Skip to content

Commit a703030

Browse files
shivammathurshivammathur
committed
Update patches
1 parent 0dea1f3 commit a703030

File tree

91 files changed

+3933
-34
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

91 files changed

+3933
-34
lines changed

‎config/patches/5.6/0204-Fix-81740-PDO-quote-may-return-unquoted-string.patch‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
From: "Christoph M. Becker" <[email protected]>
2+
Date: Mon, 31 Oct 2022 17:20:23 +0100
3+
Subject: Fix #81740: PDO::quote() may return unquoted string
4+
5+
`sqlite3_snprintf()` expects its first parameter to be `int`; we need
6+
to avoid overflow.
7+
8+
(cherry picked from commit 921b6813da3237a83e908998483f46ae3d8bacba)
9+
(cherry picked from commit 7cb160efe19d3dfb8b92629805733ea186b55050)
10+
---
11+
ext/pdo_sqlite/sqlite_driver.c | 3 +++
12+
ext/pdo_sqlite/tests/bug81740.phpt | 17 +++++++++++++++++
13+
2 files changed, 20 insertions(+)
14+
create mode 100644 ext/pdo_sqlite/tests/bug81740.phpt
15+
16+
diff --git a/ext/pdo_sqlite/sqlite_driver.c b/ext/pdo_sqlite/sqlite_driver.c
17+
index 09df8d7..413c23c 100644
18+
--- a/ext/pdo_sqlite/sqlite_driver.c
19+
+++ b/ext/pdo_sqlite/sqlite_driver.c
20+
@@ -232,6 +232,9 @@ static char *pdo_sqlite_last_insert_id(pdo_dbh_t *dbh, const char *name, unsigne
21+
/* NB: doesn't handle binary strings... use prepared stmts for that */
22+
static int sqlite_handle_quoter(pdo_dbh_t *dbh, const char *unquoted, int unquotedlen, char **quoted, int *quotedlen, enum pdo_param_type paramtype TSRMLS_DC)
23+
{
24+
+ if (unquotedlen > (INT_MAX - 3) / 2) {
25+
+ return 0;
26+
+ }
27+
*quoted = safe_emalloc(2, unquotedlen, 3);
28+
sqlite3_snprintf(2*unquotedlen + 3, *quoted, "'%q'", unquoted);
29+
*quotedlen = strlen(*quoted);
30+
diff --git a/ext/pdo_sqlite/tests/bug81740.phpt b/ext/pdo_sqlite/tests/bug81740.phpt
31+
new file mode 100644
32+
index 0000000..99fb07c
33+
--- /dev/null
34+
+++ b/ext/pdo_sqlite/tests/bug81740.phpt
35+
@@ -0,0 +1,17 @@
36+
+--TEST--
37+
+Bug #81740 (PDO::quote() may return unquoted string)
38+
+--SKIPIF--
39+
+<?php
40+
+if (!extension_loaded('pdo_sqlite')) print 'skip not loaded';
41+
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
42+
+?>
43+
+--INI--
44+
+memory_limit=-1
45+
+--FILE--
46+
+<?php
47+
+$pdo = new PDO("sqlite::memory:");
48+
+$string = str_repeat("a", 0x80000000);
49+
+var_dump($pdo->quote($string));
50+
+?>
51+
+--EXPECT--
52+
+bool(false)

‎config/patches/5.6/0205-adapt-test-for-5.x.patch‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
From: Remi Collet <[email protected]>
2+
Date: Tue, 20 Dec 2022 08:42:44 +0100
3+
Subject: adapt test for 5.x
4+
5+
---
6+
ext/pdo_sqlite/tests/bug81740.phpt | 2 +-
7+
1 file changed, 1 insertion(+), 1 deletion(-)
8+
9+
diff --git a/ext/pdo_sqlite/tests/bug81740.phpt b/ext/pdo_sqlite/tests/bug81740.phpt
10+
index 99fb07c..08947e3 100644
11+
--- a/ext/pdo_sqlite/tests/bug81740.phpt
12+
+++ b/ext/pdo_sqlite/tests/bug81740.phpt
13+
@@ -10,7 +10,7 @@ memory_limit=-1
14+
--FILE--
15+
<?php
16+
$pdo = new PDO("sqlite::memory:");
17+
-$string = str_repeat("a", 0x80000000);
18+
+$string = str_repeat("a", 0x7fffffff);
19+
var_dump($pdo->quote($string));
20+
?>
21+
--EXPECT--

‎config/patches/5.6/0206-NEWS.patch‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
From: Remi Collet <[email protected]>
2+
Date: Mon, 19 Dec 2022 09:24:02 +0100
3+
Subject: NEWS
4+
5+
(cherry picked from commit 7328f3a0344806b846bd05657bdce96e47810bf0)
6+
(cherry picked from commit dbfbd99e91701c0a5613133c06305fd70545e9ad)
7+
---
8+
NEWS | 6 ++++++
9+
1 file changed, 6 insertions(+)
10+
11+
diff --git a/NEWS b/NEWS
12+
index 8cb7923..e2c4da6 100644
13+
--- a/NEWS
14+
+++ b/NEWS
15+
@@ -1,6 +1,12 @@
16+
PHP NEWS
17+
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
18+
19+
+Backported from 8.0.27
20+
+
21+
+- PDO/SQLite:
22+
+ . Fixed bug #81740 (PDO::quote() may return unquoted string).
23+
+ (CVE-2022-31631) (cmb)
24+
+
25+
Backported from 7.4.32
26+
27+
- Core:

‎config/patches/5.6/0207-crypt-Fix-validation-of-malformed-BCrypt-hashes.patch‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
From: =?utf-8?q?Tim_D=C3=BCsterhus?= <[email protected]>
2+
Date: Mon, 23 Jan 2023 21:15:24 +0100
3+
Subject: crypt: Fix validation of malformed BCrypt hashes
4+
MIME-Version: 1.0
5+
Content-Type: text/plain; charset="utf-8"
6+
Content-Transfer-Encoding: 8bit
7+
8+
PHP’s implementation of crypt_blowfish differs from the upstream Openwall
9+
version by adding a “PHP Hack”, which allows one to cut short the BCrypt salt
10+
by including a `$` character within the characters that represent the salt.
11+
12+
Hashes that are affected by the “PHP Hack” may erroneously validate any
13+
password as valid when used with `password_verify` and when comparing the
14+
return value of `crypt()` against the input.
15+
16+
The PHP Hack exists since the first version of PHP’s own crypt_blowfish
17+
implementation that was added in 1e820eca02dcf322b41fd2fe4ed2a6b8309f8ab5.
18+
19+
No clear reason is given for the PHP Hack’s existence. This commit removes it,
20+
because BCrypt hashes containing a `$` character in their salt are not valid
21+
BCrypt hashes.
22+
23+
(cherry picked from commit c840f71524067aa474c00c3eacfb83bd860bfc8a)
24+
(cherry picked from commit 7437aaae38cf4b3357e7580f9e22fd4a403b6c23)
25+
(cherry picked from commit ed8df26f0b2834cd35996e6712ac206972cb5324)
26+
---
27+
ext/standard/crypt_blowfish.c | 8 ---
28+
ext/standard/tests/crypt/bcrypt_salt_dollar.phpt | 82 ++++++++++++++++++++++++
29+
2 files changed, 82 insertions(+), 8 deletions(-)
30+
create mode 100644 ext/standard/tests/crypt/bcrypt_salt_dollar.phpt
31+
32+
diff --git a/ext/standard/crypt_blowfish.c b/ext/standard/crypt_blowfish.c
33+
index 5cf3067..e923b55 100644
34+
--- a/ext/standard/crypt_blowfish.c
35+
+++ b/ext/standard/crypt_blowfish.c
36+
@@ -377,7 +377,6 @@ static unsigned char BF_atoi64[0x60] = {
37+
#define BF_safe_atoi64(dst, src) \
38+
{ \
39+
tmp = (unsigned char)(src); \
40+
- if (tmp == '$') break; /* PHP hack */ \
41+
if ((unsigned int)(tmp -= 0x20) >= 0x60) return -1; \
42+
tmp = BF_atoi64[tmp]; \
43+
if (tmp > 63) return -1; \
44+
@@ -405,13 +404,6 @@ static int BF_decode(BF_word *dst, const char *src, int size)
45+
*dptr++ = ((c3 & 0x03) << 6) | c4;
46+
} while (dptr < end);
47+
48+
- if (end - dptr == size) {
49+
- return -1;
50+
- }
51+
-
52+
- while (dptr < end) /* PHP hack */
53+
- *dptr++ = 0;
54+
-
55+
return 0;
56+
}
57+
58+
diff --git a/ext/standard/tests/crypt/bcrypt_salt_dollar.phpt b/ext/standard/tests/crypt/bcrypt_salt_dollar.phpt
59+
new file mode 100644
60+
index 0000000..32e335f
61+
--- /dev/null
62+
+++ b/ext/standard/tests/crypt/bcrypt_salt_dollar.phpt
63+
@@ -0,0 +1,82 @@
64+
+--TEST--
65+
+bcrypt correctly rejects salts containing $
66+
+--FILE--
67+
+<?php
68+
+for ($i = 0; $i < 23; $i++) {
69+
+ $salt = '$2y$04$' . str_repeat('0', $i) . '$';
70+
+ $result = crypt("foo", $salt);
71+
+ var_dump($salt);
72+
+ var_dump($result);
73+
+ var_dump($result === $salt);
74+
+}
75+
+?>
76+
+--EXPECT--
77+
+string(8) "$2y$04$$"
78+
+string(2) "*0"
79+
+bool(false)
80+
+string(9) "$2y$04$0$"
81+
+string(2) "*0"
82+
+bool(false)
83+
+string(10) "$2y$04$00$"
84+
+string(2) "*0"
85+
+bool(false)
86+
+string(11) "$2y$04$000$"
87+
+string(2) "*0"
88+
+bool(false)
89+
+string(12) "$2y$04$0000$"
90+
+string(2) "*0"
91+
+bool(false)
92+
+string(13) "$2y$04$00000$"
93+
+string(2) "*0"
94+
+bool(false)
95+
+string(14) "$2y$04$000000$"
96+
+string(2) "*0"
97+
+bool(false)
98+
+string(15) "$2y$04$0000000$"
99+
+string(2) "*0"
100+
+bool(false)
101+
+string(16) "$2y$04$00000000$"
102+
+string(2) "*0"
103+
+bool(false)
104+
+string(17) "$2y$04$000000000$"
105+
+string(2) "*0"
106+
+bool(false)
107+
+string(18) "$2y$04$0000000000$"
108+
+string(2) "*0"
109+
+bool(false)
110+
+string(19) "$2y$04$00000000000$"
111+
+string(2) "*0"
112+
+bool(false)
113+
+string(20) "$2y$04$000000000000$"
114+
+string(2) "*0"
115+
+bool(false)
116+
+string(21) "$2y$04$0000000000000$"
117+
+string(2) "*0"
118+
+bool(false)
119+
+string(22) "$2y$04$00000000000000$"
120+
+string(2) "*0"
121+
+bool(false)
122+
+string(23) "$2y$04$000000000000000$"
123+
+string(2) "*0"
124+
+bool(false)
125+
+string(24) "$2y$04$0000000000000000$"
126+
+string(2) "*0"
127+
+bool(false)
128+
+string(25) "$2y$04$00000000000000000$"
129+
+string(2) "*0"
130+
+bool(false)
131+
+string(26) "$2y$04$000000000000000000$"
132+
+string(2) "*0"
133+
+bool(false)
134+
+string(27) "$2y$04$0000000000000000000$"
135+
+string(2) "*0"
136+
+bool(false)
137+
+string(28) "$2y$04$00000000000000000000$"
138+
+string(2) "*0"
139+
+bool(false)
140+
+string(29) "$2y$04$000000000000000000000$"
141+
+string(2) "*0"
142+
+bool(false)
143+
+string(30) "$2y$04$0000000000000000000000$"
144+
+string(60) "$2y$04$000000000000000000000u2a2UpVexIt9k3FMJeAVr3c04F5tcI8K"
145+
+bool(false)

‎config/patches/5.6/0208-crypt-Fix-possible-buffer-overread-in-php_crypt.patch‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
From: =?utf-8?q?Tim_D=C3=BCsterhus?= <[email protected]>
2+
Date: Mon, 23 Jan 2023 22:13:57 +0100
3+
Subject: crypt: Fix possible buffer overread in php_crypt()
4+
5+
(cherry picked from commit a92acbad873a05470af1a47cb785a18eadd827b5)
6+
(cherry picked from commit ed0281b588a6840cb95f3134a4e68847a3be5bb7)
7+
(cherry picked from commit bc633b1095280f6a6b96b82f5241c14d25008e7f)
8+
---
9+
ext/standard/crypt.c | 1 +
10+
ext/standard/tests/password/password_bcrypt_short.phpt | 8 ++++++++
11+
2 files changed, 9 insertions(+)
12+
create mode 100644 ext/standard/tests/password/password_bcrypt_short.phpt
13+
14+
diff --git a/ext/standard/crypt.c b/ext/standard/crypt.c
15+
index 1b83d6e..56e1396 100644
16+
--- a/ext/standard/crypt.c
17+
+++ b/ext/standard/crypt.c
18+
@@ -196,6 +196,7 @@ PHPAPI int php_crypt(const char *password, const int pass_len, const char *salt,
19+
} else if (
20+
salt[0] == '$' &&
21+
salt[1] == '2' &&
22+
+ salt[2] != 0 &&
23+
salt[3] == '$' &&
24+
salt[4] >= '0' && salt[4] <= '3' &&
25+
salt[5] >= '0' && salt[5] <= '9' &&
26+
diff --git a/ext/standard/tests/password/password_bcrypt_short.phpt b/ext/standard/tests/password/password_bcrypt_short.phpt
27+
new file mode 100644
28+
index 0000000..085bc8a
29+
--- /dev/null
30+
+++ b/ext/standard/tests/password/password_bcrypt_short.phpt
31+
@@ -0,0 +1,8 @@
32+
+--TEST--
33+
+Test that password_hash() does not overread buffers when a short hash is passed
34+
+--FILE--
35+
+<?php
36+
+var_dump(password_verify("foo", '$2'));
37+
+?>
38+
+--EXPECT--
39+
+bool(false)

‎config/patches/5.6/0209-Fix-array-overrun-when-appending-slash-to-paths.patch‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
From: Niels Dossche <[email protected]>
2+
Date: Fri, 27 Jan 2023 19:28:27 +0100
3+
Subject: Fix array overrun when appending slash to paths
4+
5+
Fix it by extending the array sizes by one character. As the input is
6+
limited to the maximum path length, there will always be place to append
7+
the slash. As the php_check_specific_open_basedir() simply uses the
8+
strings to compare against each other, no new failures related to too
9+
long paths are introduced.
10+
We'll let the DOM and XML case handle a potentially too long path in the
11+
library code.
12+
13+
(cherry picked from commit ec10b28d64decbc54aa1e585dce580f0bd7a5953)
14+
(cherry picked from commit 887cd0710ad856a0d22c329b6ea6c71ebd8621ae)
15+
(cherry picked from commit d43aca084651d395d1191a9751e2ea90036df09e)
16+
---
17+
ext/dom/document.c | 2 +-
18+
ext/xmlreader/php_xmlreader.c | 2 +-
19+
main/fopen_wrappers.c | 6 +++---
20+
3 files changed, 5 insertions(+), 5 deletions(-)
21+
22+
diff --git a/ext/dom/document.c b/ext/dom/document.c
23+
index 1970c38..7cf4464 100644
24+
--- a/ext/dom/document.c
25+
+++ b/ext/dom/document.c
26+
@@ -1498,7 +1498,7 @@ static xmlDocPtr dom_document_parser(zval *id, int mode, char *source, int sourc
27+
int validate, recover, resolve_externals, keep_blanks, substitute_ent;
28+
int resolved_path_len;
29+
int old_error_reporting = 0;
30+
- char *directory=NULL, resolved_path[MAXPATHLEN];
31+
+ char *directory=NULL, resolved_path[MAXPATHLEN + 1];
32+
33+
if (id != NULL) {
34+
intern = (dom_object *)zend_object_store_get_object(id TSRMLS_CC);
35+
diff --git a/ext/xmlreader/php_xmlreader.c b/ext/xmlreader/php_xmlreader.c
36+
index 31208d8..7948b4c 100644
37+
--- a/ext/xmlreader/php_xmlreader.c
38+
+++ b/ext/xmlreader/php_xmlreader.c
39+
@@ -1044,7 +1044,7 @@ PHP_METHOD(xmlreader, XML)
40+
xmlreader_object *intern = NULL;
41+
char *source, *uri = NULL, *encoding = NULL;
42+
int resolved_path_len, ret = 0;
43+
- char *directory=NULL, resolved_path[MAXPATHLEN];
44+
+ char *directory=NULL, resolved_path[MAXPATHLEN + 1];
45+
xmlParserInputBufferPtr inputbfr;
46+
xmlTextReaderPtr reader;
47+
48+
diff --git a/main/fopen_wrappers.c b/main/fopen_wrappers.c
49+
index af9c558..1554aaa 100644
50+
--- a/main/fopen_wrappers.c
51+
+++ b/main/fopen_wrappers.c
52+
@@ -141,10 +141,10 @@ PHPAPI ZEND_INI_MH(OnUpdateBaseDir)
53+
*/
54+
PHPAPI int php_check_specific_open_basedir(const char *basedir, const char *path TSRMLS_DC)
55+
{
56+
- char resolved_name[MAXPATHLEN];
57+
- char resolved_basedir[MAXPATHLEN];
58+
+ char resolved_name[MAXPATHLEN + 1];
59+
+ char resolved_basedir[MAXPATHLEN + 1];
60+
char local_open_basedir[MAXPATHLEN];
61+
- char path_tmp[MAXPATHLEN];
62+
+ char path_tmp[MAXPATHLEN + 1];
63+
char *path_file;
64+
int resolved_basedir_len;
65+
int resolved_name_len;

‎config/patches/5.6/0210-NEWS.patch‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
From: Remi Collet <[email protected]>
2+
Date: Mon, 13 Feb 2023 11:46:47 +0100
3+
Subject: NEWS
4+
5+
(cherry picked from commit 614468ce4056c0ef93aae09532dcffdf65b594b5)
6+
---
7+
NEWS | 8 ++++++++
8+
1 file changed, 8 insertions(+)
9+
10+
diff --git a/NEWS b/NEWS
11+
index e2c4da6..27b96a6 100644
12+
--- a/NEWS
13+
+++ b/NEWS
14+
@@ -1,6 +1,14 @@
15+
PHP NEWS
16+
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
17+
18+
+Backported from 8.0.28
19+
+
20+
+- Core:
21+
+ . Fixed bug #81744 (Password_verify() always return true with some hash).
22+
+ (CVE-2023-0567). (Tim Düsterhus)
23+
+ . Fixed bug #81746 (1-byte array overrun in common path resolve code).
24+
+ (CVE-2023-0568). (Niels Dossche)
25+
+
26+
Backported from 8.0.27
27+
28+
- PDO/SQLite:

0 commit comments

Comments
 (0)