addpkg: php53 5.3.29-4

1 files changed, 182 insertions, 0 deletions

diff --git a/CVE-2015-0273.patch b/CVE-2015-0273.patch
new file mode 100644
index 000000000000..cd4768be2c53
--- /dev/null
+++ b/CVE-2015-0273.patch
@@ -0,0 +1,182 @@
+Backport of:
+
+From 7b1898183032eeabc64a086ff040af991cebcd93 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas@php.net>
+Date: Sat, 31 Jan 2015 22:40:08 -0800
+Subject: [PATCH] Fix bug #68942 (Use after free vulnerability in unserialize()
+ with DateTimeZone)
+
+and:
+
+From 8d199c7c4f93ebe5b9293096143d7007a6ad13a4 Mon Sep 17 00:00:00 2001
+From: Anatol Belski <ab@php.net>
+Date: Tue, 19 Mar 2013 21:19:55 +0100
+Subject: [PATCH] Backported fix for bug #62852
+
+Index: php5-5.3.10/ext/date/php_date.c
+===================================================================
+--- php5-5.3.10.orig/ext/date/php_date.c	2015-03-16 16:51:20.694390712 -0400
++++ php5-5.3.10/ext/date/php_date.c	2015-03-16 16:53:43.635562605 -0400
+@@ -2539,26 +2539,23 @@
+ 	timelib_tzinfo   *tzi;
+ 	php_timezone_obj *tzobj;
+ 
+-	if (zend_hash_find(myht, "date", 5, (void**) &z_date) == SUCCESS) {
+-		convert_to_string(*z_date);
+-		if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS) {
+-			convert_to_long(*z_timezone_type);
+-			if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS) {
+-				convert_to_string(*z_timezone);
++	if (zend_hash_find(myht, "date", 5, (void**) &z_date) == SUCCESS && Z_TYPE_PP(z_date) == IS_STRING) {
++		if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS && Z_TYPE_PP(z_timezone_type) == IS_LONG) {
++			if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS && Z_TYPE_PP(z_timezone) == IS_STRING) {
+ 
+ 				switch (Z_LVAL_PP(z_timezone_type)) {
+ 					case TIMELIB_ZONETYPE_OFFSET:
+ 					case TIMELIB_ZONETYPE_ABBR: {
+ 						char *tmp = emalloc(Z_STRLEN_PP(z_date) + Z_STRLEN_PP(z_timezone) + 2);
++						int ret;
+ 						snprintf(tmp, Z_STRLEN_PP(z_date) + Z_STRLEN_PP(z_timezone) + 2, "%s %s", Z_STRVAL_PP(z_date), Z_STRVAL_PP(z_timezone));
+-						php_date_initialize(*dateobj, tmp, Z_STRLEN_PP(z_date) + Z_STRLEN_PP(z_timezone) + 1, NULL, NULL, 0 TSRMLS_CC);
++						ret = php_date_initialize(*dateobj, tmp, Z_STRLEN_PP(z_date) + Z_STRLEN_PP(z_timezone) + 1, NULL, NULL, 0 TSRMLS_CC);
+ 						efree(tmp);
+-						return 1;
++						return 1 == ret;
+ 					}
+ 
+-					case TIMELIB_ZONETYPE_ID:
+-						convert_to_string(*z_timezone);
+-
++					case TIMELIB_ZONETYPE_ID: {
++						int ret;
+ 						tzi = php_date_parse_tzfile(Z_STRVAL_PP(z_timezone), DATE_TIMEZONEDB TSRMLS_CC);
+ 
+ 						ALLOC_INIT_ZVAL(tmp_obj);
+@@ -2567,9 +2564,10 @@
+ 						tzobj->tzi.tz = tzi;
+ 						tzobj->initialized = 1;
+ 
+-						php_date_initialize(*dateobj, Z_STRVAL_PP(z_date), Z_STRLEN_PP(z_date), NULL, tmp_obj, 0 TSRMLS_CC);
++						ret = php_date_initialize(*dateobj, Z_STRVAL_PP(z_date), Z_STRLEN_PP(z_date), NULL, tmp_obj, 0 TSRMLS_CC);
+ 						zval_ptr_dtor(&tmp_obj);
+-						return 1;
++						return 1 == ret;
++					}
+ 				}
+ 			}
+ 		}
+@@ -2593,7 +2591,9 @@
+ 
+ 	php_date_instantiate(date_ce_date, return_value TSRMLS_CC);
+ 	dateobj = (php_date_obj *) zend_object_store_get_object(return_value TSRMLS_CC);
+-	php_date_initialize_from_hash(&return_value, &dateobj, myht TSRMLS_CC);
++	if (!php_date_initialize_from_hash(&return_value, &dateobj, myht TSRMLS_CC)) {
++		php_error(E_ERROR, "Invalid serialization data for DateTime object");
++	}
+ }
+ /* }}} */
+ 
+@@ -2609,7 +2609,9 @@
+ 
+ 	myht = Z_OBJPROP_P(object);
+ 
+-	php_date_initialize_from_hash(&return_value, &dateobj, myht TSRMLS_CC);
++	if (!php_date_initialize_from_hash(&return_value, &dateobj, myht TSRMLS_CC)) {
++		php_error(E_ERROR, "Invalid serialization data for DateTime object");
++	}
+ }
+ /* }}} */
+ 
+Index: php5-5.3.10/ext/date/tests/bug68942_2.phpt
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ php5-5.3.10/ext/date/tests/bug68942_2.phpt	2015-03-16 16:51:20.690390678 -0400
+@@ -0,0 +1,9 @@
++--TEST--
++Bug #68942 (Use after free vulnerability in unserialize() with DateTime).
++--FILE--
++<?php
++$data = unserialize('a:2:{i:0;O:8:"DateTime":3:{s:4:"date";s:26:"2000-01-01 00:00:00.000000";s:13:"timezone_type";a:2:{i:0;i:1;i:1;i:2;}s:8:"timezone";s:1:"A";}i:1;R:5;}');
++var_dump($data);
++?>
++--EXPECTF--
++Fatal error: Invalid serialization data for DateTime object in %s/bug68942_2.php on line %d
+Index: php5-5.3.10/ext/date/tests/bug62852.phpt
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ php5-5.3.10/ext/date/tests/bug62852.phpt	2015-03-16 16:55:12.372289384 -0400
+@@ -0,0 +1,14 @@
++--TEST--
++Bug #62852 (Unserialize invalid DateTime causes crash), variation 1
++--INI--
++date.timezone=GMT
++--FILE--
++<?php
++$s1 = 'O:8:"DateTime":3:{s:4:"date";s:20:"10007-06-07 03:51:49";s:13:"timezone_type";i:3;s:8:"timezone";s:3:"UTC";}';
++
++try {
++    unserialize( $s1 );
++} catch ( Exception $e ) {}
++
++--EXPECTF--
++Fatal error: Invalid serialization data for DateTime object in %sbug62852.php on line %d
+Index: php5-5.3.10/ext/date/tests/bug62852_var2.phpt
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ php5-5.3.10/ext/date/tests/bug62852_var2.phpt	2015-03-16 16:52:15.814842786 -0400
+@@ -0,0 +1,25 @@
++--TEST--
++Bug #62852 (Unserialize invalid DateTime causes crash), variation 2
++--INI--
++date.timezone=GMT
++--FILE--
++<?php
++$s2 = 'O:3:"Foo":3:{s:4:"date";s:20:"10007-06-07 03:51:49";s:13:"timezone_type";i:3;s:8:"timezone";s:3:"UTC";}';
++
++global $foo;
++
++class Foo extends DateTime {
++    function __wakeup() {
++        global $foo;
++        $foo = $this;
++        parent::__wakeup();
++    }
++}
++
++try {
++    unserialize( $s2 );
++} catch ( Exception $e ) {}
++var_dump( $foo );
++
++--EXPECTF--
++Fatal error: Invalid serialization data for DateTime object in %sbug62852_var2.php on line %d
+Index: php5-5.3.10/ext/date/tests/bug62852_var3.phpt
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ php5-5.3.10/ext/date/tests/bug62852_var3.phpt	2015-03-16 16:52:15.814842786 -0400
+@@ -0,0 +1,25 @@
++--TEST--
++Bug #62852 (Unserialize invalid DateTime causes crash), variation 3
++--INI--
++date.timezone=GMT
++--FILE--
++<?php
++$s2 = 'O:3:"Foo":3:{s:4:"date";s:19:"0000-00-00 00:00:00";s:13:"timezone_type";i:0;s:8:"timezone";s:3:"UTC";}';
++
++global $foo;
++
++class Foo extends DateTime {
++    function __wakeup() {
++        global $foo;
++        $foo = $this;
++        parent::__wakeup();
++    }
++}
++
++try {
++    unserialize( $s2 );
++} catch ( Exception $e ) {}
++var_dump( $foo );
++
++--EXPECTF--
++Fatal error: Invalid serialization data for DateTime object in %sbug62852_var3.php on line %d