FILE_LINE_DC);
|
||||
diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
|
||||
index f4a61795..4b914251 100644
|
||||
--- a/Zend/zend_alloc.c
|
||||
+++ b/Zend/zend_alloc.c
|
||||
@@ -59,6 +59,7 @@
|
||||
#include "zend_operators.h"
|
||||
#include "zend_multiply.h"
|
||||
#include "zend_bitset.h"
|
||||
+#include "zend_execute.h"
|
||||
|
||||
#ifdef HAVE_SIGNAL_H
|
||||
# include <signal.h>
|
||||
@@ -360,7 +361,42 @@ static ZEND_COLD ZEND_NORETURN void zend_mm_panic(const char *message)
|
||||
#if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID)
|
||||
kill(getpid(), SIGSEGV);
|
||||
#endif
|
||||
- exit(1);
|
||||
+ _exit(1);
|
||||
+}
|
||||
+
|
||||
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...)
|
||||
+{
|
||||
+ zend_string *script_filename = NULL;
|
||||
+ uint32_t script_lineno = 0;
|
||||
+
|
||||
+ if (zend_is_executing()) {
|
||||
+ script_filename = zend_get_executed_filename_ex();
|
||||
+ script_lineno = zend_get_executed_lineno();
|
||||
+ } else if (zend_is_compiling()) {
|
||||
+ script_filename = zend_get_compiled_filename();
|
||||
+ script_lineno = zend_get_compiled_lineno();
|
||||
+ }
|
||||
+
|
||||
+ va_list args;
|
||||
+ va_start(args, format);
|
||||
+
|
||||
+ char buf[1024];
|
||||
+ vsnprintf(buf, sizeof(buf), format, args);
|
||||
+
|
||||
+ va_end(args);
|
||||
+
|
||||
+ fprintf(stderr,
|
||||
+ "\nFatal error: %s in %s on line %d\n",
|
||||
+ buf,
|
||||
+ script_filename ? ZSTR_VAL(script_filename) : "Unknown",
|
||||
+ script_lineno);
|
||||
+
|
||||
+ /* See http://support.microsoft.com/kb/190351 */
|
||||
+# ifdef ZEND_WIN32
|
||||
+ fflush(stderr);
|
||||
+# endif
|
||||
+
|
||||
+ _exit(1);
|
||||
}
|
||||
|
||||
static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
|
||||
@@ -372,22 +408,14 @@ static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
|
||||
#endif
|
||||
size_t size)
|
||||
{
|
||||
+ (void) heap;
|
||||
|
||||
- heap->overflow = 1;
|
||||
- zend_try {
|
||||
- zend_error_noreturn(E_ERROR,
|
||||
- format,
|
||||
- limit,
|
||||
+ zend_mm_safe_error_ex(format, limit,
|
||||
#if ZEND_DEBUG
|
||||
- filename,
|
||||
- lineno,
|
||||
+ filename,
|
||||
+ lineno,
|
||||
#endif
|
||||
- size);
|
||||
- } zend_catch {
|
||||
- } zend_end_try();
|
||||
- heap->overflow = 0;
|
||||
- zend_bailout();
|
||||
- exit(1);
|
||||
+ size);
|
||||
}
|
||||
|
||||
#ifdef _WIN32
|
||||
@@ -1338,7 +1366,7 @@ static zend_always_inline void *zend_mm_alloc_heap(zend_mm_heap *heap, size_t si
|
||||
size = MAX(size, 1);
|
||||
size = ZEND_MM_ALIGNED_SIZE(size) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info));
|
||||
if (UNEXPECTED(size < real_size)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
|
||||
return NULL;
|
||||
}
|
||||
#endif
|
||||
@@ -1731,7 +1759,7 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
|
||||
void *ptr;
|
||||
|
||||
if (UNEXPECTED(new_size < size)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
|
||||
}
|
||||
|
||||
#if ZEND_MM_LIMIT
|
||||
@@ -2527,7 +2555,7 @@ ZEND_API char* ZEND_FASTCALL _estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_
|
||||
|
||||
length = strlen(s);
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
|
||||
memcpy(p, s, length+1);
|
||||
@@ -2539,7 +2567,7 @@ ZEND_API char* ZEND_FASTCALL _estrndup(const char *s, size_t length ZEND_FILE_LI
|
||||
char *p;
|
||||
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
|
||||
memcpy(p, s, length);
|
||||
@@ -2553,7 +2581,7 @@ ZEND_API char* ZEND_FASTCALL zend_strndup(const char *s, size_t length)
|
||||
char *p;
|
||||
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) malloc(length + 1);
|
||||
if (UNEXPECTED(p == NULL)) {
|
||||
@@ -2827,7 +2855,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
|
||||
static ZEND_COLD ZEND_NORETURN void zend_out_of_memory(void)
|
||||
{
|
||||
fprintf(stderr, "Out of memory\n");
|
||||
- exit(1);
|
||||
+ _exit(1);
|
||||
}
|
||||
|
||||
ZEND_API void * __zend_malloc(size_t len)
|
||||
diff --git a/Zend/zend_alloc.h b/Zend/zend_alloc.h
|
||||
index e3ab221e..334004c5 100644
|
||||
--- a/Zend/zend_alloc.h
|
||||
+++ b/Zend/zend_alloc.h
|
||||
@@ -399,6 +399,8 @@ static void apc_init_heap(void)
|
||||
|
||||
*/
|
||||
|
||||
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...);
|
||||
+
|
||||
END_EXTERN_C()
|
||||
|
||||
#endif
|
||||
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
|
||||
index 9f10843b..99d4ffa6 100644
|
||||
--- a/Zend/zend_execute_API.c
|
||||
+++ b/Zend/zend_execute_API.c
|
||||
@@ -263,8 +263,21 @@ void shutdown_executor(void) /* {{{ */
|
||||
zend_close_rsrc_list(&EG(regular_list));
|
||||
} zend_end_try();
|
||||
|
||||
+ if (fast_shutdown) {
|
||||
+ /* may be used by zend_error before init_executor */
|
||||
+ ZVAL_UNDEF(&EG(user_error_handler));
|
||||
+ ZVAL_UNDEF(&EG(user_exception_handler));
|
||||
+ memset(&EG(user_error_handlers_error_reporting), 0, sizeof(EG(user_error_handlers_error_reporting)));
|
||||
+ memset(&EG(user_error_handlers), 0, sizeof(EG(user_error_handlers)));
|
||||
+ memset(&EG(user_exception_handlers), 0, sizeof(EG(user_exception_handlers)));
|
||||
+ }
|
||||
+
|
||||
zend_objects_store_free_object_storage(&EG(objects_store), fast_shutdown);
|
||||
|
||||
+ /* may be used by zend_error before init_executor */
|
||||
+ EG(error_handling) = EH_NORMAL;
|
||||
+ EG(exception) = NULL;
|
||||
+
|
||||
/* All resources and objects are destroyed. */
|
||||
/* No PHP callback functions may be called after this point. */
|
||||
EG(active) = 0;
|
||||
@@ -299,6 +312,8 @@ void shutdown_executor(void) /* {{{ */
|
||||
} ZEND_HASH_FOREACH_END_DEL();
|
||||
|
||||
zend_cleanup_internal_classes();
|
||||
+ EG(objects_store).object_buckets = NULL;
|
||||
+ EG(objects_store).top = 1;
|
||||
} else {
|
||||
zend_hash_graceful_reverse_destroy(&EG(symbol_table));
|
||||
|
||||
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
|
||||
index f5fba679..d6c022a2 100644
|
||||
--- a/Zend/zend_hash.c
|
||||
+++ b/Zend/zend_hash.c
|
||||
@@ -103,7 +103,7 @@ static zend_always_inline uint32_t zend_hash_check_size(uint32_t nSize)
|
||||
if (nSize < HT_MIN_SIZE) {
|
||||
nSize = HT_MIN_SIZE;
|
||||
} else if (UNEXPECTED(nSize >= HT_MAX_SIZE)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
|
||||
}
|
||||
|
||||
#if defined(ZEND_WIN32)
|
||||
@@ -189,7 +189,7 @@ static void ZEND_FASTCALL zend_hash_packed_grow(HashTable *ht)
|
||||
{
|
||||
HT_ASSERT_RC1(ht);
|
||||
if (ht->nTableSize >= HT_MAX_SIZE) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
|
||||
}
|
||||
ht->nTableSize += ht->nTableSize;
|
||||
HT_SET_DATA_ADDR(ht, perealloc2(HT_GET_DATA_ADDR(ht), HT_SIZE(ht), HT_USED_SIZE(ht), ht->u.flags & HASH_FLAG_PERSISTENT));
|
||||
@@ -865,7 +865,7 @@ static void ZEND_FASTCALL zend_hash_do_resize(HashTable *ht)
|
||||
pefree(old_data, ht->u.flags & HASH_FLAG_PERSISTENT);
|
||||
zend_hash_rehash(ht);
|
||||
} else {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/Zend/zend_llist.c b/Zend/zend_llist.c
|
||||
index de93f295..4b0509cb 100644
|
||||
--- a/Zend/zend_llist.c
|
||||
+++ b/Zend/zend_llist.c
|
||||
@@ -114,6 +114,8 @@ ZEND_API void zend_llist_destroy(zend_llist *l)
|
||||
current = next;
|
||||
}
|
||||
|
||||
+ l->head = NULL;
|
||||
+ l->tail = NULL;
|
||||
l->count = 0;
|
||||
}
|
||||
|
||||
diff --git a/Zend/zend_multiply.h b/Zend/zend_multiply.h
|
||||
index 26853a3c..386f9353 100644
|
||||
--- a/Zend/zend_multiply.h
|
||||
+++ b/Zend/zend_multiply.h
|
||||
@@ -309,7 +309,7 @@ static zend_always_inline size_t zend_safe_address_guarded(size_t nmemb, size_t
|
||||
size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return ret;
|
||||
@@ -322,7 +322,7 @@ static zend_always_inline size_t zend_safe_addmult(size_t nmemb, size_t size, si
|
||||
size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return ret;
|
||||
diff --git a/Zend/zend_strtod.c b/Zend/zend_strtod.c
|
||||
index 3aa99f8d..01c1779d 100644
|
||||
--- a/Zend/zend_strtod.c
|
||||
+++ b/Zend/zend_strtod.c
|
||||
@@ -600,7 +600,7 @@ Balloc
|
||||
rv = (Bigint *)MALLOC(sizeof(Bigint) + (x-1)*sizeof(ULong));
|
||||
if (!rv) {
|
||||
FREE_DTOA_LOCK(0);
|
||||
- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
|
||||
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
|
||||
}
|
||||
#else
|
||||
len = (sizeof(Bigint) + (x-1)*sizeof(ULong) + sizeof(double) - 1)
|
||||
@@ -613,7 +613,7 @@ Balloc
|
||||
rv = (Bigint*)MALLOC(len*sizeof(double));
|
||||
if (!rv) {
|
||||
FREE_DTOA_LOCK(0);
|
||||
- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
|
||||
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
|
||||
}
|
||||
#endif
|
||||
rv->k = k;
|
||||
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
|
||||
index ed84d17b..ebdb2fdc 100644
|
||||
--- a/Zend/zend_vm_def.h
|
||||
+++ b/Zend/zend_vm_def.h
|
||||
@@ -316,11 +316,17 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -2716,11 +2722,17 @@ ZEND_VM_HANDLER(53, ZEND_FAST_CONCAT, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
|
||||
index 3f975dec..b0170aff 100644
|
||||
--- a/Zend/zend_vm_execute.h
|
||||
+++ b/Zend/zend_vm_execute.h
|
||||
@@ -4406,11 +4406,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_CONST_HANDLE
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -5202,11 +5208,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_CONST_H
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -8524,11 +8536,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_CV_HANDLER(Z
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -9253,11 +9271,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_CV_HAND
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -10580,11 +10604,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_TMPVAR_HANDL
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -11275,11 +11305,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_TMPVAR_
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -35136,11 +35172,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CONST_HANDLER(Z
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -37690,11 +37732,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CONST_HAND
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -41657,11 +41705,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -44200,11 +44254,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CV_HANDLER
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -45369,11 +45429,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_TMPVAR_HANDLER(
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -47770,11 +47836,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_TMPVAR_HAN
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -49343,11 +49415,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CONST_HANDL
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -49957,11 +50035,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CONST_
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -51749,11 +51833,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CV_HANDLER(
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -52294,11 +52384,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CV_HAN
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -53079,11 +53175,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_TMPVAR_HAND
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -53625,11 +53727,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_TMPVAR
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
break;
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
diff --git a/ext/session/session.c b/ext/session/session.c
|
||||
index 0f0d9bcb..8be81f6d 100644
|
||||
--- a/ext/session/session.c
|
||||
+++ b/ext/session/session.c
|
||||
@@ -3071,7 +3071,7 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
|
||||
if (php_session_rfc1867_orig_callback) {
|
||||
retval = php_session_rfc1867_orig_callback(event, event_data, extra);
|
||||
}
|
||||
- if (!PS(rfc1867_enabled)) {
|
||||
+ if (!PS(rfc1867_enabled) || 1) {
|
||||
return retval;
|
||||
}
|
||||
|
||||
diff --git a/main/SAPI.c b/main/SAPI.c
|
||||
index 01383357..17afa0e0 100644
|
||||
--- a/main/SAPI.c
|
||||
+++ b/main/SAPI.c
|
||||
@@ -515,18 +515,23 @@ SAPI_API void sapi_deactivate(void)
|
||||
}
|
||||
if (SG(request_info).auth_user) {
|
||||
efree(SG(request_info).auth_user);
|
||||
+ SG(request_info).auth_user = NULL;
|
||||
}
|
||||
if (SG(request_info).auth_password) {
|
||||
efree(SG(request_info).auth_password);
|
||||
+ SG(request_info).auth_password = NULL;
|
||||
}
|
||||
if (SG(request_info).auth_digest) {
|
||||
efree(SG(request_info).auth_digest);
|
||||
+ SG(request_info).auth_digest = NULL;
|
||||
}
|
||||
if (SG(request_info).content_type_dup) {
|
||||
efree(SG(request_info).content_type_dup);
|
||||
+ SG(request_info).content_type_dup = NULL;
|
||||
}
|
||||
if (SG(request_info).current_user) {
|
||||
efree(SG(request_info).current_user);
|
||||
+ SG(request_info).current_user = NULL;
|
||||
}
|
||||
if (sapi_module.deactivate) {
|
||||
sapi_module.deactivate();
|
||||
diff --git a/main/main.c b/main/main.c
|
||||
index 0cfdb913..92c19e46 100644
|
||||
--- a/main/main.c
|
||||
+++ b/main/main.c
|
||||
@@ -1895,6 +1895,8 @@ void php_request_shutdown(void *dummy)
|
||||
|
||||
for (i=0; i<NUM_TRACK_VARS; i++) {
|
||||
zval_ptr_dtor(&PG(http_globals)[i]);
|
||||
+ /* May be accessed before php_request_startup() */
|
||||
+ ZVAL_UNDEF(&PG(http_globals)[i]);
|
||||
}
|
||||
} zend_end_try();
|
||||
|
||||
@@ -1948,6 +1950,9 @@ void php_request_shutdown(void *dummy)
|
||||
#ifdef HAVE_DTRACE
|
||||
DTRACE_REQUEST_SHUTDOWN(SAFE_FILENAME(SG(request_info).path_translated), SAFE_FILENAME(SG(request_info).request_uri), (char *)SAFE_FILENAME(SG(request_info).request_method));
|
||||
#endif /* HAVE_DTRACE */
|
||||
+
|
||||
+ /* May be accessed before php_request_startup() */
|
||||
+ PG(modules_activated) = 0;
|
||||
}
|
||||
/* }}} */
|
||||
|
||||
diff --git a/main/php_variables.c b/main/php_variables.c
|
||||
index 3e0e8d76..a5a9af19 100644
|
||||
--- a/main/php_variables.c
|
||||
+++ b/main/php_variables.c
|
||||
@@ -213,7 +213,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
}
|
||||
|
||||
if (!index) {
|
||||
- array_init(&gpc_element);
|
||||
+ array_init_singleton(&gpc_element);
|
||||
if ((gpc_element_p = zend_hash_next_index_insert(symtable1, &gpc_element)) == NULL) {
|
||||
zval_ptr_dtor(&gpc_element);
|
||||
zval_dtor(val);
|
||||
@@ -230,7 +230,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
gpc_element_p = zend_symtable_str_find(symtable1, index, index_len);
|
||||
if (!gpc_element_p) {
|
||||
zval tmp;
|
||||
- array_init(&tmp);
|
||||
+ array_init_singleton(&tmp);
|
||||
gpc_element_p = zend_symtable_str_update_ind(symtable1, index, index_len, &tmp);
|
||||
} else {
|
||||
if (Z_TYPE_P(gpc_element_p) == IS_INDIRECT) {
|
||||
@@ -238,7 +238,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
}
|
||||
if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) {
|
||||
zval_ptr_dtor(gpc_element_p);
|
||||
- array_init(gpc_element_p);
|
||||
+ array_init_singleton(gpc_element_p);
|
||||
} else {
|
||||
SEPARATE_ARRAY(gpc_element_p);
|
||||
}
|
||||
@@ -433,7 +433,7 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
|
||||
case PARSE_POST:
|
||||
case PARSE_GET:
|
||||
case PARSE_COOKIE:
|
||||
- array_init(&array);
|
||||
+ array_init_singleton(&array);
|
||||
switch (arg) {
|
||||
case PARSE_POST:
|
||||
zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_POST]);
|
||||
diff --git a/main/rfc1867.c b/main/rfc1867.c
|
||||
index 43b94c05..b7d1ed2a 100644
|
||||
--- a/main/rfc1867.c
|
||||
+++ b/main/rfc1867.c
|
||||
@@ -407,6 +407,14 @@ static int find_boundary(multipart_buffer *self, char *boundary)
|
||||
return 0;
|
||||
}
|
||||
|
||||
+static zend_bool php_mime_should_save_hdr(const char *name)
|
||||
+{
|
||||
+ return !strcasecmp(name, "Content-Disposition")
|
||||
+ || !strcasecmp(name, "Content-Type");
|
||||
+}
|
||||
+
|
||||
+static char *php_mime_get_hdr_value(zend_llist header, char *key);
|
||||
+
|
||||
/* parse headers */
|
||||
static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
|
||||
{
|
||||
@@ -447,10 +455,15 @@ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
|
||||
}
|
||||
|
||||
*value = '\0';
|
||||
- do { value++; } while (isspace(*value));
|
||||
-
|
||||
- key = estrdup(line);
|
||||
- smart_string_appends(&buf_value, value);
|
||||
+ /* Keep only headers we use, and ignore duplicates */
|
||||
+ if (!php_mime_should_save_hdr(line)
|
||||
+ || php_mime_get_hdr_value(*header, line)) {
|
||||
+ key = NULL;
|
||||
+ } else {
|
||||
+ key = estrdup(line);
|
||||
+ do { value++; } while (isspace(*value));
|
||||
+ smart_string_appends(&buf_value, value);
|
||||
+ }
|
||||
} else if (buf_value.c) { /* If no ':' on the line, add to previous line */
|
||||
smart_string_appends(&buf_value, line);
|
||||
} else {
|
||||
@@ -524,11 +537,11 @@ static char *php_ap_getword(const zend_encoding *encoding, char **line, char sto
|
||||
return res;
|
||||
}
|
||||
|
||||
-static char *substring_conf(char *start, int len, char quote)
|
||||
+static char *substring_conf(char *start, size_t len, char quote)
|
||||
{
|
||||
char *result = emalloc(len + 1);
|
||||
char *resp = result;
|
||||
- int i;
|
||||
+ size_t i;
|
||||
|
||||
for (i = 0; i < len && start[i] != quote; ++i) {
|
||||
if (start[i] == '\\' && (start[i + 1] == '\\' || (quote && start[i + 1] == quote))) {
|
||||
@@ -556,14 +569,14 @@ static char *php_ap_getword_conf(const zend_encoding *encoding, char *str)
|
||||
char quote = *str;
|
||||
|
||||
str++;
|
||||
- return substring_conf(str, (int)strlen(str), quote);
|
||||
+ return substring_conf(str, strlen(str), quote);
|
||||
} else {
|
||||
char *strend = str;
|
||||
|
||||
while (*strend && !isspace(*strend)) {
|
||||
++strend;
|
||||
}
|
||||
- return substring_conf(str, strend - str, 0);
|
||||
+ return substring_conf(str, (size_t)(strend - str), 0);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
# https://salsa.debian.org/php-team/php/-/tree/e0bcd488d9f8da024d9e1a254113539a846cac6d/debian/patches (Sury 7.2.34-66)
|
||||
0135-backport-ZSTR_MAX_LEN.patch
|
||||
0159-Avoid-state-corruption-via-bailout.patch
|
||||
@@ -1,22 +0,0 @@
|
||||
From: Remi Collet <remi@remirepo.net>
|
||||
Date: Fri, 22 Nov 2024 15:24:16 +0100
|
||||
Subject: backport ZSTR_MAX_LEN
|
||||
|
||||
---
|
||||
Zend/zend_string.h | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/Zend/zend_string.h b/Zend/zend_string.h
|
||||
index 396b63b..8ef979f 100644
|
||||
--- a/Zend/zend_string.h
|
||||
+++ b/Zend/zend_string.h
|
||||
@@ -76,6 +76,9 @@ END_EXTERN_C()
|
||||
|
||||
#define _ZSTR_STRUCT_SIZE(len) (_ZSTR_HEADER_SIZE + len + 1)
|
||||
|
||||
+#define ZSTR_MAX_OVERHEAD (ZEND_MM_ALIGNED_SIZE(_ZSTR_HEADER_SIZE + 1))
|
||||
+#define ZSTR_MAX_LEN (SIZE_MAX - ZSTR_MAX_OVERHEAD)
|
||||
+
|
||||
#define ZSTR_ALLOCA_ALLOC(str, _len, use_heap) do { \
|
||||
(str) = (zend_string *)do_alloca(ZEND_MM_ALIGNED_SIZE_EX(_ZSTR_STRUCT_SIZE(_len), 8), (use_heap)); \
|
||||
GC_SET_REFCOUNT(str, 1); \
|
||||
@@ -1,912 +0,0 @@
|
||||
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
|
||||
Date: Sun, 18 Oct 2026 20:09:54 +0200
|
||||
Subject: Avoid state corruption via bailout
|
||||
|
||||
Minimal mitigation for EOL version.
|
||||
|
||||
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
|
||||
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
|
||||
|
||||
Backported from the PHP 7.4 version:
|
||||
- shutdown_executor() frees the object store before the error handlers,
|
||||
so the fast shutdown resets are done just before
|
||||
zend_objects_store_free_object_storage().
|
||||
- "|| 1" instead of "|| true" in the session upload progress callback
|
||||
(no stdbool.h).
|
||||
- The max_multipart_body_parts hunk of the 7.4 patch is left out, the
|
||||
code is already there.
|
||||
|
||||
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
|
||||
---
|
||||
Zend/zend_API.h | 1 +
|
||||
Zend/zend_alloc.c | 68 +++++++++++++++++++--------
|
||||
Zend/zend_alloc.h | 2 +
|
||||
Zend/zend_execute_API.c | 15 ++++++
|
||||
Zend/zend_hash.c | 13 +++--
|
||||
Zend/zend_hash.h | 1 +
|
||||
Zend/zend_llist.c | 2 +
|
||||
Zend/zend_multiply.h | 4 +-
|
||||
Zend/zend_strtod.c | 4 +-
|
||||
Zend/zend_types.h | 26 +++++-----
|
||||
Zend/zend_vm_def.h | 12 +++++
|
||||
Zend/zend_vm_execute.h | 102 ++++++++++++++++++++++++++++++++++++++++
|
||||
ext/session/session.c | 2 +-
|
||||
main/SAPI.c | 5 ++
|
||||
main/main.c | 5 ++
|
||||
main/php_variables.c | 8 ++--
|
||||
main/rfc1867.c | 29 ++++++++----
|
||||
17 files changed, 248 insertions(+), 51 deletions(-)
|
||||
|
||||
diff --git a/Zend/zend_API.h b/Zend/zend_API.h
|
||||
index 3c134f44..67942e39 100644
|
||||
--- a/Zend/zend_API.h
|
||||
+++ b/Zend/zend_API.h
|
||||
@@ -376,6 +376,7 @@ ZEND_API char *zend_get_type_by_const(int type);
|
||||
|
||||
#define array_init(arg) ZVAL_ARR((arg), zend_new_array(0))
|
||||
#define array_init_size(arg, size) ZVAL_ARR((arg), zend_new_array(size))
|
||||
+#define array_init_singleton(arg) ZVAL_ARR((arg), zend_new_array_singleton())
|
||||
ZEND_API int object_init(zval *arg);
|
||||
ZEND_API int object_init_ex(zval *arg, zend_class_entry *ce);
|
||||
ZEND_API int object_and_properties_init(zval *arg, zend_class_entry *ce, HashTable *properties);
|
||||
diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
|
||||
index 25216898..126aa124 100644
|
||||
--- a/Zend/zend_alloc.c
|
||||
+++ b/Zend/zend_alloc.c
|
||||
@@ -57,6 +57,7 @@
|
||||
#include "zend_operators.h"
|
||||
#include "zend_multiply.h"
|
||||
#include "zend_bitset.h"
|
||||
+#include "zend_execute.h"
|
||||
|
||||
#ifdef HAVE_SIGNAL_H
|
||||
# include <signal.h>
|
||||
@@ -358,7 +359,42 @@ static ZEND_COLD ZEND_NORETURN void zend_mm_panic(const char *message)
|
||||
#if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID)
|
||||
kill(getpid(), SIGSEGV);
|
||||
#endif
|
||||
- exit(1);
|
||||
+ _exit(1);
|
||||
+}
|
||||
+
|
||||
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...)
|
||||
+{
|
||||
+ zend_string *script_filename = NULL;
|
||||
+ uint32_t script_lineno = 0;
|
||||
+
|
||||
+ if (zend_is_executing()) {
|
||||
+ script_filename = zend_get_executed_filename_ex();
|
||||
+ script_lineno = zend_get_executed_lineno();
|
||||
+ } else if (zend_is_compiling()) {
|
||||
+ script_filename = zend_get_compiled_filename();
|
||||
+ script_lineno = zend_get_compiled_lineno();
|
||||
+ }
|
||||
+
|
||||
+ va_list args;
|
||||
+ va_start(args, format);
|
||||
+
|
||||
+ char buf[1024];
|
||||
+ vsnprintf(buf, sizeof(buf), format, args);
|
||||
+
|
||||
+ va_end(args);
|
||||
+
|
||||
+ fprintf(stderr,
|
||||
+ "\nFatal error: %s in %s on line %d\n",
|
||||
+ buf,
|
||||
+ script_filename ? ZSTR_VAL(script_filename) : "Unknown",
|
||||
+ script_lineno);
|
||||
+
|
||||
+ /* See http://support.microsoft.com/kb/190351 */
|
||||
+# ifdef ZEND_WIN32
|
||||
+ fflush(stderr);
|
||||
+# endif
|
||||
+
|
||||
+ _exit(1);
|
||||
}
|
||||
|
||||
static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
|
||||
@@ -370,22 +406,14 @@ static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
|
||||
#endif
|
||||
size_t size)
|
||||
{
|
||||
+ (void) heap;
|
||||
|
||||
- heap->overflow = 1;
|
||||
- zend_try {
|
||||
- zend_error_noreturn(E_ERROR,
|
||||
- format,
|
||||
- limit,
|
||||
+ zend_mm_safe_error_ex(format, limit,
|
||||
#if ZEND_DEBUG
|
||||
- filename,
|
||||
- lineno,
|
||||
+ filename,
|
||||
+ lineno,
|
||||
#endif
|
||||
- size);
|
||||
- } zend_catch {
|
||||
- } zend_end_try();
|
||||
- heap->overflow = 0;
|
||||
- zend_bailout();
|
||||
- exit(1);
|
||||
+ size);
|
||||
}
|
||||
|
||||
#ifdef _WIN32
|
||||
@@ -1352,7 +1380,7 @@ static zend_always_inline void *zend_mm_alloc_heap(zend_mm_heap *heap, size_t si
|
||||
size = MAX(size, 1);
|
||||
size = ZEND_MM_ALIGNED_SIZE(size) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info));
|
||||
if (UNEXPECTED(size < real_size)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
|
||||
return NULL;
|
||||
}
|
||||
#endif
|
||||
@@ -1800,7 +1828,7 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
|
||||
void *ptr;
|
||||
|
||||
if (UNEXPECTED(new_size < size)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
|
||||
}
|
||||
|
||||
#if ZEND_MM_LIMIT
|
||||
@@ -2596,7 +2624,7 @@ ZEND_API char* ZEND_FASTCALL _estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_
|
||||
|
||||
length = strlen(s);
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
|
||||
memcpy(p, s, length+1);
|
||||
@@ -2608,7 +2636,7 @@ ZEND_API char* ZEND_FASTCALL _estrndup(const char *s, size_t length ZEND_FILE_LI
|
||||
char *p;
|
||||
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
|
||||
memcpy(p, s, length);
|
||||
@@ -2622,7 +2650,7 @@ ZEND_API char* ZEND_FASTCALL zend_strndup(const char *s, size_t length)
|
||||
char *p;
|
||||
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) malloc(length + 1);
|
||||
if (UNEXPECTED(p == NULL)) {
|
||||
@@ -2901,7 +2929,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
|
||||
static ZEND_COLD ZEND_NORETURN void zend_out_of_memory(void)
|
||||
{
|
||||
fprintf(stderr, "Out of memory\n");
|
||||
- exit(1);
|
||||
+ _exit(1);
|
||||
}
|
||||
|
||||
ZEND_API void * __zend_malloc(size_t len)
|
||||
diff --git a/Zend/zend_alloc.h b/Zend/zend_alloc.h
|
||||
index b3986ab9..992fa225 100644
|
||||
--- a/Zend/zend_alloc.h
|
||||
+++ b/Zend/zend_alloc.h
|
||||
@@ -397,6 +397,8 @@ static void apc_init_heap(void)
|
||||
|
||||
*/
|
||||
|
||||
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...);
|
||||
+
|
||||
END_EXTERN_C()
|
||||
|
||||
#endif
|
||||
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
|
||||
index 6eb9dfac..65e66fc8 100644
|
||||
--- a/Zend/zend_execute_API.c
|
||||
+++ b/Zend/zend_execute_API.c
|
||||
@@ -265,8 +265,21 @@ void shutdown_executor(void) /* {{{ */
|
||||
zend_close_rsrc_list(&EG(regular_list));
|
||||
} zend_end_try();
|
||||
|
||||
+ if (fast_shutdown) {
|
||||
+ /* may be used by zend_error before init_executor */
|
||||
+ ZVAL_UNDEF(&EG(user_error_handler));
|
||||
+ ZVAL_UNDEF(&EG(user_exception_handler));
|
||||
+ memset(&EG(user_error_handlers_error_reporting), 0, sizeof(EG(user_error_handlers_error_reporting)));
|
||||
+ memset(&EG(user_error_handlers), 0, sizeof(EG(user_error_handlers)));
|
||||
+ memset(&EG(user_exception_handlers), 0, sizeof(EG(user_exception_handlers)));
|
||||
+ }
|
||||
+
|
||||
zend_objects_store_free_object_storage(&EG(objects_store), fast_shutdown);
|
||||
|
||||
+ /* may be used by zend_error before init_executor */
|
||||
+ EG(error_handling) = EH_NORMAL;
|
||||
+ EG(exception) = NULL;
|
||||
+
|
||||
/* All resources and objects are destroyed. */
|
||||
/* No PHP callback functions may be called after this point. */
|
||||
EG(active) = 0;
|
||||
@@ -285,6 +298,8 @@ void shutdown_executor(void) /* {{{ */
|
||||
zend_hash_discard(EG(function_table), EG(persistent_functions_count));
|
||||
zend_hash_discard(EG(class_table), EG(persistent_classes_count));
|
||||
zend_cleanup_internal_classes();
|
||||
+ EG(objects_store).object_buckets = NULL;
|
||||
+ EG(objects_store).top = 1;
|
||||
} else {
|
||||
zend_hash_graceful_reverse_destroy(&EG(symbol_table));
|
||||
|
||||
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
|
||||
index 7ba4f32c..f228f335 100644
|
||||
--- a/Zend/zend_hash.c
|
||||
+++ b/Zend/zend_hash.c
|
||||
@@ -93,7 +93,7 @@ static zend_always_inline uint32_t zend_hash_check_size(uint32_t nSize)
|
||||
if (nSize <= HT_MIN_SIZE) {
|
||||
return HT_MIN_SIZE;
|
||||
} else if (UNEXPECTED(nSize >= HT_MAX_SIZE)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
|
||||
}
|
||||
|
||||
#if defined(ZEND_WIN32)
|
||||
@@ -219,6 +219,13 @@ ZEND_API HashTable* ZEND_FASTCALL _zend_new_array_0(void)
|
||||
return ht;
|
||||
}
|
||||
|
||||
+ZEND_API HashTable* ZEND_FASTCALL zend_new_array_singleton(void)
|
||||
+{
|
||||
+ HashTable *ht = _zend_new_array_0();
|
||||
+ ht->nTableSize = 1;
|
||||
+ return ht;
|
||||
+}
|
||||
+
|
||||
ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t nSize)
|
||||
{
|
||||
HashTable *ht = emalloc(sizeof(HashTable));
|
||||
@@ -230,7 +237,7 @@ static void ZEND_FASTCALL zend_hash_packed_grow(HashTable *ht)
|
||||
{
|
||||
HT_ASSERT_RC1(ht);
|
||||
if (ht->nTableSize >= HT_MAX_SIZE) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
|
||||
}
|
||||
ht->nTableSize += ht->nTableSize;
|
||||
HT_SET_DATA_ADDR(ht, perealloc2(HT_GET_DATA_ADDR(ht), HT_SIZE_EX(ht->nTableSize, HT_MIN_MASK), HT_USED_SIZE(ht), GC_FLAGS(ht) & IS_ARRAY_PERSISTENT));
|
||||
@@ -1041,7 +1048,7 @@ static void ZEND_FASTCALL zend_hash_do_resize(HashTable *ht)
|
||||
pefree(old_data, GC_FLAGS(ht) & IS_ARRAY_PERSISTENT);
|
||||
zend_hash_rehash(ht);
|
||||
} else {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/Zend/zend_hash.h b/Zend/zend_hash.h
|
||||
index 2c295adc..51dc4c5e 100644
|
||||
--- a/Zend/zend_hash.h
|
||||
+++ b/Zend/zend_hash.h
|
||||
@@ -276,6 +276,7 @@ ZEND_API int ZEND_FASTCALL zend_hash_rehash(HashTable *ht);
|
||||
#endif
|
||||
|
||||
ZEND_API HashTable* ZEND_FASTCALL _zend_new_array_0(void);
|
||||
+ZEND_API HashTable* ZEND_FASTCALL zend_new_array_singleton(void);
|
||||
ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t size);
|
||||
ZEND_API uint32_t zend_array_count(HashTable *ht);
|
||||
ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source);
|
||||
diff --git a/Zend/zend_llist.c b/Zend/zend_llist.c
|
||||
index ea5e2cae..f45ddda9 100644
|
||||
--- a/Zend/zend_llist.c
|
||||
+++ b/Zend/zend_llist.c
|
||||
@@ -112,6 +112,8 @@ ZEND_API void zend_llist_destroy(zend_llist *l)
|
||||
current = next;
|
||||
}
|
||||
|
||||
+ l->head = NULL;
|
||||
+ l->tail = NULL;
|
||||
l->count = 0;
|
||||
}
|
||||
|
||||
diff --git a/Zend/zend_multiply.h b/Zend/zend_multiply.h
|
||||
index 1ec1af06..ee2fd8df 100644
|
||||
--- a/Zend/zend_multiply.h
|
||||
+++ b/Zend/zend_multiply.h
|
||||
@@ -321,7 +321,7 @@ static zend_always_inline size_t zend_safe_address_guarded(size_t nmemb, size_t
|
||||
size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return ret;
|
||||
@@ -334,7 +334,7 @@ static zend_always_inline size_t zend_safe_addmult(size_t nmemb, size_t size, si
|
||||
size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return ret;
|
||||
diff --git a/Zend/zend_strtod.c b/Zend/zend_strtod.c
|
||||
index 3aa99f8d..01c1779d 100644
|
||||
--- a/Zend/zend_strtod.c
|
||||
+++ b/Zend/zend_strtod.c
|
||||
@@ -600,7 +600,7 @@ Balloc
|
||||
rv = (Bigint *)MALLOC(sizeof(Bigint) + (x-1)*sizeof(ULong));
|
||||
if (!rv) {
|
||||
FREE_DTOA_LOCK(0);
|
||||
- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
|
||||
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
|
||||
}
|
||||
#else
|
||||
len = (sizeof(Bigint) + (x-1)*sizeof(ULong) + sizeof(double) - 1)
|
||||
@@ -613,7 +613,7 @@ Balloc
|
||||
rv = (Bigint*)MALLOC(len*sizeof(double));
|
||||
if (!rv) {
|
||||
FREE_DTOA_LOCK(0);
|
||||
- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
|
||||
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
|
||||
}
|
||||
#endif
|
||||
rv->k = k;
|
||||
diff --git a/Zend/zend_types.h b/Zend/zend_types.h
|
||||
index 4250aabd..fd7e5d6a 100644
|
||||
--- a/Zend/zend_types.h
|
||||
+++ b/Zend/zend_types.h
|
||||
@@ -317,17 +317,21 @@ struct _zend_array {
|
||||
# define HT_HASH_RESET(ht) do { \
|
||||
char *p = (char*)&HT_HASH(ht, (ht)->nTableMask); \
|
||||
size_t size = HT_HASH_SIZE((ht)->nTableMask); \
|
||||
- __m128i xmm0 = _mm_setzero_si128(); \
|
||||
- xmm0 = _mm_cmpeq_epi8(xmm0, xmm0); \
|
||||
- ZEND_ASSERT(size >= 64 && ((size & 0x3f) == 0)); \
|
||||
- do { \
|
||||
- _mm_storeu_si128((__m128i*)p, xmm0); \
|
||||
- _mm_storeu_si128((__m128i*)(p+16), xmm0); \
|
||||
- _mm_storeu_si128((__m128i*)(p+32), xmm0); \
|
||||
- _mm_storeu_si128((__m128i*)(p+48), xmm0); \
|
||||
- p += 64; \
|
||||
- size -= 64; \
|
||||
- } while (size != 0); \
|
||||
+ if (UNEXPECTED(size < 64)) { \
|
||||
+ memset(p, HT_INVALID_IDX, size); \
|
||||
+ } else { \
|
||||
+ __m128i xmm0 = _mm_setzero_si128(); \
|
||||
+ xmm0 = _mm_cmpeq_epi8(xmm0, xmm0); \
|
||||
+ ZEND_ASSERT(size >= 64 && ((size & 0x3f) == 0)); \
|
||||
+ do { \
|
||||
+ _mm_storeu_si128((__m128i*)p, xmm0); \
|
||||
+ _mm_storeu_si128((__m128i*)(p+16), xmm0); \
|
||||
+ _mm_storeu_si128((__m128i*)(p+32), xmm0); \
|
||||
+ _mm_storeu_si128((__m128i*)(p+48), xmm0); \
|
||||
+ p += 64; \
|
||||
+ size -= 64; \
|
||||
+ } while (size != 0); \
|
||||
+ } \
|
||||
} while (0)
|
||||
#else
|
||||
# define HT_HASH_RESET(ht) \
|
||||
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
|
||||
index 1b4eb572..da46a635 100644
|
||||
--- a/Zend/zend_vm_def.h
|
||||
+++ b/Zend/zend_vm_def.h
|
||||
@@ -320,11 +320,17 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TMPVAR|CV, CONST|TMPVAR|CV, SPEC(NO_CONST_
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
FREE_OP2();
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -2744,11 +2750,17 @@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND_FAST_CONCAT, CONST|TMPVAR|CV, CONST|TMP
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
FREE_OP2();
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
|
||||
index be8b2b3a..ce447cb9 100644
|
||||
--- a/Zend/zend_vm_execute.h
|
||||
+++ b/Zend/zend_vm_execute.h
|
||||
@@ -4968,11 +4968,17 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -6679,11 +6685,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_TMPVAR_HANDL
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
zval_ptr_dtor_nogc(free_op2);
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -7150,11 +7162,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_TMPVAR_
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
zval_ptr_dtor_nogc(free_op2);
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -9774,11 +9792,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_CV_HANDLER(Z
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -10243,11 +10267,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_CV_HAND
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -12967,11 +12997,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CONST_HANDL
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -13732,11 +13768,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CONST_
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -14705,11 +14747,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_TMPVAR_HAND
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
zval_ptr_dtor_nogc(free_op2);
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -15346,11 +15394,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_TMPVAR
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
zval_ptr_dtor_nogc(free_op2);
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -16800,11 +16854,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CV_HANDLER(
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -17227,11 +17287,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CV_HAN
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -38581,11 +38647,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CONST_HANDLER(Z
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -41090,11 +41162,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CONST_HAND
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -42559,11 +42637,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_TMPVAR_HANDLER(
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
zval_ptr_dtor_nogc(free_op2);
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -44857,11 +44941,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_TMPVAR_HAN
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
zval_ptr_dtor_nogc(free_op2);
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -48227,11 +48317,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -50659,11 +50755,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CV_HANDLER
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
diff --git a/ext/session/session.c b/ext/session/session.c
|
||||
index 8fad988d..1c328815 100644
|
||||
--- a/ext/session/session.c
|
||||
+++ b/ext/session/session.c
|
||||
@@ -3160,7 +3160,7 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
|
||||
if (php_session_rfc1867_orig_callback) {
|
||||
retval = php_session_rfc1867_orig_callback(event, event_data, extra);
|
||||
}
|
||||
- if (!PS(rfc1867_enabled)) {
|
||||
+ if (!PS(rfc1867_enabled) || 1) {
|
||||
return retval;
|
||||
}
|
||||
|
||||
diff --git a/main/SAPI.c b/main/SAPI.c
|
||||
index afb0c772..6749184e 100644
|
||||
--- a/main/SAPI.c
|
||||
+++ b/main/SAPI.c
|
||||
@@ -513,18 +513,23 @@ SAPI_API void sapi_deactivate(void)
|
||||
}
|
||||
if (SG(request_info).auth_user) {
|
||||
efree(SG(request_info).auth_user);
|
||||
+ SG(request_info).auth_user = NULL;
|
||||
}
|
||||
if (SG(request_info).auth_password) {
|
||||
efree(SG(request_info).auth_password);
|
||||
+ SG(request_info).auth_password = NULL;
|
||||
}
|
||||
if (SG(request_info).auth_digest) {
|
||||
efree(SG(request_info).auth_digest);
|
||||
+ SG(request_info).auth_digest = NULL;
|
||||
}
|
||||
if (SG(request_info).content_type_dup) {
|
||||
efree(SG(request_info).content_type_dup);
|
||||
+ SG(request_info).content_type_dup = NULL;
|
||||
}
|
||||
if (SG(request_info).current_user) {
|
||||
efree(SG(request_info).current_user);
|
||||
+ SG(request_info).current_user = NULL;
|
||||
}
|
||||
if (sapi_module.deactivate) {
|
||||
sapi_module.deactivate();
|
||||
diff --git a/main/main.c b/main/main.c
|
||||
index c3939b3c..6e38959a 100644
|
||||
--- a/main/main.c
|
||||
+++ b/main/main.c
|
||||
@@ -1919,6 +1919,8 @@ void php_request_shutdown(void *dummy)
|
||||
|
||||
for (i=0; i<NUM_TRACK_VARS; i++) {
|
||||
zval_ptr_dtor(&PG(http_globals)[i]);
|
||||
+ /* May be accessed before php_request_startup() */
|
||||
+ ZVAL_UNDEF(&PG(http_globals)[i]);
|
||||
}
|
||||
} zend_end_try();
|
||||
|
||||
@@ -1972,6 +1974,9 @@ void php_request_shutdown(void *dummy)
|
||||
#ifdef HAVE_DTRACE
|
||||
DTRACE_REQUEST_SHUTDOWN(SAFE_FILENAME(SG(request_info).path_translated), SAFE_FILENAME(SG(request_info).request_uri), (char *)SAFE_FILENAME(SG(request_info).request_method));
|
||||
#endif /* HAVE_DTRACE */
|
||||
+
|
||||
+ /* May be accessed before php_request_startup() */
|
||||
+ PG(modules_activated) = 0;
|
||||
}
|
||||
/* }}} */
|
||||
|
||||
diff --git a/main/php_variables.c b/main/php_variables.c
|
||||
index d0ebd50e..9ebad5c8 100644
|
||||
--- a/main/php_variables.c
|
||||
+++ b/main/php_variables.c
|
||||
@@ -219,7 +219,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
}
|
||||
|
||||
if (!index) {
|
||||
- array_init(&gpc_element);
|
||||
+ array_init_singleton(&gpc_element);
|
||||
if ((gpc_element_p = zend_hash_next_index_insert(symtable1, &gpc_element)) == NULL) {
|
||||
zend_array_destroy(Z_ARR(gpc_element));
|
||||
zval_ptr_dtor_nogc(val);
|
||||
@@ -236,7 +236,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
gpc_element_p = zend_symtable_str_find(symtable1, index, index_len);
|
||||
if (!gpc_element_p) {
|
||||
zval tmp;
|
||||
- array_init(&tmp);
|
||||
+ array_init_singleton(&tmp);
|
||||
gpc_element_p = zend_symtable_str_update_ind(symtable1, index, index_len, &tmp);
|
||||
} else {
|
||||
if (Z_TYPE_P(gpc_element_p) == IS_INDIRECT) {
|
||||
@@ -244,7 +244,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
}
|
||||
if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) {
|
||||
zval_ptr_dtor_nogc(gpc_element_p);
|
||||
- array_init(gpc_element_p);
|
||||
+ array_init_singleton(gpc_element_p);
|
||||
} else {
|
||||
SEPARATE_ARRAY(gpc_element_p);
|
||||
}
|
||||
@@ -442,7 +442,7 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
|
||||
case PARSE_POST:
|
||||
case PARSE_GET:
|
||||
case PARSE_COOKIE:
|
||||
- array_init(&array);
|
||||
+ array_init_singleton(&array);
|
||||
switch (arg) {
|
||||
case PARSE_POST:
|
||||
zval_ptr_dtor_nogc(&PG(http_globals)[TRACK_VARS_POST]);
|
||||
diff --git a/main/rfc1867.c b/main/rfc1867.c
|
||||
index 3415db2f..265ca9e2 100644
|
||||
--- a/main/rfc1867.c
|
||||
+++ b/main/rfc1867.c
|
||||
@@ -405,6 +405,14 @@ static int find_boundary(multipart_buffer *self, char *boundary)
|
||||
return 0;
|
||||
}
|
||||
|
||||
+static zend_bool php_mime_should_save_hdr(const char *name)
|
||||
+{
|
||||
+ return !strcasecmp(name, "Content-Disposition")
|
||||
+ || !strcasecmp(name, "Content-Type");
|
||||
+}
|
||||
+
|
||||
+static char *php_mime_get_hdr_value(zend_llist header, char *key);
|
||||
+
|
||||
/* parse headers */
|
||||
static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
|
||||
{
|
||||
@@ -445,10 +453,15 @@ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
|
||||
}
|
||||
|
||||
*value = '\0';
|
||||
- do { value++; } while (isspace(*value));
|
||||
-
|
||||
- key = estrdup(line);
|
||||
- smart_string_appends(&buf_value, value);
|
||||
+ /* Keep only headers we use, and ignore duplicates */
|
||||
+ if (!php_mime_should_save_hdr(line)
|
||||
+ || php_mime_get_hdr_value(*header, line)) {
|
||||
+ key = NULL;
|
||||
+ } else {
|
||||
+ key = estrdup(line);
|
||||
+ do { value++; } while (isspace(*value));
|
||||
+ smart_string_appends(&buf_value, value);
|
||||
+ }
|
||||
} else if (buf_value.c) { /* If no ':' on the line, add to previous line */
|
||||
smart_string_appends(&buf_value, line);
|
||||
} else {
|
||||
@@ -522,11 +535,11 @@ static char *php_ap_getword(const zend_encoding *encoding, char **line, char sto
|
||||
return res;
|
||||
}
|
||||
|
||||
-static char *substring_conf(char *start, int len, char quote)
|
||||
+static char *substring_conf(char *start, size_t len, char quote)
|
||||
{
|
||||
char *result = emalloc(len + 1);
|
||||
char *resp = result;
|
||||
- int i;
|
||||
+ size_t i;
|
||||
|
||||
for (i = 0; i < len && start[i] != quote; ++i) {
|
||||
if (start[i] == '\\' && (start[i + 1] == '\\' || (quote && start[i + 1] == quote))) {
|
||||
@@ -554,14 +567,14 @@ static char *php_ap_getword_conf(const zend_encoding *encoding, char *str)
|
||||
char quote = *str;
|
||||
|
||||
str++;
|
||||
- return substring_conf(str, (int)strlen(str), quote);
|
||||
+ return substring_conf(str, strlen(str), quote);
|
||||
} else {
|
||||
char *strend = str;
|
||||
|
||||
while (*strend && !isspace(*strend)) {
|
||||
++strend;
|
||||
}
|
||||
- return substring_conf(str, strend - str, 0);
|
||||
+ return substring_conf(str, (size_t)(strend - str), 0);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
# https://salsa.debian.org/php-team/php/-/tree/ecf76f6726bee03657a2c608240685732312fe54/debian/patches (Sury 7.3.33-35)
|
||||
0107-backport-ZSTR_MAX_LEN.patch
|
||||
0139-Avoid-state-corruption-via-bailout.patch
|
||||
@@ -1,976 +0,0 @@
|
||||
From 712e60f9edfd03f0960fc4fc3c2c375f42b90aa2 Mon Sep 17 00:00:00 2001
|
||||
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
|
||||
Date: Sun, 18 Oct 2026 20:09:54 +0200
|
||||
Subject: [PATCH] Avoid state corruption via bailout
|
||||
|
||||
Minimal mitigation for EOL version.
|
||||
|
||||
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
|
||||
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
|
||||
|
||||
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
|
||||
---
|
||||
Zend/zend_API.h | 1 +
|
||||
Zend/zend_alloc.c | 68 ++++++++++++++++++++---------
|
||||
Zend/zend_alloc.h | 2 +
|
||||
Zend/zend_execute_API.c | 13 ++++++
|
||||
Zend/zend_hash.c | 13 ++++--
|
||||
Zend/zend_hash.h | 1 +
|
||||
Zend/zend_llist.c | 2 +
|
||||
Zend/zend_multiply.h | 4 +-
|
||||
Zend/zend_strtod.c | 4 +-
|
||||
Zend/zend_types.h | 26 +++++++-----
|
||||
Zend/zend_vm_def.h | 11 ++++-
|
||||
Zend/zend_vm_execute.h | 94 +++++++++++++++++++++++++++++++++++++----
|
||||
ext/session/session.c | 2 +-
|
||||
main/SAPI.c | 5 +++
|
||||
main/main.c | 6 +++
|
||||
main/php_variables.c | 8 ++--
|
||||
main/rfc1867.c | 39 ++++++++++++++---
|
||||
17 files changed, 240 insertions(+), 59 deletions(-)
|
||||
|
||||
diff --git a/Zend/zend_API.h b/Zend/zend_API.h
|
||||
index 2a3b582902..26f7726bd8 100644
|
||||
--- a/Zend/zend_API.h
|
||||
+++ b/Zend/zend_API.h
|
||||
@@ -380,6 +380,7 @@ ZEND_API char *zend_get_type_by_const(int type);
|
||||
|
||||
#define array_init(arg) ZVAL_ARR((arg), zend_new_array(0))
|
||||
#define array_init_size(arg, size) ZVAL_ARR((arg), zend_new_array(size))
|
||||
+#define array_init_singleton(arg) ZVAL_ARR((arg), zend_new_array_singleton())
|
||||
ZEND_API int object_init(zval *arg);
|
||||
ZEND_API int object_init_ex(zval *arg, zend_class_entry *ce);
|
||||
ZEND_API int object_and_properties_init(zval *arg, zend_class_entry *ce, HashTable *properties);
|
||||
diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
|
||||
index 3a33e5441c..be9b975426 100644
|
||||
--- a/Zend/zend_alloc.c
|
||||
+++ b/Zend/zend_alloc.c
|
||||
@@ -57,6 +57,7 @@
|
||||
#include "zend_operators.h"
|
||||
#include "zend_multiply.h"
|
||||
#include "zend_bitset.h"
|
||||
+#include "zend_execute.h"
|
||||
#include <signal.h>
|
||||
|
||||
#ifdef HAVE_UNISTD_H
|
||||
@@ -363,7 +364,42 @@ static ZEND_COLD ZEND_NORETURN void zend_mm_panic(const char *message)
|
||||
#if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID)
|
||||
kill(getpid(), SIGSEGV);
|
||||
#endif
|
||||
- exit(1);
|
||||
+ _exit(1);
|
||||
+}
|
||||
+
|
||||
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...)
|
||||
+{
|
||||
+ zend_string *script_filename = NULL;
|
||||
+ uint32_t script_lineno = 0;
|
||||
+
|
||||
+ if (zend_is_executing()) {
|
||||
+ script_filename = zend_get_executed_filename_ex();
|
||||
+ script_lineno = zend_get_executed_lineno();
|
||||
+ } else if (zend_is_compiling()) {
|
||||
+ script_filename = zend_get_compiled_filename();
|
||||
+ script_lineno = zend_get_compiled_lineno();
|
||||
+ }
|
||||
+
|
||||
+ va_list args;
|
||||
+ va_start(args, format);
|
||||
+
|
||||
+ char buf[1024];
|
||||
+ vsnprintf(buf, sizeof(buf), format, args);
|
||||
+
|
||||
+ va_end(args);
|
||||
+
|
||||
+ fprintf(stderr,
|
||||
+ "\nFatal error: %s in %s on line %d\n",
|
||||
+ buf,
|
||||
+ script_filename ? ZSTR_VAL(script_filename) : "Unknown",
|
||||
+ script_lineno);
|
||||
+
|
||||
+ /* See http://support.microsoft.com/kb/190351 */
|
||||
+# ifdef ZEND_WIN32
|
||||
+ fflush(stderr);
|
||||
+# endif
|
||||
+
|
||||
+ _exit(1);
|
||||
}
|
||||
|
||||
static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
|
||||
@@ -375,22 +411,14 @@ static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
|
||||
#endif
|
||||
size_t size)
|
||||
{
|
||||
+ (void) heap;
|
||||
|
||||
- heap->overflow = 1;
|
||||
- zend_try {
|
||||
- zend_error_noreturn(E_ERROR,
|
||||
- format,
|
||||
- limit,
|
||||
+ zend_mm_safe_error_ex(format, limit,
|
||||
#if ZEND_DEBUG
|
||||
- filename,
|
||||
- lineno,
|
||||
+ filename,
|
||||
+ lineno,
|
||||
#endif
|
||||
- size);
|
||||
- } zend_catch {
|
||||
- } zend_end_try();
|
||||
- heap->overflow = 0;
|
||||
- zend_bailout();
|
||||
- exit(1);
|
||||
+ size);
|
||||
}
|
||||
|
||||
#ifdef _WIN32
|
||||
@@ -1318,7 +1346,7 @@ static zend_always_inline void *zend_mm_alloc_heap(zend_mm_heap *heap, size_t si
|
||||
size = MAX(size, 1);
|
||||
size = ZEND_MM_ALIGNED_SIZE(size) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info));
|
||||
if (UNEXPECTED(size < real_size)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
|
||||
return NULL;
|
||||
}
|
||||
#endif
|
||||
@@ -1762,7 +1790,7 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
|
||||
void *ptr;
|
||||
|
||||
if (UNEXPECTED(new_size < size)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
|
||||
}
|
||||
|
||||
#if ZEND_MM_LIMIT
|
||||
@@ -2617,7 +2645,7 @@ ZEND_API char* ZEND_FASTCALL _estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_
|
||||
|
||||
length = strlen(s);
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
|
||||
memcpy(p, s, length+1);
|
||||
@@ -2629,7 +2657,7 @@ ZEND_API char* ZEND_FASTCALL _estrndup(const char *s, size_t length ZEND_FILE_LI
|
||||
char *p;
|
||||
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
|
||||
memcpy(p, s, length);
|
||||
@@ -2643,7 +2671,7 @@ ZEND_API char* ZEND_FASTCALL zend_strndup(const char *s, size_t length)
|
||||
char *p;
|
||||
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) malloc(length + 1);
|
||||
if (UNEXPECTED(p == NULL)) {
|
||||
@@ -2974,7 +3002,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
|
||||
static ZEND_COLD ZEND_NORETURN void zend_out_of_memory(void)
|
||||
{
|
||||
fprintf(stderr, "Out of memory\n");
|
||||
- exit(1);
|
||||
+ _exit(1);
|
||||
}
|
||||
|
||||
ZEND_API void * __zend_malloc(size_t len)
|
||||
diff --git a/Zend/zend_alloc.h b/Zend/zend_alloc.h
|
||||
index 8bb854328d..2ed2ed8b3a 100644
|
||||
--- a/Zend/zend_alloc.h
|
||||
+++ b/Zend/zend_alloc.h
|
||||
@@ -402,6 +402,8 @@ static void apc_init_heap(void)
|
||||
size_t zend_mm_globals_size(void);
|
||||
#endif
|
||||
|
||||
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...);
|
||||
+
|
||||
END_EXTERN_C()
|
||||
|
||||
#endif
|
||||
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
|
||||
index f4f0fa14f1..724b6e5cc4 100644
|
||||
--- a/Zend/zend_execute_API.c
|
||||
+++ b/Zend/zend_execute_API.c
|
||||
@@ -337,10 +337,21 @@ void shutdown_executor(void) /* {{{ */
|
||||
gc_collect_cycles();
|
||||
}
|
||||
#endif
|
||||
+ } else {
|
||||
+ /* may be used by zend_error_zstr_at before init_executor */
|
||||
+ ZVAL_UNDEF(&EG(user_error_handler));
|
||||
+ ZVAL_UNDEF(&EG(user_exception_handler));
|
||||
+ memset(&EG(user_error_handlers_error_reporting), 0, sizeof(EG(user_error_handlers_error_reporting)));
|
||||
+ memset(&EG(user_error_handlers), 0, sizeof(EG(user_error_handlers)));
|
||||
+ memset(&EG(user_exception_handlers), 0, sizeof(EG(user_exception_handlers)));
|
||||
}
|
||||
|
||||
zend_objects_store_free_object_storage(&EG(objects_store), fast_shutdown);
|
||||
|
||||
+ /* may be used by zend_error_zstr_at before init_executor */
|
||||
+ EG(error_handling) = EH_NORMAL;
|
||||
+ EG(exception) = NULL;
|
||||
+
|
||||
zend_weakrefs_shutdown();
|
||||
|
||||
zend_try {
|
||||
@@ -357,6 +368,8 @@ void shutdown_executor(void) /* {{{ */
|
||||
zend_hash_discard(EG(function_table), EG(persistent_functions_count));
|
||||
zend_hash_discard(EG(class_table), EG(persistent_classes_count));
|
||||
zend_cleanup_internal_classes();
|
||||
+ EG(objects_store).object_buckets = NULL;
|
||||
+ EG(objects_store).top = 1;
|
||||
} else {
|
||||
zend_vm_stack_destroy();
|
||||
|
||||
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
|
||||
index da150bd798..ef3d301db1 100644
|
||||
--- a/Zend/zend_hash.c
|
||||
+++ b/Zend/zend_hash.c
|
||||
@@ -97,7 +97,7 @@ static zend_always_inline uint32_t zend_hash_check_size(uint32_t nSize)
|
||||
if (nSize <= HT_MIN_SIZE) {
|
||||
return HT_MIN_SIZE;
|
||||
} else if (UNEXPECTED(nSize >= HT_MAX_SIZE)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
|
||||
}
|
||||
|
||||
#if defined(ZEND_WIN32)
|
||||
@@ -251,6 +251,13 @@ ZEND_API HashTable* ZEND_FASTCALL _zend_new_array_0(void)
|
||||
return ht;
|
||||
}
|
||||
|
||||
+ZEND_API HashTable* ZEND_FASTCALL zend_new_array_singleton(void)
|
||||
+{
|
||||
+ HashTable *ht = _zend_new_array_0();
|
||||
+ ht->nTableSize = 1;
|
||||
+ return ht;
|
||||
+}
|
||||
+
|
||||
ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t nSize)
|
||||
{
|
||||
HashTable *ht = emalloc(sizeof(HashTable));
|
||||
@@ -282,7 +289,7 @@ static void ZEND_FASTCALL zend_hash_packed_grow(HashTable *ht)
|
||||
{
|
||||
HT_ASSERT_RC1(ht);
|
||||
if (ht->nTableSize >= HT_MAX_SIZE) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
|
||||
}
|
||||
ht->nTableSize += ht->nTableSize;
|
||||
HT_SET_DATA_ADDR(ht, perealloc2(HT_GET_DATA_ADDR(ht), HT_SIZE_EX(ht->nTableSize, HT_MIN_MASK), HT_USED_SIZE(ht), GC_FLAGS(ht) & IS_ARRAY_PERSISTENT));
|
||||
@@ -1164,7 +1171,7 @@ static void ZEND_FASTCALL zend_hash_do_resize(HashTable *ht)
|
||||
pefree(old_data, GC_FLAGS(ht) & IS_ARRAY_PERSISTENT);
|
||||
zend_hash_rehash(ht);
|
||||
} else {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/Zend/zend_hash.h b/Zend/zend_hash.h
|
||||
index f1e2d34685..b833479eaa 100644
|
||||
--- a/Zend/zend_hash.h
|
||||
+++ b/Zend/zend_hash.h
|
||||
@@ -296,6 +296,7 @@ ZEND_API int ZEND_FASTCALL zend_hash_rehash(HashTable *ht);
|
||||
#endif
|
||||
|
||||
ZEND_API HashTable* ZEND_FASTCALL _zend_new_array_0(void);
|
||||
+ZEND_API HashTable* ZEND_FASTCALL zend_new_array_singleton(void);
|
||||
ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t size);
|
||||
ZEND_API HashTable* ZEND_FASTCALL zend_new_pair(zval *val1, zval *val2);
|
||||
ZEND_API uint32_t zend_array_count(HashTable *ht);
|
||||
diff --git a/Zend/zend_llist.c b/Zend/zend_llist.c
|
||||
index 4a2c22e632..0955e953aa 100644
|
||||
--- a/Zend/zend_llist.c
|
||||
+++ b/Zend/zend_llist.c
|
||||
@@ -112,6 +112,8 @@ ZEND_API void zend_llist_destroy(zend_llist *l)
|
||||
current = next;
|
||||
}
|
||||
|
||||
+ l->head = NULL;
|
||||
+ l->tail = NULL;
|
||||
l->count = 0;
|
||||
}
|
||||
|
||||
diff --git a/Zend/zend_multiply.h b/Zend/zend_multiply.h
|
||||
index a3827d25d1..a9bbda5538 100644
|
||||
--- a/Zend/zend_multiply.h
|
||||
+++ b/Zend/zend_multiply.h
|
||||
@@ -321,7 +321,7 @@ static zend_always_inline size_t zend_safe_address_guarded(size_t nmemb, size_t
|
||||
size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return ret;
|
||||
@@ -334,7 +334,7 @@ static zend_always_inline size_t zend_safe_addmult(size_t nmemb, size_t size, si
|
||||
size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return ret;
|
||||
diff --git a/Zend/zend_strtod.c b/Zend/zend_strtod.c
|
||||
index 2228e2262c..ad8df201af 100644
|
||||
--- a/Zend/zend_strtod.c
|
||||
+++ b/Zend/zend_strtod.c
|
||||
@@ -603,7 +603,7 @@ Balloc
|
||||
rv = (Bigint *)MALLOC(sizeof(Bigint) + (x-1)*sizeof(ULong));
|
||||
if (!rv) {
|
||||
FREE_DTOA_LOCK(0);
|
||||
- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
|
||||
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
|
||||
}
|
||||
#else
|
||||
len = (sizeof(Bigint) + (x-1)*sizeof(ULong) + sizeof(double) - 1)
|
||||
@@ -616,7 +616,7 @@ Balloc
|
||||
rv = (Bigint*)MALLOC(len*sizeof(double));
|
||||
if (!rv) {
|
||||
FREE_DTOA_LOCK(0);
|
||||
- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
|
||||
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
|
||||
}
|
||||
#endif
|
||||
rv->k = k;
|
||||
diff --git a/Zend/zend_types.h b/Zend/zend_types.h
|
||||
index 7b8c079c45..f7828eb6d3 100644
|
||||
--- a/Zend/zend_types.h
|
||||
+++ b/Zend/zend_types.h
|
||||
@@ -330,17 +330,21 @@ struct _zend_array {
|
||||
# define HT_HASH_RESET(ht) do { \
|
||||
char *p = (char*)&HT_HASH(ht, (ht)->nTableMask); \
|
||||
size_t size = HT_HASH_SIZE((ht)->nTableMask); \
|
||||
- __m128i xmm0 = _mm_setzero_si128(); \
|
||||
- xmm0 = _mm_cmpeq_epi8(xmm0, xmm0); \
|
||||
- ZEND_ASSERT(size >= 64 && ((size & 0x3f) == 0)); \
|
||||
- do { \
|
||||
- _mm_storeu_si128((__m128i*)p, xmm0); \
|
||||
- _mm_storeu_si128((__m128i*)(p+16), xmm0); \
|
||||
- _mm_storeu_si128((__m128i*)(p+32), xmm0); \
|
||||
- _mm_storeu_si128((__m128i*)(p+48), xmm0); \
|
||||
- p += 64; \
|
||||
- size -= 64; \
|
||||
- } while (size != 0); \
|
||||
+ if (UNEXPECTED(size < 64)) { \
|
||||
+ memset(p, HT_INVALID_IDX, size); \
|
||||
+ } else { \
|
||||
+ __m128i xmm0 = _mm_setzero_si128(); \
|
||||
+ xmm0 = _mm_cmpeq_epi8(xmm0, xmm0); \
|
||||
+ ZEND_ASSERT(size >= 64 && ((size & 0x3f) == 0)); \
|
||||
+ do { \
|
||||
+ _mm_storeu_si128((__m128i*)p, xmm0); \
|
||||
+ _mm_storeu_si128((__m128i*)(p+16), xmm0); \
|
||||
+ _mm_storeu_si128((__m128i*)(p+32), xmm0); \
|
||||
+ _mm_storeu_si128((__m128i*)(p+48), xmm0); \
|
||||
+ p += 64; \
|
||||
+ size -= 64; \
|
||||
+ } while (size != 0); \
|
||||
+ } \
|
||||
} while (0)
|
||||
#else
|
||||
# define HT_HASH_RESET(ht) \
|
||||
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
|
||||
index d362b01643..3af90d705b 100644
|
||||
--- a/Zend/zend_vm_def.h
|
||||
+++ b/Zend/zend_vm_def.h
|
||||
@@ -417,7 +417,7 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TMPVAR|CV, CONST|TMPVAR|CV, SPEC(NO_CONST_
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -426,6 +426,9 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TMPVAR|CV, CONST|TMPVAR|CV, SPEC(NO_CONST_
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -3210,6 +3213,9 @@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND_FAST_CONCAT, CONST|TMPVAR|CV, CONST|TMP
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -3217,6 +3223,9 @@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND_FAST_CONCAT, CONST|TMPVAR|CV, CONST|TMP
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
|
||||
index 2875fd3740..8701e77ea8 100644
|
||||
--- a/Zend/zend_vm_execute.h
|
||||
+++ b/Zend/zend_vm_execute.h
|
||||
@@ -5631,6 +5631,9 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -5638,6 +5641,9 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -7491,6 +7497,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_TMPVAR_HANDL
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -7498,6 +7507,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_TMPVAR_HANDL
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -7900,7 +7912,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_TMPVAR_
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -7909,6 +7921,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_TMPVAR_
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -9952,6 +9967,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_CV_HANDLER(Z
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -9959,6 +9977,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_CV_HANDLER(Z
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -10361,7 +10382,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_CV_HAND
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -10370,6 +10391,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_CV_HAND
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -13928,6 +13952,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CONST_HANDL
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -13935,6 +13962,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CONST_HANDL
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -14681,7 +14711,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CONST_
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -14690,6 +14720,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CONST_
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -15353,7 +15386,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_TMPVAR_HAND
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -15362,6 +15395,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_TMPVAR_HAND
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -16107,6 +16143,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_TMPVAR
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -16114,6 +16153,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_TMPVAR
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -17040,7 +17082,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CV_HANDLER(
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -17049,6 +17091,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CV_HANDLER(
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -17401,6 +17446,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CV_HAN
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -17408,6 +17456,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CV_HAN
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -38348,7 +38399,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CONST_HANDLER(Z
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -38357,6 +38408,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CONST_HANDLER(Z
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -40727,7 +40781,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CONST_HAND
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -40736,6 +40790,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CONST_HAND
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -41849,6 +41906,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_TMPVAR_HANDLER(
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -41856,6 +41916,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_TMPVAR_HANDLER(
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -44132,6 +44195,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_TMPVAR_HAN
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -44139,6 +44205,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_TMPVAR_HAN
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -46857,7 +46926,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -46866,6 +46935,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -49268,6 +49340,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CV_HANDLER
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -49275,6 +49350,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CV_HANDLER
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
diff --git a/ext/session/session.c b/ext/session/session.c
|
||||
index 8fb6dd2cd5..89a7400a9c 100644
|
||||
--- a/ext/session/session.c
|
||||
+++ b/ext/session/session.c
|
||||
@@ -3174,7 +3174,7 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
|
||||
if (php_session_rfc1867_orig_callback) {
|
||||
retval = php_session_rfc1867_orig_callback(event, event_data, extra);
|
||||
}
|
||||
- if (!PS(rfc1867_enabled)) {
|
||||
+ if (!PS(rfc1867_enabled) || true) {
|
||||
return retval;
|
||||
}
|
||||
|
||||
diff --git a/main/SAPI.c b/main/SAPI.c
|
||||
index a5a68f8c68..1c320f6e3f 100644
|
||||
--- a/main/SAPI.c
|
||||
+++ b/main/SAPI.c
|
||||
@@ -509,18 +509,23 @@ SAPI_API void sapi_deactivate(void)
|
||||
}
|
||||
if (SG(request_info).auth_user) {
|
||||
efree(SG(request_info).auth_user);
|
||||
+ SG(request_info).auth_user = NULL;
|
||||
}
|
||||
if (SG(request_info).auth_password) {
|
||||
efree(SG(request_info).auth_password);
|
||||
+ SG(request_info).auth_password = NULL;
|
||||
}
|
||||
if (SG(request_info).auth_digest) {
|
||||
efree(SG(request_info).auth_digest);
|
||||
+ SG(request_info).auth_digest = NULL;
|
||||
}
|
||||
if (SG(request_info).content_type_dup) {
|
||||
efree(SG(request_info).content_type_dup);
|
||||
+ SG(request_info).content_type_dup = NULL;
|
||||
}
|
||||
if (SG(request_info).current_user) {
|
||||
efree(SG(request_info).current_user);
|
||||
+ SG(request_info).current_user = NULL;
|
||||
}
|
||||
if (sapi_module.deactivate) {
|
||||
sapi_module.deactivate();
|
||||
diff --git a/main/main.c b/main/main.c
|
||||
index 0b33b2b56c..bb8501f973 100644
|
||||
--- a/main/main.c
|
||||
+++ b/main/main.c
|
||||
@@ -836,6 +836,7 @@ PHP_INI_BEGIN()
|
||||
PHP_INI_ENTRY("disable_functions", "", PHP_INI_SYSTEM, NULL)
|
||||
PHP_INI_ENTRY("disable_classes", "", PHP_INI_SYSTEM, NULL)
|
||||
PHP_INI_ENTRY("max_file_uploads", "20", PHP_INI_SYSTEM|PHP_INI_PERDIR, NULL)
|
||||
+ PHP_INI_ENTRY("max_multipart_body_parts", "-1", PHP_INI_SYSTEM|PHP_INI_PERDIR, NULL)
|
||||
|
||||
STD_PHP_INI_BOOLEAN("allow_url_fopen", "1", PHP_INI_SYSTEM, OnUpdateBool, allow_url_fopen, php_core_globals, core_globals)
|
||||
STD_PHP_INI_BOOLEAN("allow_url_include", "0", PHP_INI_SYSTEM, OnUpdateBool, allow_url_include, php_core_globals, core_globals)
|
||||
@@ -1960,6 +1961,8 @@ void php_request_shutdown(void *dummy)
|
||||
|
||||
for (i=0; i<NUM_TRACK_VARS; i++) {
|
||||
zval_ptr_dtor(&PG(http_globals)[i]);
|
||||
+ /* May be accessed before php_request_startup() */
|
||||
+ ZVAL_UNDEF(&PG(http_globals)[i]);
|
||||
}
|
||||
} zend_end_try();
|
||||
|
||||
@@ -2012,6 +2015,9 @@ void php_request_shutdown(void *dummy)
|
||||
#ifdef HAVE_DTRACE
|
||||
DTRACE_REQUEST_SHUTDOWN(SAFE_FILENAME(SG(request_info).path_translated), SAFE_FILENAME(SG(request_info).request_uri), (char *)SAFE_FILENAME(SG(request_info).request_method));
|
||||
#endif /* HAVE_DTRACE */
|
||||
+
|
||||
+ /* May be accessed before php_request_startup() */
|
||||
+ PG(modules_activated) = 0;
|
||||
}
|
||||
/* }}} */
|
||||
|
||||
diff --git a/main/php_variables.c b/main/php_variables.c
|
||||
index 18f6b65a6c..c920e4d5e2 100644
|
||||
--- a/main/php_variables.c
|
||||
+++ b/main/php_variables.c
|
||||
@@ -218,7 +218,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
}
|
||||
|
||||
if (!index) {
|
||||
- array_init(&gpc_element);
|
||||
+ array_init_singleton(&gpc_element);
|
||||
if ((gpc_element_p = zend_hash_next_index_insert(symtable1, &gpc_element)) == NULL) {
|
||||
zend_array_destroy(Z_ARR(gpc_element));
|
||||
zval_ptr_dtor_nogc(val);
|
||||
@@ -229,7 +229,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
gpc_element_p = zend_symtable_str_find(symtable1, index, index_len);
|
||||
if (!gpc_element_p) {
|
||||
zval tmp;
|
||||
- array_init(&tmp);
|
||||
+ array_init_singleton(&tmp);
|
||||
gpc_element_p = zend_symtable_str_update_ind(symtable1, index, index_len, &tmp);
|
||||
} else {
|
||||
if (Z_TYPE_P(gpc_element_p) == IS_INDIRECT) {
|
||||
@@ -237,7 +237,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
|
||||
}
|
||||
if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) {
|
||||
zval_ptr_dtor_nogc(gpc_element_p);
|
||||
- array_init(gpc_element_p);
|
||||
+ array_init_singleton(gpc_element_p);
|
||||
} else {
|
||||
SEPARATE_ARRAY(gpc_element_p);
|
||||
}
|
||||
@@ -429,7 +429,7 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
|
||||
case PARSE_POST:
|
||||
case PARSE_GET:
|
||||
case PARSE_COOKIE:
|
||||
- array_init(&array);
|
||||
+ array_init_singleton(&array);
|
||||
switch (arg) {
|
||||
case PARSE_POST:
|
||||
zval_ptr_dtor_nogc(&PG(http_globals)[TRACK_VARS_POST]);
|
||||
diff --git a/main/rfc1867.c b/main/rfc1867.c
|
||||
index edef19c16d..4946df0ca2 100644
|
||||
--- a/main/rfc1867.c
|
||||
+++ b/main/rfc1867.c
|
||||
@@ -397,6 +397,14 @@ static int find_boundary(multipart_buffer *self, char *boundary)
|
||||
return 0;
|
||||
}
|
||||
|
||||
+static zend_bool php_mime_should_save_hdr(const char *name)
|
||||
+{
|
||||
+ return !strcasecmp(name, "Content-Disposition")
|
||||
+ || !strcasecmp(name, "Content-Type");
|
||||
+}
|
||||
+
|
||||
+static char *php_mime_get_hdr_value(zend_llist header, char *key);
|
||||
+
|
||||
/* parse headers */
|
||||
static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
|
||||
{
|
||||
@@ -437,10 +445,16 @@ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
|
||||
}
|
||||
|
||||
*value = '\0';
|
||||
- do { value++; } while (isspace(*value));
|
||||
|
||||
- key = estrdup(line);
|
||||
- smart_string_appends(&buf_value, value);
|
||||
+ /* Keep only headers we use, and ignore duplicates */
|
||||
+ if (!php_mime_should_save_hdr(line)
|
||||
+ || php_mime_get_hdr_value(*header, line)) {
|
||||
+ key = NULL;
|
||||
+ } else {
|
||||
+ key = estrdup(line);
|
||||
+ do { value++; } while (isspace((unsigned char)*value));
|
||||
+ smart_string_appends(&buf_value, value);
|
||||
+ }
|
||||
} else if (buf_value.c) { /* If no ':' on the line, add to previous line */
|
||||
smart_string_appends(&buf_value, line);
|
||||
} else {
|
||||
@@ -514,11 +528,11 @@ static char *php_ap_getword(const zend_encoding *encoding, char **line, char sto
|
||||
return res;
|
||||
}
|
||||
|
||||
-static char *substring_conf(char *start, int len, char quote)
|
||||
+static char *substring_conf(char *start, size_t len, char quote)
|
||||
{
|
||||
char *result = emalloc(len + 1);
|
||||
char *resp = result;
|
||||
- int i;
|
||||
+ size_t i;
|
||||
|
||||
for (i = 0; i < len && start[i] != quote; ++i) {
|
||||
if (start[i] == '\\' && (start[i + 1] == '\\' || (quote && start[i + 1] == quote))) {
|
||||
@@ -546,14 +560,14 @@ static char *php_ap_getword_conf(const zend_encoding *encoding, char *str)
|
||||
char quote = *str;
|
||||
|
||||
str++;
|
||||
- return substring_conf(str, (int)strlen(str), quote);
|
||||
+ return substring_conf(str, strlen(str), quote);
|
||||
} else {
|
||||
char *strend = str;
|
||||
|
||||
while (*strend && !isspace(*strend)) {
|
||||
++strend;
|
||||
}
|
||||
- return substring_conf(str, strend - str, 0);
|
||||
+ return substring_conf(str, (size_t)(strend - str), 0);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -694,6 +708,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
|
||||
void *event_extra_data = NULL;
|
||||
unsigned int llen = 0;
|
||||
int upload_cnt = INI_INT("max_file_uploads");
|
||||
+ int body_parts_cnt = INI_INT("max_multipart_body_parts");
|
||||
const zend_encoding *internal_encoding = zend_multibyte_get_internal_encoding();
|
||||
php_rfc1867_getword_t getword;
|
||||
php_rfc1867_getword_conf_t getword_conf;
|
||||
@@ -715,6 +730,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
|
||||
return;
|
||||
}
|
||||
|
||||
+ if (body_parts_cnt < 0) {
|
||||
+ body_parts_cnt = PG(max_input_vars) + upload_cnt;
|
||||
+ }
|
||||
+ int body_parts_limit = body_parts_cnt;
|
||||
+
|
||||
/* Get the boundary */
|
||||
boundary = strstr(content_type_dup, "boundary");
|
||||
if (!boundary) {
|
||||
@@ -799,6 +819,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
|
||||
char *pair = NULL;
|
||||
int end = 0;
|
||||
|
||||
+ if (--body_parts_cnt < 0) {
|
||||
+ php_error_docref(NULL, E_WARNING, "Multipart body parts limit exceeded %d. To increase the limit change max_multipart_body_parts in php.ini.", body_parts_limit);
|
||||
+ goto fileupload_done;
|
||||
+ }
|
||||
+
|
||||
while (isspace(*cd)) {
|
||||
++cd;
|
||||
}
|
||||
--
|
||||
2.56.0
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
# https://github.com/php/php-src/commit/712e60f9edfd03f0960fc4fc3c2c375f42b90aa2 (branch PHP-7.4-CVE-2026-109618-109619)
|
||||
0001-Avoid-state-corruption-via-bailout.patch
|
||||
@@ -1,944 +0,0 @@
|
||||
From 82f8f31b16a035c1b67cc253e79f7cc288f4cc20 Mon Sep 17 00:00:00 2001
|
||||
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
|
||||
Date: Sun, 18 Oct 2026 20:11:52 +0200
|
||||
Subject: [PATCH] Avoid state corruption via bailout
|
||||
|
||||
Minimal mitigation for EOL version.
|
||||
|
||||
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
|
||||
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
|
||||
|
||||
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
|
||||
---
|
||||
Zend/zend_API.h | 1 +
|
||||
Zend/zend_alloc.c | 68 ++++++++++++++++++++---------
|
||||
Zend/zend_alloc.h | 2 +
|
||||
Zend/zend_execute_API.c | 13 ++++++
|
||||
Zend/zend_hash.c | 13 ++++--
|
||||
Zend/zend_hash.h | 1 +
|
||||
Zend/zend_llist.c | 2 +
|
||||
Zend/zend_multiply.h | 4 +-
|
||||
Zend/zend_strtod.c | 4 +-
|
||||
Zend/zend_types.h | 26 +++++++-----
|
||||
Zend/zend_vm_def.h | 11 ++++-
|
||||
Zend/zend_vm_execute.h | 94 +++++++++++++++++++++++++++++++++++++----
|
||||
ext/session/session.c | 2 +-
|
||||
main/SAPI.c | 5 +++
|
||||
main/main.c | 6 +++
|
||||
main/php_variables.c | 8 ++--
|
||||
main/rfc1867.c | 28 +++++++++---
|
||||
17 files changed, 229 insertions(+), 59 deletions(-)
|
||||
|
||||
diff --git a/Zend/zend_API.h b/Zend/zend_API.h
|
||||
index 456ef05d80..0d015bacf3 100644
|
||||
--- a/Zend/zend_API.h
|
||||
+++ b/Zend/zend_API.h
|
||||
@@ -428,6 +428,7 @@ ZEND_API const char *zend_get_type_by_const(int type);
|
||||
|
||||
#define array_init(arg) ZVAL_ARR((arg), zend_new_array(0))
|
||||
#define array_init_size(arg, size) ZVAL_ARR((arg), zend_new_array(size))
|
||||
+#define array_init_singleton(arg) ZVAL_ARR((arg), zend_new_array_singleton())
|
||||
ZEND_API void object_init(zval *arg);
|
||||
ZEND_API zend_result object_init_ex(zval *arg, zend_class_entry *ce);
|
||||
ZEND_API zend_result object_and_properties_init(zval *arg, zend_class_entry *ce, HashTable *properties);
|
||||
diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
|
||||
index 6e0ce4b651..a21b10f9be 100644
|
||||
--- a/Zend/zend_alloc.c
|
||||
+++ b/Zend/zend_alloc.c
|
||||
@@ -57,6 +57,7 @@
|
||||
#include "zend_operators.h"
|
||||
#include "zend_multiply.h"
|
||||
#include "zend_bitset.h"
|
||||
+#include "zend_execute.h"
|
||||
#include <signal.h>
|
||||
|
||||
#ifdef HAVE_UNISTD_H
|
||||
@@ -363,7 +364,42 @@ static ZEND_COLD ZEND_NORETURN void zend_mm_panic(const char *message)
|
||||
#if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID)
|
||||
kill(getpid(), SIGSEGV);
|
||||
#endif
|
||||
- exit(1);
|
||||
+ _exit(1);
|
||||
+}
|
||||
+
|
||||
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...)
|
||||
+{
|
||||
+ zend_string *script_filename = NULL;
|
||||
+ uint32_t script_lineno = 0;
|
||||
+
|
||||
+ if (zend_is_executing()) {
|
||||
+ script_filename = zend_get_executed_filename_ex();
|
||||
+ script_lineno = zend_get_executed_lineno();
|
||||
+ } else if (zend_is_compiling()) {
|
||||
+ script_filename = zend_get_compiled_filename();
|
||||
+ script_lineno = zend_get_compiled_lineno();
|
||||
+ }
|
||||
+
|
||||
+ va_list args;
|
||||
+ va_start(args, format);
|
||||
+
|
||||
+ char buf[1024];
|
||||
+ vsnprintf(buf, sizeof(buf), format, args);
|
||||
+
|
||||
+ va_end(args);
|
||||
+
|
||||
+ fprintf(stderr,
|
||||
+ "\nFatal error: %s in %s on line %d\n",
|
||||
+ buf,
|
||||
+ script_filename ? ZSTR_VAL(script_filename) : "Unknown",
|
||||
+ script_lineno);
|
||||
+
|
||||
+ /* See http://support.microsoft.com/kb/190351 */
|
||||
+# ifdef ZEND_WIN32
|
||||
+ fflush(stderr);
|
||||
+# endif
|
||||
+
|
||||
+ _exit(1);
|
||||
}
|
||||
|
||||
static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
|
||||
@@ -375,22 +411,14 @@ static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
|
||||
#endif
|
||||
size_t size)
|
||||
{
|
||||
+ (void) heap;
|
||||
|
||||
- heap->overflow = 1;
|
||||
- zend_try {
|
||||
- zend_error_noreturn(E_ERROR,
|
||||
- format,
|
||||
- limit,
|
||||
+ zend_mm_safe_error_ex(format, limit,
|
||||
#if ZEND_DEBUG
|
||||
- filename,
|
||||
- lineno,
|
||||
+ filename,
|
||||
+ lineno,
|
||||
#endif
|
||||
- size);
|
||||
- } zend_catch {
|
||||
- } zend_end_try();
|
||||
- heap->overflow = 0;
|
||||
- zend_bailout();
|
||||
- exit(1);
|
||||
+ size);
|
||||
}
|
||||
|
||||
#ifdef _WIN32
|
||||
@@ -1318,7 +1346,7 @@ static zend_always_inline void *zend_mm_alloc_heap(zend_mm_heap *heap, size_t si
|
||||
size = MAX(size, 1);
|
||||
size = ZEND_MM_ALIGNED_SIZE(size) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info));
|
||||
if (UNEXPECTED(size < real_size)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
|
||||
return NULL;
|
||||
}
|
||||
#endif
|
||||
@@ -1762,7 +1790,7 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
|
||||
void *ptr;
|
||||
|
||||
if (UNEXPECTED(new_size < size)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
|
||||
}
|
||||
|
||||
#if ZEND_MM_LIMIT
|
||||
@@ -2618,7 +2646,7 @@ ZEND_API char* ZEND_FASTCALL _estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_
|
||||
|
||||
length = strlen(s);
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
|
||||
memcpy(p, s, length+1);
|
||||
@@ -2630,7 +2658,7 @@ ZEND_API char* ZEND_FASTCALL _estrndup(const char *s, size_t length ZEND_FILE_LI
|
||||
char *p;
|
||||
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
|
||||
memcpy(p, s, length);
|
||||
@@ -2644,7 +2672,7 @@ ZEND_API char* ZEND_FASTCALL zend_strndup(const char *s, size_t length)
|
||||
char *p;
|
||||
|
||||
if (UNEXPECTED(length + 1 == 0)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
|
||||
}
|
||||
p = (char *) malloc(length + 1);
|
||||
if (UNEXPECTED(p == NULL)) {
|
||||
@@ -3048,7 +3076,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
|
||||
static ZEND_COLD ZEND_NORETURN void zend_out_of_memory(void)
|
||||
{
|
||||
fprintf(stderr, "Out of memory\n");
|
||||
- exit(1);
|
||||
+ _exit(1);
|
||||
}
|
||||
|
||||
ZEND_API void * __zend_malloc(size_t len)
|
||||
diff --git a/Zend/zend_alloc.h b/Zend/zend_alloc.h
|
||||
index de450bbca2..f6bc82d250 100644
|
||||
--- a/Zend/zend_alloc.h
|
||||
+++ b/Zend/zend_alloc.h
|
||||
@@ -403,6 +403,8 @@ static void apc_init_heap(void)
|
||||
size_t zend_mm_globals_size(void);
|
||||
#endif
|
||||
|
||||
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...);
|
||||
+
|
||||
END_EXTERN_C()
|
||||
|
||||
#endif
|
||||
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
|
||||
index 18104c2d99..2f19a17c6b 100644
|
||||
--- a/Zend/zend_execute_API.c
|
||||
+++ b/Zend/zend_execute_API.c
|
||||
@@ -334,10 +334,21 @@ void shutdown_executor(void) /* {{{ */
|
||||
gc_collect_cycles();
|
||||
}
|
||||
#endif
|
||||
+ } else {
|
||||
+ /* may be used by zend_error_zstr_at before init_executor */
|
||||
+ ZVAL_UNDEF(&EG(user_error_handler));
|
||||
+ ZVAL_UNDEF(&EG(user_exception_handler));
|
||||
+ memset(&EG(user_error_handlers_error_reporting), 0, sizeof(EG(user_error_handlers_error_reporting)));
|
||||
+ memset(&EG(user_error_handlers), 0, sizeof(EG(user_error_handlers)));
|
||||
+ memset(&EG(user_exception_handlers), 0, sizeof(EG(user_exception_handlers)));
|
||||
}
|
||||
|
||||
zend_objects_store_free_object_storage(&EG(objects_store), fast_shutdown);
|
||||
|
||||
+ /* may be used by zend_error_zstr_at before init_executor */
|
||||
+ EG(error_handling) = EH_NORMAL;
|
||||
+ EG(exception) = NULL;
|
||||
+
|
||||
zend_weakrefs_shutdown();
|
||||
|
||||
zend_try {
|
||||
@@ -354,6 +365,8 @@ void shutdown_executor(void) /* {{{ */
|
||||
zend_hash_discard(EG(function_table), EG(persistent_functions_count));
|
||||
zend_hash_discard(EG(class_table), EG(persistent_classes_count));
|
||||
zend_cleanup_internal_classes();
|
||||
+ EG(objects_store).object_buckets = NULL;
|
||||
+ EG(objects_store).top = 1;
|
||||
} else {
|
||||
zend_vm_stack_destroy();
|
||||
|
||||
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
|
||||
index a3b62160dc..a4c318d123 100644
|
||||
--- a/Zend/zend_hash.c
|
||||
+++ b/Zend/zend_hash.c
|
||||
@@ -119,7 +119,7 @@ static zend_always_inline uint32_t zend_hash_check_size(uint32_t nSize)
|
||||
if (nSize <= HT_MIN_SIZE) {
|
||||
return HT_MIN_SIZE;
|
||||
} else if (UNEXPECTED(nSize >= HT_MAX_SIZE)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
|
||||
}
|
||||
|
||||
#ifdef ZEND_WIN32
|
||||
@@ -273,6 +273,13 @@ ZEND_API HashTable* ZEND_FASTCALL _zend_new_array_0(void)
|
||||
return ht;
|
||||
}
|
||||
|
||||
+ZEND_API HashTable* ZEND_FASTCALL zend_new_array_singleton(void)
|
||||
+{
|
||||
+ HashTable *ht = _zend_new_array_0();
|
||||
+ ht->nTableSize = 1;
|
||||
+ return ht;
|
||||
+}
|
||||
+
|
||||
ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t nSize)
|
||||
{
|
||||
HashTable *ht = emalloc(sizeof(HashTable));
|
||||
@@ -304,7 +311,7 @@ static void ZEND_FASTCALL zend_hash_packed_grow(HashTable *ht)
|
||||
{
|
||||
HT_ASSERT_RC1(ht);
|
||||
if (ht->nTableSize >= HT_MAX_SIZE) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
|
||||
}
|
||||
ht->nTableSize += ht->nTableSize;
|
||||
HT_SET_DATA_ADDR(ht, perealloc2(HT_GET_DATA_ADDR(ht), HT_SIZE_EX(ht->nTableSize, HT_MIN_MASK), HT_USED_SIZE(ht), GC_FLAGS(ht) & IS_ARRAY_PERSISTENT));
|
||||
@@ -1190,7 +1197,7 @@ static void ZEND_FASTCALL zend_hash_do_resize(HashTable *ht)
|
||||
pefree(old_data, GC_FLAGS(ht) & IS_ARRAY_PERSISTENT);
|
||||
zend_hash_rehash(ht);
|
||||
} else {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/Zend/zend_hash.h b/Zend/zend_hash.h
|
||||
index ced21a2ca1..b697acf587 100644
|
||||
--- a/Zend/zend_hash.h
|
||||
+++ b/Zend/zend_hash.h
|
||||
@@ -296,6 +296,7 @@ ZEND_API void ZEND_FASTCALL zend_hash_rehash(HashTable *ht);
|
||||
#endif
|
||||
|
||||
ZEND_API HashTable* ZEND_FASTCALL _zend_new_array_0(void);
|
||||
+ZEND_API HashTable* ZEND_FASTCALL zend_new_array_singleton(void);
|
||||
ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t size);
|
||||
ZEND_API HashTable* ZEND_FASTCALL zend_new_pair(zval *val1, zval *val2);
|
||||
ZEND_API uint32_t zend_array_count(HashTable *ht);
|
||||
diff --git a/Zend/zend_llist.c b/Zend/zend_llist.c
|
||||
index 78a3310438..8c42b2494e 100644
|
||||
--- a/Zend/zend_llist.c
|
||||
+++ b/Zend/zend_llist.c
|
||||
@@ -112,6 +112,8 @@ ZEND_API void zend_llist_destroy(zend_llist *l)
|
||||
current = next;
|
||||
}
|
||||
|
||||
+ l->head = NULL;
|
||||
+ l->tail = NULL;
|
||||
l->count = 0;
|
||||
}
|
||||
|
||||
diff --git a/Zend/zend_multiply.h b/Zend/zend_multiply.h
|
||||
index c6cd472a23..bfe1b8e886 100644
|
||||
--- a/Zend/zend_multiply.h
|
||||
+++ b/Zend/zend_multiply.h
|
||||
@@ -321,7 +321,7 @@ static zend_always_inline size_t zend_safe_address_guarded(size_t nmemb, size_t
|
||||
size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return ret;
|
||||
@@ -334,7 +334,7 @@ static zend_always_inline size_t zend_safe_addmult(size_t nmemb, size_t size, si
|
||||
size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
|
||||
|
||||
if (UNEXPECTED(overflow)) {
|
||||
- zend_error_noreturn(E_ERROR, "Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
|
||||
+ zend_mm_safe_error_ex("Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
|
||||
return 0;
|
||||
}
|
||||
return ret;
|
||||
diff --git a/Zend/zend_strtod.c b/Zend/zend_strtod.c
|
||||
index e88fbd001f..fd6b23c9cb 100644
|
||||
--- a/Zend/zend_strtod.c
|
||||
+++ b/Zend/zend_strtod.c
|
||||
@@ -603,7 +603,7 @@ Balloc
|
||||
rv = (Bigint *)MALLOC(sizeof(Bigint) + (x-1)*sizeof(ULong));
|
||||
if (!rv) {
|
||||
FREE_DTOA_LOCK(0);
|
||||
- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
|
||||
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
|
||||
}
|
||||
#else
|
||||
len = (sizeof(Bigint) + (x-1)*sizeof(ULong) + sizeof(double) - 1)
|
||||
@@ -616,7 +616,7 @@ Balloc
|
||||
rv = (Bigint*)MALLOC(len*sizeof(double));
|
||||
if (!rv) {
|
||||
FREE_DTOA_LOCK(0);
|
||||
- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
|
||||
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
|
||||
}
|
||||
#endif
|
||||
rv->k = k;
|
||||
diff --git a/Zend/zend_types.h b/Zend/zend_types.h
|
||||
index 82cf20f1b5..1a10ba718c 100644
|
||||
--- a/Zend/zend_types.h
|
||||
+++ b/Zend/zend_types.h
|
||||
@@ -439,17 +439,21 @@ struct _zend_array {
|
||||
# define HT_HASH_RESET(ht) do { \
|
||||
char *p = (char*)&HT_HASH(ht, (ht)->nTableMask); \
|
||||
size_t size = HT_HASH_SIZE((ht)->nTableMask); \
|
||||
- __m128i xmm0 = _mm_setzero_si128(); \
|
||||
- xmm0 = _mm_cmpeq_epi8(xmm0, xmm0); \
|
||||
- ZEND_ASSERT(size >= 64 && ((size & 0x3f) == 0)); \
|
||||
- do { \
|
||||
- _mm_storeu_si128((__m128i*)p, xmm0); \
|
||||
- _mm_storeu_si128((__m128i*)(p+16), xmm0); \
|
||||
- _mm_storeu_si128((__m128i*)(p+32), xmm0); \
|
||||
- _mm_storeu_si128((__m128i*)(p+48), xmm0); \
|
||||
- p += 64; \
|
||||
- size -= 64; \
|
||||
- } while (size != 0); \
|
||||
+ if (UNEXPECTED(size < 64)) { \
|
||||
+ memset(p, HT_INVALID_IDX, size); \
|
||||
+ } else { \
|
||||
+ __m128i xmm0 = _mm_setzero_si128(); \
|
||||
+ xmm0 = _mm_cmpeq_epi8(xmm0, xmm0); \
|
||||
+ ZEND_ASSERT(size >= 64 && ((size & 0x3f) == 0)); \
|
||||
+ do { \
|
||||
+ _mm_storeu_si128((__m128i*)p, xmm0); \
|
||||
+ _mm_storeu_si128((__m128i*)(p+16), xmm0); \
|
||||
+ _mm_storeu_si128((__m128i*)(p+32), xmm0); \
|
||||
+ _mm_storeu_si128((__m128i*)(p+48), xmm0); \
|
||||
+ p += 64; \
|
||||
+ size -= 64; \
|
||||
+ } while (size != 0); \
|
||||
+ } \
|
||||
} while (0)
|
||||
#else
|
||||
# define HT_HASH_RESET(ht) \
|
||||
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
|
||||
index bcb9be8dab..406350ef26 100644
|
||||
--- a/Zend/zend_vm_def.h
|
||||
+++ b/Zend/zend_vm_def.h
|
||||
@@ -408,7 +408,7 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TMPVAR|CV, CONST|TMPVAR|CV, SPEC(NO_CONST_
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -417,6 +417,9 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TMPVAR|CV, CONST|TMPVAR|CV, SPEC(NO_CONST_
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -3157,6 +3160,9 @@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND_FAST_CONCAT, CONST|TMPVAR|CV, CONST|TMP
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -3164,6 +3170,9 @@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND_FAST_CONCAT, CONST|TMPVAR|CV, CONST|TMP
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
|
||||
index 049d0f2126..eeca7ebb75 100644
|
||||
--- a/Zend/zend_vm_execute.h
|
||||
+++ b/Zend/zend_vm_execute.h
|
||||
@@ -6348,6 +6348,9 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -6355,6 +6358,9 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -8225,7 +8231,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_TMPVAR_HANDL
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -8234,6 +8240,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_TMPVAR_HANDL
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -8641,6 +8650,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_TMPVAR_
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -8648,6 +8660,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_TMPVAR_
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -10613,7 +10628,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_CV_HANDLER(Z
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -10622,6 +10637,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_CV_HANDLER(Z
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -11029,6 +11047,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_CV_HAND
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -11036,6 +11057,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_CV_HAND
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -14644,7 +14668,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CONST_HANDL
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -14653,6 +14677,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CONST_HANDL
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -15374,6 +15401,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CONST_
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -15381,6 +15411,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CONST_
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -16067,7 +16100,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_TMPVAR_HAND
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -16076,6 +16109,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_TMPVAR_HAND
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -16797,6 +16833,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_TMPVAR
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -16804,6 +16843,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_TMPVAR
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -17744,7 +17786,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CV_HANDLER(
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -17753,6 +17795,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CV_HANDLER(
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -18112,6 +18157,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CV_HAN
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -18119,6 +18167,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CV_HAN
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -39226,7 +39277,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CONST_HANDLER(Z
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -39235,6 +39286,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CONST_HANDLER(Z
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -41677,6 +41731,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CONST_HAND
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -41684,6 +41741,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CONST_HAND
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -42951,7 +43011,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_TMPVAR_HANDLER(
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -42960,6 +43020,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_TMPVAR_HANDLER(
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -45331,6 +45394,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_TMPVAR_HAN
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -45338,6 +45404,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_TMPVAR_HAN
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -48150,7 +48219,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
}
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -48159,6 +48228,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
@@ -50629,6 +50701,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CV_HANDLER
|
||||
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
|
||||
size_t len = ZSTR_LEN(op1_str);
|
||||
|
||||
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
|
||||
@@ -50636,6 +50711,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CV_HANDLER
|
||||
zend_string_release_ex(op2_str, 0);
|
||||
}
|
||||
} else {
|
||||
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
|
||||
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
|
||||
+ }
|
||||
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
|
||||
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
|
||||
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
|
||||
diff --git a/ext/session/session.c b/ext/session/session.c
|
||||
index 3c875296c3..0c45b1bb41 100644
|
||||
--- a/ext/session/session.c
|
||||
+++ b/ext/session/session.c
|
||||
@@ -3017,7 +3017,7 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
|
||||
if (php_session_rfc1867_orig_callback) {
|
||||
retval = php_session_rfc1867_orig_callback(event, event_data, extra);
|
||||
}
|
||||
- if (!PS(rfc1867_enabled)) {
|
||||
+ if (!PS(rfc1867_enabled) || true) {
|
||||
return retval;
|
||||
}
|
||||
|
||||
diff --git a/main/SAPI.c b/main/SAPI.c
|
||||
index eea417cedc..85d964d21b 100644
|
||||
--- a/main/SAPI.c
|
||||
+++ b/main/SAPI.c
|
||||
@@ -503,18 +503,23 @@ SAPI_API void sapi_deactivate_module(void)
|
||||
}
|
||||
if (SG(request_info).auth_user) {
|
||||
efree(SG(request_info).auth_user);
|
||||
+ SG(request_info).auth_user = NULL;
|
||||
}
|
||||
if (SG(request_info).auth_password) {
|
||||
efree(SG(request_info).auth_password);
|
||||
+ SG(request_info).auth_password = NULL;
|
||||
}
|
||||
if (SG(request_info).auth_digest) {
|
||||
efree(SG(request_info).auth_digest);
|
||||
+ SG(request_info).auth_digest = NULL;
|
||||
}
|
||||
if (SG(request_info).content_type_dup) {
|
||||
efree(SG(request_info).content_type_dup);
|
||||
+ SG(request_info).content_type_dup = NULL;
|
||||
}
|
||||
if (SG(request_info).current_user) {
|
||||
efree(SG(request_info).current_user);
|
||||
+ SG(request_info).current_user = NULL;
|
||||
}
|
||||
if (sapi_module.deactivate) {
|
||||
sapi_module.deactivate();
|
||||
diff --git a/main/main.c b/main/main.c
|
||||
index c58ea58bf5..48feda4bc7 100644
|
||||
--- a/main/main.c
|
||||
+++ b/main/main.c
|
||||
@@ -1847,6 +1847,8 @@ void php_request_shutdown(void *dummy)
|
||||
|
||||
for (i=0; i<NUM_TRACK_VARS; i++) {
|
||||
zval_ptr_dtor(&PG(http_globals)[i]);
|
||||
+ /* May be accessed before php_request_startup() */
|
||||
+ ZVAL_UNDEF(&PG(http_globals)[i]);
|
||||
}
|
||||
} zend_end_try();
|
||||
|
||||
@@ -1878,6 +1880,7 @@ void php_request_shutdown(void *dummy)
|
||||
|
||||
/* 15. Free Willy (here be crashes) */
|
||||
zend_interned_strings_deactivate();
|
||||
+ clear_last_error();
|
||||
zend_try {
|
||||
shutdown_memory_manager(CG(unclean_shutdown) || !report_memleaks, 0);
|
||||
} zend_end_try();
|
||||
@@ -1901,6 +1904,9 @@ void php_request_shutdown(void *dummy)
|
||||
#ifdef HAVE_DTRACE
|
||||
DTRACE_REQUEST_SHUTDOWN(SAFE_FILENAME(SG(request_info).path_translated), SAFE_FILENAME(SG(request_info).request_uri), (char *)SAFE_FILENAME(SG(request_info).request_method));
|
||||
#endif /* HAVE_DTRACE */
|
||||
+
|
||||
+ /* May be accessed before php_request_startup() */
|
||||
+ PG(modules_activated) = 0;
|
||||
}
|
||||
/* }}} */
|
||||
|
||||
diff --git a/main/php_variables.c b/main/php_variables.c
|
||||
index 27a9ad089e..b17673060a 100644
|
||||
--- a/main/php_variables.c
|
||||
+++ b/main/php_variables.c
|
||||
@@ -213,7 +213,7 @@ PHPAPI void php_register_variable_ex(const char *var_name, zval *val, zval *trac
|
||||
}
|
||||
|
||||
if (!index) {
|
||||
- array_init(&gpc_element);
|
||||
+ array_init_singleton(&gpc_element);
|
||||
if ((gpc_element_p = zend_hash_next_index_insert(symtable1, &gpc_element)) == NULL) {
|
||||
zend_array_destroy(Z_ARR(gpc_element));
|
||||
zval_ptr_dtor_nogc(val);
|
||||
@@ -224,7 +224,7 @@ PHPAPI void php_register_variable_ex(const char *var_name, zval *val, zval *trac
|
||||
gpc_element_p = zend_symtable_str_find(symtable1, index, index_len);
|
||||
if (!gpc_element_p) {
|
||||
zval tmp;
|
||||
- array_init(&tmp);
|
||||
+ array_init_singleton(&tmp);
|
||||
gpc_element_p = zend_symtable_str_update_ind(symtable1, index, index_len, &tmp);
|
||||
} else {
|
||||
if (Z_TYPE_P(gpc_element_p) == IS_INDIRECT) {
|
||||
@@ -232,7 +232,7 @@ PHPAPI void php_register_variable_ex(const char *var_name, zval *val, zval *trac
|
||||
}
|
||||
if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) {
|
||||
zval_ptr_dtor_nogc(gpc_element_p);
|
||||
- array_init(gpc_element_p);
|
||||
+ array_init_singleton(gpc_element_p);
|
||||
} else {
|
||||
SEPARATE_ARRAY(gpc_element_p);
|
||||
}
|
||||
@@ -424,7 +424,7 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
|
||||
case PARSE_POST:
|
||||
case PARSE_GET:
|
||||
case PARSE_COOKIE:
|
||||
- array_init(&array);
|
||||
+ array_init_singleton(&array);
|
||||
switch (arg) {
|
||||
case PARSE_POST:
|
||||
zval_ptr_dtor_nogc(&PG(http_globals)[TRACK_VARS_POST]);
|
||||
diff --git a/main/rfc1867.c b/main/rfc1867.c
|
||||
index 3086e8da3d..b64574505d 100644
|
||||
--- a/main/rfc1867.c
|
||||
+++ b/main/rfc1867.c
|
||||
@@ -390,6 +390,14 @@ static int find_boundary(multipart_buffer *self, char *boundary)
|
||||
return 0;
|
||||
}
|
||||
|
||||
+static zend_bool php_mime_should_save_hdr(const char *name)
|
||||
+{
|
||||
+ return !strcasecmp(name, "Content-Disposition")
|
||||
+ || !strcasecmp(name, "Content-Type");
|
||||
+}
|
||||
+
|
||||
+static char *php_mime_get_hdr_value(zend_llist header, char *key);
|
||||
+
|
||||
/* parse headers */
|
||||
static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
|
||||
{
|
||||
@@ -430,10 +438,16 @@ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
|
||||
}
|
||||
|
||||
*value = '\0';
|
||||
- do { value++; } while (isspace(*value));
|
||||
|
||||
- key = estrdup(line);
|
||||
- smart_string_appends(&buf_value, value);
|
||||
+ /* Keep only headers we use, and ignore duplicates */
|
||||
+ if (!php_mime_should_save_hdr(line)
|
||||
+ || php_mime_get_hdr_value(*header, line)) {
|
||||
+ key = NULL;
|
||||
+ } else {
|
||||
+ key = estrdup(line);
|
||||
+ do { value++; } while (isspace((unsigned char)*value));
|
||||
+ smart_string_appends(&buf_value, value);
|
||||
+ }
|
||||
} else if (buf_value.c) { /* If no ':' on the line, add to previous line */
|
||||
smart_string_appends(&buf_value, line);
|
||||
} else {
|
||||
@@ -507,11 +521,11 @@ static char *php_ap_getword(const zend_encoding *encoding, char **line, char sto
|
||||
return res;
|
||||
}
|
||||
|
||||
-static char *substring_conf(char *start, int len, char quote)
|
||||
+static char *substring_conf(char *start, size_t len, char quote)
|
||||
{
|
||||
char *result = emalloc(len + 1);
|
||||
char *resp = result;
|
||||
- int i;
|
||||
+ size_t i;
|
||||
|
||||
for (i = 0; i < len && start[i] != quote; ++i) {
|
||||
if (start[i] == '\\' && (start[i + 1] == '\\' || (quote && start[i + 1] == quote))) {
|
||||
@@ -539,14 +553,14 @@ static char *php_ap_getword_conf(const zend_encoding *encoding, char *str)
|
||||
char quote = *str;
|
||||
|
||||
str++;
|
||||
- return substring_conf(str, (int)strlen(str), quote);
|
||||
+ return substring_conf(str, strlen(str), quote);
|
||||
} else {
|
||||
char *strend = str;
|
||||
|
||||
while (*strend && !isspace(*strend)) {
|
||||
++strend;
|
||||
}
|
||||
- return substring_conf(str, strend - str, 0);
|
||||
+ return substring_conf(str, (size_t)(strend - str), 0);
|
||||
}
|
||||
}
|
||||
|
||||
--
|
||||
2.56.0
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
# https://github.com/php/php-src/commit/82f8f31b16a035c1b67cc253e79f7cc288f4cc20 (branch PHP-8.0-CVE-2026-109618-109619)
|
||||
0001-Avoid-state-corruption-via-bailout.patch
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,2 +0,0 @@
|
||||
# https://github.com/php/php-src/commit/1d7dec178a094e6e75b229ce22754045f8c6070a (branch PHP-8.1-CVE-2026-109618-109619)
|
||||
0001-Avoid-state-corruption-via-bailout.patch
|
||||
@@ -1,13 +1,30 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
# Applies the patches listed in "$1/series" to /usr/src/php.tar.xz and repacks it in place, so the
|
||||
# official build and any later "docker-php-ext-install" compile the patched sources.
|
||||
# Applies the patches listed in the series file "$1" to /usr/src/php.tar.xz and repacks it in
|
||||
# place, so the official build and any later "docker-php-ext-install" compile the patched sources.
|
||||
# "$2" holds deb.sury.org's patches, as unpacked from the Salsa archive.
|
||||
|
||||
patchDir="$1"
|
||||
series="$1"
|
||||
set -- "$2"/*/debian/patches
|
||||
if [ $# -ne 1 ] || [ ! -f "$1/series" ]; then
|
||||
echo >&2 "error: no debian/patches with a series in the Salsa archive"
|
||||
exit 1
|
||||
fi
|
||||
debDir="$1"
|
||||
src=/usr/src/php.tar.xz
|
||||
work="$(mktemp -d)"
|
||||
|
||||
# every patch of deb.sury.org's series must be listed, applied or commented out, so a new revision
|
||||
# can't add patches nobody has reviewed
|
||||
grep -v -e '^[[:space:]]*#' -e '^[[:space:]]*$' "$debDir/series" | awk '{ print $1 }' > "$work/deb"
|
||||
sed -n -e '/^[^#[:space:]]/p' -e 's/^# [a-z]*: \([^ ]*\.patch\)$/\1/p' "$series" > "$work/ours"
|
||||
if ! diff -u "$work/deb" "$work/ours" > "$work/diff"; then
|
||||
echo >&2 "error: $series doesn't match deb.sury.org's series:"
|
||||
cat >&2 "$work/diff"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
installed=
|
||||
# busybox's patch (old Alpine releases) lacks -d and the long options used below
|
||||
if ! patch --version 2> /dev/null | grep -q GNU; then
|
||||
@@ -24,9 +41,9 @@ fi
|
||||
mkdir "$work/php"
|
||||
tar -xJf "$src" -C "$work/php" --strip-components=1
|
||||
|
||||
grep -v -e '^[[:space:]]*#' -e '^[[:space:]]*$' "$patchDir/series" | while read -r p; do
|
||||
grep -v -e '^[[:space:]]*#' -e '^[[:space:]]*$' "$series" | while read -r p; do
|
||||
echo "Applying $p"
|
||||
patch -d "$work/php" -p1 --forward --no-backup-if-mismatch < "$patchDir/$p"
|
||||
patch -d "$work/php" -p1 --forward --no-backup-if-mismatch < "$debDir/$p"
|
||||
done
|
||||
|
||||
tar -cJf "$src" -C "$work" php
|
||||
|
||||
@@ -0,0 +1,272 @@
|
||||
# Allow-list over deb.sury.org's debian/patches/series, at the Salsa commit in DEB_PATCHES
|
||||
# (eol/<version>/*/Dockerfile). Every patch of that series appears here in its order; the
|
||||
# commented-out ones are left out:
|
||||
# - packaging: Debian paths, defaults and packaging;
|
||||
# - build: build-system changes for other libraries or toolchains than our bases';
|
||||
# - behaviour: changed defaults or new features;
|
||||
# - tests: test-only changes that need a left-out patch;
|
||||
# - telemetry: deb.sury.org's DNS version check, which reports the PHP version to its server.
|
||||
# packaging: 0001-libtool_fixes.patch
|
||||
# packaging: 0002-static_openssl.patch
|
||||
# packaging: 0003-debian_quirks.patch
|
||||
# packaging: 0004-libtool2.2.patch
|
||||
# packaging: 0005-we_WANT_libtool.patch
|
||||
# packaging: 0006-php-5.4.9-phpinfo.patch
|
||||
# packaging: 0007-extension_api.patch
|
||||
# packaging: 0008-no_apache_installed.patch
|
||||
# packaging: 0009-recode_is_shared.patch
|
||||
# packaging: 0010-proc_open.patch
|
||||
# packaging: 0011-php.ini_securitynotes.patch
|
||||
# packaging: 0012-php-5.4.7-libdb.patch
|
||||
# packaging: 0013-use_embedded_timezonedb.patch
|
||||
# packaging: 0014-force_libmysqlclient_r.patch
|
||||
# packaging: 0015-strcmp_null-OnUpdateErrorLog.patch
|
||||
# packaging: 0016-dont-gitclean-in-build.patch
|
||||
# packaging: 0017-qdbm-is-usr_include_qdbm.patch
|
||||
# packaging: 0018-session_save_path.patch
|
||||
# packaging: 0019-php-fpm-man-section-and-cleanup.patch
|
||||
# packaging: 0020-fpm-config.patch
|
||||
# packaging: 0021-php-fpm-sysconfdir.patch
|
||||
# packaging: 0022-lp564920-fix-big-files.patch
|
||||
# packaging: 0023-temporary-path-fixes-for-multiarch.patch
|
||||
# packaging: 0024-hurd-noptrace.patch
|
||||
# packaging: 0025-php-5.3.9-mysqlnd.patch
|
||||
# packaging: 0026-php-5.3.9-gnusrc.patch
|
||||
# packaging: 0027-php-5.3.3-macropen.patch
|
||||
# packaging: 0028-php-5.2.4-norpath.patch
|
||||
# packaging: 0029-php-5.2.4-embed.patch
|
||||
# packaging: 0030-php-fpm-m68k.patch
|
||||
# packaging: 0031-expose_all_built_and_installed_apis.patch
|
||||
# packaging: 0032-Use-system-timezone.patch
|
||||
# packaging: 0033-zlib-largefile-function-renaming.patch
|
||||
# packaging: 0034-php-fpm-do-reload-on-SIGHUP.patch
|
||||
# packaging: 0035-php-5.4.8-ldap_r.patch
|
||||
# packaging: 0036-php-5.4.9-fixheader.patch
|
||||
# packaging: 0037-php-5.6.0-noNO.patch
|
||||
# packaging: 0038-php-5.6.0-oldpcre.patch
|
||||
# packaging: 0039-hack-phpdbg-to-explicitly-link-with-libedit.patch
|
||||
# packaging: 0040-Fix-ZEND_MM_ALIGNMENT-on-m64k.patch
|
||||
# packaging: 0041-Add-patch-to-remove-build-timestamps-from-generated-.patch
|
||||
# packaging: 0042-Remove-W3C-validation-icon-to-not-expose-the-reader-.patch
|
||||
# packaging: 0043-strtod_arm_fix.patch
|
||||
# packaging: 0044-sybase-alias.patch
|
||||
# packaging: 0045-use_embedded_timezonedb_fixes.patch
|
||||
# packaging: 0046-php-5.4.0-dlopen.patch
|
||||
# packaging: 0047-Disable-apxs2-module-activation-on-sapi-install.patch
|
||||
# packaging: 0048-Remove-warning-about-mysql-library-minor-version-mis.patch
|
||||
# packaging: 0049-XMLRPC-EPI-library-has-to-be-linked-as-lxmlrpc-epi.patch
|
||||
# packaging: 0050-Don-t-put-INSTALL_ROOT-into-phar.phar-exec-stanza.patch
|
||||
# packaging: 0051-make-opcache-lockfile-path-configurable.patch
|
||||
# packaging: 0052-Really-expand-libdir-datadir-into-EXPANDED_LIBDIR-DA.patch
|
||||
# build: 0053-Adjust-tidy-extension-for-tidy-html5.patch
|
||||
# build: 0054-Fix-check-for-CURL-include-in-M-A-directory.patch
|
||||
# build: 0055-Use-OpenSSL-1.1-compatibility-patch-when-built-with-.patch
|
||||
0056-Fix-PHP-bug-64827-Segfault-in-zval_mark_grey-zend_gc.patch
|
||||
# build: 0057-Use-pkg-config-for-FreeType2-detection.patch
|
||||
0058-Fix-bug-77396-Null-Pointer-Dereference-in-phar_creat.patch
|
||||
0059-Fix-77431-SplFileInfo-__construct-accepts-NUL-bytes.patch
|
||||
0060-Fix-test.patch
|
||||
0061-Fix-integer-overflows-on-32-bits.patch
|
||||
0062-Fix-bug-77540-Invalid-Read-on-exif_process_SOFn.patch
|
||||
0063-Fix-bug-77563-Uninitialized-read-in-exif_process_IFD.patch
|
||||
0064-Fix-test-error-message.patch
|
||||
0065-Fix-bug-77586-phar_tar_writeheaders_int-buffer-overf.patch
|
||||
0066-Fix-test.patch
|
||||
0067-Fix-bug-77630-safer-rename-procedure.patch
|
||||
0068-Fix-test-portability.patch
|
||||
0069-Update-NEWS.patch
|
||||
# build: 0070-Use-pkg-config-for-ICU-as-the-old-icu-config-has-bee.patch
|
||||
# build: 0071-ext-intl-Use-C-namespaces-for-ICU-63.1.patch
|
||||
# build: 0072-Fix-rl_completion_matches-compilation-with-newer-lib.patch
|
||||
0073-SQLite3-add-DEFENSIVE-config-for-SQLite-3.26.0-as-a-.patch
|
||||
0074-Fix-bug-77753-Heap-buffer-overflow-in-php_ifd_get32s.patch
|
||||
0075-Fixed-bug-77831-Heap-buffer-overflow-in-exif_iif_add.patch
|
||||
0076-Pointer-arithmetic-on-void-pointers-is-illegal.patch
|
||||
# build: 0077-Amend-C-11-for-intl-compilation-on-older-distributio.patch
|
||||
0078-Skip-test-on-PostgreSQL-10.patch
|
||||
0079-Fix-tests-wrt.-internationalization.patch
|
||||
0080-Fix-bug-77950-Heap-buffer-overflow-in-_estrndup-via-.patch
|
||||
# build: 0081-Fix-potential-expanded-command-line-too-long-build-e.patch
|
||||
0082-Fix-77973-Uninitialized-read-in-gdImageCreateFromXbm.patch
|
||||
0083-Fix-bug-78069-Out-of-bounds-read-in-iconv.c-_php_ico.patch
|
||||
0084-fix-test-output.patch
|
||||
0085-Fix-bug-77988-heap-buffer-overflow-on-php_jpg_get16.patch
|
||||
0086-Fix-bug-77967-Bypassing-open_basedir-restrictions-vi.patch
|
||||
# tests: 0087-fix-tests.patch
|
||||
0088-Upgrade-to-SQLite-3.28.0.patch
|
||||
0089-Add-support-for-xfail-to-phpt-SKIPIF-sections.patch
|
||||
0090-xfail-phar-tests.patch
|
||||
0091-Fix-bug-78222-heap-buffer-overflow-on-exif_scan_thum.patch
|
||||
0092-Fix-bug-78256-heap-buffer-overflow-on-exif_process_u.patch
|
||||
0093-Fix-77919-Potential-UAF-in-Phar-RSHUTDOWN.patch
|
||||
# build: 0094-Make-use-of-pkg-config-for-libxml2.patch
|
||||
0095-Fix-75457-heap-use-after-free-in-php7.0.25.patch
|
||||
0096-Fix-CVE-2019-13224-don-t-allow-different-encodings-f.patch
|
||||
0097-NEWS.patch
|
||||
0098-relax-test-offset-may-be-different-on-various-system.patch
|
||||
0099-Fix-erroneous-test-expectation.patch
|
||||
0100-Fix-getColumnMeta-test.patch
|
||||
0101-test-fixes.patch
|
||||
0102-Fixed-test-on-32-bit-systems.patch
|
||||
0103-Prevent-test-case-failure.patch
|
||||
0104-Fix-bug-78599-env_path_info-underflow-can-lead-to-RC.patch
|
||||
0105-add-NEWS-entry.patch
|
||||
0106-Fix-78878-Buffer-underflow-in-bc_shift_addsub.patch
|
||||
0107-Fix-78862-link-silently-truncates-after-a-null-byte-.patch
|
||||
0108-Fix-78863-DirectoryIterator-class-silently-truncates.patch
|
||||
0109-Fix-bug-78793.patch
|
||||
0110-Fixed-bug-78910.patch
|
||||
0111-Fix-tests.patch
|
||||
0112-fork-tests.patch
|
||||
0113-Fix-tests.patch
|
||||
0114-fix-test.patch
|
||||
0115-Extend-test-latest-cURL-ships-also-with-smb-and-smbs.patch
|
||||
0116-Sync-test-for-libcurl-7.64.0.patch
|
||||
0117-Sync-test-with-changes-in-libcurl-7.64.0.patch
|
||||
0118-Fix-ext-mysql-tests.patch
|
||||
0119-Clean-up-server-tests.php-remains.patch
|
||||
0120-refix-test.patch
|
||||
0121-Fix-test-when-it-s-run-on-another-drive.patch
|
||||
0122-Fix-test.patch
|
||||
0123-fix-remaining-tests-for-Opcache-runs.patch
|
||||
0124-Fix-79099-OOB-read-in-php_strip_tags_ex.patch
|
||||
0125-Fix-bug-79037-global-buffer-overflow-in-mbfl_filt_co.patch
|
||||
0126-update-NEWS.patch
|
||||
0127-Fix-MSVC-build.patch
|
||||
0128-More-checks-for-php_strip_tags_ex.patch
|
||||
0129-Fix-test-cases.patch
|
||||
0130-Fix-bug-79221-Null-Pointer-Dereference-in-PHP-Sessio.patch
|
||||
0131-Fix-bug-79082-Files-added-to-tar-with-Phar-buildFrom.patch
|
||||
0132-NEWS.patch
|
||||
0133-renew-certs-for-openssl-tests.patch
|
||||
# build: 0134-Use-pkg-config-for-PHP_SETUP_LIBXML.patch
|
||||
0135-Fixed-bug-79282.patch
|
||||
0136-Fix-test.patch
|
||||
0137-fix-test.patch
|
||||
0138-Fix-bug-79329-get_headers-should-not-accept-0.patch
|
||||
0139-Update-NEWS.patch
|
||||
0140-Fix-bug-79330-make-all-execution-modes-consistent-in.patch
|
||||
0141-Fix-bug-79465-use-unsigneds-as-indexes.patch
|
||||
0142-NEWS.patch
|
||||
0143-ZTS.patch
|
||||
0144-Fix-bug-72333-fwrite-on-non-blocking-SSL-sockets-doe.patch
|
||||
0145-Backport-the-aarch64-ZEND_SIGNED_MULTIPLY_LONG-assem.patch
|
||||
0146-Fix-Bug-79296-ZipArchive-open-fails-on-empty-file.patch
|
||||
0147-Backports-from-7.2.31.patch
|
||||
# behaviour: 0148-Allow-numeric-UG-ID-in-FPM-listen.-owner-group.patch
|
||||
0149-Fix-79797-Use-of-freed-hash-key-in-the-phar_parse_zi.patch
|
||||
0150-Fix-79877-getimagesize-function-silently-truncates-a.patch
|
||||
0151-ZTS-fix.patch
|
||||
# build: 0152-Fixed-phpdbg-build-broken-when-dtrace-enabled.patch
|
||||
0153-Do-not-decode-cookie-names-anymore.patch
|
||||
0154-NEWS.patch
|
||||
# build: 0155-Add-pkg-config-m4-files-to-phpize-script.patch
|
||||
# build: 0156-In-phpize-also-copy-config.guess-config.sub-ltmain.s.patch
|
||||
0157-Fix-77423-parse_url-will-deliver-a-wrong-host-to-use.patch
|
||||
0158-NEWS.patch
|
||||
0159-Alternative-fix-for-bug-77423.patch
|
||||
0160-Fix-bug-80672-Null-Dereference-in-SoapClient.patch
|
||||
0161-Fix-build.patch
|
||||
# build: 0162-Use-libenchant-2-when-available.patch
|
||||
# build: 0163-remove-deprecated-call-and-deprecate-function-to-be-.patch
|
||||
0164-Patch-mysql-with-utf8mb4-character-set.patch
|
||||
# packaging: 0165-Show-packaging-credits.patch
|
||||
# packaging: 0166-Allow-printing-credits-buffer-larger-than-4k.patch
|
||||
0167-Fix-80710-imap_mail_compose-header-injection.patch
|
||||
0168-Add-missing-NEWS-entry-for-80710.patch
|
||||
# packaging: 0169-Don-t-close-the-credits-buffer-file-descriptor-too-e.patch
|
||||
0170-Fixed-bug-73512-Fails-to-find-firebird-headers.patch
|
||||
0171-Fix-81122-SSRF-bypass-in-FILTER_VALIDATE_URL.patch
|
||||
0172-Fix-warning.patch
|
||||
0173-Fix-bug-76488-Memory-leak-when-fetching-a-BLOB-field.patch
|
||||
0174-Fix-76452-Crash-while-parsing-blob-data-in-firebird_.patch
|
||||
0175-Fix-76450-SIGSEGV-in-firebird_stmt_execute.patch
|
||||
0176-Fix-76449-SIGSEGV-in-firebird_handle_doer.patch
|
||||
0177-Fix-76448-Stack-buffer-overflow-in-firebird_info_cb.patch
|
||||
0178-Update-NEWS.patch
|
||||
0179-Fixes-65689.-PDO_Firebrid-exec-does-not-free-allocat.patch
|
||||
0180-fix-ibase-handle-initialization-mostly-compiler-warn.patch
|
||||
0181-adapt-for-5.6-without-ZEND_ULONG_MAX.patch
|
||||
0182-Fix-81211-Symlinks-are-followed-when-creating-PHAR-a.patch
|
||||
0183-Fix-test.patch
|
||||
0184-NEWS.patch
|
||||
0185-Fix-bug-81026-PHP-FPM-oob-R-W-in-root-process-leadin.patch
|
||||
0186-NEWS.patch
|
||||
0187-Fix-81420-ZipArchive-extractTo-extracts-outside-of-d.patch
|
||||
0188-NEWS.patch
|
||||
0189-Fix-79971-special-character-is-breaking-the-path-in-.patch
|
||||
0190-fix-new-tests.patch
|
||||
0191-NEWS.patch
|
||||
0192-fix-ZTS.patch
|
||||
# build: 0193-Add-minimal-OpenSSL-3.0-patch.patch
|
||||
# build: 0194-Use-true-false-instead-of-TRUE-FALSE-in-intl.patch
|
||||
# build: 0195-Change-UBool-to-bool-for-equality-operators-in-ICU-7.patch
|
||||
0196-Fix-81720-Uninitialized-array-in-pg_query_params-lea.patch
|
||||
0197-Fix-bug-81719-mysqlnd-pdo-password-buffer-overflow.patch
|
||||
0198-NEWS.patch
|
||||
0199-Fix-bug-79589-ssl3_read_n-unexpected-eof-while-readi.patch
|
||||
0200-Fix-81727-Don-t-mangle-HTTP-variable-names-that-clas.patch
|
||||
0201-Fix-81726-phar-wrapper-DOS-when-using-quine-gzip-fil.patch
|
||||
0202-Fix-regression-introduced-by-fixing-bug-81726.patch
|
||||
0203-fix-NEWS.patch
|
||||
0204-Fix-81740-PDO-quote-may-return-unquoted-string.patch
|
||||
0205-adapt-test-for-5.x.patch
|
||||
0206-NEWS.patch
|
||||
0207-crypt-Fix-validation-of-malformed-BCrypt-hashes.patch
|
||||
0208-crypt-Fix-possible-buffer-overread-in-php_crypt.patch
|
||||
0209-Fix-array-overrun-when-appending-slash-to-paths.patch
|
||||
0210-NEWS.patch
|
||||
0211-Increase-random-bytes-in-HTTP-Digest-authentication-.patch
|
||||
0212-add-cve.patch
|
||||
0213-Fix-buffer-mismanagement-in-phar_dir_read.patch
|
||||
0214-Sanitize-libxml2-globals-before-parsing.patch
|
||||
0215-NEWS.patch
|
||||
0216-fix-backport.patch
|
||||
0217-Sanitize-libxml2-globals-before-parsing-VC11-compati.patch
|
||||
0218-Fix-buffer-mismanagement-in-phar_dir_read-VC11-compa.patch
|
||||
0219-Fix-GHSA-wpj3-hf5j-x4v4-__Host-__Secure-cookie-bypas.patch
|
||||
0220-NEWS.patch
|
||||
0221-Fix-bug-GHSA-q6x7-frmf-grcw-password_verify-can-erro.patch
|
||||
0222-NEWS.patch
|
||||
# build: 0223-Add-missing-declaration-of-mbfl_filt_put_invalid_cha.patch
|
||||
0224-Fix-GHSA-w8qr-v226-r27w.patch
|
||||
0225-NEWS.patch
|
||||
0226-Fix-GHSA-3qgc-jrrr-25jv.patch
|
||||
0227-Fix-GHSA-3qgc-jrrr-25jv-VC11.patch
|
||||
0228-NEWS-Add-backport-from-8.1.29.patch
|
||||
0229-Fix-GHSA-9pqp-7h25-4f32.patch
|
||||
0230-Fix-GHSA-p99j-rfp4-xqvq.patch
|
||||
0231-Fix-GHSA-94p6-54jq-9mwp.patch
|
||||
0232-Skip-GHSA-9pqp-7h25-4f32-test-on-Windows.patch
|
||||
0233-NEWS-for-8.1.30-backports.patch
|
||||
0234-adapt-GHSA-9pqp-7h25-4f32-test-for-7.x.patch
|
||||
0235-Fix-GHSA-c5f2-jwm7-mmq2-stream-HTTP-fulluri-CRLF-inj.patch
|
||||
0236-Fix-GHSA-g665-fm4p-vhff-OOB-access-in-ldap_escape.patch
|
||||
0237-Fix-GHSA-r977-prxv-hc43.patch
|
||||
0238-Fix-74267-segfault-with-streams-and-invalid-data.patch
|
||||
0239-Fix-GHSA-4w77-75f9-2c8w.patch
|
||||
0240-NEWS-for-8.1.31-backports.patch
|
||||
# build: 0241-Force-POSIX-readdir_r-semantics.patch
|
||||
# build: 0242-Disable-the-GCC-major-version-check-in-configure.patch
|
||||
# build: 0243-Force-using-POSIX-threads-on-Linux.patch
|
||||
# build: 0244-Add-ifdef-guards-to-main-php_config.h.in.patch
|
||||
# build: 0245-Actually-use-ICU_CXXFLAGS-when-compiling-ext-intl.patch
|
||||
# build: 0246-Fix-autoconf-errors.patch
|
||||
# build: 0247-Fix-AC_PROG_SED-error-and-other-autoconf-warnings.patch
|
||||
0248-Fix-missing-includes-in-litespeed-build.patch
|
||||
# build: 0249-Add-missing-LSAPI_No_Check_ppid-prototype-to-lsapili.patch
|
||||
# build: 0250-Fix-the-install-rules-for-litespeed-SAPI.patch
|
||||
# telemetry: 0251-Add-minimal-privacy-preserving-secure-DNS-telemetry-.patch
|
||||
# build: 0252-Use-__attribute__-__unused__-directly-instead-of-ATT.patch
|
||||
0253-GHSA-m33r-qmcv-p97q-soap-Fix-use-after-free-after-he.patch
|
||||
0254-GHSA-hmxp-6pc4-f3vv-soap-Fix-broken-Apache-map-value.patch
|
||||
0255-only-test-for-GHSA-96wq-48vp-hh57.patch
|
||||
0256-NEWS-from-8.2.31.patch
|
||||
0257-GHSA-7qg2-v9fj-4mwv-fpm-XSS-within-status-endpoint.patch
|
||||
0258-relax-test-may-fail-when-script-not-in-status-page.patch
|
||||
0259-fix-test-name.patch
|
||||
0260-ext-openssl-openssl_encrypt-zend-mm-heap-overflow-on.patch
|
||||
0261-Avoid-state-corruption-via-bailout.patch
|
||||
0262-Fix-repeated-warning-for-file-uploads-limit-exceedin.patch
|
||||
0263-Introduce-max_multipart_body_parts-INI.patch
|
||||
0264-Add-CVE-2023-0662-to-NEWS.patch
|
||||
@@ -0,0 +1,241 @@
|
||||
# Allow-list over deb.sury.org's debian/patches/series, at the Salsa commit in DEB_PATCHES
|
||||
# (eol/<version>/*/Dockerfile). Every patch of that series appears here in its order; the
|
||||
# commented-out ones are left out:
|
||||
# - packaging: Debian paths, defaults and packaging;
|
||||
# - build: build-system changes for other libraries or toolchains than our bases';
|
||||
# - behaviour: changed defaults or new features;
|
||||
# - tests: test-only changes that need a left-out patch;
|
||||
# - telemetry: deb.sury.org's DNS version check, which reports the PHP version to its server.
|
||||
# packaging: 0001-libtool_fixes.patch
|
||||
# packaging: 0002-static_openssl.patch
|
||||
# packaging: 0003-debian_quirks.patch
|
||||
# packaging: 0004-libtool2.2.patch
|
||||
# packaging: 0005-we_WANT_libtool.patch
|
||||
# packaging: 0006-php-5.4.9-phpinfo.patch
|
||||
# packaging: 0007-extension_api.patch
|
||||
# packaging: 0008-no_apache_installed.patch
|
||||
# packaging: 0009-recode_is_shared.patch
|
||||
# packaging: 0010-proc_open.patch
|
||||
# packaging: 0011-php.ini_securitynotes.patch
|
||||
# packaging: 0012-php-5.4.7-libdb.patch
|
||||
# packaging: 0013-Add-support-for-use-of-the-system-timezone-database.patch
|
||||
# packaging: 0014-force_libmysqlclient_r.patch
|
||||
# packaging: 0015-strcmp_null-OnUpdateErrorLog.patch
|
||||
# packaging: 0016-dont-gitclean-in-build.patch
|
||||
# packaging: 0017-qdbm-is-usr_include_qdbm.patch
|
||||
# packaging: 0018-session_save_path.patch
|
||||
# packaging: 0019-php-fpm-man-section-and-cleanup.patch
|
||||
# packaging: 0020-fpm-config.patch
|
||||
# packaging: 0021-php-fpm-sysconfdir.patch
|
||||
# packaging: 0022-lp564920-fix-big-files.patch
|
||||
# packaging: 0023-temporary-path-fixes-for-multiarch.patch
|
||||
# packaging: 0024-hurd-noptrace.patch
|
||||
# packaging: 0025-php-5.3.9-mysqlnd.patch
|
||||
# packaging: 0026-php-5.3.9-gnusrc.patch
|
||||
# packaging: 0027-php-5.3.3-macropen.patch
|
||||
# packaging: 0028-php-5.2.4-norpath.patch
|
||||
# packaging: 0029-php-5.2.4-embed.patch
|
||||
# packaging: 0030-php-fpm-m68k.patch
|
||||
# packaging: 0031-expose_all_built_and_installed_apis.patch
|
||||
# packaging: 0032-Use-system-timezone.patch
|
||||
# packaging: 0033-zlib-largefile-function-renaming.patch
|
||||
# packaging: 0034-php-fpm-do-reload-on-SIGHUP.patch
|
||||
# packaging: 0035-php-5.4.8-ldap_r.patch
|
||||
# packaging: 0036-php-5.4.9-fixheader.patch
|
||||
# packaging: 0037-php-5.6.0-noNO.patch
|
||||
# packaging: 0038-php-5.6.0-oldpcre.patch
|
||||
# packaging: 0039-hack-phpdbg-to-explicitly-link-with-libedit.patch
|
||||
# packaging: 0040-Fix-ZEND_MM_ALIGNMENT-on-m64k.patch
|
||||
# packaging: 0041-Add-patch-to-install-php7-module-directly-to-APXS_LI.patch
|
||||
# packaging: 0042-Remove-W3C-validation-icon-to-not-expose-the-reader-.patch
|
||||
# packaging: 0043-Don-t-put-INSTALL_ROOT-into-phar.phar-exec-stanza.patch
|
||||
# packaging: 0044-XMLRPC-EPI-library-has-to-be-linked-as-lxmlrpc-epi.patch
|
||||
# packaging: 0045-Really-expand-libdir-datadir-into-EXPANDED_LIBDIR-DA.patch
|
||||
# packaging: 0046-Fix-ext-date-lib-parse_tz-PATH_MAX-HURD-FTBFS.patch
|
||||
# build: 0047-Adjust-tidy-extension-for-tidy-html5.patch
|
||||
# build: 0048-Use-pkg-config-for-FreeType2-detection.patch
|
||||
# packaging: 0049-Use-SOURCE_DATE_EPOCH-as-PHP_BUILD_DATE-if-available.patch
|
||||
0050-CVE-2019-9020.patch
|
||||
0051-CVE-2019-9021.patch
|
||||
0052-CVE-2019-9022-caa.patch
|
||||
0053-CVE-2019-9022.patch
|
||||
0054-CVE-2019-9023-1.patch
|
||||
0055-CVE-2019-9023-2.patch
|
||||
0056-CVE-2019-9023-3.patch
|
||||
0057-CVE-2019-9023-4.patch
|
||||
0058-CVE-2019-9024.patch
|
||||
0059-Fix-bug-77396-Null-Pointer-Dereference-in-phar_creat.patch
|
||||
0060-Fix-77431-SplFileInfo-__construct-accepts-NUL-bytes.patch
|
||||
0061-Fix-integer-overflows-on-32-bits.patch
|
||||
0062-Fix-bug-77540-Invalid-Read-on-exif_process_SOFn.patch
|
||||
0063-Fix-bug-77563-Uninitialized-read-in-exif_process_IFD.patch
|
||||
0064-Fix-test-error-message.patch
|
||||
0065-Fix-bug-77586-phar_tar_writeheaders_int-buffer-overf.patch
|
||||
0066-Fix-bug-77630-safer-rename-procedure.patch
|
||||
0067-Fix-test-portability.patch
|
||||
0068-Update-NEWS.patch
|
||||
# build: 0069-Use-pkg-config-for-ICU-as-the-old-icu-config-has-bee.patch
|
||||
# build: 0070-Fix-C-11-and-up-compatibility-for-zend_finite-and-mo.patch
|
||||
# build: 0071-ext-intl-Use-C-namespaces-for-ICU-63.1.patch
|
||||
# build: 0072-Fix-rl_completion_matches-compilation-with-newer-lib.patch
|
||||
0073-SQLite3-add-DEFENSIVE-config-for-SQLite-3.26.0-as-a-.patch
|
||||
0074-Fix-bug-77753-Heap-buffer-overflow-in-php_ifd_get32s.patch
|
||||
0075-Fixed-bug-77831-Heap-buffer-overflow-in-exif_iif_add.patch
|
||||
0076-Pointer-arithmetic-on-void-pointers-is-illegal.patch
|
||||
0077-Fix-tests-wrt.-internationalization.patch
|
||||
0078-Fix-bug-77950-Heap-buffer-overflow-in-_estrndup-via-.patch
|
||||
0079-Fix-77821-Potential-heap-corruption-in-TSendMail.patch
|
||||
0080-Fix-77973-Uninitialized-read-in-gdImageCreateFromXbm.patch
|
||||
0081-Fix-bug-78069-Out-of-bounds-read-in-iconv.c-_php_ico.patch
|
||||
0082-fix-test-output.patch
|
||||
0083-Fix-bug-77988-heap-buffer-overflow-on-php_jpg_get16.patch
|
||||
0084-Fix-bug-77967-Bypassing-open_basedir-restrictions-vi.patch
|
||||
0085-Fixes-3-Updated-tests-to-have-less-fails-due-to-the-.patch
|
||||
0086-Upgrade-to-SQLite-3.28.0.patch
|
||||
0087-Fix-bug-78222-heap-buffer-overflow-on-exif_scan_thum.patch
|
||||
0088-Fix-bug-78256-heap-buffer-overflow-on-exif_process_u.patch
|
||||
0089-Fix-77919-Potential-UAF-in-Phar-RSHUTDOWN.patch
|
||||
0090-CS.patch
|
||||
0091-Fix-CVE-2019-13224-don-t-allow-different-encodings-f.patch
|
||||
0092-Fix-75457-heap-use-after-free-in-php7.0.25.patch
|
||||
0093-NEWS.patch
|
||||
0094-relax-test-offset-may-be-different-on-various-system.patch
|
||||
0095-Fix-Opcache-test-fails-regarding-to-AppVeyor-image-u.patch
|
||||
0096-Fixed-test-on-32-bit-systems.patch
|
||||
0097-Remove-unstable-dns-tests.patch
|
||||
0098-Prevent-test-case-failure.patch
|
||||
0099-Fix-module-name-in-test-cases.patch
|
||||
0100-Fix-test-expectations-to-match-the-implementation.patch
|
||||
0101-Fix-bug-78599-env_path_info-underflow-can-lead-to-RC.patch
|
||||
0102-add-NEWS-entry.patch
|
||||
0103-Fix-78878-Buffer-underflow-in-bc_shift_addsub.patch
|
||||
0104-Fix-78862-link-silently-truncates-after-a-null-byte-.patch
|
||||
0105-Fix-78863-DirectoryIterator-class-silently-truncates.patch
|
||||
0106-Fix-bug-78793.patch
|
||||
0107-Fixed-bug-78910.patch
|
||||
0108-Fix-tests.patch
|
||||
0109-Fix-79099-OOB-read-in-php_strip_tags_ex.patch
|
||||
0110-Fix-bug-79037-global-buffer-overflow-in-mbfl_filt_co.patch
|
||||
0111-update-NEWS.patch
|
||||
0112-More-checks-for-php_strip_tags_ex.patch
|
||||
0113-Fix-77569-Write-Acess-Violation-in-DomImplementation.patch
|
||||
0114-Fix-typo-in-recent-bugfix.patch
|
||||
0115-Fix-bug-79221-Null-Pointer-Dereference-in-PHP-Sessio.patch
|
||||
0116-Fix-bug-79082-Files-added-to-tar-with-Phar-buildFrom.patch
|
||||
0117-NEWS.patch
|
||||
0118-renew-certs-for-openssl-tests.patch
|
||||
# build: 0119-Use-pkg-config-for-PHP_SETUP_LIBXML.patch
|
||||
0120-Fixed-bug-79282.patch
|
||||
0121-Fix-test.patch
|
||||
0122-fix-test.patch
|
||||
0123-Fix-bug-79329-get_headers-should-not-accept-0.patch
|
||||
0124-Update-NEWS.patch
|
||||
0125-Fix-bug-79330-make-all-execution-modes-consistent-in.patch
|
||||
0126-Fix-bug-79465-use-unsigneds-as-indexes.patch
|
||||
0127-NEWS.patch
|
||||
0128-Fix-bug-76895.patch
|
||||
0129-Fix-Bug-79296-ZipArchive-open-fails-on-empty-file.patch
|
||||
0130-Fix-78875-Long-filenames-cause-OOM-and-temp-files-ar.patch
|
||||
0131-Fix-78876-Long-variables-cause-OOM-and-temp-files-ar.patch
|
||||
0132-Update-NEWS.patch
|
||||
# behaviour: 0133-Allow-numeric-UG-ID-in-FPM-listen.-owner-group.patch
|
||||
0134-Fix-79797-Use-of-freed-hash-key-in-the-phar_parse_zi.patch
|
||||
0135-Fix-79877-getimagesize-function-silently-truncates-a.patch
|
||||
0136-Do-not-decode-cookie-names-anymore.patch
|
||||
0137-NEWS.patch
|
||||
# build: 0138-Add-pkg-config-m4-files-to-phpize-script.patch
|
||||
# build: 0139-In-phpize-also-copy-config.guess-config.sub-ltmain.s.patch
|
||||
0140-Fix-77423-parse_url-will-deliver-a-wrong-host-to-use.patch
|
||||
0141-NEWS.patch
|
||||
0142-Alternative-fix-for-bug-77423.patch
|
||||
0143-Fix-bug-80672-Null-Dereference-in-SoapClient.patch
|
||||
0144-Fix-build.patch
|
||||
# build: 0145-Use-libenchant-2-when-available.patch
|
||||
# build: 0146-remove-deprecated-call-and-deprecate-function-to-be-.patch
|
||||
# packaging: 0147-Show-packaging-credits.patch
|
||||
# packaging: 0148-Allow-printing-credits-buffer-larger-than-4k.patch
|
||||
0149-Fix-80710-imap_mail_compose-header-injection.patch
|
||||
0150-Add-missing-NEWS-entry-for-80710.patch
|
||||
# packaging: 0151-Don-t-close-the-credits-buffer-file-descriptor-too-e.patch
|
||||
0152-Fixed-bug-73512-Fails-to-find-firebird-headers.patch
|
||||
0153-Fix-81122-SSRF-bypass-in-FILTER_VALIDATE_URL.patch
|
||||
0154-Fix-warning.patch
|
||||
0155-Fix-bug-76488-Memory-leak-when-fetching-a-BLOB-field.patch
|
||||
0156-Fix-76452-Crash-while-parsing-blob-data-in-firebird_.patch
|
||||
0157-Fix-76450-SIGSEGV-in-firebird_stmt_execute.patch
|
||||
0158-Fix-76449-SIGSEGV-in-firebird_handle_doer.patch
|
||||
0159-Fix-76448-Stack-buffer-overflow-in-firebird_info_cb.patch
|
||||
0160-Update-NEWS.patch
|
||||
0161-Fix-81211-Symlinks-are-followed-when-creating-PHAR-a.patch
|
||||
0162-Fix-test.patch
|
||||
0163-NEWS.patch
|
||||
0164-Fix-bug-81026-PHP-FPM-oob-R-W-in-root-process-leadin.patch
|
||||
0165-NEWS.patch
|
||||
0166-Fix-81420-ZipArchive-extractTo-extracts-outside-of-d.patch
|
||||
0167-NEWS.patch
|
||||
0168-Fix-79971-special-character-is-breaking-the-path-in-.patch
|
||||
0169-NEWS.patch
|
||||
0170-fix-new-tests.patch
|
||||
# build: 0171-Add-minimal-OpenSSL-3.0-patch.patch
|
||||
# build: 0172-Use-true-false-instead-of-TRUE-FALSE-in-intl.patch
|
||||
# build: 0173-Change-UBool-to-bool-for-equality-operators-in-ICU-7.patch
|
||||
0174-Fix-81720-Uninitialized-array-in-pg_query_params-lea.patch
|
||||
0175-Fix-bug-81719-mysqlnd-pdo-password-buffer-overflow.patch
|
||||
0176-NEWS.patch
|
||||
0177-Fix-bug-79589-ssl3_read_n-unexpected-eof-while-readi.patch
|
||||
0178-Fix-81727-Don-t-mangle-HTTP-variable-names-that-clas.patch
|
||||
0179-Fix-81726-phar-wrapper-DOS-when-using-quine-gzip-fil.patch
|
||||
0180-Fix-regression-introduced-by-fixing-bug-81726.patch
|
||||
0181-fix-NEWS.patch
|
||||
0182-Fix-81740-PDO-quote-may-return-unquoted-string.patch
|
||||
0183-NEWS.patch
|
||||
0184-crypt-Fix-validation-of-malformed-BCrypt-hashes.patch
|
||||
0185-crypt-Fix-possible-buffer-overread-in-php_crypt.patch
|
||||
0186-Fix-array-overrun-when-appending-slash-to-paths.patch
|
||||
0187-NEWS.patch
|
||||
0188-Fix-missing-randomness-check-and-insufficient-random.patch
|
||||
0189-Fix-GH-11382-add-missing-hash-header-for-bin2hex.patch
|
||||
0190-add-cve.patch
|
||||
0191-Fix-buffer-mismanagement-in-phar_dir_read.patch
|
||||
0192-Sanitize-libxml2-globals-before-parsing.patch
|
||||
0193-NEWS.patch
|
||||
# packaging: 0194-Add-missing-header-includes.patch
|
||||
0195-Fix-GHSA-wpj3-hf5j-x4v4-__Host-__Secure-cookie-bypas.patch
|
||||
0196-NEWS.patch
|
||||
0197-Fix-bug-GHSA-q6x7-frmf-grcw-password_verify-can-erro.patch
|
||||
0198-NEWS.patch
|
||||
0199-Fix-GHSA-w8qr-v226-r27w.patch
|
||||
0200-NEWS.patch
|
||||
0201-Fix-GHSA-3qgc-jrrr-25jv.patch
|
||||
0202-NEWS-Add-backport-from-8.1.29.patch
|
||||
0203-Fix-GHSA-9pqp-7h25-4f32.patch
|
||||
0204-Fix-GHSA-p99j-rfp4-xqvq.patch
|
||||
0205-Fix-GHSA-94p6-54jq-9mwp.patch
|
||||
0206-Skip-GHSA-9pqp-7h25-4f32-test-on-Windows.patch
|
||||
0207-NEWS-for-8.1.30-backports.patch
|
||||
0208-adapt-GHSA-9pqp-7h25-4f32-test-for-7.x.patch
|
||||
0209-Fix-GHSA-5hqh-c84r-qjcv-Integer-overflow-in-the-dbli.patch
|
||||
0210-Fix-GHSA-5hqh-c84r-qjcv-Integer-overflow-in-the-fire.patch
|
||||
0211-backport-ZSTR_MAX_LEN.patch
|
||||
0212-Fix-GHSA-c5f2-jwm7-mmq2-stream-HTTP-fulluri-CRLF-inj.patch
|
||||
0213-Fix-GHSA-g665-fm4p-vhff-OOB-access-in-ldap_escape.patch
|
||||
0214-Fix-GHSA-r977-prxv-hc43.patch
|
||||
0215-Fix-74267-segfault-with-streams-and-invalid-data.patch
|
||||
0216-Fix-GHSA-4w77-75f9-2c8w.patch
|
||||
0217-NEWS-for-8.1.31-backports.patch
|
||||
# build: 0218-Force-POSIX-readdir_r-semantics.patch
|
||||
# build: 0219-Add-ifdef-guards-to-main-php_config.h.in.patch
|
||||
0220-Fix-missing-include-in-litespeed-build.patch
|
||||
# telemetry: 0221-Add-minimal-privacy-preserving-secure-DNS-telemetry-.patch
|
||||
# build: 0222-Use-ZEND_ATTRIBUTE_UNUSED-instead-of-ATTRIBUTE_UNUSE.patch
|
||||
0223-GHSA-85c2-q967-79q5-soap-Fix-stale-SOAP_GLOBAL-ref_m.patch
|
||||
0224-GHSA-m33r-qmcv-p97q-soap-Fix-use-after-free-after-he.patch
|
||||
0225-GHSA-hmxp-6pc4-f3vv-soap-Fix-broken-Apache-map-value.patch
|
||||
0226-GHSA-96wq-48vp-hh57-metaphone-Fix-signed-integer-ove.patch
|
||||
0227-GHSA-7qg2-v9fj-4mwv-fpm-XSS-within-status-endpoint.patch
|
||||
0228-NEWS-from-8.2.31.patch
|
||||
0229-ext-openssl-openssl_encrypt-zend-mm-heap-overflow-on.patch
|
||||
0230-Avoid-state-corruption-via-bailout.patch
|
||||
0231-Fix-repeated-warning-for-file-uploads-limit-exceedin.patch
|
||||
0232-Introduce-max_multipart_body_parts-INI.patch
|
||||
0233-Add-CVE-2023-0662-to-NEWS.patch
|
||||
@@ -0,0 +1,197 @@
|
||||
# Allow-list over deb.sury.org's debian/patches/series, at the Salsa commit in DEB_PATCHES
|
||||
# (eol/<version>/*/Dockerfile). Every patch of that series appears here in its order; the
|
||||
# commented-out ones are left out:
|
||||
# - packaging: Debian paths, defaults and packaging;
|
||||
# - build: build-system changes for other libraries or toolchains than our bases';
|
||||
# - behaviour: changed defaults or new features;
|
||||
# - tests: test-only changes that need a left-out patch;
|
||||
# - telemetry: deb.sury.org's DNS version check, which reports the PHP version to its server.
|
||||
# packaging: 0001-libtool_fixes.patch
|
||||
# packaging: 0002-static_openssl.patch
|
||||
# packaging: 0003-debian_quirks.patch
|
||||
# packaging: 0004-libtool2.2.patch
|
||||
# packaging: 0005-we_WANT_libtool.patch
|
||||
# packaging: 0006-php-5.4.9-phpinfo.patch
|
||||
# packaging: 0007-extension_api.patch
|
||||
# packaging: 0008-no_apache_installed.patch
|
||||
# packaging: 0009-recode_is_shared.patch
|
||||
# packaging: 0010-proc_open.patch
|
||||
# packaging: 0011-php.ini_securitynotes.patch
|
||||
# packaging: 0012-php-5.4.7-libdb.patch
|
||||
# packaging: 0013-Add-support-for-use-of-the-system-timezone-database.patch
|
||||
# packaging: 0014-force_libmysqlclient_r.patch
|
||||
# packaging: 0015-strcmp_null-OnUpdateErrorLog.patch
|
||||
# packaging: 0016-dont-gitclean-in-build.patch
|
||||
# packaging: 0017-qdbm-is-usr_include_qdbm.patch
|
||||
# packaging: 0018-session_save_path.patch
|
||||
# packaging: 0019-php-fpm-man-section-and-cleanup.patch
|
||||
# packaging: 0020-fpm-config.patch
|
||||
# packaging: 0021-php-fpm-sysconfdir.patch
|
||||
# packaging: 0022-lp564920-fix-big-files.patch
|
||||
# packaging: 0023-temporary-path-fixes-for-multiarch.patch
|
||||
# packaging: 0024-hurd-noptrace.patch
|
||||
# packaging: 0025-php-5.3.9-mysqlnd.patch
|
||||
# packaging: 0026-php-5.3.9-gnusrc.patch
|
||||
# packaging: 0027-php-5.3.3-macropen.patch
|
||||
# packaging: 0028-php-5.2.4-norpath.patch
|
||||
# packaging: 0029-php-5.2.4-embed.patch
|
||||
# packaging: 0030-php-fpm-m68k.patch
|
||||
# packaging: 0031-expose_all_built_and_installed_apis.patch
|
||||
# packaging: 0032-Use-system-timezone.patch
|
||||
# packaging: 0033-zlib-largefile-function-renaming.patch
|
||||
# packaging: 0034-php-fpm-do-reload-on-SIGHUP.patch
|
||||
# packaging: 0035-php-5.4.8-ldap_r.patch
|
||||
# packaging: 0036-php-5.6.0-noNO.patch
|
||||
# packaging: 0037-php-5.6.0-oldpcre.patch
|
||||
# packaging: 0038-hack-phpdbg-to-explicitly-link-with-libedit.patch
|
||||
# packaging: 0039-Fix-ZEND_MM_ALIGNMENT-on-m64k.patch
|
||||
# packaging: 0040-Add-patch-to-install-php7-module-directly-to-APXS_LI.patch
|
||||
# packaging: 0041-Remove-W3C-validation-icon-to-not-expose-the-reader-.patch
|
||||
# packaging: 0042-Don-t-put-INSTALL_ROOT-into-phar.phar-exec-stanza.patch
|
||||
# packaging: 0043-XMLRPC-EPI-library-has-to-be-linked-as-lxmlrpc-epi.patch
|
||||
# packaging: 0044-Really-expand-libdir-datadir-into-EXPANDED_LIBDIR-DA.patch
|
||||
# packaging: 0045-Fix-ext-date-lib-parse_tz-PATH_MAX-HURD-FTBFS.patch
|
||||
# build: 0046-Fix-check-for-CURL-include-in-M-A-directory.patch
|
||||
# build: 0047-Use-pkg-config-for-FreeType2-detection.patch
|
||||
# build: 0048-ext-intl-Use-pkg-config-to-detect-icu.patch
|
||||
# build: 0049-Fix-rl_completion_matches-compilation-with-newer-lib.patch
|
||||
# behaviour: 0050-PATCH-Fixed-bug-62596-add-getallheaders-apache_reque.patch
|
||||
0051-Fix-libmagic-buffer-overflow-issue-CVE-2019-18218.patch
|
||||
# packaging: 0052-Rewrite-README.md-for-7.1-branch.patch
|
||||
0053-Fix-78878-Buffer-underflow-in-bc_shift_addsub.patch
|
||||
0054-Fix-78862-link-silently-truncates-after-a-null-byte-.patch
|
||||
0055-Fix-78863-DirectoryIterator-class-silently-truncates.patch
|
||||
0056-Fix-bug-78793.patch
|
||||
0057-Fixed-bug-78910.patch
|
||||
0058-relax-tests.patch
|
||||
0059-Fix-79091-heap-use-after-free-in-session_create_id.patch
|
||||
0060-Fix-79099-OOB-read-in-php_strip_tags_ex.patch
|
||||
0061-Fix-bug-79037-global-buffer-overflow-in-mbfl_filt_co.patch
|
||||
0062-update-NEWS.patch
|
||||
0063-More-checks-for-php_strip_tags_ex.patch
|
||||
0064-Fix-77569-Write-Acess-Violation-in-DomImplementation.patch
|
||||
0065-Fix-typo-in-recent-bugfix.patch
|
||||
0066-Fix-bug-79221-Null-Pointer-Dereference-in-PHP-Sessio.patch
|
||||
0067-Fix-bug-79082-Files-added-to-tar-with-Phar-buildFrom.patch
|
||||
0068-Mark-bug76348.phpt-as-online-test.patch
|
||||
0069-NEWS.patch
|
||||
0070-renew-certs-for-openssl-tests.patch
|
||||
# build: 0071-Use-pkg-config-for-PHP_SETUP_LIBXML.patch
|
||||
0072-Fixed-bug-79282.patch
|
||||
0073-Fix-test.patch
|
||||
0074-fix-test.patch
|
||||
0075-Fix-bug-79329-get_headers-should-not-accept-0.patch
|
||||
0076-Update-NEWS.patch
|
||||
0077-Fix-bug-79330-make-all-execution-modes-consistent-in.patch
|
||||
0078-Fix-bug-79465-use-unsigneds-as-indexes.patch
|
||||
0079-NEWS.patch
|
||||
0080-Fix-bug-76895.patch
|
||||
0081-Fix-Bug-79296-ZipArchive-open-fails-on-empty-file.patch
|
||||
0082-Fix-78875-Long-filenames-cause-OOM-and-temp-files-ar.patch
|
||||
0083-Fix-78876-Long-variables-cause-OOM-and-temp-files-ar.patch
|
||||
0084-Update-NEWS.patch
|
||||
# behaviour: 0085-Allow-numeric-UG-ID-in-FPM-listen.-owner-group.patch
|
||||
0086-Allow-fpm-tests-to-be-run-with-long-socket-path.patch
|
||||
# tests: 0087-Skip-fpm-tests-not-designed-to-be-run-as-root.patch
|
||||
0088-Fix-79797-Use-of-freed-hash-key-in-the-phar_parse_zi.patch
|
||||
0089-Fix-79877-getimagesize-function-silently-truncates-a.patch
|
||||
0090-Fix-bug-79601-Wrong-ciphertext-tag-in-AES-CCM-encryp.patch
|
||||
0091-Fix-bug-78079-openssl_encrypt_ccm.phpt-fails-with-Op.patch
|
||||
0092-Do-not-decode-cookie-names-anymore.patch
|
||||
0093-NEWS.patch
|
||||
# build: 0094-Add-pkg-config-m4-files-to-phpize-script.patch
|
||||
# build: 0095-In-phpize-also-copy-config.guess-config.sub-ltmain.s.patch
|
||||
0096-Fix-77423-parse_url-will-deliver-a-wrong-host-to-use.patch
|
||||
0097-NEWS.patch
|
||||
0098-Alternative-fix-for-bug-77423.patch
|
||||
0099-Fix-bug-80672-Null-Dereference-in-SoapClient.patch
|
||||
0100-Fix-build.patch
|
||||
# build: 0101-Use-libenchant-2-when-available.patch
|
||||
# build: 0102-remove-deprecated-call-and-deprecate-function-to-be-.patch
|
||||
# packaging: 0103-Show-packaging-credits.patch
|
||||
# packaging: 0104-Allow-printing-credits-buffer-larger-than-4k.patch
|
||||
0105-Fix-80710-imap_mail_compose-header-injection.patch
|
||||
0106-Add-missing-NEWS-entry-for-80710.patch
|
||||
# packaging: 0107-Don-t-close-the-credits-buffer-file-descriptor-too-e.patch
|
||||
0108-Fix-81122-SSRF-bypass-in-FILTER_VALIDATE_URL.patch
|
||||
0109-Fix-warning.patch
|
||||
0110-Fix-76452-Crash-while-parsing-blob-data-in-firebird_.patch
|
||||
0111-Fix-76450-SIGSEGV-in-firebird_stmt_execute.patch
|
||||
0112-Fix-76449-SIGSEGV-in-firebird_handle_doer.patch
|
||||
0113-Fix-76448-Stack-buffer-overflow-in-firebird_info_cb.patch
|
||||
0114-Update-NEWS.patch
|
||||
0115-Fix-81211-Symlinks-are-followed-when-creating-PHAR-a.patch
|
||||
0116-Fix-test.patch
|
||||
0117-NEWS.patch
|
||||
0118-Fix-bug-81026-PHP-FPM-oob-R-W-in-root-process-leadin.patch
|
||||
0119-NEWS.patch
|
||||
# packaging: 0120-update-README.patch
|
||||
0121-Fix-81420-ZipArchive-extractTo-extracts-outside-of-d.patch
|
||||
0122-NEWS.patch
|
||||
0123-Fix-79971-special-character-is-breaking-the-path-in-.patch
|
||||
0124-NEWS.patch
|
||||
0125-fix-new-tests.patch
|
||||
# build: 0126-Add-minimal-OpenSSL-3.0-patch.patch
|
||||
# build: 0127-Use-true-false-instead-of-TRUE-FALSE-in-intl.patch
|
||||
# build: 0128-Change-UBool-to-bool-for-equality-operators-in-ICU-7.patch
|
||||
0129-Fix-81720-Uninitialized-array-in-pg_query_params-lea.patch
|
||||
0130-Fix-bug-81719-mysqlnd-pdo-password-buffer-overflow.patch
|
||||
0131-NEWS.patch
|
||||
0132-Fix-bug-79589-ssl3_read_n-unexpected-eof-while-readi.patch
|
||||
0133-Fix-81727-Don-t-mangle-HTTP-variable-names-that-clas.patch
|
||||
0134-Fix-81726-phar-wrapper-DOS-when-using-quine-gzip-fil.patch
|
||||
0135-Fix-regression-introduced-by-fixing-bug-81726.patch
|
||||
0136-fix-NEWS.patch
|
||||
0137-Fix-81740-PDO-quote-may-return-unquoted-string.patch
|
||||
0138-NEWS.patch
|
||||
0139-crypt-Fix-validation-of-malformed-BCrypt-hashes.patch
|
||||
0140-crypt-Fix-possible-buffer-overread-in-php_crypt.patch
|
||||
0141-Fix-array-overrun-when-appending-slash-to-paths.patch
|
||||
0142-NEWS.patch
|
||||
0143-Fix-missing-randomness-check-and-insufficient-random.patch
|
||||
0144-Fix-GH-11382-add-missing-hash-header-for-bin2hex.patch
|
||||
0145-add-cve.patch
|
||||
0146-Fix-buffer-mismanagement-in-phar_dir_read.patch
|
||||
0147-Sanitize-libxml2-globals-before-parsing.patch
|
||||
0148-NEWS.patch
|
||||
0149-Fixed-bug-79412-Opcache-chokes-and-uses-100-CPU-on-s.patch
|
||||
# packaging: 0150-Add-missing-header-includes.patch
|
||||
0151-Fix-GHSA-wpj3-hf5j-x4v4-__Host-__Secure-cookie-bypas.patch
|
||||
0152-NEWS.patch
|
||||
0153-Fix-bug-GHSA-q6x7-frmf-grcw-password_verify-can-erro.patch
|
||||
0154-NEWS.patch
|
||||
0155-Fix-GHSA-w8qr-v226-r27w.patch
|
||||
0156-NEWS.patch
|
||||
0157-Fix-GHSA-3qgc-jrrr-25jv.patch
|
||||
0158-NEWS-Add-backport-from-8.1.29.patch
|
||||
0159-Fix-GHSA-9pqp-7h25-4f32.patch
|
||||
0160-Fix-GHSA-p99j-rfp4-xqvq.patch
|
||||
0161-Fix-GHSA-94p6-54jq-9mwp.patch
|
||||
0162-Skip-GHSA-9pqp-7h25-4f32-test-on-Windows.patch
|
||||
0163-NEWS-for-8.1.30-backports.patch
|
||||
0164-adapt-GHSA-9pqp-7h25-4f32-test-for-7.x.patch
|
||||
0165-Fix-GHSA-5hqh-c84r-qjcv-Integer-overflow-in-the-dbli.patch
|
||||
0166-Fix-GHSA-5hqh-c84r-qjcv-Integer-overflow-in-the-fire.patch
|
||||
0167-backport-ZSTR_MAX_LEN.patch
|
||||
0168-Fix-GHSA-c5f2-jwm7-mmq2-stream-HTTP-fulluri-CRLF-inj.patch
|
||||
0169-Fix-GHSA-g665-fm4p-vhff-OOB-access-in-ldap_escape.patch
|
||||
0170-Fix-GHSA-r977-prxv-hc43.patch
|
||||
0171-Fix-74267-segfault-with-streams-and-invalid-data.patch
|
||||
0172-Fix-GHSA-4w77-75f9-2c8w.patch
|
||||
0173-NEWS-for-8.1.31-backports.patch
|
||||
# build: 0174-Force-POSIX-readdir_r-semantics.patch
|
||||
# build: 0175-Add-ifdef-guards-to-main-php_config.h.in.patch
|
||||
0176-Fix-missing-include-in-litespeed-build.patch
|
||||
# telemetry: 0177-Add-minimal-privacy-preserving-secure-DNS-telemetry-.patch
|
||||
# build: 0178-Use-ZEND_ATTRIBUTE_UNUSED-instead-of-ATTRIBUTE_UNUSE.patch
|
||||
0179-GHSA-85c2-q967-79q5-soap-Fix-stale-SOAP_GLOBAL-ref_m.patch
|
||||
0180-GHSA-m33r-qmcv-p97q-soap-Fix-use-after-free-after-he.patch
|
||||
0181-GHSA-hmxp-6pc4-f3vv-soap-Fix-broken-Apache-map-value.patch
|
||||
0182-GHSA-96wq-48vp-hh57-metaphone-Fix-signed-integer-ove.patch
|
||||
0183-GHSA-7qg2-v9fj-4mwv-fpm-XSS-within-status-endpoint.patch
|
||||
0184-NEWS-from-8.2.31.patch
|
||||
0185-ext-openssl-openssl_encrypt-zend-mm-heap-overflow-on.patch
|
||||
0186-Avoid-state-corruption-via-bailout.patch
|
||||
0187-Fix-repeated-warning-for-file-uploads-limit-exceedin.patch
|
||||
0188-Introduce-max_multipart_body_parts-INI.patch
|
||||
0189-Add-CVE-2023-0662-to-NEWS.patch
|
||||
@@ -0,0 +1,167 @@
|
||||
# Allow-list over deb.sury.org's debian/patches/series, at the Salsa commit in DEB_PATCHES
|
||||
# (eol/<version>/*/Dockerfile). Every patch of that series appears here in its order; the
|
||||
# commented-out ones are left out:
|
||||
# - packaging: Debian paths, defaults and packaging;
|
||||
# - build: build-system changes for other libraries or toolchains than our bases';
|
||||
# - behaviour: changed defaults or new features;
|
||||
# - tests: test-only changes that need a left-out patch;
|
||||
# - telemetry: deb.sury.org's DNS version check, which reports the PHP version to its server.
|
||||
# packaging: 0001-libtool_fixes.patch
|
||||
# packaging: 0002-static_openssl.patch
|
||||
# packaging: 0003-debian_quirks.patch
|
||||
# packaging: 0004-libtool2.2.patch
|
||||
# packaging: 0005-we_WANT_libtool.patch
|
||||
# packaging: 0006-php-5.4.9-phpinfo.patch
|
||||
# packaging: 0007-extension_api.patch
|
||||
# packaging: 0008-no_apache_installed.patch
|
||||
# packaging: 0009-recode_is_shared.patch
|
||||
# packaging: 0010-proc_open.patch
|
||||
# packaging: 0011-php.ini_securitynotes.patch
|
||||
# packaging: 0012-php-5.4.7-libdb.patch
|
||||
# packaging: 0013-Add-support-for-use-of-the-system-timezone-database.patch
|
||||
# packaging: 0014-force_libmysqlclient_r.patch
|
||||
# packaging: 0015-strcmp_null-OnUpdateErrorLog.patch
|
||||
# packaging: 0016-dont-gitclean-in-build.patch
|
||||
# packaging: 0017-qdbm-is-usr_include_qdbm.patch
|
||||
# packaging: 0018-session_save_path.patch
|
||||
# packaging: 0019-php-fpm-man-section-and-cleanup.patch
|
||||
# packaging: 0020-fpm-config.patch
|
||||
# packaging: 0021-php-fpm-sysconfdir.patch
|
||||
# packaging: 0022-lp564920-fix-big-files.patch
|
||||
# packaging: 0023-temporary-path-fixes-for-multiarch.patch
|
||||
# packaging: 0024-hurd-noptrace.patch
|
||||
# packaging: 0025-php-5.3.9-mysqlnd.patch
|
||||
# packaging: 0026-php-5.3.9-gnusrc.patch
|
||||
# packaging: 0027-php-5.3.3-macropen.patch
|
||||
# packaging: 0028-php-5.2.4-norpath.patch
|
||||
# packaging: 0029-php-5.2.4-embed.patch
|
||||
# packaging: 0030-php-fpm-m68k.patch
|
||||
# packaging: 0031-expose_all_built_and_installed_apis.patch
|
||||
# packaging: 0032-Use-system-timezone.patch
|
||||
# packaging: 0033-zlib-largefile-function-renaming.patch
|
||||
# packaging: 0034-php-fpm-do-reload-on-SIGHUP.patch
|
||||
# packaging: 0035-php-5.4.8-ldap_r.patch
|
||||
# packaging: 0036-php-5.4.9-fixheader.patch
|
||||
# packaging: 0037-php-5.6.0-noNO.patch
|
||||
# packaging: 0038-php-5.6.0-oldpcre.patch
|
||||
# packaging: 0039-hack-phpdbg-to-explicitly-link-with-libedit.patch
|
||||
# packaging: 0040-Fix-ZEND_MM_ALIGNMENT-on-m64k.patch
|
||||
# packaging: 0041-Add-patch-to-install-php7-module-directly-to-APXS_LI.patch
|
||||
# packaging: 0042-Remove-W3C-validation-icon-to-not-expose-the-reader-.patch
|
||||
# packaging: 0043-Don-t-put-INSTALL_ROOT-into-phar.phar-exec-stanza.patch
|
||||
# packaging: 0044-XMLRPC-EPI-library-has-to-be-linked-as-lxmlrpc-epi.patch
|
||||
# packaging: 0045-Really-expand-libdir-datadir-into-EXPANDED_LIBDIR-DA.patch
|
||||
# packaging: 0046-Fix-ext-date-lib-parse_tz-PATH_MAX-HURD-FTBFS.patch
|
||||
# build: 0047-Use-pkg-config-for-FreeType2-detection.patch
|
||||
# build: 0048-ext-intl-Use-pkg-config-to-detect-icu.patch
|
||||
# behaviour: 0049-Fixed-bug-62596-add-getallheaders-apache_request_hea.patch
|
||||
# build: 0050-Use-pkg-config-for-PHP_SETUP_LIBXML.patch
|
||||
0051-Fix-Bug-79296-ZipArchive-open-fails-on-empty-file.patch
|
||||
# behaviour: 0052-Allow-numeric-UG-ID-in-FPM-listen.-owner-group.patch
|
||||
0053-Allow-fpm-tests-to-be-run-with-long-socket-path.patch
|
||||
# tests: 0054-Skip-fpm-tests-not-designed-to-be-run-as-root.patch
|
||||
# build: 0055-Add-pkg-config-m4-files-to-phpize-script.patch
|
||||
# build: 0056-In-phpize-also-copy-config.guess-config.sub-ltmain.s.patch
|
||||
0057-Fix-77423-parse_url-will-deliver-a-wrong-host-to-use.patch
|
||||
0058-NEWS.patch
|
||||
0059-Alternative-fix-for-bug-77423.patch
|
||||
0060-Fix-bug-80672-Null-Dereference-in-SoapClient.patch
|
||||
0061-Fix-build.patch
|
||||
# build: 0062-Use-libenchant-2-when-available.patch
|
||||
# build: 0063-remove-deprecated-call-and-deprecate-function-to-be-.patch
|
||||
# packaging: 0064-Show-packaging-credits.patch
|
||||
# packaging: 0065-Allow-printing-credits-buffer-larger-than-4k.patch
|
||||
0066-Fix-80710-imap_mail_compose-header-injection.patch
|
||||
0067-Add-missing-NEWS-entry-for-80710.patch
|
||||
# packaging: 0068-Don-t-close-the-credits-buffer-file-descriptor-too-e.patch
|
||||
0069-Fix-81122-SSRF-bypass-in-FILTER_VALIDATE_URL.patch
|
||||
0070-Fix-warning.patch
|
||||
0071-Fix-76452-Crash-while-parsing-blob-data-in-firebird_.patch
|
||||
0072-Fix-76450-SIGSEGV-in-firebird_stmt_execute.patch
|
||||
0073-Fix-76449-SIGSEGV-in-firebird_handle_doer.patch
|
||||
0074-Fix-76448-Stack-buffer-overflow-in-firebird_info_cb.patch
|
||||
0075-Update-NEWS.patch
|
||||
0076-Fix-81211-Symlinks-are-followed-when-creating-PHAR-a.patch
|
||||
0077-Fix-test.patch
|
||||
0078-NEWS.patch
|
||||
0079-Fix-bug-81026-PHP-FPM-oob-R-W-in-root-process-leadin.patch
|
||||
0080-NEWS.patch
|
||||
# packaging: 0081-update-README.patch
|
||||
0082-Fix-81420-ZipArchive-extractTo-extracts-outside-of-d.patch
|
||||
0083-NEWS.patch
|
||||
0084-Fix-79971-special-character-is-breaking-the-path-in-.patch
|
||||
0085-NEWS.patch
|
||||
# build: 0086-Add-minimal-OpenSSL-3.0-patch.patch
|
||||
# build: 0087-Use-true-false-instead-of-TRUE-FALSE-in-intl.patch
|
||||
# build: 0088-Change-UBool-to-bool-for-equality-operators-in-ICU-7.patch
|
||||
0089-Fix-81720-Uninitialized-array-in-pg_query_params-lea.patch
|
||||
0090-Fix-bug-81719-mysqlnd-pdo-password-buffer-overflow.patch
|
||||
0091-NEWS.patch
|
||||
0092-Fix-bug-79589-ssl3_read_n-unexpected-eof-while-readi.patch
|
||||
0093-Fix-81727-Don-t-mangle-HTTP-variable-names-that-clas.patch
|
||||
0094-Fix-81726-phar-wrapper-DOS-when-using-quine-gzip-fil.patch
|
||||
0095-Fix-regression-introduced-by-fixing-bug-81726.patch
|
||||
0096-fix-NEWS.patch
|
||||
0097-Fix-bug-81738-buffer-overflow-in-hash_update-on-long.patch
|
||||
0098-Fix-81740-PDO-quote-may-return-unquoted-string.patch
|
||||
0099-NEWS.patch
|
||||
0100-crypt-Fix-validation-of-malformed-BCrypt-hashes.patch
|
||||
0101-crypt-Fix-possible-buffer-overread-in-php_crypt.patch
|
||||
0102-Fix-array-overrun-when-appending-slash-to-paths.patch
|
||||
0103-NEWS.patch
|
||||
0104-Fix-repeated-warning-for-file-uploads-limit-exceedin.patch
|
||||
0105-Introduce-max_multipart_body_parts-INI.patch
|
||||
0106-NEWS.patch
|
||||
0107-fix-NEWS-not-FPM-specific.patch
|
||||
0108-Fix-missing-randomness-check-and-insufficient-random.patch
|
||||
0109-Fix-GH-11382-add-missing-hash-header-for-bin2hex.patch
|
||||
0110-add-cve.patch
|
||||
0111-Fix-buffer-mismanagement-in-phar_dir_read.patch
|
||||
0112-Sanitize-libxml2-globals-before-parsing.patch
|
||||
0113-backport-zend_test-changes-zend_test_override_libxml.patch
|
||||
0114-adapt-to-7.2.patch
|
||||
0115-NEWS.patch
|
||||
0116-Fixed-bug-79412-Opcache-chokes-and-uses-100-CPU-on-s.patch
|
||||
# behaviour: 0117-Change-the-default-OPcache-optimization-to-7FFEBF5F-.patch
|
||||
# packaging: 0118-Add-missing-header-includes.patch
|
||||
0119-Fix-GHSA-wpj3-hf5j-x4v4-__Host-__Secure-cookie-bypas.patch
|
||||
0120-NEWS.patch
|
||||
0121-Fix-bug-GHSA-q6x7-frmf-grcw-password_verify-can-erro.patch
|
||||
0122-NEWS.patch
|
||||
0123-Fix-GHSA-w8qr-v226-r27w.patch
|
||||
0124-NEWS.patch
|
||||
0125-Fix-GHSA-3qgc-jrrr-25jv.patch
|
||||
0126-NEWS-Add-backport-from-8.1.29.patch
|
||||
0127-Fix-GHSA-9pqp-7h25-4f32.patch
|
||||
0128-Fix-GHSA-p99j-rfp4-xqvq.patch
|
||||
0129-Fix-GHSA-94p6-54jq-9mwp.patch
|
||||
0130-Skip-GHSA-9pqp-7h25-4f32-test-on-Windows.patch
|
||||
0131-NEWS-for-8.1.30-backports.patch
|
||||
0132-adapt-GHSA-9pqp-7h25-4f32-test-for-7.x.patch
|
||||
0133-Fix-GHSA-5hqh-c84r-qjcv-Integer-overflow-in-the-dbli.patch
|
||||
0134-Fix-GHSA-5hqh-c84r-qjcv-Integer-overflow-in-the-fire.patch
|
||||
0135-backport-ZSTR_MAX_LEN.patch
|
||||
0136-Fix-GHSA-c5f2-jwm7-mmq2-stream-HTTP-fulluri-CRLF-inj.patch
|
||||
0137-Fix-GHSA-g665-fm4p-vhff-OOB-access-in-ldap_escape.patch
|
||||
0138-Fix-GHSA-r977-prxv-hc43.patch
|
||||
0139-Fix-74267-segfault-with-streams-and-invalid-data.patch
|
||||
0140-Fix-GHSA-4w77-75f9-2c8w.patch
|
||||
0141-NEWS-for-8.1.31-backports.patch
|
||||
# build: 0142-Force-POSIX-readdir_r-semantics.patch
|
||||
0143-Fix-missing-include-in-litespeed-build.patch
|
||||
# telemetry: 0144-Add-minimal-privacy-preserving-secure-DNS-telemetry-.patch
|
||||
# build: 0145-Use-ZEND_ATTRIBUTE_UNUSED-instead-of-ATTRIBUTE_UNUSE.patch
|
||||
0146-Fix-GHSA-h96m-rvf9-jgm2.patch
|
||||
0147-NEWS.patch
|
||||
0148-GHSA-85c2-q967-79q5-soap-Fix-stale-SOAP_GLOBAL-ref_m.patch
|
||||
0149-GHSA-m33r-qmcv-p97q-soap-Fix-use-after-free-after-he.patch
|
||||
0150-GHSA-hmxp-6pc4-f3vv-soap-Fix-broken-Apache-map-value.patch
|
||||
0151-GHSA-96wq-48vp-hh57-metaphone-Fix-signed-integer-ove.patch
|
||||
0152-GHSA-7qg2-v9fj-4mwv-fpm-XSS-within-status-endpoint.patch
|
||||
0153-NEWS-from-8.2.31.patch
|
||||
0154-ext-openssl-openssl_encrypt-zend-mm-heap-overflow-on.patch
|
||||
0155-libgd-patch-for-CVE-2026-9672.patch
|
||||
0156-Fix-SQL-injection-in-ext-pgsql-via-E-.-backslash-bre.patch
|
||||
0157-Fix-GHSA-vc5h-9ppw-p5f3-phar-circular-symlink-crash.patch
|
||||
0158-NEWS-from-8.2.33.patch
|
||||
0159-Avoid-state-corruption-via-bailout.patch
|
||||
@@ -0,0 +1,147 @@
|
||||
# Allow-list over deb.sury.org's debian/patches/series, at the Salsa commit in DEB_PATCHES
|
||||
# (eol/<version>/*/Dockerfile). Every patch of that series appears here in its order; the
|
||||
# commented-out ones are left out:
|
||||
# - packaging: Debian paths, defaults and packaging;
|
||||
# - build: build-system changes for other libraries or toolchains than our bases';
|
||||
# - behaviour: changed defaults or new features;
|
||||
# - tests: test-only changes that need a left-out patch;
|
||||
# - telemetry: deb.sury.org's DNS version check, which reports the PHP version to its server.
|
||||
# packaging: 0001-libtool_fixes.patch
|
||||
# packaging: 0002-static_openssl.patch
|
||||
# packaging: 0003-debian_quirks.patch
|
||||
# packaging: 0004-libtool2.2.patch
|
||||
# packaging: 0005-we_WANT_libtool.patch
|
||||
# packaging: 0006-php-5.4.9-phpinfo.patch
|
||||
# packaging: 0007-extension_api.patch
|
||||
# packaging: 0008-no_apache_installed.patch
|
||||
# packaging: 0009-recode_is_shared.patch
|
||||
# packaging: 0010-proc_open.patch
|
||||
# packaging: 0011-php.ini_securitynotes.patch
|
||||
# packaging: 0012-php-5.4.7-libdb.patch
|
||||
# packaging: 0013-Add-support-for-use-of-the-system-timezone-database.patch
|
||||
# packaging: 0014-strcmp_null-OnUpdateErrorLog.patch
|
||||
# packaging: 0015-dont-gitclean-in-build.patch
|
||||
# packaging: 0016-qdbm-is-usr_include_qdbm.patch
|
||||
# packaging: 0017-session_save_path.patch
|
||||
# packaging: 0018-php-fpm-man-section-and-cleanup.patch
|
||||
# packaging: 0019-fpm-config.patch
|
||||
# packaging: 0020-php-fpm-sysconfdir.patch
|
||||
# packaging: 0021-lp564920-fix-big-files.patch
|
||||
# packaging: 0022-temporary-path-fixes-for-multiarch.patch
|
||||
# packaging: 0023-hurd-noptrace.patch
|
||||
# packaging: 0024-php-5.3.9-mysqlnd.patch
|
||||
# packaging: 0025-php-5.3.9-gnusrc.patch
|
||||
# packaging: 0026-php-5.3.3-macropen.patch
|
||||
# packaging: 0027-php-5.2.4-norpath.patch
|
||||
# packaging: 0028-php-5.2.4-embed.patch
|
||||
# packaging: 0029-php-fpm-m68k.patch
|
||||
# packaging: 0030-expose_all_built_and_installed_apis.patch
|
||||
# packaging: 0031-Use-system-timezone.patch
|
||||
# packaging: 0032-zlib-largefile-function-renaming.patch
|
||||
# packaging: 0033-php-fpm-do-reload-on-SIGHUP.patch
|
||||
# packaging: 0034-php-5.4.8-ldap_r.patch
|
||||
# packaging: 0035-php-5.4.9-fixheader.patch
|
||||
# packaging: 0036-php-5.6.0-noNO.patch
|
||||
# packaging: 0037-php-5.6.0-oldpcre.patch
|
||||
# packaging: 0038-hack-phpdbg-to-explicitly-link-with-libedit.patch
|
||||
# packaging: 0039-Fix-ZEND_MM_ALIGNMENT-on-m64k.patch
|
||||
# packaging: 0040-Add-patch-to-install-php7-module-directly-to-APXS_LI.patch
|
||||
# packaging: 0041-Remove-W3C-validation-icon-to-not-expose-the-reader-.patch
|
||||
# packaging: 0042-Don-t-put-INSTALL_ROOT-into-phar.phar-exec-stanza.patch
|
||||
# packaging: 0043-XMLRPC-EPI-library-has-to-be-linked-as-lxmlrpc-epi.patch
|
||||
# packaging: 0044-Really-expand-libdir-datadir-into-EXPANDED_LIBDIR-DA.patch
|
||||
# packaging: 0045-Fix-ext-date-lib-parse_tz-PATH_MAX-HURD-FTBFS.patch
|
||||
# build: 0046-Use-pkg-config-for-FreeType2-detection.patch
|
||||
# build: 0047-Use-pkg-config-for-PHP_SETUP_LIBXML.patch
|
||||
# behaviour: 0048-Allow-numeric-UG-ID-in-FPM-listen.-owner-group.patch
|
||||
0049-Allow-fpm-tests-to-be-run-with-long-socket-path.patch
|
||||
# tests: 0050-Skip-fpm-tests-not-designed-to-be-run-as-root.patch
|
||||
# build: 0051-Add-pkg-config-m4-files-to-phpize-script.patch
|
||||
# build: 0052-In-phpize-also-copy-config.guess-config.sub-ltmain.s.patch
|
||||
# build: 0053-Use-libenchant-2-when-available.patch
|
||||
# build: 0054-remove-deprecated-call-and-deprecate-function-to-be-.patch
|
||||
# packaging: 0055-Don-t-use-hrtimers-on-GNU-Hurd.patch
|
||||
# packaging: 0056-Show-packaging-credits.patch
|
||||
# packaging: 0057-Allow-printing-credits-buffer-larger-than-4k.patch
|
||||
# packaging: 0058-Don-t-close-the-credits-buffer-file-descriptor-too-e.patch
|
||||
# build: 0059-Add-minimal-OpenSSL-3.0-patch.patch
|
||||
# build: 0060-Use-true-false-instead-of-TRUE-FALSE-in-intl.patch
|
||||
# build: 0061-Change-UBool-to-bool-for-equality-operators-in-ICU-7.patch
|
||||
0062-Fix-81720-Uninitialized-array-in-pg_query_params-lea.patch
|
||||
0063-Fix-bug-81719-mysqlnd-pdo-password-buffer-overflow.patch
|
||||
0064-NEWS.patch
|
||||
# build: 0065-ax_gcc_func_attribute-Revise-the-detection-of-unknow.patch
|
||||
0066-Fix-bug-79589-ssl3_read_n-unexpected-eof-while-readi.patch
|
||||
0067-Fix-81727-Don-t-mangle-HTTP-variable-names-that-clas.patch
|
||||
0068-Fix-81726-phar-wrapper-DOS-when-using-quine-gzip-fil.patch
|
||||
0069-Fix-regression-introduced-by-fixing-bug-81726.patch
|
||||
0070-fix-NEWS.patch
|
||||
0071-Fix-bug-81738-buffer-overflow-in-hash_update-on-long.patch
|
||||
0072-Fix-81740-PDO-quote-may-return-unquoted-string.patch
|
||||
0073-NEWS.patch
|
||||
0074-crypt-Fix-validation-of-malformed-BCrypt-hashes.patch
|
||||
0075-crypt-Fix-possible-buffer-overread-in-php_crypt.patch
|
||||
0076-Fix-array-overrun-when-appending-slash-to-paths.patch
|
||||
0077-NEWS.patch
|
||||
0078-Fix-repeated-warning-for-file-uploads-limit-exceedin.patch
|
||||
0079-Introduce-max_multipart_body_parts-INI.patch
|
||||
0080-NEWS.patch
|
||||
0081-fix-NEWS-not-FPM-specific.patch
|
||||
0082-Fix-missing-randomness-check-and-insufficient-random.patch
|
||||
0083-Fix-GH-11382-add-missing-hash-header-for-bin2hex.patch
|
||||
0084-add-cve.patch
|
||||
0085-Fix-buffer-mismanagement-in-phar_dir_read.patch
|
||||
0086-Sanitize-libxml2-globals-before-parsing.patch
|
||||
0087-backport-zend_test-changes-zend_test_override_libxml.patch
|
||||
0088-NEWS.patch
|
||||
# behaviour: 0089-Change-the-default-OPcache-optimization-to-7FFEBF5F-.patch
|
||||
# packaging: 0090-Add-missing-header-includes.patch
|
||||
0091-Fix-GHSA-wpj3-hf5j-x4v4-__Host-__Secure-cookie-bypas.patch
|
||||
0092-NEWS.patch
|
||||
0093-Fix-bug-GHSA-q6x7-frmf-grcw-password_verify-can-erro.patch
|
||||
0094-NEWS.patch
|
||||
0095-Fix-GHSA-w8qr-v226-r27w.patch
|
||||
0096-NEWS.patch
|
||||
0097-Fix-GHSA-3qgc-jrrr-25jv.patch
|
||||
0098-NEWS-Add-backport-from-8.1.29.patch
|
||||
0099-Fix-GHSA-9pqp-7h25-4f32.patch
|
||||
0100-Fix-GHSA-p99j-rfp4-xqvq.patch
|
||||
0101-Fix-GHSA-94p6-54jq-9mwp.patch
|
||||
0102-Skip-GHSA-9pqp-7h25-4f32-test-on-Windows.patch
|
||||
0103-NEWS-for-8.1.30-backports.patch
|
||||
0104-adapt-GHSA-9pqp-7h25-4f32-test-for-7.x.patch
|
||||
0105-Fix-GHSA-5hqh-c84r-qjcv-Integer-overflow-in-the-dbli.patch
|
||||
0106-Fix-GHSA-5hqh-c84r-qjcv-Integer-overflow-in-the-fire.patch
|
||||
0107-backport-ZSTR_MAX_LEN.patch
|
||||
0108-Fix-GHSA-c5f2-jwm7-mmq2-stream-HTTP-fulluri-CRLF-inj.patch
|
||||
0109-Fix-GHSA-g665-fm4p-vhff-OOB-access-in-ldap_escape.patch
|
||||
0110-Fix-GHSA-r977-prxv-hc43.patch
|
||||
0111-Fix-GHSA-4w77-75f9-2c8w.patch
|
||||
0112-NEWS-for-8.1.31-backports.patch
|
||||
0113-Fix-GHSA-h35g-vwh6-m678-Mysqlnd-various-heap-buffer-.patch
|
||||
0114-Fix-MySQLnd-possible-buffer-over-read-in-auth_protoc.patch
|
||||
0115-Avoid-using-uninitialised-struct.patch
|
||||
0116-Change-port-for-mysqli-fake-server-auth-message-test.patch
|
||||
0117-Increase-MySQLi-fake-server-read-timeout-for-ASAN-jo.patch
|
||||
0118-adapt-test-NEWS.patch
|
||||
# build: 0119-Force-POSIX-readdir_r-semantics.patch
|
||||
0120-Fix-GH-20584-Information-Leak-of-Memory.patch
|
||||
0121-Only-test-from-code-is-not-affected.patch
|
||||
0122-Fix-GHSA-h96m-rvf9-jgm2.patch
|
||||
0123-Fix-GHSA-www2-q4fc-65wf.patch
|
||||
0124-NEWS-from-8.1.34.patch
|
||||
0125-Fix-missing-include-in-litespeed-build.patch
|
||||
# telemetry: 0126-Add-minimal-privacy-preserving-secure-DNS-telemetry-.patch
|
||||
# build: 0127-Use-ZEND_ATTRIBUTE_UNUSED-instead-of-ATTRIBUTE_UNUSE.patch
|
||||
0128-GHSA-85c2-q967-79q5-soap-Fix-stale-SOAP_GLOBAL-ref_m.patch
|
||||
0129-GHSA-m33r-qmcv-p97q-soap-Fix-use-after-free-after-he.patch
|
||||
0130-GHSA-hmxp-6pc4-f3vv-soap-Fix-broken-Apache-map-value.patch
|
||||
0131-GHSA-96wq-48vp-hh57-metaphone-Fix-signed-integer-ove.patch
|
||||
0132-GHSA-7qg2-v9fj-4mwv-fpm-XSS-within-status-endpoint.patch
|
||||
0133-NEWS-from-8.2.31.patch
|
||||
0134-ext-openssl-openssl_encrypt-zend-mm-heap-overflow-on.patch
|
||||
0135-libgd-patch-for-CVE-2026-9672.patch
|
||||
0136-Fix-SQL-injection-in-ext-pgsql-via-E-.-backslash-bre.patch
|
||||
0137-Fix-GHSA-vc5h-9ppw-p5f3-phar-circular-symlink-crash.patch
|
||||
0138-NEWS-from-8.2.33.patch
|
||||
0139-Avoid-state-corruption-via-bailout.patch
|
||||
@@ -0,0 +1,172 @@
|
||||
# Allow-list over deb.sury.org's debian/patches/series, at the Salsa commit in DEB_PATCHES
|
||||
# (eol/<version>/*/Dockerfile). Every patch of that series appears here in its order; the
|
||||
# commented-out ones are left out:
|
||||
# - packaging: Debian paths, defaults and packaging;
|
||||
# - build: build-system changes for other libraries or toolchains than our bases';
|
||||
# - behaviour: changed defaults or new features;
|
||||
# - tests: test-only changes that need a left-out patch;
|
||||
# - telemetry: deb.sury.org's DNS version check, which reports the PHP version to its server.
|
||||
# packaging: 0001-libtool_fixes.patch
|
||||
# packaging: 0002-debian_quirks.patch
|
||||
# packaging: 0003-php-5.4.9-phpinfo.patch
|
||||
# packaging: 0004-extension_api.patch
|
||||
# packaging: 0005-proc_open.patch
|
||||
# packaging: 0006-php.ini_securitynotes.patch
|
||||
# packaging: 0007-php-5.4.7-libdb.patch
|
||||
# packaging: 0008-Add-support-for-use-of-the-system-timezone-database.patch
|
||||
# packaging: 0009-strcmp_null-OnUpdateErrorLog.patch
|
||||
# packaging: 0010-qdbm-is-usr_include_qdbm.patch
|
||||
# packaging: 0011-session_save_path.patch
|
||||
# packaging: 0012-php-fpm-man-section-and-cleanup.patch
|
||||
# packaging: 0013-fpm-config.patch
|
||||
# packaging: 0014-php-fpm-sysconfdir.patch
|
||||
# packaging: 0015-lp564920-fix-big-files.patch
|
||||
# packaging: 0016-temporary-path-fixes-for-multiarch.patch
|
||||
# packaging: 0017-hurd-noptrace.patch
|
||||
# packaging: 0018-php-5.3.9-mysqlnd.patch
|
||||
# packaging: 0019-php-5.3.9-gnusrc.patch
|
||||
# packaging: 0020-php-5.3.3-macropen.patch
|
||||
# packaging: 0021-php-5.2.4-embed.patch
|
||||
# packaging: 0022-php-fpm-m68k.patch
|
||||
# packaging: 0023-expose_all_built_and_installed_apis.patch
|
||||
# packaging: 0024-Use-system-timezone.patch
|
||||
# packaging: 0025-zlib-largefile-function-renaming.patch
|
||||
# packaging: 0026-php-fpm-do-reload-on-SIGHUP.patch
|
||||
# packaging: 0027-php-5.4.8-ldap_r.patch
|
||||
# packaging: 0028-php-5.4.9-fixheader.patch
|
||||
# packaging: 0029-php-5.6.0-noNO.patch
|
||||
# packaging: 0030-php-5.6.0-oldpcre.patch
|
||||
# packaging: 0031-hack-phpdbg-to-explicitly-link-with-libedit.patch
|
||||
# packaging: 0032-Fix-ZEND_MM_ALIGNMENT-on-m64k.patch
|
||||
# packaging: 0033-Add-patch-to-install-php7-module-directly-to-APXS_LI.patch
|
||||
# packaging: 0034-Remove-W3C-validation-icon-to-not-expose-the-reader-.patch
|
||||
# packaging: 0035-Don-t-put-INSTALL_ROOT-into-phar.phar-exec-stanza.patch
|
||||
# packaging: 0036-XMLRPC-EPI-library-has-to-be-linked-as-lxmlrpc-epi.patch
|
||||
# packaging: 0037-Really-expand-libdir-datadir-into-EXPANDED_LIBDIR-DA.patch
|
||||
# packaging: 0038-Fix-ext-date-lib-parse_tz-PATH_MAX-HURD-FTBFS.patch
|
||||
# build: 0039-remove-deprecated-call-and-deprecate-function-to-be-.patch
|
||||
# build: 0040-Use-libenchant-2-when-available.patch
|
||||
# packaging: 0041-libtool2.2.patch
|
||||
# build: 0042-Include-all-libtool-files-from-phpize.m4.patch
|
||||
# build: 0043-In-phpize-also-copy-config.guess-config.sub-ltmain.s.patch
|
||||
# packaging: 0044-Don-t-use-hrtimers-on-GNU-Hurd.patch
|
||||
# packaging: 0045-Show-packaging-credits.patch
|
||||
# packaging: 0046-Allow-printing-credits-buffer-larger-than-4k.patch
|
||||
# packaging: 0047-Don-t-close-the-credits-buffer-file-descriptor-too-e.patch
|
||||
# build: 0048-Add-minimal-OpenSSL-3.0-patch.patch
|
||||
# build: 0049-Use-true-false-instead-of-TRUE-FALSE-in-intl.patch
|
||||
# build: 0050-ax_gcc_func_attribute-Revise-the-detection-of-unknow.patch
|
||||
0051-Fix-bug-79589-ssl3_read_n-unexpected-eof-while-readi.patch
|
||||
# packaging: 0052-adapted-README.md.patch
|
||||
# packaging: 0053-add-information-about-binary-distributions.patch
|
||||
0054-Fix-81740-PDO-quote-may-return-unquoted-string.patch
|
||||
0055-NEWS.patch
|
||||
0056-Fix-GH-10187-Segfault-in-stripslashes-with-arm64.patch
|
||||
0057-crypt-Fix-validation-of-malformed-BCrypt-hashes.patch
|
||||
0058-crypt-Fix-possible-buffer-overread-in-php_crypt.patch
|
||||
0059-Fix-array-overrun-when-appending-slash-to-paths.patch
|
||||
0060-NEWS.patch
|
||||
0061-Fix-repeated-warning-for-file-uploads-limit-exceedin.patch
|
||||
0062-Introduce-max_multipart_body_parts-INI.patch
|
||||
0063-NEWS.patch
|
||||
0064-fix-NEWS-not-FPM-specific.patch
|
||||
0065-Fix-missing-randomness-check-and-insufficient-random.patch
|
||||
0066-Fix-GH-11382-add-missing-hash-header-for-bin2hex.patch
|
||||
0067-add-cve.patch
|
||||
0068-Fix-buffer-mismanagement-in-phar_dir_read.patch
|
||||
0069-Sanitize-libxml2-globals-before-parsing.patch
|
||||
0070-NEWS.patch
|
||||
0071-backport-zend_test-changes-zend_test_override_libxml.patch
|
||||
0072-Support-libzip_a.lib-for-VS16-libzip_a.lib-for-VS16-.patch
|
||||
# packaging: 0073-Add-missing-header-includes.patch
|
||||
0074-Fix-GHSA-wpj3-hf5j-x4v4-__Host-__Secure-cookie-bypas.patch
|
||||
0075-NEWS.patch
|
||||
0076-Fix-bug-GHSA-q6x7-frmf-grcw-password_verify-can-erro.patch
|
||||
0077-NEWS.patch
|
||||
0078-Add-proc_open-escaping-for-cmd-file-execution-Backpo.patch
|
||||
0079-NEWS.patch
|
||||
0080-Fix-GHSA-w8qr-v226-r27w.patch
|
||||
0081-NEWS.patch
|
||||
0082-Fix-GHSA-9fcc-425m-g385-bypass-CVE-2024-1874.patch
|
||||
0083-Fix-GHSA-3qgc-jrrr-25jv.patch
|
||||
0084-Mark-CVE-2024-5585-backport-tests-for-PHP-7.4-as-EXP.patch
|
||||
0085-NEWS-Add-backports-from-8.1.29.patch
|
||||
0086-Fix-GHSA-9pqp-7h25-4f32.patch
|
||||
0087-Fix-GHSA-p99j-rfp4-xqvq.patch
|
||||
0088-Fix-GHSA-94p6-54jq-9mwp.patch
|
||||
0089-Fix-GHSA-865w-9rf3-2wh5-FPM-Logs-from-childrens-may-.patch
|
||||
0090-Skip-GHSA-9pqp-7h25-4f32-test-on-Windows.patch
|
||||
0091-NEWS-for-8.1.30-backports.patch
|
||||
0092-adapt-GHSA-865w-9rf3-2wh5-test-for-7.x.patch
|
||||
0093-adapt-GHSA-9pqp-7h25-4f32-test-for-7.x.patch
|
||||
0094-Fix-GHSA-5hqh-c84r-qjcv-Integer-overflow-in-the-dbli.patch
|
||||
0095-Fix-GHSA-5hqh-c84r-qjcv-Integer-overflow-in-the-fire.patch
|
||||
0096-Fix-GHSA-c5f2-jwm7-mmq2-stream-HTTP-fulluri-CRLF-inj.patch
|
||||
0097-Fix-GHSA-g665-fm4p-vhff-OOB-access-in-ldap_escape.patch
|
||||
0098-Fix-GHSA-r977-prxv-hc43.patch
|
||||
0099-Fix-GHSA-4w77-75f9-2c8w.patch
|
||||
0100-NEWS-for-8.1.31-backports.patch
|
||||
0101-Fix-GHSA-h35g-vwh6-m678-Mysqlnd-various-heap-buffer-.patch
|
||||
0102-Fix-MySQLnd-possible-buffer-over-read-in-auth_protoc.patch
|
||||
0103-Avoid-using-uninitialised-struct.patch
|
||||
0104-Change-port-for-mysqli-fake-server-auth-message-test.patch
|
||||
0105-Increase-MySQLi-fake-server-read-timeout-for-ASAN-jo.patch
|
||||
0106-adapt-test-NEWS.patch
|
||||
0107-Fix-GHSA-ghsa-v8xr-gpvj-cx9g-http-header-folding.patch
|
||||
0108-Fix-GHSA-pcmh-g36c-qc44-http-headers-without-colon.patch
|
||||
0109-Fix-GHSA-52jp-hrpf-2jff-http-redirect-location-trunc.patch
|
||||
0110-Fix-GHSA-hgf5-96fm-v528-http-user-header-check-of-cr.patch
|
||||
0111-Fix-GH-11160-Few-tests-failed-building-with-new-libx.patch
|
||||
# build: 0112-Backport-0a39890c-Fix-libxml2-2.12-build-due-to-API-.patch
|
||||
# build: 0113-Backport-4fe82131-Backport-libxml2-2.13.2-fixes-1481.patch
|
||||
0114-Fix-GHSA-p3x9-6h7p-cgfc-libxml-streams-wrong-content.patch
|
||||
0115-Fix-GHSA-wg4p-4hqh-c3g9.patch
|
||||
# build: 0116-Fix-GH-12702-libxml2-2.12.0-issue-building-from-src.patch
|
||||
0117-NEWS.patch
|
||||
0118-Fix-GHSA-453j-q27h-5p8x.patch
|
||||
0119-Fix-GHSA-3cr5-j632-f35r-Null-byte-in-hostnames.patch
|
||||
0120-Fix-GHSA-hrwm-9436-5mv3-pgsql-escaping-no-error-chec.patch
|
||||
0121-NEWS.patch
|
||||
0122-Fix-GH-20584-Information-Leak-of-Memory.patch
|
||||
0123-Only-test-from-code-is-not-affected.patch
|
||||
0124-Fix-GHSA-h96m-rvf9-jgm2.patch
|
||||
0125-Fix-GHSA-www2-q4fc-65wf.patch
|
||||
0126-NEWS-from-8.1.34.patch
|
||||
0127-Fix-missing-include-in-litespeed-build.patch
|
||||
# telemetry: 0128-Add-minimal-privacy-preserving-secure-DNS-telemetry-.patch
|
||||
0129-GHSA-85c2-q967-79q5-soap-Fix-stale-SOAP_GLOBAL-ref_m.patch
|
||||
0130-GHSA-m33r-qmcv-p97q-soap-Fix-use-after-free-after-he.patch
|
||||
0131-GHSA-hmxp-6pc4-f3vv-soap-Fix-broken-Apache-map-value.patch
|
||||
0132-GHSA-7qg2-v9fj-4mwv-fpm-XSS-within-status-endpoint.patch
|
||||
0133-Only-test-for-GHSA-wm6j-2649-pv75-mbstring-Fix-null-.patch
|
||||
0134-GHSA-96wq-48vp-hh57-metaphone-Fix-signed-integer-ove.patch
|
||||
0135-Adjust-credits-for-GHSA-96wq-48vp-hh57.phpt.patch
|
||||
0136-GHSA-m8rr-4c36-8gq4-Consistently-pass-unsigned-char-.patch
|
||||
0137-NEWS-from-8.2.31.patch
|
||||
0138-ext-openssl-openssl_encrypt-zend-mm-heap-overflow-on.patch
|
||||
0139-Fix-heap-buffer-overflow-in-convert-stream-filters-w.patch
|
||||
0140-libgd-patch-for-CVE-2026-9672.patch
|
||||
0141-Fix-GHSA-62xp-839h-2637-FastCGI-allowed_clients-comp.patch
|
||||
0142-Fix-SQL-injection-in-ext-pgsql-via-E-.-backslash-bre.patch
|
||||
0143-Fix-GHSA-vc5h-9ppw-p5f3-phar-circular-symlink-crash.patch
|
||||
0144-logtool-changes-from-8.2.patch
|
||||
0145-Fix-GHSA-vvx9-73fr-5jjx-do-not-fall-back-to-CN-if-th.patch
|
||||
0146-Fix-leak-on-double-DatePeriod-__construct-call.patch
|
||||
0147-Fix-GHSA-xr7j-rvgx-xq5p-OOB-read-in-php_openssl_matc.patch
|
||||
0148-NEWS-from-8.2.33.patch
|
||||
0149-Partial-Fix-GHSA-r6x9-5r99-36j7-Various-packet-overr.patch
|
||||
0150-re-add-new-tests-as-XFAIL-because-of-partial-fix.patch
|
||||
0151-fix-new-tests-expectations-warnings-raised-instead-o.patch
|
||||
0152-Fix-GH-11274-POST-PATCH-request-via-file_get_content.patch
|
||||
0153-Fix-GHSA-fpwc-w8rq-cr92-strip-credentials-from-user-.patch
|
||||
0154-Fix-GHSA-rgrp-mwpx-f6rm-unbounded-recursion-in-ext-s.patch
|
||||
0155-Fix-GHSA-cj93-vc83-wgqv.patch
|
||||
0156-Fix-GHSA-j3wh-g957-2m85-phar-tar-entry-injection.patch
|
||||
0157-Fix-GHSA-9f67-6fw4-hpfp.patch
|
||||
0158-Fix-GHSA-ch8v-r6jh-4vvr-encode-0xFF-in-FILTER_SANITI.patch
|
||||
0159-ext-soap-make-GHSA-cj93-vc83-wgqv-test-lean-and-reli.patch
|
||||
0160-Add-NEWS-entries-from-8.2.34.patch
|
||||
0161-fix-skipif-section.patch
|
||||
0162-Fix-out-of-bounds-read-on-empty-Location-header.patch
|
||||
0163-ext-standard-Fix-1-char-relative-Location-redirects-.patch
|
||||
0164-Avoid-state-corruption-via-bailout.patch
|
||||
@@ -0,0 +1,145 @@
|
||||
# Allow-list over deb.sury.org's debian/patches/series, at the Salsa commit in DEB_PATCHES
|
||||
# (eol/<version>/*/Dockerfile). Every patch of that series appears here in its order; the
|
||||
# commented-out ones are left out:
|
||||
# - packaging: Debian paths, defaults and packaging;
|
||||
# - build: build-system changes for other libraries or toolchains than our bases';
|
||||
# - behaviour: changed defaults or new features;
|
||||
# - tests: test-only changes that need a left-out patch;
|
||||
# - telemetry: deb.sury.org's DNS version check, which reports the PHP version to its server.
|
||||
# packaging: 0001-libtool_fixes.patch
|
||||
# packaging: 0002-debian_quirks.patch
|
||||
# packaging: 0003-php-5.4.9-phpinfo.patch
|
||||
# packaging: 0004-extension_api.patch
|
||||
# packaging: 0005-php.ini_securitynotes.patch
|
||||
# packaging: 0006-php-5.4.7-libdb.patch
|
||||
# packaging: 0007-Add-support-for-use-of-the-system-timezone-database.patch
|
||||
# packaging: 0008-strcmp_null-OnUpdateErrorLog.patch
|
||||
# packaging: 0009-qdbm-is-usr_include_qdbm.patch
|
||||
# packaging: 0010-session_save_path.patch
|
||||
# packaging: 0011-php-fpm-man-section-and-cleanup.patch
|
||||
# packaging: 0012-fpm-config.patch
|
||||
# packaging: 0013-php-fpm-sysconfdir.patch
|
||||
# packaging: 0014-lp564920-fix-big-files.patch
|
||||
# packaging: 0015-temporary-path-fixes-for-multiarch.patch
|
||||
# packaging: 0016-hurd-noptrace.patch
|
||||
# packaging: 0017-php-5.3.9-gnusrc.patch
|
||||
# packaging: 0018-php-5.3.3-macropen.patch
|
||||
# packaging: 0019-php-5.2.4-embed.patch
|
||||
# packaging: 0020-php-fpm-m68k.patch
|
||||
# packaging: 0021-expose_all_built_and_installed_apis.patch
|
||||
# packaging: 0022-Use-system-timezone.patch
|
||||
# packaging: 0023-php-fpm-do-reload-on-SIGHUP.patch
|
||||
# packaging: 0024-php-5.4.8-ldap_r.patch
|
||||
# packaging: 0025-php-5.4.9-fixheader.patch
|
||||
# packaging: 0026-php-5.6.0-noNO.patch
|
||||
# packaging: 0027-php-5.6.0-oldpcre.patch
|
||||
# packaging: 0028-hack-phpdbg-to-explicitly-link-with-libedit.patch
|
||||
# packaging: 0029-Fix-ZEND_MM_ALIGNMENT-on-m64k.patch
|
||||
# packaging: 0030-Remove-W3C-validation-icon-to-not-expose-the-reader-.patch
|
||||
# packaging: 0031-Don-t-put-INSTALL_ROOT-into-phar.phar-exec-stanza.patch
|
||||
# packaging: 0032-Really-expand-libdir-datadir-into-EXPANDED_LIBDIR-DA.patch
|
||||
# packaging: 0033-Fix-ext-date-lib-parse_tz-PATH_MAX-HURD-FTBFS.patch
|
||||
# packaging: 0034-Add-patch-to-install-php7-module-directly-to-APXS_LI.patch
|
||||
# packaging: 0035-libtool2.2.patch
|
||||
# build: 0036-Include-all-libtool-files-from-phpize.m4.patch
|
||||
# build: 0037-In-phpize-also-copy-config.guess-config.sub-ltmain.s.patch
|
||||
# packaging: 0038-Don-t-use-hrtimers-on-GNU-Hurd.patch
|
||||
# packaging: 0039-Show-packaging-credits.patch
|
||||
# packaging: 0040-Allow-printing-credits-buffer-larger-than-4k.patch
|
||||
# packaging: 0041-Don-t-close-the-credits-buffer-file-descriptor-too-e.patch
|
||||
# build: 0042-Add-minimal-OpenSSL-3.0-patch.patch
|
||||
# build: 0043-ax_gcc_func_attribute-Revise-the-detection-of-unknow.patch
|
||||
0044-Fix-bug-79589-ssl3_read_n-unexpected-eof-while-readi.patch
|
||||
0045-Fix-GH-10187-Segfault-in-stripslashes-with-arm64.patch
|
||||
# packaging: 0046-update-README.patch
|
||||
# packaging: 0047-Disable-garbage-collection-routine.patch
|
||||
# packaging: 0048-Add-missing-header-includes.patch
|
||||
0049-Fix-GHSA-wpj3-hf5j-x4v4-__Host-__Secure-cookie-bypas.patch
|
||||
0050-NEWS.patch
|
||||
0051-Fix-bug-GHSA-q6x7-frmf-grcw-password_verify-can-erro.patch
|
||||
0052-NEWS.patch
|
||||
0053-Add-proc_open-escaping-for-cmd-file-execution-Backpo.patch
|
||||
0054-NEWS.patch
|
||||
0055-Fix-GHSA-w8qr-v226-r27w.patch
|
||||
0056-NEWS.patch
|
||||
0057-Fix-GHSA-9fcc-425m-g385-bypass-CVE-2024-1874.patch
|
||||
0058-Fix-GHSA-3qgc-jrrr-25jv.patch
|
||||
0059-NEWS-Add-backports-from-8.1.29.patch
|
||||
0060-Fix-GHSA-9pqp-7h25-4f32.patch
|
||||
0061-Fix-GHSA-p99j-rfp4-xqvq.patch
|
||||
0062-Fix-GHSA-94p6-54jq-9mwp.patch
|
||||
0063-Fix-GHSA-865w-9rf3-2wh5-FPM-Logs-from-childrens-may-.patch
|
||||
0064-Skip-GHSA-9pqp-7h25-4f32-test-on-Windows.patch
|
||||
0065-NEWS-for-8.1.30-backports.patch
|
||||
0066-Fix-GHSA-5hqh-c84r-qjcv-Integer-overflow-in-the-dbli.patch
|
||||
0067-Fix-GHSA-5hqh-c84r-qjcv-Integer-overflow-in-the-fire.patch
|
||||
0068-Fix-GHSA-c5f2-jwm7-mmq2-stream-HTTP-fulluri-CRLF-inj.patch
|
||||
0069-Fix-GHSA-g665-fm4p-vhff-OOB-access-in-ldap_escape.patch
|
||||
0070-Fix-GHSA-r977-prxv-hc43.patch
|
||||
0071-Fix-GHSA-4w77-75f9-2c8w.patch
|
||||
0072-NEWS-for-8.1.31-backports.patch
|
||||
0073-fix-transport_string-release.patch
|
||||
0074-Fix-GHSA-h35g-vwh6-m678-Mysqlnd-various-heap-buffer-.patch
|
||||
0075-Fix-MySQLnd-possible-buffer-over-read-in-auth_protoc.patch
|
||||
0076-Change-port-for-mysqli-fake-server-auth-message-test.patch
|
||||
0077-Increase-MySQLi-fake-server-read-timeout-for-ASAN-jo.patch
|
||||
0078-Avoid-using-uninitialised-struct.patch
|
||||
0079-adapt-test-NEWS.patch
|
||||
0080-Fix-GHSA-ghsa-v8xr-gpvj-cx9g-http-header-folding.patch
|
||||
0081-Fix-GHSA-pcmh-g36c-qc44-http-headers-without-colon.patch
|
||||
0082-Fix-GHSA-52jp-hrpf-2jff-http-redirect-location-trunc.patch
|
||||
0083-Fix-GHSA-hgf5-96fm-v528-http-user-header-check-of-cr.patch
|
||||
0084-Fix-GH-11160-Few-tests-failed-building-with-new-libx.patch
|
||||
# build: 0085-Backport-0a39890c-Fix-libxml2-2.12-build-due-to-API-.patch
|
||||
# build: 0086-Backport-4fe82131-Backport-libxml2-2.13.2-fixes-1481.patch
|
||||
0087-Fix-GHSA-p3x9-6h7p-cgfc-libxml-streams-wrong-content.patch
|
||||
0088-Fix-GHSA-wg4p-4hqh-c3g9.patch
|
||||
# build: 0089-Fix-GH-12702-libxml2-2.12.0-issue-building-from-src.patch
|
||||
0090-NEWS.patch
|
||||
0091-Fix-GHSA-453j-q27h-5p8x.patch
|
||||
0092-Fix-GHSA-3cr5-j632-f35r-Null-byte-in-hostnames.patch
|
||||
0093-Fix-GHSA-hrwm-9436-5mv3-pgsql-escaping-no-error-chec.patch
|
||||
0094-NEWS.patch
|
||||
0095-Fix-GH-20584-Information-Leak-of-Memory.patch
|
||||
0096-Only-test-from-code-is-not-affected.patch
|
||||
0097-Fix-GHSA-h96m-rvf9-jgm2.patch
|
||||
0098-Fix-GHSA-www2-q4fc-65wf.patch
|
||||
0099-NEWS-from-8.1.34.patch
|
||||
# telemetry: 0100-Add-minimal-privacy-preserving-secure-DNS-telemetry-.patch
|
||||
0101-GHSA-85c2-q967-79q5-soap-Fix-stale-SOAP_GLOBAL-ref_m.patch
|
||||
0102-GHSA-m33r-qmcv-p97q-soap-Fix-use-after-free-after-he.patch
|
||||
0103-GHSA-hmxp-6pc4-f3vv-soap-Fix-broken-Apache-map-value.patch
|
||||
0104-GHSA-7qg2-v9fj-4mwv-fpm-XSS-within-status-endpoint.patch
|
||||
0105-GHSA-wm6j-2649-pv75-mbstring-Fix-null-pointer-derefe.patch
|
||||
0106-GHSA-96wq-48vp-hh57-metaphone-Fix-signed-integer-ove.patch
|
||||
0107-Adjust-credits-for-GHSA-96wq-48vp-hh57.phpt.patch
|
||||
0108-GHSA-w476-322c-wpvm-pdo_firebird-Fix-SQL-injection-v.patch
|
||||
0109-GHSA-m8rr-4c36-8gq4-Consistently-pass-unsigned-char-.patch
|
||||
0110-NEWS-from-8.2.31.patch
|
||||
0111-ext-openssl-openssl_encrypt-zend-mm-heap-overflow-on.patch
|
||||
0112-Fix-heap-buffer-overflow-in-convert-stream-filters-w.patch
|
||||
0113-libgd-patch-for-CVE-2026-9672.patch
|
||||
0114-Fix-GHSA-62xp-839h-2637-FastCGI-allowed_clients-comp.patch
|
||||
0115-Fix-SQL-injection-in-ext-pgsql-via-E-.-backslash-bre.patch
|
||||
0116-Fix-GHSA-vc5h-9ppw-p5f3-phar-circular-symlink-crash.patch
|
||||
0117-logtool-changes-from-8.2.patch
|
||||
0118-Fix-GHSA-vvx9-73fr-5jjx-do-not-fall-back-to-CN-if-th.patch
|
||||
0119-Fix-leak-on-double-DatePeriod-__construct-call.patch
|
||||
0120-Fix-GHSA-xr7j-rvgx-xq5p-OOB-read-in-php_openssl_matc.patch
|
||||
0121-NEWS-from-8.2.33.patch
|
||||
0122-Partial-Fix-GHSA-r6x9-5r99-36j7-Various-packet-overr.patch
|
||||
0123-Fix-GH-11274-POST-PATCH-request-via-file_get_content.patch
|
||||
0124-Fix-GHSA-fpwc-w8rq-cr92-strip-credentials-from-user-.patch
|
||||
0125-Fix-GHSA-rgrp-mwpx-f6rm-unbounded-recursion-in-ext-s.patch
|
||||
0126-Fix-GHSA-cj93-vc83-wgqv.patch
|
||||
0127-Fix-GHSA-j3wh-g957-2m85-phar-tar-entry-injection.patch
|
||||
0128-Fix-GHSA-9f67-6fw4-hpfp.patch
|
||||
0129-Fix-GHSA-ch8v-r6jh-4vvr-encode-0xFF-in-FILTER_SANITI.patch
|
||||
0130-ext-soap-make-GHSA-cj93-vc83-wgqv-test-lean-and-reli.patch
|
||||
0131-Add-NEWS-entries-from-8.2.34.patch
|
||||
0132-re-add-new-tests-as-XFAIL-because-of-partial-fix.patch
|
||||
0133-fix-new-tests-expectations-warnings-raised-instead-o.patch
|
||||
0134-CVE-2025-1218-is-fully-fixed.patch
|
||||
0135-Fix-out-of-bounds-read-on-empty-Location-header.patch
|
||||
0136-ext-standard-Fix-1-char-relative-Location-redirects-.patch
|
||||
0137-Avoid-state-corruption-via-bailout.patch
|
||||
@@ -0,0 +1,91 @@
|
||||
# Allow-list over deb.sury.org's debian/patches/series, at the Salsa commit in DEB_PATCHES
|
||||
# (eol/<version>/*/Dockerfile). Every patch of that series appears here in its order; the
|
||||
# commented-out ones are left out:
|
||||
# - packaging: Debian paths, defaults and packaging;
|
||||
# - build: build-system changes for other libraries or toolchains than our bases';
|
||||
# - behaviour: changed defaults or new features;
|
||||
# - tests: test-only changes that need a left-out patch;
|
||||
# - telemetry: deb.sury.org's DNS version check, which reports the PHP version to its server.
|
||||
# packaging: 0001-libtool_fixes.patch
|
||||
# packaging: 0002-debian_quirks.patch
|
||||
# packaging: 0003-php-5.4.9-phpinfo.patch
|
||||
# packaging: 0004-extension_api.patch
|
||||
# packaging: 0005-php.ini_securitynotes.patch
|
||||
# packaging: 0006-php-5.4.7-libdb.patch
|
||||
# packaging: 0007-Add-support-for-use-of-the-system-timezone-database.patch
|
||||
# packaging: 0008-strcmp_null-OnUpdateErrorLog.patch
|
||||
# packaging: 0009-qdbm-is-usr_include_qdbm.patch
|
||||
# packaging: 0010-session_save_path.patch
|
||||
# packaging: 0011-php-fpm-man-section-and-cleanup.patch
|
||||
# packaging: 0012-fpm-config.patch
|
||||
# packaging: 0013-php-fpm-sysconfdir.patch
|
||||
# packaging: 0014-lp564920-fix-big-files.patch
|
||||
# packaging: 0015-temporary-path-fixes-for-multiarch.patch
|
||||
# packaging: 0016-hurd-noptrace.patch
|
||||
# packaging: 0017-php-5.3.9-gnusrc.patch
|
||||
# packaging: 0018-php-5.3.3-macropen.patch
|
||||
# packaging: 0019-php-5.2.4-embed.patch
|
||||
# packaging: 0020-php-fpm-m68k.patch
|
||||
# packaging: 0021-expose_all_built_and_installed_apis.patch
|
||||
# packaging: 0022-Use-system-timezone.patch
|
||||
# packaging: 0023-php-fpm-do-reload-on-SIGHUP.patch
|
||||
# packaging: 0024-php-5.4.8-ldap_r.patch
|
||||
# packaging: 0025-php-5.4.9-fixheader.patch
|
||||
# packaging: 0026-php-5.6.0-noNO.patch
|
||||
# packaging: 0027-php-5.6.0-oldpcre.patch
|
||||
# packaging: 0028-hack-phpdbg-to-explicitly-link-with-libedit.patch
|
||||
# packaging: 0029-Fix-ZEND_MM_ALIGNMENT-on-m64k.patch
|
||||
# packaging: 0030-Remove-W3C-validation-icon-to-not-expose-the-reader-.patch
|
||||
# packaging: 0031-Don-t-put-INSTALL_ROOT-into-phar.phar-exec-stanza.patch
|
||||
# packaging: 0032-Really-expand-libdir-datadir-into-EXPANDED_LIBDIR-DA.patch
|
||||
# packaging: 0033-Fix-ext-date-lib-parse_tz-PATH_MAX-HURD-FTBFS.patch
|
||||
# packaging: 0034-Add-patch-to-install-php7-module-directly-to-APXS_LI.patch
|
||||
# packaging: 0035-libtool2.2.patch
|
||||
# build: 0036-Include-all-libtool-files-from-phpize.m4.patch
|
||||
# build: 0037-In-phpize-also-copy-config.guess-config.sub-ltmain.s.patch
|
||||
# packaging: 0038-Don-t-use-hrtimers-on-GNU-Hurd.patch
|
||||
# packaging: 0039-Show-packaging-credits.patch
|
||||
# packaging: 0040-Allow-printing-credits-buffer-larger-than-4k.patch
|
||||
# packaging: 0041-Don-t-close-the-credits-buffer-file-descriptor-too-e.patch
|
||||
# build: 0042-Lower-the-OpenSSL-requirement-to-1.0.1.patch
|
||||
# build: 0043-Fail-the-build-when-the-dtrace-call-fails.patch
|
||||
# build: 0044-Override-result-of-AC_PROG_LN_S-to-fix-FTBFS-on-ppc6.patch
|
||||
# build: 0045-Update-gcc-func-attr-macro.patch
|
||||
# packaging: 0046-Disable-garbage-collection-routine.patch
|
||||
# packaging: 0047-Add-missing-header-includes.patch
|
||||
# telemetry: 0048-Add-minimal-privacy-preserving-secure-DNS-telemetry-.patch
|
||||
# packaging: 0049-update-README.patch
|
||||
0050-GHSA-85c2-q967-79q5-soap-Fix-stale-SOAP_GLOBAL-ref_m.patch
|
||||
0051-GHSA-m33r-qmcv-p97q-soap-Fix-use-after-free-after-he.patch
|
||||
0052-GHSA-hmxp-6pc4-f3vv-soap-Fix-broken-Apache-map-value.patch
|
||||
0053-GHSA-7qg2-v9fj-4mwv-fpm-XSS-within-status-endpoint.patch
|
||||
0054-GHSA-wm6j-2649-pv75-mbstring-Fix-null-pointer-derefe.patch
|
||||
0055-GHSA-96wq-48vp-hh57-metaphone-Fix-signed-integer-ove.patch
|
||||
0056-GHSA-w476-322c-wpvm-pdo_firebird-Fix-SQL-injection-v.patch
|
||||
0057-GHSA-m8rr-4c36-8gq4-Consistently-pass-unsigned-char-.patch
|
||||
0058-Adjust-credits-for-GHSA-96wq-48vp-hh57.phpt.patch
|
||||
0059-NEWS-from-8.2.31.patch
|
||||
0060-ext-openssl-openssl_encrypt-zend-mm-heap-overflow-on.patch
|
||||
0061-Fix-heap-buffer-overflow-in-convert-stream-filters-w.patch
|
||||
0062-libgd-patch-for-CVE-2026-9672.patch
|
||||
0063-Fix-GHSA-62xp-839h-2637-FastCGI-allowed_clients-comp.patch
|
||||
0064-Fix-SQL-injection-in-ext-pgsql-via-E-.-backslash-bre.patch
|
||||
0065-Fix-GHSA-vc5h-9ppw-p5f3-phar-circular-symlink-crash.patch
|
||||
0066-logtool-changes-from-8.2.patch
|
||||
0067-Fix-GHSA-vvx9-73fr-5jjx-do-not-fall-back-to-CN-if-th.patch
|
||||
0068-Fix-leak-on-double-DatePeriod-__construct-call.patch
|
||||
0069-Fix-GHSA-xr7j-rvgx-xq5p-OOB-read-in-php_openssl_matc.patch
|
||||
0070-NEWS-from-8.2.33.patch
|
||||
0071-Fix-GHSA-r6x9-5r99-36j7-Various-packet-overreads-in-.patch
|
||||
0072-Fix-GHSA-fpwc-w8rq-cr92-strip-credentials-from-user-.patch
|
||||
0073-Fix-GHSA-rgrp-mwpx-f6rm-unbounded-recursion-in-ext-s.patch
|
||||
0074-Fix-GHSA-cj93-vc83-wgqv.patch
|
||||
0075-Fix-GHSA-j3wh-g957-2m85-phar-tar-entry-injection.patch
|
||||
0076-Fix-GHSA-9f67-6fw4-hpfp.patch
|
||||
0077-Fix-GHSA-ch8v-r6jh-4vvr-encode-0xFF-in-FILTER_SANITI.patch
|
||||
0078-Fix-out-of-bounds-read-on-empty-Location-header.patch
|
||||
0079-ext-standard-Fix-1-char-relative-Location-redirects-.patch
|
||||
0080-ext-soap-make-GHSA-cj93-vc83-wgqv-test-lean-and-reli.patch
|
||||
0081-Skip-recursion-tests-on-ASAN.patch
|
||||
0082-Add-NEWS-entries-from-8.2.34.patch
|
||||
0083-Avoid-state-corruption-via-bailout.patch
|
||||
Reference in New Issue
Block a user