head 1.1; access; symbols pkgsrc-2026Q3:1.1.0.2; locks; strict; comment @# @; 1.1 date 2026.10.27.15.30.49; author taca; state Exp; branches 1.1.2.1; next ; commitid KjO33YVcJEfD481H; 1.1.2.1 date 2026.10.27.15.30.49; author maya; state dead; branches; next 1.1.2.2; commitid p9DWww5rhvcuiL2H; 1.1.2.2 date 2026.11.09.08.24.26; author maya; state Exp; branches; next ; commitid p9DWww5rhvcuiL2H; desc @@ 1.1 log @lang/php56: fix CVE-2026-109618 and CVE-2026-109619 Apply patch for CVE-2026-109618 and CVE-2026-109619. Thanks to sborrill@@ providing patch information. Bump PKGREVISION. @ text @$NetBSD$ https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch --- ext/standard/var_unserializer.re.orig 2019-01-09 09:54:13.000000000 +0000 +++ ext/standard/var_unserializer.re @@@@ -372,6 +372,16 @@@@ static inline int process_nested_data(UN return 0; } + /* The members that incomplete_classes_only mode writes itself cannot be + * told apart from that bookkeeping: reject them */ + if (objprops && UNEXPECTED(BG(incomplete_classes_only)) && Z_TYPE_P(key) == IS_STRING + && ((Z_STRLEN_P(key) == sizeof(MAGIC_MEMBER) - 1 && !memcmp(Z_STRVAL_P(key), MAGIC_MEMBER, sizeof(MAGIC_MEMBER) - 1)) + || (Z_STRLEN_P(key) == sizeof(MAGIC_MEMBER_SERIALIZED) - 1 && !memcmp(Z_STRVAL_P(key), MAGIC_MEMBER_SERIALIZED, sizeof(MAGIC_MEMBER_SERIALIZED) - 1)))) { + var_push_dtor_no_addref(var_hash, &key); + var_push_dtor_no_addref(var_hash, &data); + return 0; + } + if (!objprops) { switch (Z_TYPE_P(key)) { case IS_LONG: @@@@ -418,7 +428,7 @@@@ static inline int finish_nested_data(UNS return 1; } -static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce) +static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce, int keep_payload) { long datalen; @@@@ -431,7 +441,16 @@@@ static inline int object_custom(UNSERIAL return 0; } - if (ce->unserialize == NULL) { + if (keep_payload) { + /* The class was not resolved (see BG(incomplete_classes_only)): keep + * the payload verbatim, so that the object serializes back unchanged */ + zval *payload; + + object_init_ex(*rval, ce); + MAKE_STD_ZVAL(payload); + ZVAL_STRINGL(payload, (char *) *p, datalen, 1); + zend_hash_update(Z_OBJPROP_PP(rval), MAGIC_MEMBER_SERIALIZED, sizeof(MAGIC_MEMBER_SERIALIZED), &payload, sizeof(payload), NULL); + } else if (ce->unserialize == NULL) { zend_error(E_WARNING, "Class %s has no unserializer", ce->name); object_init_ex(*rval, ce); } else if (ce->unserialize(rval, ce, (const unsigned char*)*p, datalen, (zend_unserialize_data *)var_hash TSRMLS_CC) != SUCCESS) { @@@@ -796,6 +815,14 @@@@ object ":" uiv ":" ["] { class_name = estrndup(class_name, len); do { + if (BG(incomplete_classes_only)) { + /* Do not look the class up at all, so that no code (autoloader, + * unserialize_callback_func, __wakeup(), unserialize()) can run */ + incomplete_class = 1; + ce = PHP_IC_ENTRY; + break; + } + /* Try to find class directly */ BG(serialize_lock)++; if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) { @@@@ -875,7 +902,7 @@@@ object ":" uiv ":" ["] { if (custom_object) { int ret; - ret = object_custom(UNSERIALIZE_PASSTHRU, ce); + ret = object_custom(UNSERIALIZE_PASSTHRU, ce, incomplete_class && BG(incomplete_classes_only)); if (ret && incomplete_class) { php_store_class_name(*rval, class_name, len2); @ 1.1.2.1 log @file patch-ext_standard_var__unserializer.re was added on branch pkgsrc-2026Q3 on 2026-11-09 08:24:26 +0000 @ text @d1 74 @ 1.1.2.2 log @Pullup ticket #7341 - requested by taca lang/php56: Security fix Revisions pulled up: - lang/php56/Makefile 1.50 - lang/php56/distinfo 1.68-1.69 - lang/php56/patches/patch-Zend_zend.c 1.1 - lang/php56/patches/patch-Zend_zend__alloc.c 1.1 - lang/php56/patches/patch-Zend_zend__alloc.h 1.1 - lang/php56/patches/patch-Zend_zend__execute__API.c 1.1 - lang/php56/patches/patch-Zend_zend__globals.h 1.1 - lang/php56/patches/patch-Zend_zend__llist.c 1.1 - lang/php56/patches/patch-Zend_zend__multiply.h 1.2 - lang/php56/patches/patch-Zend_zend__vm__execute.h 1.1 - lang/php56/patches/patch-Zend_zend__vm__execute.skl 1.1 - lang/php56/patches/patch-ext_session_session.c 1.1 - lang/php56/patches/patch-ext_standard_basic__functions.c 1.3 - lang/php56/patches/patch-ext_standard_basic__functions.h 1.1 - lang/php56/patches/patch-ext_standard_php__incomplete__class.h 1.1 - lang/php56/patches/patch-ext_standard_var.c 1.1 - lang/php56/patches/patch-ext_standard_var__unserializer.c 1.1 - lang/php56/patches/patch-ext_standard_var__unserializer.re 1.1 - lang/php56/patches/patch-main_SAPI.c 1.1 - lang/php56/patches/patch-main_main.c 1.1 - lang/php56/patches/patch-main_php__variables.c 1.1 - lang/php56/patches/patch-main_rfc1867.c 1.1 - lang/php56/patches/patch-sapi_embed_php__embed.c 1.1 --- Module Name: pkgsrc Committed By: taca Date: Tue Oct 27 15:30:49 UTC 2026 Modified Files: pkgsrc/lang/php56: Makefile distinfo pkgsrc/lang/php56/patches: patch-Zend_zend__multiply.h Added Files: pkgsrc/lang/php56/patches: patch-Zend_zend.c patch-Zend_zend__alloc.c patch-Zend_zend__alloc.h patch-Zend_zend__execute__API.c patch-Zend_zend__globals.h patch-Zend_zend__llist.c patch-Zend_zend__vm__execute.h patch-Zend_zend__vm__execute.skl patch-ext_session_session.c patch-ext_standard_basic__functions.h patch-ext_standard_php__incomplete__class.h patch-ext_standard_var.c patch-ext_standard_var__unserializer.c patch-ext_standard_var__unserializer.re patch-main_SAPI.c patch-main_main.c patch-main_php__variables.c patch-main_rfc1867.c Log Message: lang/php56: fix CVE-2026-109618 and CVE-2026-109619 Apply patch for CVE-2026-109618 and CVE-2026-109619. Thanks to sborrill@@ providing patch information. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: taca Date: Wed Oct 28 14:40:58 UTC 2026 Modified Files: pkgsrc/lang/php56: distinfo pkgsrc/lang/php56/patches: patch-ext_standard_basic__functions.c Added Files: pkgsrc/lang/php56/patches: patch-sapi_embed_php__embed.c Log Message: lang/php56: build fix Add missing parts from previous patches. @ text @a0 74 $NetBSD: patch-ext_standard_var__unserializer.re,v 1.1 2026/10/27 15:30:49 taca Exp $ https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch --- ext/standard/var_unserializer.re.orig 2019-01-09 09:54:13.000000000 +0000 +++ ext/standard/var_unserializer.re @@@@ -372,6 +372,16 @@@@ static inline int process_nested_data(UN return 0; } + /* The members that incomplete_classes_only mode writes itself cannot be + * told apart from that bookkeeping: reject them */ + if (objprops && UNEXPECTED(BG(incomplete_classes_only)) && Z_TYPE_P(key) == IS_STRING + && ((Z_STRLEN_P(key) == sizeof(MAGIC_MEMBER) - 1 && !memcmp(Z_STRVAL_P(key), MAGIC_MEMBER, sizeof(MAGIC_MEMBER) - 1)) + || (Z_STRLEN_P(key) == sizeof(MAGIC_MEMBER_SERIALIZED) - 1 && !memcmp(Z_STRVAL_P(key), MAGIC_MEMBER_SERIALIZED, sizeof(MAGIC_MEMBER_SERIALIZED) - 1)))) { + var_push_dtor_no_addref(var_hash, &key); + var_push_dtor_no_addref(var_hash, &data); + return 0; + } + if (!objprops) { switch (Z_TYPE_P(key)) { case IS_LONG: @@@@ -418,7 +428,7 @@@@ static inline int finish_nested_data(UNS return 1; } -static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce) +static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce, int keep_payload) { long datalen; @@@@ -431,7 +441,16 @@@@ static inline int object_custom(UNSERIAL return 0; } - if (ce->unserialize == NULL) { + if (keep_payload) { + /* The class was not resolved (see BG(incomplete_classes_only)): keep + * the payload verbatim, so that the object serializes back unchanged */ + zval *payload; + + object_init_ex(*rval, ce); + MAKE_STD_ZVAL(payload); + ZVAL_STRINGL(payload, (char *) *p, datalen, 1); + zend_hash_update(Z_OBJPROP_PP(rval), MAGIC_MEMBER_SERIALIZED, sizeof(MAGIC_MEMBER_SERIALIZED), &payload, sizeof(payload), NULL); + } else if (ce->unserialize == NULL) { zend_error(E_WARNING, "Class %s has no unserializer", ce->name); object_init_ex(*rval, ce); } else if (ce->unserialize(rval, ce, (const unsigned char*)*p, datalen, (zend_unserialize_data *)var_hash TSRMLS_CC) != SUCCESS) { @@@@ -796,6 +815,14 @@@@ object ":" uiv ":" ["] { class_name = estrndup(class_name, len); do { + if (BG(incomplete_classes_only)) { + /* Do not look the class up at all, so that no code (autoloader, + * unserialize_callback_func, __wakeup(), unserialize()) can run */ + incomplete_class = 1; + ce = PHP_IC_ENTRY; + break; + } + /* Try to find class directly */ BG(serialize_lock)++; if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) { @@@@ -875,7 +902,7 @@@@ object ":" uiv ":" ["] { if (custom_object) { int ret; - ret = object_custom(UNSERIALIZE_PASSTHRU, ce); + ret = object_custom(UNSERIALIZE_PASSTHRU, ce, incomplete_class && BG(incomplete_classes_only)); if (ret && incomplete_class) { php_store_class_name(*rval, class_name, len2); @