- rel 16; SECURITY; fixes http://akat1.pl/?id=1

diff --git a/php-bug-71475.patch b/php-bug-71475.patch
new file mode 100644 (file)
index 0000000..0a9ed6f
--- /dev/null
+++ b/php-bug-71475.patch
@@ -0,0 +1,42 @@
+--- php-5.6.17/ext/openssl/openssl.c~  2016-01-06 16:14:47.000000000 +0100
++++ php-5.6.17/ext/openssl/openssl.c   2016-02-02 18:15:39.118449615 +0100
+@@ -4886,6 +4886,7 @@ PHP_FUNCTION(openssl_seal)
+       memset(eks, 0, sizeof(*eks) * nkeys);
+       key_resources = safe_emalloc(nkeys, sizeof(long), 0);
+       memset(key_resources, 0, sizeof(*key_resources) * nkeys);
++      memset(pkeys, 0, sizeof(*pkeys) * nkeys);
+ 
+       /* get the public keys we are using to seal this data */
+       zend_hash_internal_pointer_reset_ex(pubkeysht, &pos);
+@@ -4958,7 +4959,7 @@ PHP_FUNCTION(openssl_seal)
+ 
+ clean_exit:
+       for (i=0; i<nkeys; i++) {
+-              if (key_resources[i] == -1) {
++              if (key_resources[i] == -1 && pkeys[i] != NULL) {
+                       EVP_PKEY_free(pkeys[i]);
+               }
+               if (eks[i]) { 
+diff --git a/ext/openssl/tests/bug71475.phpt b/ext/openssl/tests/bug71475.phpt
+new file mode 100644
+index 0000000..680753d
+--- /dev/null
++++ b/ext/openssl/tests/bug71475.phpt
+@@ -0,0 +1,16 @@
++--TEST--
++Bug #71475: openssl_seal() uninitialized memory usage
++--SKIPIF--
++<?php 
++if (!extension_loaded("openssl")) die("skip openssl not loaded");
++?>
++--FILE--
++<?php
++$_ = str_repeat("A", 512);
++openssl_seal($_, $_, $_, array_fill(0,64,0));
++?>
++DONE
++--EXPECTF--
++
++Warning: openssl_seal(): not a public key (1th member of pubkeys) in %s/bug71475.php on line %d
++DONE
+\ No newline at end of file

diff --git a/php.spec b/php.spec
index 1826c93914b26154707e9a42f83b9f5600e3da05..82a7c5276ff8c0bc26d5327d5c7fd4b9702fe734 100644 (file)
--- a/php.spec
+++ b/php.spec
@@ -112,7 +112,7 @@ ERROR: You need to select at least one Apache SAPI to build shared modules.
 %define                magic_mime      /usr/share/misc/magic.mime
 %endif
 
-%define                rel     15
+%define                rel     16
 %define                orgname php
 %define                ver_suffix 52
 %define                php_suffix %{!?with_default_php:%{ver_suffix}}
@@ -209,6 +209,7 @@ Patch57:    php-php_dl.patch
 Patch58:       php-svn-281516.patch
 Patch59:       %{orgname}-systzdata.patch
 Patch60:       bug-60986.patch
+Patch61:       php-bug-71475.patch
 # http://spot.fedorapeople.org/php-5.3.6-libzip.patch
 Patch65:       system-libzip.patch
 Patch66:       bug-47930.patch
@@ -1936,6 +1937,7 @@ done
 %patch58 -p4
 %patch59 -p1
 %patch60 -p4
+%patch61 -p1
 %{?with_system_libzip:%patch65 -p1}
 %patch66 -p2
 %patch67 -p1