Apply changes by r308525 from PHP's repository to fix bug #54055
(buffer overrun with high values for precision ini setting).

It fixes one of security fixes by PHP 5.3.6.

Bump PKGREVISION.


(taca)

$NetBSD: patch-main_snprintf.c,v 1.1 2011/03/21 16:34:28 taca Exp $

--- main/snprintf.c.orig	2010-01-03 09:23:27.000000000 +0000
+++ main/snprintf.c
@@ -675,10 +675,6 @@ static int format_converter(register buf
 
 				/*
 				 * Check if a precision was specified
-				 *
-				 * XXX: an unreasonable amount of precision may be specified
-				 * resulting in overflow of num_buf. Currently we
-				 * ignore this possibility.
 				 */
 				if (*fmt == '.') {
 					adjust_precision = YES;
@@ -692,6 +688,10 @@ static int format_converter(register buf
 							precision = 0;
 					} else
 						precision = 0;
+
+					if (precision > FORMAT_CONV_MAX_PRECISION) {
+						precision = FORMAT_CONV_MAX_PRECISION;
+					}
 				} else
 					adjust_precision = NO;
 			} else

$NetBSD: patch-main_snprintf.h,v 1.1 2011/03/21 16:34:28 taca Exp $

--- main/snprintf.h.orig	2010-01-03 09:23:27.000000000 +0000
+++ main/snprintf.h
@@ -12,7 +12,7 @@
    | obtain it through the world-wide-web, please send a note to          |
    | license@php.net so we can mail you a copy immediately.               |
    +----------------------------------------------------------------------+
-   | Author: Stig Sæther Bakken <ssb@php.net>                             |
+   | Author: Stig Sæther Bakken <ssb@php.net>                             |
    |         Marcus Boerger <helly@php.net>                               |
    +----------------------------------------------------------------------+
 */
@@ -148,6 +148,17 @@ extern char * ap_php_conv_10(register wi
 extern char * ap_php_conv_p2(register u_wide_int num, register int nbits,
 		 char format, char *buf_end, register int *len);
 
+/* The maximum precision that's allowed for float conversion. Does not include
+ * decimal separator, exponent, sign, terminator. Currently does not affect
+ * the modes e/f, only g/k/H, as those have a different limit enforced at
+ * another level (see NDIG in php_conv_fp()).
+ * Applies to the formatting functions of both spprintf.c and snprintf.c, which
+ * use equally sized buffers of MAX_BUF_SIZE = 512 to hold the result of the
+ * call to php_gcvt().
+ * This should be reasonably smaller than MAX_BUF_SIZE (I think MAX_BUF_SIZE - 9
+ * should be enough, but let's give some more space) */
+#define FORMAT_CONV_MAX_PRECISION 500
+
 #endif /* SNPRINTF_H */
 
 /*

$NetBSD: patch-main_spprintf.c,v 1.1 2011/03/21 16:34:28 taca Exp $

--- main/spprintf.c.orig	2010-01-03 09:23:27.000000000 +0000
+++ main/spprintf.c
@@ -282,10 +282,6 @@ static void xbuf_format_converter(smart_
 
 				/*
 				 * Check if a precision was specified
-				 *
-				 * XXX: an unreasonable amount of precision may be specified
-				 * resulting in overflow of num_buf. Currently we
-				 * ignore this possibility.
 				 */
 				if (*fmt == '.') {
 					adjust_precision = YES;
@@ -299,6 +295,10 @@ static void xbuf_format_converter(smart_
 							precision = 0;
 					} else
 						precision = 0;
+
+					if (precision > FORMAT_CONV_MAX_PRECISION) {
+						precision = FORMAT_CONV_MAX_PRECISION;
+					}
 				} else
 					adjust_precision = NO;
 			} else