head 1.1; access; symbols pkgsrc-2026Q3:1.1.0.2; locks; strict; comment @ * @; 1.1 date 2026.10.27.15.30.49; author taca; state Exp; branches 1.1.2.1; next ; commitid KjO33YVcJEfD481H; 1.1.2.1 date 2026.10.27.15.30.49; author maya; state dead; branches; next 1.1.2.2; commitid p9DWww5rhvcuiL2H; 1.1.2.2 date 2026.11.09.08.24.26; author maya; state Exp; branches; next ; commitid p9DWww5rhvcuiL2H; desc @@ 1.1 log @lang/php56: fix CVE-2026-109618 and CVE-2026-109619 Apply patch for CVE-2026-109618 and CVE-2026-109619. Thanks to sborrill@@ providing patch information. Bump PKGREVISION. @ text @$NetBSD$ https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch --- ext/session/session.c.orig 2019-01-09 09:54:13.000000000 +0000 +++ ext/session/session.c @@@@ -2642,6 +2642,9 @@@@ static void php_session_rfc1867_update(p progress->next_update = Z_LVAL_P(progress->post_bytes_processed) + progress->update_step; } + /* Runs before RINIT: no code may run on behalf of the session data, see + * BG(incomplete_classes_only) (CVE-2026-109619) */ + BG(incomplete_classes_only)++; php_session_initialize(TSRMLS_C); PS(session_status) = php_session_active; IF_SESSION_VARS() { @@@@ -2649,16 +2652,19 @@@@ static void php_session_rfc1867_update(p ZEND_SET_SYMBOL_WITH_LENGTH(Z_ARRVAL_P(PS(http_session_vars)), progress->key.c, progress->key.len+1, progress->data, 2, 0); } php_session_flush(TSRMLS_C); + BG(incomplete_classes_only)--; } /* }}} */ static void php_session_rfc1867_cleanup(php_session_rfc1867_progress *progress TSRMLS_DC) /* {{{ */ { + BG(incomplete_classes_only)++; php_session_initialize(TSRMLS_C); PS(session_status) = php_session_active; IF_SESSION_VARS() { zend_hash_del(Z_ARRVAL_P(PS(http_session_vars)), progress->key.c, progress->key.len+1); } php_session_flush(TSRMLS_C); + BG(incomplete_classes_only)--; } /* }}} */ static int php_session_rfc1867_callback(unsigned int event, void *event_data, void **extra TSRMLS_DC) /* {{{ */ @@@@ -2678,6 +2684,11 @@@@ static int php_session_rfc1867_callback( switch(event) { case MULTIPART_EVENT_START: { multipart_event_start *data = (multipart_event_start *) event_data; + + /* This runs before RINIT: a previous request interrupted by a fatal + * error may have left these pointing to freed memory */ + php_rinit_session_globals(TSRMLS_C); + progress = ecalloc(1, sizeof(php_session_rfc1867_progress)); progress->content_length = data->content_length; progress->sname_len = strlen(PS(session_name)); @@@@ -2825,6 +2836,10 @@@@ static int php_session_rfc1867_callback( php_session_rfc1867_update(progress, 1 TSRMLS_CC); } php_rshutdown_session_globals(TSRMLS_C); + + /* $_SESSION was populated with unresolved classes, see + * php_session_rfc1867_update() */ + zend_delete_global_variable("_SESSION", sizeof("_SESSION")-1 TSRMLS_CC); } if (progress->data) { @ 1.1.2.1 log @file patch-ext_session_session.c was added on branch pkgsrc-2026Q3 on 2026-11-09 08:24:26 +0000 @ text @d1 59 @ 1.1.2.2 log @Pullup ticket #7341 - requested by taca lang/php56: Security fix Revisions pulled up: - lang/php56/Makefile 1.50 - lang/php56/distinfo 1.68-1.69 - lang/php56/patches/patch-Zend_zend.c 1.1 - lang/php56/patches/patch-Zend_zend__alloc.c 1.1 - lang/php56/patches/patch-Zend_zend__alloc.h 1.1 - lang/php56/patches/patch-Zend_zend__execute__API.c 1.1 - lang/php56/patches/patch-Zend_zend__globals.h 1.1 - lang/php56/patches/patch-Zend_zend__llist.c 1.1 - lang/php56/patches/patch-Zend_zend__multiply.h 1.2 - lang/php56/patches/patch-Zend_zend__vm__execute.h 1.1 - lang/php56/patches/patch-Zend_zend__vm__execute.skl 1.1 - lang/php56/patches/patch-ext_session_session.c 1.1 - lang/php56/patches/patch-ext_standard_basic__functions.c 1.3 - lang/php56/patches/patch-ext_standard_basic__functions.h 1.1 - lang/php56/patches/patch-ext_standard_php__incomplete__class.h 1.1 - lang/php56/patches/patch-ext_standard_var.c 1.1 - lang/php56/patches/patch-ext_standard_var__unserializer.c 1.1 - lang/php56/patches/patch-ext_standard_var__unserializer.re 1.1 - lang/php56/patches/patch-main_SAPI.c 1.1 - lang/php56/patches/patch-main_main.c 1.1 - lang/php56/patches/patch-main_php__variables.c 1.1 - lang/php56/patches/patch-main_rfc1867.c 1.1 - lang/php56/patches/patch-sapi_embed_php__embed.c 1.1 --- Module Name: pkgsrc Committed By: taca Date: Tue Oct 27 15:30:49 UTC 2026 Modified Files: pkgsrc/lang/php56: Makefile distinfo pkgsrc/lang/php56/patches: patch-Zend_zend__multiply.h Added Files: pkgsrc/lang/php56/patches: patch-Zend_zend.c patch-Zend_zend__alloc.c patch-Zend_zend__alloc.h patch-Zend_zend__execute__API.c patch-Zend_zend__globals.h patch-Zend_zend__llist.c patch-Zend_zend__vm__execute.h patch-Zend_zend__vm__execute.skl patch-ext_session_session.c patch-ext_standard_basic__functions.h patch-ext_standard_php__incomplete__class.h patch-ext_standard_var.c patch-ext_standard_var__unserializer.c patch-ext_standard_var__unserializer.re patch-main_SAPI.c patch-main_main.c patch-main_php__variables.c patch-main_rfc1867.c Log Message: lang/php56: fix CVE-2026-109618 and CVE-2026-109619 Apply patch for CVE-2026-109618 and CVE-2026-109619. Thanks to sborrill@@ providing patch information. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: taca Date: Wed Oct 28 14:40:58 UTC 2026 Modified Files: pkgsrc/lang/php56: distinfo pkgsrc/lang/php56/patches: patch-ext_standard_basic__functions.c Added Files: pkgsrc/lang/php56/patches: patch-sapi_embed_php__embed.c Log Message: lang/php56: build fix Add missing parts from previous patches. @ text @a0 59 $NetBSD: patch-ext_session_session.c,v 1.1 2026/10/27 15:30:49 taca Exp $ https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch --- ext/session/session.c.orig 2019-01-09 09:54:13.000000000 +0000 +++ ext/session/session.c @@@@ -2642,6 +2642,9 @@@@ static void php_session_rfc1867_update(p progress->next_update = Z_LVAL_P(progress->post_bytes_processed) + progress->update_step; } + /* Runs before RINIT: no code may run on behalf of the session data, see + * BG(incomplete_classes_only) (CVE-2026-109619) */ + BG(incomplete_classes_only)++; php_session_initialize(TSRMLS_C); PS(session_status) = php_session_active; IF_SESSION_VARS() { @@@@ -2649,16 +2652,19 @@@@ static void php_session_rfc1867_update(p ZEND_SET_SYMBOL_WITH_LENGTH(Z_ARRVAL_P(PS(http_session_vars)), progress->key.c, progress->key.len+1, progress->data, 2, 0); } php_session_flush(TSRMLS_C); + BG(incomplete_classes_only)--; } /* }}} */ static void php_session_rfc1867_cleanup(php_session_rfc1867_progress *progress TSRMLS_DC) /* {{{ */ { + BG(incomplete_classes_only)++; php_session_initialize(TSRMLS_C); PS(session_status) = php_session_active; IF_SESSION_VARS() { zend_hash_del(Z_ARRVAL_P(PS(http_session_vars)), progress->key.c, progress->key.len+1); } php_session_flush(TSRMLS_C); + BG(incomplete_classes_only)--; } /* }}} */ static int php_session_rfc1867_callback(unsigned int event, void *event_data, void **extra TSRMLS_DC) /* {{{ */ @@@@ -2678,6 +2684,11 @@@@ static int php_session_rfc1867_callback( switch(event) { case MULTIPART_EVENT_START: { multipart_event_start *data = (multipart_event_start *) event_data; + + /* This runs before RINIT: a previous request interrupted by a fatal + * error may have left these pointing to freed memory */ + php_rinit_session_globals(TSRMLS_C); + progress = ecalloc(1, sizeof(php_session_rfc1867_progress)); progress->content_length = data->content_length; progress->sname_len = strlen(PS(session_name)); @@@@ -2825,6 +2836,10 @@@@ static int php_session_rfc1867_callback( php_session_rfc1867_update(progress, 1 TSRMLS_CC); } php_rshutdown_session_globals(TSRMLS_C); + + /* $_SESSION was populated with unresolved classes, see + * php_session_rfc1867_update() */ + zend_delete_global_variable("_SESSION", sizeof("_SESSION")-1 TSRMLS_CC); } if (progress->data) { @