!96 22.03-LTS-Next: fix CVE-2022-31625 CVE-2022-31626
From: @hugel Reviewed-by: @overweight Signed-off-by: @overweight
This commit is contained in:
openeuler-ci-bot
Gitee
commit
f931e0f886
68
backport-CVE-2022-31625.patch
Normal file
68
backport-CVE-2022-31625.patch
Normal file
@ -0,0 +1,68 @@
|
||||
From 55f6895f4b4c677272fd4ee1113acdbd99c4b5ab Mon Sep 17 00:00:00 2001
|
||||
From: "Christoph M. Becker" <cmbecker69@gmx.de>
|
||||
Date: Tue, 17 May 2022 12:59:23 +0200
|
||||
Subject: [PATCH] Fix #81720: Uninitialized array in pg_query_params() leading
|
||||
to RCE
|
||||
|
||||
We must not free parameters which we haven't initialized yet.
|
||||
|
||||
We also fix the not directly related issue, that we checked for the
|
||||
wrong value being `NULL`, potentially causing a segfault.
|
||||
---
|
||||
ext/pgsql/pgsql.c | 6 +++---
|
||||
ext/pgsql/tests/bug81720.phpt | 27 +++++++++++++++++++++++++++
|
||||
2 files changed, 30 insertions(+), 3 deletions(-)
|
||||
create mode 100644 ext/pgsql/tests/bug81720.phpt
|
||||
|
||||
--- a/ext/pgsql/pgsql.c
|
||||
+++ b/ext/pgsql/pgsql.c
|
||||
@@ -1201,7 +1201,7 @@ PHP_FUNCTION(pg_query_params)
|
||||
} else {
|
||||
zend_string *param_str = zval_try_get_string(tmp);
|
||||
if (!param_str) {
|
||||
- _php_pgsql_free_params(params, num_params);
|
||||
+ _php_pgsql_free_params(params, i);
|
||||
RETURN_THROWS();
|
||||
}
|
||||
params[i] = estrndup(ZSTR_VAL(param_str), ZSTR_LEN(param_str));
|
||||
@@ -3918,8 +3918,8 @@ PHP_FUNCTION(pg_send_execute)
|
||||
params[i] = NULL;
|
||||
} else {
|
||||
zend_string *tmp_str = zval_try_get_string(tmp);
|
||||
- if (UNEXPECTED(!tmp)) {
|
||||
- _php_pgsql_free_params(params, num_params);
|
||||
+ if (UNEXPECTED(!tmp_str)) {
|
||||
+ _php_pgsql_free_params(params, i);
|
||||
return;
|
||||
}
|
||||
params[i] = estrndup(ZSTR_VAL(tmp_str), ZSTR_LEN(tmp_str));
|
||||
--- /dev/null
|
||||
+++ b/ext/pgsql/tests/bug81720.phpt
|
||||
@@ -0,0 +1,27 @@
|
||||
+--TEST--
|
||||
+Bug #81720 (Uninitialized array in pg_query_params() leading to RCE)
|
||||
+--SKIPIF--
|
||||
+<?php include("skipif.inc"); ?>
|
||||
+--FILE--
|
||||
+<?php
|
||||
+include('config.inc');
|
||||
+
|
||||
+$conn = pg_connect($conn_str);
|
||||
+
|
||||
+try {
|
||||
+ pg_query_params($conn, 'SELECT $1, $2', [1, new stdClass()]);
|
||||
+} catch (Throwable $ex) {
|
||||
+ echo $ex->getMessage(), PHP_EOL;
|
||||
+}
|
||||
+
|
||||
+try {
|
||||
+ pg_send_prepare($conn, "my_query", 'SELECT $1, $2');
|
||||
+ pg_get_result($conn);
|
||||
+ pg_send_execute($conn, "my_query", [1, new stdClass()]);
|
||||
+} catch (Throwable $ex) {
|
||||
+ echo $ex->getMessage(), PHP_EOL;
|
||||
+}
|
||||
+?>
|
||||
+--EXPECT--
|
||||
+Object of class stdClass could not be converted to string
|
||||
+Object of class stdClass could not be converted to string
|
||||
21
backport-CVE-2022-31626.patch
Normal file
21
backport-CVE-2022-31626.patch
Normal file
@ -0,0 +1,21 @@
|
||||
From 58006537fc5f133ae8549efe5118cde418b3ace9 Mon Sep 17 00:00:00 2001
|
||||
From: Stanislav Malyshev <smalyshev@gmail.com>
|
||||
Date: Mon, 6 Jun 2022 00:56:51 -0600
|
||||
Subject: [PATCH] Fix bug #81719: mysqlnd/pdo password buffer overflow
|
||||
|
||||
---
|
||||
ext/mysqlnd/mysqlnd_wireprotocol.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/ext/mysqlnd/mysqlnd_wireprotocol.c
|
||||
+++ b/ext/mysqlnd/mysqlnd_wireprotocol.c
|
||||
@@ -768,7 +768,8 @@ php_mysqlnd_change_auth_response_write(M
|
||||
MYSQLND_VIO * vio = conn->vio;
|
||||
MYSQLND_STATS * stats = conn->stats;
|
||||
MYSQLND_CONNECTION_STATE * connection_state = &conn->state;
|
||||
- zend_uchar * const buffer = pfc->cmd_buffer.length >= packet->auth_data_len? pfc->cmd_buffer.buffer : mnd_emalloc(packet->auth_data_len);
|
||||
+ size_t total_packet_size = packet->auth_data_len + MYSQLND_HEADER_SIZE;
|
||||
+ zend_uchar * const buffer = pfc->cmd_buffer.length >= total_packet_size? pfc->cmd_buffer.buffer : mnd_emalloc(total_packet_size);
|
||||
zend_uchar * p = buffer + MYSQLND_HEADER_SIZE; /* start after the header */
|
||||
|
||||
DBG_ENTER("php_mysqlnd_change_auth_response_write");
|
||||
7
php.spec
7
php.spec
@ -26,7 +26,7 @@
|
||||
|
||||
Name: php
|
||||
Version: %{upver}
|
||||
Release: 9
|
||||
Release: 10
|
||||
Summary: PHP scripting language for creating dynamic web sites
|
||||
License: PHP and Zend-2.0 and BSD and MIT and ASL 1.0 and NCSA
|
||||
URL: http://www.php.net/
|
||||
@ -70,6 +70,8 @@ Patch19: backport-Undef-slot-before-destroying-in-unset_property.patch
|
||||
Patch20: backport-Handle-ref-return-from-Iterator-key.patch
|
||||
Patch21: backport-Fix-return-by-ref-from-array_reduce-callback.patch
|
||||
Patch22: backport-CVE-2021-21708-Fix-81708.patch
|
||||
Patch23: backport-CVE-2022-31625.patch
|
||||
Patch24: backport-CVE-2022-31626.patch
|
||||
|
||||
BuildRequires: bzip2-devel, curl-devel >= 7.9, httpd-devel >= 2.0.46-1, pam-devel, httpd-filesystem, nginx-filesystem
|
||||
BuildRequires: libstdc++-devel, openssl-devel, sqlite-devel >= 3.6.0, zlib-devel, smtpdaemon, libedit-devel
|
||||
@ -1102,6 +1104,9 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || :
|
||||
|
||||
|
||||
%changelog
|
||||
* Sat Jun 18 2022 Hugel <gengqihu1@h-partners.com> - 8.0.0-10
|
||||
- Fix CVE-2022-31625 CVE-2022-31626
|
||||
|
||||
* Wed Mar 9 2022 panxiaohe <panxh.life@foxmail.com> - 8.0.0-9
|
||||
- Fix CVE-2021-21708
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user