Skip to contentSkip to conversation

php: security bump to version 5.5.8

PATCH New Gustavo Zacarias 3 participants 15 messages Jan 28, 2014 – Feb 12, 2014

lore
Share & tools
lore
#0 lore raw

PATCH 1/6 php: security bump to version 5.5.8

Fixes CVE-2013-6712.
Note that there's no xz format tarball for 5.5.8.

---
 package/php/php.mk | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
package/php/php.mk +1 -2
index 54d6e05..de02f4b 100644
@@ -4,8 +4,7 @@
 #
 ################################################################################
 
-PHP_VERSION = 5.5.7
-PHP_SOURCE = php-$(PHP_VERSION).tar.xz
+PHP_VERSION = 5.5.8
 PHP_SITE = http://www.php.net/distributions
 PHP_INSTALL_STAGING = YES
 PHP_INSTALL_STAGING_OPT = INSTALL_ROOT=$(STAGING_DIR) install
Signature · 1 line
1.8.3.2
#1 lore raw

PATCH 2/6 php: fix for external extensions

Adjust phpize and php-config to make them work for cross-compiled external extensions.
While at it also fix dl* issues that prevent said extensions from loading.

---
 package/php/php-02-dlopen.patch | 25 +++++++++++++++++++++++++
 package/php/php.mk              | 25 ++++++++++++++++++++++---
 2 files changed, 47 insertions(+), 3 deletions(-)
 create mode 100644 package/php/php-02-dlopen.patch
package/php/php-02-dlopen.patch new file +25 -0
new file mode 100644
index 0000000..1dd009f
@@ -0,0 +1,25 @@
+PHP can't be AUTORECONF with any modern autotools and the dl tests are
+pretty bad for cross-compilation, so just kill the needed ac_cv value unsets
+so they can flow through from the package makefile.
+
+Signed-off-by: Gustavo Zacarias <[email protected]>
+
+diff -Nura php-5.5.8.orig/configure php-5.5.8/configure
+--- php-5.5.8.orig/configure	2014-01-28 17:41:33.943851727 -0300
++++ php-5.5.8/configure	2014-01-28 17:42:53.785493795 -0300
+@@ -16985,7 +16985,6 @@
+ 
+ 
+ 
+-  unset ac_cv_func_dlopen
+   unset ac_cv_func___dlopen
+   unset found
+ 
+@@ -17013,7 +17012,6 @@
+ 
+     *)
+ 
+-  unset ac_cv_lib_dl_dlopen
+   unset ac_cv_lib_dl___dlopen
+   unset found
+   { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
package/php/php.mk +22 -3
index de02f4b..2f6280f 100644
@@ -19,15 +19,25 @@ PHP_CONF_OPT =  --mandir=/usr/share/man \
 		--with-config-file-path=/etc \
 		--localstatedir=/var \
 		--disable-rpath
+PHP_CONF_ENV = EXTRA_LIBS="$(PHP_EXTRA_LIBS)"
+
 ifeq ($(BR2_ENDIAN),"BIG")
-PHP_CONF_ENV = ac_cv_c_bigendian_php=yes
+PHP_CONF_ENV += ac_cv_c_bigendian_php=yes
 else
-PHP_CONF_ENV = ac_cv_c_bigendian_php=no
+PHP_CONF_ENV += ac_cv_c_bigendian_php=no
 endif
 PHP_CONFIG_SCRIPTS = php-config
 
 PHP_CFLAGS = $(TARGET_CFLAGS)
 
+# We need to force dl "detection"
+ifeq ($(BR2_PREFER_STATIC_LIB),)
+PHP_CONF_ENV += ac_cv_func_dlopen=yes ac_cv_lib_dl_dlopen=yes
+PHP_EXTRA_LIBS += -ldl
+else
+PHP_CONF_ENV += ac_cv_func_dlopen=no ac_cv_lib_dl_dlopen=no
+endif
+
 # Workaround for non-IPv6 uClibc toolchain
 ifeq ($(BR2_TOOLCHAIN_USES_UCLIBC),y)
 ifneq ($(BR2_INET_IPV6),y)
@@ -116,7 +126,7 @@ ifeq ($(BR2_PACKAGE_PHP_EXT_INTL),y)
 	# The intl module is implemented in C++, but PHP fails to use
 	# g++ as the compiler for the final link. As a workaround,
 	# tell it to link libstdc++.
-	PHP_CONF_ENV += EXTRA_LIBS="-lstdc++"
+	PHP_EXTRA_LIBS + = -lstdc++
 endif
 
 ifeq ($(BR2_PACKAGE_PHP_EXT_GMP),y)
@@ -200,6 +210,15 @@ ifeq ($(BR2_PACKAGE_PHP_EXT_SNMP),y)
 	PHP_DEPENDENCIES += netsnmp
 endif
 
+define PHP_EXTENSIONS_FIXUP
+	$(SED) "/prefix/ s:/usr:$(STAGING_DIR)/usr:" \
+		$(STAGING_DIR)/usr/bin/phpize
+	$(SED) "/extension_dir/ s:/usr:$(TARGET_DIR)/usr:" \
+		$(STAGING_DIR)/usr/bin/php-config
+endef
+
+PHP_POST_INSTALL_TARGET_HOOKS += PHP_EXTENSIONS_FIXUP
+
 define PHP_INSTALL_FIXUP
 	rm -rf $(TARGET_DIR)/usr/lib/php
 	rm -f $(TARGET_DIR)/usr/bin/phpize
Signature · 1 line
1.8.3.2
#2 lore raw

PATCH 2/6 php: fix for external extensions

package/php/php.mk ifeq ($(BR2_PACKAGE_PHP_EXT_SNMP),y) · line 215

Quoted 12 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Gustavo" == Gustavo Zacarias <[email protected]> writes:

Adjust phpize and php-config to make them work for cross-compiled external extensions.
While at it also fix dl* issues that prevent said extensions from loading.

package/php/php.mk +3 -0
+define PHP_EXTENSIONS_FIXUP
+	$(SED) "/prefix/ s:/usr:$(STAGING_DIR)/usr:" \
+		$(STAGING_DIR)/usr/bin/phpize

Can't we just add phpize to PHP_CONFIG_SCRIPTS?

package/php/php.mk ifeq ($(BR2_PACKAGE_PHP_EXT_SNMP),y) · line 217

Quoted 2 lines
package/php/php.mk +2 -0
+	$(SED) "/extension_dir/ s:/usr:$(TARGET_DIR)/usr:" \
+		$(STAGING_DIR)/usr/bin/php-config

Shouldn't this be s/TARGET_DIR/STAGING_DIR/?

Signature · 1 line
Bye, Peter Korsgaard
#3 lore raw

PATCH 2/6 php: fix for external extensions

Quoted 5 lines · Peter Korsgaard

package/php/php.mk ifeq ($(BR2_PACKAGE_PHP_EXT_SNMP),y) · line 215

Quoted 3 lines
package/php/php.mk +3 -0
+define PHP_EXTENSIONS_FIXUP
+	$(SED) "/prefix/ s:/usr:$(STAGING_DIR)/usr:" \
+		$(STAGING_DIR)/usr/bin/phpize

Can't we just add phpize to PHP_CONFIG_SCRIPTS?

See below...

Quoted 4 lines

package/php/php.mk ifeq ($(BR2_PACKAGE_PHP_EXT_SNMP),y) · line 217

Quoted 2 lines
package/php/php.mk +2 -0
+	$(SED) "/extension_dir/ s:/usr:$(TARGET_DIR)/usr:" \
+		$(STAGING_DIR)/usr/bin/php-config

Shouldn't this be s/TARGET_DIR/STAGING_DIR/?

No, that's where the extensions will be installed (no DESTDIR or similar override in the Makefile), so just with this at least we can't do PHP_CONFIG_SCRIPTS.
Regards.

#4 lore raw

PATCH 2/6 php: fix for external extensions

Quoted 11 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Gustavo" == Gustavo Zacarias <[email protected]> writes:

Quoted 5 lines · Peter Korsgaard

package/php/php.mk ifeq ($(BR2_PACKAGE_PHP_EXT_SNMP),y) · line 215

Quoted 3 lines
package/php/php.mk +3 -0
+define PHP_EXTENSIONS_FIXUP
+	$(SED) "/prefix/ s:/usr:$(STAGING_DIR)/usr:" \
+		$(STAGING_DIR)/usr/bin/phpize

Can't we just add phpize to PHP_CONFIG_SCRIPTS?

See below...

Quoted 8 lines
Quoted 4 lines

package/php/php.mk ifeq ($(BR2_PACKAGE_PHP_EXT_SNMP),y) · line 217

Quoted 2 lines
package/php/php.mk +2 -0
+	$(SED) "/extension_dir/ s:/usr:$(TARGET_DIR)/usr:" \
+		$(STAGING_DIR)/usr/bin/php-config

Shouldn't this be s/TARGET_DIR/STAGING_DIR/?

No, that's where the extensions will be installed (no DESTDIR or similar override in the Makefile), so just with this at least we can't do PHP_CONFIG_SCRIPTS.

Ok - So to conclude, we need the manual php-config change, but the phpize change can be done with PHP_CONFIG_SCRIPTS?

Signature · 1 line
Bye, Peter Korsgaard
#5 lore raw

PATCH 2/6 php: fix for external extensions

Quoted 2 lines · Peter Korsgaard

Ok - So to conclude, we need the manual php-config change, but the phpize change can be done with PHP_CONFIG_SCRIPTS?

It works... for now... i'm a bit wary of doing so since it's just casual that it works with _CONFIG_SCRIPTS without it being a config script, if upstream changes things in a newer php version it may break. Regards.

#6 lore raw

PATCH 2/6 php: fix for external extensions

In reply to Gustavo Zacarias
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Gustavo" == Gustavo Zacarias <[email protected]> writes:

Adjust phpize and php-config to make them work for cross-compiled external extensions.
While at it also fix dl* issues that prevent said extensions from loading.

Committed this and the rest of the series to next, thanks.

Signature · 1 line
Bye, Peter Korsgaard
#7 lore raw

PATCH 3/6 php-zmq: new package

In reply to Gustavo Zacarias
---
 package/Config.in          | 10 ++++++++++
 package/php-zmq/Config.in  | 17 +++++++++++++++++
 package/php-zmq/php-zmq.mk | 25 +++++++++++++++++++++++++
 3 files changed, 52 insertions(+)
 create mode 100644 package/php-zmq/Config.in
 create mode 100644 package/php-zmq/php-zmq.mk
package/Config.in +10 -0
index f4c1c17..5c91d9a 100644
@@ -395,6 +395,16 @@ source "package/cpanminus/Config.in"
 endmenu
 endif
 source "package/php/Config.in"
+if BR2_PACKAGE_PHP
+if !BR2_PREFER_STATIC_LIB
+menu "External php extensions"
+source "package/php-zmq/Config.in"
+endmenu
+endif
+if BR2_PREFER_STATIC_LIB
+comment "External PHP extensions need a toolchain w/ dynamic library"
+endif
+endif
 source "package/python/Config.in"
 if BR2_PACKAGE_PYTHON
 menu "external python modules"
package/php-zmq/Config.in new file +17 -0
new file mode 100644
index 0000000..f32b5a3
@@ -0,0 +1,17 @@
+comment "php-zmq needs a toolchain w/ C++, IPv6, largefile, wchar, threads"
+	depends on !(BR2_INSTALL_LIBSTDCPP && BR2_INET_IPV6 && BR2_LARGEFILE \
+		&& BR2_USE_WCHAR && BR2_TOOLCHAIN_HAS_THREADS)
+
+config BR2_PACKAGE_PHP_ZMQ
+	bool "php-zmq"
+	depends on BR2_PACKAGE_PHP
+	depends on BR2_INSTALL_LIBSTDCPP
+	depends on BR2_INET_IPV6
+	depends on BR2_LARGEFILE # util-linux
+	depends on BR2_USE_WCHAR # util-linux
+	depends on BR2_TOOLCHAIN_HAS_THREADS
+	select BR2_PACKAGE_ZEROMQ
+	help
+	  ZeroMQ messaging bindings for PHP
+
+	  http://pecl.php.net/package/zmq
package/php-zmq/php-zmq.mk new file +25 -0
new file mode 100644
index 0000000..2b48a63
@@ -0,0 +1,25 @@
+################################################################################
+#
+# php-zmq
+#
+################################################################################
+
+PHP_ZMQ_VERSION = 1.1.2
+PHP_ZMQ_SOURCE = zmq-$(PHP_ZMQ_VERSION).tgz
+PHP_ZMQ_SITE = http://pecl.php.net/get
+# phpize does the autoconf magic
+PHP_ZMQ_DEPENDENCIES = php zeromq host-autoconf host-pkgconf
+PHP_ZMQ_CONF_OPT = --with-php-config=$(STAGING_DIR)/usr/bin/php-config
+PHP_ZMQ_LICENSE = BSD-3c
+PHP_ZMQ_LICENSE_FILES = LICENSE
+
+define PHP_ZMQ_PHPIZE
+	(cd $(@D); \
+		PHP_AUTOCONF=$(HOST_DIR)/usr/bin/autoconf \
+		PHP_AUTOHEADER=$(HOST_DIR)/usr/bin/autoheader \
+		$(STAGING_DIR)/usr/bin/phpize)
+endef
+
+PHP_ZMQ_PRE_CONFIGURE_HOOKS += PHP_ZMQ_PHPIZE
+
+$(eval $(autotools-package))
Signature · 1 line
1.8.3.2
#8 lore raw

PATCH 3/6 php-zmq: new package

Dear Gustavo Zacarias,

Quoted 8 lines · Gustavo Zacarias
---
 package/Config.in          | 10 ++++++++++
 package/php-zmq/Config.in  | 17 +++++++++++++++++
 package/php-zmq/php-zmq.mk | 25 +++++++++++++++++++++++++
 3 files changed, 52 insertions(+)
 create mode 100644 package/php-zmq/Config.in
 create mode 100644 package/php-zmq/php-zmq.mk

Just curious, how many potential PHP packages could we add? The build logic for the four packages you submitted looks highly similar, maybe it calls a php-package infrastructure?

The only "difficulty" is that it would have to inherit from autotools-package, which itself already inherits from generic-package. So it would be the first package infrastructure to inherit from a package infra that already inherits from generic-package. I'm sure it can work, but it might raise issues with some missing quoting.

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com
#9 lore raw

PATCH 3/6 php-zmq: new package

Quoted 9 lines · Thomas Petazzoni

Just curious, how many potential PHP packages could we add? The build logic for the four packages you submitted looks highly similar, maybe it calls a php-package infrastructure?

The only "difficulty" is that it would have to inherit from autotools-package, which itself already inherits from generic-package. So it would be the first package infrastructure to inherit from a package infra that already inherits from generic-package. I'm sure it can work, but it might raise issues with some missing quoting.

Not that many that are useful, many are abandonware, that being the reason i opted for the autotools infra with the tweak.
PECL packages are compiled (these ones are), PEAR packages are normally interpreted so it's just a matter of just installing them. Arguably we could also enable PEAR installs in the target itself but i don't think it's the spirit of buildroot, like CPAN for perl. But we don't have any PEAR packages at the moment.
Regards.

#10 lore raw

PATCH 3/6 php-zmq: new package

Dear Gustavo Zacarias,

Quoted 10 lines · Gustavo Zacarias
Quoted 9 lines

Just curious, how many potential PHP packages could we add? The build logic for the four packages you submitted looks highly similar, maybe it calls a php-package infrastructure?

The only "difficulty" is that it would have to inherit from autotools-package, which itself already inherits from generic-package. So it would be the first package infrastructure to inherit from a package infra that already inherits from generic-package. I'm sure it can work, but it might raise issues with some missing quoting.

Quoted 7 lines

Not that many that are useful, many are abandonware, that being the reason i opted for the autotools infra with the tweak.
PECL packages are compiled (these ones are), PEAR packages are normally interpreted so it's just a matter of just installing them. Arguably we could also enable PEAR installs in the target itself but i don't think it's the spirit of buildroot, like CPAN for perl. But we don't have any PEAR packages at the moment.

Ok. Then I guess we should go ahead with what you proposed, and only introduce a PHP package infra if we get over 10 PHP packages or so.

Thanks!

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com
#11 lore raw

PATCH 4/6 php-yaml: new package

In reply to Gustavo Zacarias
---
 package/Config.in            |  1 +
 package/php-yaml/Config.in   |  8 ++++++++
 package/php-yaml/php-yaml.mk | 26 ++++++++++++++++++++++++++
 3 files changed, 35 insertions(+)
 create mode 100644 package/php-yaml/Config.in
 create mode 100644 package/php-yaml/php-yaml.mk
package/Config.in +1 -0
index 5c91d9a..ffe11bb 100644
@@ -398,6 +398,7 @@ source "package/php/Config.in"
 if BR2_PACKAGE_PHP
 if !BR2_PREFER_STATIC_LIB
 menu "External php extensions"
+source "package/php-yaml/Config.in"
 source "package/php-zmq/Config.in"
 endmenu
 endif
package/php-yaml/Config.in new file +8 -0
new file mode 100644
index 0000000..8d09ce2
@@ -0,0 +1,8 @@
+config BR2_PACKAGE_PHP_YAML
+	bool "php-yaml"
+	depends on BR2_PACKAGE_PHP
+	select BR2_PACKAGE_LIBYAML
+	help
+	  PHP YAML-1.1 parser and emitter.
+
+	  http://pecl.php.net/package/yaml
package/php-yaml/php-yaml.mk new file +26 -0
new file mode 100644
index 0000000..a53e012
@@ -0,0 +1,26 @@
+################################################################################
+#
+# php-yaml
+#
+################################################################################
+
+PHP_YAML_VERSION = 1.1.1
+PHP_YAML_SOURCE = yaml-$(PHP_YAML_VERSION).tgz
+PHP_YAML_SITE = http://pecl.php.net/get
+PHP_YAML_CONF_OPT = --with-php-config=$(STAGING_DIR)/usr/bin/php-config \
+	--with-yaml=$(STAGING_DIR)/usr
+# phpize does the autoconf magic
+PHP_YAML_DEPENDENCIES = libyaml php host-autoconf
+PHP_YAML_LICENSE = MIT
+PHP_YAML_LICENSE_FILES = LICENSE
+
+define PHP_YAML_PHPIZE
+	(cd $(@D); \
+		PHP_AUTOCONF=$(HOST_DIR)/usr/bin/autoconf \
+		PHP_AUTOHEADER=$(HOST_DIR)/usr/bin/autoheader \
+		$(STAGING_DIR)/usr/bin/phpize)
+endef
+
+PHP_YAML_PRE_CONFIGURE_HOOKS += PHP_YAML_PHPIZE
+
+$(eval $(autotools-package))
Signature · 1 line
1.8.3.2
#12 lore raw

PATCH 5/6 php-ssh2: new package

In reply to Gustavo Zacarias
---
 package/Config.in            |  1 +
 package/php-ssh2/Config.in   |  8 ++++++++
 package/php-ssh2/php-ssh2.mk | 26 ++++++++++++++++++++++++++
 3 files changed, 35 insertions(+)
 create mode 100644 package/php-ssh2/Config.in
 create mode 100644 package/php-ssh2/php-ssh2.mk
package/Config.in +1 -0
index ffe11bb..7878b53 100644
@@ -398,6 +398,7 @@ source "package/php/Config.in"
 if BR2_PACKAGE_PHP
 if !BR2_PREFER_STATIC_LIB
 menu "External php extensions"
+source "package/php-ssh2/Config.in"
 source "package/php-yaml/Config.in"
 source "package/php-zmq/Config.in"
 endmenu
package/php-ssh2/Config.in new file +8 -0
new file mode 100644
index 0000000..b457900
@@ -0,0 +1,8 @@
+config BR2_PACKAGE_PHP_SSH2
+	bool "php-ssh2"
+	depends on BR2_PACKAGE_PHP
+	select BR2_PACKAGE_LIBSSH2
+	help
+	  PHP bindings for the libssh2 library.
+
+	  http://pecl.php.net/package/ssh2
package/php-ssh2/php-ssh2.mk new file +26 -0
new file mode 100644
index 0000000..f2067a4
@@ -0,0 +1,26 @@
+################################################################################
+#
+# php-ssh2
+#
+################################################################################
+
+PHP_SSH2_VERSION = 0.12
+PHP_SSH2_SOURCE = ssh2-$(PHP_SSH2_VERSION).tgz
+PHP_SSH2_SITE = http://pecl.php.net/get
+PHP_SSH2_CONF_OPT = --with-php-config=$(STAGING_DIR)/usr/bin/php-config \
+	--with-ssh2=$(STAGING_DIR)/usr
+# phpize does the autoconf magic
+PHP_SSH2_DEPENDENCIES = libssh2 php host-autoconf
+PHP_SSH2_LICENSE = PHP
+PHP_SSH2_LICENSE_FILES = LICENSE
+
+define PHP_SSH2_PHPIZE
+	(cd $(@D); \
+		PHP_AUTOCONF=$(HOST_DIR)/usr/bin/autoconf \
+		PHP_AUTOHEADER=$(HOST_DIR)/usr/bin/autoheader \
+		$(STAGING_DIR)/usr/bin/phpize)
+endef
+
+PHP_SSH2_PRE_CONFIGURE_HOOKS += PHP_SSH2_PHPIZE
+
+$(eval $(autotools-package))
Signature · 1 line
1.8.3.2
#13 lore raw

PATCH 6/6 php-imagick: new package

In reply to Gustavo Zacarias
---
 package/Config.in                  |  1 +
 package/php-imagick/Config.in      |  8 ++++++++
 package/php-imagick/php-imagick.mk | 26 ++++++++++++++++++++++++++
 3 files changed, 35 insertions(+)
 create mode 100644 package/php-imagick/Config.in
 create mode 100644 package/php-imagick/php-imagick.mk
package/Config.in +1 -0
index 7878b53..a4b9ce3 100644
@@ -398,6 +398,7 @@ source "package/php/Config.in"
 if BR2_PACKAGE_PHP
 if !BR2_PREFER_STATIC_LIB
 menu "External php extensions"
+source "package/php-imagick/Config.in"
 source "package/php-ssh2/Config.in"
 source "package/php-yaml/Config.in"
 source "package/php-zmq/Config.in"
package/php-imagick/Config.in new file +8 -0
new file mode 100644
index 0000000..1d55fcc
@@ -0,0 +1,8 @@
+config BR2_PACKAGE_PHP_IMAGICK
+	bool "php-imagick"
+	depends on BR2_PACKAGE_PHP
+	select BR2_PACKAGE_IMAGEMAGICK
+	help
+	  PHP wrapper to the ImageMagick library.
+
+	  http://pecl.php.net/package/imagick
package/php-imagick/php-imagick.mk new file +26 -0
new file mode 100644
index 0000000..148d519
@@ -0,0 +1,26 @@
+################################################################################
+#
+# php-imagick
+#
+################################################################################
+
+PHP_IMAGICK_VERSION = 3.1.2
+PHP_IMAGICK_SOURCE = imagick-$(PHP_IMAGICK_VERSION).tgz
+PHP_IMAGICK_SITE = http://pecl.php.net/get
+PHP_IMAGICK_CONF_OPT = --with-php-config=$(STAGING_DIR)/usr/bin/php-config \
+	--with-imagick=$(STAGING_DIR)/usr
+# phpize does the autoconf magic
+PHP_IMAGICK_DEPENDENCIES = imagemagick php host-autoconf
+PHP_IMAGICK_LICENSE = PHP
+PHP_IMAGICK_LICENSE_FILES = LICENSE
+
+define PHP_IMAGICK_PHPIZE
+	(cd $(@D); \
+		PHP_AUTOCONF=$(HOST_DIR)/usr/bin/autoconf \
+		PHP_AUTOHEADER=$(HOST_DIR)/usr/bin/autoheader \
+		$(STAGING_DIR)/usr/bin/phpize)
+endef
+
+PHP_IMAGICK_PRE_CONFIGURE_HOOKS += PHP_IMAGICK_PHPIZE
+
+$(eval $(autotools-package))
Signature · 1 line
1.8.3.2