fix for CVE-2015-0232

[packages/php.git] / php-sapi-ini-file.patch

diff --git a/php-sapi-ini-file.patch b/php-sapi-ini-file.patch
index b078e3ffa41cc8a04616d247b08f34420b361637..0c6abd696e1783c481b4165a4019ecd8ca622d73 100644 (file)
--- a/php-sapi-ini-file.patch
+++ b/php-sapi-ini-file.patch
@@ -1,20 +1,27 @@
---- php-5.2.7/main/php_ini.c.org       2008-12-05 23:30:07.843241117 +0100
-+++ php-5.2.7/main/php_ini.c   2008-12-05 23:36:18.096968965 +0100
-@@ -475,21 +475,32 @@
+--- php-5.2.11/main/php_ini.c  2009-09-24 22:48:12.128424374 +0300
++++ php-5.2.11/main/php_ini.c  2009-09-24 22:50:19.481745134 +0300
+@@ -255,6 +255,12 @@
+ }
+ /* }}} */
+ 
++static int php_csort(const struct dirent **a, const struct dirent **b)
++{
++      return strcmp((*a)->d_name,(*b)->d_name);
++}
++
++
+ /* {{{ php_init_config
+  */
+ int php_init_config(TSRMLS_D)
+@@ -474,6 +480,24 @@
+                               }
                        }
                }
- 
--              /* Otherwise search for php-%sapi-module-name%.ini file in search path */
 +              /* Search (global) php.ini file in search path */
-               if (!fh.handle.fp) {
--                      const char *fmt = "php-%s.ini";
--                      char *ini_fname;
--                      spprintf(&ini_fname, 0, fmt, sapi_module.name);
--                      fh.handle.fp = php_fopen_with_path(ini_fname, "r", php_ini_search_path, &php_ini_opened_path TSRMLS_CC);
--                      efree(ini_fname);
++              if (!fh.handle.fp) {
 +                      fh.handle.fp = php_fopen_with_path("php.ini", "r", php_ini_search_path, &php_ini_opened_path TSRMLS_CC);
-                       if (fh.handle.fp) {
-                               fh.filename = php_ini_opened_path;
++                      if (fh.handle.fp) {
++                              fh.filename = php_ini_opened_path;
 +                              PG(safe_mode) = safe_mode_state;
 +                              PG(open_basedir) = open_basedir;
 +                              fh.type = ZEND_HANDLE_FP;
@@ -26,22 +33,27 @@
 +                              fh.handle.fp = NULL;
 +                              efree(php_ini_opened_path);
 +                              fh.filename = php_ini_opened_path = NULL;
-                       }
-               }
++                      }
++              }
  
--              /* If still no ini file found, search for php.ini file in search path */
-+              /* Otherwise search for php-%sapi-module-name%.ini file in search path */
+               /* Otherwise search for php-%sapi-module-name%.ini file in search path */
                if (!fh.handle.fp) {
--                      fh.handle.fp = php_fopen_with_path("php.ini", "r", php_ini_search_path, &php_ini_opened_path TSRMLS_CC);
-+                      const char *fmt = "php-%s.ini";
-+                      char *ini_fname;
-+                      spprintf(&ini_fname, 0, fmt, sapi_module.name);
-+                      fh.handle.fp = php_fopen_with_path(ini_fname, "r", php_ini_search_path, &php_ini_opened_path TSRMLS_CC);
-+                      efree(ini_fname);
-                       if (fh.handle.fp) {
+@@ -486,14 +510,6 @@
                                fh.filename = php_ini_opened_path;
                        }
-@@ -533,9 +544,13 @@
+               }
+-
+-              /* If still no ini file found, search for php.ini file in search path */
+-              if (!fh.handle.fp) {
+-                      fh.handle.fp = php_fopen_with_path("php.ini", "r", php_ini_search_path, &php_ini_opened_path TSRMLS_CC);
+-                      if (fh.handle.fp) {
+-                              fh.filename = php_ini_opened_path;
+-                      }
+-              }
+       }
+ 
+       if (free_ini_search_path) {
+@@ -533,9 +549,13 @@
        /* Scan and parse any .ini files found in scan path if path not empty. */
        if (!sapi_module.php_ini_ignore && php_ini_scanned_path_len) {
                struct dirent **namelist;
@@ -51,19 +63,29 @@
 +              char *sapi_scan_dir = emalloc(strlen(fmt) + strlen(sapi_module.name));
 +              sprintf(sapi_scan_dir, fmt, sapi_module.name);
  
-               if ((ndir = php_scandir(php_ini_scanned_path, &namelist, 0, php_alphasort)) > 0) {
+-              if ((ndir = php_scandir(php_ini_scanned_path, &namelist, 0, php_alphasort)) > 0) {
++              if ((ndir = php_scandir(php_ini_scanned_path, &namelist, 0, php_csort)) > 0) {
 +                      found += ndir;
                        for (i = 0; i < ndir; i++) {
                                /* check for a .ini extension */
                                if (!(p = strrchr(namelist[i]->d_name, '.')) || (p && strcmp(p, ".ini"))) {
-@@ -564,6 +579,38 @@
-                               free(namelist[i]);
-                       }
-                       free(namelist);
+@@ -556,6 +576,35 @@
+                                                       /* Here, add it to the list of ini files read */
+                                                       l = strlen(ini_file);
+                                                       total_l += l + 2;
++                                                      p = estrndup(ini_file, l); 
++                                                      zend_llist_add_element(&scanned_ini_list, &p);
++                                              }
++                                      }
++                              }
++                              free(namelist[i]);
++                      }
++                      free(namelist);
 +              }
-+              
-+              if ((ndir = php_scandir(sapi_scan_dir, &namelist, 0, php_alphasort)) > 0) {
++
++              if ((ndir = php_scandir(sapi_scan_dir, &namelist, 0, php_csort)) > 0) {
 +                      found += ndir;
++
 +                      for (i = 0; i < ndir; i++) {
 +                              /* check for a .ini extension */
 +                              if (!(p = strrchr(namelist[i]->d_name, '.')) || (p && strcmp(p, ".ini"))) {
@@ -80,18 +102,19 @@
 +                                                      /* Here, add it to the list of ini files read */
 +                                                      l = strlen(ini_file);
 +                                                      total_l += l + 2;
-+                                                      p = estrndup(ini_file, l);
-+                                                      zend_llist_add_element(&scanned_ini_list, &p);
-+                                              }
-+                                      }
-+                              }
-+                              free(namelist[i]);
-+                      }
-+                      free(namelist);
+                                                       p = estrndup(ini_file, l);
+                                                       zend_llist_add_element(&scanned_ini_list, &p);
+                                               }
+@@ -564,8 +613,11 @@
+                               free(namelist[i]);
+                       }
+                       free(namelist);
 +              }
 +              efree(sapi_scan_dir);
-+
-+              if (found) {
  
-                       /*
+-                      /*
++              if (found) {
++                      /* 
                         * Don't need an extra byte for the \0 in this malloc as the last
+                        * element will not get a trailing , which gives us the byte for the \0
+                        */