head 1.1; access; symbols pkgsrc-2026Q3:1.1.0.2; locks; strict; comment @ * @; 1.1 date 2026.10.22.02.06.45; author taca; state Exp; branches 1.1.2.1; next ; commitid Wi6Qo1a7ewgzMp0H; 1.1.2.1 date 2026.10.22.02.06.45; author maya; state dead; branches; next 1.1.2.2; commitid gZ0YLeL6EcmpcL2H; 1.1.2.2 date 2026.11.09.08.06.42; author maya; state Exp; branches; next ; commitid gZ0YLeL6EcmpcL2H; desc @@ 1.1 log @lang/php74: Apply changes from PHP-7.4-CVE-2026-109618-109619 Apply changes from tagged as PHP-7.4-CVE-2026-109618-109619 from GitHub. Quote from security advisory announce on https://www.php.net: Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor. Bump PKGREVISION. @ text @$NetBSD$ Fix for CVE-2026-109618-109619. --- Zend/zend_execute_API.c.orig 2022-10-31 10:36:16.000000000 +0000 +++ Zend/zend_execute_API.c @@@@ -337,10 +337,21 @@@@ void shutdown_executor(void) /* {{{ */ gc_collect_cycles(); } #endif + } else { + /* may be used by zend_error_zstr_at before init_executor */ + ZVAL_UNDEF(&EG(user_error_handler)); + ZVAL_UNDEF(&EG(user_exception_handler)); + memset(&EG(user_error_handlers_error_reporting), 0, sizeof(EG(user_error_handlers_error_reporting))); + memset(&EG(user_error_handlers), 0, sizeof(EG(user_error_handlers))); + memset(&EG(user_exception_handlers), 0, sizeof(EG(user_exception_handlers))); } zend_objects_store_free_object_storage(&EG(objects_store), fast_shutdown); + /* may be used by zend_error_zstr_at before init_executor */ + EG(error_handling) = EH_NORMAL; + EG(exception) = NULL; + zend_weakrefs_shutdown(); zend_try { @@@@ -357,6 +368,8 @@@@ void shutdown_executor(void) /* {{{ */ zend_hash_discard(EG(function_table), EG(persistent_functions_count)); zend_hash_discard(EG(class_table), EG(persistent_classes_count)); zend_cleanup_internal_classes(); + EG(objects_store).object_buckets = NULL; + EG(objects_store).top = 1; } else { zend_vm_stack_destroy(); @ 1.1.2.1 log @file patch-Zend_zend__execute__API.c was added on branch pkgsrc-2026Q3 on 2026-11-09 08:06:42 +0000 @ text @d1 37 @ 1.1.2.2 log @Pullup ticket #7332 - requested by taca lang/php74: Security fix Revisions pulled up: - lang/php74/Makefile 1.40 - lang/php74/distinfo 1.48 - lang/php74/patches/patch-Zend_zend__API.h 1.1 - lang/php74/patches/patch-Zend_zend__alloc.c 1.1 - lang/php74/patches/patch-Zend_zend__alloc.h 1.1 - lang/php74/patches/patch-Zend_zend__execute__API.c 1.1 - lang/php74/patches/patch-Zend_zend__hash.c 1.1 - lang/php74/patches/patch-Zend_zend__hash.h 1.1 - lang/php74/patches/patch-Zend_zend__llist.c 1.1 - lang/php74/patches/patch-Zend_zend__multiply.h 1.1 - lang/php74/patches/patch-Zend_zend__strtod.c 1.1 - lang/php74/patches/patch-Zend_zend__types.h 1.1 - lang/php74/patches/patch-Zend_zend__vm__def.h 1.1 - lang/php74/patches/patch-Zend_zend__vm__execute.h 1.1 - lang/php74/patches/patch-ext_session_session.c 1.1 - lang/php74/patches/patch-main_SAPI.c 1.1 - lang/php74/patches/patch-main_main.c 1.1 - lang/php74/patches/patch-main_php__variables.c 1.1 - lang/php74/patches/patch-main_rfc1867.c 1.1 --- Module Name: pkgsrc Committed By: taca Date: Thu Oct 22 02:06:46 UTC 2026 Modified Files: pkgsrc/lang/php74: Makefile distinfo Added Files: pkgsrc/lang/php74/patches: patch-Zend_zend__API.h patch-Zend_zend__alloc.c patch-Zend_zend__alloc.h patch-Zend_zend__execute__API.c patch-Zend_zend__hash.c patch-Zend_zend__hash.h patch-Zend_zend__llist.c patch-Zend_zend__multiply.h patch-Zend_zend__strtod.c patch-Zend_zend__types.h patch-Zend_zend__vm__def.h patch-Zend_zend__vm__execute.h patch-ext_session_session.c patch-main_SAPI.c patch-main_main.c patch-main_php__variables.c patch-main_rfc1867.c Log Message: lang/php74: Apply changes from PHP-7.4-CVE-2026-109618-109619 Apply changes from tagged as PHP-7.4-CVE-2026-109618-109619 from GitHub. Quote from security advisory announce on https://www.php.net: Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor. Bump PKGREVISION. @ text @a0 37 $NetBSD: patch-Zend_zend__execute__API.c,v 1.1 2026/10/22 02:06:45 taca Exp $ Fix for CVE-2026-109618-109619. --- Zend/zend_execute_API.c.orig 2022-10-31 10:36:16.000000000 +0000 +++ Zend/zend_execute_API.c @@@@ -337,10 +337,21 @@@@ void shutdown_executor(void) /* {{{ */ gc_collect_cycles(); } #endif + } else { + /* may be used by zend_error_zstr_at before init_executor */ + ZVAL_UNDEF(&EG(user_error_handler)); + ZVAL_UNDEF(&EG(user_exception_handler)); + memset(&EG(user_error_handlers_error_reporting), 0, sizeof(EG(user_error_handlers_error_reporting))); + memset(&EG(user_error_handlers), 0, sizeof(EG(user_error_handlers))); + memset(&EG(user_exception_handlers), 0, sizeof(EG(user_exception_handlers))); } zend_objects_store_free_object_storage(&EG(objects_store), fast_shutdown); + /* may be used by zend_error_zstr_at before init_executor */ + EG(error_handling) = EH_NORMAL; + EG(exception) = NULL; + zend_weakrefs_shutdown(); zend_try { @@@@ -357,6 +368,8 @@@@ void shutdown_executor(void) /* {{{ */ zend_hash_discard(EG(function_table), EG(persistent_functions_count)); zend_hash_discard(EG(class_table), EG(persistent_classes_count)); zend_cleanup_internal_classes(); + EG(objects_store).object_buckets = NULL; + EG(objects_store).top = 1; } else { zend_vm_stack_destroy(); @