summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta-oe/recipes-devtools/php/php/CVE-2019-6978.patch192
-rw-r--r--meta-oe/recipes-devtools/php/php_7.3.9.bb1
2 files changed, 193 insertions, 0 deletions
diff --git a/meta-oe/recipes-devtools/php/php/CVE-2019-6978.patch b/meta-oe/recipes-devtools/php/php/CVE-2019-6978.patch
new file mode 100644
index 0000000000..b7cdfd964c
--- /dev/null
+++ b/meta-oe/recipes-devtools/php/php/CVE-2019-6978.patch
@@ -0,0 +1,192 @@
1From 089f7c0bc28d399b0420aa6ef058e4c1c120b2ae Mon Sep 17 00:00:00 2001
2From: "Christoph M. Becker" <cmbecker69@gmx.de>
3Date: Sat, 19 Jan 2019 10:35:39 +0100
4Subject: [PATCH] Sync with upstream
5
6Even though libgd/libgd#492 is not a relevant bug fix for PHP, since
7the binding doesn't use the `gdImage*Ptr()` functions at all, we're
8porting the fix to stay in sync here.
9---
10 ext/gd/libgd/gd_gif_out.c | 20 +++++++++++++++++---
11 ext/gd/libgd/gd_jpeg.c | 17 ++++++++++++++---
12 ext/gd/libgd/gd_wbmp.c | 18 +++++++++++++++---
13 3 files changed, 46 insertions(+), 9 deletions(-)
14
15Upstream-Status: Backport [http://git.php.net/?p=php-src.git;a=commit;h=089f7c0bc28d399b0420aa6ef058e4c1c120b2ae]
16CVE: CVE-2019-6978
17
18Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
19
20diff --git a/ext/gd/libgd/gd_gif_out.c b/ext/gd/libgd/gd_gif_out.c
21index 1f2a6b936a..2e1f38af70 100644
22--- a/ext/gd/libgd/gd_gif_out.c
23+++ b/ext/gd/libgd/gd_gif_out.c
24@@ -97,12 +97,18 @@ static void cl_hash (register count_int chsize, GifCtx *ctx);
25 static void char_init (GifCtx *ctx);
26 static void char_out (int c, GifCtx *ctx);
27 static void flush_char (GifCtx *ctx);
28+
29+static int _gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out);
30+
31 void * gdImageGifPtr (gdImagePtr im, int *size)
32 {
33 void *rv;
34 gdIOCtx *out = gdNewDynamicCtx (2048, NULL);
35- gdImageGifCtx (im, out);
36- rv = gdDPExtractData (out, size);
37+ if (!_gdImageGifCtx(im, out)) {
38+ rv = gdDPExtractData(out, size);
39+ } else {
40+ rv = NULL;
41+ }
42 out->gd_free (out);
43 return rv;
44 }
45@@ -115,6 +121,12 @@ void gdImageGif (gdImagePtr im, FILE * outFile)
46 }
47
48 void gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out)
49+{
50+ _gdImageGifCtx(im, out);
51+}
52+
53+/* returns 0 on success, 1 on failure */
54+static int _gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out)
55 {
56 gdImagePtr pim = 0, tim = im;
57 int interlace, BitsPerPixel;
58@@ -125,7 +137,7 @@ void gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out)
59 based temporary image. */
60 pim = gdImageCreatePaletteFromTrueColor(im, 1, 256);
61 if (!pim) {
62- return;
63+ return 1;
64 }
65 tim = pim;
66 }
67@@ -138,6 +150,8 @@ void gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out)
68 /* Destroy palette based temporary image. */
69 gdImageDestroy( pim);
70 }
71+
72+ return 0;
73 }
74
75 static int
76diff --git a/ext/gd/libgd/gd_jpeg.c b/ext/gd/libgd/gd_jpeg.c
77index 8cf71fcbc9..ef46c4a22c 100644
78--- a/ext/gd/libgd/gd_jpeg.c
79+++ b/ext/gd/libgd/gd_jpeg.c
80@@ -132,6 +132,7 @@ const char * gdJpegGetVersionString()
81 }
82 }
83
84+static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality);
85
86 /*
87 * Write IM to OUTFILE as a JFIF-formatted JPEG image, using quality
88@@ -153,8 +154,11 @@ void *gdImageJpegPtr (gdImagePtr im, int *size, int quality)
89 {
90 void *rv;
91 gdIOCtx *out = gdNewDynamicCtx (2048, NULL);
92- gdImageJpegCtx (im, out, quality);
93- rv = gdDPExtractData (out, size);
94+ if (!_gdImageJpegCtx(im, out, quality)) {
95+ rv = gdDPExtractData(out, size);
96+ } else {
97+ rv = NULL;
98+ }
99 out->gd_free (out);
100
101 return rv;
102@@ -163,6 +167,12 @@ void *gdImageJpegPtr (gdImagePtr im, int *size, int quality)
103 void jpeg_gdIOCtx_dest (j_compress_ptr cinfo, gdIOCtx * outfile);
104
105 void gdImageJpegCtx (gdImagePtr im, gdIOCtx * outfile, int quality)
106+{
107+ _gdImageJpegCtx(im, outfile, quality);
108+}
109+
110+/* returns 0 on success, 1 on failure */
111+static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality)
112 {
113 struct jpeg_compress_struct cinfo;
114 struct jpeg_error_mgr jerr;
115@@ -184,7 +194,7 @@ void gdImageJpegCtx (gdImagePtr im, gdIOCtx * outfile, int quality)
116 if (row) {
117 gdFree (row);
118 }
119- return;
120+ return 1;
121 }
122
123 cinfo.err->error_exit = fatal_jpeg_error;
124@@ -277,6 +287,7 @@ void gdImageJpegCtx (gdImagePtr im, gdIOCtx * outfile, int quality)
125 jpeg_finish_compress (&cinfo);
126 jpeg_destroy_compress (&cinfo);
127 gdFree (row);
128+ return 0;
129 }
130
131 gdImagePtr gdImageCreateFromJpeg (FILE * inFile)
132diff --git a/ext/gd/libgd/gd_wbmp.c b/ext/gd/libgd/gd_wbmp.c
133index 55ced3443d..fd9edad2ca 100644
134--- a/ext/gd/libgd/gd_wbmp.c
135+++ b/ext/gd/libgd/gd_wbmp.c
136@@ -82,6 +82,7 @@ int gd_getin (void *in)
137 return (gdGetC((gdIOCtx *) in));
138 }
139
140+static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out);
141
142 /* gdImageWBMPCtx
143 ** --------------
144@@ -93,6 +94,12 @@ int gd_getin (void *in)
145 ** out: the stream where to write
146 */
147 void gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)
148+{
149+ _gdImageWBMPCtx(image, fg, out);
150+}
151+
152+/* returns 0 on success, 1 on failure */
153+static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out)
154 {
155 int x, y, pos;
156 Wbmp *wbmp;
157@@ -100,7 +107,7 @@ void gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)
158 /* create the WBMP */
159 if ((wbmp = createwbmp (gdImageSX (image), gdImageSY (image), WBMP_WHITE)) == NULL) {
160 gd_error("Could not create WBMP");
161- return;
162+ return 1;
163 }
164
165 /* fill up the WBMP structure */
166@@ -116,7 +123,9 @@ void gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)
167
168 /* write the WBMP to a gd file descriptor */
169 if (writewbmp (wbmp, &gd_putout, out)) {
170+ freewbmp(wbmp);
171 gd_error("Could not save WBMP");
172+ return 1;
173 }
174 /* des submitted this bugfix: gdFree the memory. */
175 freewbmp(wbmp);
176@@ -204,8 +213,11 @@ void * gdImageWBMPPtr (gdImagePtr im, int *size, int fg)
177 {
178 void *rv;
179 gdIOCtx *out = gdNewDynamicCtx(2048, NULL);
180- gdImageWBMPCtx(im, fg, out);
181- rv = gdDPExtractData(out, size);
182+ if (!_gdImageWBMPCtx(im, fg, out)) {
183+ rv = gdDPExtractData(out, size);
184+ } else {
185+ rv = NULL;
186+ }
187 out->gd_free(out);
188
189 return rv;
190--
1912.17.1
192
diff --git a/meta-oe/recipes-devtools/php/php_7.3.9.bb b/meta-oe/recipes-devtools/php/php_7.3.9.bb
index 23ab7ca8e2..a5c7b9b6ba 100644
--- a/meta-oe/recipes-devtools/php/php_7.3.9.bb
+++ b/meta-oe/recipes-devtools/php/php_7.3.9.bb
@@ -7,6 +7,7 @@ SRC_URI += "file://0001-acinclude.m4-don-t-unset-cache-variables.patch \
7 file://0049-ext-intl-Use-pkg-config-to-detect-icu.patch \ 7 file://0049-ext-intl-Use-pkg-config-to-detect-icu.patch \
8 file://0001-Use-pkg-config-for-libxml2-detection.patch \ 8 file://0001-Use-pkg-config-for-libxml2-detection.patch \
9 file://debian-php-fixheader.patch \ 9 file://debian-php-fixheader.patch \
10 file://CVE-2019-6978.patch \
10 " 11 "
11SRC_URI_append_class-target = " \ 12SRC_URI_append_class-target = " \
12 file://pear-makefile.patch \ 13 file://pear-makefile.patch \
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-26 03:13:01 +0000