Pullup ticket #4475 - requested by prlw1

lang/php53: security update

Revisions pulled up:
- lang/php/phpversion.mk                                        1.69 via patch
- lang/php53/Makefile                                           1.49
- lang/php53/Makefile.php                                       1.41
- lang/php53/distinfo                                           1.75-1.76
- lang/php53/patches/patch-Zend_zend_language_parser.h          deleted
- lang/php53/patches/patch-ext_date_lib_parse__iso__intervals.c deleted
- lang/php53/patches/patch-ext_date_lib_parse__iso__intervals.re deleted

---
   Module Name:	pkgsrc
   Committed By:	prlw1
   Date:		Mon Jul 28 16:12:57 UTC 2014

   Modified Files:
   	pkgsrc/lang/php53: distinfo
   Added Files:
   	pkgsrc/lang/php53/patches: patch-Zend_zend_language_parser.h

   Log Message:
   Fix build of www/ap-php with PHP 5.3.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Fri Aug 15 16:09:16 UTC 2014

   Modified Files:
   	pkgsrc/lang/php: phpversion.mk
   	pkgsrc/lang/php53: Makefile Makefile.php distinfo
   Removed Files:
   	pkgsrc/lang/php53/patches: patch-Zend_zend_language_parser.h
   	    patch-ext_date_lib_parse__iso__intervals.c
   	    patch-ext_date_lib_parse__iso__intervals.re

   Log Message:
   Update php53 to 5.3.29, final PHP 5.3 release.

   14 Aug 2014, PHP 5.3.29

   - Core:
     . Fixed bug #66127 (Segmentation fault with ArrayObject unset). (Stas)
     . Fixed bug #67247 (spl_fixedarray_resize integer overflow). (Stas)
     . Fixed bug #67249 (printf out-of-bounds read). (Stas)
     . Fixed bug #67250 (iptcparse out-of-bounds read). (Stas)
     . Fixed bug #67252 (convert_uudecode out-of-bounds read). (Stas)
     . Fixed bug #67359 (Segfault in recursiveDirectoryIterator). (Laruence)
     . Fixed bug #67390 (insecure temporary file use in the configure script).
       (Remi) (CVE-2014-3981)
     . Fixed bug #67399 (putenv with empty variable may lead to crash). (Stas)
     . Fixed bug #67492 (unserialize() SPL ArrayObject / SPLObjectStorage Type
       Confusion) (CVE-2014-3515). (Stefan Esser)
     . Fixed bug #67498 (phpinfo() Type Confusion Information Leak Vulnerability).
       (Stefan Esser)

   - COM:
     . Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas).

   - Date:
     . Fixed bug #66060 (Heap buffer over-read in DateInterval). (CVE-2013-6712)
       (Remi)
     . Fixed bug #67251 (date_parse_from_format out-of-bounds read). (Stas)
     . Fixed bug #67253 (timelib_meridian_with_check out-of-bounds read). (Stas)

   - Exif:
     . Fixed bug #65873 (Integer overflow in exif_read_data()). (Stas)

   - Fileinfo:
     . Fixed bug #66307 (Fileinfo crashes with powerpoint files). (Anatol)
     . Fixed bug #67326 (fileinfo: cdf_read_short_sector insufficient boundary
       check). (CVE-2014-0207)
     . Fixed bug #67327 (fileinfo: CDF infinite loop in nelements DoS).
       (CVE-2014-0238)
     . Fixed bug #67328 (fileinfo: fileinfo: numerous file_printf calls resulting
       in performance degradation). (CVE-2014-0237)
     . Fixed bug #67410 (fileinfo: mconvert incorrect handling of truncated pascal
       string size). (Francisco Alonso, Jan Kaluza, Remi)
     . Fixed bug #67411 (fileinfo: cdf_check_stream_offset insufficient boundary
       check). (Francisco Alonso, Jan Kaluza, Remi)
     . Fixed bug #67412 (fileinfo: cdf_count_chain insufficient boundary check).
       (Francisco Alonso, Jan Kaluza, Remi)
     . Fixed bug #67413 (fileinfo: cdf_read_property_info insufficient boundary
       check). (Francisco Alonso, Jan Kaluza, Remi)

   - Intl:
     . Fixed bug #67349 (Locale::parseLocale Double Free). (Stas)
     . Fixed bug #67397 (Buffer overflow in locale_get_display_name and
       uloc_getDisplayName (libicu 4.8.1)). (Stas)

   - Network:
     . Fixed bug #67432 (Fix potential segfault in dns_check_record()).
       (CVE-2014-4049). (Sara)

   - OpenSSL:
     . Fixed missing type checks in OpenSSL options (Yussuf Khalil, Stas).

   - Session:
     . Fixed missing type checks in php_session_create_id (Yussuf Khalil, Stas).

7 files changed, 30 insertions, 46 deletions

diff --git a/lang/php/phpversion.mk b/lang/php/phpversion.mk
index 8565704591d..760ce9ffcb7 100644
--- a/lang/php/phpversion.mk
+++ b/lang/php/phpversion.mk
@@ -1,4 +1,4 @@
-# $NetBSD: phpversion.mk,v 1.66 2014/06/27 11:34:19 taca Exp $
+# $NetBSD: phpversion.mk,v 1.66.2.1 2014/08/18 12:48:05 tron Exp $
 #
 # This file selects a PHP version, based on the user's preferences and
 # the installed packages. It does not add a dependency on the PHP
@@ -81,7 +81,7 @@
 PHPVERSION_MK=	defined
 
 # Define each PHP's version.
-PHP53_VERSION=	5.3.28
+PHP53_VERSION=	5.3.29
 PHP54_VERSION=	5.4.30
 PHP55_VERSION=	5.5.14
 
diff --git a/lang/php53/Makefile b/lang/php53/Makefile
index 3c655c08752..7a02b033f39 100644
--- a/lang/php53/Makefile
+++ b/lang/php53/Makefile
@@ -1,10 +1,9 @@
-# $NetBSD: Makefile,v 1.48 2014/06/13 14:13:20 fhajny Exp $
+# $NetBSD: Makefile,v 1.48.2.1 2014/08/18 12:48:05 tron Exp $
 
 #
 # We can't omit PKGNAME here to handle PKG_OPTIONS.
 #
 PKGNAME=		php-${PHP_BASE_VERS}
-PKGREVISION=		3
 CATEGORIES=		lang
 
 HOMEPAGE=		http://www.php.net/
diff --git a/lang/php53/Makefile.php b/lang/php53/Makefile.php
index 2c142bfcb65..bbc0170daff 100644
--- a/lang/php53/Makefile.php
+++ b/lang/php53/Makefile.php
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.php,v 1.40 2014/06/13 14:13:20 fhajny Exp $
+# $NetBSD: Makefile.php,v 1.40.2.1 2014/08/18 12:48:05 tron Exp $
 # used by lang/php53/Makefile
 # used by www/ap-php/Makefile
 # used by www/php-fpm/Makefile
@@ -53,8 +53,8 @@ PKG_SUGGESTED_OPTIONS+=	inet6 ssl
 .include "../../mk/bsd.options.mk"
 
 .if !empty(PKG_OPTIONS:Msuhosin)
-SUHOSIN_PHPVER=		5.3.25
-.  if ${SUHOSIN_PHPVER} != ${PHP_BASE_VERS} && ${PHP_BASE_VERS} != "5.3.28"
+SUHOSIN_PHPVER=		5.3.29
+.  if ${SUHOSIN_PHPVER} != ${PHP_BASE_VERS}
 PKG_FAIL_REASON+=	"The suhosin patch is currently not available for"
 PKG_FAIL_REASON+=	"this version of PHP.  You may have to wait until"
 PKG_FAIL_REASON+=	"an updated patch is released or temporarily"
diff --git a/lang/php53/distinfo b/lang/php53/distinfo
index 14974fb8fcc..1fba5c4a587 100644
--- a/lang/php53/distinfo
+++ b/lang/php53/distinfo
@@ -1,11 +1,11 @@
-$NetBSD: distinfo,v 1.74 2014/06/13 14:09:34 fhajny Exp $
+$NetBSD: distinfo,v 1.74.2.1 2014/08/18 12:48:05 tron Exp $
 
-SHA1 (php-5.3.28.tar.bz2) = f985ca1f6a5f49ebfb25a08f1837a44c563b31f8
-RMD160 (php-5.3.28.tar.bz2) = e4910c0c365f39a5009807801bd5ee6e25be020d
-Size (php-5.3.28.tar.bz2) = 11051714 bytes
-SHA1 (suhosin-patch-5.3.25-0.9.10.patch.bz2) = ce5883b05daf91e8a44fffbfa4d3989ac3311dd1
-RMD160 (suhosin-patch-5.3.25-0.9.10.patch.bz2) = 6c4d0cfe070802481121be465b66d3cefe44da83
-Size (suhosin-patch-5.3.25-0.9.10.patch.bz2) = 32447 bytes
+SHA1 (php-5.3.29.tar.bz2) = 6e9e492c6d5853d063ddb9a4dbef60b8e5d87444
+RMD160 (php-5.3.29.tar.bz2) = e57beb4fdda41bca81b5856161bc97f3c5e3e9da
+Size (php-5.3.29.tar.bz2) = 11396771 bytes
+SHA1 (suhosin-patch-5.3.29-0.9.10.patch.bz2) = b81a9b24f758cef4319759e09d011c7a350232a7
+RMD160 (suhosin-patch-5.3.29-0.9.10.patch.bz2) = 7685501fd40426068c58dfbe844d12f1af299d80
+Size (suhosin-patch-5.3.29-0.9.10.patch.bz2) = 32437 bytes
 SHA1 (patch-aa) = fd930d0d9b1c60e8c7c514cfb6864b61ce4d158d
 SHA1 (patch-ab) = 36789fea71e316d5c4358e597df1928d94f8ea6a
 SHA1 (patch-ac) = b194eaed2d81877166b13db58b37c5ddff0210a6
@@ -19,8 +19,6 @@ SHA1 (patch-ai) = 9659f73eef1b4fcca9b844bdaa785ac6d5e582a1
 SHA1 (patch-aj) = 181658ae523bd60f67750566711fc078b49191b7
 SHA1 (patch-al) = fe534d7d50a529e3c7d0ffed76afdb70bb55a521
 SHA1 (patch-build_libtool.m4) = 6835b90ebd34739440c8eb94ed19ebacdf2ba6a5
-SHA1 (patch-ext_date_lib_parse__iso__intervals.c) = 1243e4cda1d6446ee4f8b6cab61556fa07837139
-SHA1 (patch-ext_date_lib_parse__iso__intervals.re) = 75d4abd666c17d7d5f8a4ee9e489bf2565f83524
 SHA1 (patch-ext_gd_libgd_gdxpm.c) = 9a175417fad9ac23037a24122f8d1258b9eebbcb
 SHA1 (patch-ext_standard_basic__functions.c) = 017fd25e646af4d7eb2a0bd13b3c8da34eaee8c5
 SHA1 (patch-main_streams_cast.c) = d68b69c9418a8780b1610b8755487771f7c46a5a
diff --git a/lang/php53/patches/patch-Zend_zend_language_parser.h b/lang/php53/patches/patch-Zend_zend_language_parser.h
new file mode 100644
index 00000000000..d1fc8c0216f
--- /dev/null
+++ b/lang/php53/patches/patch-Zend_zend_language_parser.h
@@ -0,0 +1,17 @@
+$NetBSD: patch-Zend_zend_language_parser.h,v 1.2.2.2 2014/08/18 12:48:05 tron Exp $
+
+https://bugs.php.net/bug.php?id=64503
+
+--- Zend/zend_language_parser.h.orig	2013-12-10 20:13:14.000000000 +0000
++++ Zend/zend_language_parser.h
+@@ -305,6 +305,10 @@ typedef int YYSTYPE;
+ # define YYSTYPE_IS_DECLARED 1
+ #endif
+ 
++#ifdef ZTS
++# define YYPARSE_PARAM tsrm_ls
++# define YYLEX_PARAM tsrm_ls
++#endif
+ 
+ #ifdef YYPARSE_PARAM
+ #if defined __STDC__ || defined __cplusplus
diff --git a/lang/php53/patches/patch-ext_date_lib_parse__iso__intervals.c b/lang/php53/patches/patch-ext_date_lib_parse__iso__intervals.c
deleted file mode 100644
index e895589cb76..00000000000
--- a/lang/php53/patches/patch-ext_date_lib_parse__iso__intervals.c
+++ /dev/null
@@ -1,15 +0,0 @@
-$NetBSD: patch-ext_date_lib_parse__iso__intervals.c,v 1.1 2013/12/05 16:16:40 taca Exp $
-
-Fix for CVE-2013-6712.
-
---- ext/date/lib/parse_iso_intervals.c.orig	2013-07-10 17:43:08.000000000 +0000
-+++ ext/date/lib/parse_iso_intervals.c
-@@ -415,7 +415,7 @@ yy6:
- 					break;
- 			}
- 			ptr++;
--		} while (*ptr);
-+		} while (!s->errors->error_count && *ptr);
- 		s->have_period = 1;
- 		TIMELIB_DEINIT;
- 		return TIMELIB_PERIOD;
diff --git a/lang/php53/patches/patch-ext_date_lib_parse__iso__intervals.re b/lang/php53/patches/patch-ext_date_lib_parse__iso__intervals.re
deleted file mode 100644
index 39c23175ab0..00000000000
--- a/lang/php53/patches/patch-ext_date_lib_parse__iso__intervals.re
+++ /dev/null
@@ -1,15 +0,0 @@
-$NetBSD: patch-ext_date_lib_parse__iso__intervals.re,v 1.1 2013/12/05 16:16:40 taca Exp $
-
-Fix for CVE-2013-6712.
-
---- ext/date/lib/parse_iso_intervals.re.orig	2013-07-10 17:43:08.000000000 +0000
-+++ ext/date/lib/parse_iso_intervals.re
-@@ -383,7 +383,7 @@ isoweek          = year4 "-"? "W" weekof
- 					break;
- 			}
- 			ptr++;
--		} while (*ptr);
-+		} while (!s->errors->error_count && *ptr);
- 		s->have_period = 1;
- 		TIMELIB_DEINIT;
- 		return TIMELIB_PERIOD;