From cfd33e25ea0ef4dc794849d7662c8e1d5d5e3a23 Mon Sep 17 00:00:00 2001 From: hongwei-qin Date: Thu, 25 Aug 2022 16:19:25 +0800 Subject: [PATCH 1/2] update to php-7.4.19-4.module+el8.6.0+16316+906f6c6d Signed-off-by: hongwei-qin --- 1000-anolis-php-support-loongarch64.patch | 23 ------- php-CVE-2022-31625.patch | 73 +++++++++++++++++++++++ php.spec | 14 ++--- 3 files changed, 79 insertions(+), 31 deletions(-) delete mode 100644 1000-anolis-php-support-loongarch64.patch create mode 100644 php-CVE-2022-31625.patch diff --git a/1000-anolis-php-support-loongarch64.patch b/1000-anolis-php-support-loongarch64.patch deleted file mode 100644 index 607d933..0000000 --- a/1000-anolis-php-support-loongarch64.patch +++ /dev/null @@ -1,23 +0,0 @@ -diff -Nur php-7.2.24.new/build/config.guess php-7.2.24/build/config.guess ---- php-7.2.24.new/build/config.guess 2021-11-08 19:01:51.684000000 +0800 -+++ php-7.2.24/build/config.guess 2021-11-08 19:04:15.004000000 +0800 -@@ -891,6 +891,9 @@ - UNAME_MACHINE=aarch64_be - echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" - exit ;; -+ loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*) -+ echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" -+ exit ;; - alpha:Linux:*:*) - case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in - EV5) UNAME_MACHINE=alphaev5 ;; ---- php-7.4.6/build/config.sub 2020-05-12 16:09:15.000000000 +0800 -+++ php-7.4.6/build/config.sub.new 2021-11-10 11:23:11.386075262 +0800 -@@ -1160,6 +1160,7 @@ - 1750a | 580 \ - | a29k \ - | aarch64 | aarch64_be \ -+ | loongarch32 | loongarch64 | loongarchx32 \ - | abacus \ - | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] \ - | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] \ diff --git a/php-CVE-2022-31625.patch b/php-CVE-2022-31625.patch new file mode 100644 index 0000000..c45fab0 --- /dev/null +++ b/php-CVE-2022-31625.patch @@ -0,0 +1,73 @@ +From 55f6895f4b4c677272fd4ee1113acdbd99c4b5ab Mon Sep 17 00:00:00 2001 +From: "Christoph M. Becker" +Date: Tue, 17 May 2022 12:59:23 +0200 +Subject: [PATCH] Fix #81720: Uninitialized array in pg_query_params() leading + to RCE + +We must not free parameters which we haven't initialized yet. + +We also fix the not directly related issue, that we checked for the +wrong value being `NULL`, potentially causing a segfault. +--- + ext/pgsql/pgsql.c | 6 +++--- + ext/pgsql/tests/bug81720.phpt | 27 +++++++++++++++++++++++++++ + 2 files changed, 30 insertions(+), 3 deletions(-) + create mode 100644 ext/pgsql/tests/bug81720.phpt + +diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c +index f52ff884d83c..7dcd56cf1441 100644 +--- a/ext/pgsql/pgsql.c ++++ b/ext/pgsql/pgsql.c +@@ -1994,7 +1994,7 @@ PHP_FUNCTION(pg_query_params) + if (Z_TYPE(tmp_val) != IS_STRING) { + php_error_docref(NULL, E_WARNING,"Error converting parameter"); + zval_ptr_dtor(&tmp_val); +- _php_pgsql_free_params(params, num_params); ++ _php_pgsql_free_params(params, i); + RETURN_FALSE; + } + params[i] = estrndup(Z_STRVAL(tmp_val), Z_STRLEN(tmp_val)); +@@ -5175,8 +5175,8 @@ PHP_FUNCTION(pg_send_execute) + params[i] = NULL; + } else { + zend_string *tmp_str = zval_try_get_string(tmp); +- if (UNEXPECTED(!tmp)) { +- _php_pgsql_free_params(params, num_params); ++ if (UNEXPECTED(!tmp_str)) { ++ _php_pgsql_free_params(params, i); + return; + } + params[i] = estrndup(ZSTR_VAL(tmp_str), ZSTR_LEN(tmp_str)); +diff --git a/ext/pgsql/tests/bug81720.phpt b/ext/pgsql/tests/bug81720.phpt +new file mode 100644 +index 000000000000..d79f1fcdd612 +--- /dev/null ++++ b/ext/pgsql/tests/bug81720.phpt +@@ -0,0 +1,27 @@ ++--TEST-- ++Bug #81720 (Uninitialized array in pg_query_params() leading to RCE) ++--SKIPIF-- ++ ++--FILE-- ++getMessage(), PHP_EOL; ++} ++ ++try { ++ pg_send_prepare($conn, "my_query", 'SELECT $1, $2'); ++ pg_get_result($conn); ++ pg_send_execute($conn, "my_query", [1, new stdClass()]); ++} catch (Throwable $ex) { ++ echo $ex->getMessage(), PHP_EOL; ++} ++?> ++--EXPECT-- ++Object of class stdClass could not be converted to string ++Object of class stdClass could not be converted to string diff --git a/php.spec b/php.spec index 3d0d3b3..76fed93 100644 --- a/php.spec +++ b/php.spec @@ -1,4 +1,3 @@ -%define anolis_release .0.1 # RHEL / Fedora spec file for php # # License: MIT @@ -61,7 +60,7 @@ Summary: PHP scripting language for creating dynamic web sites Name: php Version: %{upver}%{?rcver:~%{rcver}} -Release: 3%{anolis_release}%{?dist} +Release: 4%{?dist} # All files licensed under PHP version 3.01, except # Zend is licensed under Zend # TSRM is licensed under BSD @@ -112,13 +111,12 @@ Patch47: php-5.6.3-phpinfo.patch Patch200: php-7.4.19-CVE-2021-21703.patch Patch201: php-7.4.19-CVE-2021-21705.patch Patch202: php-CVE-2022-31626.patch +Patch203: php-CVE-2022-31625.patch # Fixes for tests (300+) # Factory is droped from system tzdata Patch300: php-5.6.3-datetests.patch -Patch1000: 1000-anolis-php-support-loongarch64.patch - BuildRequires: gnupg2 BuildRequires: bzip2-devel @@ -727,12 +725,11 @@ in pure PHP. %patch200 -p1 -b .cve21705 %patch201 -p1 -b .cve21703 %patch202 -p1 -b .cve31626 +%patch203 -p1 -b .cve31625 # Fixes for tests %patch300 -p1 -b .datetests -%patch1000 -p1 - # Prevent %%doc confusion over LICENSE files cp Zend/LICENSE Zend/ZEND_LICENSE @@ -1520,8 +1517,9 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || : %changelog -* Mon Jul 4 2022 Liwei Ge - 7.4.19-3.0.1 -- Support loongarch64 platform +* Tue Aug 9 2022 Remi Collet - 7.4.19-4 +- fix uninitialized array in pg_query_params() leading to RCE + CVE-2022-31625 * Wed Jun 22 2022 Remi Collet - 7.4.19-3 - fix password of excessive length triggers buffer overflow leading to RCE -- Gitee From c1a90558b4527a6d19e42d83e9d794715d29f285 Mon Sep 17 00:00:00 2001 From: Liwei Ge Date: Mon, 8 Nov 2021 21:59:28 +0800 Subject: [PATCH 2/2] build: support loongarch64 platform Signed-off-by: Liwei Ge --- 1000-anolis-php-support-loongarch64.patch | 23 +++++++++++++++++++++++ php.spec | 10 +++++++++- 2 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 1000-anolis-php-support-loongarch64.patch diff --git a/1000-anolis-php-support-loongarch64.patch b/1000-anolis-php-support-loongarch64.patch new file mode 100644 index 0000000..607d933 --- /dev/null +++ b/1000-anolis-php-support-loongarch64.patch @@ -0,0 +1,23 @@ +diff -Nur php-7.2.24.new/build/config.guess php-7.2.24/build/config.guess +--- php-7.2.24.new/build/config.guess 2021-11-08 19:01:51.684000000 +0800 ++++ php-7.2.24/build/config.guess 2021-11-08 19:04:15.004000000 +0800 +@@ -891,6 +891,9 @@ + UNAME_MACHINE=aarch64_be + echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" + exit ;; ++ loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*) ++ echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" ++ exit ;; + alpha:Linux:*:*) + case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in + EV5) UNAME_MACHINE=alphaev5 ;; +--- php-7.4.6/build/config.sub 2020-05-12 16:09:15.000000000 +0800 ++++ php-7.4.6/build/config.sub.new 2021-11-10 11:23:11.386075262 +0800 +@@ -1160,6 +1160,7 @@ + 1750a | 580 \ + | a29k \ + | aarch64 | aarch64_be \ ++ | loongarch32 | loongarch64 | loongarchx32 \ + | abacus \ + | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] \ + | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] \ diff --git a/php.spec b/php.spec index 76fed93..a9581a1 100644 --- a/php.spec +++ b/php.spec @@ -1,3 +1,4 @@ +%define anolis_release .0.1 # RHEL / Fedora spec file for php # # License: MIT @@ -60,7 +61,7 @@ Summary: PHP scripting language for creating dynamic web sites Name: php Version: %{upver}%{?rcver:~%{rcver}} -Release: 4%{?dist} +Release: 4%{anolis_release}%{?dist} # All files licensed under PHP version 3.01, except # Zend is licensed under Zend # TSRM is licensed under BSD @@ -117,6 +118,8 @@ Patch203: php-CVE-2022-31625.patch # Factory is droped from system tzdata Patch300: php-5.6.3-datetests.patch +Patch1000: 1000-anolis-php-support-loongarch64.patch + BuildRequires: gnupg2 BuildRequires: bzip2-devel @@ -730,6 +733,8 @@ in pure PHP. # Fixes for tests %patch300 -p1 -b .datetests +%patch1000 -p1 + # Prevent %%doc confusion over LICENSE files cp Zend/LICENSE Zend/ZEND_LICENSE @@ -1517,6 +1522,9 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || : %changelog +* Thu Aug 25 2022 Liwei Ge - 7.4.19-4.0.1 +- Support loongarch64 platform + * Tue Aug 9 2022 Remi Collet - 7.4.19-4 - fix uninitialized array in pg_query_params() leading to RCE CVE-2022-31625 -- Gitee