From 1b0276fe6ee03eda5d27fc57be15e92865e3207d Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: May 20 2020 11:05:50 +0000
Subject: import php-5.4.16-48.el7


---

diff --git a/SOURCES/php-5.4.16-CVE-2019-11043.patch b/SOURCES/php-5.4.16-CVE-2019-11043.patch
new file mode 100644
index 0000000..b70a56d
--- /dev/null
+++ b/SOURCES/php-5.4.16-CVE-2019-11043.patch
@@ -0,0 +1,33 @@
+Backported for 5.4 from:
+
+
+
+From c69bcb212b37900fd61daaf38762e4974cb4dcc9 Mon Sep 17 00:00:00 2001
+From: Jakub Zelenka <bukka@php.net>
+Date: Sat, 12 Oct 2019 15:56:16 +0100
+Subject: [PATCH 1/2] Fix bug #78599 (env_path_info underflow can lead to RCE)
+ (CVE-2019-11043)
+
+cheery-picked from ab061f95ca966731b1c84cf5b7b20155c0a1c06a
+without the test as tester not available
+---
+ sapi/fpm/fpm/fpm_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sapi/fpm/fpm/fpm_main.c b/sapi/fpm/fpm/fpm_main.c
+index d12ac01859..22b889c167 100644
+--- a/sapi/fpm/fpm/fpm_main.c
++++ b/sapi/fpm/fpm/fpm_main.c
+@@ -1210,8 +1210,8 @@ static void init_request_info(TSRMLS_D)
+ 								path_info = script_path_translated + ptlen;
+ 								tflag = (slen != 0 && (!orig_path_info || strcmp(orig_path_info, path_info) != 0));
+ 							} else {
+-								path_info = env_path_info ? env_path_info + pilen - slen : NULL;
+-								tflag = (orig_path_info != path_info);
++								path_info = (env_path_info && pilen > slen) ? env_path_info + pilen - slen : NULL;
++								tflag = path_info && (orig_path_info != path_info);
+ 							}
+ 
+ 							if (tflag) {
+
+
diff --git a/SPECS/php.spec b/SPECS/php.spec
index 8a2767b..a6c0adf 100644
--- a/SPECS/php.spec
+++ b/SPECS/php.spec
@@ -69,7 +69,7 @@
 Summary: PHP scripting language for creating dynamic web sites
 Name: php
 Version: 5.4.16
-Release: 47%{?dist}
+Release: 48%{?dist}
 # All files licensed under PHP version 3.01, except
 # Zend is licensed under Zend
 # TSRM is licensed under BSD
@@ -217,6 +217,7 @@ Patch163: php-5.4.16-CVE-2018-5784.patch
 Patch164: php-5.4.16-CVE-2019-9024.patch
 Patch165: php-5.4.16-CVE-2018-5712.patch
 Patch166: php-5.4.16-CVE-2018-10547.patch
+Patch167: php-5.4.16-CVE-2019-11043.patch
 
 
 BuildRequires: bzip2-devel, curl-devel >= 7.9, gmp-devel
@@ -804,6 +805,7 @@ support for using the enchant library to PHP.
 %patch164 -p1 -b .cve9024
 %patch165 -p1 -b .cve5712
 %patch166 -p1 -b .cve10547
+%patch167 -p1 -b .cve11043
 
 
 # Prevent %%doc confusion over LICENSE files
@@ -1575,6 +1577,9 @@ fi
 
 
 %changelog
+* Tue Oct 29 2019 Remi Collet <rcollet@redhat.com> - 5.4.16-48
+- fix underflow in env_path_info in fpm_main.c CVE-2019-11043
+
 * Wed Aug 21 2019 Remi Collet <rcollet@redhat.com> - 5.4.16-47
 - fix stack-buffer-overflow while parsing HTTP response CVE-2018-7584
 - fix out-of-bounds read in base64_decode_xmlrpc CVE-2019-9024