Merge ~bryce/ubuntu/+source/php7.4:merge-v7o4o5-1-groovy into ubuntu/+source/php7.4:debian/sid

[Bryce Harrington]

Pretty straightforward merge from debian of php7.4. Three CVEs could be dropped since they're included in the upstream release.

There's some warnings in both the source and binary debuilds but nothing remarkable enough to carry delta for. E.g. formatting of stuff in debian/copying, and ISO C warnings about void * pointer handling.

Since this is a point update rather than a transition, we likely will be able to avoid most of the php stack rebuild, but there's usually some random assortment of migration issues to handle as followup.

Usual tags pushed.

PPA: https://launchpad.net/~bryce/+archive/ubuntu/php7.4-merge-v7o4o5-1

[Christian Ehrhardt  (paelzer)]

Could you add https://bugs.launchpad.net/ubuntu/+source/php7.4/+bug/1887826 to the list of bugs being fixed?

[Christian Ehrhardt  (paelzer)]

When uploaded you might want to try the new auto-transition tracker at https://people.canonical.com/~ubuntu-archive/transitions/

[Christian Ehrhardt  (paelzer)]

v7o4o5 is quite the leetspeek try :-) - what is vtoaos? :-P

Changelog:
- [✓] old content and logical tag match as expected
- [✓] changelog entry correct version and targeted codename
- [x] changelog entries not correct
      Line 23,24 and 29 have invalid indent
- [✓] update-maintainer has been run

Actual changes:
- [✓] no major upstream changes to consider having impact on packaging
- [x] hmm further upstream version to consider
    I know we rebase from Debian, but doing 7.4.5 now while 7.4.8 is available.
    Quite some fixes - how about doing this once for groovy ang going to the July version right
    away instead of the April release?
    7.4.8 seems to be a required CVE anyway
    https://www.php.net/ChangeLog-7.php#7.4.8
    https://www.php.net/releases/7_4_8.php
    If you go ahead of Debian for this or ping Ondřej if he'd mind to bump Debian is up to you.
- [✓] debian changes look safe (only a few in 7.4.4-1)

Old Delta:
- [✓] dropped changes are ok to be dropped
- [✓] nothing else to drop
    Well if we'd go to >=7.4.6 another CVE fix would be part of upstreams code.

    The conflicts for upgrades from former versions have to go through Focal.
    Therefore the conflict with 7.2/7.3 will already have happened.
    This surely covers:
  4 - d/control, d/control.in: Conflict with mod-php from php7.2 and
  5 php7.3 to ensure safe upgrade path for apache2.
  6 (Fixes LP #1850933)
    Maybe even this:
  7 - libapache2-mod-php.postinst.extra: Disable other mod-php versions.
  8 Fixes failure when upgrading from previous versions of mod-php.
  9 (LP 1865218)
    IMHO the related Delta can be dropped now (similar delta will come back
    once moving to 7.5). What do you think?

Bonus - if you agree and go to >=7.4.6 there will be NO Ubuntu Delta left.
So it could be a sync (for a short while).

New Delta:
- [✓] no new patches added

Build/Test:
- [✓] build is ok (I agree the few errors don't warrant extra Delta)
- [✓] verified PPA package installs/uninstalls
   (x86 only build , boo - but it seems I'm generally the only one complaining :-) )
- [✓] I've not seen autopkgtest data, but that will happen before migration so we'd catch it

The fixes in changelog are required but not too impactful, the decisions on Delta and Versions are up to you mostly. Since I'm probably away once you resolved these feel free to ask another reviewer or go on with an upload once you addressed my concerns.

review: Needs Fixing

[Bryce Harrington (bryce)]

It's a good point about the newer upstream versions, indeed that's why I had originally planned to leave this merge to do in August. But I have +1 maint and a week long vacation in August, so figured it'd be good to tackle it early.

So I think what I'll do is land this now, with the changelog changes you recommend, and plan to do another merge/sync later in the cycle. I think the next major version will be 8.0, not 7.5. So having the 7.4 series updated as much as possible is probably a good idea.

Sorry about only including x86... I'm kicking myself because I've been making an effort to enable all arch's in my PPAs now, but apparently forgot to do so for this one. I wish there was a setting to make that ones' default. Anyway, when there have been arch-specific issues with php they seem to crop up more with the autopkgtests than the build itself.

[Bryce Harrington (bryce)]

I've applied the changes you recommended, and tagged & pushed 7.4.5:

$ git ubuntu tag --upload
$ git push pkg upload/7.4.5-1ubuntu1
Enumerating objects: 44, done.
Counting objects: 100% (44/44), done.
Delta compression using up to 12 threads
Compressing objects: 100% (35/35), done.
Writing objects: 100% (36/36), 6.51 KiB | 6.51 MiB/s, done.
Total 36 (delta 25), reused 2 (delta 1)
To ssh://git.launchpad.net/ubuntu/+source/php7.4
 * [new tag] upload/7.4.5-1ubuntu1 -> upload/7.4.5-1ubuntu1
$ dput ubuntu php7.4_7.4.5-1ubuntu1_source.changes
Checking signature on .changes
gpg: /home/bryce/pkg/Php7.4/merge-v7.4.5-1/php7.4_7.4.5-1ubuntu1_source.changes: Valid signature from E603B2578FB8F0FB
Checking signature on .dsc
gpg: /home/bryce/pkg/Php7.4/merge-v7.4.5-1/php7.4_7.4.5-1ubuntu1.dsc: Valid signature from E603B2578FB8F0FB
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading php7.4_7.4.5-1ubuntu1.dsc: done.
  Uploading php7.4_7.4.5-1ubuntu1.debian.tar.xz: done.
  Uploading php7.4_7.4.5-1ubuntu1_source.buildinfo: done.
  Uploading php7.4_7.4.5-1ubuntu1_source.changes: done.
Successfully uploaded packages.

I'll add a card to do another php7.4 merge later in the cycle.

[Bryce Harrington (bryce)]

This transitioned

diff --git a/debian/changelog b/debian/changelog
index a67d2fe..a05a1d8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,37 @@
+php7.4 (7.4.5-1ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/control, d/control.in: Conflict with mod-php from php7.2 and
+      php7.3 to ensure safe upgrade path for apache2.
+      (Fixes LP #1850933)
+    - libapache2-mod-php.postinst.extra: Disable other mod-php versions.
+      Fixes failure when upgrading from previous versions of mod-php.
+      (LP 1865218)
+    - SECURITY UPDATE: Denial of service through oversized memory allocated
+      + debian/patches/CVE-2019-11048.patch: changes types int to size_t
+        in main/rfc1867.c.
+      + CVE-2019-11048
+  * Dropped:
+    - SECURITY UPDATE: Read one byte of uninitialized memory
+      + debian/patches/CVE-2020-7064.patch: check length in
+        exif_process_TIFF_in_JPEG to avoid read uninitialized memory
+        ext/exif/exif.c, ext/exif/tests/bug79282.phpt.
+      + CVE-2020-7064
+      [Fixed in 7.4.5-1]
+    - SECURITY UPDATE: Memory corruption, crash and potentially code execution
+      + debian/patches/CVE-2020-7065.patch: make sure that negative values are
+	properly compared in ext/mbstring/php_unicode.c,
+	ext/mbstring/tests/bug70371.phpt.
+      + CVE-2020-7065
+      [Fixed in 7.4.5-1]
+    - SECURITY UPDATE: Truncated url due \0
+      + debian/patches/CVE-2020-7066.patch: check for get_headers
+	not accepting \0 in ext/standard/url.c.
+      + CVE-2020-7066
+      [Fixed in 7.4.5-1]
+
+ -- Bryce Harrington <[e-mail]>  Thu, 16 Jul 2020 13:20:11 -0700
+
 php7.4 (7.4.5-1) unstable; urgency=medium
 
   * New upstream version 7.4.5
@@ -13,6 +47,62 @@ php7.4 (7.4.4-1) unstable; urgency=medium
 
  -- Ondřej Surý <[e-mail]>  Fri, 20 Mar 2020 14:45:16 +0100
 
+php7.4 (7.4.3-4ubuntu4) groovy; urgency=medium
+
+  * SECURITY UPDATE: Denial of service through oversized memory allocated
+    - debian/patches/CVE-2019-11048.patch: changes types int to size_t
+      in main/rfc1867.c.
+    - CVE-2019-11048
+
+ -- Leonidas S. Barbosa <[e-mail]>  Mon, 25 May 2020 09:41:37 -0300
+
+php7.4 (7.4.3-4ubuntu3) groovy; urgency=medium
+
+  * libapache2-mod-php.postinst.extra: Disable other mod-php versions.
+    Fixes failure when upgrading from previous versions of mod-php.
+    (LP: #1865218)
+
+ -- Bryce Harrington <[e-mail]>  Tue, 21 Apr 2020 23:04:30 +0000
+
+php7.4 (7.4.3-4ubuntu2) focal; urgency=medium
+
+  * SECURITY UPDATE: Read one byte of uninitialized memory
+    - debian/patches/CVE-2020-7064.patch: check length in
+      exif_process_TIFF_in_JPEG to avoid read uninitialized memory
+      ext/exif/exif.c, ext/exif/tests/bug79282.phpt.
+    - CVE-2020-7064
+  * SECURITY UPDATE: Memory corruption, crash and potentially code execution
+    - debian/patches/CVE-2020-7065.patch: make sure that negative values are
+      properly compared in ext/mbstring/php_unicode.c,
+      ext/mbstring/tests/bug70371.phpt.
+    - CVE-2020-7065
+  * SECURITY UPDATE: Truncated url due \0
+    - debian/patches/CVE-2020-7066.patch: check for get_headers
+      not accepting \0 in ext/standard/url.c.
+    - CVE-2020-7066
+
+ -- Leonidas S. Barbosa <[e-mail]>  Mon, 13 Apr 2020 09:32:06 -0300
+
+php7.4 (7.4.3-4ubuntu1) focal; urgency=medium
+
+  * d/control, d/control.in: Conflict with mod-php from php7.2 and
+    php7.3 to ensure safe upgrade path for apache2.
+    (Fixes LP: #1850933)
+
+ -- Bryce Harrington <[e-mail]>  Thu, 26 Mar 2020 20:24:23 +0000
+
+php7.4 (7.4.3-4build2) focal; urgency=medium
+
+  * No-change rebuild for icu soname change.
+
+ -- Matthias Klose <[e-mail]>  Tue, 03 Mar 2020 21:34:56 +0100
+
+php7.4 (7.4.3-4build1) focal; urgency=medium
+
+  * No-change rebuild to enable build for i386
+
+ -- Steve Langasek <[e-mail]>  Tue, 25 Feb 2020 14:37:54 -0800
+
 php7.4 (7.4.3-4) unstable; urgency=medium
 
   * Remove /etc/init/php@[e-mail], not
diff --git a/debian/control b/debian/control
index 3ca9223..8e60773 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: php7.4
 Section: php
 Priority: optional
-Maintainer: Debian PHP Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian PHP Maintainers <[e-mail]>
 Uploaders: Ondřej Surý <[e-mail]>,
            Lior Kaplan <[e-mail]>
 Build-Depends: apache2-dev (>= 2.4),
@@ -95,6 +96,8 @@ Depends: libmagic1,
          ${shlibs:Depends}
 Provides: libapache2-mod-php,
           ${php:Provides}
+Conflicts: libapache2-mod-php7.3,
+	   libapache2-mod-php7.2
 Recommends: apache2
 Suggests: php-pear
 Description: server-side, HTML-embedded scripting language (Apache 2 module)
diff --git a/debian/control.in b/debian/control.in
index 9681703..4432404 100644
--- a/debian/control.in
+++ b/debian/control.in
@@ -1,7 +1,8 @@
 Source: php@PHP_VERSION@
 Section: php
 Priority: optional
-Maintainer: Debian PHP Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian PHP Maintainers <[e-mail]>
 Uploaders: Ondřej Surý <[e-mail]>,
            Lior Kaplan <[e-mail]>
 Build-Depends: apache2-dev (>= 2.4),
@@ -95,6 +96,8 @@ Depends: libmagic1,
          ${shlibs:Depends}
 Provides: libapache2-mod-php,
           ${php:Provides}
+Conflicts: libapache2-mod-php7.3,
+	   libapache2-mod-php7.2
 Recommends: apache2
 Suggests: php-pear
 Description: server-side, HTML-embedded scripting language (Apache 2 module)
diff --git a/debian/libapache2-mod-php.postinst.extra b/debian/libapache2-mod-php.postinst.extra
index 923e475..6c6ef99 100644
--- a/debian/libapache2-mod-php.postinst.extra
+++ b/debian/libapache2-mod-php.postinst.extra
@@ -13,9 +13,14 @@ if [ -e /usr/share/apache2/apache2-maintscript-helper ]; then
 	fi
 
 	PHP_MODULE=$(a2query -m | sed -n 's/^\(php[\.0-9]*\) (enabled.*)/\1/p')
-        if [ -n "$PHP_MODULE" -a "$PHP_MODULE" != "php@PHP_VERSION@" ]; then
-	    apache2_msg "err" "$DPKG_MAINTSCRIPT_PACKAGE: $PHP_MODULE module already enabled, not enabling PHP @PHP_VERSION@"
-	    return 1
+	if [ -n "$PHP_MODULE" -a "$PHP_MODULE" != "php@PHP_VERSION@" ]; then
+	    local a2invoke_ret=0
+	    apache2_msg "info" "$DPKG_MAINTSCRIPT_PACKAGE: Disabling old $PHP_MODULE in favor of using PHP @PHP_VERSION@"
+	    apache2_invoke dismod $PHP_MODULE || a2invoke_ret=1
+	    if [ "${a2invoke_ret}" -ne 0 ]; then
+		apache2_msg "err" "$DPKG_MAINTSCRIPT_PACKAGE: (${a2invoke_ret}) failed to disable old $PHP_MODULE"
+		return 1
+	    fi
 	fi
 
 	mpm=$(a2query -M)
diff --git a/debian/patches/CVE-2019-11048.patch b/debian/patches/CVE-2019-11048.patch
new file mode 100644
index 0000000..e6e73d5
--- /dev/null
+++ b/debian/patches/CVE-2019-11048.patch
@@ -0,0 +1,65 @@
+From a3924ab6542a358a3099de992b63b932a9570add Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <[e-mail]>
+Date: Mon, 11 May 2020 14:20:47 -0700
+Subject: [PATCH] Merge branch 'PHP-7.3' into PHP-7.4
+
+* PHP-7.3:
+  Fix #78876: Long variables cause OOM and temp files are not cleaned
+  Fix #78875: Long filenames cause OOM and temp files are not cleaned
+  Update NEWS for 7.2.31
+  Update CREDITS for PHP 7.2.30
+  Update NEWS for PHP 7.2.30
+---
+ main/rfc1867.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/main/rfc1867.c b/main/rfc1867.c
+index 1ee7b925a1b9..8bdc409296ae 100644
+--- a/main/rfc1867.c
++++ b/main/rfc1867.c
+@@ -606,7 +606,7 @@ static void *php_ap_memstr(char *haystack, int haystacklen, char *needle, int ne
+ }
+ 
+ /* read until a boundary condition */
+-static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
++static size_t multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
+ {
+ 	size_t len, max;
+ 	char *bound;
+@@ -645,7 +645,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes
+ 		self->buf_begin += len;
+ 	}
+ 
+-	return (int)len;
++	return len;
+ }
+ 
+ /*
+@@ -655,7 +655,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes
+ static char *multipart_buffer_read_body(multipart_buffer *self, size_t *len)
+ {
+ 	char buf[FILLUNIT], *out=NULL;
+-	int total_bytes=0, read_bytes=0;
++	size_t total_bytes=0, read_bytes=0;
+ 
+ 	while((read_bytes = multipart_buffer_read(self, buf, sizeof(buf), NULL))) {
+ 		out = erealloc(out, total_bytes + read_bytes + 1);
+@@ -682,7 +682,8 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
+ 	char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL;
+ 	char *lbuf = NULL, *abuf = NULL;
+ 	zend_string *temp_filename = NULL;
+-	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0;
++	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0;
++	size_t array_len = 0;
+ 	int64_t total_bytes = 0, max_file_size = 0;
+ 	int skip_upload = 0, anonindex = 0, is_anonymous;
+ 	HashTable *uploaded_files = NULL;
+@@ -1116,7 +1117,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
+ 			is_arr_upload =	(start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']');
+ 
+ 			if (is_arr_upload) {
+-				array_len = (int)strlen(start_arr);
++				array_len = strlen(start_arr);
+ 				if (array_index) {
+ 					efree(array_index);
+ 				}
diff --git a/debian/patches/series b/debian/patches/series
index 1784689..4d4e247 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -38,3 +38,4 @@
 0038-Really-expand-libdir-datadir-into-EXPANDED_LIBDIR-DA.patch
 0039-Fix-ext-date-lib-parse_tz-PATH_MAX-HURD-FTBFS.patch
 0040-Amend-C-11-for-intl-compilation-on-older-distributio.patch
+CVE-2019-11048.patch