head 1.1; access; symbols pkgsrc-2026Q3:1.1.0.2; locks; strict; comment @ * @; 1.1 date 2026.10.27.15.30.48; author taca; state Exp; branches 1.1.2.1; next ; commitid KjO33YVcJEfD481H; 1.1.2.1 date 2026.10.27.15.30.48; author maya; state dead; branches; next 1.1.2.2; commitid p9DWww5rhvcuiL2H; 1.1.2.2 date 2026.11.09.08.24.26; author maya; state Exp; branches; next ; commitid p9DWww5rhvcuiL2H; desc @@ 1.1 log @lang/php56: fix CVE-2026-109618 and CVE-2026-109619 Apply patch for CVE-2026-109618 and CVE-2026-109619. Thanks to sborrill@@ providing patch information. Bump PKGREVISION. @ text @$NetBSD$ https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch --- Zend/zend_execute_API.c.orig 2019-01-09 09:54:13.000000000 +0000 +++ Zend/zend_execute_API.c @@@@ -330,6 +330,23 @@@@ void shutdown_executor(TSRMLS_D) /* {{{ zend_shutdown_fpu(TSRMLS_C); + /* A bailout may have skipped the resets above. zend_error() may use these + * before the next init_executor(), e.g. for INI warnings or upload + * progress during request startup (CVE-2026-109619). */ + EG(user_error_handler) = NULL; + EG(user_exception_handler) = NULL; + EG(error_handling) = EH_NORMAL; + EG(exception_class) = NULL; + EG(exception) = NULL; + EG(prev_exception) = NULL; + EG(current_execute_data) = NULL; + EG(active_symbol_table) = NULL; + EG(active_op_array) = NULL; + EG(opline_ptr) = NULL; + EG(in_execution) = 0; + EG(in_autoload) = NULL; + EG(autoload_func) = NULL; + EG(active) = 0; } /* }}} */ @@@@ -639,6 +656,10 @@@@ int zend_call_function(zend_fcall_info * return FAILURE; /* executor is already inactive */ } + if (ZEND_OOM_PENDING()) { + zend_handle_delayed_oom(TSRMLS_C); + } + if (EG(exception)) { return FAILURE; /* we would result in an instable executor otherwise */ } @ 1.1.2.1 log @file patch-Zend_zend__execute__API.c was added on branch pkgsrc-2026Q3 on 2026-11-09 08:24:26 +0000 @ text @d1 41 @ 1.1.2.2 log @Pullup ticket #7341 - requested by taca lang/php56: Security fix Revisions pulled up: - lang/php56/Makefile 1.50 - lang/php56/distinfo 1.68-1.69 - lang/php56/patches/patch-Zend_zend.c 1.1 - lang/php56/patches/patch-Zend_zend__alloc.c 1.1 - lang/php56/patches/patch-Zend_zend__alloc.h 1.1 - lang/php56/patches/patch-Zend_zend__execute__API.c 1.1 - lang/php56/patches/patch-Zend_zend__globals.h 1.1 - lang/php56/patches/patch-Zend_zend__llist.c 1.1 - lang/php56/patches/patch-Zend_zend__multiply.h 1.2 - lang/php56/patches/patch-Zend_zend__vm__execute.h 1.1 - lang/php56/patches/patch-Zend_zend__vm__execute.skl 1.1 - lang/php56/patches/patch-ext_session_session.c 1.1 - lang/php56/patches/patch-ext_standard_basic__functions.c 1.3 - lang/php56/patches/patch-ext_standard_basic__functions.h 1.1 - lang/php56/patches/patch-ext_standard_php__incomplete__class.h 1.1 - lang/php56/patches/patch-ext_standard_var.c 1.1 - lang/php56/patches/patch-ext_standard_var__unserializer.c 1.1 - lang/php56/patches/patch-ext_standard_var__unserializer.re 1.1 - lang/php56/patches/patch-main_SAPI.c 1.1 - lang/php56/patches/patch-main_main.c 1.1 - lang/php56/patches/patch-main_php__variables.c 1.1 - lang/php56/patches/patch-main_rfc1867.c 1.1 - lang/php56/patches/patch-sapi_embed_php__embed.c 1.1 --- Module Name: pkgsrc Committed By: taca Date: Tue Oct 27 15:30:49 UTC 2026 Modified Files: pkgsrc/lang/php56: Makefile distinfo pkgsrc/lang/php56/patches: patch-Zend_zend__multiply.h Added Files: pkgsrc/lang/php56/patches: patch-Zend_zend.c patch-Zend_zend__alloc.c patch-Zend_zend__alloc.h patch-Zend_zend__execute__API.c patch-Zend_zend__globals.h patch-Zend_zend__llist.c patch-Zend_zend__vm__execute.h patch-Zend_zend__vm__execute.skl patch-ext_session_session.c patch-ext_standard_basic__functions.h patch-ext_standard_php__incomplete__class.h patch-ext_standard_var.c patch-ext_standard_var__unserializer.c patch-ext_standard_var__unserializer.re patch-main_SAPI.c patch-main_main.c patch-main_php__variables.c patch-main_rfc1867.c Log Message: lang/php56: fix CVE-2026-109618 and CVE-2026-109619 Apply patch for CVE-2026-109618 and CVE-2026-109619. Thanks to sborrill@@ providing patch information. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: taca Date: Wed Oct 28 14:40:58 UTC 2026 Modified Files: pkgsrc/lang/php56: distinfo pkgsrc/lang/php56/patches: patch-ext_standard_basic__functions.c Added Files: pkgsrc/lang/php56/patches: patch-sapi_embed_php__embed.c Log Message: lang/php56: build fix Add missing parts from previous patches. @ text @a0 41 $NetBSD: patch-Zend_zend__execute__API.c,v 1.1 2026/10/27 15:30:48 taca Exp $ https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch --- Zend/zend_execute_API.c.orig 2019-01-09 09:54:13.000000000 +0000 +++ Zend/zend_execute_API.c @@@@ -330,6 +330,23 @@@@ void shutdown_executor(TSRMLS_D) /* {{{ zend_shutdown_fpu(TSRMLS_C); + /* A bailout may have skipped the resets above. zend_error() may use these + * before the next init_executor(), e.g. for INI warnings or upload + * progress during request startup (CVE-2026-109619). */ + EG(user_error_handler) = NULL; + EG(user_exception_handler) = NULL; + EG(error_handling) = EH_NORMAL; + EG(exception_class) = NULL; + EG(exception) = NULL; + EG(prev_exception) = NULL; + EG(current_execute_data) = NULL; + EG(active_symbol_table) = NULL; + EG(active_op_array) = NULL; + EG(opline_ptr) = NULL; + EG(in_execution) = 0; + EG(in_autoload) = NULL; + EG(autoload_func) = NULL; + EG(active) = 0; } /* }}} */ @@@@ -639,6 +656,10 @@@@ int zend_call_function(zend_fcall_info * return FAILURE; /* executor is already inactive */ } + if (ZEND_OOM_PENDING()) { + zend_handle_delayed_oom(TSRMLS_C); + } + if (EG(exception)) { return FAILURE; /* we would result in an instable executor otherwise */ } @