From 1b956b49241d378ba33a70905f2e1b6518ae463d Mon Sep 17 00:00:00 2001 From: Hugel <2712504175@qq.com> Date: Sat, 18 Jun 2022 10:50:35 +0800 Subject: [PATCH] CVE-2022-31625 CVE-2022-31626 --- backport-CVE-2022-31625.patch | 57 +++++++++++++++++++++++++++++++++++ backport-CVE-2022-31626.patch | 21 +++++++++++++ php.spec | 7 ++++- 3 files changed, 84 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2022-31625.patch create mode 100644 backport-CVE-2022-31626.patch diff --git a/backport-CVE-2022-31625.patch b/backport-CVE-2022-31625.patch new file mode 100644 index 0000000..3eafb5a --- /dev/null +++ b/backport-CVE-2022-31625.patch @@ -0,0 +1,57 @@ +From 55f6895f4b4c677272fd4ee1113acdbd99c4b5ab Mon Sep 17 00:00:00 2001 +From: "Christoph M. Becker" +Date: Tue, 17 May 2022 12:59:23 +0200 +Subject: [PATCH] Fix #81720: Uninitialized array in pg_query_params() leading + to RCE + +We must not free parameters which we haven't initialized yet. + +We also fix the not directly related issue, that we checked for the +wrong value being `NULL`, potentially causing a segfault. +--- + ext/pgsql/pgsql.c | 6 +++--- + ext/pgsql/tests/bug81720.phpt | 27 +++++++++++++++++++++++++++ + 2 files changed, 30 insertions(+), 3 deletions(-) + create mode 100644 ext/pgsql/tests/bug81720.phpt + +--- a/ext/pgsql/pgsql.c ++++ b/ext/pgsql/pgsql.c +@@ -1988,7 +1988,7 @@ PHP_FUNCTION(pg_query_params) + if (Z_TYPE(tmp_val) != IS_STRING) { + php_error_docref(NULL, E_WARNING,"Error converting parameter"); + zval_ptr_dtor(&tmp_val); +- _php_pgsql_free_params(params, num_params); ++ _php_pgsql_free_params(params, i); + RETURN_FALSE; + } + params[i] = estrndup(Z_STRVAL(tmp_val), Z_STRLEN(tmp_val)); +--- /dev/null ++++ b/ext/pgsql/tests/bug81720.phpt +@@ -0,0 +1,27 @@ ++--TEST-- ++Bug #81720 (Uninitialized array in pg_query_params() leading to RCE) ++--SKIPIF-- ++ ++--FILE-- ++getMessage(), PHP_EOL; ++} ++ ++try { ++ pg_send_prepare($conn, "my_query", 'SELECT $1, $2'); ++ pg_get_result($conn); ++ pg_send_execute($conn, "my_query", [1, new stdClass()]); ++} catch (Throwable $ex) { ++ echo $ex->getMessage(), PHP_EOL; ++} ++?> ++--EXPECT-- ++Object of class stdClass could not be converted to string ++Object of class stdClass could not be converted to string diff --git a/backport-CVE-2022-31626.patch b/backport-CVE-2022-31626.patch new file mode 100644 index 0000000..8a0a90e --- /dev/null +++ b/backport-CVE-2022-31626.patch @@ -0,0 +1,21 @@ +From 58006537fc5f133ae8549efe5118cde418b3ace9 Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev +Date: Mon, 6 Jun 2022 00:56:51 -0600 +Subject: [PATCH] Fix bug #81719: mysqlnd/pdo password buffer overflow + +--- + ext/mysqlnd/mysqlnd_wireprotocol.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/ext/mysqlnd/mysqlnd_wireprotocol.c ++++ b/ext/mysqlnd/mysqlnd_wireprotocol.c +@@ -794,7 +794,8 @@ php_mysqlnd_change_auth_response_write(v + MYSQLND_VIO * vio = packet->header.vio; + MYSQLND_STATS * stats = packet->header.stats; + MYSQLND_CONNECTION_STATE * connection_state = packet->header.connection_state; +- zend_uchar * buffer = pfc->cmd_buffer.length >= packet->auth_data_len? pfc->cmd_buffer.buffer : mnd_emalloc(packet->auth_data_len); ++ size_t total_packet_size = packet->auth_data_len + MYSQLND_HEADER_SIZE; ++ zend_uchar * buffer = pfc->cmd_buffer.length >= total_packet_size? pfc->cmd_buffer.buffer : mnd_emalloc(total_packet_size); + zend_uchar * p = buffer + MYSQLND_HEADER_SIZE; /* start after the header */ + + DBG_ENTER("php_mysqlnd_change_auth_response_write"); diff --git a/php.spec b/php.spec index a09517e..716a097 100644 --- a/php.spec +++ b/php.spec @@ -28,7 +28,7 @@ Name: php Version: %{upver}%{?rcver:~%{rcver}} -Release: 19 +Release: 20 Summary: PHP scripting language for creating dynamic web sites License: PHP and Zend and BSD and MIT and ASL 1.0 and NCSA LGPL-2.1+ and Apache-2.0 and Artistic-1.0-Perl URL: http://www.php.net/ @@ -115,6 +115,8 @@ Patch6041: backport-CVE-2020-7067-Fix-bug-79465-use-unsigneds-as-indexes.pat Patch6042: backport-CVE-2019-11038-Fix-77973-Uninitialized-read-in-gdImageCreateFromXbm.patch Patch6043: backport-CVE-2019-11039-Fix-bug-78069-Out-of-bounds-read-in-iconv.c-_php_ico.patch Patch6044: backport-CVE-2019-11040-Fix-bug-77988-heap-buffer-overflow-on-php_jpg_get16.patch +Patch6045: backport-CVE-2022-31625.patch +Patch6046: backport-CVE-2022-31626.patch BuildRequires: bzip2-devel, curl-devel >= 7.9, httpd-devel >= 2.0.46-1, pam-devel, httpd-filesystem, nginx-filesystem BuildRequires: libstdc++-devel, openssl-devel, sqlite-devel >= 3.6.0, zlib-devel, smtpdaemon, libedit-devel @@ -1176,6 +1178,9 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || : %changelog +* Sat Jun 18 2022 Hugel - 7.2.10-20 +- Fix CVE-2022-31625 CVE-2022-31626 + * Mon Feb 28 2022 wangchen - 7.2.10-19 - Fix CVE-2019-11038 CVE-2019-11039 CVE-2019-11040 -- Gitee