- GC bug fix: http://svn.php.net/viewvc?view=revision&revision=303016

- CVE-2010-3710 (a part of SA41724)
	http://svn.php.net/viewvc?view=revision&revision=303779
- CVE-2010-3870 (a part of SA41724)
	http://svn.php.net/viewvc?view=revision&revision=304959
- CVE-2010-4150 (php-imap)
	http://svn.php.net/viewvc?view=revision&revision=305032
- CVE-2010-4156 (SA42135)
	http://svn.php.net/viewvc?view=revision&revision=305214

Bump PKGREVISION.

5 files changed, 290 insertions, 0 deletions

diff --git a/lang/php53/patches/patch-am b/lang/php53/patches/patch-am
new file mode 100644
index 00000000000..2251b9818ea
--- /dev/null
+++ b/lang/php53/patches/patch-am
@@ -0,0 +1,65 @@
+$NetBSD: patch-am,v 1.1 2010/11/25 03:43:50 taca Exp $
+
+GC bug fix: http://svn.php.net/viewvc?view=revision&revision=303016
+
+--- Zend/zend_gc.c.orig	2010-04-01 22:54:03.000000000 +0000
++++ Zend/zend_gc.c
+@@ -414,19 +414,21 @@ static void gc_mark_roots(TSRMLS_D)
+ 	gc_root_buffer *current = GC_G(roots).next;
+ 
+ 	while (current != &GC_G(roots)) {
+-		if (current->handle && EG(objects_store).object_buckets) {
+-			struct _store_object *obj = &EG(objects_store).object_buckets[current->handle].bucket.obj;
++		if (current->handle) {
++			if (EG(objects_store).object_buckets) {
++				struct _store_object *obj = &EG(objects_store).object_buckets[current->handle].bucket.obj;
+ 
+-			if (GC_GET_COLOR(obj->buffered) == GC_PURPLE) {
+-				zval z;
++				if (GC_GET_COLOR(obj->buffered) == GC_PURPLE) {
++					zval z;
+ 
+-				INIT_PZVAL(&z);
+-				Z_OBJ_HANDLE(z) = current->handle;
+-				Z_OBJ_HT(z) = current->u.handlers;
+-				zobj_mark_grey(obj, &z TSRMLS_CC);
+-			} else {
+-				GC_SET_ADDRESS(obj->buffered, NULL);
+-				GC_REMOVE_FROM_BUFFER(current);
++					INIT_PZVAL(&z);
++					Z_OBJ_HANDLE(z) = current->handle;
++					Z_OBJ_HT(z) = current->u.handlers;
++					zobj_mark_grey(obj, &z TSRMLS_CC);
++				} else {
++					GC_SET_ADDRESS(obj->buffered, NULL);
++					GC_REMOVE_FROM_BUFFER(current);
++				}
+ 			}
+ 		} else {
+ 			if (GC_ZVAL_GET_COLOR(current->u.pz) == GC_PURPLE) {
+@@ -623,15 +625,17 @@ static void gc_collect_roots(TSRMLS_D)
+ 	gc_root_buffer *current = GC_G(roots).next;
+ 
+ 	while (current != &GC_G(roots)) {
+-		if (current->handle && EG(objects_store).object_buckets) {
+-			struct _store_object *obj = &EG(objects_store).object_buckets[current->handle].bucket.obj;
+-			zval z;
++		if (current->handle) {
++			if (EG(objects_store).object_buckets) {
++				struct _store_object *obj = &EG(objects_store).object_buckets[current->handle].bucket.obj;
++				zval z;
+ 
+-			GC_SET_ADDRESS(obj->buffered, NULL);
+-			INIT_PZVAL(&z);
+-			Z_OBJ_HANDLE(z) = current->handle;
+-			Z_OBJ_HT(z) = current->u.handlers;
+-			zobj_collect_white(&z TSRMLS_CC);
++				GC_SET_ADDRESS(obj->buffered, NULL);
++				INIT_PZVAL(&z);
++				Z_OBJ_HANDLE(z) = current->handle;
++				Z_OBJ_HT(z) = current->u.handlers;
++				zobj_collect_white(&z TSRMLS_CC);
++			}
+ 		} else {
+ 			GC_ZVAL_SET_ADDRESS(current->u.pz, NULL);
+ 			zval_collect_white(current->u.pz TSRMLS_CC);
diff --git a/lang/php53/patches/patch-an b/lang/php53/patches/patch-an
new file mode 100644
index 00000000000..273a1e6a999
--- /dev/null
+++ b/lang/php53/patches/patch-an
@@ -0,0 +1,20 @@
+$NetBSD: patch-an,v 1.1 2010/11/25 03:43:50 taca Exp $
+
+Fix for CVE-2010-3710 (a part of http://secunia.com/advisories/41724/):
+
+	http://svn.php.net/viewvc?view=revision&revision=303779
+
+--- ext/filter/logical_filters.c.orig	2010-04-02 18:27:48.000000000 +0000
++++ ext/filter/logical_filters.c
+@@ -531,6 +531,11 @@ void php_filter_validate_email(PHP_INPUT
+ 	int         matches;
+ 
+ 
++	/* The maximum length of an e-mail address is 320 octets, per RFC 2821. */
++	if (Z_STRLEN_P(value) > 320) {
++		RETURN_VALIDATION_FAILED
++	}
++
+ 	re = pcre_get_compiled_regex((char *)regexp, &pcre_extra, &preg_options TSRMLS_CC);
+ 	if (!re) {
+ 		RETURN_VALIDATION_FAILED
diff --git a/lang/php53/patches/patch-ao b/lang/php53/patches/patch-ao
new file mode 100644
index 00000000000..fe17b49820d
--- /dev/null
+++ b/lang/php53/patches/patch-ao
@@ -0,0 +1,166 @@
+$NetBSD: patch-ao,v 1.1 2010/11/25 03:43:50 taca Exp $
+
+Fix for CVE-2010-3870 (a part of http://secunia.com/advisories/41724/):
+
+	http://svn.php.net/viewvc?view=revision&revision=304959
+
+--- ext/xml/xml.c.orig	2010-01-05 13:03:40.000000000 +0000
++++ ext/xml/xml.c
+@@ -659,10 +659,111 @@ PHPAPI char *xml_utf8_encode(const char 
+ }
+ /* }}} */
+ 
++/* copied from trunk's implementation of get_next_char in ext/standard/html.c */
++#define MB_FAILURE(pos, advance) do { \
++	*cursor = pos + (advance); \
++	*status = FAILURE; \
++	return 0; \
++} while (0)
++
++#define CHECK_LEN(pos, chars_need) ((str_len - (pos)) >= (chars_need))
++#define utf8_lead(c)  ((c) < 0x80 || ((c) >= 0xC2 && (c) <= 0xF4))
++#define utf8_trail(c) ((c) >= 0x80 && (c) <= 0xBF)
++
++/* {{{ php_next_utf8_char
++ */
++static inline unsigned int php_next_utf8_char(
++		const unsigned char *str,
++		size_t str_len,
++		size_t *cursor,
++		int *status)
++{
++	size_t pos = *cursor;
++	unsigned int this_char = 0;
++	unsigned char c;
++
++	*status = SUCCESS;
++
++	if (!CHECK_LEN(pos, 1))
++		MB_FAILURE(pos, 1);
++
++	/* We'll follow strategy 2. from section 3.6.1 of UTR #36:
++		* "In a reported illegal byte sequence, do not include any
++		*  non-initial byte that encodes a valid character or is a leading
++		*  byte for a valid sequence.» */
++	c = str[pos];
++	if (c < 0x80) {
++		this_char = c;
++		pos++;
++	} else if (c < 0xc2) {
++		MB_FAILURE(pos, 1);
++	} else if (c < 0xe0) {
++		if (!CHECK_LEN(pos, 2))
++			MB_FAILURE(pos, 1);
++
++		if (!utf8_trail(str[pos + 1])) {
++			MB_FAILURE(pos, utf8_lead(str[pos + 1]) ? 1 : 2);
++		}
++		this_char = ((c & 0x1f) << 6) | (str[pos + 1] & 0x3f);
++		if (this_char < 0x80) { /* non-shortest form */
++			MB_FAILURE(pos, 2);
++		}
++		pos += 2;
++	} else if (c < 0xf0) {
++		size_t avail = str_len - pos;
++
++		if (avail < 3 ||
++				!utf8_trail(str[pos + 1]) || !utf8_trail(str[pos + 2])) {
++			if (avail < 2 || utf8_lead(str[pos + 1]))
++				MB_FAILURE(pos, 1);
++			else if (avail < 3 || utf8_lead(str[pos + 2]))
++				MB_FAILURE(pos, 2);
++			else
++				MB_FAILURE(pos, 3);
++		}
++
++		this_char = ((c & 0x0f) << 12) | ((str[pos + 1] & 0x3f) << 6) | (str[pos + 2] & 0x3f);
++		if (this_char < 0x800) { /* non-shortest form */
++			MB_FAILURE(pos, 3);
++		} else if (this_char >= 0xd800 && this_char <= 0xdfff) { /* surrogate */
++			MB_FAILURE(pos, 3);
++		}
++		pos += 3;
++	} else if (c < 0xf5) {
++		size_t avail = str_len - pos;
++
++		if (avail < 4 ||
++				!utf8_trail(str[pos + 1]) || !utf8_trail(str[pos + 2]) ||
++				!utf8_trail(str[pos + 3])) {
++			if (avail < 2 || utf8_lead(str[pos + 1]))
++				MB_FAILURE(pos, 1);
++			else if (avail < 3 || utf8_lead(str[pos + 2]))
++				MB_FAILURE(pos, 2);
++			else if (avail < 4 || utf8_lead(str[pos + 3]))
++				MB_FAILURE(pos, 3);
++			else
++				MB_FAILURE(pos, 4);
++		}
++				
++		this_char = ((c & 0x07) << 18) | ((str[pos + 1] & 0x3f) << 12) | ((str[pos + 2] & 0x3f) << 6) | (str[pos + 3] & 0x3f);
++		if (this_char < 0x10000 || this_char > 0x10FFFF) { /* non-shortest form or outside range */
++			MB_FAILURE(pos, 4);
++		}
++		pos += 4;
++	} else {
++		MB_FAILURE(pos, 1);
++	}
++	
++	*cursor = pos;
++	return this_char;
++}
++/* }}} */
++
++
+ /* {{{ xml_utf8_decode */
+ PHPAPI char *xml_utf8_decode(const XML_Char *s, int len, int *newlen, const XML_Char *encoding)
+ {
+-	int pos = len;
++	size_t pos = 0;
+ 	char *newbuf = emalloc(len + 1);
+ 	unsigned int c;
+ 	char (*decoder)(unsigned short) = NULL;
+@@ -681,36 +782,15 @@ PHPAPI char *xml_utf8_decode(const XML_C
+ 		newbuf[*newlen] = '\0';
+ 		return newbuf;
+ 	}
+-	while (pos > 0) {
+-		c = (unsigned char)(*s);
+-		if (c >= 0xf0) { /* four bytes encoded, 21 bits */
+-			if(pos-4 >= 0) {
+-				c = ((s[0]&7)<<18) | ((s[1]&63)<<12) | ((s[2]&63)<<6) | (s[3]&63);
+-			} else {
+-				c = '?';	
+-			}
+-			s += 4;
+-			pos -= 4;
+-		} else if (c >= 0xe0) { /* three bytes encoded, 16 bits */
+-			if(pos-3 >= 0) {
+-				c = ((s[0]&63)<<12) | ((s[1]&63)<<6) | (s[2]&63);
+-			} else {
+-				c = '?';
+-			}
+-			s += 3;
+-			pos -= 3;
+-		} else if (c >= 0xc0) { /* two bytes encoded, 11 bits */
+-			if(pos-2 >= 0) {
+-				c = ((s[0]&63)<<6) | (s[1]&63);
+-			} else {
+-				c = '?';
+-			}
+-			s += 2;
+-			pos -= 2;
+-		} else {
+-			s++;
+-			pos--;
++
++	while (pos < (size_t)len) {
++		int status = FAILURE;
++		c = php_next_utf8_char((const unsigned char*)s, (size_t) len, &pos, &status);
++
++		if (status == FAILURE || c > 0xFFU) {
++			c = '?';
+ 		}
++
+ 		newbuf[*newlen] = decoder ? decoder(c) : c;
+ 		++*newlen;
+ 	}
diff --git a/lang/php53/patches/patch-ap b/lang/php53/patches/patch-ap
new file mode 100644
index 00000000000..15fa5400311
--- /dev/null
+++ b/lang/php53/patches/patch-ap
@@ -0,0 +1,20 @@
+$NetBSD: patch-ap,v 1.1 2010/11/25 03:43:50 taca Exp $
+
+Fix for CVE-2010-4150:
+	http://svn.php.net/viewvc?view=revision&revision=305032
+
+--- ext/imap/php_imap.c.orig	2010-04-14 09:45:37.000000000 +0000
++++ ext/imap/php_imap.c
+@@ -1209,10 +1209,12 @@ static void php_imap_do_open(INTERNAL_FU
+ 
+ 	if (IMAPG(imap_user)) {
+ 		efree(IMAPG(imap_user));
++		IMAPG(imap_user) = 0;
+ 	}
+ 
+ 	if (IMAPG(imap_password)) {
+ 		efree(IMAPG(imap_password));
++		IMAPG(imap_password) = 0;
+ 	}
+ 
+ 	/* local filename, need to perform open_basedir and safe_mode checks */
diff --git a/lang/php53/patches/patch-aq b/lang/php53/patches/patch-aq
new file mode 100644
index 00000000000..038674040a1
--- /dev/null
+++ b/lang/php53/patches/patch-aq
@@ -0,0 +1,19 @@
+$NetBSD: patch-aq,v 1.1 2010/11/25 03:43:50 taca Exp $
+
+Fix for CVE-2010-4156 (also http://secunia.com/advisories/42135/):
+
+	http://svn.php.net/viewvc?view=revision&revision=305214
+
+--- ext/mbstring/libmbfl/mbfl/mbfilter.c.orig	2010-03-12 04:55:37.000000000 +0000
++++ ext/mbstring/libmbfl/mbfl/mbfilter.c
+@@ -1397,6 +1397,10 @@ mbfl_strcut(
+ 			start = string->val + from;
+ 			end   = start + (length & -4);
+ 		} else if ((encoding->flag & MBFL_ENCTYPE_SBCS)) {
++			if (from + length >= string->len) {
++				length = string->len - from;
++			}
++
+ 			start = string->val + from;
+ 			end = start + length;
+ 		} else if (encoding->mblen_table != NULL) {