Merge ~athos-ribeiro/ubuntu/+source/php8.1:lp1990302-tmp-stream-file-pos into ubuntu/+source/php8.1:ubuntu/jammy-devel

[Athos Ribeiro]

Jammy fix for LP: #1990302

PPA: https://launchpad.net/~athos-ribeiro/+archive/ubuntu/lp1990302-tmp-stream-file-pos/+packages

Local autopkgtest run result summary:

autopkgtest [16:22:36]: @@@@@@@@@@@@@@@@@@@@ summary
cli PASS
cgi PASS
mod-php PASS
fpm PASS
version PASS

[Bryce Harrington (bryce)]

Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-jammy-athos-ribeiro-lp1990302-tmp-stream-file-pos/?format=plain)
  php8.1 @ amd64:
    20.10.22 23:34:14 Log 🗒️ ✅ Triggers: php8.1/8.1.2-1ubuntu2.7~ppa1
  php8.1 @ armhf:
    20.10.22 23:33:56 Log 🗒️ ✅ Triggers: php8.1/8.1.2-1ubuntu2.7~ppa1
  php8.1 @ ppc64el:
    20.10.22 23:37:20 Log 🗒️ ✅ Triggers: php8.1/8.1.2-1ubuntu2.7~ppa1
  php8.1 @ s390x:
    20.10.22 23:25:16 Log 🗒️ ✅ Triggers: php8.1/8.1.2-1ubuntu2.7~ppa1

In a jammy LXC container, verified the reproducer myself:

  $ sudo apt-get install php-common php-cli
  $ php reproduce.php
  string(16) "1111111111111111"
  int(1250)
  $ sudo add-apt-repository -yus ppa:athos-ribeiro/lp1990302-tmp-stream-file-pos
  $ sudo apt-get -y dist-upgrade
  $ php reproduce.php
  string(16) "2222222222222222"
  int(738)

I reviewed the patch's code, and verified it matches upstream.
Packaging changes look good.

The only thing I might mention, is that the changelog entry description is rather terse. The SRU [Impact] text is really informative though, and I wonder if some text could be borrowed from that. E.g.:

  * d/p/0049-Preserve-file-position-when-php-temp-switches.patch: PHP provides a
    temporary data stream, php://temp, whose contents are moved to a temporary file
    when a predefined size limit is hit. In jammy, the file position is set to the
    end of the file, which results in corrupted/unwanted data. Fix this by
    preserving the file position in this situation.
    (LP: #1990302)

Maybe a bit wordy but gives a better explanation of the change. This is just optional though; people can easily link over to the referenced bug to get the full explanation if they need.

review: Approve

[Athos Ribeiro (athos-ribeiro)]

Thanks, Bryce!

I applied the changelog suggestions and uploaded it!

$ dput ubuntu ../php8.1_8.1.2-1ubuntu2.7_source.changes
D: Setting host argument.
Checking signature on .changes
gpg: ../php8.1_8.1.2-1ubuntu2.7_source.changes: Valid signature from 033C4CA276024834
Checking signature on .dsc
gpg: ../php8.1_8.1.2-1ubuntu2.7.dsc: Valid signature from 033C4CA276024834
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading php8.1_8.1.2-1ubuntu2.7.dsc: done.
  Uploading php8.1_8.1.2-1ubuntu2.7.debian.tar.xz: done.
  Uploading php8.1_8.1.2-1ubuntu2.7_source.buildinfo: done.
  Uploading php8.1_8.1.2-1ubuntu2.7_source.changes: done.
Successfully uploaded packages.

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: athos-ribeiro, bryce
Uploaders: athos-ribeiro, bryce
MP auto-approved

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 2c48cf6..99e7278 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,14 @@
+php8.1 (8.1.2-1ubuntu2.7) jammy; urgency=medium
+
+  * d/p/0049-Preserve-file-position-when-php-temp-switches.patch: PHP provides
+    a temporary data stream, php://temp, whose contents are moved to a
+    temporary file when a predefined size limit is hit. In jammy, the file
+    position is set to the end of the file, which results in corrupted/unwanted
+    data. Fix this by preserving the file position in this situation.
+    (LP: #1990302)
+
+ -- Athos Ribeiro <[e-mail]>  Wed, 19 Oct 2022 11:58:09 -0300
+
 php8.1 (8.1.2-1ubuntu2.6) jammy; urgency=medium
 
   * d/rules: fix PHP_EXTRA_VERSION setting. (LP: #1989196)
diff --git a/debian/patches/0049-Preserve-file-position-when-php-temp-switches.patch b/debian/patches/0049-Preserve-file-position-when-php-temp-switches.patch
new file mode 100644
index 0000000..ca19cb3
--- /dev/null
+++ b/debian/patches/0049-Preserve-file-position-when-php-temp-switches.patch
@@ -0,0 +1,64 @@
+From 84c18f9f04cb9852d992194e613927154f765192 Mon Sep 17 00:00:00 2001
+From: Bernd Holzmüller <[e-mail]>
+Date: Sat, 9 Apr 2022 17:49:47 +0200
+Subject: [PATCH] Preserve file-position when php://temp switches to temporary file
+
+Closes GH-8333.
+
+Bug: https://github.com/php/php-src/pull/8333
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/php8.1/+bug/1990302
+Last-Update: 2022-10-19
+Origin: backport, https://github.com/php/php-src/commit/84c18f9f04cb9852d992194e613927154f765192
+---
+ .../tests/streams/temp_stream_seek.phpt       | 20 +++++++++++++++++++
+ main/streams/memory.c                         | 10 ++++++----
+ 3 files changed, 30 insertions(+), 4 deletions(-)
+ create mode 100644 ext/standard/tests/streams/temp_stream_seek.phpt
+
+--- /dev/null
++++ b/ext/standard/tests/streams/temp_stream_seek.phpt
+@@ -0,0 +1,20 @@
++--TEST--
++BUG: php://temp does not preserve file-pointer once it switches from memory to temporary file
++--FILE--
++<?php
++
++$f = fopen('php://temp/maxmemory:1024', 'r+');
++fwrite($f, str_repeat("1", 738));
++fseek($f, 0, SEEK_SET);
++fwrite($f, str_repeat("2", 512));
++
++fseek($f, 0, SEEK_SET);
++var_dump(fread($f, 16));
++
++fseek($f, 0, SEEK_END);
++var_dump(ftell($f));
++
++?>
++--EXPECT--
++string(16) "2222222222222222"
++int(738)
+--- a/main/streams/memory.c
++++ b/main/streams/memory.c
+@@ -345,9 +345,10 @@
+ 		return -1;
+ 	}
+ 	if (php_stream_is(ts->innerstream, PHP_STREAM_IS_MEMORY)) {
+-		zend_string *membuf = php_stream_memory_get_buffer(ts->innerstream);
+-
+-		if (ZSTR_LEN(membuf) + count >= ts->smax) {
++		zend_off_t pos = php_stream_tell(ts->innerstream);
++		
++		if (pos + count >= ts->smax) {
++			zend_string *membuf = php_stream_memory_get_buffer(ts->innerstream);
+ 			php_stream *file = php_stream_fopen_temporary_file(ts->tmpdir, "php", NULL);
+ 			if (file == NULL) {
+ 				php_error_docref(NULL, E_WARNING, "Unable to create temporary file, Check permissions in temporary files directory.");
+@@ -357,6 +358,7 @@
+ 			php_stream_free_enclosed(ts->innerstream, PHP_STREAM_FREE_CLOSE);
+ 			ts->innerstream = file;
+ 			php_stream_encloses(stream, ts->innerstream);
++			php_stream_seek(ts->innerstream, pos, SEEK_SET);
+ 		}
+ 	}
+ 	return php_stream_write(ts->innerstream, buf, count);
diff --git a/debian/patches/series b/debian/patches/series
index abf5480..5cf3bfd 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -46,6 +46,7 @@
 0046-Fix-ssl3-unexpected-eof.patch
 0047-Update-gcc-func-attr-macro.patch
 0048-Clear-recorded-errors-before-executing-shutdown-func.patch
+0049-Preserve-file-position-when-php-temp-switches.patch
 CVE-2021-21708.patch
 CVE-2022-31625.patch
 CVE-2022-31626.patch