Update to 7.0.25 - http://www.php.net/releases/7_0_25.php

add upstream security patches for oniguruma

.gitignore

@@ -1,8 +1,8 @@
 clog
-php-5.3.*.bz2
-php-5.4.*.bz2
-php-5.5.*.xz
+*.md
 php-5.6.*.xz
+php-7.1.*.xz
+php-7.2.*.xz
 /php-7.0.8.tar.xz
 /php-7.0.9RC1.tar.xz
 /php-7.0.9.tar.xz
@@ -10,3 +10,18 @@ php-5.6.*.xz
 /php-7.0.10.tar.xz
 /php-7.0.11RC1.tar.xz
 /php-7.0.11.tar.xz
+/php-7.0.12.tar.xz
+/php-7.0.13.tar.xz
+/php-7.0.14.tar.xz
+/php-7.0.15.tar.xz
+/php-7.0.16.tar.xz
+/php-7.0.17RC1.tar.xz
+/php-7.0.17.tar.xz
+/php-7.0.18.tar.xz
+/php-7.0.19.tar.xz
+/php-7.0.20.tar.xz
+/php-7.0.21.tar.xz
+/php-7.0.22.tar.xz
+/php-7.0.23.tar.xz
+/php-7.0.24.tar.xz
+/php-7.0.25.tar.xz

php-7.0.0-systzdata-v14.patch

@@ -1,7 +1,11 @@
+# License: MIT
+# http://opensource.org/licenses/MIT
+
 Add support for use of the system timezone database, rather
 than embedding a copy.  Discussed upstream but was not desired.
 
 History:
+r14: improve check for valid tz file
 r13: adapt for upstream changes to use PHP allocator
 r12: adapt for upstream changes for new zic
 r11: use canonical names to avoid more case sensitivity issues
@@ -21,10 +25,10 @@ r3: fix a crash if /usr/share/zoneinfo doesn't exist (Raphael Geissert)
 r2: add filesystem trawl to set up name alias index
 r1: initial revision
 
-diff -up php-7.0.0RC1/ext/date/lib/parse_tz.c.systzdata php-7.0.0RC1/ext/date/lib/parse_tz.c
---- php-7.0.0RC1/ext/date/lib/parse_tz.c.systzdata	2015-08-18 23:39:24.000000000 +0200
-+++ php-7.0.0RC1/ext/date/lib/parse_tz.c	2015-08-22 07:54:38.097258458 +0200
-@@ -20,6 +20,16 @@
+diff -up php-7.0.12RC1/ext/date/lib/parse_tz.c.systzdata php-7.0.12RC1/ext/date/lib/parse_tz.c
+--- php-7.0.12RC1/ext/date/lib/parse_tz.c.systzdata	2016-09-27 17:31:31.000000000 +0200
++++ php-7.0.12RC1/ext/date/lib/parse_tz.c	2016-10-07 14:53:11.270619502 +0200
+@@ -24,6 +24,16 @@
  
  #include "timelib.h"
  
@@ -41,7 +45,7 @@ diff -up php-7.0.0RC1/ext/date/lib/parse_tz.c.systzdata php-7.0.0RC1/ext/date/li
  #include <stdio.h>
  
  #ifdef HAVE_LOCALE_H
-@@ -32,8 +42,12 @@
+@@ -36,8 +46,12 @@
  #include <strings.h>
  #endif
  
@@ -54,7 +58,7 @@ diff -up php-7.0.0RC1/ext/date/lib/parse_tz.c.systzdata php-7.0.0RC1/ext/date/li
  
  #if (defined(__APPLE__) || defined(__APPLE_CC__)) && (defined(__BIG_ENDIAN__) || defined(__LITTLE_ENDIAN__))
  # if defined(__LITTLE_ENDIAN__)
-@@ -55,6 +69,11 @@ static int read_preamble(const unsigned
+@@ -59,6 +73,11 @@ static int read_preamble(const unsigned
  {
  	uint32_t version;
  
@@ -66,7 +70,7 @@ diff -up php-7.0.0RC1/ext/date/lib/parse_tz.c.systzdata php-7.0.0RC1/ext/date/li
  	/* read ID */
  	version = (*tzf)[3] - '0';
  	*tzf += 4;
-@@ -298,7 +317,418 @@ void timelib_dump_tzinfo(timelib_tzinfo
+@@ -302,7 +321,429 @@ void timelib_dump_tzinfo(timelib_tzinfo
  	}
  }
  
@@ -285,6 +289,7 @@ diff -up php-7.0.0RC1/ext/date/lib/parse_tz.c.systzdata php-7.0.0RC1/ext/date/li
 +		&& strcmp(ent->d_name, "posix") != 0
 +		&& strcmp(ent->d_name, "posixrules") != 0
 +		&& strcmp(ent->d_name, "right") != 0
++		&& strstr(ent->d_name, ".list") == NULL
 +		&& strstr(ent->d_name, ".tab") == NULL;
 +}
 +
@@ -425,8 +430,18 @@ diff -up php-7.0.0RC1/ext/date/lib/parse_tz.c.systzdata php-7.0.0RC1/ext/date/li
 +
 +/* Returns true if the passed-in stat structure describes a
 + * probably-valid timezone file. */
-+static int is_valid_tzfile(const struct stat *st)
++static int is_valid_tzfile(const struct stat *st, int fd)
 +{
++	if (fd) {
++		char buf[20];
++		if (read(fd, buf, 20)!=20) {
++			return 0;
++		}
++		lseek(fd, SEEK_SET, 0);
++		if (memcmp(buf, "TZif", 4)) {
++			return 0;			
++		}
++	}
 +	return S_ISREG(st->st_mode) && st->st_size > 20;
 +}
 +
@@ -464,11 +479,11 @@ diff -up php-7.0.0RC1/ext/date/lib/parse_tz.c.systzdata php-7.0.0RC1/ext/date/li
 +	}
 +
 +	snprintf(fname, sizeof fname, ZONEINFO_PREFIX "/%s", canonical_tzname(timezone));
-+	
++
 +	fd = open(fname, O_RDONLY);
 +	if (fd == -1) {
 +		return NULL;
-+	} else if (fstat(fd, &st) != 0 || !is_valid_tzfile(&st)) {
++	} else if (fstat(fd, &st) != 0 || !is_valid_tzfile(&st, fd)) {
 +		close(fd);
 +		return NULL;
 +	}
@@ -486,7 +501,7 @@ diff -up php-7.0.0RC1/ext/date/lib/parse_tz.c.systzdata php-7.0.0RC1/ext/date/li
  {
  	int left = 0, right = tzdb->index_size - 1;
  #ifdef HAVE_SETLOCALE
-@@ -337,21 +767,88 @@ static int seek_to_tz_position(const uns
+@@ -341,21 +782,88 @@ static int seek_to_tz_position(const uns
  	return 0;
  }
  
@@ -568,7 +583,7 @@ diff -up php-7.0.0RC1/ext/date/lib/parse_tz.c.systzdata php-7.0.0RC1/ext/date/li
 +
 +		snprintf(fname, sizeof fname, ZONEINFO_PREFIX "/%s", canonical_tzname(timezone));
 +
-+		return stat(fname, &st) == 0 && is_valid_tzfile(&st);
++		return stat(fname, &st) == 0 && is_valid_tzfile(&st, 0);
 +	}
 +#endif
 +
@@ -576,7 +591,7 @@ diff -up php-7.0.0RC1/ext/date/lib/parse_tz.c.systzdata php-7.0.0RC1/ext/date/li
  }
  
  static void skip_64bit_preamble(const unsigned char **tzf, timelib_tzinfo *tz)
-@@ -376,24 +873,54 @@ static void read_64bit_header(const unsi
+@@ -380,24 +888,54 @@ static void read_64bit_header(const unsi
  timelib_tzinfo *timelib_parse_tzfile(char *timezone, const timelib_tzdb *tzdb)
  {
  	const unsigned char *tzf;
@@ -640,9 +655,9 @@ diff -up php-7.0.0RC1/ext/date/lib/parse_tz.c.systzdata php-7.0.0RC1/ext/date/li
  	} else {
  		tmp = NULL;
  	}
-diff -up php-7.0.0RC1/ext/date/lib/timelib.m4.systzdata php-7.0.0RC1/ext/date/lib/timelib.m4
---- php-7.0.0RC1/ext/date/lib/timelib.m4.systzdata	2015-08-18 23:39:24.000000000 +0200
-+++ php-7.0.0RC1/ext/date/lib/timelib.m4	2015-08-22 07:47:34.854055364 +0200
+diff -up php-7.0.12RC1/ext/date/lib/timelib.m4.systzdata php-7.0.12RC1/ext/date/lib/timelib.m4
+--- php-7.0.12RC1/ext/date/lib/timelib.m4.systzdata	2016-09-27 17:31:31.000000000 +0200
++++ php-7.0.12RC1/ext/date/lib/timelib.m4	2016-10-07 14:36:19.569469385 +0200
 @@ -78,3 +78,17 @@ stdlib.h
  
  dnl Check for strtoll, atoll

php-7.0.17-dlopen.patch

@@ -1,7 +1,7 @@
-diff -up php-7.0.0RC1/sapi/litespeed/lsapilib.c.dlopen php-7.0.0RC1/sapi/litespeed/lsapilib.c
---- php-7.0.0RC1/sapi/litespeed/lsapilib.c.dlopen	2015-08-18 23:39:17.000000000 +0200
-+++ php-7.0.0RC1/sapi/litespeed/lsapilib.c	2015-08-22 07:46:31.729721983 +0200
-@@ -582,7 +582,7 @@ static int (*fp_lve_leave)(struct liblve
+diff -up php-7.0.17RC1/sapi/litespeed/lsapilib.c.dlopen php-7.0.17RC1/sapi/litespeed/lsapilib.c
+--- php-7.0.17RC1/sapi/litespeed/lsapilib.c.dlopen	2017-02-28 12:11:33.000000000 +0100
++++ php-7.0.17RC1/sapi/litespeed/lsapilib.c	2017-02-28 13:06:07.493838664 +0100
+@@ -616,7 +616,7 @@ static int (*fp_lve_leave)(struct liblve
  static int (*fp_lve_jail)( struct passwd *, char *) = NULL;
  static int lsapi_load_lve_lib()
  {
@@ -10,16 +10,16 @@ diff -up php-7.0.0RC1/sapi/litespeed/lsapilib.c.dlopen php-7.0.0RC1/sapi/litespe
      if (s_liblve)
      {
          fp_lve_is_available = dlsym(s_liblve, "lve_is_available");
-diff -up php-7.0.0RC1/Zend/zend_portability.h.dlopen php-7.0.0RC1/Zend/zend_portability.h
---- php-7.0.0RC1/Zend/zend_portability.h.dlopen	2015-08-18 23:39:16.000000000 +0200
-+++ php-7.0.0RC1/Zend/zend_portability.h	2015-08-22 07:46:31.729721983 +0200
-@@ -136,11 +136,11 @@
+diff -up php-7.0.17RC1/Zend/zend_portability.h.dlopen php-7.0.17RC1/Zend/zend_portability.h
+--- php-7.0.17RC1/Zend/zend_portability.h.dlopen	2017-02-28 13:06:07.493838664 +0100
++++ php-7.0.17RC1/Zend/zend_portability.h	2017-02-28 13:07:10.626118397 +0100
+@@ -146,11 +146,11 @@
  # endif
  
  # if defined(RTLD_GROUP) && defined(RTLD_WORLD) && defined(RTLD_PARENT)
 -#  define DL_LOAD(libname)			dlopen(libname, RTLD_LAZY | RTLD_GLOBAL | RTLD_GROUP | RTLD_WORLD | RTLD_PARENT)
 +#  define DL_LOAD(libname)			dlopen(libname, RTLD_NOW  | RTLD_GLOBAL | RTLD_GROUP | RTLD_WORLD | RTLD_PARENT)
- # elif defined(RTLD_DEEPBIND)
+ # elif defined(RTLD_DEEPBIND) && !defined(__SANITIZE_ADDRESS__)
 -#  define DL_LOAD(libname)			dlopen(libname, RTLD_LAZY | RTLD_GLOBAL | RTLD_DEEPBIND)
 +#  define DL_LOAD(libname)			dlopen(libname, RTLD_NOW  | RTLD_GLOBAL | RTLD_DEEPBIND)
  # else

php-fpm.service

@@ -8,7 +8,6 @@ After=syslog.target network.target
 
 [Service]
 Type=notify
-PIDFile=/run/php-fpm/php-fpm.pid
 ExecStart=/usr/sbin/php-fpm --nodaemonize
 ExecReload=/bin/kill -USR2 $MAINPID
 PrivateTmp=true

php.ini

@@ -941,7 +941,7 @@ cli_server.color = On
 
 ;Enables or disables JIT compilation of patterns. This requires the PCRE
 ;library to be compiled with JIT support.
-;pcre.jit=1
+pcre.jit=0
 
 [Pdo]
 ; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off"

php.spec

@@ -63,16 +63,14 @@
 
 Summary: PHP scripting language for creating dynamic web sites
 Name: php
-Version: 7.0.11
-%if 0%{?rcver:1}
-Release: 0.%{rpmrel}.%{rcver}%{?dist}
-%else
-Release: %{rpmrel}%{?dist}
-%endif
+Version: 7.0.25
+Release: %{?rcver:0.}%{rpmrel}%{?rcver:.%{rcver}}%{?dist}
 # All files licensed under PHP version 3.01, except
 # Zend is licensed under Zend
 # TSRM is licensed under BSD
-License: PHP and Zend and BSD
+# main/snprintf.c, main/spprintf.c and main/rfc1867.c are ASL 1.0
+# ext/date/lib is MIT
+License: PHP and Zend and BSD and MIT and ASL 1.0
 Group: Development/Languages
 URL: http://www.php.net/
 
@@ -99,8 +97,8 @@ Patch7: php-5.3.0-recode.patch
 Patch8: php-7.0.2-libdb.patch
 
 # Functional changes
-Patch40: php-7.0.0-dlopen.patch
-Patch42: php-7.0.0-systzdata-v13.patch
+Patch40: php-7.0.17-dlopen.patch
+Patch42: php-7.0.0-systzdata-v14.patch
 # See http://bugs.php.net/53436
 Patch43: php-5.4.0-phpize.patch
 # Use -lldap_r for OpenLDAP
@@ -190,10 +188,6 @@ The php-dbg package contains the interactive PHP debugger.
 %package fpm
 Group: Development/Languages
 Summary: PHP FastCGI Process Manager
-# All files licensed under PHP version 3.01, except
-# Zend is licensed under Zend
-# TSRM and fpm are licensed under BSD
-License: PHP and Zend and BSD
 BuildRequires: libacl-devel
 Requires: php-common%{?_isa} = %{version}-%{release}
 Requires(pre): /usr/sbin/useradd
@@ -224,8 +218,7 @@ Summary: Common files for PHP
 # All files licensed under PHP version 3.01, except
 # fileinfo is licensed under PHP version 3.0
 # regex, libmagic are licensed under BSD
-# main/snprintf.c, main/spprintf.c and main/rfc1867.c are ASL 1.0
-License: PHP and BSD and ASL 1.0
+License: PHP and BSD
 # ABI/API check - Arch specific
 Provides: php(api) = %{apiver}%{isasuffix}
 Provides: php(zend-abi) = %{zendver}%{isasuffix}
@@ -738,6 +731,7 @@ cp ext/mbstring/ucgendat/OPENLDAP_LICENSE ucgendat_LICENSE
 cp ext/fileinfo/libmagic/LICENSE libmagic_LICENSE
 cp ext/phar/LICENSE phar_LICENSE
 cp ext/bcmath/libbcmath/COPYING.LIB libbcmath_COPYING
+cp ext/date/lib/LICENSE.rst timelib_LICENSE
 
 # Multiple builds for multiple SAPIs
 mkdir build-cgi build-apache build-embedded \
@@ -1361,9 +1355,10 @@ rm -f README.{Zeus,QNX,CVS-RULES}
 
 %files common -f files.common
 %doc CODING_STANDARDS CREDITS EXTENSIONS NEWS README*
-%license LICENSE Zend/ZEND_* TSRM_LICENSE
+%license LICENSE TSRM_LICENSE
 %license libmagic_LICENSE
 %license phar_LICENSE
+%license timelib_LICENSE
 %doc php.ini-*
 %config(noreplace) %{_sysconfdir}/php.ini
 %dir %{_sysconfdir}/php.d
@@ -1490,6 +1485,57 @@ rm -f README.{Zeus,QNX,CVS-RULES}
 
 
 %changelog
+* Sat Oct 28 2017 Remi Collet <remi@fedoraproject.org> - 7.0.25-1
+- Update to 7.0.25 - http://www.php.net/releases/7_0_25.php
+
+* Wed Sep 27 2017 Remi Collet <remi@fedoraproject.org> - 7.0.24-1
+- Update to 7.0.24 - http://www.php.net/releases/7_0_24.php
+
+* Wed Aug 30 2017 Remi Collet <remi@fedoraproject.org> - 7.0.23-1
+- Update to 7.0.23 - http://www.php.net/releases/7_0_23.php
+
+* Wed Aug  2 2017 Remi Collet <remi@fedoraproject.org> - 7.0.22-1
+- Update to 7.0.22 - http://www.php.net/releases/7_0_22.php
+
+* Wed Jul  5 2017 Remi Collet <remi@fedoraproject.org> - 7.0.21-1
+- Update to 7.0.21 - http://www.php.net/releases/7_0_21.php
+
+* Tue Jun  6 2017 Remi Collet <remi@fedoraproject.org> - 7.0.20-1
+- Update to 7.0.20 - http://www.php.net/releases/7_0_20.php
+- add upstream security patches for oniguruma
+
+* Tue May  9 2017 Remi Collet <remi@fedoraproject.org> - 7.0.19-1
+- Update to 7.0.19 - http://www.php.net/releases/7_0_19.php
+
+* Tue Apr 11 2017 Remi Collet <remi@fedoraproject.org> 7.0.18-1
+- Update to 7.0.18 - http://www.php.net/releases/7_0_18.php
+- timelib License is MIT
+
+* Wed Mar 15 2017 Remi Collet <remi@fedoraproject.org> 7.0.17-1
+- Update to 7.0.17 - http://www.php.net/releases/7_0_17.php
+
+* Tue Feb 28 2017 Remi Collet <remi@fedoraproject.org> 7.0.17-0.1.RC1
+- Update to 7.0.17RC1
+
+* Wed Feb 15 2017 Remi Collet <remi@fedoraproject.org> 7.0.16-1
+- Update to 7.0.16 - http://www.php.net/releases/7_0_16.php
+
+* Wed Jan 18 2017 Remi Collet <remi@fedoraproject.org> 7.0.15-1
+- Update to 7.0.15 - http://www.php.net/releases/7_0_15.php
+
+* Wed Dec  7 2016 Remi Collet <remi@fedoraproject.org> 7.0.14-1
+- Update to 7.0.14 - http://www.php.net/releases/7_0_14.php
+
+* Thu Nov 24 2016 Remi Collet <remi@fedoraproject.org> 7.0.13-2
+- disable pcre.jit everywhere as it raise AVC #1398474
+
+* Wed Nov  9 2016 Remi Collet <remi@fedoraproject.org> 7.0.13-1
+- Update to 7.0.13 - http://www.php.net/releases/7_0_13.php
+- update tzdata patch to v14, improve check for valid tz file
+
+* Thu Oct 13 2016 Remi Collet <remi@fedoraproject.org> 7.0.12-2
+- Update to 7.0.12 - http://www.php.net/releases/7_0_12.php
+
 * Wed Sep 14 2016 Remi Collet <remi@fedoraproject.org> 7.0.11-1
 - Update to 7.0.11 - http://www.php.net/releases/7_0_11.php
 

sources

@@ -1 +1 @@
-9a6013a5e9f258bbfb62ae5ac66b72da  php-7.0.11.tar.xz
+SHA512 (php-7.0.25.tar.xz) = 7a31fe48f3843a5380a7ab7b04ba2006e739f96d314b662beb337a8e76fbb2f3c1e1e22a8c9d5209bad61deb0ccc21706f0dedd12d15766f7795497549b4cae4