Sat Jan 19 21:44:08 2019 UTC ()
Pullup ticket #5897 - requested by taca
lang/php72: security fix

Revisions pulled up:
- lang/php/phpversion.mk                                        1.243
- lang/php72/Makefile                                           1.16
- lang/php72/distinfo                                           1.35

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sat Jan 12 14:59:03 UTC 2019

   Modified Files:
   	pkgsrc/lang/php: phpversion.mk
   	pkgsrc/lang/php72: Makefile distinfo

   Log Message:
   lang/php72: update to 7.2.14

   10 Jan 2019, PHP 7.2.14

   - Core:
     . Fixed bug #77369 (memcpy with negative length via crafted DNS response). (Stas)
     . Fixed bug #71041 (zend_signal_startup() needs ZEND_API).
       (Valentin V. Bartenev)
     . Fixed bug #76046 (PHP generates "FE_FREE" opcode on the wrong line).
       (Nikita)

   - COM:
     . Fixed bug #77177 (Serializing or unserializing COM objects crashes). (cmb)

   - Date:
     . Fixed bug #77097 (DateTime::diff gives wrong diff when the actual diff is
       less than 1 second). (Derick)

   - Exif:
     . Fixed bug #77184 (Unsigned rational numbers are written out as signed
       rationals). (Colin Basnett)

   - GD:
     . Fixed bug #77269 (efree() on uninitialized Heap data in imagescale leads to
       use-after-free). (cmb)
     . Fixed bug #77270 (imagecolormatch Out Of Bounds Write on Heap). (cmb)
     . Fixed bug #77195 (Incorrect error handling of imagecreatefromjpeg()). (cmb)
     . Fixed bug #77198 (auto cropping has insufficient precision). (cmb)
     . Fixed bug #77200 (imagecropauto(…, GD_CROP_SIDES) crops left but not right).
       (cmb)

   - IMAP:
     . Fixed bug #77020 (null pointer dereference in imap_mail). (cmb)

   - Mbstring:
     . Fixed bug #77370 (Buffer overflow on mb regex functions - fetch_token). (Stas)
     . Fixed bug #77371 (heap buffer overflow in mb regex functions
       - compile_string_node). (Stas)
     . Fixed bug #77381 (heap buffer overflow in multibyte match_at). (Stas)
     . Fixed bug #77382 (heap buffer overflow due to incorrect length in
       expand_case_fold_string). (Stas)
     . Fixed bug #77385 (buffer overflow in fetch_token). (Stas)
     . Fixed bug #77394 (Buffer overflow in multibyte case folding - unicode). (Stas)
     . Fixed bug #77418 (Heap overflow in utf32be_mbc_to_code). (Stas)

   - OCI8:
     . Fixed bug #76804 (oci_pconnect with OCI_CRED_EXT not working). (KoenigsKind)
     . Added oci_set_call_timeout() for call timeouts.
     . Added oci_set_db_operation() for the DBOP end-to-end-tracing attribute.

   - Opcache:
     . Fixed bug #77215 (CFG assertion failure on multiple finalizing switch
       frees in one block). (Nikita)

   - PDO:
     . Handle invalid index passed to PDOStatement::fetchColumn() as error. (Sergei
       Morozov)

   - Phar:
     . Fixed bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext). (Stas)

   - Sockets:
     . Fixed bug #77136 (Unsupported IPV6_RECVPKTINFO constants on macOS).
       (Mizunashi Mana)

   - SQLite3:
     . Fixed bug #77051 (Issue with re-binding on SQLite3). (BohwaZ)

   - Xmlrpc:
     . Fixed bug #77242 (heap out of bounds read in xmlrpc_decode()). (cmb)
     . Fixed bug #77380 (Global out of bounds read in xmlrpc base64 code). (Stas)


(bsiegert)
diff -r1.241.2.1 -r1.241.2.2 pkgsrc/lang/php/phpversion.mk
diff -r1.15 -r1.15.2.1 pkgsrc/lang/php72/Makefile
diff -r1.34 -r1.34.2.1 pkgsrc/lang/php72/distinfo
cvs diff -r1.241.2.1 -r1.241.2.2 pkgsrc/lang/php/phpversion.mk (expand / switch to unified diff)

--- pkgsrc/lang/php/phpversion.mk 2019/01/19 21:30:21 1.241.2.1
+++ pkgsrc/lang/php/phpversion.mk 2019/01/19 21:44:08 1.241.2.2
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1# $NetBSD: phpversion.mk,v 1.241.2.1 2019/01/19 21:30:21 bsiegert Exp $ 1# $NetBSD: phpversion.mk,v 1.241.2.2 2019/01/19 21:44:08 bsiegert Exp $
2# 2#
3# This file selects a PHP version, based on the user's preferences and 3# This file selects a PHP version, based on the user's preferences and
4# the installed packages. It does not add a dependency on the PHP 4# the installed packages. It does not add a dependency on the PHP
5# package. 5# package.
6# 6#
7# === User-settable variables === 7# === User-settable variables ===
8# 8#
9# PHP_VERSION_DEFAULT 9# PHP_VERSION_DEFAULT
10# The PHP version to choose when more than one is acceptable to 10# The PHP version to choose when more than one is acceptable to
11# the package. 11# the package.
12# 12#
13# Possible: 56 70 71 72 73 13# Possible: 56 70 71 72 73
14# Default: 71 14# Default: 71
@@ -80,27 +80,27 @@ @@ -80,27 +80,27 @@
80# 80#
81# Example: lib/php/20140828 81# Example: lib/php/20140828
82# 82#
83# Keywords: php 83# Keywords: php
84# 84#
85 85
86.if !defined(PHPVERSION_MK) 86.if !defined(PHPVERSION_MK)
87PHPVERSION_MK= defined 87PHPVERSION_MK= defined
88 88
89# Define each PHP's version. 89# Define each PHP's version.
90PHP56_VERSION= 5.6.39 90PHP56_VERSION= 5.6.39
91PHP70_VERSION= 7.0.33 91PHP70_VERSION= 7.0.33
92PHP71_VERSION= 7.1.26 92PHP71_VERSION= 7.1.26
93PHP72_VERSION= 7.2.13 93PHP72_VERSION= 7.2.14
94PHP73_VERSION= 7.3.0 94PHP73_VERSION= 7.3.0
95 95
96# Define initial release of major version. 96# Define initial release of major version.
97PHP56_RELDATE= 20140828 97PHP56_RELDATE= 20140828
98PHP70_RELDATE= 20151203 98PHP70_RELDATE= 20151203
99PHP71_RELDATE= 20160303 99PHP71_RELDATE= 20160303
100PHP72_RELDATE= 20170718 100PHP72_RELDATE= 20170718
101PHP73_RELDATE= 20181200 101PHP73_RELDATE= 20181200
102 102
103_VARGROUPS+= php 103_VARGROUPS+= php
104_USER_VARS.php= PHP_VERSION_DEFAULT 104_USER_VARS.php= PHP_VERSION_DEFAULT
105_PKG_VARS.php= PHP_VERSIONS_ACCEPTED PHP_VERSION_REQD 105_PKG_VARS.php= PHP_VERSIONS_ACCEPTED PHP_VERSION_REQD
106_SYS_VARS.php= PKG_PHP_VERSION PKG_PHP PHPPKGSRCDIR PHP_PKG_PREFIX \ 106_SYS_VARS.php= PKG_PHP_VERSION PKG_PHP PHPPKGSRCDIR PHP_PKG_PREFIX \
cvs diff -r1.15 -r1.15.2.1 pkgsrc/lang/php72/Attic/Makefile (expand / switch to unified diff)

--- pkgsrc/lang/php72/Attic/Makefile 2018/12/09 18:52:34 1.15
+++ pkgsrc/lang/php72/Attic/Makefile 2019/01/19 21:44:08 1.15.2.1
@@ -1,20 +1,19 @@ @@ -1,20 +1,19 @@
1# $NetBSD: Makefile,v 1.15 2018/12/09 18:52:34 adam Exp $ 1# $NetBSD: Makefile,v 1.15.2.1 2019/01/19 21:44:08 bsiegert Exp $
2 2
3# 3#
4# We can't omit PKGNAME here to handle PKG_OPTIONS. 4# We can't omit PKGNAME here to handle PKG_OPTIONS.
5# 5#
6PKGNAME= php-${PHP_VERSION:S/RC/rc/} 6PKGNAME= php-${PHP_VERSION:S/RC/rc/}
7PKGREVISION= 2 
8 7
9HOMEPAGE= http://www.php.net/ 8HOMEPAGE= http://www.php.net/
10COMMENT= PHP Hypertext Preprocessor version 7.2 9COMMENT= PHP Hypertext Preprocessor version 7.2
11LICENSE= php 10LICENSE= php
12 11
13TEST_TARGET= test 12TEST_TARGET= test
14 13
15USE_TOOLS+= gmake lex pkg-config 14USE_TOOLS+= gmake lex pkg-config
16LIBTOOL_OVERRIDE= # empty 15LIBTOOL_OVERRIDE= # empty
17PHP_CHECK_INSTALLED= No 16PHP_CHECK_INSTALLED= No
18 17
19PHP_VERSIONS_ACCEPTED= 72 18PHP_VERSIONS_ACCEPTED= 72
20 19
cvs diff -r1.34 -r1.34.2.1 pkgsrc/lang/php72/Attic/distinfo (expand / switch to unified diff)

--- pkgsrc/lang/php72/Attic/distinfo 2018/12/07 17:12:48 1.34
+++ pkgsrc/lang/php72/Attic/distinfo 2019/01/19 21:44:08 1.34.2.1
@@ -1,19 +1,19 @@ @@ -1,19 +1,19 @@
1$NetBSD: distinfo,v 1.34 2018/12/07 17:12:48 taca Exp $ 1$NetBSD: distinfo,v 1.34.2.1 2019/01/19 21:44:08 bsiegert Exp $
2 2
3SHA1 (php-7.2.13.tar.bz2) = eb74e4b52013fef8a349b2193605d344ed425503 3SHA1 (php-7.2.14.tar.bz2) = 97d0bfc6f75d82e8ef9425189ca5c544866f927e
4RMD160 (php-7.2.13.tar.bz2) = 1f362e20ce739e34d7e5c3f282e1842f1873aa73 4RMD160 (php-7.2.14.tar.bz2) = 886704673d55837144946731f6137549d4f963ac
5SHA512 (php-7.2.13.tar.bz2) = 95b9d09fec4af7df38736fabd291af5635a2caab9611c82a9a4988a849888f9847052ed69192c0f0b0103cf9d2888d5dd763471e1419d6e8da33ab77c9f95dbd 5SHA512 (php-7.2.14.tar.bz2) = 1a3db5937c826a1dea39db24fcf122b931ecda89c5c8ca96f337fb696c48c39f81c540bfae40e0cc8837b5d378288da4f91dfa07435801517d75202e5c925453
6Size (php-7.2.13.tar.bz2) = 15051814 bytes 6Size (php-7.2.14.tar.bz2) = 15039077 bytes
7SHA1 (patch-configure) = 47f2ede97390cc7e46d04c2769dd97459b19450a 7SHA1 (patch-configure) = 47f2ede97390cc7e46d04c2769dd97459b19450a
8SHA1 (patch-disable-filter-url) = e9e92d686ddd1d1a1ece10fe4feee4e368fe510c 8SHA1 (patch-disable-filter-url) = e9e92d686ddd1d1a1ece10fe4feee4e368fe510c
9SHA1 (patch-ext_gd_config.m4) = eaecfb31b18700dd642c067ed82748d4f6be2335 9SHA1 (patch-ext_gd_config.m4) = eaecfb31b18700dd642c067ed82748d4f6be2335
10SHA1 (patch-ext_phar_Makefile.frag) = 558869b60f8ed6674a3ba1d595a65f010df4c426 10SHA1 (patch-ext_phar_Makefile.frag) = 558869b60f8ed6674a3ba1d595a65f010df4c426
11SHA1 (patch-ext_phar_phar_phar.php) = f630e3946b21b76d4fe857a43e00e25c9445f2c8 11SHA1 (patch-ext_phar_phar_phar.php) = f630e3946b21b76d4fe857a43e00e25c9445f2c8
12SHA1 (patch-ext_recode_recode.c) = 639bf762302c7a30c88d3f3fa862494e0f847bdb 12SHA1 (patch-ext_recode_recode.c) = 639bf762302c7a30c88d3f3fa862494e0f847bdb
13SHA1 (patch-ext_xsl_php__xsl.h) = a9877bff7bacc77926a4541a0ac171c00ad1a627 13SHA1 (patch-ext_xsl_php__xsl.h) = a9877bff7bacc77926a4541a0ac171c00ad1a627
14SHA1 (patch-php.ini-development) = dd65962000ec06439fae3c9bf252fa46be4e33fd 14SHA1 (patch-php.ini-development) = dd65962000ec06439fae3c9bf252fa46be4e33fd
15SHA1 (patch-php.ini-production) = ae61dffedf574b688fe576b0b2af748b7a28cd89 15SHA1 (patch-php.ini-production) = ae61dffedf574b688fe576b0b2af748b7a28cd89
16SHA1 (patch-run-tests.php) = 86c4d3f03eb8e31b5a35820f426533c9478571fb 16SHA1 (patch-run-tests.php) = 86c4d3f03eb8e31b5a35820f426533c9478571fb
17SHA1 (patch-sapi_cgi_Makefile.frag) = 18769900f588ff81cc34474542afa1d65c070e65 17SHA1 (patch-sapi_cgi_Makefile.frag) = 18769900f588ff81cc34474542afa1d65c070e65
18SHA1 (patch-sapi_cli_Makefile.frag) = 1cd29d09042863acbf5330e406410fdcf75d06b3 18SHA1 (patch-sapi_cli_Makefile.frag) = 1cd29d09042863acbf5330e406410fdcf75d06b3
19SHA1 (patch-sapi_fpm_fpm_events_port.c) = b82b7caffffde1343190fae430a68eb411b5cf8a 19SHA1 (patch-sapi_fpm_fpm_events_port.c) = b82b7caffffde1343190fae430a68eb411b5cf8a