head 1.1; access; symbols pkgsrc-2026Q3:1.1.0.2; locks; strict; comment @ * @; 1.1 date 2026.10.27.15.30.49; author taca; state Exp; branches 1.1.2.1; next ; commitid KjO33YVcJEfD481H; 1.1.2.1 date 2026.10.27.15.30.49; author maya; state dead; branches; next 1.1.2.2; commitid p9DWww5rhvcuiL2H; 1.1.2.2 date 2026.11.09.08.24.27; author maya; state Exp; branches; next ; commitid p9DWww5rhvcuiL2H; desc @@ 1.1 log @lang/php56: fix CVE-2026-109618 and CVE-2026-109619 Apply patch for CVE-2026-109618 and CVE-2026-109619. Thanks to sborrill@@ providing patch information. Bump PKGREVISION. @ text @$NetBSD$ https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch --- main/rfc1867.c.orig 2019-01-09 09:54:13.000000000 +0000 +++ main/rfc1867.c @@@@ -249,6 +249,12 @@@@ static int fill_buffer(multipart_buffer self->buf_begin = self->buffer; + /* The declared Content-Length was checked against post_max_size, but the + * body may be longer (or chunked) */ + if (SG(post_max_size) > 0 && SG(read_post_bytes) > SG(post_max_size)) { + return 0; + } + /* calculate the free space in the buffer */ bytes_to_read = self->bufsize - self->bytes_in_buffer; @@@@ -400,6 +406,14 @@@@ static int find_boundary(multipart_buffe return 0; } +static char *php_mime_get_hdr_value(zend_llist header, char *key); + +static zend_bool php_mime_should_save_hdr(const char *name) +{ + return !strcasecmp(name, "Content-Disposition") + || !strcasecmp(name, "Content-Type"); +} + /* parse headers */ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header TSRMLS_DC) { @@@@ -441,15 +455,31 @@@@ static int multipart_buffer_headers(mult } *value = '\0'; - do { value++; } while(isspace(*value)); - key = estrdup(line); - smart_str_appends(&buf_value, value); + /* An unbounded number of headers would be kept in memory: keep + * only the ones we use, and ignore duplicates */ + if (!php_mime_should_save_hdr(line) + || php_mime_get_hdr_value(*header, line)) { + key = NULL; + } else { + do { value++; } while(isspace(*value)); + + key = estrdup(line); + smart_str_appends(&buf_value, value); + } } else if (buf_value.c) { /* If no ':' on the line, add to previous line */ smart_str_appends(&buf_value, line); } else { continue; } + + if (ZEND_HAS_OOM()) { + if (key) { + efree(key); + } + smart_str_free(&buf_value); + return 0; + } } if(buf_value.c && key) { /* add the last one to the list */ @@@@ -664,6 +694,9 @@@@ static char *multipart_buffer_read_body( out = erealloc(out, total_bytes + read_bytes + 1); memcpy(out + total_bytes, buf, read_bytes); total_bytes += read_bytes; + if (ZEND_HAS_OOM()) { + break; + } } if (out) { @@@@ -696,6 +729,8 @@@@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ void *event_extra_data = NULL; unsigned int llen = 0; int upload_cnt = INI_INT("max_file_uploads"); + long body_parts_cnt = INI_INT("max_multipart_body_parts"); + long body_parts_limit; const zend_encoding *internal_encoding = zend_multibyte_get_internal_encoding(TSRMLS_C); php_rfc1867_getword_t getword; php_rfc1867_getword_conf_t getword_conf; @@@@ -717,6 +752,11 @@@@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ return; } + if (body_parts_cnt < 0) { + body_parts_cnt = PG(max_input_vars) + upload_cnt; + } + body_parts_limit = body_parts_cnt; + /* Get the boundary */ boundary = strstr(content_type_dup, "boundary"); if (!boundary) { @@@@ -782,6 +822,9 @@@@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ if (php_rfc1867_callback(MULTIPART_EVENT_START, &event_start, &event_extra_data TSRMLS_CC) == FAILURE) { goto fileupload_done; } + if (ZEND_HAS_OOM()) { + goto fileupload_done; + } } while (!multipart_buffer_eof(mbuff TSRMLS_CC)) @@@@ -793,6 +836,11 @@@@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ zend_llist_clean(&header); + if (ZEND_HAS_OOM()) { + /* A previous body part has reached the memory limit: stop here */ + goto fileupload_done; + } + if (!multipart_buffer_headers(mbuff, &header TSRMLS_CC)) { goto fileupload_done; } @@@@ -801,6 +849,11 @@@@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ char *pair = NULL; int end = 0; + if (--body_parts_cnt < 0) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Multipart body parts limit exceeded %ld. To increase the limit change max_multipart_body_parts in php.ini.", body_parts_limit); + goto fileupload_done; + } + while (isspace(*cd)) { ++cd; } @@@@ -856,6 +909,17 @@@@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ char *value = multipart_buffer_read_body(mbuff, &value_len TSRMLS_CC); unsigned int new_val_len; /* Dummy variable */ + if (ZEND_HAS_OOM()) { + if (value) { + efree(value); + } + efree(param); + if (filename) { + efree(filename); + } + goto fileupload_done; + } + if (!value) { value = estrdup(""); value_len = 0; @@@@ -1287,6 +1351,9 @@@@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ } fileupload_done: + if (SG(post_max_size) > 0 && SG(read_post_bytes) > SG(post_max_size)) { + sapi_module.sapi_error(E_WARNING, "Actual POST length does not match Content-Length, and exceeds %ld bytes", SG(post_max_size)); + } if (php_rfc1867_callback != NULL) { multipart_event_end event_end; @ 1.1.2.1 log @file patch-main_rfc1867.c was added on branch pkgsrc-2026Q3 on 2026-11-09 08:24:27 +0000 @ text @d1 162 @ 1.1.2.2 log @Pullup ticket #7341 - requested by taca lang/php56: Security fix Revisions pulled up: - lang/php56/Makefile 1.50 - lang/php56/distinfo 1.68-1.69 - lang/php56/patches/patch-Zend_zend.c 1.1 - lang/php56/patches/patch-Zend_zend__alloc.c 1.1 - lang/php56/patches/patch-Zend_zend__alloc.h 1.1 - lang/php56/patches/patch-Zend_zend__execute__API.c 1.1 - lang/php56/patches/patch-Zend_zend__globals.h 1.1 - lang/php56/patches/patch-Zend_zend__llist.c 1.1 - lang/php56/patches/patch-Zend_zend__multiply.h 1.2 - lang/php56/patches/patch-Zend_zend__vm__execute.h 1.1 - lang/php56/patches/patch-Zend_zend__vm__execute.skl 1.1 - lang/php56/patches/patch-ext_session_session.c 1.1 - lang/php56/patches/patch-ext_standard_basic__functions.c 1.3 - lang/php56/patches/patch-ext_standard_basic__functions.h 1.1 - lang/php56/patches/patch-ext_standard_php__incomplete__class.h 1.1 - lang/php56/patches/patch-ext_standard_var.c 1.1 - lang/php56/patches/patch-ext_standard_var__unserializer.c 1.1 - lang/php56/patches/patch-ext_standard_var__unserializer.re 1.1 - lang/php56/patches/patch-main_SAPI.c 1.1 - lang/php56/patches/patch-main_main.c 1.1 - lang/php56/patches/patch-main_php__variables.c 1.1 - lang/php56/patches/patch-main_rfc1867.c 1.1 - lang/php56/patches/patch-sapi_embed_php__embed.c 1.1 --- Module Name: pkgsrc Committed By: taca Date: Tue Oct 27 15:30:49 UTC 2026 Modified Files: pkgsrc/lang/php56: Makefile distinfo pkgsrc/lang/php56/patches: patch-Zend_zend__multiply.h Added Files: pkgsrc/lang/php56/patches: patch-Zend_zend.c patch-Zend_zend__alloc.c patch-Zend_zend__alloc.h patch-Zend_zend__execute__API.c patch-Zend_zend__globals.h patch-Zend_zend__llist.c patch-Zend_zend__vm__execute.h patch-Zend_zend__vm__execute.skl patch-ext_session_session.c patch-ext_standard_basic__functions.h patch-ext_standard_php__incomplete__class.h patch-ext_standard_var.c patch-ext_standard_var__unserializer.c patch-ext_standard_var__unserializer.re patch-main_SAPI.c patch-main_main.c patch-main_php__variables.c patch-main_rfc1867.c Log Message: lang/php56: fix CVE-2026-109618 and CVE-2026-109619 Apply patch for CVE-2026-109618 and CVE-2026-109619. Thanks to sborrill@@ providing patch information. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: taca Date: Wed Oct 28 14:40:58 UTC 2026 Modified Files: pkgsrc/lang/php56: distinfo pkgsrc/lang/php56/patches: patch-ext_standard_basic__functions.c Added Files: pkgsrc/lang/php56/patches: patch-sapi_embed_php__embed.c Log Message: lang/php56: build fix Add missing parts from previous patches. @ text @a0 162 $NetBSD: patch-main_rfc1867.c,v 1.1 2026/10/27 15:30:49 taca Exp $ https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/refs/heads/main/patches/php-5.6-enhanced-universal.patch --- main/rfc1867.c.orig 2019-01-09 09:54:13.000000000 +0000 +++ main/rfc1867.c @@@@ -249,6 +249,12 @@@@ static int fill_buffer(multipart_buffer self->buf_begin = self->buffer; + /* The declared Content-Length was checked against post_max_size, but the + * body may be longer (or chunked) */ + if (SG(post_max_size) > 0 && SG(read_post_bytes) > SG(post_max_size)) { + return 0; + } + /* calculate the free space in the buffer */ bytes_to_read = self->bufsize - self->bytes_in_buffer; @@@@ -400,6 +406,14 @@@@ static int find_boundary(multipart_buffe return 0; } +static char *php_mime_get_hdr_value(zend_llist header, char *key); + +static zend_bool php_mime_should_save_hdr(const char *name) +{ + return !strcasecmp(name, "Content-Disposition") + || !strcasecmp(name, "Content-Type"); +} + /* parse headers */ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header TSRMLS_DC) { @@@@ -441,15 +455,31 @@@@ static int multipart_buffer_headers(mult } *value = '\0'; - do { value++; } while(isspace(*value)); - key = estrdup(line); - smart_str_appends(&buf_value, value); + /* An unbounded number of headers would be kept in memory: keep + * only the ones we use, and ignore duplicates */ + if (!php_mime_should_save_hdr(line) + || php_mime_get_hdr_value(*header, line)) { + key = NULL; + } else { + do { value++; } while(isspace(*value)); + + key = estrdup(line); + smart_str_appends(&buf_value, value); + } } else if (buf_value.c) { /* If no ':' on the line, add to previous line */ smart_str_appends(&buf_value, line); } else { continue; } + + if (ZEND_HAS_OOM()) { + if (key) { + efree(key); + } + smart_str_free(&buf_value); + return 0; + } } if(buf_value.c && key) { /* add the last one to the list */ @@@@ -664,6 +694,9 @@@@ static char *multipart_buffer_read_body( out = erealloc(out, total_bytes + read_bytes + 1); memcpy(out + total_bytes, buf, read_bytes); total_bytes += read_bytes; + if (ZEND_HAS_OOM()) { + break; + } } if (out) { @@@@ -696,6 +729,8 @@@@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ void *event_extra_data = NULL; unsigned int llen = 0; int upload_cnt = INI_INT("max_file_uploads"); + long body_parts_cnt = INI_INT("max_multipart_body_parts"); + long body_parts_limit; const zend_encoding *internal_encoding = zend_multibyte_get_internal_encoding(TSRMLS_C); php_rfc1867_getword_t getword; php_rfc1867_getword_conf_t getword_conf; @@@@ -717,6 +752,11 @@@@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ return; } + if (body_parts_cnt < 0) { + body_parts_cnt = PG(max_input_vars) + upload_cnt; + } + body_parts_limit = body_parts_cnt; + /* Get the boundary */ boundary = strstr(content_type_dup, "boundary"); if (!boundary) { @@@@ -782,6 +822,9 @@@@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ if (php_rfc1867_callback(MULTIPART_EVENT_START, &event_start, &event_extra_data TSRMLS_CC) == FAILURE) { goto fileupload_done; } + if (ZEND_HAS_OOM()) { + goto fileupload_done; + } } while (!multipart_buffer_eof(mbuff TSRMLS_CC)) @@@@ -793,6 +836,11 @@@@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ zend_llist_clean(&header); + if (ZEND_HAS_OOM()) { + /* A previous body part has reached the memory limit: stop here */ + goto fileupload_done; + } + if (!multipart_buffer_headers(mbuff, &header TSRMLS_CC)) { goto fileupload_done; } @@@@ -801,6 +849,11 @@@@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ char *pair = NULL; int end = 0; + if (--body_parts_cnt < 0) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Multipart body parts limit exceeded %ld. To increase the limit change max_multipart_body_parts in php.ini.", body_parts_limit); + goto fileupload_done; + } + while (isspace(*cd)) { ++cd; } @@@@ -856,6 +909,17 @@@@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ char *value = multipart_buffer_read_body(mbuff, &value_len TSRMLS_CC); unsigned int new_val_len; /* Dummy variable */ + if (ZEND_HAS_OOM()) { + if (value) { + efree(value); + } + efree(param); + if (filename) { + efree(filename); + } + goto fileupload_done; + } + if (!value) { value = estrdup(""); value_len = 0; @@@@ -1287,6 +1351,9 @@@@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ } fileupload_done: + if (SG(post_max_size) > 0 && SG(read_post_bytes) > SG(post_max_size)) { + sapi_module.sapi_error(E_WARNING, "Actual POST length does not match Content-Length, and exceeds %ld bytes", SG(post_max_size)); + } if (php_rfc1867_callback != NULL) { multipart_event_end event_end; @