Merge ~athos-ribeiro/ubuntu/+source/php7.4:focal-infinite-loop into ubuntu/+source/php7.4:ubuntu/focal-devel

[Athos Ribeiro]

This is a proposal to fix https://bugs.launchpad.net/ubuntu/+source/php7.4/+bug/1951031 for focal.

A PPA with the proposed patch is available at https://launchpad.net/~athos-ribeiro/+archive/ubuntu/php7-lp-1951031/+packages

I also ran the dep8 test suite locally. Here is the test summary:

autopkgtest [21:16:48]: @@@@@@@@@@@@@@@@@@@@ summary
cli PASS
cgi PASS
mod-php PASS
fpm PASS

[Christian Ehrhardt  (paelzer)]

Hi,
well done - changelog, patches, patch heeaders, references, PPA builds and tests that all LGTM.
I'll approve the MP, but not sponsor yet as the bug has no proper SRU description yet.
Once added anyone around can IMHO sponsor this.

P.S. you missed to add review slots for us - let us see where tha "approve" lands :-)

review: Approve

[Sergio Durigan Junior (sergiodj)]

Uploaded:

$ dput php7.4_7.4.3-4ubuntu2.8_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/php7.4/php7.4_7.4.3-4ubuntu2.8_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/php7.4/php7.4_7.4.3-4ubuntu2.8.dsc: Valid signature from 106DA1C8C3CBBF14
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading php7.4_7.4.3-4ubuntu2.8.dsc: done.
  Uploading php7.4_7.4.3-4ubuntu2.8.debian.tar.xz: done.
  Uploading php7.4_7.4.3-4ubuntu2.8_source.buildinfo: done.
  Uploading php7.4_7.4.3-4ubuntu2.8_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index cde177a..b58bcd7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+php7.4 (7.4.3-4ubuntu2.8) focal; urgency=medium
+
+  * d/p/0047-fix-exception-infinite-loop.patch: Fix ErrorException infinite
+    loop (LP: #1951031)
+
+ -- Athos Ribeiro <[e-mail]>  Thu, 25 Nov 2021 20:16:22 -0300
+
 php7.4 (7.4.3-4ubuntu2.7) focal-security; urgency=medium
 
   * SECURITY UPDATE: Out of bounds read/write
diff --git a/debian/patches/0047-fix-exception-infinite-loop.patch b/debian/patches/0047-fix-exception-infinite-loop.patch
new file mode 100644
index 0000000..7ebe1de
--- /dev/null
+++ b/debian/patches/0047-fix-exception-infinite-loop.patch
@@ -0,0 +1,195 @@
+From 6dd85f83f78fbafc4a90b264e577a31b59323314 Mon Sep 17 00:00:00 2001
+From: Nikita Popov <[e-mail]>
+Date: Mon, 22 Feb 2021 09:33:23 +0100
+Subject: [PATCH] Fixed bug #80781
+
+zend_find_array_dim_slow() may throw, make sure to handle this.
+This backports the code we already use for this on PHP-8.0,
+and also backports an exception check that makes this easier to
+catch.
+
+Bug: https://bugs.php.net/bug.php?id=80781
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/php7.4/+bug/1951031
+Last-Update: 2021-11-25
+Origin: upstream, https://github.com/php/php-src/commit/6dd85f83f78fbafc4a90b264e577a31b59323314
+---
+ NEWS                     |  4 ++++
+ Zend/tests/bug80781.phpt | 32 ++++++++++++++++++++++++++++++++
+ Zend/zend_execute.c      |  1 +
+ Zend/zend_vm_def.h       |  4 ++++
+ Zend/zend_vm_execute.h   | 36 ++++++++++++++++++++++++++++++++++++
+ 5 files changed, 77 insertions(+)
+ create mode 100644 Zend/tests/bug80781.phpt
+
+--- a/NEWS
++++ b/NEWS
+@@ -202,6 +202,10 @@
+   . Fixed bug #78916 (php-fpm 7.4.0 don't send mail via mail()).
+     (Jakub Zelenka)
+ 
++- Core:
++  . Fixed bug #80781 (Error handler that throws ErrorException infinite loop).
++    (Nikita)
++
+ - Intl:
+   . Implemented FR #78912 (INTL Support for accounting format). (cmb)
+ 
+--- /dev/null
++++ b/Zend/tests/bug80781.phpt
+@@ -0,0 +1,32 @@
++--TEST--
++Bug #80781: Error handler that throws ErrorException infinite loop
++--FILE--
++<?php
++
++function handle(int $severity, string $message, string $file, int $line): bool {
++	if((error_reporting() & $severity) !== 0) {
++		throw new \ErrorException($message, 0, $severity, $file, $line);
++	}
++
++	return true; // stfu operator
++}
++
++set_error_handler('handle');
++
++function getPlugin(string $plugin) : bool{
++	return false;
++}
++
++$data = [];
++$array = [];
++if (isset($array[$data]) or getPlugin($data)) {
++
++}
++
++?>
++--EXPECTF--
++Fatal error: Uncaught ErrorException: Illegal offset type in isset or empty in %s:%d
++Stack trace:
++#0 %s(%d): handle(2, 'Illegal offset ...', %s, %d, Array)
++#1 {main}
++  thrown in %s on line %d
+--- a/Zend/zend_execute.c
++++ b/Zend/zend_execute.c
+@@ -4496,6 +4496,7 @@
+ 	if (check_exception) { \
+ 		OPLINE = EX(opline) + (skip); \
+ 	} else { \
++		ZEND_ASSERT(!EG(exception)); \
+ 		OPLINE = opline + (skip); \
+ 	} \
+ 	ZEND_VM_CONTINUE()
+--- a/Zend/zend_vm_def.h
++++ b/Zend/zend_vm_def.h
+@@ -6908,6 +6908,10 @@
+ 			ZEND_VM_C_GOTO(isset_again);
+ 		} else {
+ 			value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
++			if (UNEXPECTED(EG(exception))) {
++				result = 0;
++				ZEND_VM_C_GOTO(isset_dim_obj_exit);
++			}
+ 		}
+ 
+ 		if (!(opline->extended_value & ZEND_ISEMPTY)) {
+--- a/Zend/zend_vm_execute.h
++++ b/Zend/zend_vm_execute.h
+@@ -6260,6 +6260,10 @@
+ 			goto isset_again;
+ 		} else {
+ 			value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
++			if (UNEXPECTED(EG(exception))) {
++				result = 0;
++				goto isset_dim_obj_exit;
++			}
+ 		}
+ 
+ 		if (!(opline->extended_value & ZEND_ISEMPTY)) {
+@@ -8454,6 +8458,10 @@
+ 			goto isset_again;
+ 		} else {
+ 			value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
++			if (UNEXPECTED(EG(exception))) {
++				result = 0;
++				goto isset_dim_obj_exit;
++			}
+ 		}
+ 
+ 		if (!(opline->extended_value & ZEND_ISEMPTY)) {
+@@ -10907,6 +10915,10 @@
+ 			goto isset_again;
+ 		} else {
+ 			value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
++			if (UNEXPECTED(EG(exception))) {
++				result = 0;
++				goto isset_dim_obj_exit;
++			}
+ 		}
+ 
+ 		if (!(opline->extended_value & ZEND_ISEMPTY)) {
+@@ -14943,6 +14955,10 @@
+ 			goto isset_again;
+ 		} else {
+ 			value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
++			if (UNEXPECTED(EG(exception))) {
++				result = 0;
++				goto isset_dim_obj_exit;
++			}
+ 		}
+ 
+ 		if (!(opline->extended_value & ZEND_ISEMPTY)) {
+@@ -16360,6 +16376,10 @@
+ 			goto isset_again;
+ 		} else {
+ 			value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
++			if (UNEXPECTED(EG(exception))) {
++				result = 0;
++				goto isset_dim_obj_exit;
++			}
+ 		}
+ 
+ 		if (!(opline->extended_value & ZEND_ISEMPTY)) {
+@@ -17647,6 +17667,10 @@
+ 			goto isset_again;
+ 		} else {
+ 			value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
++			if (UNEXPECTED(EG(exception))) {
++				result = 0;
++				goto isset_dim_obj_exit;
++			}
+ 		}
+ 
+ 		if (!(opline->extended_value & ZEND_ISEMPTY)) {
+@@ -41440,6 +41464,10 @@
+ 			goto isset_again;
+ 		} else {
+ 			value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
++			if (UNEXPECTED(EG(exception))) {
++				result = 0;
++				goto isset_dim_obj_exit;
++			}
+ 		}
+ 
+ 		if (!(opline->extended_value & ZEND_ISEMPTY)) {
+@@ -44892,6 +44920,10 @@
+ 			goto isset_again;
+ 		} else {
+ 			value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
++			if (UNEXPECTED(EG(exception))) {
++				result = 0;
++				goto isset_dim_obj_exit;
++			}
+ 		}
+ 
+ 		if (!(opline->extended_value & ZEND_ISEMPTY)) {
+@@ -50079,6 +50111,10 @@
+ 			goto isset_again;
+ 		} else {
+ 			value = zend_find_array_dim_slow(ht, offset EXECUTE_DATA_CC);
++			if (UNEXPECTED(EG(exception))) {
++				result = 0;
++				goto isset_dim_obj_exit;
++			}
+ 		}
+ 
+ 		if (!(opline->extended_value & ZEND_ISEMPTY)) {
diff --git a/debian/patches/series b/debian/patches/series
index 5dc89cf..149f3ff 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -62,3 +62,4 @@ CVE-2021-21705-2.patch
 lp-1939853-1-Fix-Segfault-with-get_result-and-PS-cursors.patch
 lp-1939853-2-MySQLnd-Support-cursors-in-store-get-result.patch
 CVE-2021-21703.patch
+0047-fix-exception-infinite-loop.patch