CVS commit: [pkgsrc-2018Q2] pkgsrc/lang

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Fri Aug 17 17:39:36 UTC 2018

Modified Files:
        pkgsrc/lang/php [pkgsrc-2018Q2]: phpversion.mk
        pkgsrc/lang/php56 [pkgsrc-2018Q2]: Makefile.php distinfo
Added Files:
        pkgsrc/lang/php56/patches [pkgsrc-2018Q2]: patch-disable-filter-url

Log Message:
Pullup ticket #5800 - requested by taca
lang/php56: security fix

Revisions pulled up:
- lang/php/phpversion.mk                                        1.225
- lang/php56/Makefile.php                                       1.5
- lang/php56/distinfo                                           1.49-1.50
- lang/php56/patches/patch-disable-filter-url                   1.1

---
   Module Name: pkgsrc
   Committed By:        manu
   Date:                Wed Jul 18 07:33:12 UTC 2018

   Modified Files:
        pkgsrc/lang/php56: Makefile.php distinfo
        pkgsrc/lang/php70: Makefile.php distinfo
        pkgsrc/lang/php71: Makefile.php distinfo
        pkgsrc/lang/php72: Makefile.php distinfo
   Added Files:
        pkgsrc/lang/php56/patches: patch-disable-filter-url
        pkgsrc/lang/php70/patches: patch-disable-filter-url
        pkgsrc/lang/php71/patches: patch-disable-filter-url
        pkgsrc/lang/php72/patches: patch-disable-filter-url

   Log Message:
   Add pkgsrc build option disable-filter-url to disable php://filter URL

   php://filter URL is a feature documented here:
   http://php.net/manual/en/wrappers.php.php

   Unfortunately, it allows remote control of include() behavior
   beyond what many developpers expected, enabling easy dump of
   PHP source files. The administrator may want to disable the
   feature for security sake, and this option makes that possible.

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Fri Jul 20 13:28:48 UTC 2018

   Modified Files:
        pkgsrc/lang/php: phpversion.mk
        pkgsrc/lang/php56: distinfo

   Log Message:
   lang/php56: update to 5.6.37

   19 Jul 2018, PHP 5.6.37

   - Exif:
     . Fixed bug #76423 (Int Overflow lead to Heap OverFlow in
       exif_thumbnail_extract of exif.c). (Stas)
     . Fixed bug #76557 (heap-buffer-overflow (READ of size 48) while reading exif
       data). (Stas)

   - Win32:
     . Fixed bug #76459 (windows linkinfo lacks openbasedir check). (Anatol)


To generate a diff of this commit:
cvs rdiff -u -r1.221.2.3 -r1.221.2.4 pkgsrc/lang/php/phpversion.mk
cvs rdiff -u -r1.4 -r1.4.10.1 pkgsrc/lang/php56/Makefile.php
cvs rdiff -u -r1.48 -r1.48.2.1 pkgsrc/lang/php56/distinfo
cvs rdiff -u -r0 -r1.1.2.2 pkgsrc/lang/php56/patches/patch-disable-filter-url

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/php/phpversion.mk
diff -u pkgsrc/lang/php/phpversion.mk:1.221.2.3 pkgsrc/lang/php/phpversion.mk:1.221.2.4
--- pkgsrc/lang/php/phpversion.mk:1.221.2.3     Fri Aug 17 17:37:21 2018
+++ pkgsrc/lang/php/phpversion.mk       Fri Aug 17 17:39:36 2018
@@ -1,4 +1,4 @@
-# $NetBSD: phpversion.mk,v 1.221.2.3 2018/08/17 17:37:21 bsiegert Exp $
+# $NetBSD: phpversion.mk,v 1.221.2.4 2018/08/17 17:39:36 bsiegert Exp $
 #
 # This file selects a PHP version, based on the user's preferences and
 # the installed packages. It does not add a dependency on the PHP
@@ -87,7 +87,7 @@
 PHPVERSION_MK= defined
 
 # Define each PHP's version.
-PHP56_VERSION= 5.6.36
+PHP56_VERSION= 5.6.37
 PHP70_VERSION= 7.0.31
 PHP71_VERSION= 7.1.20
 PHP72_VERSION= 7.2.8

Index: pkgsrc/lang/php56/Makefile.php
diff -u pkgsrc/lang/php56/Makefile.php:1.4 pkgsrc/lang/php56/Makefile.php:1.4.10.1
--- pkgsrc/lang/php56/Makefile.php:1.4  Wed Jul 12 09:11:35 2017
+++ pkgsrc/lang/php56/Makefile.php      Fri Aug 17 17:39:36 2018
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.php,v 1.4 2017/07/12 09:11:35 manu Exp $
+# $NetBSD: Makefile.php,v 1.4.10.1 2018/08/17 17:39:36 bsiegert Exp $
 # used by lang/php56/Makefile
 # used by www/ap-php/Makefile
 # used by www/php-fpm/Makefile
@@ -42,7 +42,7 @@ CONFIGURE_ARGS+=      --with-libxml-dir=${PRE
 .include "../../textproc/libxml2/buildlink3.mk"
 
 PKG_OPTIONS_VAR=       PKG_OPTIONS.${PHP_PKG_PREFIX}
-PKG_SUPPORTED_OPTIONS+=        inet6 ssl maintainer-zts readline
+PKG_SUPPORTED_OPTIONS+=        inet6 ssl maintainer-zts readline disable-filter-url
 PKG_SUGGESTED_OPTIONS+=        inet6 ssl
 
 .if ${OPSYS} == "SunOS" || ${OPSYS} == "Darwin" || ${OPSYS} == "FreeBSD"
@@ -89,5 +89,9 @@ CONFIGURE_ARGS+=      --enable-dtrace
 INSTALL_MAKE_FLAGS+=   -r
 .endif
 
+.if !empty(PKG_OPTIONS:Mdisable-filter-url)
+CFLAGS+=               -DDISABLE_FILTER_URL
+.endif
+
 DL_AUTO_VARS=          yes
 .include "../../mk/dlopen.buildlink3.mk"

Index: pkgsrc/lang/php56/distinfo
diff -u pkgsrc/lang/php56/distinfo:1.48 pkgsrc/lang/php56/distinfo:1.48.2.1
--- pkgsrc/lang/php56/distinfo:1.48     Sun Apr 29 16:26:40 2018
+++ pkgsrc/lang/php56/distinfo  Fri Aug 17 17:39:36 2018
@@ -1,11 +1,12 @@
-$NetBSD: distinfo,v 1.48 2018/04/29 16:26:40 taca Exp $
+$NetBSD: distinfo,v 1.48.2.1 2018/08/17 17:39:36 bsiegert Exp $
 
-SHA1 (php-5.6.36.tar.bz2) = c5cf00d9d6e212e1d10cfd45adbe73c936312e43
-RMD160 (php-5.6.36.tar.bz2) = 91d662d8dba9cd6ed9b14244afcae4c12c25ff01
-SHA512 (php-5.6.36.tar.bz2) = 39988e3be529cdbb12aab848de7bc132475e2c81d322403bc7015b6f8c178334f2bc98cad70ea9426596da8ce160d78ce077578d37c668b7bd481da10bbd8bce
-Size (php-5.6.36.tar.bz2) = 15057704 bytes
+SHA1 (php-5.6.37.tar.bz2) = 4672d3d43f3de9aa77799be5bf41f11008e920a5
+RMD160 (php-5.6.37.tar.bz2) = 0690834e3a68fa8ac6d89ac0d73bb50930ab8077
+SHA512 (php-5.6.37.tar.bz2) = 9cdd7710893ceb464a4818b853a2a70a02f55ece1d23cafe9a5529fdfa9ac1b23cf0eb944bd812825ec946901967a76254b10a38db835759be048cbc01795776
+Size (php-5.6.37.tar.bz2) = 15057773 bytes
 SHA1 (patch-acinclude.m4) = 34d38d2538cc00932cdfcc80d1d4a91632cd15d0
 SHA1 (patch-configure) = a5623b0cbb3331fd0a537b26c0ae48315d52dbe2
+SHA1 (patch-disable-filter-url) = a2b08912d81f2872bf1834fa4cefddb044c9d0f8
 SHA1 (patch-ext_gd_config.m4) = b92ab4c7fe8aceaef7787a607a7d2eac258fee19
 SHA1 (patch-ext_imap_config.m4) = 9c6ed6966366c4fe1b7cfd34b5910e2ff0e68577
 SHA1 (patch-ext_mssql_php__mssql.c) = c4fa9231dc539ffb027f1beb6f182f21ddb94a3c

Added files:

Index: pkgsrc/lang/php56/patches/patch-disable-filter-url
diff -u /dev/null pkgsrc/lang/php56/patches/patch-disable-filter-url:1.1.2.2
--- /dev/null   Fri Aug 17 17:39:36 2018
+++ pkgsrc/lang/php56/patches/patch-disable-filter-url  Fri Aug 17 17:39:36 2018
@@ -0,0 +1,34 @@
+$NetBSD: patch-disable-filter-url,v 1.1.2.2 2018/08/17 17:39:36 bsiegert Exp $
+
+Add build-time disable option for dangerous php://filter URL
+
+php://filter URL is a feature documented here:
+http://php.net/manual/en/wrappers.php.php
+
+Unfortunately, it allows remote control of include() behavior
+beyond what many developpers expected, enabling easy dump of 
+PHP source files. The administrator may want to disable the
+feature for security sake, and this patch makes that possible.
+
+--- ./ext/standard/php_fopen_wrapper.c.orig
++++ ./ext/standard/php_fopen_wrapper.c
+@@ -333,8 +333,9 @@
+                               "Error duping file descriptor %ld; possibly it doesn't exist: "
+                               "[%d]: %s", fildes_ori, errno, strerror(errno));
+                       return NULL;
+               }
++#ifndef DISABLE_FILTER_URL
+       } else if (!strncasecmp(path, "filter/", 7)) {
+               /* Save time/memory when chain isn't specified */
+               if (strchr(mode, 'r') || strchr(mode, '+')) {
+                       mode_rw |= PHP_STREAM_FILTER_READ;
+@@ -369,8 +370,9 @@
+               }
+               efree(pathdup);
+ 
+               return stream;
++#endif /* !DISABLE_FILTER_URL */
+       } else {
+               /* invalid php://thingy */
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid php:// URL specified");
+               return NULL;