143 lines
4.1 KiB
Diff
143 lines
4.1 KiB
Diff
From bbb027263bf9ec3d0ceba01d55307fe728b58f19 Mon Sep 17 00:00:00 2001
|
|
From: Ilija Tovilo <ilija.tovilo@me.com>
|
|
Date: Tue, 7 Jul 2026 20:32:58 +0200
|
|
Subject: [PATCH 4/5] Fix leak on double DatePeriod::__construct() call
|
|
|
|
Closes GH-22643
|
|
|
|
(cherry picked from commit 2d86f8cf489ea5410edd19d301c1aefe330599ab)
|
|
(cherry picked from commit 591e613e1cf6cc10d84df2c799ede593b7371bc1)
|
|
(cherry picked from commit 3f74c8a960c866da1b016bac2fc9e476955fbbc7)
|
|
---
|
|
NEWS | 5 ++++
|
|
ext/date/php_date.c | 25 ++++++++++++++++---
|
|
.../DatePeriod_double_constructor_call.phpt | 14 +++++++++++
|
|
3 files changed, 40 insertions(+), 4 deletions(-)
|
|
create mode 100644 ext/date/tests/DatePeriod_double_constructor_call.phpt
|
|
|
|
diff --git a/NEWS b/NEWS
|
|
index 328fd6d6de..cf9a15804d 100644
|
|
--- a/NEWS
|
|
+++ b/NEWS
|
|
@@ -1,6 +1,11 @@
|
|
PHP NEWS
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
|
+Backported from 8.2.33
|
|
+
|
|
+- Date:
|
|
+ . Fixed leak on double DatePeriod::__construct() call. (ilutov)
|
|
+
|
|
Backported from 8.2.32
|
|
|
|
- OpenSSL:
|
|
diff --git a/ext/date/php_date.c b/ext/date/php_date.c
|
|
index e1a427c5ca..15f13d423f 100644
|
|
--- a/ext/date/php_date.c
|
|
+++ b/ext/date/php_date.c
|
|
@@ -4670,9 +4670,24 @@ static int date_period_initialize(timelib_time **st, timelib_time **et, timelib_
|
|
return retval;
|
|
} /* }}} */
|
|
|
|
-/* {{{ proto DatePeriod::__construct(DateTime $start, DateInterval $interval, int recurrences|DateTime $end)
|
|
- Creates new DatePeriod object.
|
|
-*/
|
|
+static void date_period_reset(php_period_obj *period_obj)
|
|
+{
|
|
+ if (period_obj->start) {
|
|
+ timelib_time_dtor(period_obj->start);
|
|
+ }
|
|
+ if (period_obj->current) {
|
|
+ timelib_time_dtor(period_obj->current);
|
|
+ }
|
|
+ if (period_obj->end) {
|
|
+ timelib_time_dtor(period_obj->end);
|
|
+ }
|
|
+ if (period_obj->interval) {
|
|
+ timelib_rel_time_dtor(period_obj->interval);
|
|
+ }
|
|
+ memset(period_obj, 0, XtOffsetOf(php_period_obj, std));
|
|
+}
|
|
+
|
|
+/* {{{ Creates new DatePeriod object. */
|
|
PHP_METHOD(DatePeriod, __construct)
|
|
{
|
|
php_period_obj *dpobj;
|
|
@@ -4696,7 +4711,7 @@ PHP_METHOD(DatePeriod, __construct)
|
|
}
|
|
|
|
dpobj = Z_PHPPERIOD_P(ZEND_THIS);
|
|
- dpobj->current = NULL;
|
|
+ date_period_reset(dpobj);
|
|
|
|
if (isostr) {
|
|
date_period_initialize(&(dpobj->start), &(dpobj->end), &(dpobj->interval), &recurrences, isostr, isostr_len);
|
|
@@ -4718,6 +4733,8 @@ PHP_METHOD(DatePeriod, __construct)
|
|
}
|
|
dpobj->start_ce = date_ce_date;
|
|
} else {
|
|
+ DATE_CHECK_INITIALIZED(Z_PHPINTERVAL_P(interval)->initialized, Z_OBJCE_P(interval));
|
|
+
|
|
/* init */
|
|
php_interval_obj *intobj = Z_PHPINTERVAL_P(interval);
|
|
|
|
diff --git a/ext/date/tests/DatePeriod_double_constructor_call.phpt b/ext/date/tests/DatePeriod_double_constructor_call.phpt
|
|
new file mode 100644
|
|
index 0000000000..551d272728
|
|
--- /dev/null
|
|
+++ b/ext/date/tests/DatePeriod_double_constructor_call.phpt
|
|
@@ -0,0 +1,14 @@
|
|
+--TEST--
|
|
+Double DatePeriod::__construct() call
|
|
+--FILE--
|
|
+<?php
|
|
+
|
|
+$start = new \DateTime();
|
|
+$interval = new \DateInterval('P1D');
|
|
+$period = new \DatePeriod($start, $interval, 1);
|
|
+$period->__construct($start, $interval, 1);
|
|
+
|
|
+?>
|
|
+===DONE===
|
|
+--EXPECT--
|
|
+===DONE===
|
|
--
|
|
2.55.0
|
|
|
|
From 78793e0bc0a244e228f9e9e9d2a28f48c941f223 Mon Sep 17 00:00:00 2001
|
|
From: Remi Collet <remi@remirepo.net>
|
|
Date: Thu, 30 Jul 2026 09:07:49 +0200
|
|
Subject: [PATCH 5/5] NEWS from 8.2.33
|
|
|
|
(cherry picked from commit 11b947ce14c7fcc77adc740349add4c5c8967a62)
|
|
(cherry picked from commit 9aa1f1c43308560bb5dc97cbf8995c66108aeef0)
|
|
---
|
|
NEWS | 11 +++++++++++
|
|
1 file changed, 11 insertions(+)
|
|
|
|
diff --git a/NEWS b/NEWS
|
|
index cf9a15804d..6e0a091363 100644
|
|
--- a/NEWS
|
|
+++ b/NEWS
|
|
@@ -6,6 +6,17 @@ Backported from 8.2.33
|
|
- Date:
|
|
. Fixed leak on double DatePeriod::__construct() call. (ilutov)
|
|
|
|
+- GD:
|
|
+ . Upgrade libgd. (CVE-2026-9672) (Pierre Joye)
|
|
+
|
|
+- PGSQL:
|
|
+ . Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout).
|
|
+ (CVE-2026-17543) (ilutov)
|
|
+
|
|
+- Phar:
|
|
+ . Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)
|
|
+ (Jakub Zelenka)
|
|
+
|
|
Backported from 8.2.32
|
|
|
|
- OpenSSL:
|
|
--
|
|
2.55.0
|
|
|