pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: pkgsrc/lang/php74
Module Name: pkgsrc
Committed By: taca
Date: Thu Oct 22 02:06:46 UTC 2026
Modified Files:
pkgsrc/lang/php74: Makefile distinfo
Added Files:
pkgsrc/lang/php74/patches: patch-Zend_zend__API.h
patch-Zend_zend__alloc.c patch-Zend_zend__alloc.h
patch-Zend_zend__execute__API.c patch-Zend_zend__hash.c
patch-Zend_zend__hash.h patch-Zend_zend__llist.c
patch-Zend_zend__multiply.h patch-Zend_zend__strtod.c
patch-Zend_zend__types.h patch-Zend_zend__vm__def.h
patch-Zend_zend__vm__execute.h patch-ext_session_session.c
patch-main_SAPI.c patch-main_main.c patch-main_php__variables.c
patch-main_rfc1867.c
Log Message:
lang/php74: Apply changes from PHP-7.4-CVE-2026-109618-109619
Apply changes from tagged as PHP-7.4-CVE-2026-109618-109619 from GitHub.
Quote from security advisory announce on https://www.php.net:
Given the severity of these vulnerabilities, the PHP security team
provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to
help people building from source or without access to an LTS vendor.
Bump PKGREVISION.
To generate a diff of this commit:
cvs rdiff -u -r1.39 -r1.40 pkgsrc/lang/php74/Makefile
cvs rdiff -u -r1.47 -r1.48 pkgsrc/lang/php74/distinfo
cvs rdiff -u -r0 -r1.1 pkgsrc/lang/php74/patches/patch-Zend_zend__API.h \
pkgsrc/lang/php74/patches/patch-Zend_zend__alloc.c \
pkgsrc/lang/php74/patches/patch-Zend_zend__alloc.h \
pkgsrc/lang/php74/patches/patch-Zend_zend__execute__API.c \
pkgsrc/lang/php74/patches/patch-Zend_zend__hash.c \
pkgsrc/lang/php74/patches/patch-Zend_zend__hash.h \
pkgsrc/lang/php74/patches/patch-Zend_zend__llist.c \
pkgsrc/lang/php74/patches/patch-Zend_zend__multiply.h \
pkgsrc/lang/php74/patches/patch-Zend_zend__strtod.c \
pkgsrc/lang/php74/patches/patch-Zend_zend__types.h \
pkgsrc/lang/php74/patches/patch-Zend_zend__vm__def.h \
pkgsrc/lang/php74/patches/patch-Zend_zend__vm__execute.h \
pkgsrc/lang/php74/patches/patch-ext_session_session.c \
pkgsrc/lang/php74/patches/patch-main_SAPI.c \
pkgsrc/lang/php74/patches/patch-main_main.c \
pkgsrc/lang/php74/patches/patch-main_php__variables.c \
pkgsrc/lang/php74/patches/patch-main_rfc1867.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/lang/php74/Makefile
diff -u pkgsrc/lang/php74/Makefile:1.39 pkgsrc/lang/php74/Makefile:1.40
--- pkgsrc/lang/php74/Makefile:1.39 Tue Sep 29 06:06:17 2026
+++ pkgsrc/lang/php74/Makefile Thu Oct 22 02:06:45 2026
@@ -1,10 +1,10 @@
-# $NetBSD: Makefile,v 1.39 2026/09/29 06:06:17 wiz Exp $
+# $NetBSD: Makefile,v 1.40 2026/10/22 02:06:45 taca Exp $
#
# We can't omit PKGNAME here to handle PKG_OPTIONS.
#
PKGNAME= ${PHP_PKG_PREFIX}-${PHP_VERSION}
-PKGREVISION= 10
+PKGREVISION= 11
CATEGORIES= lang
COMMENT= PHP Hypertext Preprocessor version 7.4
Index: pkgsrc/lang/php74/distinfo
diff -u pkgsrc/lang/php74/distinfo:1.47 pkgsrc/lang/php74/distinfo:1.48
--- pkgsrc/lang/php74/distinfo:1.47 Tue May 19 10:12:49 2026
+++ pkgsrc/lang/php74/distinfo Thu Oct 22 02:06:45 2026
@@ -1,8 +1,20 @@
-$NetBSD: distinfo,v 1.47 2026/05/19 10:12:49 jperkin Exp $
+$NetBSD: distinfo,v 1.48 2026/10/22 02:06:45 taca Exp $
BLAKE2s (php-7.4.33.tar.xz) = 11ec78e0a566d33168e9867e60796f25b8edc4efa03868929251a6297021e79d
SHA512 (php-7.4.33.tar.xz) = 499b63b99e5d8e8082ff89d3a91b4cb9a593ea7553b96e48863414c13d2e50275904ed29070e2232e529ee91160f505e6060a4d129cb5bf098aa5b6ea0928d3d
Size (php-7.4.33.tar.xz) = 10420144 bytes
+SHA1 (patch-Zend_zend__API.h) = c7227dac6cd5016e9d4c66cba734931cad5abb78
+SHA1 (patch-Zend_zend__alloc.c) = 056b7d710cf72019d867588906b5fb927aa849fd
+SHA1 (patch-Zend_zend__alloc.h) = 14d2a0896345713fa91fa915f27e59f1d66b6e47
+SHA1 (patch-Zend_zend__execute__API.c) = f135fa45008b6699fae07a1181721343ef115b6c
+SHA1 (patch-Zend_zend__hash.c) = 7f02dc5eb6a947ba7644bc730e931fe4131232cb
+SHA1 (patch-Zend_zend__hash.h) = 14415bc17de10ef3afdcd509b6c7cb3ae7359dea
+SHA1 (patch-Zend_zend__llist.c) = 0c9ef60d699c219379710e381026e9ec59ba2399
+SHA1 (patch-Zend_zend__multiply.h) = 29944e8fb1017f0d44616b88fa4ecac709f015e5
+SHA1 (patch-Zend_zend__strtod.c) = e5eac92745c1c81d2df55403397cb4ec2d889da1
+SHA1 (patch-Zend_zend__types.h) = 42abe267c957bb2d5b5fd0966f35f2d58cf242d0
+SHA1 (patch-Zend_zend__vm__def.h) = 66d052aaf9c9083d05292711d4687acdc57c7a93
+SHA1 (patch-Zend_zend__vm__execute.h) = ad64fb8b421eadf643faccef8d71522000527ad1
SHA1 (patch-build_Makefile.global) = 9776c936b982042d6a06c7a3e43c547fefb13c39
SHA1 (patch-build_php.m4) = b134d33cd47dae37be011bb8dd0c0f2a6efe2a78
SHA1 (patch-configure.ac) = 42cb03a3cb3a872f9acbcab30ea0813686a7af9a
@@ -16,10 +28,15 @@ SHA1 (patch-ext_intl_timezone_timezone__
SHA1 (patch-ext_libxml_libxml.c) = 33e19680b87a22c19601b4df91a99ba8a7a483d3
SHA1 (patch-ext_openssl_openssl.c) = bbd446bbf89e90749a01319553d666d86d1274e2
SHA1 (patch-ext_phar_Makefile.frag) = 53ea5c58b0bc27d236118d5750a74b1cba43e5dd
+SHA1 (patch-ext_session_session.c) = 992ca0a3bd52118aa4a3798be1c8b4df95d3ecce
SHA1 (patch-ext_standard_scanf.c) = e924e424e377629c91199aa2fcdd95b83c5cdf73
SHA1 (patch-ext_tidy_config.m4) = 380f4e8927582b2781faf58b17ad81b6dc967ba7
SHA1 (patch-ext_xml_compat.c) = 2415549270c38822d702668ae0d1e3b30a4869ec
SHA1 (patch-ext_xsl_php__xsl.h) = a9877bff7bacc77926a4541a0ac171c00ad1a627
+SHA1 (patch-main_SAPI.c) = 6615d752fffce7828c685ed867113cb3cdadc95c
+SHA1 (patch-main_main.c) = 1695e7d3f87943545321937c719d67b1e6ece2fe
+SHA1 (patch-main_php__variables.c) = 16376412eeb5fee9c546e82ff6e19144ab917b50
+SHA1 (patch-main_rfc1867.c) = a3425c4add7596864dbd0398508df4694573425f
SHA1 (patch-php.ini-development) = 719cc709ea383691ef656f38e1ab5f30a11ef509
SHA1 (patch-php.ini-production) = 334fcba211c0b5d864c93b6f79c997e07e1ed70d
SHA1 (patch-sapi_apache2handler_config.m4) = 398b774f93044cac9f6cf15599c8b9eef1c97cf8
Added files:
Index: pkgsrc/lang/php74/patches/patch-Zend_zend__API.h
diff -u /dev/null pkgsrc/lang/php74/patches/patch-Zend_zend__API.h:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-Zend_zend__API.h Thu Oct 22 02:06:45 2026
@@ -0,0 +1,14 @@
+$NetBSD: patch-Zend_zend__API.h,v 1.1 2026/10/22 02:06:45 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- Zend/zend_API.h.orig 2022-10-31 10:36:16.000000000 +0000
++++ Zend/zend_API.h
+@@ -380,6 +380,7 @@ ZEND_API char *zend_get_type_by_const(in
+
+ #define array_init(arg) ZVAL_ARR((arg), zend_new_array(0))
+ #define array_init_size(arg, size) ZVAL_ARR((arg), zend_new_array(size))
++#define array_init_singleton(arg) ZVAL_ARR((arg), zend_new_array_singleton())
+ ZEND_API int object_init(zval *arg);
+ ZEND_API int object_init_ex(zval *arg, zend_class_entry *ce);
+ ZEND_API int object_and_properties_init(zval *arg, zend_class_entry *ce, HashTable *properties);
Index: pkgsrc/lang/php74/patches/patch-Zend_zend__alloc.c
diff -u /dev/null pkgsrc/lang/php74/patches/patch-Zend_zend__alloc.c:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-Zend_zend__alloc.c Thu Oct 22 02:06:45 2026
@@ -0,0 +1,137 @@
+$NetBSD: patch-Zend_zend__alloc.c,v 1.1 2026/10/22 02:06:45 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- Zend/zend_alloc.c.orig 2022-10-31 10:36:16.000000000 +0000
++++ Zend/zend_alloc.c
+@@ -57,6 +57,7 @@
+ #include "zend_operators.h"
+ #include "zend_multiply.h"
+ #include "zend_bitset.h"
++#include "zend_execute.h"
+ #include <signal.h>
+
+ #ifdef HAVE_UNISTD_H
+@@ -363,7 +364,42 @@ static ZEND_COLD ZEND_NORETURN void zend
+ #if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID)
+ kill(getpid(), SIGSEGV);
+ #endif
+- exit(1);
++ _exit(1);
++}
++
++ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...)
++{
++ zend_string *script_filename = NULL;
++ uint32_t script_lineno = 0;
++
++ if (zend_is_executing()) {
++ script_filename = zend_get_executed_filename_ex();
++ script_lineno = zend_get_executed_lineno();
++ } else if (zend_is_compiling()) {
++ script_filename = zend_get_compiled_filename();
++ script_lineno = zend_get_compiled_lineno();
++ }
++
++ va_list args;
++ va_start(args, format);
++
++ char buf[1024];
++ vsnprintf(buf, sizeof(buf), format, args);
++
++ va_end(args);
++
++ fprintf(stderr,
++ "\nFatal error: %s in %s on line %d\n",
++ buf,
++ script_filename ? ZSTR_VAL(script_filename) : "Unknown",
++ script_lineno);
++
++ /* See http://support.microsoft.com/kb/190351 */
++# ifdef ZEND_WIN32
++ fflush(stderr);
++# endif
++
++ _exit(1);
+ }
+
+ static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
+@@ -375,22 +411,14 @@ static ZEND_COLD ZEND_NORETURN void zend
+ #endif
+ size_t size)
+ {
++ (void) heap;
+
+- heap->overflow = 1;
+- zend_try {
+- zend_error_noreturn(E_ERROR,
+- format,
+- limit,
++ zend_mm_safe_error_ex(format, limit,
+ #if ZEND_DEBUG
+ filename,
+ lineno,
+ #endif
+ size);
+- } zend_catch {
+- } zend_end_try();
+- heap->overflow = 0;
+- zend_bailout();
+- exit(1);
+ }
+
+ #ifdef _WIN32
+@@ -1318,7 +1346,7 @@ static zend_always_inline void *zend_mm_
+ size = MAX(size, 1);
+ size = ZEND_MM_ALIGNED_SIZE(size) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info));
+ if (UNEXPECTED(size < real_size)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
+ return NULL;
+ }
+ #endif
+@@ -1762,7 +1790,7 @@ static void *zend_mm_alloc_huge(zend_mm_
+ void *ptr;
+
+ if (UNEXPECTED(new_size < size)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
+ }
+
+ #if ZEND_MM_LIMIT
+@@ -2617,7 +2645,7 @@ ZEND_API char* ZEND_FASTCALL _estrdup(co
+
+ length = strlen(s);
+ if (UNEXPECTED(length + 1 == 0)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
+ }
+ p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+ memcpy(p, s, length+1);
+@@ -2629,7 +2657,7 @@ ZEND_API char* ZEND_FASTCALL _estrndup(c
+ char *p;
+
+ if (UNEXPECTED(length + 1 == 0)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
+ }
+ p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+ memcpy(p, s, length);
+@@ -2643,7 +2671,7 @@ ZEND_API char* ZEND_FASTCALL zend_strndu
+ char *p;
+
+ if (UNEXPECTED(length + 1 == 0)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
+ }
+ p = (char *) malloc(length + 1);
+ if (UNEXPECTED(p == NULL)) {
+@@ -2974,7 +3002,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_e
+ static ZEND_COLD ZEND_NORETURN void zend_out_of_memory(void)
+ {
+ fprintf(stderr, "Out of memory\n");
+- exit(1);
++ _exit(1);
+ }
+
+ ZEND_API void * __zend_malloc(size_t len)
Index: pkgsrc/lang/php74/patches/patch-Zend_zend__alloc.h
diff -u /dev/null pkgsrc/lang/php74/patches/patch-Zend_zend__alloc.h:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-Zend_zend__alloc.h Thu Oct 22 02:06:45 2026
@@ -0,0 +1,15 @@
+$NetBSD: patch-Zend_zend__alloc.h,v 1.1 2026/10/22 02:06:45 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- Zend/zend_alloc.h.orig 2022-10-31 10:36:16.000000000 +0000
++++ Zend/zend_alloc.h
+@@ -402,6 +402,8 @@ static void apc_init_heap(void)
+ size_t zend_mm_globals_size(void);
+ #endif
+
++ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...);
++
+ END_EXTERN_C()
+
+ #endif
Index: pkgsrc/lang/php74/patches/patch-Zend_zend__execute__API.c
diff -u /dev/null pkgsrc/lang/php74/patches/patch-Zend_zend__execute__API.c:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-Zend_zend__execute__API.c Thu Oct 22 02:06:45 2026
@@ -0,0 +1,37 @@
+$NetBSD: patch-Zend_zend__execute__API.c,v 1.1 2026/10/22 02:06:45 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- Zend/zend_execute_API.c.orig 2022-10-31 10:36:16.000000000 +0000
++++ Zend/zend_execute_API.c
+@@ -337,10 +337,21 @@ void shutdown_executor(void) /* {{{ */
+ gc_collect_cycles();
+ }
+ #endif
++ } else {
++ /* may be used by zend_error_zstr_at before init_executor */
++ ZVAL_UNDEF(&EG(user_error_handler));
++ ZVAL_UNDEF(&EG(user_exception_handler));
++ memset(&EG(user_error_handlers_error_reporting), 0, sizeof(EG(user_error_handlers_error_reporting)));
++ memset(&EG(user_error_handlers), 0, sizeof(EG(user_error_handlers)));
++ memset(&EG(user_exception_handlers), 0, sizeof(EG(user_exception_handlers)));
+ }
+
+ zend_objects_store_free_object_storage(&EG(objects_store), fast_shutdown);
+
++ /* may be used by zend_error_zstr_at before init_executor */
++ EG(error_handling) = EH_NORMAL;
++ EG(exception) = NULL;
++
+ zend_weakrefs_shutdown();
+
+ zend_try {
+@@ -357,6 +368,8 @@ void shutdown_executor(void) /* {{{ */
+ zend_hash_discard(EG(function_table), EG(persistent_functions_count));
+ zend_hash_discard(EG(class_table), EG(persistent_classes_count));
+ zend_cleanup_internal_classes();
++ EG(objects_store).object_buckets = NULL;
++ EG(objects_store).top = 1;
+ } else {
+ zend_vm_stack_destroy();
+
Index: pkgsrc/lang/php74/patches/patch-Zend_zend__hash.c
diff -u /dev/null pkgsrc/lang/php74/patches/patch-Zend_zend__hash.c:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-Zend_zend__hash.c Thu Oct 22 02:06:45 2026
@@ -0,0 +1,47 @@
+$NetBSD: patch-Zend_zend__hash.c,v 1.1 2026/10/22 02:06:45 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- Zend/zend_hash.c.orig 2022-10-31 10:36:16.000000000 +0000
++++ Zend/zend_hash.c
+@@ -97,7 +97,7 @@ static zend_always_inline uint32_t zend_
+ if (nSize <= HT_MIN_SIZE) {
+ return HT_MIN_SIZE;
+ } else if (UNEXPECTED(nSize >= HT_MAX_SIZE)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
+ }
+
+ #if defined(ZEND_WIN32)
+@@ -251,6 +251,13 @@ ZEND_API HashTable* ZEND_FASTCALL _zend_
+ return ht;
+ }
+
++ZEND_API HashTable* ZEND_FASTCALL zend_new_array_singleton(void)
++{
++ HashTable *ht = _zend_new_array_0();
++ ht->nTableSize = 1;
++ return ht;
++}
++
+ ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t nSize)
+ {
+ HashTable *ht = emalloc(sizeof(HashTable));
+@@ -282,7 +289,7 @@ static void ZEND_FASTCALL zend_hash_pack
+ {
+ HT_ASSERT_RC1(ht);
+ if (ht->nTableSize >= HT_MAX_SIZE) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
+ }
+ ht->nTableSize += ht->nTableSize;
+ HT_SET_DATA_ADDR(ht, perealloc2(HT_GET_DATA_ADDR(ht), HT_SIZE_EX(ht->nTableSize, HT_MIN_MASK), HT_USED_SIZE(ht), GC_FLAGS(ht) & IS_ARRAY_PERSISTENT));
+@@ -1164,7 +1171,7 @@ static void ZEND_FASTCALL zend_hash_do_r
+ pefree(old_data, GC_FLAGS(ht) & IS_ARRAY_PERSISTENT);
+ zend_hash_rehash(ht);
+ } else {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
+ }
+ }
+
Index: pkgsrc/lang/php74/patches/patch-Zend_zend__hash.h
diff -u /dev/null pkgsrc/lang/php74/patches/patch-Zend_zend__hash.h:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-Zend_zend__hash.h Thu Oct 22 02:06:45 2026
@@ -0,0 +1,14 @@
+$NetBSD: patch-Zend_zend__hash.h,v 1.1 2026/10/22 02:06:45 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- Zend/zend_hash.h.orig 2022-10-31 10:36:16.000000000 +0000
++++ Zend/zend_hash.h
+@@ -296,6 +296,7 @@ ZEND_API int ZEND_FASTCALL zend_hash_reh
+ #endif
+
+ ZEND_API HashTable* ZEND_FASTCALL _zend_new_array_0(void);
++ZEND_API HashTable* ZEND_FASTCALL zend_new_array_singleton(void);
+ ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t size);
+ ZEND_API HashTable* ZEND_FASTCALL zend_new_pair(zval *val1, zval *val2);
+ ZEND_API uint32_t zend_array_count(HashTable *ht);
Index: pkgsrc/lang/php74/patches/patch-Zend_zend__llist.c
diff -u /dev/null pkgsrc/lang/php74/patches/patch-Zend_zend__llist.c:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-Zend_zend__llist.c Thu Oct 22 02:06:45 2026
@@ -0,0 +1,15 @@
+$NetBSD: patch-Zend_zend__llist.c,v 1.1 2026/10/22 02:06:45 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- Zend/zend_llist.c.orig 2022-10-31 10:36:16.000000000 +0000
++++ Zend/zend_llist.c
+@@ -112,6 +112,8 @@ ZEND_API void zend_llist_destroy(zend_ll
+ current = next;
+ }
+
++ l->head = NULL;
++ l->tail = NULL;
+ l->count = 0;
+ }
+
Index: pkgsrc/lang/php74/patches/patch-Zend_zend__multiply.h
diff -u /dev/null pkgsrc/lang/php74/patches/patch-Zend_zend__multiply.h:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-Zend_zend__multiply.h Thu Oct 22 02:06:45 2026
@@ -0,0 +1,24 @@
+$NetBSD: patch-Zend_zend__multiply.h,v 1.1 2026/10/22 02:06:45 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- Zend/zend_multiply.h.orig 2022-10-31 10:36:16.000000000 +0000
++++ Zend/zend_multiply.h
+@@ -321,7 +321,7 @@ static zend_always_inline size_t zend_sa
+ size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
+
+ if (UNEXPECTED(overflow)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+ return 0;
+ }
+ return ret;
+@@ -334,7 +334,7 @@ static zend_always_inline size_t zend_sa
+ size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
+
+ if (UNEXPECTED(overflow)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
++ zend_mm_safe_error_ex("Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
+ return 0;
+ }
+ return ret;
Index: pkgsrc/lang/php74/patches/patch-Zend_zend__strtod.c
diff -u /dev/null pkgsrc/lang/php74/patches/patch-Zend_zend__strtod.c:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-Zend_zend__strtod.c Thu Oct 22 02:06:45 2026
@@ -0,0 +1,24 @@
+$NetBSD: patch-Zend_zend__strtod.c,v 1.1 2026/10/22 02:06:45 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- Zend/zend_strtod.c.orig 2022-10-31 10:36:16.000000000 +0000
++++ Zend/zend_strtod.c
+@@ -603,7 +603,7 @@ Balloc
+ rv = (Bigint *)MALLOC(sizeof(Bigint) + (x-1)*sizeof(ULong));
+ if (!rv) {
+ FREE_DTOA_LOCK(0);
+- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
++ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
+ }
+ #else
+ len = (sizeof(Bigint) + (x-1)*sizeof(ULong) + sizeof(double) - 1)
+@@ -616,7 +616,7 @@ Balloc
+ rv = (Bigint*)MALLOC(len*sizeof(double));
+ if (!rv) {
+ FREE_DTOA_LOCK(0);
+- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
++ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
+ }
+ #endif
+ rv->k = k;
Index: pkgsrc/lang/php74/patches/patch-Zend_zend__types.h
diff -u /dev/null pkgsrc/lang/php74/patches/patch-Zend_zend__types.h:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-Zend_zend__types.h Thu Oct 22 02:06:45 2026
@@ -0,0 +1,24 @@
+$NetBSD: patch-Zend_zend__types.h,v 1.1 2026/10/22 02:06:45 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- Zend/zend_types.h.orig 2022-10-31 10:36:14.000000000 +0000
++++ Zend/zend_types.h
+@@ -330,6 +330,9 @@ struct _zend_array {
+ # define HT_HASH_RESET(ht) do { \
+ char *p = (char*)&HT_HASH(ht, (ht)->nTableMask); \
+ size_t size = HT_HASH_SIZE((ht)->nTableMask); \
++ if (UNEXPECTED(size < 64)) { \
++ memset(p, HT_INVALID_IDX, size); \
++ } else { \
+ __m128i xmm0 = _mm_setzero_si128(); \
+ xmm0 = _mm_cmpeq_epi8(xmm0, xmm0); \
+ ZEND_ASSERT(size >= 64 && ((size & 0x3f) == 0)); \
+@@ -341,6 +344,7 @@ struct _zend_array {
+ p += 64; \
+ size -= 64; \
+ } while (size != 0); \
++ } \
+ } while (0)
+ #else
+ # define HT_HASH_RESET(ht) \
Index: pkgsrc/lang/php74/patches/patch-Zend_zend__vm__def.h
diff -u /dev/null pkgsrc/lang/php74/patches/patch-Zend_zend__vm__def.h:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-Zend_zend__vm__def.h Thu Oct 22 02:06:45 2026
@@ -0,0 +1,45 @@
+$NetBSD: patch-Zend_zend__vm__def.h,v 1.1 2026/10/22 02:06:45 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- Zend/zend_vm_def.h.orig 2022-10-31 10:36:14.000000000 +0000
++++ Zend/zend_vm_def.h
+@@ -417,7 +417,7 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TM
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -426,6 +426,9 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TM
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -3210,6 +3213,9 @@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -3217,6 +3223,9 @@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
Index: pkgsrc/lang/php74/patches/patch-Zend_zend__vm__execute.h
diff -u /dev/null pkgsrc/lang/php74/patches/patch-Zend_zend__vm__execute.h:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-Zend_zend__vm__execute.h Thu Oct 22 02:06:45 2026
@@ -0,0 +1,338 @@
+$NetBSD: patch-Zend_zend__vm__execute.h,v 1.1 2026/10/22 02:06:45 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- Zend/zend_vm_execute.h.orig 2022-10-31 10:36:16.000000000 +0000
++++ Zend/zend_vm_execute.h
+@@ -5631,6 +5631,9 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -5638,6 +5641,9 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -7491,6 +7497,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -7498,6 +7507,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -7900,7 +7912,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -7909,6 +7921,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -9952,6 +9967,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -9959,6 +9977,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -10361,7 +10382,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -10370,6 +10391,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -13928,6 +13952,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -13935,6 +13962,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -14681,7 +14711,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -14690,6 +14720,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -15353,7 +15386,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -15362,6 +15395,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -16107,6 +16143,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -16114,6 +16153,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -17040,7 +17082,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -17049,6 +17091,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -17401,6 +17446,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -17408,6 +17456,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -38348,7 +38399,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -38357,6 +38408,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -40727,7 +40781,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -40736,6 +40790,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -41849,6 +41906,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -41856,6 +41916,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -44132,6 +44195,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -44139,6 +44205,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -46857,7 +46926,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -46866,6 +46935,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -49268,6 +49340,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -49275,6 +49350,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
Index: pkgsrc/lang/php74/patches/patch-ext_session_session.c
diff -u /dev/null pkgsrc/lang/php74/patches/patch-ext_session_session.c:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-ext_session_session.c Thu Oct 22 02:06:45 2026
@@ -0,0 +1,15 @@
+$NetBSD: patch-ext_session_session.c,v 1.1 2026/10/22 02:06:45 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- ext/session/session.c.orig 2022-10-31 10:36:09.000000000 +0000
++++ ext/session/session.c
+@@ -3174,7 +3174,7 @@ static int php_session_rfc1867_callback(
+ if (php_session_rfc1867_orig_callback) {
+ retval = php_session_rfc1867_orig_callback(event, event_data, extra);
+ }
+- if (!PS(rfc1867_enabled)) {
++ if (!PS(rfc1867_enabled) || true) {
+ return retval;
+ }
+
Index: pkgsrc/lang/php74/patches/patch-main_SAPI.c
diff -u /dev/null pkgsrc/lang/php74/patches/patch-main_SAPI.c:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-main_SAPI.c Thu Oct 22 02:06:45 2026
@@ -0,0 +1,30 @@
+$NetBSD: patch-main_SAPI.c,v 1.1 2026/10/22 02:06:45 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- main/SAPI.c.orig 2022-10-31 10:36:05.000000000 +0000
++++ main/SAPI.c
+@@ -509,18 +509,23 @@ SAPI_API void sapi_deactivate(void)
+ }
+ if (SG(request_info).auth_user) {
+ efree(SG(request_info).auth_user);
++ SG(request_info).auth_user = NULL;
+ }
+ if (SG(request_info).auth_password) {
+ efree(SG(request_info).auth_password);
++ SG(request_info).auth_password = NULL;
+ }
+ if (SG(request_info).auth_digest) {
+ efree(SG(request_info).auth_digest);
++ SG(request_info).auth_digest = NULL;
+ }
+ if (SG(request_info).content_type_dup) {
+ efree(SG(request_info).content_type_dup);
++ SG(request_info).content_type_dup = NULL;
+ }
+ if (SG(request_info).current_user) {
+ efree(SG(request_info).current_user);
++ SG(request_info).current_user = NULL;
+ }
+ if (sapi_module.deactivate) {
+ sapi_module.deactivate();
Index: pkgsrc/lang/php74/patches/patch-main_main.c
diff -u /dev/null pkgsrc/lang/php74/patches/patch-main_main.c:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-main_main.c Thu Oct 22 02:06:46 2026
@@ -0,0 +1,33 @@
+$NetBSD: patch-main_main.c,v 1.1 2026/10/22 02:06:46 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- main/main.c.orig 2022-10-31 10:36:05.000000000 +0000
++++ main/main.c
+@@ -836,6 +836,7 @@ PHP_INI_BEGIN()
+ PHP_INI_ENTRY("disable_functions", "", PHP_INI_SYSTEM, NULL)
+ PHP_INI_ENTRY("disable_classes", "", PHP_INI_SYSTEM, NULL)
+ PHP_INI_ENTRY("max_file_uploads", "20", PHP_INI_SYSTEM|PHP_INI_PERDIR, NULL)
++ PHP_INI_ENTRY("max_multipart_body_parts", "-1", PHP_INI_SYSTEM|PHP_INI_PERDIR, NULL)
+
+ STD_PHP_INI_BOOLEAN("allow_url_fopen", "1", PHP_INI_SYSTEM, OnUpdateBool, allow_url_fopen, php_core_globals, core_globals)
+ STD_PHP_INI_BOOLEAN("allow_url_include", "0", PHP_INI_SYSTEM, OnUpdateBool, allow_url_include, php_core_globals, core_globals)
+@@ -1960,6 +1961,8 @@ void php_request_shutdown(void *dummy)
+
+ for (i=0; i<NUM_TRACK_VARS; i++) {
+ zval_ptr_dtor(&PG(http_globals)[i]);
++ /* May be accessed before php_request_startup() */
++ ZVAL_UNDEF(&PG(http_globals)[i]);
+ }
+ } zend_end_try();
+
+@@ -2012,6 +2015,9 @@ void php_request_shutdown(void *dummy)
+ #ifdef HAVE_DTRACE
+ DTRACE_REQUEST_SHUTDOWN(SAFE_FILENAME(SG(request_info).path_translated), SAFE_FILENAME(SG(request_info).request_uri), (char *)SAFE_FILENAME(SG(request_info).request_method));
+ #endif /* HAVE_DTRACE */
++
++ /* May be accessed before php_request_startup() */
++ PG(modules_activated) = 0;
+ }
+ /* }}} */
+
Index: pkgsrc/lang/php74/patches/patch-main_php__variables.c
diff -u /dev/null pkgsrc/lang/php74/patches/patch-main_php__variables.c:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-main_php__variables.c Thu Oct 22 02:06:46 2026
@@ -0,0 +1,42 @@
+$NetBSD: patch-main_php__variables.c,v 1.1 2026/10/22 02:06:46 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- main/php_variables.c.orig 2022-10-31 10:36:05.000000000 +0000
++++ main/php_variables.c
+@@ -218,7 +218,7 @@ PHPAPI void php_register_variable_ex(cha
+ }
+
+ if (!index) {
+- array_init(&gpc_element);
++ array_init_singleton(&gpc_element);
+ if ((gpc_element_p = zend_hash_next_index_insert(symtable1, &gpc_element)) == NULL) {
+ zend_array_destroy(Z_ARR(gpc_element));
+ zval_ptr_dtor_nogc(val);
+@@ -229,7 +229,7 @@ PHPAPI void php_register_variable_ex(cha
+ gpc_element_p = zend_symtable_str_find(symtable1, index, index_len);
+ if (!gpc_element_p) {
+ zval tmp;
+- array_init(&tmp);
++ array_init_singleton(&tmp);
+ gpc_element_p = zend_symtable_str_update_ind(symtable1, index, index_len, &tmp);
+ } else {
+ if (Z_TYPE_P(gpc_element_p) == IS_INDIRECT) {
+@@ -237,7 +237,7 @@ PHPAPI void php_register_variable_ex(cha
+ }
+ if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) {
+ zval_ptr_dtor_nogc(gpc_element_p);
+- array_init(gpc_element_p);
++ array_init_singleton(gpc_element_p);
+ } else {
+ SEPARATE_ARRAY(gpc_element_p);
+ }
+@@ -429,7 +429,7 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_defaul
+ case PARSE_POST:
+ case PARSE_GET:
+ case PARSE_COOKIE:
+- array_init(&array);
++ array_init_singleton(&array);
+ switch (arg) {
+ case PARSE_POST:
+ zval_ptr_dtor_nogc(&PG(http_globals)[TRACK_VARS_POST]);
Index: pkgsrc/lang/php74/patches/patch-main_rfc1867.c
diff -u /dev/null pkgsrc/lang/php74/patches/patch-main_rfc1867.c:1.1
--- /dev/null Thu Oct 22 02:06:46 2026
+++ pkgsrc/lang/php74/patches/patch-main_rfc1867.c Thu Oct 22 02:06:46 2026
@@ -0,0 +1,102 @@
+$NetBSD: patch-main_rfc1867.c,v 1.1 2026/10/22 02:06:46 taca Exp $
+
+Fix for CVE-2026-109618-109619.
+
+--- main/rfc1867.c.orig 2022-10-31 10:36:05.000000000 +0000
++++ main/rfc1867.c
+@@ -397,6 +397,14 @@ static int find_boundary(multipart_buffe
+ return 0;
+ }
+
++static zend_bool php_mime_should_save_hdr(const char *name)
++{
++ return !strcasecmp(name, "Content-Disposition")
++ || !strcasecmp(name, "Content-Type");
++}
++
++static char *php_mime_get_hdr_value(zend_llist header, char *key);
++
+ /* parse headers */
+ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
+ {
+@@ -437,10 +445,16 @@ static int multipart_buffer_headers(mult
+ }
+
+ *value = '\0';
+- do { value++; } while (isspace(*value));
+
++ /* Keep only headers we use, and ignore duplicates */
++ if (!php_mime_should_save_hdr(line)
++ || php_mime_get_hdr_value(*header, line)) {
++ key = NULL;
++ } else {
+ key = estrdup(line);
++ do { value++; } while (isspace((unsigned char)*value));
+ smart_string_appends(&buf_value, value);
++ }
+ } else if (buf_value.c) { /* If no ':' on the line, add to previous line */
+ smart_string_appends(&buf_value, line);
+ } else {
+@@ -514,11 +528,11 @@ static char *php_ap_getword(const zend_e
+ return res;
+ }
+
+-static char *substring_conf(char *start, int len, char quote)
++static char *substring_conf(char *start, size_t len, char quote)
+ {
+ char *result = emalloc(len + 1);
+ char *resp = result;
+- int i;
++ size_t i;
+
+ for (i = 0; i < len && start[i] != quote; ++i) {
+ if (start[i] == '\\' && (start[i + 1] == '\\' || (quote && start[i + 1] == quote))) {
+@@ -546,14 +560,14 @@ static char *php_ap_getword_conf(const z
+ char quote = *str;
+
+ str++;
+- return substring_conf(str, (int)strlen(str), quote);
++ return substring_conf(str, strlen(str), quote);
+ } else {
+ char *strend = str;
+
+ while (*strend && !isspace(*strend)) {
+ ++strend;
+ }
+- return substring_conf(str, strend - str, 0);
++ return substring_conf(str, (size_t)(strend - str), 0);
+ }
+ }
+
+@@ -694,6 +708,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_
+ void *event_extra_data = NULL;
+ unsigned int llen = 0;
+ int upload_cnt = INI_INT("max_file_uploads");
++ int body_parts_cnt = INI_INT("max_multipart_body_parts");
+ const zend_encoding *internal_encoding = zend_multibyte_get_internal_encoding();
+ php_rfc1867_getword_t getword;
+ php_rfc1867_getword_conf_t getword_conf;
+@@ -715,6 +730,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_
+ return;
+ }
+
++ if (body_parts_cnt < 0) {
++ body_parts_cnt = PG(max_input_vars) + upload_cnt;
++ }
++ int body_parts_limit = body_parts_cnt;
++
+ /* Get the boundary */
+ boundary = strstr(content_type_dup, "boundary");
+ if (!boundary) {
+@@ -799,6 +819,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_
+ char *pair = NULL;
+ int end = 0;
+
++ if (--body_parts_cnt < 0) {
++ php_error_docref(NULL, E_WARNING, "Multipart body parts limit exceeded %d. To increase the limit change max_multipart_body_parts in php.ini.", body_parts_limit);
++ goto fileupload_done;
++ }
++
+ while (isspace(*cd)) {
+ ++cd;
+ }
Home |
Main Index |
Thread Index |
Old Index