Mon Mar 21 16:08:29 2011 UTC ()
Add a patch to fix bug #54193 (Integer overflow in shmop_read()) referring
r309018 from PHPs' repository.  (CVE-2011-1092)

Bump PKGREVISION of devel/php-shmop.


(taca)
diff -r1.9 -r1.10 pkgsrc/devel/php-shmop/Makefile
diff -r1.87 -r1.88 pkgsrc/lang/php5/distinfo
diff -r0 -r1.1 pkgsrc/lang/php5/patches/patch-ext_shmop_shmop.c
cvs diff -r1.9 -r1.10 pkgsrc/devel/php-shmop/Makefile (expand / switch to unified diff)

--- pkgsrc/devel/php-shmop/Makefile 2008/06/12 02:14:28 1.9
+++ pkgsrc/devel/php-shmop/Makefile 2011/03/21 16:08:28 1.10
@@ -1,14 +1,15 @@ @@ -1,14 +1,15 @@
1# $NetBSD: Makefile,v 1.9 2008/06/12 02:14:28 joerg Exp $ 1# $NetBSD: Makefile,v 1.10 2011/03/21 16:08:28 taca Exp $
2 2
3MODNAME= shmop 3MODNAME= shmop
 4PKGREVISION= 1
4CATEGORIES+= devel 5CATEGORIES+= devel
5COMMENT= PHP extension for simple SysV shared memory operations 6COMMENT= PHP extension for simple SysV shared memory operations
6 7
7PKG_DESTDIR_SUPPORT= user-destdir 8PKG_DESTDIR_SUPPORT= user-destdir
8 9
9CONFLICTS= php-shmop-[0-9]* 10CONFLICTS= php-shmop-[0-9]*
10 11
11CONFIGURE_ARGS+= --enable-${MODNAME}=shared,${BUILDLINK_DIR} 12CONFIGURE_ARGS+= --enable-${MODNAME}=shared,${BUILDLINK_DIR}
12 13
13.include "../../lang/php/ext.mk" 14.include "../../lang/php/ext.mk"
14.include "../../mk/bsd.pkg.mk" 15.include "../../mk/bsd.pkg.mk"
cvs diff -r1.87 -r1.88 pkgsrc/lang/php5/Attic/distinfo (expand / switch to unified diff)

--- pkgsrc/lang/php5/Attic/distinfo 2011/02/21 16:26:49 1.87
+++ pkgsrc/lang/php5/Attic/distinfo 2011/03/21 16:08:29 1.88
@@ -1,22 +1,20 @@ @@ -1,22 +1,20 @@
1$NetBSD: distinfo,v 1.87 2011/02/21 16:26:49 taca Exp $ 1$NetBSD: distinfo,v 1.88 2011/03/21 16:08:29 taca Exp $
2 2
3SHA1 (php-5.2.17/php-5.2.17.tar.bz2) = d68f3b09f766990d815a3c4c63c157db8dab8095 3SHA1 (php-5.2.17/php-5.2.17.tar.bz2) = d68f3b09f766990d815a3c4c63c157db8dab8095
4RMD160 (php-5.2.17/php-5.2.17.tar.bz2) = 567fa8d718b93fb83a89494c83a8bec224ac99e9 4RMD160 (php-5.2.17/php-5.2.17.tar.bz2) = 567fa8d718b93fb83a89494c83a8bec224ac99e9
5Size (php-5.2.17/php-5.2.17.tar.bz2) = 9092312 bytes 5Size (php-5.2.17/php-5.2.17.tar.bz2) = 9092312 bytes
6SHA1 (php-5.2.17/suhosin-patch-5.2.16-0.9.7.patch.gz) = fec10b2b81582d06bb0d0a96ea55c525afc8ab29 
7RMD160 (php-5.2.17/suhosin-patch-5.2.16-0.9.7.patch.gz) = b28b70faf136b3e04c5b483da0f4c2279378f43a 
8Size (php-5.2.17/suhosin-patch-5.2.16-0.9.7.patch.gz) = 23069 bytes 
9SHA1 (patch-aa) = 20bc3831e435182d014b11ae9f1f6c537a21af20 6SHA1 (patch-aa) = 20bc3831e435182d014b11ae9f1f6c537a21af20
10SHA1 (patch-af) = 68c5a31dccf1854ba1aff653e4c524767d6a64f6 7SHA1 (patch-af) = 68c5a31dccf1854ba1aff653e4c524767d6a64f6
11SHA1 (patch-ag) = 5e3e822657925a77fbccaca63f283863a1cc6d94 8SHA1 (patch-ag) = 5e3e822657925a77fbccaca63f283863a1cc6d94
12SHA1 (patch-ah) = a25cb7fa3d1f5b9fb99493a4348fdba69d3d4728 9SHA1 (patch-ah) = a25cb7fa3d1f5b9fb99493a4348fdba69d3d4728
13SHA1 (patch-aj) = 54812097499c81e5cb0196ab949cc86a4f24a9cc 10SHA1 (patch-aj) = 54812097499c81e5cb0196ab949cc86a4f24a9cc
14SHA1 (patch-al) = 257129124d46a84f7342b1a00f0cab073066e7cb 11SHA1 (patch-al) = 257129124d46a84f7342b1a00f0cab073066e7cb
15SHA1 (patch-an) = 8f4174627b8cb5f8bfbc59413c95f71e26b9e602 12SHA1 (patch-an) = 8f4174627b8cb5f8bfbc59413c95f71e26b9e602
16SHA1 (patch-ap) = 5eb0e0e4244a993da93e36f8fcb5553454207fce 13SHA1 (patch-ap) = 5eb0e0e4244a993da93e36f8fcb5553454207fce
17SHA1 (patch-aq) = 0c9d48547da2fa80aa8357d23ad8505d1c0330df 14SHA1 (patch-aq) = 0c9d48547da2fa80aa8357d23ad8505d1c0330df
18SHA1 (patch-ar) = 2d74ec926cc00bfbb67d16210af78c33ad9ac38d 15SHA1 (patch-ar) = 2d74ec926cc00bfbb67d16210af78c33ad9ac38d
19SHA1 (patch-as) = f7ce5caffe2acdd1f8e9fc8ae6c7ba1d8c6a25c1 16SHA1 (patch-as) = f7ce5caffe2acdd1f8e9fc8ae6c7ba1d8c6a25c1
20SHA1 (patch-ext_exif_exif.c) = 0a6ab268751e633510cb6b334b1bdb84a014b528 17SHA1 (patch-ext_exif_exif.c) = 0a6ab268751e633510cb6b334b1bdb84a014b528
 18SHA1 (patch-ext_shmop_shmop.c) = 6e11b87dd71ff26357b14b61df626c40b40a022d
21SHA1 (patch-ext_zip_lib_zip__name__locate.c) = 4030e37ae4f93dbcb1a3a937a5407c2c406a49d6 19SHA1 (patch-ext_zip_lib_zip__name__locate.c) = 4030e37ae4f93dbcb1a3a937a5407c2c406a49d6
22SHA1 (patch-ext_zip_php__zip.c) = 134fa566a689d72d63a2fa0aa5c96c4595619089 20SHA1 (patch-ext_zip_php__zip.c) = 134fa566a689d72d63a2fa0aa5c96c4595619089
File Added: pkgsrc/lang/php5/patches/Attic/patch-ext_shmop_shmop.c
$NetBSD: patch-ext_shmop_shmop.c,v 1.1 2011/03/21 16:08:29 taca Exp $

Fix for CVE-2011-1092.

--- ext/shmop/shmop.c.orig	2010-01-03 09:23:27.000000000 +0000
+++ ext/shmop/shmop.c
@@ -223,7 +223,7 @@ PHP_FUNCTION(shmop_read)
 		RETURN_FALSE;
 	}
 
-	if (start + count > shmop->size || count < 0) {
+	if (count < 0 || start > (INT_MAX - count) || start + count > shmop->size) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "count is out of range");
 		RETURN_FALSE;
 	}