head 1.1; access; symbols pkgsrc-2026Q3:1.1.0.2; locks; strict; comment @ * @; 1.1 date 2026.10.27.15.30.48; author taca; state Exp; branches 1.1.2.1; next ; commitid KjO33YVcJEfD481H; 1.1.2.1 date 2026.10.27.15.30.48; author maya; state dead; branches; next 1.1.2.2; commitid p9DWww5rhvcuiL2H; 1.1.2.2 date 2026.11.09.08.24.26; author maya; state Exp; branches; next ; commitid p9DWww5rhvcuiL2H; desc @@ 1.1 log @lang/php56: fix CVE-2026-109618 and CVE-2026-109619 Apply patch for CVE-2026-109618 and CVE-2026-109619. Thanks to sborrill@@ providing patch information. Bump PKGREVISION. @ text @$NetBSD$ https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch --- Zend/zend_alloc.h.orig 2019-01-09 09:54:13.000000000 +0000 +++ Zend/zend_alloc.h @@@@ -50,6 +50,25 @@@@ typedef struct _zend_leak_info { uint orig_lineno; } zend_leak_info; +/* Delayed out of memory handling (CVE-2026-109618). + * + * Exceeding memory_limit no longer bails out (longjmp) from inside the + * allocator, where the caller may have left request memory in an + * inconsistent state. Instead the allocation succeeds, the error is recorded + * and raised as a fatal error at the next safe point (between two opcodes, or + * once request startup has finished parsing the request). Memory usage beyond + * a hard limit (twice memory_limit, or memory_limit + 1G for limits above 1G) + * terminates the process immediately with _exit(). */ +typedef enum _zend_oom_state { + ZEND_OOM_STATE_NONE = 0, + ZEND_OOM_STATE_PENDING, + ZEND_OOM_STATE_HANDLING, + ZEND_OOM_STATE_HANDLED +} zend_oom_state; + +#define ZEND_HAS_OOM() (UNEXPECTED(EG(delayed_oom) != ZEND_OOM_STATE_NONE)) +#define ZEND_OOM_PENDING() (UNEXPECTED(EG(delayed_oom) == ZEND_OOM_STATE_PENDING)) + BEGIN_EXTERN_C() ZEND_API char *zend_strndup(const char *s, unsigned int length) ZEND_ATTRIBUTE_MALLOC; @@@@ -142,6 +161,7 @@@@ inline static void * __zend_realloc(void #define safe_estrndup(ptr, len) ((ptr)?(estrndup((ptr), (len))):STR_EMPTY_ALLOC()) ZEND_API int zend_set_memory_limit(size_t memory_limit); +ZEND_API void zend_handle_delayed_oom(TSRMLS_D); ZEND_API void start_memory_manager(TSRMLS_D); ZEND_API void shutdown_memory_manager(int silent, int full_shutdown TSRMLS_DC); @ 1.1.2.1 log @file patch-Zend_zend__alloc.h was added on branch pkgsrc-2026Q3 on 2026-11-09 08:24:26 +0000 @ text @d1 40 @ 1.1.2.2 log @Pullup ticket #7341 - requested by taca lang/php56: Security fix Revisions pulled up: - lang/php56/Makefile 1.50 - lang/php56/distinfo 1.68-1.69 - lang/php56/patches/patch-Zend_zend.c 1.1 - lang/php56/patches/patch-Zend_zend__alloc.c 1.1 - lang/php56/patches/patch-Zend_zend__alloc.h 1.1 - lang/php56/patches/patch-Zend_zend__execute__API.c 1.1 - lang/php56/patches/patch-Zend_zend__globals.h 1.1 - lang/php56/patches/patch-Zend_zend__llist.c 1.1 - lang/php56/patches/patch-Zend_zend__multiply.h 1.2 - lang/php56/patches/patch-Zend_zend__vm__execute.h 1.1 - lang/php56/patches/patch-Zend_zend__vm__execute.skl 1.1 - lang/php56/patches/patch-ext_session_session.c 1.1 - lang/php56/patches/patch-ext_standard_basic__functions.c 1.3 - lang/php56/patches/patch-ext_standard_basic__functions.h 1.1 - lang/php56/patches/patch-ext_standard_php__incomplete__class.h 1.1 - lang/php56/patches/patch-ext_standard_var.c 1.1 - lang/php56/patches/patch-ext_standard_var__unserializer.c 1.1 - lang/php56/patches/patch-ext_standard_var__unserializer.re 1.1 - lang/php56/patches/patch-main_SAPI.c 1.1 - lang/php56/patches/patch-main_main.c 1.1 - lang/php56/patches/patch-main_php__variables.c 1.1 - lang/php56/patches/patch-main_rfc1867.c 1.1 - lang/php56/patches/patch-sapi_embed_php__embed.c 1.1 --- Module Name: pkgsrc Committed By: taca Date: Tue Oct 27 15:30:49 UTC 2026 Modified Files: pkgsrc/lang/php56: Makefile distinfo pkgsrc/lang/php56/patches: patch-Zend_zend__multiply.h Added Files: pkgsrc/lang/php56/patches: patch-Zend_zend.c patch-Zend_zend__alloc.c patch-Zend_zend__alloc.h patch-Zend_zend__execute__API.c patch-Zend_zend__globals.h patch-Zend_zend__llist.c patch-Zend_zend__vm__execute.h patch-Zend_zend__vm__execute.skl patch-ext_session_session.c patch-ext_standard_basic__functions.h patch-ext_standard_php__incomplete__class.h patch-ext_standard_var.c patch-ext_standard_var__unserializer.c patch-ext_standard_var__unserializer.re patch-main_SAPI.c patch-main_main.c patch-main_php__variables.c patch-main_rfc1867.c Log Message: lang/php56: fix CVE-2026-109618 and CVE-2026-109619 Apply patch for CVE-2026-109618 and CVE-2026-109619. Thanks to sborrill@@ providing patch information. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: taca Date: Wed Oct 28 14:40:58 UTC 2026 Modified Files: pkgsrc/lang/php56: distinfo pkgsrc/lang/php56/patches: patch-ext_standard_basic__functions.c Added Files: pkgsrc/lang/php56/patches: patch-sapi_embed_php__embed.c Log Message: lang/php56: build fix Add missing parts from previous patches. @ text @a0 40 $NetBSD: patch-Zend_zend__alloc.h,v 1.1 2026/10/27 15:30:48 taca Exp $ https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch --- Zend/zend_alloc.h.orig 2019-01-09 09:54:13.000000000 +0000 +++ Zend/zend_alloc.h @@@@ -50,6 +50,25 @@@@ typedef struct _zend_leak_info { uint orig_lineno; } zend_leak_info; +/* Delayed out of memory handling (CVE-2026-109618). + * + * Exceeding memory_limit no longer bails out (longjmp) from inside the + * allocator, where the caller may have left request memory in an + * inconsistent state. Instead the allocation succeeds, the error is recorded + * and raised as a fatal error at the next safe point (between two opcodes, or + * once request startup has finished parsing the request). Memory usage beyond + * a hard limit (twice memory_limit, or memory_limit + 1G for limits above 1G) + * terminates the process immediately with _exit(). */ +typedef enum _zend_oom_state { + ZEND_OOM_STATE_NONE = 0, + ZEND_OOM_STATE_PENDING, + ZEND_OOM_STATE_HANDLING, + ZEND_OOM_STATE_HANDLED +} zend_oom_state; + +#define ZEND_HAS_OOM() (UNEXPECTED(EG(delayed_oom) != ZEND_OOM_STATE_NONE)) +#define ZEND_OOM_PENDING() (UNEXPECTED(EG(delayed_oom) == ZEND_OOM_STATE_PENDING)) + BEGIN_EXTERN_C() ZEND_API char *zend_strndup(const char *s, unsigned int length) ZEND_ATTRIBUTE_MALLOC; @@@@ -142,6 +161,7 @@@@ inline static void * __zend_realloc(void #define safe_estrndup(ptr, len) ((ptr)?(estrndup((ptr), (len))):STR_EMPTY_ALLOC()) ZEND_API int zend_set_memory_limit(size_t memory_limit); +ZEND_API void zend_handle_delayed_oom(TSRMLS_D); ZEND_API void start_memory_manager(TSRMLS_D); ZEND_API void shutdown_memory_manager(int silent, int full_shutdown TSRMLS_DC); @