Pullup ticket #2721 - requested by adrianp

php5: security update

Revisions pulled up:
- lang/php5/MESSAGE.suhosin			1.1 via patch
- lang/php5/Makefile				1.71 via patch
- lang/php5/Makefile.common			1.35
- lang/php5/Makefile.php			1.33-1.34
- lang/php5/PLIST				1.21
- lang/php5/distinfo				1.61-1.62
- lang/php5/patches/patch-an			patch
- lang/php5/patches/patch-ar			patch
- lang/php5/patches/patch-as			delete
---
Module Name:	pkgsrc
Committed By:	adrianp
Date:		Mon Mar  2 22:52:17 UTC 2009

Modified Files:
	pkgsrc/lang/php5: Makefile Makefile.common Makefile.php PLIST distinfo
Removed Files:
	pkgsrc/lang/php5/patches: patch-as

Log Message:
The PHP development team would like to announce the immediate availability of PHP 5.2.9. This release focuses on improving the stability of the PHP 5.2.x branch with over 50 bug fixes, several of which are security related. All users of PHP are encouraged to upgrade to this release.

Security Enhancements and Fixes in PHP 5.2.9:

    * Fixed security issue in imagerotate(), background colour isn't validated correctly with a non truecolour image. Reported by Hamid Ebadi, APA Laboratory (Fixes CVE-2008-5498). (Scott)
    * Fixed a crash on extract in zip when files or directories entry names contain a relative path. (Pierre)
    * Fixed explode() behavior with empty string to respect negative limit. (Shire)
    * Fixed a segfault when malformed string is passed to json_decode(). (Scott)

Key enhancements in PHP 5.2.9 include:

    * Added optional sorting type flag parameter to array_unique(). Default is SORT_REGULAR. (Andrei)
    * Fixed bug #45996 (libxml2 2.7 causes breakage with character data in xml_parse()). (Rob)
    * A number of fixes in the mbstring extension (Moriyoshi)
    * Fixed bug #44336 (Improve pcre UTF-8 string matching performance). (frode at coretrek dot com, Nuno)
    * Fixed bug #46699 (xml_parse crash when parser is namespace aware). (Rob)
    * Fixed bug #46748 (Segfault when an SSL error has more than one error). (Scott)
    * Fixed bug #46889 (Memory leak in strtotime()). (Derick)
    * Fixed bug #47049 (SoapClient::__soapCall causes a segmentation fault). (Dmitry)
    * Fixed bug #47165 (Possible memory corruption when passing return value by reference). (Dmitry)
    * Fixed bug #47282 (FILTER_VALIDATE_EMAIL is marking valid email addresses as invalid). (Ilia)
    * Fixed bug #47422 (modulus operator returns incorrect results on 64 bit linux). (Matt)
    * Over 50 bug fixes.
---
Module Name:	pkgsrc
Committed By:	adrianp
Date:		Thu Mar  5 23:22:24 UTC 2009

Modified Files:
	pkgsrc/lang/php5: Makefile.php distinfo

Log Message:
Add back suhosin patch as a new one for 5.2.9 is out

9 files changed, 111 insertions, 44 deletions

diff --git a/lang/php5/MESSAGE.suhosin b/lang/php5/MESSAGE.suhosin
new file mode 100644
index 00000000000..a6b3cfb64bf
--- /dev/null
+++ b/lang/php5/MESSAGE.suhosin
@@ -0,0 +1,7 @@
+===========================================================================
+$NetBSD: MESSAGE.suhosin,v 1.1.2.2 2009/03/15 19:21:22 tron Exp $
+
+As you have chosen to install the Suhosin patch you may also want to
+install the Suhosin extension which can be found in security/php-suhosin.
+
+===========================================================================
diff --git a/lang/php5/Makefile b/lang/php5/Makefile
index df220f05c62..287be716d3f 100644
--- a/lang/php5/Makefile
+++ b/lang/php5/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.69 2008/12/10 19:37:01 adrianp Exp $
+# $NetBSD: Makefile,v 1.69.2.1 2009/03/15 19:21:22 tron Exp $
 
 PKGNAME=		php-${PHP_BASE_VERS}
 CATEGORIES=		lang
diff --git a/lang/php5/Makefile.common b/lang/php5/Makefile.common
index 66778f2721b..9d3d11d98aa 100644
--- a/lang/php5/Makefile.common
+++ b/lang/php5/Makefile.common
@@ -1,5 +1,15 @@
-# $NetBSD: Makefile.common,v 1.33 2008/12/10 19:37:01 adrianp Exp $
+# $NetBSD: Makefile.common,v 1.33.2.1 2009/03/15 19:21:22 tron Exp $
 # used by lang/php5/Makefile.php
+# used by lang/php/ext.mk
+
+#
+# NOTE:
+# The suhosin option includes a patch from http://www.hardened-php.net/
+# Which tracks with the exact version number of PHP.  There may be a delay
+# in the patch which can leave the option broken until an updated patch
+# is released.  When updating PHP please don't forget to update the
+# distnfo with the details of the suhosin patch as well.
+#
 
 .if !defined(DISTNAME)
 DISTNAME=		php-${PHP_BASE_VERS}
@@ -16,7 +26,7 @@ EXTRACT_SUFX?=		.tar.bz2
 MAINTAINER?=		jdolecek@NetBSD.org
 HOMEPAGE?=		http://www.php.net/
 
-PHP_BASE_VERS=		5.2.8
+PHP_BASE_VERS=		5.2.9
 
 PHP_EXTENSION_DIR=	lib/php/20040412
 PLIST_SUBST+=		PHP_EXTENSION_DIR=${PHP_EXTENSION_DIR:Q}
diff --git a/lang/php5/Makefile.php b/lang/php5/Makefile.php
index c77e663e0a0..556656c7e2f 100644
--- a/lang/php5/Makefile.php
+++ b/lang/php5/Makefile.php
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.php,v 1.29 2008/08/17 18:36:50 adrianp Exp $
+# $NetBSD: Makefile.php,v 1.29.6.1 2009/03/15 19:21:22 tron Exp $
 #
 
 .include "../../lang/php5/Makefile.common"
@@ -10,6 +10,7 @@ USE_LIBTOOL=		YES
 USE_LANGUAGES=		c c++
 GNU_CONFIGURE=		YES
 BUILD_DEFS+=		VARBASE
+PLIST_VARS+=		suhosin
 
 CONFIGURE_ENV+=		EXTENSION_DIR="${PREFIX}/${PHP_EXTENSION_DIR}"
 
@@ -41,7 +42,7 @@ CONFIGURE_ARGS+=	--with-libxml-dir=${PREFIX:Q}
 # Note: This expression is the same as ${PKGBASE}, but the latter is
 # not defined yet, so we cannot use it here.
 PKG_OPTIONS_VAR=	PKG_OPTIONS.${PKGNAME:C/-[0-9].*//}
-PKG_SUPPORTED_OPTIONS+=	inet6 ssl maintainer-zts
+PKG_SUPPORTED_OPTIONS+=	inet6 ssl maintainer-zts suhosin
 PKG_SUGGESTED_OPTIONS+=	ssl
 
 SUBST_CLASSES+=		ini
@@ -53,6 +54,23 @@ SUBST_MESSAGE.ini=	Fixing default ini files.
 
 .include "../../mk/bsd.options.mk"
 
+.if !empty(PKG_OPTIONS:Msuhosin)
+SUHOSIN_PHPVER=		5.2.9
+. if ${SUHOSIN_PHPVER} != ${PHP_BASE_VERS}
+PKG_FAIL_REASON+=	"The suhosin patch is currently not available for"
+PKG_FAIL_REASON+=	"this version of PHP.  You may have to wait until"
+PKG_FAIL_REASON+=	"an updated patch is released or temporarily"
+PKG_FAIL_REASON+=	"build this package without the suhosin option."
+. else
+PATCH_SITES=		http://download.suhosin.org/
+PATCHFILES+=		suhosin-patch-${SUHOSIN_PHPVER}-0.9.7.patch.gz
+PATCH_DIST_STRIP=	-p1
+PLIST.suhosin=		yes
+MESSAGE_SRC=		${.CURDIR}/../../lang/php5/MESSAGE
+MESSAGE_SRC+=		${.CURDIR}/../../lang/php5/MESSAGE.suhosin
+. endif
+.endif
+
 .if !empty(PKG_OPTIONS:Minet6)
 CONFIGURE_ARGS+=	--enable-ipv6
 .else
@@ -61,7 +79,12 @@ CONFIGURE_ARGS+=	--disable-ipv6
 
 .if !empty(PKG_OPTIONS:Mssl)
 .  include "../../security/openssl/buildlink3.mk"
+.  if ${OPSYS} == "SunOS"
+CONFIGURE_ARGS+=	--with-openssl=yes
+LIBS.SunOS+=		-lcrypto
+.  else
 CONFIGURE_ARGS+=	--with-openssl=${BUILDLINK_PREFIX.openssl}
+.  endif
 .else
 CONFIGURE_ARGS+=	--without-openssl
 .endif
diff --git a/lang/php5/PLIST b/lang/php5/PLIST
index cbaf714f167..515499ba914 100644
--- a/lang/php5/PLIST
+++ b/lang/php5/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.19 2008/12/10 19:37:01 adrianp Exp $
+@comment $NetBSD: PLIST,v 1.19.2.1 2009/03/15 19:21:22 tron Exp $
 bin/php
 bin/php-config
 bin/phpize
@@ -87,7 +87,6 @@ include/php/ext/pcre/pcrelib/pcre.h
 include/php/ext/pcre/pcrelib/pcre_internal.h
 include/php/ext/pcre/pcrelib/pcreposix.h
 include/php/ext/pcre/pcrelib/ucp.h
-include/php/ext/pcre/pcrelib/ucptable.h
 include/php/ext/pcre/php_pcre.h
 include/php/ext/session/mod_files.h
 include/php/ext/session/mod_user.h
@@ -201,6 +200,9 @@ include/php/main/streams/php_stream_transport.h
 include/php/main/streams/php_stream_userspace.h
 include/php/main/streams/php_streams_int.h
 include/php/main/win95nt.h
+${PLIST.suhosin}include/php/main/suhosin_globals.h
+${PLIST.suhosin}include/php/main/suhosin_logo.h
+${PLIST.suhosin}include/php/main/suhosin_patch.h
 include/php/regex/cclass.h
 include/php/regex/cname.h
 include/php/regex/regex.h
diff --git a/lang/php5/distinfo b/lang/php5/distinfo
index b7887cb0e0a..0c1c754e0ca 100644
--- a/lang/php5/distinfo
+++ b/lang/php5/distinfo
@@ -1,15 +1,18 @@
-$NetBSD: distinfo,v 1.56.2.2 2009/02/26 13:49:24 tron Exp $
+$NetBSD: distinfo,v 1.56.2.3 2009/03/15 19:21:22 tron Exp $
 
-SHA1 (php-5.2.8/php-5.2.8.tar.bz2) = d285636144e0a4aa61195793634807e763c63dc3
-RMD160 (php-5.2.8/php-5.2.8.tar.bz2) = d38fe5d918c335089a027600a93d950f417a7e98
-Size (php-5.2.8/php-5.2.8.tar.bz2) = 9827180 bytes
+SHA1 (php-5.2.9/php-5.2.9.tar.bz2) = 1c738dbd7e3f8d723b6ce2e0fbc90a69e249f5f0
+RMD160 (php-5.2.9/php-5.2.9.tar.bz2) = fc2b316ff05462667704027cf2a1a4ac0a238422
+Size (php-5.2.9/php-5.2.9.tar.bz2) = 10203122 bytes
+SHA1 (php-5.2.9/suhosin-patch-5.2.9-0.9.7.patch.gz) = 4197644330a4f182f4dd64beb9db29406ed300ca
+RMD160 (php-5.2.9/suhosin-patch-5.2.9-0.9.7.patch.gz) = 1d2e01a935c4bbc9e858796f8f6004b4f75950b3
+Size (php-5.2.9/suhosin-patch-5.2.9-0.9.7.patch.gz) = 23026 bytes
 SHA1 (patch-aa) = 20bc3831e435182d014b11ae9f1f6c537a21af20
 SHA1 (patch-ad) = b324c33b1e70adee5b89dcecdd7690dcadcc18ec
 SHA1 (patch-ag) = 4ccb67ba6f5370b1d16b087e3e714de3e5ae604e
 SHA1 (patch-ah) = c7cbd4b9ea0796ea3b7491c2cffb6ddddc518587
 SHA1 (patch-aj) = 54812097499c81e5cb0196ab949cc86a4f24a9cc
 SHA1 (patch-al) = 0ee37782cc0d3bf5ede1a583de0589c2c1316b50
-SHA1 (patch-an) = d0578fa2d00932d6b5d97dfff525f4c0f9586bd5
+SHA1 (patch-an) = 8f4174627b8cb5f8bfbc59413c95f71e26b9e602
 SHA1 (patch-ap) = 5eb0e0e4244a993da93e36f8fcb5553454207fce
 SHA1 (patch-aq) = 0c9d48547da2fa80aa8357d23ad8505d1c0330df
-SHA1 (patch-as) = 7612bf91fe04d980a41dbb0ea652fd50d3b5cebb
+SHA1 (patch-ar) = 2d74ec926cc00bfbb67d16210af78c33ad9ac38d
diff --git a/lang/php5/patches/patch-an b/lang/php5/patches/patch-an
index 9b170275bc8..ebe448657de 100644
--- a/lang/php5/patches/patch-an
+++ b/lang/php5/patches/patch-an
@@ -1,8 +1,8 @@
-$NetBSD: patch-an,v 1.6 2008/10/28 07:07:59 adam Exp $
+$NetBSD: patch-an,v 1.6.2.1 2009/03/15 19:21:22 tron Exp $
 
---- configure.orig	2008-04-30 20:37:32.000000000 +0200
+--- configure.orig	2008-12-07 11:31:12.000000000 -0800
 +++ configure
-@@ -12437,7 +12437,7 @@ EOF
+@@ -12471,7 +12471,7 @@ EOF
  
      echo "$ac_t""$PHP_PATH_INFO_CHECK" 1>&6
  
@@ -11,7 +11,43 @@ $NetBSD: patch-an,v 1.6 2008/10/28 07:07:59 adam Exp $
      
    PHP_SAPI=cgi
    
-@@ -107515,12 +107515,7 @@ old_CC=$CC
+@@ -21467,7 +21467,7 @@ fi
+     if test "$found_openssl" = "no"; then
+   
+     if test "$PHP_OPENSSL_DIR" = "yes"; then
+-      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl"
++      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl /"
+     fi
+ 
+     for i in $PHP_OPENSSL_DIR; do
+@@ -34588,7 +34588,7 @@ fi
+     if test "$found_openssl" = "no"; then
+   
+     if test "$PHP_OPENSSL_DIR" = "yes"; then
+-      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl"
++      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl /"
+     fi
+ 
+     for i in $PHP_OPENSSL_DIR; do
+@@ -48878,7 +48878,7 @@ fi
+     if test "$found_openssl" = "no"; then
+   
+     if test "$PHP_OPENSSL_DIR" = "yes"; then
+-      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl"
++      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl /"
+     fi
+ 
+     for i in $PHP_OPENSSL_DIR; do
+@@ -87996,7 +87996,7 @@ fi
+     if test "$found_openssl" = "no"; then
+   
+     if test "$PHP_OPENSSL_DIR" = "yes"; then
+-      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl"
++      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl /"
+     fi
+ 
+     for i in $PHP_OPENSSL_DIR; do
+@@ -108297,12 +108297,7 @@ old_CC=$CC
  if test "$PHP_THREAD_SAFETY" = "yes" && test -n "$ac_cv_pthreads_cflags"; then
    CXXFLAGS="$CXXFLAGS $ac_cv_pthreads_cflags"
    INLINE_CFLAGS="$INLINE_CFLAGS $ac_cv_pthreads_cflags"
diff --git a/lang/php5/patches/patch-ar b/lang/php5/patches/patch-ar
new file mode 100644
index 00000000000..09d5bbebb5f
--- /dev/null
+++ b/lang/php5/patches/patch-ar
@@ -0,0 +1,13 @@
+$NetBSD: patch-ar,v 1.4.12.1 2009/03/15 19:21:22 tron Exp $
+
+--- acinclude.m4.orig	2008-09-08 03:24:38.000000000 -0700
++++ acinclude.m4
+@@ -2332,7 +2332,7 @@ AC_DEFUN([PHP_SETUP_OPENSSL],[
+   if test "$found_openssl" = "no"; then
+   
+     if test "$PHP_OPENSSL_DIR" = "yes"; then
+-      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl"
++      PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl /"
+     fi
+ 
+     for i in $PHP_OPENSSL_DIR; do
diff --git a/lang/php5/patches/patch-as b/lang/php5/patches/patch-as
deleted file mode 100644
index aa8ec604cca..00000000000
--- a/lang/php5/patches/patch-as
+++ /dev/null
@@ -1,27 +0,0 @@
-$NetBSD: patch-as,v 1.3.20.1 2009/02/26 13:43:59 tron Exp $
-
-Fix memory leak and pullup bug fix for http://bugs.php.net/bug.php?id=46918
-
-Remove this patch when PHP >= 5.2.9 is released as it will contain these
-changes
-
---- ext/imap/php_imap.c.orig	2009-02-24 17:45:27.000000000 +0000
-+++ ext/imap/php_imap.c	2009-02-24 17:47:14.000000000 +0000
-@@ -2172,7 +2172,7 @@
- 
- 	/* rfc822_parse_adrlist() modifies passed string. Copy it. */
- 	str_copy = estrndup(Z_STRVAL_PP(str), Z_STRLEN_PP(str));
--	rfc822_parse_adrlist(&env->to, str_copy, defaulthost);
-+	rfc822_parse_adrlist(&env->to, str_copy, Z_STRVAL_PP(defaulthost));
- 	efree(str_copy);
- 
- 	array_init(return_value);
-@@ -2196,6 +2196,8 @@
- 		}
- 		add_next_index_object(return_value, tovals TSRMLS_CC);
- 	} while ((addresstmp = addresstmp->next));
-+	
-+	mail_free_envelope(&env);
- }
- /* }}} */
-