FreeBSD ports tree https://cgit-dev.freebsd.org/ports/atom?h=2020Q1 2020-03-25T11:22:19Z 2020-03-25T11:22:19Z Torsten Zuehlsdorff tz@FreeBSD.org 2020-03-25T11:22:19Z urn:sha1:4b71035cd94ff941b26cb05c0afab5f7a761ed62 lang/php74: Update from 7.4.3 to 7.4.4 Changelog: Core: Fixed bug #79329 (get_headers() silently truncates after a null byte) (CVE-2020-7066) Fixed bug #79244 (php crashes during parsing INI file). Fixed bug #63206 (restore_error_handler does not restore previous errors mask). COM: Fixed bug #66322 (COMPersistHelper::SaveToFile can save to wrong location). Fixed bug #79242 (COM error constants don't match com_exception codes on x86). Fixed bug #79247 (Garbage collecting variant objects segfaults). Fixed bug #79248 (Traversing empty VT_ARRAY throws com_exception). Fixed bug #79299 (com_print_typeinfo prints duplicate variables). Fixed bug #79332 (php_istreams are never freed). Fixed bug #79333 (com_print_typeinfo() leaks memory). CURL: Fixed bug #79019 (Copied cURL handles upload empty file). Fixed bug #79013 (Content-Length missing when posting a curlFile with curl). DOM: Fixed bug #77569: (Write Access Violation in DomImplementation). Fixed bug #79271 (DOMDocumentType::$childNodes is NULL). Enchant: Fixed bug #79311 (enchant_dict_suggest() fails on big endian architecture). EXIF: Fixed bug #79282 (Use-of-uninitialized-value in exif) (CVE-2020-7064). Fileinfo: Fixed bug #79283 (Segfault in libmagic patch contains a buffer overflow). FPM: Fixed bug #77653 (operator displayed instead of the real error message). Fixed bug #79014 (PHP-FPM & Primary script unknown). MBstring: Fixed bug #79371 (mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full) (CVE-2020-7065). MySQLi: Fixed bug #64032 (mysqli reports different client_version). MySQLnd: Implemented FR #79275 (Support auth_plugin_caching_sha2_password on Windows). Opcache: Fixed bug #79252 (preloading causes php-fpm to segfault during exit). PCRE: Fixed bug #79188 (Memory corruption in preg_replace/preg_replace_callback and unicode). Fixed bug #79241 (Segmentation fault on preg_match()). Fixed bug #79257 (Duplicate named groups (?J) prefer last alternative even if not matched). PDO_ODBC: Fixed bug #79038 (PDOStatement::nextRowset() leaks column values). Reflection: Fixed bug #79062 (Property with heredoc default value returns false for getDocComment). SQLite3: Fixed bug #79294 (::columnType() may fail after SQLite3Stmt::reset()). Standard: Fixed bug #79254 (getenv() w/o arguments not showing changes). Fixed bug #79265 (Improper injection of Host header when using fopen for http requests). Zip: Fixed bug #79315 (ZipArchive::addFile doesn't honor start/length parameters). Changelog taken from: https://www.php.net/ChangeLog-7.php#7.4.4 Sponsored by: PHP Update Service Approved by: ports-secteam (joneum) 2020-03-25T11:19:09Z Torsten Zuehlsdorff tz@FreeBSD.org 2020-03-25T11:19:09Z urn:sha1:d7b1ed0570bd6a300fcd4481ca0374e6101aaeb9 lang/php73: Update from 7.3.15 to 7.3.16 Changelog: Core: Fixed bug #63206 (restore_error_handler does not restore previous errors mask). COM: Fixed bug #66322 (COMPersistHelper::SaveToFile can save to wrong location). Fixed bug #79242 (COM error constants don't match com_exception codes on x86). Fixed bug #79248 (Traversing empty VT_ARRAY throws com_exception). Fixed bug #79299 (com_print_typeinfo prints duplicate variables). Fixed bug #79332 (php_istreams are never freed). Fixed bug #79333 (com_print_typeinfo() leaks memory). DOM: Fixed bug #77569: (Write Access Violation in DomImplementation). Fixed bug #79271 (DOMDocumentType::$childNodes is NULL). Enchant: Fixed bug #79311 (enchant_dict_suggest() fails on big endian architecture). EXIF: Fixed bug #79282 (Use-of-uninitialized-value in exif). (CVE-2020-7064) MBstring: Fixed bug #79371 (mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full). (CVE-2020-7065) MySQLi: Fixed bug #64032 (mysqli reports different client_version). PCRE: Fixed bug #79188 (Memory corruption in preg_replace/preg_replace_callback and unicode). PDO_ODBC: Fixed bug #79038 (PDOStatement::nextRowset() leaks column values). Reflection: Fixed bug #79062 (Property with heredoc default value returns false for getDocComment). SQLite3: Fixed bug #79294 (::columnType() may fail after SQLite3Stmt::reset()). Standard: Fixed bug #79329 (get_headers() silently truncates after a null byte). (CVE-2020-7066) Fixed bug #79254 (getenv() w/o arguments not showing changes). Fixed bug #79265 (Improper injection of Host header when using fopen for http requests). Changelog taken from: https://www.php.net/ChangeLog-7.php#7.3.16 Sponsored by: PHP Update Service Approved by: ports-secteam (joneum) 2020-03-25T11:15:56Z Torsten Zuehlsdorff tz@FreeBSD.org 2020-03-25T11:15:56Z urn:sha1:69c1fd1645f040df6a50bf069e31781002378393 lang/php72: Update from 7.2.28 to 7.2.29 Changelog: Core: Fixed bug #79329 (get_headers() silently truncates after a null byte) (CVE-2020-7066) (cmb) EXIF: Fixed bug #79282 (Use-of-uninitialized-value in exif) (CVE-2020-7064) (Nikita) Changelog taken from: https://www.php.net/ChangeLog-7.php#7.2.29 Sponsored by: PHP Update Service Approved by: ports-secteam (joneum) 2020-03-04T17:56:57Z Tobias Kortkamp tobik@FreeBSD.org 2020-03-04T17:56:57Z urn:sha1:795f7aa36eace3af1d7a289cf34e36326aabbb5d lang/rust-nightly: Unbreak with lld on 12.1/13.0 i386 = note: ld: error: relocation R_386_PC32 cannot be used against symbol __rust_probestack; recompile with -fPIC >>> defined in /wrkdirs/usr/ports/lang/rust-nightly/work/rustc-nightly-src/build/i686-unknown-freebsd/stage1/lib/rustlib/i686-unknown-freebsd/lib/libcompiler_builtins-6570a75fe85f0e1a.rlib(compiler_builtins-6570a75fe85f0e1a.compiler_builtins.2i519eqi-cgu.15.rcgu.o) >>> referenced by std.4xivr03c-cgu.14 >>> std-9bd70afd58e204b7.std.4xivr03c-cgu.14.rcgu.o:(_$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h1c78ed6e734a2bfc (.llvm.10122419023709863394)) in archive /wrkdirs/usr/ports/lang/rust-nightly/work/rustc-nightly-src/build/i686-unknown-freebsd/stage1/lib/rustlib/i686-unknown-freebsd/lib/libstd-9bd70afd58e204b7.rlib ld: error: relocation R_386_PC32 cannot be used against symbol __rust_probestack; recompile with -fPIC >>> defined in /wrkdirs/usr/ports/lang/rust-nightly/work/rustc-nightly-src/build/i686-unknown-freebsd/stage1/lib/rustlib/i686-unknown-freebsd/lib/libcompiler_builtins-6570a75fe85f0e1a.rlib(compiler_builtins-6570a75fe85f0e1a.compiler_builtins.2i519eqi-cgu.15.rcgu.o) >>> referenced by std.4xivr03c-cgu.14 >>> std-9bd70afd58e204b7.std.4xivr03c-cgu.14.rcgu.o:(std::io::util::copy::h9115f048f2203467) in archive /wrkdirs/usr/ports/lang/rust-nightly/work/rustc-nightly-src/build/i686-unknown-freebsd/stage1/lib/rustlib/i686-unknown-freebsd/lib/libstd-9bd70afd58e204b7.rlib clang-cpp: error: linker command failed with exit code 1 (use -v to see invocation) error: aborting due to previous error http://beefy17.nyi.freebsd.org/data/head-i386-default/p523508_s356869/logs/rust-nightly-1.42.0.20200118.log http://beefy4.nyi.freebsd.org/data/121i386-quarterly/527662/logs/rust-nightly-1.42.0.20191222.log Approved by: ports-secteam blanket 2020-02-21T22:46:19Z Torsten Zuehlsdorff tz@FreeBSD.org 2020-02-21T22:46:19Z urn:sha1:30f1a3ab920280a04c56009f0010b0a3f6476a59 lang/php74: Upgrade from 7.4.2 to 7.4.3 Changelog: Core: Fixed bug #79146 (cscript can fail to run on some systems). Fixed bug #79155 (Property nullability lost when using multiple property definition). Fixed bug #78323 (Code 0 is returned on invalid options). Fixed bug #78989 (Delayed variance check involving trait segfaults). Fixed bug #79174 (cookie values with spaces fail to round-trip). Fixed bug #76047 (Use-after-free when accessing already destructed backtrace arguments). COM: Fixed bug #79247 (Garbage collecting variant objects segfaults). CURL: Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()). FFI: Fixed bug #79096 (FFI Struct Segfault). IMAP: Fixed bug #79112 (IMAP extension can't find OpenSSL libraries at configure time). Intl: Fixed bug #79212 (NumberFormatter::format() may detect wrong type). Libxml: Fixed bug #79191 (Error in SoapClient ctor disables DOMDocument::save()). MBString: Fixed bug #79149 (SEGV in mb_convert_encoding with non-string encodings). MySQLi: Fixed bug #78666 (Properties may emit a warning on var_dump()). MySQLnd: Fixed bug #79084 (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH). Fixed bug #79011 (MySQL caching_sha2_password Access denied for password with more than 20 chars). Opcache: Fixed bug #79114 (Eval class during preload causes class to be only half available). Fixed bug #79128 (Preloading segfaults if preload_user is used). Fixed bug #79193 (Incorrect type inference for self::$field =& $field). OpenSSL: Fixed bug #79145 (openssl memory leak). Phar: Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have all-access permissions). (CVE-2020-7063) Fixed bug #79171 (heap-buffer-overflow in phar_extract_file). (CVE-2020-7061) Fixed bug #76584 (PharFileInfo::decompress not working). Reflection: Fixed bug #79115 (ReflectionClass::isCloneable call reflected class __destruct). Session: Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress). (CVE-2020-7062) Standard: Fixed bug #78902 (Memory leak when using stream_filter_append). Fixed bug #78969 (PASSWORD_DEFAULT should match PASSWORD_BCRYPT instead of being null). Testing: Fixed bug #78090 (bug45161.phpt takes forever to finish). XSL: Fixed bug #70078 (XSL callbacks with nodes as parameter leak memory). Zip: Add ZipArchive::CM_LZMA2 and ZipArchive::CM_XZ constants (since libzip 1.6.0). Add ZipArchive::RDONLY (since libzip 1.0.0). Add ZipArchive::ER_* missing constants. Add ZipArchive::LIBZIP_VERSION constant. Fixed bug #73119 (Wrong return for ZipArchive::addEmptyDir Method). Changelog taken from: https://www.php.net/ChangeLog-7.php#7.4.3 Approved by: ports-secteam (joneum) 2020-02-21T22:43:15Z Torsten Zuehlsdorff tz@FreeBSD.org 2020-02-21T22:43:15Z urn:sha1:63f99985052ee0f82005d7103656e666f7fe6904 lang/php73: Upgrade from 7.3.14 to 7.3.15 Changelog: Core: Fixed bug #71876 (Memory corruption htmlspecialchars(): charset `*' not supported). Fixed bug #79146 (cscript can fail to run on some systems). Fixed bug #78323 (Code 0 is returned on invalid options). Fixed bug #76047 (Use-after-free when accessing already destructed backtrace arguments). CURL: Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()). Intl: Fixed bug #79212 (NumberFormatter::format() may detect wrong type). Libxml: Fixed bug #79191 (Error in SoapClient ctor disables DOMDocument::save()). MBString: Fixed bug #79154 (mb_convert_encoding() can modify $from_encoding). MySQLnd: Fixed bug #79084 (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH). OpenSSL: Fixed bug #79145 (openssl memory leak). Phar: Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have all-access permissions). (CVE-2020-7063) Fixed bug #79171 (heap-buffer-overflow in phar_extract_file). (CVE-2020-7061) Fixed bug #76584 (PharFileInfo::decompress not working). Reflection: Fixed bug #79115 (ReflectionClass::isCloneable call reflected class __destruct). Session: Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress). (CVE-2020-7062) SPL: Fixed bug #79151 (heap use after free caused by spl_dllist_it_helper_move_forward). Standard: Fixed bug #78902 (Memory leak when using stream_filter_append). Testing: Fixed bug #78090 (bug45161.phpt takes forever to finish). XSL: Fixed bug #70078 (XSL callbacks with nodes as parameter leak memory). Changelog taken from: https://www.php.net/ChangeLog-7.php#7.3.15 Approved by: ports-secteam (joneum) 2020-02-21T22:41:12Z Torsten Zuehlsdorff tz@FreeBSD.org 2020-02-21T22:41:12Z urn:sha1:2dd60a109f9a6a5a934f049afb8a4f5e11c0bba2 lang/php72: Upgrade from 7.2.27 to 7.2.28 Changelog: DOM: Fixed bug #77569: (Write Access Violation in DomImplementation). Phar: Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have all-access permissions). (CVE-2020-7063) Session: Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress). (CVE-2020-7062) Changelog taken from: https://www.php.net/ChangeLog-7.php#7.2.28 Approved by: ports-secteam (joneum) 2020-01-26T15:35:44Z Dave Cottlehuber dch@FreeBSD.org 2020-01-26T15:35:44Z urn:sha1:9ab218f7eb9800d686651744bf719e2405b3ca5a lang/erlang*: repair 32-bit x86 erlang builds Having HIPE & NATIVE enabled breaks OTP on 32-bit x86. They have not built succesfully for quite some time. Reported by: pkg fallout Reviewed by: olgeni Sponsored by: SkunkWerks, GmbH Differential Revision: https://reviews.freebsd.org/D23296 lang/erlang*: include serious scheduler bugfixes OTP-16371 Taking a scheduler offline could cause timers set while executing on that scheduler to be delayed until the scheduler was put online again. This bug was introduced in ERTS version 10.0 (OTP 21.0). OTP-16378 | ERL-1125 The ets:update_counter/4 core dumped when given an ordered_set with write_concurrency enabled and an invalid position. OTP-16379 A process calling erlang:system_flag(multi_scheduling, block) could end up blocked waiting for the operation to complete indefinitely. Reviewed by: olgeni Sponsored by: SkunkWerks, GmbH Differential Revision: https://reviews.freebsd.org/D23313 Approved by: portmgr 2020-01-25T19:49:53Z Torsten Zuehlsdorff tz@FreeBSD.org 2020-01-25T19:49:53Z urn:sha1:a3d58833dbbd057efc5a520cee75f348ac8e206c lang/php74: Upgrade from 7.4.1 to 7.4.2 Changelog: Core: Preloading support on Windows has been disabled. Fixed bug #79022 (class_exists returns True for classes that are not ready to be used). Fixed bug #78929 (plus signs in cookie values are converted to spaces). Fixed bug #78973 (Destructor during CV freeing causes segfault if opline never saved). Fixed bug #78776 (Abstract method implementation from trait does not check "static"). Fixed bug #78999 (Cycle leak when using function result as temporary). Fixed bug #79008 (General performance regression with PHP 7.4 on Windows). Fixed bug #79002 (Serializing uninitialized typed properties with __sleep makes unserialize throw). CURL: Fixed bug #79033 (Curl timeout error with specific url and post). Fixed bug #79063 (curl openssl does not respect PKG_CONFIG_PATH). Date: Fixed bug #79015 (undefined-behavior in php_date.c). DBA: Fixed bug #78808 ([LMDB] MDB_MAP_FULL: Environment mapsize limit reached). Exif: Fixed bug #79046 (NaN to int cast undefined behavior in exif). Fileinfo: Fixed bug #74170 (locale information change after mime_content_type). GD: Fixed bug #79067 (gdTransformAffineCopy() may use unitialized values). Fixed bug #79068 (gdTransformAffineCopy() changes interpolation method). Libxml: Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter). Mbstring: Fixed bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). (CVE-2020-7060) OPcache: Fixed bug #78961 (erroneous optimization of re-assigned $GLOBALS). Fixed bug #78950 (Preloading trait method with static variables). Fixed bug #78903 (Conflict in RTD key for closures results in crash). Fixed bug #78986 (Opcache segfaults when inheriting ctor from immutable into mutable class). Fixed bug #79040 (Warning Opcode handlers are unusable due to ASLR). Fixed bug #79055 (Typed property become unknown with OPcache file cache). Pcntl: Fixed bug #78402 (Converting null to string in error message is bad DX). PDO_PgSQL: Fixed bug #78983 (pdo_pgsql config.w32 cannot find libpq-fe.h). Fixed bug #78980 (pgsqlGetNotify() overlooks dead connection). Fixed bug #78982 (pdo_pgsql returns dead persistent connection). Session: Fixed bug #79091 (heap use-after-free in session_create_id()). Fixed bug #79031 (Session unserialization problem). Shmop: Fixed bug #78538 (shmop memory leak). Sqlite3: Fixed bug #79056 (sqlite does not respect PKG_CONFIG_PATH during compilation). Spl: Fixed bug #78976 (SplFileObject::fputcsv returns -1 on failure). Standard: Fixed bug #79099 (OOB read in php_strip_tags_ex). (CVE-2020-7059) Fixed bug #79000 (Non-blocking socket stream reports EAGAIN as error). Fixed bug #54298 (Using empty additional_headers adding extraneous CRLF). Changelog taken from: https://www.php.net/ChangeLog-7.php#7.4.2 Approved by: ports-secteam (joneum) 2020-01-25T00:15:08Z Torsten Zuehlsdorff tz@FreeBSD.org 2020-01-25T00:15:08Z urn:sha1:7dac23f8bbfcad4051f08aaa94944976fc984f21 lang/php73: Update from 7.3.13 to 7.3.14 Changelog: Core: Fixed bug #78999 (Cycle leak when using function result as temporary). CURL: Fixed bug #79033 (Curl timeout error with specific url and post). Date: Fixed bug #79015 (undefined-behavior in php_date.c). DBA: Fixed bug #78808 ([LMDB] MDB_MAP_FULL: Environment mapsize limit reached). Fileinfo: Fixed bug #74170 (locale information change after mime_content_type). GD: Fixed bug #78923 (Artifacts when convoluting image with transparency). Fixed bug #79067 (gdTransformAffineCopy() may use unitialized values). Fixed bug #79068 (gdTransformAffineCopy() changes interpolation method). Libxml: Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter). Mbstring: Fixed bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). (CVE-2020-7060) OPcache: Fixed bug #79040 (Warning Opcode handlers are unusable due to ASLR). Pcntl: Fixed bug #78402 (Converting null to string in error message is bad DX). PDO_PgSQL: Fixed bug #78983 (pdo_pgsql config.w32 cannot find libpq-fe.h). Fixed bug #78980 (pgsqlGetNotify() overlooks dead connection). Fixed bug #78982 (pdo_pgsql returns dead persistent connection). Session: Fixed bug #79091 (heap use-after-free in session_create_id()). Shmop: Fixed bug #78538 (shmop memory leak). Standard: Fixed bug #79099 (OOB read in php_strip_tags_ex). (CVE-2020-7059) Fixed bug #54298 (Using empty additional_headers adding extraneous CRLF). Changelog taken from: https://www.php.net/ChangeLog-7.php#7.3.14 Approved by: ports-secteam (joneum)