head 1.1; access; symbols pkgsrc-2026Q3:1.1.0.2; locks; strict; comment @ * @; 1.1 date 2026.10.27.15.30.49; author taca; state Exp; branches 1.1.2.1; next ; commitid KjO33YVcJEfD481H; 1.1.2.1 date 2026.10.27.15.30.49; author maya; state dead; branches; next 1.1.2.2; commitid p9DWww5rhvcuiL2H; 1.1.2.2 date 2026.11.09.08.24.26; author maya; state Exp; branches; next ; commitid p9DWww5rhvcuiL2H; desc @@ 1.1 log @lang/php56: fix CVE-2026-109618 and CVE-2026-109619 Apply patch for CVE-2026-109618 and CVE-2026-109619. Thanks to sborrill@@ providing patch information. Bump PKGREVISION. @ text @$NetBSD$ https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch --- ext/standard/var.c.orig 2019-01-09 09:54:13.000000000 +0000 +++ ext/standard/var.c @@@@ -768,6 +768,30 @@@@ static void php_var_serialize_intern(sma ce = Z_OBJCE_P(struc); } + if (ce && ce == PHP_IC_ENTRY && UNEXPECTED(BG(incomplete_classes_only))) { + /* C: value kept by php_var_unserialize(), see BG(incomplete_classes_only) */ + zval **payload; + char *class_name; + zend_uint name_len; + + if (zend_hash_find(Z_OBJPROP_P(struc), MAGIC_MEMBER_SERIALIZED, sizeof(MAGIC_MEMBER_SERIALIZED), (void **) &payload) == SUCCESS + && Z_TYPE_PP(payload) == IS_STRING + && (class_name = php_lookup_class_name(struc, &name_len)) != NULL) { + smart_str_appendl(buf, "C:", 2); + smart_str_append_long(buf, (int)name_len); + smart_str_appendl(buf, ":\"", 2); + smart_str_appendl(buf, class_name, name_len); + smart_str_appendl(buf, "\":", 2); + + smart_str_append_long(buf, (int)Z_STRLEN_PP(payload)); + smart_str_appendl(buf, ":{", 2); + smart_str_appendl(buf, Z_STRVAL_PP(payload), Z_STRLEN_PP(payload)); + smart_str_appendc(buf, '}'); + efree(class_name); + return; + } + } + if (ce && ce->serialize != NULL) { /* has custom handler */ unsigned char *serialized_data = NULL; @ 1.1.2.1 log @file patch-ext_standard_var.c was added on branch pkgsrc-2026Q3 on 2026-11-09 08:24:26 +0000 @ text @d1 37 @ 1.1.2.2 log @Pullup ticket #7341 - requested by taca lang/php56: Security fix Revisions pulled up: - lang/php56/Makefile 1.50 - lang/php56/distinfo 1.68-1.69 - lang/php56/patches/patch-Zend_zend.c 1.1 - lang/php56/patches/patch-Zend_zend__alloc.c 1.1 - lang/php56/patches/patch-Zend_zend__alloc.h 1.1 - lang/php56/patches/patch-Zend_zend__execute__API.c 1.1 - lang/php56/patches/patch-Zend_zend__globals.h 1.1 - lang/php56/patches/patch-Zend_zend__llist.c 1.1 - lang/php56/patches/patch-Zend_zend__multiply.h 1.2 - lang/php56/patches/patch-Zend_zend__vm__execute.h 1.1 - lang/php56/patches/patch-Zend_zend__vm__execute.skl 1.1 - lang/php56/patches/patch-ext_session_session.c 1.1 - lang/php56/patches/patch-ext_standard_basic__functions.c 1.3 - lang/php56/patches/patch-ext_standard_basic__functions.h 1.1 - lang/php56/patches/patch-ext_standard_php__incomplete__class.h 1.1 - lang/php56/patches/patch-ext_standard_var.c 1.1 - lang/php56/patches/patch-ext_standard_var__unserializer.c 1.1 - lang/php56/patches/patch-ext_standard_var__unserializer.re 1.1 - lang/php56/patches/patch-main_SAPI.c 1.1 - lang/php56/patches/patch-main_main.c 1.1 - lang/php56/patches/patch-main_php__variables.c 1.1 - lang/php56/patches/patch-main_rfc1867.c 1.1 - lang/php56/patches/patch-sapi_embed_php__embed.c 1.1 --- Module Name: pkgsrc Committed By: taca Date: Tue Oct 27 15:30:49 UTC 2026 Modified Files: pkgsrc/lang/php56: Makefile distinfo pkgsrc/lang/php56/patches: patch-Zend_zend__multiply.h Added Files: pkgsrc/lang/php56/patches: patch-Zend_zend.c patch-Zend_zend__alloc.c patch-Zend_zend__alloc.h patch-Zend_zend__execute__API.c patch-Zend_zend__globals.h patch-Zend_zend__llist.c patch-Zend_zend__vm__execute.h patch-Zend_zend__vm__execute.skl patch-ext_session_session.c patch-ext_standard_basic__functions.h patch-ext_standard_php__incomplete__class.h patch-ext_standard_var.c patch-ext_standard_var__unserializer.c patch-ext_standard_var__unserializer.re patch-main_SAPI.c patch-main_main.c patch-main_php__variables.c patch-main_rfc1867.c Log Message: lang/php56: fix CVE-2026-109618 and CVE-2026-109619 Apply patch for CVE-2026-109618 and CVE-2026-109619. Thanks to sborrill@@ providing patch information. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: taca Date: Wed Oct 28 14:40:58 UTC 2026 Modified Files: pkgsrc/lang/php56: distinfo pkgsrc/lang/php56/patches: patch-ext_standard_basic__functions.c Added Files: pkgsrc/lang/php56/patches: patch-sapi_embed_php__embed.c Log Message: lang/php56: build fix Add missing parts from previous patches. @ text @a0 37 $NetBSD: patch-ext_standard_var.c,v 1.1 2026/10/27 15:30:49 taca Exp $ https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch --- ext/standard/var.c.orig 2019-01-09 09:54:13.000000000 +0000 +++ ext/standard/var.c @@@@ -768,6 +768,30 @@@@ static void php_var_serialize_intern(sma ce = Z_OBJCE_P(struc); } + if (ce && ce == PHP_IC_ENTRY && UNEXPECTED(BG(incomplete_classes_only))) { + /* C: value kept by php_var_unserialize(), see BG(incomplete_classes_only) */ + zval **payload; + char *class_name; + zend_uint name_len; + + if (zend_hash_find(Z_OBJPROP_P(struc), MAGIC_MEMBER_SERIALIZED, sizeof(MAGIC_MEMBER_SERIALIZED), (void **) &payload) == SUCCESS + && Z_TYPE_PP(payload) == IS_STRING + && (class_name = php_lookup_class_name(struc, &name_len)) != NULL) { + smart_str_appendl(buf, "C:", 2); + smart_str_append_long(buf, (int)name_len); + smart_str_appendl(buf, ":\"", 2); + smart_str_appendl(buf, class_name, name_len); + smart_str_appendl(buf, "\":", 2); + + smart_str_append_long(buf, (int)Z_STRLEN_PP(payload)); + smart_str_appendl(buf, ":{", 2); + smart_str_appendl(buf, Z_STRVAL_PP(payload), Z_STRLEN_PP(payload)); + smart_str_appendc(buf, '}'); + efree(class_name); + return; + } + } + if (ce && ce->serialize != NULL) { /* has custom handler */ unsigned char *serialized_data = NULL; @