From e146b5224433865eb38de2d0919acb3ec77b4738 Mon Sep 17 00:00:00 2001 From: hongwei-qin Date: Sat, 2 Jul 2022 11:18:20 +0800 Subject: [PATCH 1/2] update to php-8.0.13-3.module+el8.6.0+15725+0c79e7c4 Signed-off-by: hongwei-qin --- 1000-anolis-php-support-loongarch64.patch | 23 ----------------------- php-CVE-2022-31626.patch | 23 +++++++++++++++++++++++ php.spec | 14 ++++++-------- 3 files changed, 29 insertions(+), 31 deletions(-) delete mode 100644 1000-anolis-php-support-loongarch64.patch create mode 100644 php-CVE-2022-31626.patch diff --git a/1000-anolis-php-support-loongarch64.patch b/1000-anolis-php-support-loongarch64.patch deleted file mode 100644 index f23cddb..0000000 --- a/1000-anolis-php-support-loongarch64.patch +++ /dev/null @@ -1,23 +0,0 @@ -diff -Nur php-7.2.24.new/build/config.guess php-7.2.24/build/config.guess ---- php-7.2.24.new/build/config.guess 2021-11-08 19:01:51.684000000 +0800 -+++ php-7.2.24/build/config.guess 2021-11-08 19:04:15.004000000 +0800 -@@ -891,6 +891,9 @@ - UNAME_MACHINE=aarch64_be - GUESS=$UNAME_MACHINE-unknown-linux-$LIBC - ;; -+ loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*) -+ GUESS="$UNAME_MACHINE"-unknown-linux-"$LIBC" -+ ;; - alpha:Linux:*:*) - case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' /proc/cpuinfo 2>/dev/null` in - EV5) UNAME_MACHINE=alphaev5 ;; ---- php-7.4.6/build/config.sub 2020-05-12 16:09:15.000000000 +0800 -+++ php-7.4.6/build/config.sub.new 2021-11-10 11:23:11.386075262 +0800 -@@ -1160,6 +1160,7 @@ - 1750a | 580 \ - | a29k \ - | aarch64 | aarch64_be \ -+ | loongarch32 | loongarch64 | loongarchx32 \ - | abacus \ - | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] \ - | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] \ diff --git a/php-CVE-2022-31626.patch b/php-CVE-2022-31626.patch new file mode 100644 index 0000000..7f89dcb --- /dev/null +++ b/php-CVE-2022-31626.patch @@ -0,0 +1,23 @@ +From 58006537fc5f133ae8549efe5118cde418b3ace9 Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev +Date: Mon, 6 Jun 2022 00:56:51 -0600 +Subject: [PATCH] Fix bug #81719: mysqlnd/pdo password buffer overflow + +--- + ext/mysqlnd/mysqlnd_wireprotocol.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/ext/mysqlnd/mysqlnd_wireprotocol.c b/ext/mysqlnd/mysqlnd_wireprotocol.c +index 87b2e7c31331..e4a298adaea4 100644 +--- a/ext/mysqlnd/mysqlnd_wireprotocol.c ++++ b/ext/mysqlnd/mysqlnd_wireprotocol.c +@@ -771,7 +771,8 @@ php_mysqlnd_change_auth_response_write(MYSQLND_CONN_DATA * conn, void * _packet) + MYSQLND_VIO * vio = conn->vio; + MYSQLND_STATS * stats = conn->stats; + MYSQLND_CONNECTION_STATE * connection_state = &conn->state; +- zend_uchar * const buffer = pfc->cmd_buffer.length >= packet->auth_data_len? pfc->cmd_buffer.buffer : mnd_emalloc(packet->auth_data_len); ++ size_t total_packet_size = packet->auth_data_len + MYSQLND_HEADER_SIZE; ++ zend_uchar * const buffer = pfc->cmd_buffer.length >= total_packet_size? pfc->cmd_buffer.buffer : mnd_emalloc(total_packet_size); + zend_uchar * p = buffer + MYSQLND_HEADER_SIZE; /* start after the header */ + + DBG_ENTER("php_mysqlnd_change_auth_response_write"); diff --git a/php.spec b/php.spec index ebddce6..25dae18 100644 --- a/php.spec +++ b/php.spec @@ -1,4 +1,3 @@ -%define anolis_release .0.1 # RHEL / Fedora spec file for php # # License: MIT @@ -61,7 +60,7 @@ Summary: PHP scripting language for creating dynamic web sites Name: php Version: %{upver}%{?rcver:~%{rcver}} -Release: 2%{anolis_release}%{?dist} +Release: 3%{?dist} # All files licensed under PHP version 3.01, except # Zend is licensed under Zend # TSRM is licensed under BSD @@ -120,13 +119,12 @@ Patch51: php-8.0.13-crypt.patch # Upstream fixes (100+) # Security fixes (200+) +Patch200: php-CVE-2022-31626.patch # Fixes for tests (300+) # Factory is droped from system tzdata Patch300: php-7.4.0-datetests.patch -Patch1000: 1000-anolis-php-support-loongarch64.patch - BuildRequires: gnupg2 BuildRequires: bzip2-devel @@ -712,12 +710,11 @@ in pure PHP. # upstream patches # security patches +%patch200 -p1 -b .cve31626 # Fixes for tests %patch300 -p1 -b .datetests -%patch1000 -p1 - # Prevent %%doc confusion over LICENSE files cp Zend/LICENSE Zend/ZEND_LICENSE @@ -1509,8 +1506,9 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || : %changelog -* Wed Apr 20 2022 Liwei Ge - 8.0.13-2.0.1 -- Support loongarch64 platform +* Wed Jun 22 2022 Remi Collet - 8.0.13-3 +- fix password of excessive length triggers buffer overflow leading to RCE + CVE-2022-31626 * Tue Dec 14 2021 Remi Collet - 8.0.13-2 - refresh provided configuration from upstream -- Gitee From 8611aafffae7a5d83f290fdfa28b655c4a41f1c0 Mon Sep 17 00:00:00 2001 From: Liwei Ge Date: Mon, 8 Nov 2021 21:59:28 +0800 Subject: [PATCH 2/2] build: support loongarch64 platform Signed-off-by: Liwei Ge --- 1000-anolis-php-support-loongarch64.patch | 23 +++++++++++++++++++++++ php.spec | 10 +++++++++- 2 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 1000-anolis-php-support-loongarch64.patch diff --git a/1000-anolis-php-support-loongarch64.patch b/1000-anolis-php-support-loongarch64.patch new file mode 100644 index 0000000..f23cddb --- /dev/null +++ b/1000-anolis-php-support-loongarch64.patch @@ -0,0 +1,23 @@ +diff -Nur php-7.2.24.new/build/config.guess php-7.2.24/build/config.guess +--- php-7.2.24.new/build/config.guess 2021-11-08 19:01:51.684000000 +0800 ++++ php-7.2.24/build/config.guess 2021-11-08 19:04:15.004000000 +0800 +@@ -891,6 +891,9 @@ + UNAME_MACHINE=aarch64_be + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; ++ loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*) ++ GUESS="$UNAME_MACHINE"-unknown-linux-"$LIBC" ++ ;; + alpha:Linux:*:*) + case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' /proc/cpuinfo 2>/dev/null` in + EV5) UNAME_MACHINE=alphaev5 ;; +--- php-7.4.6/build/config.sub 2020-05-12 16:09:15.000000000 +0800 ++++ php-7.4.6/build/config.sub.new 2021-11-10 11:23:11.386075262 +0800 +@@ -1160,6 +1160,7 @@ + 1750a | 580 \ + | a29k \ + | aarch64 | aarch64_be \ ++ | loongarch32 | loongarch64 | loongarchx32 \ + | abacus \ + | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] \ + | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] \ diff --git a/php.spec b/php.spec index 25dae18..ac8a898 100644 --- a/php.spec +++ b/php.spec @@ -1,3 +1,4 @@ +%define anolis_release .0.1 # RHEL / Fedora spec file for php # # License: MIT @@ -60,7 +61,7 @@ Summary: PHP scripting language for creating dynamic web sites Name: php Version: %{upver}%{?rcver:~%{rcver}} -Release: 3%{?dist} +Release: 3%{anolis_release}%{?dist} # All files licensed under PHP version 3.01, except # Zend is licensed under Zend # TSRM is licensed under BSD @@ -125,6 +126,8 @@ Patch200: php-CVE-2022-31626.patch # Factory is droped from system tzdata Patch300: php-7.4.0-datetests.patch +Patch1000: 1000-anolis-php-support-loongarch64.patch + BuildRequires: gnupg2 BuildRequires: bzip2-devel @@ -715,6 +718,8 @@ in pure PHP. # Fixes for tests %patch300 -p1 -b .datetests +%patch1000 -p1 + # Prevent %%doc confusion over LICENSE files cp Zend/LICENSE Zend/ZEND_LICENSE @@ -1506,6 +1511,9 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || : %changelog +* Sat Jul 02 2022 Liwei Ge - 8.0.13-3.0.1 +- Support loongarch64 platform + * Wed Jun 22 2022 Remi Collet - 8.0.13-3 - fix password of excessive length triggers buffer overflow leading to RCE CVE-2022-31626 -- Gitee