head 1.1; access; symbols pkgsrc-2026Q3:1.1.0.2; locks; strict; comment @ * @; 1.1 date 2026.10.22.02.06.45; author taca; state Exp; branches 1.1.2.1; next ; commitid Wi6Qo1a7ewgzMp0H; 1.1.2.1 date 2026.10.22.02.06.45; author maya; state dead; branches; next 1.1.2.2; commitid gZ0YLeL6EcmpcL2H; 1.1.2.2 date 2026.11.09.08.06.43; author maya; state Exp; branches; next ; commitid gZ0YLeL6EcmpcL2H; desc @@ 1.1 log @lang/php74: Apply changes from PHP-7.4-CVE-2026-109618-109619 Apply changes from tagged as PHP-7.4-CVE-2026-109618-109619 from GitHub. Quote from security advisory announce on https://www.php.net: Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor. Bump PKGREVISION. @ text @$NetBSD$ Fix for CVE-2026-109618-109619. --- Zend/zend_vm_def.h.orig 2022-10-31 10:36:14.000000000 +0000 +++ Zend/zend_vm_def.h @@@@ -417,7 +417,7 @@@@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TM size_t len = ZSTR_LEN(op1_str); if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { - zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation"); + zend_mm_safe_error_ex("Integer overflow in memory allocation"); } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@@@ -426,6 +426,9 @@@@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TM zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@@@ -3210,6 +3213,9 @@@@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) { size_t len = ZSTR_LEN(op1_str); + if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); ZVAL_NEW_STR(EX_VAR(opline->result.var), str); @@@@ -3217,6 +3223,9 @@@@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @ 1.1.2.1 log @file patch-Zend_zend__vm__def.h was added on branch pkgsrc-2026Q3 on 2026-11-09 08:06:43 +0000 @ text @d1 45 @ 1.1.2.2 log @Pullup ticket #7332 - requested by taca lang/php74: Security fix Revisions pulled up: - lang/php74/Makefile 1.40 - lang/php74/distinfo 1.48 - lang/php74/patches/patch-Zend_zend__API.h 1.1 - lang/php74/patches/patch-Zend_zend__alloc.c 1.1 - lang/php74/patches/patch-Zend_zend__alloc.h 1.1 - lang/php74/patches/patch-Zend_zend__execute__API.c 1.1 - lang/php74/patches/patch-Zend_zend__hash.c 1.1 - lang/php74/patches/patch-Zend_zend__hash.h 1.1 - lang/php74/patches/patch-Zend_zend__llist.c 1.1 - lang/php74/patches/patch-Zend_zend__multiply.h 1.1 - lang/php74/patches/patch-Zend_zend__strtod.c 1.1 - lang/php74/patches/patch-Zend_zend__types.h 1.1 - lang/php74/patches/patch-Zend_zend__vm__def.h 1.1 - lang/php74/patches/patch-Zend_zend__vm__execute.h 1.1 - lang/php74/patches/patch-ext_session_session.c 1.1 - lang/php74/patches/patch-main_SAPI.c 1.1 - lang/php74/patches/patch-main_main.c 1.1 - lang/php74/patches/patch-main_php__variables.c 1.1 - lang/php74/patches/patch-main_rfc1867.c 1.1 --- Module Name: pkgsrc Committed By: taca Date: Thu Oct 22 02:06:46 UTC 2026 Modified Files: pkgsrc/lang/php74: Makefile distinfo Added Files: pkgsrc/lang/php74/patches: patch-Zend_zend__API.h patch-Zend_zend__alloc.c patch-Zend_zend__alloc.h patch-Zend_zend__execute__API.c patch-Zend_zend__hash.c patch-Zend_zend__hash.h patch-Zend_zend__llist.c patch-Zend_zend__multiply.h patch-Zend_zend__strtod.c patch-Zend_zend__types.h patch-Zend_zend__vm__def.h patch-Zend_zend__vm__execute.h patch-ext_session_session.c patch-main_SAPI.c patch-main_main.c patch-main_php__variables.c patch-main_rfc1867.c Log Message: lang/php74: Apply changes from PHP-7.4-CVE-2026-109618-109619 Apply changes from tagged as PHP-7.4-CVE-2026-109618-109619 from GitHub. Quote from security advisory announce on https://www.php.net: Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor. Bump PKGREVISION. @ text @a0 45 $NetBSD: patch-Zend_zend__vm__def.h,v 1.1 2026/10/22 02:06:45 taca Exp $ Fix for CVE-2026-109618-109619. --- Zend/zend_vm_def.h.orig 2022-10-31 10:36:14.000000000 +0000 +++ Zend/zend_vm_def.h @@@@ -417,7 +417,7 @@@@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TM size_t len = ZSTR_LEN(op1_str); if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { - zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation"); + zend_mm_safe_error_ex("Integer overflow in memory allocation"); } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@@@ -426,6 +426,9 @@@@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TM zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@@@ -3210,6 +3213,9 @@@@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) { size_t len = ZSTR_LEN(op1_str); + if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); ZVAL_NEW_STR(EX_VAR(opline->result.var), str); @@@@ -3217,6 +3223,9 @@@@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @