Update versions for PHP 7.2.34

We have to check for NUL bytes if `getimagesize()` has been called.

NEWS

@@ -1,7 +1,46 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2020, PHP 7.2.30
+01 Oct 2020, PHP 7.2.34
 
+- Core:
+  . Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-`
+    cookies can be sent). (CVE-2020-7070) (Stas)
+
+- OpenSSL:
+  . Fixed bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12
+    bytes IV). (CVE-2020-7069) (Jakub Zelenka)
+
+06 Aug 2020, PHP 7.2.33
+
+- Core:
+  . Fixed bug #79877 (getimagesize function silently truncates after a null 
+    byte) (cmb)
+
+- Phar:
+  . Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile
+    function). (CVE-2020-7068) (cmb)
+
+09 Jul 2020, PHP 7.2.32
+
+- Core:
+  . No source changes to this release.
+    Vesion number added for reproduction of Windows builds. (cmb)
+
+14 May 2020, PHP 7.2.31
+
+- Core:
+  . Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned). 
+    (CVE-2019-11048) (cmb)
+  . Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp 
+    files are not cleaned). (CVE-2019-11048) (cmb)
+
+16 Apr 2020, PHP 7.2.30
+
+- Standard:
+  . Fixed bug #79468 (SIGSEGV when closing stream handle with a stream filter
+    appended). (dinosaur)
+  . Fixed bug #79330 (shell_exec() silently truncates after a null byte). (stas)
+  . Fixed bug #79465 (OOB Read in urldecode()). (stas)
 
 19 Mar 2020, PHP 7.2.29
 

UPGRADING

@@ -52,11 +52,16 @@ PHP 7.2 UPGRADE NOTES
   . The hash_hmac(), hash_hmac_file(), hash_pbkdf2() and hash_init() (with
     HASH_HMAC) functions no longer accept non-cryptographic hashes.
 
-- JSON
+- JSON:
   . The json_decode() option JSON_OBJECT_AS_ARRAY is used if the second
     parameter (assoc) is null. Previously JSON_OBJECT_AS_ARRAY was always
     ignored.
 
+- SAPI:
+  . Starting with 7.2.34, incoming cookie names are not url-decoded. This was never 
+    required by the standard, outgoing cookie names aren't encoded and this leads 
+    to security issues (CVE-2020-7070).
+
 - Session:
   . Removed register_globals related code and "!" can be used as $_SESSION key name.
   . Session is made to manage session status correctly and prevents invalid operations.
@@ -69,7 +74,7 @@ PHP 7.2 UPGRADE NOTES
         session_unset(), session_write_close()/session_commit(), session_abort(),
         session_reset()
     . Functions prohibit invalid operations with regard to session status and
-      HTTP header status, returns correct bool return value.
+      HTTP header status, return correct bool return value.
         session_start(), session_set_cookie_params(), session_name(), session_module_name(),
         session_set_save_handler(), session_regenerate_id(), session_cache_limiter(),
         session_cache_expire(), session_unset(), session_destroy(),
@@ -88,7 +93,7 @@ PHP 7.2 UPGRADE NOTES
         session_start()
     . When headers are already sent and try to set new INI values, session_name(),
       session_module_name(), session_save_path(), session_cache_limiter() and
-      session_cache_expire() are no longer works. Older PHPs accepts new values even
+      session_cache_expire() no longer work. Older PHPs accept new values even
       if new values will not be effective.
       This new corrected behavior may affect command line mode CLI scripts that manage
       sessions. Use output buffer just like web applications to resolve problems on

configure.ac

@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
-PHP_RELEASE_VERSION=30
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=34
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/openssl/openssl.c

@@ -6391,11 +6391,6 @@ static int php_openssl_validate_iv(char **piv, size_t *piv_len, size_t iv_requir
 {
 	char *iv_new;
 
-	/* Best case scenario, user behaved */
-	if (*piv_len == iv_required_len) {
-		return SUCCESS;
-	}
-
 	if (mode->is_aead) {
 		if (EVP_CIPHER_CTX_ctrl(cipher_ctx, mode->aead_ivlen_flag, *piv_len, NULL) != 1) {
 			php_error_docref(NULL, E_WARNING, "Setting of IV length for AEAD mode failed");
@@ -6404,6 +6399,11 @@ static int php_openssl_validate_iv(char **piv, size_t *piv_len, size_t iv_requir
 		return SUCCESS;
 	}
 
+	/* Best case scenario, user behaved */
+	if (*piv_len == iv_required_len) {
+		return SUCCESS;
+	}
+
 	iv_new = ecalloc(1, iv_required_len + 1);
 
 	if (*piv_len == 0) {

ext/openssl/tests/cipher_tests.inc

@@ -1,5 +1,26 @@
 <?php
 $php_openssl_cipher_tests = array(
+    'aes-128-ccm' => array(
+        array(
+            'key' => '404142434445464748494a4b4c4d4e4f',
+            'iv'  => '1011121314151617',
+            'aad' => '000102030405060708090a0b0c0d0e0f',
+            'tag' => '1fc64fbfaccd',
+            'pt'  => '202122232425262728292a2b2c2d2e2f',
+            'ct'  => 'd2a1f0e051ea5f62081a7792073d593d',
+        ),
+        array(
+            'key' => '404142434445464748494a4b4c4d4e4f',
+            'iv'  => '101112131415161718191a1b',
+            'aad' => '000102030405060708090a0b0c0d0e0f' .
+                     '10111213',
+            'tag' => '484392fbc1b09951',
+            'pt'  => '202122232425262728292a2b2c2d2e2f' .
+                     '3031323334353637',
+            'ct'  => 'e3b201a9f5b71a7a9b1ceaeccd97e70b' .
+                     '6176aad9a4428aa5',
+        ),
+    ),
     'aes-256-ccm' => array(
         array(
             'key' => '1bde3251d41a8b5ea013c195ae128b21' .

ext/openssl/tests/openssl_decrypt_ccm.phpt

@@ -10,14 +10,16 @@ if (!in_array('aes-256-ccm', openssl_get_cipher_methods()))
 --FILE--
 <?php
 require_once __DIR__ . "/cipher_tests.inc";
-$method = 'aes-256-ccm';
-$tests = openssl_get_cipher_tests($method);
+$methods = ['aes-128-ccm', 'aes-256-ccm'];
 
-foreach ($tests as $idx => $test) {
-    echo "TEST $idx\n";
-    $pt = openssl_decrypt($test['ct'], $method, $test['key'], OPENSSL_RAW_DATA,
-        $test['iv'], $test['tag'], $test['aad']);
-    var_dump($test['pt'] === $pt);
+foreach ($methods as $method) {
+    $tests = openssl_get_cipher_tests($method);
+    foreach ($tests as $idx => $test) {
+        echo "$method - TEST $idx\n";
+        $pt = openssl_decrypt($test['ct'], $method, $test['key'], OPENSSL_RAW_DATA,
+            $test['iv'], $test['tag'], $test['aad']);
+        var_dump($test['pt'] === $pt);
+    }
 }
 
 // no IV
@@ -32,7 +34,11 @@ var_dump(openssl_decrypt($test['ct'], $method, $test['key'], OPENSSL_RAW_DATA,
 
 ?>
 --EXPECTF--
-TEST 0
+aes-128-ccm - TEST 0
+bool(true)
+aes-128-ccm - TEST 1
+bool(true)
+aes-256-ccm - TEST 0
 bool(true)
 
 Warning: openssl_decrypt(): Setting of IV length for AEAD mode failed in %s on line %d

ext/openssl/tests/openssl_encrypt_ccm.phpt

@@ -10,15 +10,17 @@ if (!in_array('aes-256-ccm', openssl_get_cipher_methods()))
 --FILE--
 <?php
 require_once __DIR__ . "/cipher_tests.inc";
-$method = 'aes-256-ccm';
-$tests = openssl_get_cipher_tests($method);
+$methods = ['aes-128-ccm', 'aes-256-ccm'];
 
-foreach ($tests as $idx => $test) {
-    echo "TEST $idx\n";
-    $ct = openssl_encrypt($test['pt'], $method, $test['key'], OPENSSL_RAW_DATA,
-        $test['iv'], $tag, $test['aad'], strlen($test['tag']));
-    var_dump($test['ct'] === $ct);
-    var_dump($test['tag'] === $tag);
+foreach ($methods as $method) {
+    $tests = openssl_get_cipher_tests($method);
+    foreach ($tests as $idx => $test) {
+        echo "$method - TEST $idx\n";
+        $ct = openssl_encrypt($test['pt'], $method, $test['key'], OPENSSL_RAW_DATA,
+            $test['iv'], $tag, $test['aad'], strlen($test['tag']));
+        var_dump($test['ct'] === $ct);
+        var_dump($test['tag'] === $tag);
+    }
 }
 
 // Empty IV error
@@ -32,7 +34,13 @@ var_dump(strlen($tag));
 var_dump(openssl_encrypt('data', $method, 'password', 0, str_repeat('x', 16), $tag, '', 1024));
 ?>
 --EXPECTF--
-TEST 0
+aes-128-ccm - TEST 0
+bool(true)
+bool(true)
+aes-128-ccm - TEST 1
+bool(true)
+bool(true)
+aes-256-ccm - TEST 0
 bool(true)
 bool(true)
 

ext/phar/tests/bug79797.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #79797 (Use of freed hash key in the phar_parse_zipfile function)
+--SKIPIF--
+<?php
+if (!extension_loaded('phar')) die('skip phar extension not available');
+?>
+--INI--
+phar.cache_list={PWD}/bug79797.phar
+--FILE--
+<?php
+echo "done\n";
+?>
+--EXPECT--
+done

ext/phar/zip.c

@@ -703,7 +703,7 @@ foundit:
 			efree(actual_alias);
 		}
 
-		zend_hash_str_add_ptr(&(PHAR_G(phar_alias_map)), actual_alias, mydata->alias_len, mydata);
+		zend_hash_str_add_ptr(&(PHAR_G(phar_alias_map)), mydata->alias, mydata->alias_len, mydata);
 	} else {
 		phar_archive_data *fd_ptr;
 

ext/standard/credits_ext.h

@@ -1,11 +1,11 @@
-/* 
+/*
                       DO NOT EDIT THIS FILE!
 
- it has been automaticaly created by php7/scripts/credits from  
+ it has been automaticaly created by php7/scripts/credits from
  the information found in the various php7/ext/.../CREDITS and
- php7/sapi/.../CREDITS files 
- 
- if you want to change an entry you have to edit the appropriate 
+ php7/sapi/.../CREDITS files
+
+ if you want to change an entry you have to edit the appropriate
  CREDITS file instead
 
 */
@@ -28,7 +28,7 @@ CREDIT_LINE("FTP", "Stefan Esser, Andrew Skalski");
 CREDIT_LINE("GD imaging", "Rasmus Lerdorf, Stig Bakken, Jim Winstead, Jouni Ahto, Ilia Alshanetsky, Pierre-Alain Joye, Marcus Boerger");
 CREDIT_LINE("GetText", "Alex Plotnick");
 CREDIT_LINE("GNU GMP support", "Stanislav Malyshev");
-CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi ");
+CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi");
 CREDIT_LINE("IMAP", "Rex Logan, Mark Musone, Brian Wang, Kaj-Michael Lang, Antoni Pamies Olive, Rasmus Lerdorf, Andrew Skalski, Chuck Hagenbuch, Daniel R Kalowsky");
 CREDIT_LINE("Input Filter", "Rasmus Lerdorf, Derick Rethans, Pierre-Alain Joye, Ilia Alshanetsky");
 CREDIT_LINE("InterBase", "Jouni Ahto, Andrew Avdeev, Ard Biesheuvel");

ext/standard/credits_sapi.h

@@ -1,11 +1,11 @@
-/* 
+/*
                       DO NOT EDIT THIS FILE!
 
- it has been automaticaly created by php7/scripts/credits from  
+ it has been automaticaly created by php7/scripts/credits from
  the information found in the various php7/ext/.../CREDITS and
- php7/sapi/.../CREDITS files 
- 
- if you want to change an entry you have to edit the appropriate 
+ php7/sapi/.../CREDITS files
+
+ if you want to change an entry you have to edit the appropriate
  CREDITS file instead
 
 */

ext/standard/exec.c

@@ -531,6 +531,15 @@ PHP_FUNCTION(shell_exec)
 		Z_PARAM_STRING(command, command_len)
 	ZEND_PARSE_PARAMETERS_END();
 
+	if (!command_len) {
+		php_error_docref(NULL, E_WARNING, "Cannot execute a blank command");
+		RETURN_FALSE;
+	}
+	if (strlen(command) != command_len) {
+		php_error_docref(NULL, E_WARNING, "NULL byte detected. Possible attack");
+		RETURN_FALSE;
+	}
+
 #ifdef PHP_WIN32
 	if ((in=VCWD_POPEN(command, "rt"))==NULL) {
 #else

ext/standard/image.c

@@ -1478,6 +1478,11 @@ static void php_getimagesize_from_any(INTERNAL_FUNCTION_PARAMETERS, int mode) {
 		Z_PARAM_ZVAL_DEREF(info)
 	ZEND_PARSE_PARAMETERS_END();
 
+	if (mode == FROM_PATH && CHECK_NULL_PATH(input, input_len)) {
+		php_error_docref(NULL, E_WARNING, "Invalid path");
+		return;
+	}
+
 	if (argc == 2) {
 		zval_ptr_dtor(info);
 		array_init(info);

ext/standard/tests/filters/bug79468.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #79468	SIGSEGV when closing stream handle with a stream filter appended
+--SKIPIF--
+<?php
+$filters = stream_get_filters();
+if(! in_array( "string.rot13", $filters )) die( "skip rot13 filter not available." );
+?>
+--FILE--
+<?php
+$fp = fopen('php://temp', 'rb');
+$rot13_filter = stream_filter_append($fp, "string.rot13", STREAM_FILTER_WRITE);
+fwrite($fp, "This is ");
+fclose($fp);
+try {
+    stream_filter_remove($rot13_filter);
+} catch (\Throwable $e) {
+    var_dump($e->getMessage());
+}
+?>
+--EXPECTF--
+Warning: stream_filter_remove(): Invalid resource given, not a stream filter in %s on line %d

ext/standard/tests/image/bug79877.phpt

@@ -0,0 +1,9 @@
+--TEST--
+Bug #79877 (getimagesize function silently truncates after a null byte)
+--FILE--
+<?php
+var_dump(getimagesize("/tmp/a.png\0xx"));
+?>
+--EXPECTF--
+Warning: getimagesize(): Invalid path in %s on line %d
+NULL

ext/standard/url.c

@@ -559,7 +559,7 @@ PHPAPI size_t php_url_decode(char *str, size_t len)
 #ifndef CHARSET_EBCDIC
 			*dest = (char) php_htoi(data + 1);
 #else
-			*dest = os_toebcdic[(char) php_htoi(data + 1)];
+			*dest = os_toebcdic[(unsigned char) php_htoi(data + 1)];
 #endif
 			data += 2;
 			len -= 2;
@@ -651,7 +651,7 @@ PHPAPI size_t php_raw_url_decode(char *str, size_t len)
 #ifndef CHARSET_EBCDIC
 			*dest = (char) php_htoi(data + 1);
 #else
-			*dest = os_toebcdic[(char) php_htoi(data + 1)];
+			*dest = os_toebcdic[(unsigned char) php_htoi(data + 1)];
 #endif
 			data += 2;
 			len -= 2;

main/php_variables.c

@@ -492,7 +492,9 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
 			size_t new_val_len;
 
 			*val++ = '\0';
-			php_url_decode(var, strlen(var));
+			if (arg != PARSE_COOKIE) {
+				php_url_decode(var, strlen(var));
+			}
 			val_len = php_url_decode(val, strlen(val));
 			val = estrndup(val, val_len);
 			if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len)) {
@@ -503,7 +505,9 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
 			size_t val_len;
 			size_t new_val_len;
 
-			php_url_decode(var, strlen(var));
+			if (arg != PARSE_COOKIE) {
+				php_url_decode(var, strlen(var));
+			}
 			val_len = 0;
 			val = estrndup("", val_len);
 			if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len)) {

main/php_version.h

@@ -2,7 +2,7 @@
 /* edit configure.ac to change version number */
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 2
-#define PHP_RELEASE_VERSION 30
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.2.30-dev"
-#define PHP_VERSION_ID 70230
+#define PHP_RELEASE_VERSION 34
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.2.34"
+#define PHP_VERSION_ID 70234

main/rfc1867.c

@@ -616,7 +616,7 @@ static void *php_ap_memstr(char *haystack, int haystacklen, char *needle, int ne
 }
 
 /* read until a boundary condition */
-static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
+static size_t multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
 {
 	size_t len, max;
 	char *bound;
@@ -655,7 +655,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes
 		self->buf_begin += len;
 	}
 
-	return (int)len;
+	return len;
 }
 
 /*
@@ -665,7 +665,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes
 static char *multipart_buffer_read_body(multipart_buffer *self, size_t *len)
 {
 	char buf[FILLUNIT], *out=NULL;
-	int total_bytes=0, read_bytes=0;
+	size_t total_bytes=0, read_bytes=0;
 
 	while((read_bytes = multipart_buffer_read(self, buf, sizeof(buf), NULL))) {
 		out = erealloc(out, total_bytes + read_bytes + 1);
@@ -692,7 +692,8 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
 	char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL;
 	char *lbuf = NULL, *abuf = NULL;
 	zend_string *temp_filename = NULL;
-	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0;
+	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0;
+	size_t array_len = 0;
 	int64_t total_bytes = 0, max_file_size = 0;
 	int skip_upload = 0, anonindex = 0, is_anonymous;
 	HashTable *uploaded_files = NULL;
@@ -1126,7 +1127,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
 			is_arr_upload =	(start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']');
 
 			if (is_arr_upload) {
-				array_len = (int)strlen(start_arr);
+				array_len = strlen(start_arr);
 				if (array_index) {
 					efree(array_index);
 				}

main/streams/streams.c

@@ -477,9 +477,15 @@ fprintf(stderr, "stream_free: %s:%p[%s] preserve_handle=%d release_cast=%d remov
 
 	if (close_options & PHP_STREAM_FREE_RELEASE_STREAM) {
 		while (stream->readfilters.head) {
+			if (stream->readfilters.head->res != NULL) {
+				zend_list_close(stream->readfilters.head->res);
+			}
 			php_stream_filter_remove(stream->readfilters.head, 1);
 		}
 		while (stream->writefilters.head) {
+			if (stream->writefilters.head->res != NULL) {
+				zend_list_close(stream->writefilters.head->res);
+			}
 			php_stream_filter_remove(stream->writefilters.head, 1);
 		}
 

tests/basic/022.phpt

@@ -10,7 +10,7 @@ cookie1=val1  ; cookie2=val2%20; cookie3=val 3.; cookie 4= value 4 %3B; cookie1=
 var_dump($_COOKIE);
 ?>
 --EXPECT--
-array(10) {
+array(12) {
   ["cookie1"]=>
   string(6) "val1  "
   ["cookie2"]=>
@@ -19,11 +19,15 @@ array(10) {
   string(6) "val 3."
   ["cookie_4"]=>
   string(10) " value 4 ;"
+  ["%20cookie1"]=>
+  string(6) "ignore"
+  ["+cookie1"]=>
+  string(6) "ignore"
   ["cookie__5"]=>
   string(7) "  value"
-  ["cookie_6"]=>
+  ["cookie%206"]=>
   string(3) "þæö"
-  ["cookie_7"]=>
+  ["cookie+7"]=>
   string(0) ""
   ["$cookie_8"]=>
   string(0) ""

tests/basic/023.phpt

@@ -10,9 +10,11 @@ c o o k i e=value; c o o k i e= v a l u e ;;c%20o+o k+i%20e=v;name="value","valu
 var_dump($_COOKIE);
 ?>
 --EXPECT--
-array(3) {
+array(4) {
   ["c_o_o_k_i_e"]=>
   string(5) "value"
+  ["c%20o+o_k+i%20e"]=>
+  string(1) "v"
   ["name"]=>
   string(24) ""value","value",UEhQIQ=="
   ["UEhQIQ"]=>

tests/basic/bug79699.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Cookies Security Bug
+--INI--
+max_input_vars=1000
+filter.default=unsafe_raw
+--COOKIE--
+__%48ost-evil=evil; __Host-evil=good; %66oo=baz;foo=bar
+--FILE--
+<?php
+var_dump($_COOKIE);
+?>
+--EXPECT--
+array(4) {
+  ["__%48ost-evil"]=>
+  string(4) "evil"
+  ["__Host-evil"]=>
+  string(4) "good"
+  ["%66oo"]=>
+  string(3) "baz"
+  ["foo"]=>
+  string(3) "bar"
+}