diff -Nru php7.4-7.4.3/debian/changelog php7.4-7.4.3/debian/changelog --- php7.4-7.4.3/debian/changelog 2022-11-02 09:53:44.000000000 +0000 +++ php7.4-7.4.3/debian/changelog 2022-09-15 22:53:21.000000000 +0000 @@ -1,3 +1,18 @@ +php7.4 (7.4.3-4ubuntu2.16) focal; urgency=medium + + [ Athos Ribeiro ] + * d/rules: fix PHP_EXTRA_VERSION setting. (LP: #1989196) + * Test PHP_EXTRA_VERSION setting with autopkgtest. + + [ Matthew Ruffell ] + * No longer throw an error when serializing uninitialized typed + properties with __sleep(), which makes serializing objects with + __sleep() behave the same as serializing objects without + __sleep(). (LP: #1999598) + - d/p/lp-1999598-Fix-bug-79447.patch + + -- Athos Ribeiro Thu, 15 Sep 2022 19:53:21 -0300 + php7.4 (7.4.3-4ubuntu2.15) focal-security; urgency=medium * SECURITY UPDATE: Denial of service diff -Nru php7.4-7.4.3/debian/patches/lp-1999598-Fix-bug-79447.patch php7.4-7.4.3/debian/patches/lp-1999598-Fix-bug-79447.patch --- php7.4-7.4.3/debian/patches/lp-1999598-Fix-bug-79447.patch 1970-01-01 00:00:00.000000000 +0000 +++ php7.4-7.4.3/debian/patches/lp-1999598-Fix-bug-79447.patch 2022-09-15 22:53:21.000000000 +0000 @@ -0,0 +1,99 @@ +commit 73d02c3b3eb8b828a1cc7ae04a4cc4f4875c3ddd +Author: Nicolas Grekas +Date: Thu, 16 Apr 2020 00:11:38 +0200 +Description: Fix bug #79447 + Partially reverts 846b6479537a112d1ded725e6484e46462048b35: instead of + throwing, this skips uninitialized typed properties when serializing objects. + + This makes serialize with __sleep() behave the same as serialize() + without __sleep(). + + As in the non-__sleep() case, unserialize(serialize($x)) identity + may not be preserved due to replacement of uninitialized/unset + properties with default values. Fixing this will require changes to + the serialization format. + + Closes GH-5396. +Bug-Ubuntu: https://bugs.launchpad.net/bugs/1999598 +Bug: https://bugs.php.net/bug.php?id=79447 +Origin: backport, https://github.com/php/php-src/commit/73d02c3b3eb8b828a1cc7ae04a4cc4f4875c3ddd +Last-Update: 2022-12-14 + +Index: php7.4-7.4.3/ext/standard/tests/serialize/sleep_uninitialized_typed_prop.phpt +=================================================================== +--- php7.4-7.4.3.orig/ext/standard/tests/serialize/sleep_uninitialized_typed_prop.phpt 2022-12-14 11:47:32.074805621 +1300 ++++ php7.4-7.4.3/ext/standard/tests/serialize/sleep_uninitialized_typed_prop.phpt 2022-12-14 11:47:32.070805541 +1300 +@@ -1,5 +1,5 @@ + --TEST-- +-Referencing an uninitialized typed property in __sleep() should result in Error ++Referencing an uninitialized typed property in __sleep() should be skipped + --FILE-- + getMessage(), "\n"; +-} ++var_dump(serialize($t)); ++var_dump(unserialize(serialize($t)) == $t); + + $t->x = 1; +-try { +- serialize($t); +-} catch (Error $e) { +- echo $e->getMessage(), "\n"; +-} ++var_dump(unserialize(serialize($t)) == $t); + + $t->y = 2; +-try { +- serialize($t); +-} catch (Error $e) { +- echo $e->getMessage(), "\n"; +-} ++var_dump(unserialize(serialize($t)) == $t); + + $t->z = 3; +-try { +- var_dump(unserialize(serialize($t))); +-} catch (Error $e) { +- echo $e->getMessage(), "\n"; +-} ++var_dump(unserialize(serialize($t)) == $t); + ++var_dump($t); + ?> + --EXPECT-- +-Typed property Test::$x must not be accessed before initialization (in __sleep) +-Typed property Test::$y must not be accessed before initialization (in __sleep) +-Typed property Test::$z must not be accessed before initialization (in __sleep) +-object(Test)#3 (3) { ++string(15) "O:4:"Test":0:{}" ++bool(true) ++bool(true) ++bool(true) ++bool(true) ++object(Test)#1 (3) { + ["x"]=> + int(1) + ["y":protected]=> +Index: php7.4-7.4.3/ext/standard/var.c +=================================================================== +--- php7.4-7.4.3.orig/ext/standard/var.c 2022-12-14 11:47:32.074805621 +1300 ++++ php7.4-7.4.3/ext/standard/var.c 2022-12-14 11:47:32.070805541 +1300 +@@ -784,9 +784,7 @@ + if (Z_TYPE_P(val) == IS_UNDEF) { + zend_property_info *info = zend_get_typed_property_info_for_slot(Z_OBJ_P(struc), val); + if (info) { +- zend_throw_error(NULL, +- "Typed property %s::$%s must not be accessed before initialization (in __sleep)", +- ZSTR_VAL(Z_OBJCE_P(struc)->name), ZSTR_VAL(error_name)); ++ return SUCCESS; + } + return FAILURE; + } diff -Nru php7.4-7.4.3/debian/patches/series php7.4-7.4.3/debian/patches/series --- php7.4-7.4.3/debian/patches/series 2022-11-02 09:53:34.000000000 +0000 +++ php7.4-7.4.3/debian/patches/series 2022-09-15 22:53:21.000000000 +0000 @@ -81,3 +81,4 @@ CVE-2022-31629.patch CVE-2022-31630.patch CVE-2022-37454.patch +lp-1999598-Fix-bug-79447.patch diff -Nru php7.4-7.4.3/debian/rules php7.4-7.4.3/debian/rules --- php7.4-7.4.3/debian/rules 2022-08-17 13:25:24.000000000 +0000 +++ php7.4-7.4.3/debian/rules 2022-09-15 22:53:21.000000000 +0000 @@ -271,13 +271,13 @@ prepared: prepared-stamp debian/control debian/source.lintian-overrides prepared-stamp: - $(SED) -i -e 's/EXTRA_VERSION=""/EXTRA_VERSION="-$(PHP_DEBIAN_REVISION)"/' configure.ac + $(SED) -i -e 's/^PHP_EXTRA_VERSION=\[\$$\]4$$/PHP_EXTRA_VERSION="-$(PHP_DEBIAN_REVISION)"/' configure.ac ./buildconf --force touch prepared-stamp unprepared: dh_testdir - $(SED) -i -e 's/EXTRA_VERSION="-$(PHP_DEBIAN_REVISION)"/EXTRA_VERSION=""/' configure.ac + $(SED) -i -e 's/^PHP_EXTRA_VERSION="-$(PHP_DEBIAN_REVISION)"/PHP_EXTRA_VERSION=[$$]4/' configure.ac -[ -f ext/ext_skel.in ] && mv ext/ext_skel.in ext/ext_skel rm -f prepared-stamp diff -Nru php7.4-7.4.3/debian/tests/control php7.4-7.4.3/debian/tests/control --- php7.4-7.4.3/debian/tests/control 2022-08-17 13:21:44.000000000 +0000 +++ php7.4-7.4.3/debian/tests/control 2022-09-15 22:53:21.000000000 +0000 @@ -19,3 +19,6 @@ php7.4-fpm, wget Restrictions: needs-root + +Tests: version +Depends: php7.4-cli diff -Nru php7.4-7.4.3/debian/tests/version php7.4-7.4.3/debian/tests/version --- php7.4-7.4.3/debian/tests/version 1970-01-01 00:00:00.000000000 +0000 +++ php7.4-7.4.3/debian/tests/version 2022-09-15 22:53:21.000000000 +0000 @@ -0,0 +1,13 @@ +#!/bin/sh + +# Author: Athos Ribeiro + +# Ensure that the PHP_EXTRA_VERSION is being set with the debian version + +PKGVERSION=$(dpkg-query --showformat='${Version}\n' --show php7.4-cli) +PHPVERSION=$(php7.4 --version | head -1 | cut -d ' ' -f2) + +if [ "${PKGVERSION}" != "${PHPVERSION}" ]; then + echo "package version '${PKGVERSION}' does not match php CLI version '${PHPVERSION}'" + exit 1 +fi diff -Nru php7.4-7.4.3/debian/tests.in/control php7.4-7.4.3/debian/tests.in/control --- php7.4-7.4.3/debian/tests.in/control 2022-08-17 13:21:44.000000000 +0000 +++ php7.4-7.4.3/debian/tests.in/control 2022-09-15 22:53:21.000000000 +0000 @@ -19,3 +19,6 @@ php@PHP_VERSION@-fpm, wget Restrictions: needs-root + +Tests: version +Depends: php@PHP_VERSION@-cli diff -Nru php7.4-7.4.3/debian/tests.in/version php7.4-7.4.3/debian/tests.in/version --- php7.4-7.4.3/debian/tests.in/version 1970-01-01 00:00:00.000000000 +0000 +++ php7.4-7.4.3/debian/tests.in/version 2022-09-15 22:53:21.000000000 +0000 @@ -0,0 +1,13 @@ +#!/bin/sh + +# Author: Athos Ribeiro + +# Ensure that the PHP_EXTRA_VERSION is being set with the debian version + +PKGVERSION=$(dpkg-query --showformat='${Version}\n' --show php@PHP_VERSION@-cli) +PHPVERSION=$(php@PHP_VERSION@ --version | head -1 | cut -d ' ' -f2) + +if [ "${PKGVERSION}" != "${PHPVERSION}" ]; then + echo "package version '${PKGVERSION}' does not match php CLI version '${PHPVERSION}'" + exit 1 +fi