head 1.1; access; symbols pkgsrc-2026Q3:1.1.0.2; locks; strict; comment @ * @; 1.1 date 2026.10.27.15.30.49; author taca; state Exp; branches 1.1.2.1; next ; commitid KjO33YVcJEfD481H; 1.1.2.1 date 2026.10.27.15.30.49; author maya; state dead; branches; next 1.1.2.2; commitid p9DWww5rhvcuiL2H; 1.1.2.2 date 2026.11.09.08.24.26; author maya; state Exp; branches; next ; commitid p9DWww5rhvcuiL2H; desc @@ 1.1 log @lang/php56: fix CVE-2026-109618 and CVE-2026-109619 Apply patch for CVE-2026-109618 and CVE-2026-109619. Thanks to sborrill@@ providing patch information. Bump PKGREVISION. @ text @$NetBSD$ https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch --- ext/standard/basic_functions.h.orig 2019-01-09 09:54:13.000000000 +0000 +++ ext/standard/basic_functions.h @@@@ -230,6 +230,13 @@@@ typedef struct _php_basic_globals { #endif int umask; + + /* var.c: while non-zero, php_var_unserialize() represents every object + * as __PHP_Incomplete_Class without resolving its class, and + * php_var_serialize() writes such objects back unchanged. Used by the + * session upload progress handler, which runs before RINIT. Kept last so + * that the offsets of the fields above do not change. */ + unsigned incomplete_classes_only; } php_basic_globals; #ifdef ZTS @@@@ -261,6 +268,7 @@@@ PHPAPI extern zend_bool register_user_sh PHPAPI extern zend_bool remove_user_shutdown_function(char *function_name, size_t function_len TSRMLS_DC); PHPAPI extern zend_bool append_user_shutdown_function(php_shutdown_function_entry shutdown_function_entry TSRMLS_DC); +PHPAPI void php_basic_early_rinit(TSRMLS_D); PHPAPI void php_call_shutdown_functions(TSRMLS_D); PHPAPI void php_free_shutdown_functions(TSRMLS_D); @ 1.1.2.1 log @file patch-ext_standard_basic__functions.h was added on branch pkgsrc-2026Q3 on 2026-11-09 08:24:26 +0000 @ text @d1 28 @ 1.1.2.2 log @Pullup ticket #7341 - requested by taca lang/php56: Security fix Revisions pulled up: - lang/php56/Makefile 1.50 - lang/php56/distinfo 1.68-1.69 - lang/php56/patches/patch-Zend_zend.c 1.1 - lang/php56/patches/patch-Zend_zend__alloc.c 1.1 - lang/php56/patches/patch-Zend_zend__alloc.h 1.1 - lang/php56/patches/patch-Zend_zend__execute__API.c 1.1 - lang/php56/patches/patch-Zend_zend__globals.h 1.1 - lang/php56/patches/patch-Zend_zend__llist.c 1.1 - lang/php56/patches/patch-Zend_zend__multiply.h 1.2 - lang/php56/patches/patch-Zend_zend__vm__execute.h 1.1 - lang/php56/patches/patch-Zend_zend__vm__execute.skl 1.1 - lang/php56/patches/patch-ext_session_session.c 1.1 - lang/php56/patches/patch-ext_standard_basic__functions.c 1.3 - lang/php56/patches/patch-ext_standard_basic__functions.h 1.1 - lang/php56/patches/patch-ext_standard_php__incomplete__class.h 1.1 - lang/php56/patches/patch-ext_standard_var.c 1.1 - lang/php56/patches/patch-ext_standard_var__unserializer.c 1.1 - lang/php56/patches/patch-ext_standard_var__unserializer.re 1.1 - lang/php56/patches/patch-main_SAPI.c 1.1 - lang/php56/patches/patch-main_main.c 1.1 - lang/php56/patches/patch-main_php__variables.c 1.1 - lang/php56/patches/patch-main_rfc1867.c 1.1 - lang/php56/patches/patch-sapi_embed_php__embed.c 1.1 --- Module Name: pkgsrc Committed By: taca Date: Tue Oct 27 15:30:49 UTC 2026 Modified Files: pkgsrc/lang/php56: Makefile distinfo pkgsrc/lang/php56/patches: patch-Zend_zend__multiply.h Added Files: pkgsrc/lang/php56/patches: patch-Zend_zend.c patch-Zend_zend__alloc.c patch-Zend_zend__alloc.h patch-Zend_zend__execute__API.c patch-Zend_zend__globals.h patch-Zend_zend__llist.c patch-Zend_zend__vm__execute.h patch-Zend_zend__vm__execute.skl patch-ext_session_session.c patch-ext_standard_basic__functions.h patch-ext_standard_php__incomplete__class.h patch-ext_standard_var.c patch-ext_standard_var__unserializer.c patch-ext_standard_var__unserializer.re patch-main_SAPI.c patch-main_main.c patch-main_php__variables.c patch-main_rfc1867.c Log Message: lang/php56: fix CVE-2026-109618 and CVE-2026-109619 Apply patch for CVE-2026-109618 and CVE-2026-109619. Thanks to sborrill@@ providing patch information. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: taca Date: Wed Oct 28 14:40:58 UTC 2026 Modified Files: pkgsrc/lang/php56: distinfo pkgsrc/lang/php56/patches: patch-ext_standard_basic__functions.c Added Files: pkgsrc/lang/php56/patches: patch-sapi_embed_php__embed.c Log Message: lang/php56: build fix Add missing parts from previous patches. @ text @a0 28 $NetBSD: patch-ext_standard_basic__functions.h,v 1.1 2026/10/27 15:30:49 taca Exp $ https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch --- ext/standard/basic_functions.h.orig 2019-01-09 09:54:13.000000000 +0000 +++ ext/standard/basic_functions.h @@@@ -230,6 +230,13 @@@@ typedef struct _php_basic_globals { #endif int umask; + + /* var.c: while non-zero, php_var_unserialize() represents every object + * as __PHP_Incomplete_Class without resolving its class, and + * php_var_serialize() writes such objects back unchanged. Used by the + * session upload progress handler, which runs before RINIT. Kept last so + * that the offsets of the fields above do not change. */ + unsigned incomplete_classes_only; } php_basic_globals; #ifdef ZTS @@@@ -261,6 +268,7 @@@@ PHPAPI extern zend_bool register_user_sh PHPAPI extern zend_bool remove_user_shutdown_function(char *function_name, size_t function_len TSRMLS_DC); PHPAPI extern zend_bool append_user_shutdown_function(php_shutdown_function_entry shutdown_function_entry TSRMLS_DC); +PHPAPI void php_basic_early_rinit(TSRMLS_D); PHPAPI void php_call_shutdown_functions(TSRMLS_D); PHPAPI void php_free_shutdown_functions(TSRMLS_D); @