Skip to content

Commit 0cff6b0

Browse files
arc9693arc9693
authored
php: upgrade to 8.3.12 to fix CVE-2024-8927, CVE-2024-8925 (#10747)
1 parent 465d65c commit 0cff6b0

5 files changed

Lines changed: 76 additions & 31 deletions

File tree

‎SPECS/php/CVE-test.patch‎

Whitespace-only changes.

SPECS/php/php-8.3.0-systzdata-v24.patch renamed to SPECS/php/php-8.3.12-systzdata-v25.patch

Lines changed: 66 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,10 @@ r2: add filesystem trawl to set up name alias index
3636
r1: initial revision
3737

3838

39-
diff --git a/ext/date/config0.m4 b/ext/date/config0.m4
40-
index 6b803bf33e..53c3cdb3f4 100644
41-
--- a/ext/date/config0.m4
42-
+++ b/ext/date/config0.m4
43-
@@ -4,6 +4,19 @@ AC_CHECK_HEADERS([io.h])
39+
diff --color -ruN b/ext/date/config0.m4 a/ext/date/config0.m4
40+
--- b/ext/date/config0.m4 2024-09-24 18:08:04.000000000 +0000
41+
+++ a/ext/date/config0.m4 2024-10-16 12:11:31.140181713 +0000
42+
@@ -4,6 +4,19 @@
4443
dnl Check for strtoll, atoll
4544
AC_CHECK_FUNCS(strtoll atoll)
4645

@@ -57,13 +56,57 @@ index 6b803bf33e..53c3cdb3f4 100644
5756
+ fi
5857
+fi
5958
+
60-
PHP_DATE_CFLAGS="-Wno-implicit-fallthrough -I@ext_builddir@/lib -DZEND_ENABLE_STATIC_TSRMLS_CACHE=1 -DHAVE_TIMELIB_CONFIG_H=1"
61-
timelib_sources="lib/astro.c lib/dow.c lib/parse_date.c lib/parse_tz.c lib/parse_posix.c
62-
lib/timelib.c lib/tm2unixtime.c lib/unixtime2tm.c lib/parse_iso_intervals.c lib/interval.c"
63-
diff --git a/ext/date/lib/parse_tz.c b/ext/date/lib/parse_tz.c
64-
index c7f93580d7..ec196a98b6 100644
65-
--- a/ext/date/lib/parse_tz.c
66-
+++ b/ext/date/lib/parse_tz.c
59+
AX_CHECK_COMPILE_FLAG([-Wno-implicit-fallthrough],
60+
[PHP_DATE_CFLAGS="$PHP_DATE_CFLAGS -Wno-implicit-fallthrough"],,
61+
[-Werror])
62+
diff --color -ruN b/ext/date/config0.m4.orig a/ext/date/config0.m4.orig
63+
--- b/ext/date/config0.m4.orig 1970-01-01 00:00:00.000000000 +0000
64+
+++ a/ext/date/config0.m4.orig 2024-09-24 18:08:04.000000000 +0000
65+
@@ -0,0 +1,41 @@
66+
+dnl Check for headers needed by timelib
67+
+AC_CHECK_HEADERS([io.h])
68+
+
69+
+dnl Check for strtoll, atoll
70+
+AC_CHECK_FUNCS(strtoll atoll)
71+
+
72+
+AX_CHECK_COMPILE_FLAG([-Wno-implicit-fallthrough],
73+
+ [PHP_DATE_CFLAGS="$PHP_DATE_CFLAGS -Wno-implicit-fallthrough"],,
74+
+ [-Werror])
75+
+
76+
+PHP_DATE_CFLAGS="$PHP_DATE_CFLAGS -I@ext_builddir@/lib -DZEND_ENABLE_STATIC_TSRMLS_CACHE=1 -DHAVE_TIMELIB_CONFIG_H=1"
77+
+timelib_sources="lib/astro.c lib/dow.c lib/parse_date.c lib/parse_tz.c lib/parse_posix.c
78+
+ lib/timelib.c lib/tm2unixtime.c lib/unixtime2tm.c lib/parse_iso_intervals.c lib/interval.c"
79+
+
80+
+PHP_NEW_EXTENSION(date, php_date.c $timelib_sources, no,, $PHP_DATE_CFLAGS)
81+
+
82+
+PHP_ADD_BUILD_DIR([$ext_builddir/lib], 1)
83+
+PHP_ADD_INCLUDE([$ext_builddir/lib])
84+
+PHP_ADD_INCLUDE([$ext_srcdir/lib])
85+
+
86+
+PHP_INSTALL_HEADERS([ext/date], [php_date.h lib/timelib.h lib/timelib_config.h])
87+
+AC_DEFINE([HAVE_TIMELIB_CONFIG_H], [1], [Have timelib_config.h])
88+
+
89+
+cat > $ext_builddir/lib/timelib_config.h <<EOF
90+
+#ifdef PHP_WIN32
91+
+# include "config.w32.h"
92+
+#else
93+
+# include <php_config.h>
94+
+#endif
95+
+#include <inttypes.h>
96+
+#include <stdint.h>
97+
+
98+
+#include "zend.h"
99+
+
100+
+#define timelib_malloc emalloc
101+
+#define timelib_realloc erealloc
102+
+#define timelib_calloc ecalloc
103+
+#define timelib_strdup estrdup
104+
+#define timelib_strndup estrndup
105+
+#define timelib_free efree
106+
+EOF
107+
diff --color -ruN b/ext/date/lib/parse_tz.c a/ext/date/lib/parse_tz.c
108+
--- b/ext/date/lib/parse_tz.c 2024-09-24 18:08:04.000000000 +0000
109+
+++ a/ext/date/lib/parse_tz.c 2024-10-16 12:11:31.140181713 +0000
67110
@@ -26,9 +26,33 @@
68111
#include "timelib.h"
69112
#include "timelib_private.h"
@@ -98,7 +141,7 @@ index c7f93580d7..ec196a98b6 100644
98141

99142
#if (defined(__APPLE__) || defined(__APPLE_CC__)) && (defined(__BIG_ENDIAN__) || defined(__LITTLE_ENDIAN__))
100143
# if defined(__LITTLE_ENDIAN__)
101-
@@ -95,6 +119,11 @@ static int read_php_preamble(const unsigned char **tzf, timelib_tzinfo *tz)
144+
@@ -95,6 +119,11 @@
102145
{
103146
uint32_t version;
104147

@@ -110,7 +153,7 @@ index c7f93580d7..ec196a98b6 100644
110153
/* read ID */
111154
version = (*tzf)[3] - '0';
112155
*tzf += 4;
113-
@@ -577,7 +606,475 @@ void timelib_dump_tzinfo(timelib_tzinfo *tz)
156+
@@ -577,7 +606,475 @@
114157
}
115158
}
116159

@@ -587,7 +630,7 @@ index c7f93580d7..ec196a98b6 100644
587630
{
588631
int left = 0, right = tzdb->index_size - 1;
589632

590-
@@ -603,9 +1100,49 @@ static int seek_to_tz_position(const unsigned char **tzf, const char *timezone,
633+
@@ -603,9 +1100,49 @@
591634
return 0;
592635
}
593636

@@ -637,7 +680,7 @@ index c7f93580d7..ec196a98b6 100644
637680
}
638681

639682
const timelib_tzdb_index_entry *timelib_timezone_identifiers_list(const timelib_tzdb *tzdb, int *count)
640-
@@ -617,7 +1154,32 @@ const timelib_tzdb_index_entry *timelib_timezone_identifiers_list(const timelib_
683+
@@ -617,7 +1154,32 @@
641684
int timelib_timezone_id_is_valid(const char *timezone, const timelib_tzdb *tzdb)
642685
{
643686
const unsigned char *tzf;
@@ -671,7 +714,7 @@ index c7f93580d7..ec196a98b6 100644
671714
}
672715

673716
static int skip_64bit_preamble(const unsigned char **tzf, timelib_tzinfo *tz)
674-
@@ -662,6 +1224,8 @@ static timelib_tzinfo* timelib_tzinfo_ctor(const char *name)
717+
@@ -662,6 +1224,8 @@
675718
timelib_tzinfo *timelib_parse_tzfile(const char *timezone, const timelib_tzdb *tzdb, int *error_code)
676719
{
677720
const unsigned char *tzf;
@@ -680,7 +723,7 @@ index c7f93580d7..ec196a98b6 100644
680723
timelib_tzinfo *tmp;
681724
int version;
682725
int transitions_result, types_result;
683-
@@ -669,7 +1233,7 @@ timelib_tzinfo *timelib_parse_tzfile(const char *timezone, const timelib_tzdb *t
726+
@@ -669,7 +1233,7 @@
684727

685728
*error_code = TIMELIB_ERROR_NO_ERROR;
686729

@@ -689,7 +732,7 @@ index c7f93580d7..ec196a98b6 100644
689732
tmp = timelib_tzinfo_ctor(timezone);
690733

691734
version = read_preamble(&tzf, tmp, &type);
692-
@@ -712,11 +1276,38 @@ timelib_tzinfo *timelib_parse_tzfile(const char *timezone, const timelib_tzdb *t
735+
@@ -712,11 +1276,38 @@
693736
return NULL;
694737
}
695738

@@ -728,11 +771,10 @@ index c7f93580d7..ec196a98b6 100644
728771
} else {
729772
*error_code = TIMELIB_ERROR_NO_SUCH_TIMEZONE;
730773
tmp = NULL;
731-
diff --git a/ext/date/php_date.c b/ext/date/php_date.c
732-
index 48c82bf7ec..443299c089 100644
733-
--- a/ext/date/php_date.c
734-
+++ b/ext/date/php_date.c
735-
@@ -490,7 +490,11 @@ PHP_MINFO_FUNCTION(date)
774+
diff --color -ruN b/ext/date/php_date.c a/ext/date/php_date.c
775+
--- b/ext/date/php_date.c 2024-09-24 18:08:04.000000000 +0000
776+
+++ a/ext/date/php_date.c 2024-10-16 12:11:31.144181704 +0000
777+
@@ -490,7 +490,11 @@
736778
php_info_print_table_row(2, "date/time support", "enabled");
737779
php_info_print_table_row(2, "timelib version", TIMELIB_ASCII_VERSION);
738780
php_info_print_table_row(2, "\"Olson\" Timezone Database Version", tzdb->version);
@@ -743,4 +785,3 @@ index 48c82bf7ec..443299c089 100644
743785
+#endif
744786
php_info_print_table_row(2, "Default timezone", guess_timezone(tzdb));
745787
php_info_print_table_end();
746-

‎SPECS/php/php.signatures.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"nginx-fpm.conf": "5a222ab2c3fc0145cb67a1c5125471bbf097de304e77c9858e7077a3b4fcad59",
77
"nginx-php.conf": "b3b3f744c4c122302fcb11f39cac78d01cef15ee6f8bd67e98b3438efcf8dc95",
88
"opcache-default.blacklist": "4eef0875e1a0c6a75b8a2bafd4ddc029b83be74dd336a6a99214b0c32808cb38",
9-
"php-8.3.8.tar.xz": "aea358b56186f943c2bbd350c9005b9359133d47e954cfc561385319ae5bb8d7",
9+
"php-8.3.12.tar.xz": "f774e28633e26fc8c5197f4dae58ec9e3ff87d1b4311cbc61ab05a7ad24bd131",
1010
"php-fpm-www.conf": "1cacdd4962c01a0a968933c38db503023940ad9105f021bdab85d6cdc46dcbb8",
1111
"php-fpm.conf": "bb261d53b9b42bb163a7637bb373ffa18a20dddf27a3efe6cb5ed1b1cf5981a9",
1212
"php-fpm.logrotate": "7d8279bebb9ffabc596a2699150e93d4ce4513245890b9b786d337288b19fa79",
@@ -16,4 +16,4 @@
1616
"php.ini": "8fd5a4d891c19320c07010fbbbac982c886b422bc8d062acaeae49d70c136fc8",
1717
"php.modconf": "dc7303ea584452d2f742d002a648abe74905025aabf240259c7e8bd01746d278"
1818
}
19-
}
19+
}

‎SPECS/php/php.spec‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232
%global with_qdbm 0
3333
Summary: PHP scripting language for creating dynamic web sites
3434
Name: php
35-
Version: 8.3.8
35+
Version: 8.3.12
3636
Release: 1%{?dist}
3737
# All files licensed under PHP version 3.01, except
3838
# Zend is licensed under Zend
@@ -70,7 +70,7 @@ Patch8: php-8.1.0-libdb.patch
7070
# Use system nikic/php-parser
7171
Patch41: php-8.3.3-parser.patch
7272
# use system tzdata
73-
Patch42: php-8.3.0-systzdata-v24.patch
73+
Patch42: php-8.3.12-systzdata-v25.patch
7474
# See http://bugs.php.net/53436
7575
Patch43: php-7.4.0-phpize.patch
7676
# Use -lldap_r for OpenLDAP
@@ -1514,6 +1514,10 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || :
15141514
%dir %{_datadir}/php/preload
15151515

15161516
%changelog
1517+
* Wed Oct 16 2024 Archana Choudhary <archana1@microsoft.com> - 8.3.12-1
1518+
- Upgarde to 8.3.12 to fix CVE-2024-8927, CVE-2024-8925
1519+
- Refactor patch (with fuzzing) for system tzdata
1520+
15171521
* Tue Jun 11 2024 Neha Agarwal <nehaagarwal@microsoft.com> - 8.3.8-1
15181522
- Upgrade to 8.3.8 to fix CVE-2024-4577, CVE-2024-5458, CVE-2024-5585
15191523

‎cgmanifest.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20813,8 +20813,8 @@
2081320813
"type": "other",
2081420814
"other": {
2081520815
"name": "php",
20816-
"version": "8.3.8",
20817-
"downloadUrl": "https://www.php.net/distributions/php-8.3.8.tar.xz"
20816+
"version": "8.3.12",
20817+
"downloadUrl": "https://www.php.net/distributions/php-8.3.12.tar.xz"
2081820818
}
2081920819
}
2082020820
},

0 commit comments

Comments
 (0)