[pkgsrc/pkgsrc-2008Q4]: pkgsrc/lang/php5 Pullup ticket #2721 - requested by a...

[tron <tron%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/b76e3fe3582f
branches:  pkgsrc-2008Q4
changeset: 552372:b76e3fe3582f
user:      tron <tron%pkgsrc.org@localhost>
date:      Sun Mar 15 19:21:22 2009 +0000

description:
Pullup ticket #2721 - requested by adrianp
php5: security update

Revisions pulled up:
- lang/php5/MESSAGE.suhosin                     1.1 via patch
- lang/php5/Makefile                            1.71 via patch
- lang/php5/Makefile.common                     1.35
- lang/php5/Makefile.php                        1.33-1.34
- lang/php5/PLIST                               1.21
- lang/php5/distinfo                            1.61-1.62
- lang/php5/patches/patch-an                    patch
- lang/php5/patches/patch-ar                    patch
- lang/php5/patches/patch-as                    delete
---
Module Name:    pkgsrc
Committed By:   adrianp
Date:           Mon Mar  2 22:52:17 UTC 2009

Modified Files:
        pkgsrc/lang/php5: Makefile Makefile.common Makefile.php PLIST distinfo
Removed Files:
        pkgsrc/lang/php5/patches: patch-as

Log Message:
The PHP development team would like to announce the immediate availability of PHP 5.2.9. This release focuses on improving the stability of the PHP 5.2.x branch with over 50 bug fixes, several of 
which are security related. All users of PHP are encouraged to upgrade to this release.

Security Enhancements and Fixes in PHP 5.2.9:

    * Fixed security issue in imagerotate(), background colour isn't validated correctly with a non truecolour image. Reported by Hamid Ebadi, APA Laboratory (Fixes CVE-2008-5498). (Scott)
    * Fixed a crash on extract in zip when files or directories entry names contain a relative path. (Pierre)
    * Fixed explode() behavior with empty string to respect negative limit. (Shire)
    * Fixed a segfault when malformed string is passed to json_decode(). (Scott)

Key enhancements in PHP 5.2.9 include:

    * Added optional sorting type flag parameter to array_unique(). Default is SORT_REGULAR. (Andrei)
    * Fixed bug #45996 (libxml2 2.7 causes breakage with character data in xml_parse()). (Rob)
    * A number of fixes in the mbstring extension (Moriyoshi)
    * Fixed bug #44336 (Improve pcre UTF-8 string matching performance). (frode at coretrek dot com, Nuno)
    * Fixed bug #46699 (xml_parse crash when parser is namespace aware). (Rob)
    * Fixed bug #46748 (Segfault when an SSL error has more than one error). (Scott)
    * Fixed bug #46889 (Memory leak in strtotime()). (Derick)
    * Fixed bug #47049 (SoapClient::__soapCall causes a segmentation fault). (Dmitry)
    * Fixed bug #47165 (Possible memory corruption when passing return value by reference). (Dmitry)
    * Fixed bug #47282 (FILTER_VALIDATE_EMAIL is marking valid email addresses as invalid). (Ilia)
    * Fixed bug #47422 (modulus operator returns incorrect results on 64 bit linux). (Matt)
    * Over 50 bug fixes.
---
Module Name:    pkgsrc
Committed By:   adrianp
Date:           Thu Mar  5 23:22:24 UTC 2009

Modified Files:
        pkgsrc/lang/php5: Makefile.php distinfo

Log Message:
Add back suhosin patch as a new one for 5.2.9 is out

diffstat:

 lang/php5/MESSAGE.suhosin  |   7 +++++++
 lang/php5/Makefile         |   2 +-
 lang/php5/Makefile.common  |  14 ++++++++++++--
 lang/php5/Makefile.php     |  27 +++++++++++++++++++++++++--
 lang/php5/PLIST            |   6 ++++--
 lang/php5/distinfo         |  15 +++++++++------
 lang/php5/patches/patch-an |  44 ++++++++++++++++++++++++++++++++++++++++----
 lang/php5/patches/patch-ar |  13 +++++++++++++
 lang/php5/patches/patch-as |  27 ---------------------------
 9 files changed, 111 insertions(+), 44 deletions(-)

diffs (275 lines):

diff -r 19bdb1a66474 -r b76e3fe3582f lang/php5/MESSAGE.suhosin
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/lang/php5/MESSAGE.suhosin Sun Mar 15 19:21:22 2009 +0000
@@ -0,0 +1,7 @@
+===========================================================================
+$NetBSD: MESSAGE.suhosin,v 1.1.2.2 2009/03/15 19:21:22 tron Exp $
+
+As you have chosen to install the Suhosin patch you may also want to
+install the Suhosin extension which can be found in security/php-suhosin.
+
+===========================================================================
diff -r 19bdb1a66474 -r b76e3fe3582f lang/php5/Makefile
--- a/lang/php5/Makefile        Sun Mar 15 15:09:00 2009 +0000
+++ b/lang/php5/Makefile        Sun Mar 15 19:21:22 2009 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.69 2008/12/10 19:37:01 adrianp Exp $
+# $NetBSD: Makefile,v 1.69.2.1 2009/03/15 19:21:22 tron Exp $
 
 PKGNAME=               php-${PHP_BASE_VERS}
 CATEGORIES=            lang
diff -r 19bdb1a66474 -r b76e3fe3582f lang/php5/Makefile.common
--- a/lang/php5/Makefile.common Sun Mar 15 15:09:00 2009 +0000
+++ b/lang/php5/Makefile.common Sun Mar 15 19:21:22 2009 +0000
@@ -1,5 +1,15 @@
-# $NetBSD: Makefile.common,v 1.33 2008/12/10 19:37:01 adrianp Exp $
+# $NetBSD: Makefile.common,v 1.33.2.1 2009/03/15 19:21:22 tron Exp $
 # used by lang/php5/Makefile.php
+# used by lang/php/ext.mk
+
+#
+# NOTE:
+# The suhosin option includes a patch from http://www.hardened-php.net/
+# Which tracks with the exact version number of PHP.  There may be a delay
+# in the patch which can leave the option broken until an updated patch
+# is released.  When updating PHP please don't forget to update the
+# distnfo with the details of the suhosin patch as well.
+#
 
 .if !defined(DISTNAME)
 DISTNAME=              php-${PHP_BASE_VERS}
@@ -16,7 +26,7 @@
 MAINTAINER?=           jdolecek%NetBSD.org@localhost
 HOMEPAGE?=             http://www.php.net/
 
-PHP_BASE_VERS=         5.2.8
+PHP_BASE_VERS=         5.2.9
 
 PHP_EXTENSION_DIR=     lib/php/20040412
 PLIST_SUBST+=          PHP_EXTENSION_DIR=${PHP_EXTENSION_DIR:Q}
diff -r 19bdb1a66474 -r b76e3fe3582f lang/php5/Makefile.php
--- a/lang/php5/Makefile.php    Sun Mar 15 15:09:00 2009 +0000
+++ b/lang/php5/Makefile.php    Sun Mar 15 19:21:22 2009 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.php,v 1.29 2008/08/17 18:36:50 adrianp Exp $
+# $NetBSD: Makefile.php,v 1.29.6.1 2009/03/15 19:21:22 tron Exp $
 #
 
 .include "../../lang/php5/Makefile.common"
@@ -10,6 +10,7 @@
 USE_LANGUAGES=         c c++
 GNU_CONFIGURE=         YES
 BUILD_DEFS+=           VARBASE
+PLIST_VARS+=           suhosin
 
 CONFIGURE_ENV+=                EXTENSION_DIR="${PREFIX}/${PHP_EXTENSION_DIR}"
 
@@ -41,7 +42,7 @@
 # Note: This expression is the same as ${PKGBASE}, but the latter is
 # not defined yet, so we cannot use it here.
 PKG_OPTIONS_VAR=       PKG_OPTIONS.${PKGNAME:C/-[0-9].*//}
-PKG_SUPPORTED_OPTIONS+=        inet6 ssl maintainer-zts
+PKG_SUPPORTED_OPTIONS+=        inet6 ssl maintainer-zts suhosin
 PKG_SUGGESTED_OPTIONS+=        ssl
 
 SUBST_CLASSES+=                ini
@@ -53,6 +54,23 @@
 
 .include "../../mk/bsd.options.mk"
 
+.if !empty(PKG_OPTIONS:Msuhosin)
+SUHOSIN_PHPVER=                5.2.9
+. if ${SUHOSIN_PHPVER} != ${PHP_BASE_VERS}
+PKG_FAIL_REASON+=      "The suhosin patch is currently not available for"
+PKG_FAIL_REASON+=      "this version of PHP.  You may have to wait until"
+PKG_FAIL_REASON+=      "an updated patch is released or temporarily"
+PKG_FAIL_REASON+=      "build this package without the suhosin option."
+. else
+PATCH_SITES=           http://download.suhosin.org/
+PATCHFILES+=           suhosin-patch-${SUHOSIN_PHPVER}-0.9.7.patch.gz
+PATCH_DIST_STRIP=      -p1
+PLIST.suhosin=         yes
+MESSAGE_SRC=           ${.CURDIR}/../../lang/php5/MESSAGE
+MESSAGE_SRC+=          ${.CURDIR}/../../lang/php5/MESSAGE.suhosin
+. endif
+.endif
+
 .if !empty(PKG_OPTIONS:Minet6)
 CONFIGURE_ARGS+=       --enable-ipv6
 .else
@@ -61,7 +79,12 @@
 
 .if !empty(PKG_OPTIONS:Mssl)
 .  include "../../security/openssl/buildlink3.mk"
+.  if ${OPSYS} == "SunOS"
+CONFIGURE_ARGS+=       --with-openssl=yes
+LIBS.SunOS+=           -lcrypto
+.  else
 CONFIGURE_ARGS+=       --with-openssl=${BUILDLINK_PREFIX.openssl}
+.  endif
 .else
 CONFIGURE_ARGS+=       --without-openssl
 .endif
diff -r 19bdb1a66474 -r b76e3fe3582f lang/php5/PLIST
--- a/lang/php5/PLIST   Sun Mar 15 15:09:00 2009 +0000
+++ b/lang/php5/PLIST   Sun Mar 15 19:21:22 2009 +0000
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.19 2008/12/10 19:37:01 adrianp Exp $
+@comment $NetBSD: PLIST,v 1.19.2.1 2009/03/15 19:21:22 tron Exp $
 bin/php
 bin/php-config
 bin/phpize
@@ -87,7 +87,6 @@
 include/php/ext/pcre/pcrelib/pcre_internal.h
 include/php/ext/pcre/pcrelib/pcreposix.h
 include/php/ext/pcre/pcrelib/ucp.h
-include/php/ext/pcre/pcrelib/ucptable.h
 include/php/ext/pcre/php_pcre.h
 include/php/ext/session/mod_files.h
 include/php/ext/session/mod_user.h
@@ -201,6 +200,9 @@
 include/php/main/streams/php_stream_userspace.h
 include/php/main/streams/php_streams_int.h
 include/php/main/win95nt.h
+${PLIST.suhosin}include/php/main/suhosin_globals.h
+${PLIST.suhosin}include/php/main/suhosin_logo.h
+${PLIST.suhosin}include/php/main/suhosin_patch.h
 include/php/regex/cclass.h
 include/php/regex/cname.h
 include/php/regex/regex.h
diff -r 19bdb1a66474 -r b76e3fe3582f lang/php5/distinfo
--- a/lang/php5/distinfo        Sun Mar 15 15:09:00 2009 +0000
+++ b/lang/php5/distinfo        Sun Mar 15 19:21:22 2009 +0000
@@ -1,15 +1,18 @@
-$NetBSD: distinfo,v 1.56.2.2 2009/02/26 13:49:24 tron Exp $
+$NetBSD: distinfo,v 1.56.2.3 2009/03/15 19:21:22 tron Exp $
 
-SHA1 (php-5.2.8/php-5.2.8.tar.bz2) = d285636144e0a4aa61195793634807e763c63dc3
-RMD160 (php-5.2.8/php-5.2.8.tar.bz2) = d38fe5d918c335089a027600a93d950f417a7e98
-Size (php-5.2.8/php-5.2.8.tar.bz2) = 9827180 bytes
+SHA1 (php-5.2.9/php-5.2.9.tar.bz2) = 1c738dbd7e3f8d723b6ce2e0fbc90a69e249f5f0
+RMD160 (php-5.2.9/php-5.2.9.tar.bz2) = fc2b316ff05462667704027cf2a1a4ac0a238422
+Size (php-5.2.9/php-5.2.9.tar.bz2) = 10203122 bytes
+SHA1 (php-5.2.9/suhosin-patch-5.2.9-0.9.7.patch.gz) = 4197644330a4f182f4dd64beb9db29406ed300ca
+RMD160 (php-5.2.9/suhosin-patch-5.2.9-0.9.7.patch.gz) = 1d2e01a935c4bbc9e858796f8f6004b4f75950b3
+Size (php-5.2.9/suhosin-patch-5.2.9-0.9.7.patch.gz) = 23026 bytes
 SHA1 (patch-aa) = 20bc3831e435182d014b11ae9f1f6c537a21af20
 SHA1 (patch-ad) = b324c33b1e70adee5b89dcecdd7690dcadcc18ec
 SHA1 (patch-ag) = 4ccb67ba6f5370b1d16b087e3e714de3e5ae604e
 SHA1 (patch-ah) = c7cbd4b9ea0796ea3b7491c2cffb6ddddc518587
 SHA1 (patch-aj) = 54812097499c81e5cb0196ab949cc86a4f24a9cc
 SHA1 (patch-al) = 0ee37782cc0d3bf5ede1a583de0589c2c1316b50
-SHA1 (patch-an) = d0578fa2d00932d6b5d97dfff525f4c0f9586bd5
+SHA1 (patch-an) = 8f4174627b8cb5f8bfbc59413c95f71e26b9e602
 SHA1 (patch-ap) = 5eb0e0e4244a993da93e36f8fcb5553454207fce
 SHA1 (patch-aq) = 0c9d48547da2fa80aa8357d23ad8505d1c0330df
-SHA1 (patch-as) = 7612bf91fe04d980a41dbb0ea652fd50d3b5cebb
+SHA1 (patch-ar) = 2d74ec926cc00bfbb67d16210af78c33ad9ac38d
diff -r 19bdb1a66474 -r b76e3fe3582f lang/php5/patches/patch-an
--- a/lang/php5/patches/patch-an        Sun Mar 15 15:09:00 2009 +0000
+++ b/lang/php5/patches/patch-an        Sun Mar 15 19:21:22 2009 +0000
@@ -1,8 +1,8 @@
-$NetBSD: patch-an,v 1.6 2008/10/28 07:07:59 adam Exp $
+$NetBSD: patch-an,v 1.6.2.1 2009/03/15 19:21:22 tron Exp $
 
---- configure.orig     2008-04-30 20:37:32.000000000 +0200
+--- configure.orig     2008-12-07 11:31:12.000000000 -0800
 +++ configure
-@@ -12437,7 +12437,7 @@ EOF
+@@ -12471,7 +12471,7 @@ EOF
  
      echo "$ac_t""$PHP_PATH_INFO_CHECK" 1>&6
  
@@ -11,7 +11,43 @@
      
    PHP_SAPI=cgi
    
-@@ -107515,12 +107515,7 @@ old_CC=$CC
+@@ -21467,7 +21467,7 @@ fi
+     if test "$found_openssl" = "no"; then
+   
+     if test "$PHP_OPENSSL_DIR" = "yes"; then
+-      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl"
++      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl /"
+     fi
+ 
+     for i in $PHP_OPENSSL_DIR; do
+@@ -34588,7 +34588,7 @@ fi
+     if test "$found_openssl" = "no"; then
+   
+     if test "$PHP_OPENSSL_DIR" = "yes"; then
+-      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl"
++      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl /"
+     fi
+ 
+     for i in $PHP_OPENSSL_DIR; do
+@@ -48878,7 +48878,7 @@ fi
+     if test "$found_openssl" = "no"; then
+   
+     if test "$PHP_OPENSSL_DIR" = "yes"; then
+-      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl"
++      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl /"
+     fi
+ 
+     for i in $PHP_OPENSSL_DIR; do
+@@ -87996,7 +87996,7 @@ fi
+     if test "$found_openssl" = "no"; then
+   
+     if test "$PHP_OPENSSL_DIR" = "yes"; then
+-      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl"
++      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl /"
+     fi
+ 
+     for i in $PHP_OPENSSL_DIR; do
+@@ -108297,12 +108297,7 @@ old_CC=$CC
  if test "$PHP_THREAD_SAFETY" = "yes" && test -n "$ac_cv_pthreads_cflags"; then
    CXXFLAGS="$CXXFLAGS $ac_cv_pthreads_cflags"
    INLINE_CFLAGS="$INLINE_CFLAGS $ac_cv_pthreads_cflags"
diff -r 19bdb1a66474 -r b76e3fe3582f lang/php5/patches/patch-ar
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/lang/php5/patches/patch-ar        Sun Mar 15 19:21:22 2009 +0000
@@ -0,0 +1,13 @@
+$NetBSD: patch-ar,v 1.4.12.1 2009/03/15 19:21:22 tron Exp $
+
+--- acinclude.m4.orig  2008-09-08 03:24:38.000000000 -0700
++++ acinclude.m4
+@@ -2332,7 +2332,7 @@ AC_DEFUN([PHP_SETUP_OPENSSL],[
+   if test "$found_openssl" = "no"; then
+   
+     if test "$PHP_OPENSSL_DIR" = "yes"; then
+-      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl"
++      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl /"
+     fi
+ 
+     for i in $PHP_OPENSSL_DIR; do
diff -r 19bdb1a66474 -r b76e3fe3582f lang/php5/patches/patch-as
--- a/lang/php5/patches/patch-as        Sun Mar 15 15:09:00 2009 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,27 +0,0 @@
-$NetBSD: patch-as,v 1.3.20.1 2009/02/26 13:43:59 tron Exp $
-
-Fix memory leak and pullup bug fix for http://bugs.php.net/bug.php?id=46918
-
-Remove this patch when PHP >= 5.2.9 is released as it will contain these
-changes
-
---- ext/imap/php_imap.c.orig   2009-02-24 17:45:27.000000000 +0000
-+++ ext/imap/php_imap.c        2009-02-24 17:47:14.000000000 +0000
-@@ -2172,7 +2172,7 @@
- 
-       /* rfc822_parse_adrlist() modifies passed string. Copy it. */
-       str_copy = estrndup(Z_STRVAL_PP(str), Z_STRLEN_PP(str));
--      rfc822_parse_adrlist(&env->to, str_copy, defaulthost);
-+      rfc822_parse_adrlist(&env->to, str_copy, Z_STRVAL_PP(defaulthost));
-       efree(str_copy);
- 
-       array_init(return_value);
-@@ -2196,6 +2196,8 @@
-               }
-               add_next_index_object(return_value, tovals TSRMLS_CC);
-       } while ((addresstmp = addresstmp->next));
-+      
-+      mail_free_envelope(&env);
- }
- /* }}} */
-