diff options
Diffstat (limited to 'meta-oe/recipes-devtools/php/php/CVE-2015-7803.patch')
-rw-r--r-- | meta-oe/recipes-devtools/php/php/CVE-2015-7803.patch | 82 |
1 files changed, 82 insertions, 0 deletions
diff --git a/meta-oe/recipes-devtools/php/php/CVE-2015-7803.patch b/meta-oe/recipes-devtools/php/php/CVE-2015-7803.patch new file mode 100644 index 000000000..5636f2580 --- /dev/null +++ b/meta-oe/recipes-devtools/php/php/CVE-2015-7803.patch | |||
@@ -0,0 +1,82 @@ | |||
1 | From d698f0ae51f67c9cce870b09c59df3d6ba959244 Mon Sep 17 00:00:00 2001 | ||
2 | From: Stanislav Malyshev <stas@php.net> | ||
3 | Date: Mon, 28 Sep 2015 15:51:59 -0700 | ||
4 | Subject: [PATCH] Fix bug #69720: Null pointer dereference in | ||
5 | phar_get_fp_offset() | ||
6 | |||
7 | Upsteam-Status: Backport | ||
8 | https://git.php.net/?p=php-src.git;a=patch;h=d698f0ae51f67c9cce870b09c59df3d6ba959244 | ||
9 | |||
10 | CVE: CVE-2015-7803 | ||
11 | Signed-off-by: Armin Kuster <akuster@mvista.com> | ||
12 | |||
13 | --- | ||
14 | ext/phar/tests/bug69720.phar | Bin 0 -> 8192 bytes | ||
15 | ext/phar/tests/bug69720.phpt | 40 ++++++++++++++++++++++++++++++++++++++++ | ||
16 | ext/phar/util.c | 6 +++++- | ||
17 | 3 files changed, 45 insertions(+), 1 deletion(-) | ||
18 | create mode 100644 ext/phar/tests/bug69720.phar | ||
19 | create mode 100644 ext/phar/tests/bug69720.phpt | ||
20 | |||
21 | Index: php-5.5.21/ext/phar/tests/bug69720.phpt | ||
22 | =================================================================== | ||
23 | --- /dev/null | ||
24 | +++ php-5.5.21/ext/phar/tests/bug69720.phpt | ||
25 | @@ -0,0 +1,40 @@ | ||
26 | +--TEST-- | ||
27 | +Phar - bug #69720 - Null pointer dereference in phar_get_fp_offset() | ||
28 | +--SKIPIF-- | ||
29 | +<?php if (!extension_loaded("phar")) die("skip"); ?> | ||
30 | +--FILE-- | ||
31 | +<?php | ||
32 | +try { | ||
33 | + // open an existing phar | ||
34 | + $p = new Phar(__DIR__."/bug69720.phar",0); | ||
35 | + // Phar extends SPL's DirectoryIterator class | ||
36 | + echo $p->getMetadata(); | ||
37 | + foreach (new RecursiveIteratorIterator($p) as $file) { | ||
38 | + // $file is a PharFileInfo class, and inherits from SplFileInfo | ||
39 | + $temp=""; | ||
40 | + $temp= $file->getFileName() . "\n"; | ||
41 | + $temp.=file_get_contents($file->getPathName()) . "\n"; // display contents | ||
42 | + var_dump($file->getMetadata()); | ||
43 | + } | ||
44 | +} | ||
45 | + catch (Exception $e) { | ||
46 | + echo 'Could not open Phar: ', $e; | ||
47 | +} | ||
48 | +?> | ||
49 | +--EXPECTF-- | ||
50 | + | ||
51 | +MY_METADATA_NULL | ||
52 | + | ||
53 | +Warning: file_get_contents(phar:///%s): failed to open stream: phar error: "test.php" is not a file in phar "%s.phar" in %s.php on line %d | ||
54 | +array(1) { | ||
55 | + ["whatever"]=> | ||
56 | + int(123) | ||
57 | +} | ||
58 | +object(DateTime)#2 (3) { | ||
59 | + ["date"]=> | ||
60 | + string(26) "2000-01-01 00:00:00.000000" | ||
61 | + ["timezone_type"]=> | ||
62 | + int(3) | ||
63 | + ["timezone"]=> | ||
64 | + string(3) "UTC" | ||
65 | +} | ||
66 | Index: php-5.5.21/ext/phar/util.c | ||
67 | =================================================================== | ||
68 | --- php-5.5.21.orig/ext/phar/util.c | ||
69 | +++ php-5.5.21/ext/phar/util.c | ||
70 | @@ -494,7 +494,11 @@ really_get_entry: | ||
71 | (*ret)->is_tar = entry->is_tar; | ||
72 | (*ret)->fp = phar_get_efp(entry, 1 TSRMLS_CC); | ||
73 | if (entry->link) { | ||
74 | - (*ret)->zero = phar_get_fp_offset(phar_get_link_source(entry TSRMLS_CC) TSRMLS_CC); | ||
75 | + phar_entry_info *link = phar_get_link_source(entry TSRMLS_CC); | ||
76 | + if(!link) { | ||
77 | + return FAILURE; | ||
78 | + } | ||
79 | + (*ret)->zero = phar_get_fp_offset(link TSRMLS_CC); | ||
80 | } else { | ||
81 | (*ret)->zero = phar_get_fp_offset(entry TSRMLS_CC); | ||
82 | } | ||