diff --git a/SOURCES/php-5.4.16-CVE-2016-10167.patch b/SOURCES/php-5.4.16-CVE-2016-10167.patch new file mode 100644 index 0000000..6df0a22 --- /dev/null +++ b/SOURCES/php-5.4.16-CVE-2016-10167.patch @@ -0,0 +1,47 @@ +Fix for CVE-2017-10168 +Backported for 5.4 without test and binary patch + + +From f1b2afc9d9e77edf41804f5dfc4e2069d8a12975 Mon Sep 17 00:00:00 2001 +From: "Christoph M. Becker" +Date: Tue, 16 Aug 2016 18:23:36 +0200 +Subject: [PATCH] Fix #73868: DOS vulnerability in gdImageCreateFromGd2Ctx() + +We must not pretend that there are image data if there are none. Instead +we fail reading the image file gracefully. + +(cherry picked from commit cdb648dc4115ce0722f3cc75e6a65115fc0e56ab) +--- + ext/gd/libgd/gd_gd2.c | 8 ++++++-- + ext/gd/tests/bug73868.gd2 | Bin 0 -> 1050 bytes + ext/gd/tests/bug73868.phpt | 18 ++++++++++++++++++ + 3 files changed, 24 insertions(+), 2 deletions(-) + create mode 100644 ext/gd/tests/bug73868.gd2 + create mode 100644 ext/gd/tests/bug73868.phpt + +diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c +index d06f328..196b785 100644 +--- a/ext/gd/libgd/gd_gd2.c ++++ b/ext/gd/libgd/gd_gd2.c +@@ -334,12 +334,16 @@ gdImagePtr gdImageCreateFromGd2Ctx (gdIOCtxPtr in) + for (x = xlo; x < xhi; x++) { + if (im->trueColor) { + if (!gdGetInt(&im->tpixels[y][x], in)) { +- im->tpixels[y][x] = 0; ++ php_gd_error("gd2: EOF while reading\n"); ++ gdImageDestroy(im); ++ return NULL; + } + } else { + int ch; + if (!gdGetByte(&ch, in)) { +- ch = 0; ++ php_gd_error("gd2: EOF while reading\n"); ++ gdImageDestroy(im); ++ return NULL; + } + im->pixels[y][x] = ch; + } +-- +2.1.4 + diff --git a/SOURCES/php-5.4.16-CVE-2016-10168.patch b/SOURCES/php-5.4.16-CVE-2016-10168.patch new file mode 100644 index 0000000..6e5b08e --- /dev/null +++ b/SOURCES/php-5.4.16-CVE-2016-10168.patch @@ -0,0 +1,45 @@ +Fix for CVE-2017-10168 +Backported for 5.4 without test and binary patch + + +From d2274b01cbbadf5516b3ea87ad76fbae18834007 Mon Sep 17 00:00:00 2001 +From: "Christoph M. Becker" +Date: Sat, 17 Dec 2016 17:06:58 +0100 +Subject: [PATCH] Fix #73869: Signed Integer Overflow gd_io.c + +GD2 stores the number of horizontal and vertical chunks as words (i.e. 2 +byte unsigned). These values are multiplied and assigned to an int when +reading the image, what can cause integer overflows. We have to avoid +that, and also make sure that either chunk count is actually greater +than zero. If illegal chunk counts are detected, we bail out from +reading the image. + +(cherry picked from commit 5b5d9db3988b829e0b121b74bb3947f01c2796a1) +--- + ext/gd/libgd/gd_gd2.c | 4 ++++ + ext/gd/tests/bug73869.phpt | 19 +++++++++++++++++++ + ext/gd/tests/bug73869a.gd2 | Bin 0 -> 92 bytes + ext/gd/tests/bug73869b.gd2 | Bin 0 -> 18 bytes + 4 files changed, 23 insertions(+) + create mode 100644 ext/gd/tests/bug73869.phpt + create mode 100644 ext/gd/tests/bug73869a.gd2 + create mode 100644 ext/gd/tests/bug73869b.gd2 + +diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c +index 196b785..3eba6b3 100644 +--- a/ext/gd/libgd/gd_gd2.c ++++ b/ext/gd/libgd/gd_gd2.c +@@ -136,6 +136,10 @@ static int _gd2GetHeader(gdIOCtxPtr in, int *sx, int *sy, int *cs, int *vers, in + GD2_DBG(php_gd_error("%d Chunks vertically", *ncy)); + + if (gd2_compressed(*fmt)) { ++ if (*ncx <= 0 || *ncy <= 0 || *ncx > INT_MAX / *ncy) { ++ GD2_DBG(printf ("Illegal chunk counts: %d * %d\n", *ncx, *ncy)); ++ goto fail1; ++ } + nc = (*ncx) * (*ncy); + GD2_DBG(php_gd_error("Reading %d chunk index entries", nc)); + if (overflow2(sizeof(t_chunk_info), nc)) { +-- +2.1.4 + diff --git a/SPECS/php.spec b/SPECS/php.spec index 7024bf6..78d0082 100644 --- a/SPECS/php.spec +++ b/SPECS/php.spec @@ -69,7 +69,7 @@ Summary: PHP scripting language for creating dynamic web sites Name: php Version: 5.4.16 -Release: 42%{?dist} +Release: 43%{?dist} # All files licensed under PHP version 3.01, except # Zend is licensed under Zend # TSRM is licensed under BSD @@ -204,6 +204,8 @@ Patch156: php-5.4.16-CVE-2016-5766.patch Patch157: php-5.4.16-CVE-2016-5767.patch Patch158: php-5.4.16-CVE-2016-5768.patch Patch159: php-5.4.16-CVE-2016-5399.patch +Patch160: php-5.4.16-CVE-2016-10167.patch +Patch161: php-5.4.16-CVE-2016-10168.patch BuildRequires: bzip2-devel, curl-devel >= 7.9, gmp-devel @@ -777,6 +779,8 @@ support for using the enchant library to PHP. %patch157 -p1 -b .cve5767 %patch158 -p1 -b .cve5768 %patch159 -p1 -b .cve5399 +%patch160 -p1 -b .cve10167 +%patch161 -p1 -b .cve10168 # Prevent %%doc confusion over LICENSE files @@ -1548,6 +1552,10 @@ fi %changelog +* Wed Oct 4 2017 Remi Collet - 5.4.16-43 +- gd: fix DoS vulnerability in gdImageCreateFromGd2Ctx() CVE-2016-10167 +- gd: Signed Integer Overflow gd_io.c CVE-2016-10168 + * Fri Aug 5 2016 Remi Collet - 5.4.16-42 - bz2: fix improper error handling in bzread() CVE-2016-5399