Fixes security bug #356893

(Portage version: 2.1.9.41/cvs/Linux x86_64)

3 files changed, 241 insertions, 1 deletions

diff --git a/dev-php/PEAR-PEAR/ChangeLog b/dev-php/PEAR-PEAR/ChangeLog
index f34595454c21..6a1434883ddb 100644
--- a/dev-php/PEAR-PEAR/ChangeLog
+++ b/dev-php/PEAR-PEAR/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for dev-php/PEAR-PEAR
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-php/PEAR-PEAR/ChangeLog,v 1.135 2011/03/06 10:59:47 olemarkus Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-php/PEAR-PEAR/ChangeLog,v 1.136 2011/03/14 17:13:18 olemarkus Exp $
+
+*PEAR-PEAR-1.9.2-r1 (14 Mar 2011)
+
+  14 Mar 2011; <olemarkus@gentoo.org> +PEAR-PEAR-1.9.2-r1.ebuild,
+  +files/symlink-attack-fix.patch:
+  Fixes security bug #356893
 
   06 Mar 2011; Ole Markus With <olemarkus@gentoo.org>
   -PEAR-PEAR-1.6.2-r1.ebuild, -PEAR-PEAR-1.9.0.ebuild,
diff --git a/dev-php/PEAR-PEAR/PEAR-PEAR-1.9.2-r1.ebuild b/dev-php/PEAR-PEAR/PEAR-PEAR-1.9.2-r1.ebuild
new file mode 100644
index 000000000000..876db88104ad
--- /dev/null
+++ b/dev-php/PEAR-PEAR/PEAR-PEAR-1.9.2-r1.ebuild
@@ -0,0 +1,108 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-php/PEAR-PEAR/PEAR-PEAR-1.9.2-r1.ebuild,v 1.1 2011/03/14 17:13:18 olemarkus Exp $
+
+EAPI="3"
+
+inherit depend.php
+
+PEAR="${PV}"
+
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-linux ~ia64-linux ~x86-linux ~x86-macos"
+
+DESCRIPTION="PEAR Base System"
+HOMEPAGE="http://pear.php.net/package/PEAR"
+SRC_URI="http://pear.php.net/get/PEAR-${PEAR}.tgz"
+LICENSE="MIT"
+SLOT="0"
+IUSE=""
+
+DEPEND="|| ( <dev-lang/php-5.3[pcre] >=dev-lang/php-5.3 )
+		dev-lang/php[cli,xml,zlib]"
+
+RDEPEND="${DEPEND}"
+
+S="${WORKDIR}"
+
+pkg_setup() {
+	has_php
+
+	[[ -z "${PEAR_CACHEDIR}" ]] && PEAR_CACHEDIR="${EPREFIX}/var/cache/pear"
+	[[ -z "${PEAR_DOWNLOADDIR}" ]] && PEAR_DOWNLOADDIR="${EPREFIX}/var/tmp/pear"
+	[[ -z "${PEAR_TEMPDIR}" ]] && PEAR_TEMPDIR="${EPREFIX}/tmp"
+
+	elog
+	elog "cache_dir is set to: ${PEAR_CACHEDIR}"
+	elog "download_dir is set to: ${PEAR_DOWNLOADDIR}"
+	elog "temp_dir is set to: ${PEAR_TEMPDIR}"
+	elog
+	elog "If you want to change the above values, you need to set"
+	elog "PEAR_CACHEDIR, PEAR_DOWNLOADDIR and PEAR_TEMPDIR variable(s)"
+	elog "accordingly in /etc/make.conf and re-emerge ${PN}."
+	elog
+}
+
+src_prepare() {
+	#356893	
+	epatch "${FILESDIR}/symlink-attack-fix.patch"
+}
+
+src_install() {
+	# Prevent SNMP related sandbox violoation.
+	addpredict /usr/share/snmp/mibs/.index
+	addpredict /var/lib/net-snmp/
+
+	# install PEAR package
+	cd "${S}"/PEAR-${PEAR}
+
+	insinto /usr/share/php
+	doins -r PEAR/
+	doins -r OS/
+	doins PEAR.php PEAR5.php System.php
+	doins scripts/pearcmd.php
+	doins scripts/peclcmd.php
+
+	newbin scripts/pear.sh pear
+	newbin scripts/peardev.sh peardev
+	newbin scripts/pecl.sh pecl
+
+	# adjust some scripts for current version
+	for i in pearcmd.php peclcmd.php ; do
+		dosed "s:@pear_version@:${PEAR}:g" /usr/share/php/${i}
+	done
+
+	for i in pear peardev pecl ; do
+		dosed "s:@bin_dir@:${EPREFIX}/usr/bin:g" /usr/bin/${i}
+		dosed "s:@php_dir@:${EPREFIX}/usr/share/php:g" /usr/bin/${i}
+	done
+	dosed "s:-d output_buffering=1:-d output_buffering=1 -d memory_limit=32M:g" /usr/bin/pear
+
+	dosed "s:@package_version@:${PEAR}:g" /usr/share/php/PEAR/Command/Package.php
+	dosed "s:@PEAR-VER@:${PEAR}:g" /usr/share/php/PEAR/Dependency2.php
+	dosed "s:@PEAR-VER@:${PEAR}:g" /usr/share/php/PEAR/PackageFile/Parser/v1.php
+	dosed "s:@PEAR-VER@:${PEAR}:g" /usr/share/php/PEAR/PackageFile/Parser/v2.php
+
+	# finalize install
+	insinto /etc
+	newins "${FILESDIR}"/pear.conf-r2 pear.conf
+	dosed "s|s:PHPCLILEN:\"PHPCLI\"|s:${#PHPCLI}:\"${PHPCLI}\"|g" /etc/pear.conf
+	dosed "s|s:CACHEDIRLEN:\"CACHEDIR\"|s:${#PEAR_CACHEDIR}:\"${PEAR_CACHEDIR}\"|g" /etc/pear.conf
+	dosed "s|s:DOWNLOADDIRLEN:\"DOWNLOADDIR\"|s:${#PEAR_DOWNLOADDIR}:\"${PEAR_DOWNLOADDIR}\"|g" /etc/pear.conf
+	dosed "s|s:TEMPDIRLEN:\"TEMPDIR\"|s:${#PEAR_TEMPDIR}:\"${PEAR_TEMPDIR}\"|g" /etc/pear.conf
+
+	# Change the paths for eprefix!
+	dosed "s|s:19:\"/usr/share/php/docs\"|s:$(( ${#EPREFIX}+19 )):\"${EPREFIX}/usr/share/php/docs\"|g" /etc/pear.conf
+	dosed "s|s:19:\"/usr/share/php/data\"|s:$(( ${#EPREFIX}+19 )):\"${EPREFIX}/usr/share/php/data\"|g" /etc/pear.conf
+	dosed "s|s:20:\"/usr/share/php/tests\"|s:$(( ${#EPREFIX}+20 )):\"${EPREFIX}/usr/share/php/tests\"|g" /etc/pear.conf
+	dosed "s|s:14:\"/usr/share/php\"|s:$(( ${#EPREFIX}+14 )):\"${EPREFIX}/usr/share/php\"|g" /etc/pear.conf
+	dosed "s|s:8:\"/usr/bin\"|s:$(( ${#EPREFIX}+8 )):\"${EPREFIX}/usr/bin\"|g" /etc/pear.conf
+
+	[[ "${PEAR_TEMPDIR}" != "/tmp" ]] && keepdir "${PEAR_TEMPDIR#${EPREFIX}}"
+	keepdir "${PEAR_CACHEDIR#${EPREFIX}}"
+	diropts -m1777
+	keepdir "${PEAR_DOWNLOADDIR#${EPREFIX}}"
+}
+
+pkg_preinst() {
+	rm -f "${EROOT}/etc/pear.conf"
+}
diff --git a/dev-php/PEAR-PEAR/files/symlink-attack-fix.patch b/dev-php/PEAR-PEAR/files/symlink-attack-fix.patch
new file mode 100644
index 000000000000..8101b2e592af
--- /dev/null
+++ b/dev-php/PEAR-PEAR/files/symlink-attack-fix.patch
@@ -0,0 +1,126 @@
+Fixes issue with symlink attacks found in PEAR-PEAR-1.9.2
+Upstream bug: http://pear.php.net/bugs/bug.php?id=18056
+Gentoo bug: 356893
+
+--- pear/pear-core/tags/PEAR-1.9.3/PEAR/REST.php	2011/03/08 22:46:27	309041
++++ pear/pear-core/tags/PEAR-1.9.3/PEAR/REST.php	2011/03/08 23:16:30	309042
+@@ -228,59 +228,75 @@
+         $cacheidfile = $d . 'rest.cacheid';
+         $cachefile   = $d . 'rest.cachefile';
+ 
++        if (!is_dir($cache_dir)) {
++            if (System::mkdir(array('-p', $cache_dir) === false)) {
++              return PEAR::raiseError("The value of config option cache_dir ($cache_dir) is not a directory and attempts to create the directory failed.");
++            }
++        }
++
+         if ($cacheid === null && $nochange) {
+             $cacheid = unserialize(implode('', file($cacheidfile)));
+         }
+ 
+-        if (is_link($cacheidfile)) {
+-            return PEAR::raiseError('SECURITY ERROR: Will not write to ' . $cacheidfile . ' as it is symlinked to ' . readlink($cacheidfile) . ' - Possible symlink attack');
+-        }
++        $idData = serialize(array(
++            'age'        => time(),
++            'lastChange' => ($nochange ? $cacheid['lastChange'] : $lastmodified),
++        ));
+ 
+-        if (is_link($cachefile)) {
+-            return PEAR::raiseError('SECURITY ERROR: Will not write to ' . $cacheidfile . ' as it is symlinked to ' . readlink($cacheidfile) . ' - Possible symlink attack');
++        $result = $this->saveCacheFile($cacheidfile, $idData);
++        if (PEAR::isError($result)) {
++            return $result;
++        } elseif ($nochange) {
++            return true;
+         }
+ 
+-        $cacheidfile_fp = @fopen($cacheidfile, 'wb');
+-        if (!$cacheidfile_fp) {
+-            if (is_dir($cache_dir)) {
+-                return PEAR::raiseError("The value of config option cache_dir ($cache_dir) is not a directory. ");
++        $result = $this->saveCacheFile($cachefile, serialize($contents));
++        if (PEAR::isError($result)) {
++            if (file_exists($cacheidfile)) {
++              @unlink($cacheidfile);
+             }
+ 
+-            System::mkdir(array('-p', $cache_dir));
+-            $cacheidfile_fp = @fopen($cacheidfile, 'wb');
+-            if (!$cacheidfile_fp) {
+-                return PEAR::raiseError("Could not open $cacheidfile for writing.");
+-            }
++            return $result;
+         }
+ 
+-        if ($nochange) {
+-            fwrite($cacheidfile_fp, serialize(array(
+-                'age'        => time(),
+-                'lastChange' => $cacheid['lastChange'],
+-                ))
+-            );
+-
+-            fclose($cacheidfile_fp);
+-            return true;
+-        }
++        return true;
++    }
+ 
+-        fwrite($cacheidfile_fp, serialize(array(
+-            'age'        => time(),
+-            'lastChange' => $lastmodified,
+-            ))
+-        );
+-        fclose($cacheidfile_fp);
++    function saveCacheFile($file, $contents)
++    {
++        $len = strlen($contents);
+ 
+-        $cachefile_fp = @fopen($cachefile, 'wb');
+-        if (!$cachefile_fp) {
+-            if (file_exists($cacheidfile)) {
+-                @unlink($cacheidfile);
++        $cachefile_fp = @fopen($file, 'xb'); // x is the O_CREAT|O_EXCL mode
++        if ($cachefile_fp !== false) { // create file
++            if (fwrite($cachefile_fp, $contents, $len) < $len) {
++                fclose($cachefile_fp);
++                return PEAR::raiseError("Could not write $file.");
++            }
++        } else { // update file
++            $cachefile_lstat = lstat($file);
++            $cachefile_fp = @fopen($file, 'wb');
++            if (!$cachefile_fp) {
++                return PEAR::raiseError("Could not open $file for writing.");
++            }
++
++            $cachefile_fstat = fstat($cachefile_fp);
++            if (
++              $cachefile_lstat['mode'] == $cachefile_fstat['mode'] &&
++              $cachefile_lstat['ino']  == $cachefile_fstat['ino'] &&
++              $cachefile_lstat['dev']  == $cachefile_fstat['dev'] &&
++              $cachefile_fstat['nlink'] === 1
++            ) {
++                if (fwrite($cachefile_fp, $contents, $len) < $len) {
++                    fclose($cachefile_fp);
++                    return PEAR::raiseError("Could not write $file.");
++                }
++            } else {
++                fclose($cachefile_fp);
++                $link = function_exists('readlink') ? readlink($file) : $file;
++                return PEAR::raiseError('SECURITY ERROR: Will not write to ' . $file . ' as it is symlinked to ' . $link . ' - Possible symlink attack');
+             }
+-
+-            return PEAR::raiseError("Could not open $cacheidfile for writing.");
+         }
+ 
+-        fwrite($cachefile_fp, serialize($contents));
+         fclose($cachefile_fp);
+         return true;
+     }
+@@ -464,4 +480,4 @@
+ 
+         return $data;
+     }
+-}
++}
+\ No newline at end of file