[Pkg-php-commits] r883 - in php4/branches/etch/debian: . patches

[Sean Finney]

Author: seanius
Date: 2007-09-20 17:11:11 +0000 (Thu, 20 Sep 2007)
New Revision: 883

Added:
   php4/branches/etch/debian/patches/077-CVE-2007-3799_session.patch
   php4/branches/etch/debian/patches/078-CVE-2007-4657_strcspn.patch
Modified:
   php4/branches/etch/debian/changelog
Log:
two CVE fixes

Modified: php4/branches/etch/debian/changelog
===================================================================
--- php4/branches/etch/debian/changelog	2007-09-20 00:45:45 UTC (rev 882)
+++ php4/branches/etch/debian/changelog	2007-09-20 17:11:11 UTC (rev 883)
@@ -1,8 +1,12 @@
 php4 (6:4.4.4-8+etch5) UNRELEASED; urgency=low
 
   * NOT RELEASED YET
+  * NMU prepared for the security team by the package maintainer.
+  * The following security issues are addressed with this update:
+    - CVE-2007-3799: session insertion vulnerability
+    - CVE-2007-4657: integer overflows in strspn/strcspn
 
- -- sean finney <sean at rangda.stickybit.se>  Sat, 30 Jun 2007 16:59:46 +0200
+ -- sean finney <seanius at debian.org>  Thu, 20 Sep 2007 19:02:43 +0200
 
 php4 (6:4.4.4-8+etch4) stable-security; urgency=low
 

Added: php4/branches/etch/debian/patches/077-CVE-2007-3799_session.patch
===================================================================
--- php4/branches/etch/debian/patches/077-CVE-2007-3799_session.patch	                        (rev 0)
+++ php4/branches/etch/debian/patches/077-CVE-2007-3799_session.patch	2007-09-20 17:11:11 UTC (rev 883)
@@ -0,0 +1,31 @@
+--- old/ext/session/session.c	2007/06/15 22:45:25	1.336.2.53.2.19
++++ new/ext/session/session.c	2007/06/16 07:48:23	1.336.2.53.2.20
+@@ -918,6 +918,7 @@
+ {
+ 	smart_str ncookie = {0};
+ 	char *date_fmt = NULL;
++	char *e_session_name, *e_id;
+ 
+ 	if (SG(headers_sent)) {
+ 		char *output_start_filename = php_get_output_start_filename(TSRMLS_C);
+@@ -931,11 +932,18 @@
+ 		}	
+ 		return;
+ 	}
++	
++	/* URL encode session_name and id because they might be user supplied */
++	e_session_name = php_url_encode(PS(session_name), strlen(PS(session_name)), NULL);
++	e_id = php_url_encode(PS(id), strlen(PS(id)), NULL);
+ 
+ 	smart_str_appends(&ncookie, COOKIE_SET_COOKIE);
+-	smart_str_appends(&ncookie, PS(session_name));
++	smart_str_appends(&ncookie, e_session_name);
+ 	smart_str_appendc(&ncookie, '=');
+-	smart_str_appends(&ncookie, PS(id));
++	smart_str_appends(&ncookie, e_id);
++	
++	efree(e_session_name);
++	efree(e_id);
+ 	
+ 	if (PS(cookie_lifetime) > 0) {
+ 		struct timeval tv;

Added: php4/branches/etch/debian/patches/078-CVE-2007-4657_strcspn.patch
===================================================================
--- php4/branches/etch/debian/patches/078-CVE-2007-4657_strcspn.patch	                        (rev 0)
+++ php4/branches/etch/debian/patches/078-CVE-2007-4657_strcspn.patch	2007-09-20 17:11:11 UTC (rev 883)
@@ -0,0 +1,74 @@
+--- old/ext/standard/string.c	2007/05/24 21:31:05	1.333.2.52.2.13
++++ new/ext/standard/string.c	2007/06/06 18:38:47	1.333.2.52.2.16
+@@ -234,10 +234,14 @@
+ 		}
+ 	}
+ 	
+-	if (((unsigned) start + (unsigned) len) > len1) {
++	if (len > len1 - start) {
+ 		len = len1 - start;
+ 	}
+ 
++	if(len == 0) {
++		RETURN_LONG(0);
++	}
++
+ 	s = s22;
+ 	e = s22 + len2;
+ 	while (s < e) {
+@@ -1511,11 +1515,25 @@
+ 	char *p, *q;
+ 	int chunks; /* complete chunks! */
+ 	int restlen;
++	int out_len;
+ 
+ 	chunks = srclen / chunklen;
+ 	restlen = srclen - chunks * chunklen; /* srclen % chunklen */
+ 
+-	dest = safe_emalloc(sizeof(char), (srclen + (chunks + 1) * endlen + 1), 0);
++	if(chunks > INT_MAX - 1) {
++		return NULL;
++	}
++	out_len = chunks + 1;
++	if(endlen != 0 && out_len > INT_MAX/endlen) {
++		return NULL;
++	}
++	out_len *= endlen;
++	if(out_len > INT_MAX - srclen - 1) {
++		return NULL;
++	}
++	out_len += srclen + 1;
++
++	dest = safe_emalloc(out_len, sizeof(char), 0);
+ 
+ 	for (p = src, q = dest; p < (src + srclen - chunklen + 1); ) {
+ 		memcpy(q, p, chunklen);
+@@ -4088,12 +4106,27 @@
+ 
+ PHP_FUNCTION(money_format) {
+ 	int format_len = 0, str_len;
+-	char *format, *str;
++	char *format, *str, *p, *e;
+ 	double value;
++	zend_bool check = 0;
+ 
+ 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sd",
+ 							  &format, &format_len, &value) == FAILURE) {
+ 		return;
++	}
++
++	p = format;
++	e = p + format_len;
++	while ((p = memchr(p, '%', (e - p)))) {
++		if (*(p + 1) == '%') {
++			p += 2;	
++		} else if (!check) {
++			check = 1;
++			p++;
++		} else {
++			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Only a single %%i or %%n token can be used");
++			RETURN_FALSE;
++		}
+ 	}
+ 
+ 	str_len = format_len + 1024;