packages/php
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!18 Fix the CVE-2020-7068

Browse Source 
From: @kang_xiao_qiang
Reviewed-by: @small_leek
Signed-off-by: @small_leek
This commit is contained in:
openeuler-ci-bot 2020-09-21 20:13:02 +08:00 committed by Gitee
commit 6babe6f5a9
2 changed files with 31 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
CVE-2020-7068.patch Normal file
View File

@ -0,0 +1,26 @@
From 7355ab81763a3d6a04ac11660e6a16d58838d187 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker"<cmbecker69@gmx.de>
Date: Tue, 14 Jul 2020 17:04:24 +0200
Subject: [PATCH] Fix #79797: Use of freed hash key in the
phar_parse_zipfile funtion
---
ext/phar/zip.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ext/phar/zip.c b/ext/phar/zip.c
index d615e8ad..50c5d69e 100644
--- a/ext/phar/zip.c
+++ b/ext/phar/zip.c
@@ -703,7 +703,7 @@ foundit:
efree(actual_alias);
}
- zend_hash_str_add_ptr(&(PHAR_G(phar_alias_map)), actual_alias, mydata->alias_len, mydata);
+ zend_hash_str_add_ptr(&(PHAR_G(phar_alias_map)), mydata->alias, mydata->alias_len, mydata);
} else {
phar_archive_data *fd_ptr;
--
2.23.0

6
php.spec
View File

@ -28,7 +28,7 @@
Name: php
Version: %{upver}%{?rcver:~%{rcver}}
Release: 5
Release: 6
Summary: PHP scripting language for creating dynamic web sites
License: PHP and Zend and BSD and MIT and ASL 1.0 and NCSA
URL: http://www.php.net/
@ -92,6 +92,7 @@ Patch6021: CVE-2019-6977.patch
Patch6022: CVE-2020-7064.patch
Patch6023: CVE-2020-7066.patch
Patch6024: CVE-2019-11048.patch
Patch6025: CVE-2020-7068.patch
BuildRequires: bzip2-devel, curl-devel >= 7.9, httpd-devel >= 2.0.46-1, pam-devel, httpd-filesystem, nginx-filesystem
BuildRequires: libstdc++-devel, openssl-devel, sqlite-devel >= 3.6.0, zlib-devel, smtpdaemon, libedit-devel
@ -1152,6 +1153,9 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || :
%changelog
* Mon Sep 21 2020 shaoqiang kang <kangshaoqiang1@huawei.com> - 7.2.10-6
- Fix CVE-2020-7068
* Tue Jul 21 2020 wangyue <wangyue92@huawei.com> - 7.2.10-5
- Type:cves
- ID:CVE-2019-11048