Merge branch 'rosa2023.1' into rosa2021.1

CVE-2022-4900.patch

@@ -0,0 +1,30 @@
+# from https://github.com/php/php-src/commit/789a37f14405e2d1a05a76c9fb4ed2d49d4580d5#diff-0265438340ea11a73f2e268834e3ac37b52342d9a911b5c4193df0b0072895ecR2389
+
+diff -ruN a/sapi/cli/php_cli_server.c b/sapi/cli/php_cli_server.c
+--- a/sapi/cli/php_cli_server.c	2022-10-31 19:36:05.000000000 +0900
++++ b/sapi/cli/php_cli_server.c	2024-11-28 11:05:56.301504326 +0900
+@@ -517,13 +517,8 @@
+ 		if (php_cli_server_workers_max > 1) {
+ 			zend_long php_cli_server_worker;
+ 
+-			php_cli_server_workers = calloc(
+-				php_cli_server_workers_max, sizeof(pid_t));
+-			if (!php_cli_server_workers) {
+-				php_cli_server_workers_max = 1;
+-
+-				return SUCCESS;
+-			}
++			php_cli_server_workers = pecalloc(
++				php_cli_server_workers_max, sizeof(pid_t), 1);
+ 
+ 			php_cli_server_master = getpid();
+ 
+@@ -2361,7 +2356,7 @@
+ 					  !WIFSIGNALED(php_cli_server_worker_status));
+ 		}
+ 
+-		free(php_cli_server_workers);
++		pefree(php_cli_server_workers, 1);
+ 	}
+ #endif
+ } /* }}} */

php7.spec

@@ -27,7 +27,7 @@
 Summary:	The PHP7 scripting language
 Name:		php
 Version:	7.4.33
-Release:	8
+Release:	11
 Source0:	http://ch1.php.net/distributions/php-%{version}.tar.gz
 Source1:	macros.php
 Group:		Development/PHP
@@ -85,7 +85,9 @@ Patch122:	php-not-use-libgd-const.patch
 Patch127:	php-7.4.30-svace-fixes.patch
 Patch128:	0001-Revert-Throw-notice-on-array-access-on-illegal-type.patch
 Patch200:	fix-include-e2k.patch
-
+# fix for openssl3, rediff from https://git.remirepo.net/cgit/rpms/scl-php74/php.git/plain/php-7.4.26-openssl3.patch
+Patch201:	php-7.4.33-openssl3.patch
+Patch202:	CVE-2022-4900.patch
 BuildRequires:	autoconf
 BuildRequires:	automake
 BuildRequires:	bison
@@ -1120,7 +1122,7 @@ Group:		Development/Other
 Requires:	%{libname} >= %{EVRD}
 Requires:	%{name}-ctype >= %{EVRD}
 Requires:	%{name}-filter >= %{EVRD}
-Requires:	%{name}-ftp >= %{EVRD}
+#Requires:	%{name}-ftp >= %{EVRD}
 Requires:	%{name}-gettext >= %{EVRD}
 Requires:	%{name}-ini >= %{version}
 Requires:	%{name}-json >= %{EVRD}
@@ -1163,7 +1165,7 @@ Requires:	apache-modules >= 2.4.0
 Requires:	apache-mpm >= 2.4.0
 Requires:	%{name}-ctype = %{EVRD}
 Requires:	%{name}-filter = %{EVRD}
-Requires:	%{name}-ftp = %{EVRD}
+#Requires:	%{name}-ftp = %{EVRD}
 Requires:	%{name}-gettext = %{EVRD}
 Requires:	%{name}-ini >= %{version}
 Requires:	%{name}-json = %{EVRD}
@@ -1296,6 +1298,8 @@ fi
 %ifarch %{e2k}
 %patch200 -p1
 %endif
+%patch201 -p1
+%patch202 -p1
 
 cp %{SOURCE2} maxlifetime
 cp %{SOURCE3} php.crond
@@ -1369,7 +1373,7 @@ CFLAGS=`echo $CFLAGS|sed -e 's|-fPIE||g'`
 CXXFLAGS=`echo $CXXFLAGS|sed -e 's|-fPIE||g'`
 
 #export CFLAGS="`echo ${CFLAGS} | sed s/O2/O0/` -fPIC -L%{_libdir} -fno-strict-aliasing"
-export CFLAGS="${CFLAGS} -fPIC -L%{_libdir} -fno-strict-aliasing"
+export CFLAGS="${CFLAGS} -fPIC -L%{_libdir} -fno-strict-aliasing -Wno-incompatible-pointer-types"
 export CXXFLAGS="${CFLAGS}"
 export RPM_OPT_FLAGS="${CFLAGS}"
 
@@ -1441,9 +1445,10 @@ for i in fpm cgi cli apxs; do
     --disable-debug  \
     --enable-inline-optimization \
     --with-zlib=%{_prefix} \
+    --with-openssl=shared,%{_prefix} \
+    --with-openssl-dir=%{_prefix} --enable-ftp=shared \
     --with-pdo-odbc=unixODBC \
     --with-zlib=shared,%{_prefix} --with-zlib-dir=%{_prefix} \
-    --with-openssl=shared,%{_prefix} \
     --without-pear \
     --enable-bcmath=shared \
     --with-bz2=shared,%{_prefix} \
@@ -1458,7 +1463,6 @@ for i in fpm cgi cli apxs; do
     --enable-filter=shared \
     --enable-intl=shared \
     --enable-json=shared \
-    --with-openssl-dir=%{_prefix} --enable-ftp=shared \
     --with-zlib-dir=%{_prefix} \
     --with-gettext=shared,%{_prefix} \
     --with-gmp=shared,%{_prefix} \
@@ -1840,7 +1844,7 @@ for i in modules/*.so; do
 	xsl.so)
 		# Unresolved symbols, need fixing
 		;;
-#	ctype.so|dom.so|openssl.so|zlib.so|ftp.so|gettext.so|posix.so|session.so|hash.so|sysvsem.so|sysvshm.so|tokenizer.so|xml.so|xmlreader.so|xmlwriter.so|filter.so|json.so)
+#	ctype.so|dom.so|openssl.so|ftp.so|zlib.so|gettext.so|posix.so|session.so|hash.so|sysvsem.so|sysvshm.so|tokenizer.so|xml.so|xmlreader.so|xmlwriter.so|filter.so|json.so)
 		# Apparently loaded by default without a need to mention them in the ini file
 #		;;
 	*)