head 1.1; access; symbols pkgsrc-2026Q3:1.1.0.2; locks; strict; comment @ * @; 1.1 date 2026.10.22.02.06.46; author taca; state Exp; branches 1.1.2.1; next ; commitid Wi6Qo1a7ewgzMp0H; 1.1.2.1 date 2026.10.22.02.06.46; author maya; state dead; branches; next 1.1.2.2; commitid gZ0YLeL6EcmpcL2H; 1.1.2.2 date 2026.11.09.08.06.43; author maya; state Exp; branches; next ; commitid gZ0YLeL6EcmpcL2H; desc @@ 1.1 log @lang/php74: Apply changes from PHP-7.4-CVE-2026-109618-109619 Apply changes from tagged as PHP-7.4-CVE-2026-109618-109619 from GitHub. Quote from security advisory announce on https://www.php.net: Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor. Bump PKGREVISION. @ text @$NetBSD$ Fix for CVE-2026-109618-109619. --- main/php_variables.c.orig 2022-10-31 10:36:05.000000000 +0000 +++ main/php_variables.c @@@@ -218,7 +218,7 @@@@ PHPAPI void php_register_variable_ex(cha } if (!index) { - array_init(&gpc_element); + array_init_singleton(&gpc_element); if ((gpc_element_p = zend_hash_next_index_insert(symtable1, &gpc_element)) == NULL) { zend_array_destroy(Z_ARR(gpc_element)); zval_ptr_dtor_nogc(val); @@@@ -229,7 +229,7 @@@@ PHPAPI void php_register_variable_ex(cha gpc_element_p = zend_symtable_str_find(symtable1, index, index_len); if (!gpc_element_p) { zval tmp; - array_init(&tmp); + array_init_singleton(&tmp); gpc_element_p = zend_symtable_str_update_ind(symtable1, index, index_len, &tmp); } else { if (Z_TYPE_P(gpc_element_p) == IS_INDIRECT) { @@@@ -237,7 +237,7 @@@@ PHPAPI void php_register_variable_ex(cha } if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) { zval_ptr_dtor_nogc(gpc_element_p); - array_init(gpc_element_p); + array_init_singleton(gpc_element_p); } else { SEPARATE_ARRAY(gpc_element_p); } @@@@ -429,7 +429,7 @@@@ SAPI_API SAPI_TREAT_DATA_FUNC(php_defaul case PARSE_POST: case PARSE_GET: case PARSE_COOKIE: - array_init(&array); + array_init_singleton(&array); switch (arg) { case PARSE_POST: zval_ptr_dtor_nogc(&PG(http_globals)[TRACK_VARS_POST]); @ 1.1.2.1 log @file patch-main_php__variables.c was added on branch pkgsrc-2026Q3 on 2026-11-09 08:06:43 +0000 @ text @d1 42 @ 1.1.2.2 log @Pullup ticket #7332 - requested by taca lang/php74: Security fix Revisions pulled up: - lang/php74/Makefile 1.40 - lang/php74/distinfo 1.48 - lang/php74/patches/patch-Zend_zend__API.h 1.1 - lang/php74/patches/patch-Zend_zend__alloc.c 1.1 - lang/php74/patches/patch-Zend_zend__alloc.h 1.1 - lang/php74/patches/patch-Zend_zend__execute__API.c 1.1 - lang/php74/patches/patch-Zend_zend__hash.c 1.1 - lang/php74/patches/patch-Zend_zend__hash.h 1.1 - lang/php74/patches/patch-Zend_zend__llist.c 1.1 - lang/php74/patches/patch-Zend_zend__multiply.h 1.1 - lang/php74/patches/patch-Zend_zend__strtod.c 1.1 - lang/php74/patches/patch-Zend_zend__types.h 1.1 - lang/php74/patches/patch-Zend_zend__vm__def.h 1.1 - lang/php74/patches/patch-Zend_zend__vm__execute.h 1.1 - lang/php74/patches/patch-ext_session_session.c 1.1 - lang/php74/patches/patch-main_SAPI.c 1.1 - lang/php74/patches/patch-main_main.c 1.1 - lang/php74/patches/patch-main_php__variables.c 1.1 - lang/php74/patches/patch-main_rfc1867.c 1.1 --- Module Name: pkgsrc Committed By: taca Date: Thu Oct 22 02:06:46 UTC 2026 Modified Files: pkgsrc/lang/php74: Makefile distinfo Added Files: pkgsrc/lang/php74/patches: patch-Zend_zend__API.h patch-Zend_zend__alloc.c patch-Zend_zend__alloc.h patch-Zend_zend__execute__API.c patch-Zend_zend__hash.c patch-Zend_zend__hash.h patch-Zend_zend__llist.c patch-Zend_zend__multiply.h patch-Zend_zend__strtod.c patch-Zend_zend__types.h patch-Zend_zend__vm__def.h patch-Zend_zend__vm__execute.h patch-ext_session_session.c patch-main_SAPI.c patch-main_main.c patch-main_php__variables.c patch-main_rfc1867.c Log Message: lang/php74: Apply changes from PHP-7.4-CVE-2026-109618-109619 Apply changes from tagged as PHP-7.4-CVE-2026-109618-109619 from GitHub. Quote from security advisory announce on https://www.php.net: Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor. Bump PKGREVISION. @ text @a0 42 $NetBSD: patch-main_php__variables.c,v 1.1 2026/10/22 02:06:46 taca Exp $ Fix for CVE-2026-109618-109619. --- main/php_variables.c.orig 2022-10-31 10:36:05.000000000 +0000 +++ main/php_variables.c @@@@ -218,7 +218,7 @@@@ PHPAPI void php_register_variable_ex(cha } if (!index) { - array_init(&gpc_element); + array_init_singleton(&gpc_element); if ((gpc_element_p = zend_hash_next_index_insert(symtable1, &gpc_element)) == NULL) { zend_array_destroy(Z_ARR(gpc_element)); zval_ptr_dtor_nogc(val); @@@@ -229,7 +229,7 @@@@ PHPAPI void php_register_variable_ex(cha gpc_element_p = zend_symtable_str_find(symtable1, index, index_len); if (!gpc_element_p) { zval tmp; - array_init(&tmp); + array_init_singleton(&tmp); gpc_element_p = zend_symtable_str_update_ind(symtable1, index, index_len, &tmp); } else { if (Z_TYPE_P(gpc_element_p) == IS_INDIRECT) { @@@@ -237,7 +237,7 @@@@ PHPAPI void php_register_variable_ex(cha } if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) { zval_ptr_dtor_nogc(gpc_element_p); - array_init(gpc_element_p); + array_init_singleton(gpc_element_p); } else { SEPARATE_ARRAY(gpc_element_p); } @@@@ -429,7 +429,7 @@@@ SAPI_API SAPI_TREAT_DATA_FUNC(php_defaul case PARSE_POST: case PARSE_GET: case PARSE_COOKIE: - array_init(&array); + array_init_singleton(&array); switch (arg) { case PARSE_POST: zval_ptr_dtor_nogc(&PG(http_globals)[TRACK_VARS_POST]); @