Prepare PHP 7.3.9

Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe()
Backport from https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55 (cherry picked from commit 1258303e66)
2026-11-11 03:00:49 +00:00 · 2019-08-27 23:29:58 +02:00 · 2019-08-27 23:27:11 +02:00 · 2019-08-27 23:15:50 +02:00 · 2019-08-15 15:24:39 +02:00 · 2019-08-15 15:21:18 +02:00
8 changed files with 26 additions and 11 deletions
@@ -1,10 +1,12 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 7.3.9
+29 Aug 2019, PHP 7.3.9

 - Core:
  . Fixed bug #78363 (Buffer overflow in zendparse). (Nikita)
  . Fixed bug #78379 (Cast to object confuses GC, causes crash). (Dmitry)
+  . Fixed bug #78412 (Generator incorrectly reports non-releasable $this as GC
+    child). (Nikita)

 - Curl:
  . Fixed bug #77946 (Bad cURL resources returned by curl_multi_info_read()).
@@ -25,6 +27,9 @@ PHP                                                                        NEWS
 - LiteSpeed:
  . Updated to LiteSpeed SAPI V7.5 (Fixed clean shutdown). (George Wang)

+- MBString:
+  . Fixed bug #78380 (Oniguruma 6.9.3 fixes CVEs). (CVE-2019-13224) (Stas)
+
 - MySQLnd:
  . Fixed bug #78179 (MariaDB server version incorrectly detected). (cmb)
  . Fixed bug #78213 (Empty row pocket). (cmb)
@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H

-#define ZEND_VERSION "3.3.9-dev"
+#define ZEND_VERSION "3.3.9"

 #define ZEND_ENGINE_3

@@ -271,7 +271,7 @@ static uint32_t calc_gc_buffer_size(zend_generator *generator) /* {{{ */
 		if (EX_CALL_INFO() & ZEND_CALL_FREE_EXTRA_ARGS) {
 			size += EX_NUM_ARGS() - op_array->num_args;
 		}
-		size += Z_TYPE(execute_data->This) == IS_OBJECT; /* $this */
+		size += (EX_CALL_INFO() & ZEND_CALL_RELEASE_THIS) != 0; /* $this */
 		size += (EX_CALL_INFO() & ZEND_CALL_CLOSURE) != 0; /* Closure object */

 		/* Live vars */
@@ -352,7 +352,7 @@ static HashTable *zend_generator_get_gc(zval *object, zval **table, int *n) /* {
 		}
 	}

-	if (Z_TYPE(execute_data->This) == IS_OBJECT) {
+	if (EX_CALL_INFO() & ZEND_CALL_RELEASE_THIS) {
 		ZVAL_OBJ(gc_buffer++, Z_OBJ(execute_data->This));
 	}
 	if (EX_CALL_INFO() & ZEND_CALL_CLOSURE) {
@@ -108,7 +108,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=3
 PHP_RELEASE_VERSION=9
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -29,6 +29,7 @@

 #include "regint.h"

+#if 0
 static void
 conv_ext0be32(const UChar* s, const UChar* end, UChar* conv)
 {
@@ -158,6 +159,7 @@ conv_encoding(OnigEncoding from, OnigEncoding to, const UChar* s, const UChar* e

  return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
 }
+#endif

 extern int
 onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
@@ -169,9 +171,7 @@ onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
  if (IS_NOT_NULL(einfo)) einfo->par = (UChar* )NULL;

  if (ci->pattern_enc != ci->target_enc) {
-    r = conv_encoding(ci->pattern_enc, ci->target_enc, pattern, pattern_end,
-                      &cpat, &cpat_end);
-    if (r != 0) return r;
+    return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
  }
  else {
    cpat     = (UChar* )pattern;
@@ -0,0 +1,10 @@
+--TEST--
+Bug #75457 (heap-use-after-free in php7.0.25)
+--FILE--
+<?php
+$pattern = "/(((?(?C)0?=))(?!()0|.(?0)0)())/";
+var_dump(preg_match($pattern, "hello"));
+?>
+--EXPECTF--
+Warning: preg_match(): Compilation failed: assertion expected after (?( or (?(?C) at offset %d in %sbug75457.php on line %d
+bool(false)
@@ -28,7 +28,7 @@ CREDIT_LINE("FTP", "Stefan Esser, Andrew Skalski");
 CREDIT_LINE("GD imaging", "Rasmus Lerdorf, Stig Bakken, Jim Winstead, Jouni Ahto, Ilia Alshanetsky, Pierre-Alain Joye, Marcus Boerger");
 CREDIT_LINE("GetText", "Alex Plotnick");
 CREDIT_LINE("GNU GMP support", "Stanislav Malyshev");
-CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi ");
+CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi");
 CREDIT_LINE("IMAP", "Rex Logan, Mark Musone, Brian Wang, Kaj-Michael Lang, Antoni Pamies Olive, Rasmus Lerdorf, Andrew Skalski, Chuck Hagenbuch, Daniel R Kalowsky");
 CREDIT_LINE("Input Filter", "Rasmus Lerdorf, Derick Rethans, Pierre-Alain Joye, Ilia Alshanetsky");
 CREDIT_LINE("InterBase", "Jouni Ahto, Andrew Avdeev, Ard Biesheuvel");
@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 3
 #define PHP_RELEASE_VERSION 9
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.3.9-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.3.9"
 #define PHP_VERSION_ID 70309
Author	SHA1	Message	Date
Christoph M. Becker	89dc78e0f0	Prepare PHP 7.3.9	2019-08-27 23:29:58 +02:00
Stanislav Malyshev	a3bc8443f3	Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe() Backport from https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55 (cherry picked from commit `1258303e66`)	2019-08-27 23:27:11 +02:00
Stanislav Malyshev	510ca4a126	Merge branch 'PHP-7.2' into PHP-7.3 * PHP-7.2: Fix #75457: heap-use-after-free in php7.0.25 (cherry picked from commit `5d25ebb0dd`)	2019-08-27 23:15:50 +02:00
Nikita Popov	c4cfab8f84	Fixed bug #78412 $this should only be included in the generator GC buffer, if it will be released on destruction. (cherry picked from commit `fcabe7e5e4`)	2019-08-15 15:24:39 +02:00
Christoph M. Becker	8dc9e843a1	Update credits_ext.h	2019-08-15 15:21:18 +02:00
Christoph M. Becker	2c0381f330	Prepare 7.3.9RC1	2019-08-13 23:29:54 +02:00