Skip to content

Commit 8f3f3b5

Browse files
ericmannericmann
authored
Merge pull request #22 from php/PHP-8.3.14-security
PHP 8.3.14 - security fixes
2 parents 673e8d1 + 1234971 commit 8f3f3b5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+2237
-58
lines changed

‎.github/actions/configure-macos/action.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ runs:
99
- shell: bash
1010
run: |
1111
set -x
12+
BREW_OPT="$(brew --prefix)"/opt
1213
export PATH="/usr/local/opt/bison/bin:$PATH"
1314
export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:/usr/local/opt/[email protected]/lib/pkgconfig"
1415
export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:/usr/local/opt/curl/lib/pkgconfig"
@@ -18,6 +19,7 @@ runs:
1819
export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:/usr/local/opt/libxslt/lib/pkgconfig"
1920
export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:/usr/local/opt/zlib/lib/pkgconfig"
2021
export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:/usr/local/opt/icu4c/lib/pkgconfig"
22+
sed -i -e 's/Requires.private:.*//g' "$BREW_OPT/curl/lib/pkgconfig/libcurl.pc"
2123
./buildconf --force
2224
./configure \
2325
CFLAGS="-Wno-strict-prototypes -Wno-unused-but-set-variable -Wno-single-bit-bitfield-constant-conversion" \

‎.github/workflows/labeler.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ permissions:
77

88
jobs:
99
triage:
10+
if: github.repository == 'php/php-src'
1011
permissions:
1112
pull-requests: write
1213
runs-on: ubuntu-latest

‎NEWS

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
3-
?? ??? ????, PHP 8.3.14
3+
21 Now 2024, PHP 8.3.14
44

5-
- Cli:
5+
- CLI:
66
. Fixed bug GH-16373 (Shebang is not skipped for router script in cli-server
77
started through shebang). (ilutov)
8+
. Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data
9+
Processing in CLI SAPI Interface). (nielsdos)
810

911
- COM:
1012
. Fixed out of bound writes to SafeArray data. (cmb)
@@ -79,10 +81,18 @@ PHP NEWS
7981
. Fixed segfaults and other issues related to operator overloading with
8082
GMP objects. (Girgias)
8183

84+
- LDAP:
85+
. Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932)
86+
(nielsdos)
87+
8288
- MBstring:
8389
. Fixed bug GH-16361 (mb_substr overflow on start/length arguments).
8490
(David Carlier)
8591

92+
- MySQLnd:
93+
. Fixed bug GHSA-h35g-vwh6-m678 (Leak partial content of the heap through
94+
heap buffer over-read). (CVE-2024-8929) (Jakub Zelenka)
95+
8696
- Opcache:
8797
. Fixed bug GH-16408 (Array to string conversion warning emitted in
8898
optimizer). (ilutov)
@@ -95,7 +105,15 @@ PHP NEWS
95105
. Fix various memory leaks on error conditions in openssl_x509_parse().
96106
(nielsdos)
97107

98-
- PDO_ODBC:
108+
- PDO DBLIB:
109+
. Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing
110+
OOB writes). (CVE-2024-11236) (nielsdos)
111+
112+
- PDO Firebird:
113+
. Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter
114+
causing OOB writes). (CVE-2024-11236) (nielsdos)
115+
116+
- PDO ODBC:
99117
. Fixed bug GH-16450 (PDO_ODBC can inject garbage into field values). (cmb)
100118

101119
- Phar:
@@ -141,6 +159,12 @@ PHP NEWS
141159
. Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with
142160
bail enabled). (ilutov)
143161

162+
- Streams:
163+
. Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context
164+
might allow for CRLF injection in URIs). (CVE-2024-11234) (Jakub Zelenka)
165+
. Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with
166+
convert.quoted-printable-decode filter). (CVE-2024-11233) (nielsdos)
167+
144168
- SysVMsg:
145169
. Fixed bug GH-16592 (msg_send() crashes when a type does not properly
146170
serialized). (David Carlier / cmb)

‎ext/intl/tests/bug62070_3.phpt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ Bug #62070: Collator::getSortKey() returns garbage
44
intl
55
--SKIPIF--
66
<?php if (version_compare(INTL_ICU_VERSION, '62.1') < 0) die('skip for ICU >= 62.1'); ?>
7+
<?php if (version_compare(INTL_ICU_VERSION, '76.1') >= 0) die('skip for ICU < 76.1'); ?>
78
--FILE--
89
<?php
910
$s1 = 'Hello';

‎ext/intl/tests/bug62070_icu76_1.phpt

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
Bug #62070: Collator::getSortKey() returns garbage
3+
--EXTENSIONS--
4+
intl
5+
--SKIPIF--
6+
<?php if (version_compare(INTL_ICU_VERSION, '76.1') < 0) die('skip for ICU >= 76.1'); ?>
7+
--FILE--
8+
<?php
9+
$s1 = 'Hello';
10+
11+
$coll = collator_create('en_US');
12+
$res = collator_get_sort_key($coll, $s1);
13+
14+
echo urlencode($res);
15+
?>
16+
--EXPECT--
17+
93AAG%01%09%01%DC%08

‎ext/intl/tests/collator_get_sort_key_variant7.phpt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ collator_get_sort_key() icu >= 62.1
44
intl
55
--SKIPIF--
66
<?php if (version_compare(INTL_ICU_VERSION, '62.1') < 0) die('skip for ICU >= 62.1'); ?>
7+
<?php if (version_compare(INTL_ICU_VERSION, '76.1') >= 0) die('skip for ICU < 76.1'); ?>
78
--FILE--
89
<?php
910

‎ext/intl/tests/collator_get_sort_key_variant_icu76_1.phpt

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
--TEST--
2+
collator_get_sort_key() icu >= 62.1
3+
--EXTENSIONS--
4+
intl
5+
--SKIPIF--
6+
<?php if (version_compare(INTL_ICU_VERSION, '76.1') < 0) die('skip for ICU >= 76.1'); ?>
7+
--FILE--
8+
<?php
9+
10+
/*
11+
* Get sort keys using various locales
12+
*/
13+
function sort_arrays( $locale, $data )
14+
{
15+
$res_str = '';
16+
17+
$coll = ut_coll_create( $locale );
18+
19+
foreach($data as $value) {
20+
$res_val = ut_coll_get_sort_key( $coll, $value );
21+
$res_str .= "source: ".$value."\n".
22+
"key: ".bin2hex($res_val)."\n";
23+
}
24+
25+
return $res_str;
26+
}
27+
28+
29+
function ut_main()
30+
{
31+
$res_str = '';
32+
33+
// Regular strings keys
34+
$test_params = array(
35+
'abc', 'abd', 'aaa',
36+
'аа', 'а', 'z',
37+
'', '3',
38+
'y' , 'i' , 'k'
39+
);
40+
41+
$res_str .= sort_arrays( 'en_US', $test_params );
42+
43+
// Sort a non-ASCII array using ru_RU locale.
44+
$test_params = array(
45+
'абг', 'абв', 'жжж', 'эюя'
46+
);
47+
48+
$res_str .= sort_arrays( 'ru_RU', $test_params );
49+
50+
// Sort an array using Lithuanian locale.
51+
$res_str .= sort_arrays( 'lt_LT', $test_params );
52+
53+
return $res_str . "\n";
54+
}
55+
56+
include_once( 'ut_common.inc' );
57+
ut_run();
58+
?>
59+
--EXPECT--
60+
source: abc
61+
key: 2b2d2f01070107
62+
source: abd
63+
key: 2b2d3101070107
64+
source: aaa
65+
key: 2b2b2b01070107
66+
source: аа
67+
key: 62060601060106
68+
source: а
69+
key: 620601050105
70+
source: z
71+
key: 5d01050105
72+
source:
73+
key: 0101
74+
source: 3
75+
key: 1801050105
76+
source: y
77+
key: 5b01050105
78+
source: i
79+
key: 3b01050105
80+
source: k
81+
key: 3f01050105
82+
source: абг
83+
key: 28060c1001070107
84+
source: абв
85+
key: 28060c0e01070107
86+
source: жжж
87+
key: 282c2c2c01070107
88+
source: эюя
89+
key: 28eef0f401070107
90+
source: абг
91+
key: 62060c1001070107
92+
source: абв
93+
key: 62060c0e01070107
94+
source: жжж
95+
key: 622c2c2c01070107
96+
source: эюя
97+
key: 62eef0f401070107

‎ext/intl/tests/locale_get_display_name8.phpt

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -317,14 +317,14 @@ disp_locale=fr : display_name=anglais #États-Unis, attribute=islamcal#
317317
disp_locale=de : display_name=Englisch #Vereinigte Staaten, attribute=islamcal#
318318
-----------------
319319
locale='zh-CN-a-myExt-x-private'
320-
disp_locale=en : display_name=Chinese #China, a=myext, Private-Use=private#
321-
disp_locale=fr : display_name=chinois #Chine, a=myext, usage privé=private#
322-
disp_locale=de : display_name=Chinesisch #China, a=myext, Privatnutzung=private#
320+
disp_locale=en : display_name=Chinese #China(, A_MYEXT_X_PRIVATE)?, a=myext, Private-Use=private#
321+
disp_locale=fr : display_name=chinois #Chine(, A_MYEXT_X_PRIVATE)?, a=myext, usage privé=private#
322+
disp_locale=de : display_name=Chinesisch #China(, A_MYEXT_X_PRIVATE)?, a=myext, Privatnutzung=private#
323323
-----------------
324324
locale='en-a-myExt-b-another'
325-
disp_locale=en : display_name=English #a=myext, b=another#
326-
disp_locale=fr : display_name=anglais #a=myext, b=another#
327-
disp_locale=de : display_name=Englisch #a=myext, b=another#
325+
disp_locale=en : display_name=English #(A_MYEXT_B_ANOTHER, )?a=myext, b=another#
326+
disp_locale=fr : display_name=anglais #(A_MYEXT_B_ANOTHER, )?a=myext, b=another#
327+
disp_locale=de : display_name=Englisch #(A_MYEXT_B_ANOTHER, )?a=myext, b=another#
328328
-----------------
329329
locale='de-419-DE'
330330
disp_locale=en : display_name=German #Latin America, DE#
@@ -337,7 +337,7 @@ disp_locale=fr : display_name=a #Allemagne#
337337
disp_locale=de : display_name=a #Deutschland#
338338
-----------------
339339
locale='ar-a-aaa-b-bbb-a-ccc'
340-
disp_locale=en : display_name=Arabic #a=aaa, b=bbb#
341-
disp_locale=fr : display_name=arabe #a=aaa, b=bbb#
342-
disp_locale=de : display_name=Arabisch #a=aaa, b=bbb#
340+
disp_locale=en : display_name=Arabic #(A_AAA_B_BBB_A_CCC, )?a=aaa, b=bbb#
341+
disp_locale=fr : display_name=arabe #(A_AAA_B_BBB_A_CCC, )?a=aaa, b=bbb#
342+
disp_locale=de : display_name=Arabisch #(A_AAA_B_BBB_A_CCC, )?a=aaa, b=bbb#
343343
-----------------

‎ext/intl/tests/locale_get_display_variant2.phpt

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -248,14 +248,14 @@ disp_locale=fr : display_variant=
248248
disp_locale=de : display_variant=
249249
-----------------
250250
locale='zh-CN-a-myExt-x-private'
251-
disp_locale=en : display_variant=
252-
disp_locale=fr : display_variant=
253-
disp_locale=de : display_variant=
251+
disp_locale=en : display_variant=(A_MYEXT_X_PRIVATE)?
252+
disp_locale=fr : display_variant=(A_MYEXT_X_PRIVATE)?
253+
disp_locale=de : display_variant=(A_MYEXT_X_PRIVATE)?
254254
-----------------
255255
locale='en-a-myExt-b-another'
256-
disp_locale=en : display_variant=(MYEXT_B_ANOTHER)?
257-
disp_locale=fr : display_variant=(MYEXT_B_ANOTHER)?
258-
disp_locale=de : display_variant=(MYEXT_B_ANOTHER)?
256+
disp_locale=en : display_variant=((A_)?MYEXT_B_ANOTHER)?
257+
disp_locale=fr : display_variant=((A_)?MYEXT_B_ANOTHER)?
258+
disp_locale=de : display_variant=((A_)?MYEXT_B_ANOTHER)?
259259
-----------------
260260
locale='de-419-DE'
261261
disp_locale=en : display_variant=DE
@@ -268,7 +268,7 @@ disp_locale=fr : display_variant=
268268
disp_locale=de : display_variant=
269269
-----------------
270270
locale='ar-a-aaa-b-bbb-a-ccc'
271-
disp_locale=en : display_variant=(AAA_B_BBB_A_CCC)?
272-
disp_locale=fr : display_variant=(AAA_B_BBB_A_CCC)?
273-
disp_locale=de : display_variant=(AAA_B_BBB_A_CCC)?
271+
disp_locale=en : display_variant=((A_)?AAA_B_BBB_A_CCC)?
272+
disp_locale=fr : display_variant=((A_)?AAA_B_BBB_A_CCC)?
273+
disp_locale=de : display_variant=((A_)?AAA_B_BBB_A_CCC)?
274274
-----------------

‎ext/intl/tests/timezone_IDforWindowsID_basic2.phpt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ IntlTimeZone::getIDForWindowsID basic test
44
intl
55
--SKIPIF--
66
<?php if (version_compare(INTL_ICU_VERSION, '58.1') < 0) die('skip for ICU >= 58.1'); ?>
7+
<?php if (version_compare(INTL_ICU_VERSION, '76.1') >= 0) die('skip for ICU <= 76.1'); ?>
78
--FILE--
89
<?php
910

‎ext/intl/tests/timezone_IDforWindowsID_basic_icu76_1.phpt

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
--TEST--
2+
IntlTimeZone::getIDForWindowsID basic test
3+
--EXTENSIONS--
4+
intl
5+
--SKIPIF--
6+
<?php if (version_compare(INTL_ICU_VERSION, '76.1') < 0) die('skip for ICU >= 76.1'); ?>
7+
--FILE--
8+
<?php
9+
10+
$tzs = array(
11+
'Gnomeregan' => array(NULL),
12+
'India Standard Time' => array(NULL),
13+
'Pacific Standard Time' => array('001', 'CA', 'MX', 'US', 'ZZ'),
14+
'Romance Standard Time' => array('001', 'BE', 'DK', 'ES', 'FR'),
15+
);
16+
17+
foreach ($tzs as $tz => $regions) {
18+
echo "** $tz\n";
19+
foreach ($regions as $region) {
20+
var_dump(IntlTimeZone::getIDForWindowsID($tz, $region));
21+
if (intl_get_error_code() != U_ZERO_ERROR) {
22+
echo "Error: ", intl_get_error_message(), "\n";
23+
}
24+
}
25+
}
26+
?>
27+
--EXPECTF--
28+
** Gnomeregan
29+
bool(false)
30+
Error: %snknown windows timezone: U_ILLEGAL_ARGUMENT_ERROR
31+
** India Standard Time
32+
string(13) "Asia/Calcutta"
33+
** Pacific Standard Time
34+
string(19) "America/Los_Angeles"
35+
string(17) "America/Vancouver"
36+
string(19) "America/Los_Angeles"
37+
string(19) "America/Los_Angeles"
38+
string(19) "America/Los_Angeles"
39+
** Romance Standard Time
40+
string(12) "Europe/Paris"
41+
string(15) "Europe/Brussels"
42+
string(17) "Europe/Copenhagen"
43+
string(13) "Europe/Madrid"
44+
string(12) "Europe/Paris"

‎ext/ldap/ldap.c

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3775,13 +3775,23 @@ static zend_string* php_ldap_do_escape(const bool *map, const char *value, size_
37753775
zend_string *ret;
37763776

37773777
for (i = 0; i < valuelen; i++) {
3778-
len += (map[(unsigned char) value[i]]) ? 3 : 1;
3778+
size_t addend = (map[(unsigned char) value[i]]) ? 3 : 1;
3779+
if (len > ZSTR_MAX_LEN - addend) {
3780+
return NULL;
3781+
}
3782+
len += addend;
37793783
}
37803784
/* Per RFC 4514, a leading and trailing space must be escaped */
37813785
if ((flags & PHP_LDAP_ESCAPE_DN) && (value[0] == ' ')) {
3786+
if (len > ZSTR_MAX_LEN - 2) {
3787+
return NULL;
3788+
}
37823789
len += 2;
37833790
}
37843791
if ((flags & PHP_LDAP_ESCAPE_DN) && ((valuelen > 1) && (value[valuelen - 1] == ' '))) {
3792+
if (len > ZSTR_MAX_LEN - 2) {
3793+
return NULL;
3794+
}
37853795
len += 2;
37863796
}
37873797

@@ -3848,7 +3858,13 @@ PHP_FUNCTION(ldap_escape)
38483858
php_ldap_escape_map_set_chars(map, ignores, ignoreslen, 0);
38493859
}
38503860

3851-
RETURN_NEW_STR(php_ldap_do_escape(map, value, valuelen, flags));
3861+
zend_string *result = php_ldap_do_escape(map, value, valuelen, flags);
3862+
if (UNEXPECTED(!result)) {
3863+
zend_argument_value_error(1, "is too long");
3864+
RETURN_THROWS();
3865+
}
3866+
3867+
RETURN_NEW_STR(result);
38523868
}
38533869

38543870
#ifdef STR_TRANSLATION

0 commit comments

Comments
 (0)