diff --git a/php-CVE-2022-31626.patch b/php-CVE-2022-31626.patch new file mode 100644 index 0000000000000000000000000000000000000000..7f89dcb3558b55f22748db5b74af0087e5646c12 --- /dev/null +++ b/php-CVE-2022-31626.patch @@ -0,0 +1,23 @@ +From 58006537fc5f133ae8549efe5118cde418b3ace9 Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev +Date: Mon, 6 Jun 2022 00:56:51 -0600 +Subject: [PATCH] Fix bug #81719: mysqlnd/pdo password buffer overflow + +--- + ext/mysqlnd/mysqlnd_wireprotocol.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/ext/mysqlnd/mysqlnd_wireprotocol.c b/ext/mysqlnd/mysqlnd_wireprotocol.c +index 87b2e7c31331..e4a298adaea4 100644 +--- a/ext/mysqlnd/mysqlnd_wireprotocol.c ++++ b/ext/mysqlnd/mysqlnd_wireprotocol.c +@@ -771,7 +771,8 @@ php_mysqlnd_change_auth_response_write(MYSQLND_CONN_DATA * conn, void * _packet) + MYSQLND_VIO * vio = conn->vio; + MYSQLND_STATS * stats = conn->stats; + MYSQLND_CONNECTION_STATE * connection_state = &conn->state; +- zend_uchar * const buffer = pfc->cmd_buffer.length >= packet->auth_data_len? pfc->cmd_buffer.buffer : mnd_emalloc(packet->auth_data_len); ++ size_t total_packet_size = packet->auth_data_len + MYSQLND_HEADER_SIZE; ++ zend_uchar * const buffer = pfc->cmd_buffer.length >= total_packet_size? pfc->cmd_buffer.buffer : mnd_emalloc(total_packet_size); + zend_uchar * p = buffer + MYSQLND_HEADER_SIZE; /* start after the header */ + + DBG_ENTER("php_mysqlnd_change_auth_response_write"); diff --git a/php.spec b/php.spec index ebddce65b5b7497f20da9692f5ea28f1774bcce2..ac8a89857ec8d67d8f07fdc6dac52531f68cde8f 100644 --- a/php.spec +++ b/php.spec @@ -61,7 +61,7 @@ Summary: PHP scripting language for creating dynamic web sites Name: php Version: %{upver}%{?rcver:~%{rcver}} -Release: 2%{anolis_release}%{?dist} +Release: 3%{anolis_release}%{?dist} # All files licensed under PHP version 3.01, except # Zend is licensed under Zend # TSRM is licensed under BSD @@ -120,6 +120,7 @@ Patch51: php-8.0.13-crypt.patch # Upstream fixes (100+) # Security fixes (200+) +Patch200: php-CVE-2022-31626.patch # Fixes for tests (300+) # Factory is droped from system tzdata @@ -712,6 +713,7 @@ in pure PHP. # upstream patches # security patches +%patch200 -p1 -b .cve31626 # Fixes for tests %patch300 -p1 -b .datetests @@ -1509,9 +1511,13 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || : %changelog -* Wed Apr 20 2022 Liwei Ge - 8.0.13-2.0.1 +* Sat Jul 02 2022 Liwei Ge - 8.0.13-3.0.1 - Support loongarch64 platform +* Wed Jun 22 2022 Remi Collet - 8.0.13-3 +- fix password of excessive length triggers buffer overflow leading to RCE + CVE-2022-31626 + * Tue Dec 14 2021 Remi Collet - 8.0.13-2 - refresh provided configuration from upstream