Thu May 15 09:56:31 2008 UTC ()
pullup ticket #2378 - requested by adrianp
php5: many security fixes

revisions pulled up:
- pkgsrc/lang/php5/Makefile		1.64
- pkgsrc/lang/php5/Makefile.common	1.29
- pkgsrc/lang/php5/distinfo		1.52

   Module Name:	pkgsrc
   Committed By:	adrianp
   Date:		Sun May  4 16:50:44 UTC 2008

   Modified Files:
   	pkgsrc/lang/php5: Makefile Makefile.common distinfo

   Log Message:
   Security Enhancements and Fixes in PHP 5.2.6:

   Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
   Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
   Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
   Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
   Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
   Upgraded bundled PCRE to version 7.6

   Key enhancements in PHP 5.2.6 include:
   * Fixed two possible crashes inside the posix extension.
   * Fixed bug 44069 (Huge memory usage with concatenation using . instead of .=)
   * Fixed bug 44141 (private parent constructor callable through static function).
   * Fixed bug 43589 (a possible infinite loop in bz2_filter.c).
   * Fixed bug 43450 (Memory leak on some functions with implicit object __toString() call).
   * Fixed bug 43201 (Crash on using uninitialized vals and __get/__set).
   * Fixed bug 42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
   * Fixed bug 42937 (__call() method not invoked when methods are called on parent from child class).
   * Fixed bug 42736 (xmlrpc_server_call_method() crashes).
   * Fixed bug 42369 (Implicit conversion to string leaks memory).
   * Fixed bug 41562 (SimpleXML memory issue).
   * Over 120 bug fixes.


(rtr)
diff -r1.63 -r1.63.2.1 pkgsrc/lang/php5/Makefile
diff -r1.28 -r1.28.4.1 pkgsrc/lang/php5/Makefile.common
diff -r1.51 -r1.51.2.1 pkgsrc/lang/php5/distinfo
cvs diff -r1.63 -r1.63.2.1 pkgsrc/lang/php5/Attic/Makefile (expand / switch to unified diff)

--- pkgsrc/lang/php5/Attic/Makefile 2008/01/18 05:06:44 1.63
+++ pkgsrc/lang/php5/Attic/Makefile 2008/05/15 09:56:31 1.63.2.1
@@ -1,17 +1,16 @@ @@ -1,17 +1,16 @@
1# $NetBSD: Makefile,v 1.63 2008/01/18 05:06:44 tnn Exp $ 1# $NetBSD: Makefile,v 1.63.2.1 2008/05/15 09:56:31 rtr Exp $
2 2
3PKGNAME= php-${PHP_BASE_VERS} 3PKGNAME= php-${PHP_BASE_VERS}
4PKGREVISION= 1 
5CATEGORIES= lang 4CATEGORIES= lang
6 5
7HOMEPAGE= http://www.php.net/ 6HOMEPAGE= http://www.php.net/
8COMMENT= PHP Hypertext Preprocessor version 5 7COMMENT= PHP Hypertext Preprocessor version 5
9 8
10TEST_TARGET= test 9TEST_TARGET= test
11PKG_DESTDIR_SUPPORT= user-destdir 10PKG_DESTDIR_SUPPORT= user-destdir
12 11
13USE_TOOLS+= gmake lex 12USE_TOOLS+= gmake lex
14LIBTOOL_OVERRIDE= # empty 13LIBTOOL_OVERRIDE= # empty
15 14
16PKG_OPTIONS_REQUIRED_GROUPS+= sapi 15PKG_OPTIONS_REQUIRED_GROUPS+= sapi
17PKG_OPTIONS_GROUP.sapi= cgi fastcgi 16PKG_OPTIONS_GROUP.sapi= cgi fastcgi
cvs diff -r1.28 -r1.28.4.1 pkgsrc/lang/php5/Attic/Makefile.common (expand / switch to unified diff)

--- pkgsrc/lang/php5/Attic/Makefile.common 2007/11/23 13:20:00 1.28
+++ pkgsrc/lang/php5/Attic/Makefile.common 2008/05/15 09:56:31 1.28.4.1
@@ -1,28 +1,28 @@ @@ -1,28 +1,28 @@
1# $NetBSD: Makefile.common,v 1.28 2007/11/23 13:20:00 adrianp Exp $ 1# $NetBSD: Makefile.common,v 1.28.4.1 2008/05/15 09:56:31 rtr Exp $
2 2
3.if !defined(DISTNAME) 3.if !defined(DISTNAME)
4DISTNAME= php-${PHP_BASE_VERS} 4DISTNAME= php-${PHP_BASE_VERS}
5DIST_SUBDIR= ${DISTNAME} 5DIST_SUBDIR= ${DISTNAME}
6.endif 6.endif
7CATEGORIES+= www 7CATEGORIES+= www
8 8
9.if !defined(PECL_VERSION) 9.if !defined(PECL_VERSION)
10MASTER_SITES?= http://www.php.net/distributions/ \ 10MASTER_SITES?= http://www.php.net/distributions/ \
11 http://php3.de/distributions/ 11 http://php3.de/distributions/
12EXTRACT_SUFX?= .tar.bz2 12EXTRACT_SUFX?= .tar.bz2
13.endif 13.endif
14 14
15MAINTAINER?= jdolecek@NetBSD.org 15MAINTAINER?= jdolecek@NetBSD.org
16HOMEPAGE?= http://www.php.net/ 16HOMEPAGE?= http://www.php.net/
17 17
18PHP_BASE_VERS= 5.2.5 18PHP_BASE_VERS= 5.2.6
19 19
20PHP_EXTENSION_DIR= lib/php/20040412 20PHP_EXTENSION_DIR= lib/php/20040412
21PLIST_SUBST+= PHP_EXTENSION_DIR=${PHP_EXTENSION_DIR:Q} 21PLIST_SUBST+= PHP_EXTENSION_DIR=${PHP_EXTENSION_DIR:Q}
22 22
23PKG_SYSCONFVAR?= php 23PKG_SYSCONFVAR?= php
24 24
25# needed due to (broken?) configure checks in php-xmlrpc and php5-dom 25# needed due to (broken?) configure checks in php-xmlrpc and php5-dom
26CONFIGURE_ENV+= PHP_LIBXML_SHARED="1" 26CONFIGURE_ENV+= PHP_LIBXML_SHARED="1"
27 27
28.include "../../mk/bsd.prefs.mk" 28.include "../../mk/bsd.prefs.mk"
cvs diff -r1.51 -r1.51.2.1 pkgsrc/lang/php5/Attic/distinfo (expand / switch to unified diff)

--- pkgsrc/lang/php5/Attic/distinfo 2008/03/04 18:58:52 1.51
+++ pkgsrc/lang/php5/Attic/distinfo 2008/05/15 09:56:31 1.51.2.1
@@ -1,15 +1,15 @@ @@ -1,15 +1,15 @@
1$NetBSD: distinfo,v 1.51 2008/03/04 18:58:52 sborrill Exp $ 1$NetBSD: distinfo,v 1.51.2.1 2008/05/15 09:56:31 rtr Exp $
2 2
3SHA1 (php-5.2.5/php-5.2.5.tar.bz2) = 6b46fd095891183b328163b70cdb5acd30a24b7a 3SHA1 (php-5.2.6/php-5.2.6.tar.bz2) = 2a2b1afa657a7739a23784c869d57c3e0a7ad6b4
4RMD160 (php-5.2.5/php-5.2.5.tar.bz2) = 2d5755f2ae8884e80f0a5c70e8fdfdb6deed46bc 4RMD160 (php-5.2.6/php-5.2.6.tar.bz2) = 27f730d4b1ceb1c42ff03618dbfa0dc87a00990b
5Size (php-5.2.5/php-5.2.5.tar.bz2) = 7773024 bytes 5Size (php-5.2.6/php-5.2.6.tar.bz2) = 9571312 bytes
6SHA1 (patch-aa) = 20bc3831e435182d014b11ae9f1f6c537a21af20 6SHA1 (patch-aa) = 20bc3831e435182d014b11ae9f1f6c537a21af20
7SHA1 (patch-ad) = b324c33b1e70adee5b89dcecdd7690dcadcc18ec 7SHA1 (patch-ad) = b324c33b1e70adee5b89dcecdd7690dcadcc18ec
8SHA1 (patch-ag) = 4ccb67ba6f5370b1d16b087e3e714de3e5ae604e 8SHA1 (patch-ag) = 4ccb67ba6f5370b1d16b087e3e714de3e5ae604e
9SHA1 (patch-ah) = c7cbd4b9ea0796ea3b7491c2cffb6ddddc518587 9SHA1 (patch-ah) = c7cbd4b9ea0796ea3b7491c2cffb6ddddc518587
10SHA1 (patch-aj) = 54812097499c81e5cb0196ab949cc86a4f24a9cc 10SHA1 (patch-aj) = 54812097499c81e5cb0196ab949cc86a4f24a9cc
11SHA1 (patch-ak) = e3c654de196dc4b693b2d95e3ee131fa147125bc 11SHA1 (patch-ak) = e3c654de196dc4b693b2d95e3ee131fa147125bc
12SHA1 (patch-al) = 0ee37782cc0d3bf5ede1a583de0589c2c1316b50 12SHA1 (patch-al) = 0ee37782cc0d3bf5ede1a583de0589c2c1316b50
13SHA1 (patch-an) = f07a08f8ee1a18f6371af9bd6c482d936e9220e4 13SHA1 (patch-an) = f07a08f8ee1a18f6371af9bd6c482d936e9220e4
14SHA1 (patch-ap) = 5eb0e0e4244a993da93e36f8fcb5553454207fce 14SHA1 (patch-ap) = 5eb0e0e4244a993da93e36f8fcb5553454207fce
15SHA1 (patch-aq) = 0c9d48547da2fa80aa8357d23ad8505d1c0330df 15SHA1 (patch-aq) = 0c9d48547da2fa80aa8357d23ad8505d1c0330df