bugbot adjusting priority

Created attachment 682008 [details]
xx.php

QA REPRODUCER:

php xx.php

should return
array(1) refcount(1){
  [0]=>
  object(stdClass)#3 (0) refcount(3){
  }
}

I think

Not sure how the testcase should work.

Fixed in 13.2/php5 and 12/php5.

The behaviour seems to trigger for php 5.3

As Petr found, the garbage collection hooks work differently.

was checking the sources

(In reply to Marcus Meissner from comment #5)
> The behaviour seems to trigger for php 5.3

Actually, not for me. I get

$ php xx.php
array(1) refcount(1){
  [0]=>
  object(stdClass)#3 (0) refcount(3){
  }
}

$

which is the exact expected output from the test, as far as I can see. Without patching anything.

> As Petr found, the garbage collection hooks work differently.
> 
> was checking the sources

Will submit now without the fix for 5.3. Please reassign back to me as soon as the release happens, if you still want to fix this for 5.3.

(see also bug 986391)

Packages submitted.

This is an autogenerated message for OBS integration:
This bug (986247) was mentioned in
https://build.opensuse.org/request/show/405425 13.2 / php5

(In reply to Petr Gajdos from comment #6)
> (In reply to Marcus Meissner from comment #5)
> > The behaviour seems to trigger for php 5.3
> 
> Actually, not for me. I get

Sorry, obvious mistake, forgot to install php5-zip. Now I get

$ php xx.php
string(13) "filler_zval_2" refcount(2)
$

even for php53, yes. Thanks Marcus.

This is an autogenerated message for OBS integration:
This bug (986247) was mentioned in
https://build.opensuse.org/request/show/405458 13.2 / php5

openSUSE-SU-2016:1761-1: An update that fixes 9 vulnerabilities is now available.

Category: security (important)
Bug References: 986004,986244,986246,986247,986386,986388,986391,986392,986393
CVE References: CVE-2015-8935,CVE-2016-5766,CVE-2016-5767,CVE-2016-5768,CVE-2016-5769,CVE-2016-5770,CVE-2016-5771,CVE-2016-5772,CVE-2016-5773
Sources used:
openSUSE 13.2 (src):    php5-5.6.1-69.1

(not fixed yet for sle11/sle12)

Actually, sle12 is fixed (php-CVE-2016-5773.patch), just changelog entry was missing.

P4 for sle11.

SUSE-SU-2016:2975-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1008029,986247
CVE References: CVE-2016-5773,CVE-2016-9137
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    imap-2007e_suse-22.1
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    imap-2007e_suse-22.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    imap-2007e_suse-22.1, php5-5.5.14-86.2
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    imap-2007e_suse-22.1, php5-5.5.14-86.2
SUSE Linux Enterprise Module for Web Scripting 12 (src):    imap-2007e_suse-22.1, php5-5.5.14-86.2
SUSE Linux Enterprise Desktop 12-SP2 (src):    imap-2007e_suse-22.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    imap-2007e_suse-22.1

openSUSE-SU-2016:3095-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1008029,986247
CVE References: CVE-2016-5773,CVE-2016-9137
Sources used:
openSUSE Leap 42.2 (src):    php5-5.5.14-69.1
openSUSE Leap 42.1 (src):    php5-5.5.14-68.3

released

An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2017-02-13.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/63367

Created attachment 758442 [details]
dirty approach to fix this in php 5.3

Created attachment 758443 [details]
clean approach to fix this in php 5.3

So here it goes. I have two different patches with two different approaches to fix this issue in php 5.3:

- attachment 758442 [details] contains the "dirty" but simple approach. It does not change any data structures. Since it compares a class name by string it might influence performance a little. Also it will not extend so well should we need more similar patches in the future.

- attachement 758443 contains the "clean" but a bit more complex approach. It introduces parts of the "get_gc" method infrastructure as found in php 5.4 onwards. This requires to extended global data structures and it's difficult to say if this has any side effects I'm not aware of. It is better for performance and can be extended easily should we need more similar patches in the future.

I've tested both patches and the reproducer does not trigger any more. Valgrind runs through cleanly. Please review and decide which patch to take :-)

Created attachment 758972 [details]
ABI compatible fix

Since the previous "clean" patch variant was not ABI compatible and the "dirty" patch was not good enough to support the fix of bug 986391 I've devised a new patch for this issue.

In attachment 758972 [details] you can find the new ABI compatible fix for php 5.3. The major difference to the previous "clean" patch is that we're misusing the get_closure handler field to mark extensions that support the extended global handlers structure.

Created attachment 759080 [details]
testcase modified by Matthias Gerstner

BEFORE

$ php xx_sle11.php 
No entry for terminal type "rxvt-unicode";
using dumb terminal settings.
array(1) refcount(1){
  [0]=>
  object(stdClass)#3 (0) refcount(2){
  }
}
string(0) "" refcount(1)
Segmentation fault (core dumped)
$

AFTER

$ php xx_sle11.php 
array(1) refcount(1){
  [0]=>
  object(stdClass)#3 (0) refcount(2){
  }
}
array(1) refcount(1){
  [0]=>
  object(stdClass)#3 (0) refcount(2){
  }
}
array(1) refcount(1){
  [0]=>
  object(stdClass)#3 (0) refcount(3){
  }
}
$

Packages submitted.
Thanks Matthias.

SUSE-SU-2018:0806-1: An update that fixes 6 vulnerabilities is now available.

Category: security (important)
Bug References: 1076220,1076391,1080234,1083639,986247,986391
CVE References: CVE-2016-10712,CVE-2016-5771,CVE-2016-5773,CVE-2018-5711,CVE-2018-5712,CVE-2018-7584
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    php53-5.3.17-112.20.1
SUSE Linux Enterprise Server 11-SP4 (src):    php53-5.3.17-112.20.1
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    php53-5.3.17-112.20.1
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    php53-5.3.17-112.20.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    php53-5.3.17-112.20.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    php53-5.3.17-112.20.1

done