[Pkg-php-commits] r1085 - php5/branches/lenny/debian/patches
Sean Finney
seanius at alioth.debian.org
Tue May 27 17:51:57 UTC 2008
Author: seanius
Date: 2008-05-27 17:51:56 +0000 (Tue, 27 May 2008)
New Revision: 1085
Added:
php5/branches/lenny/debian/patches/CVE-2008-1384
php5/branches/lenny/debian/patches/CVE-2008-2050.patch
php5/branches/lenny/debian/patches/CVE-2008-2051.patch
Modified:
php5/branches/lenny/debian/patches/series
Log:
backported patches for CVE entries
Added: php5/branches/lenny/debian/patches/CVE-2008-1384
===================================================================
--- php5/branches/lenny/debian/patches/CVE-2008-1384 (rev 0)
+++ php5/branches/lenny/debian/patches/CVE-2008-1384 2008-05-27 17:51:56 UTC (rev 1085)
@@ -0,0 +1,34 @@
+http://cvs.php.net/viewvc.cgi/php-src/ext/standard/formatted_print.c?r1=1.104&r2=1.105&view=patch
+Index: php5-5.2.5/ext/standard/formatted_print.c
+===================================================================
+--- php5-5.2.5.orig/ext/standard/formatted_print.c
++++ php5-5.2.5/ext/standard/formatted_print.c
+@@ -76,6 +76,7 @@ php_sprintf_appendstring(char **buffer,
+ register int npad;
+ int req_size;
+ int copy_len;
++ int m_width;
+
+ copy_len = (expprec ? MIN(max_width, len) : len);
+ npad = min_width - copy_len;
+@@ -86,11 +87,19 @@ php_sprintf_appendstring(char **buffer,
+
+ PRINTF_DEBUG(("sprintf: appendstring(%x, %d, %d, \"%s\", %d, '%c', %d)\n",
+ *buffer, *pos, *size, add, min_width, padding, alignment));
++ m_width = MAX(min_width, copy_len);
+
+- req_size = *pos + MAX(min_width, copy_len) + 1;
++ if(m_width > INT_MAX - *pos - 1) {
++ zend_error_noreturn(E_ERROR, "Field width %d is too long", m_width);
++ }
++
++ req_size = *pos + m_width + 1;
+
+ if (req_size > *size) {
+ while (req_size > *size) {
++ if(*size > INT_MAX/2) {
++ zend_error_noreturn(E_ERROR, "Field width %d is too long", req_size);
++ }
+ *size <<= 1;
+ }
+ PRINTF_DEBUG(("sprintf ereallocing buffer to %d bytes\n", *size));
Added: php5/branches/lenny/debian/patches/CVE-2008-2050.patch
===================================================================
--- php5/branches/lenny/debian/patches/CVE-2008-2050.patch (rev 0)
+++ php5/branches/lenny/debian/patches/CVE-2008-2050.patch 2008-05-27 17:51:56 UTC (rev 1085)
@@ -0,0 +1,22 @@
+http://cvs.php.net/viewvc.cgi/php-src/sapi/cgi/fastcgi.c?r1=1.44&r2=1.45&view=patch
+--- old/sapi/cgi/fastcgi.c 2008/02/15 14:51:52 1.44
++++ new/sapi/cgi/fastcgi.c 2008/04/03 10:25:08 1.45
+@@ -593,6 +593,9 @@
+ hdr->reserved = 0;
+ hdr->type = type;
+ hdr->version = FCGI_VERSION_1;
++ if (pad) {
++ memset(((unsigned char*)hdr) + sizeof(fcgi_header) + len, 0, pad);
++ }
+ return pad;
+ }
+
+@@ -777,7 +780,7 @@
+ {
+ int ret, n, rest;
+ fcgi_header hdr;
+- unsigned char buf[8];
++ unsigned char buf[255];
+
+ n = 0;
+ rest = len;
Added: php5/branches/lenny/debian/patches/CVE-2008-2051.patch
===================================================================
--- php5/branches/lenny/debian/patches/CVE-2008-2051.patch (rev 0)
+++ php5/branches/lenny/debian/patches/CVE-2008-2051.patch 2008-05-27 17:51:56 UTC (rev 1085)
@@ -0,0 +1,17 @@
+http://cvs.php.net/viewvc.cgi/php-src/ext/standard/exec.c?r1=1.113.2.3.2.1.2.3&r2=1.113.2.3.2.1.2.4&view=patch
+Index: php5-5.2.5/ext/standard/exec.c
+===================================================================
+--- php5-5.2.5.orig/ext/standard/exec.c
++++ php5-5.2.5/ext/standard/exec.c
+@@ -270,6 +270,11 @@ char *php_escape_shell_cmd(char *str) {
+ cmd = safe_emalloc(2, l, 1);
+
+ for (x = 0, y = 0; x < l; x++) {
++ /* skip non-valid multibyte characters */
++ if (php_mblen(str + x, (l - x)) < 0) {
++ continue;
++ }
++
+ switch (str[x]) {
+ case '"':
+ case '\'':
Modified: php5/branches/lenny/debian/patches/series
===================================================================
--- php5/branches/lenny/debian/patches/series 2008-05-27 17:51:33 UTC (rev 1084)
+++ php5/branches/lenny/debian/patches/series 2008-05-27 17:51:56 UTC (rev 1085)
@@ -28,3 +28,6 @@
libdb_is_-ldb
suhosin.patch
fix_broken_upstream_tests.patch
+CVE-2008-1384
+CVE-2008-2050.patch
+CVE-2008-2051.patch
More information about the Pkg-php-commits
mailing list