Debian Bug report logs - #447432
suhosin patch breaks realpath() royally

version graph

Package: php5; Maintainer for php5 is (unknown);

Reported by: Steve Langasek <vorlon@debian.org>

Date: Sun, 21 Oct 2007 08:18:03 UTC

Severity: important

Found in version php5/5.2.4-1

Fixed in version 5.2.5-1

Done: Raphael Geissert <atomo64@gmail.com>

Bug is archived. No further changes may be made.

Forwarded to suhosin-bugs@hardened-php.net

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>:
Bug#447432; Package php5. (full text, mbox, link).

Acknowledgement sent to Steve Langasek <vorlon@debian.org>:
New Bug report received and forwarded. Copy sent to Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>. (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>
To: submit@bugs.debian.org
Subject: suhosin patch breaks realpath() royally
Date: Sun, 21 Oct 2007 01:16:08 -0700
Package: php5
Version: 5.2.4-1
Severity: important

The suhosin patch that's been applied to the Debian packages breaks
realpath()'s resolution of filenames where the last component of the path
(the filename) is a symlink.  This causes all but two of the readlink tests
in ext/standard/tests/file to fail in the current build, e.g.
<http://buildd.debian.org/fetch.cgi?pkg=php5&arch=alpha&ver=5.2.4-1&stamp=1190131371&file=log&as=rawhttp://buildd.debian.org/fetch.cgi?pkg=php5&arch=alpha&ver=5.2.4-1&stamp=1190131371&file=log&as=raw>:

TEST 2628/3217 [ext/standard/tests/file/readlink_realpath_basic1.phpt]
FAIL Test readlink() and realpath functions: basic functionality - diff. path notation for links [ext/standard/tests/file/readlink_realpath_basic1.phpt] 
TEST 2629/3217 [ext/standard/tests/file/readlink_realpath_basic2.phpt]
FAIL Test readlink() and realpath functions: basic functionality - diff. path notation for files [ext/standard/tests/file/readlink_realpath_basic2.phpt] 
TEST 2630/3217 [ext/standard/tests/file/readlink_realpath_error.phpt]
PASS Test readlink() and realpath() functions: error conditions [ext/standard/tests/file/readlink_realpath_error.phpt] 
TEST 2631/3217 [ext/standard/tests/file/readlink_realpath_variation1.phpt]
FAIL Test readlink() and realpath() functions: usage variation - linkname/filename stored in object [ext/standard/tests/file/readlink_realpath_variation1.phpt] 
TEST 2632/3217 [ext/standard/tests/file/readlink_realpath_variation2.phpt]
FAIL Test readlink() and realpath() functions: usage variation - linkname/filename stored in array [ext/standard/tests/file/readlink_realpath_variation2.phpt] 
TEST 2633/3217 [ext/standard/tests/file/readlink_realpath_variation3.phpt]
PASS Test readlink() and realpath() functions: usage variation - invalid args [ext/standard/tests/file/readlink_realpath_variation3.phpt] 

I think the suhosin patch should be unapplied until it stops causing
regressions in such straightforward functions.

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/

Information forwarded to debian-bugs-dist@lists.debian.org, Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>:
Bug#447432; Package php5. (full text, mbox, link).

Acknowledgement sent to Jan Wagner <waja@cyconet.org>:
Extra info received and forwarded to list. Copy sent to Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>. (full text, mbox, link).

Message #10 received at 447432@bugs.debian.org (full text, mbox, reply):

From: Jan Wagner <waja@cyconet.org>
To: Steve Langasek <vorlon@debian.org>, 447432@bugs.debian.org
Subject: Re: [php-maint] Bug#447432: suhosin patch breaks realpath() royally
Date: Sun, 21 Oct 2007 10:58:33 +0200
[Message part 1 (text/plain, inline)]
Hi Steve,

On Sunday 21 October 2007 10:16, Steve Langasek wrote:
> Package: php5
> Version: 5.2.4-1
> Severity: important
>
> The suhosin patch that's been applied to the Debian packages breaks
> realpath()'s resolution of filenames where the last component of the path
> (the filename) is a symlink.  This causes all but two of the readlink tests
> in ext/standard/tests/file to fail in the current build, e.g.
> <http://buildd.debian.org/fetch.cgi?pkg=php5&arch=alpha&ver=5.2.4-1&stamp=1
>190131371&file=log&as=rawhttp://buildd.debian.org/fetch.cgi?pkg=php5&arch=al
>pha&ver=5.2.4-1&stamp=1190131371&file=log&as=raw>:
>
[...]
>
> I think the suhosin patch should be unapplied until it stops causing
> regressions in such straightforward functions.

was it reported to upstream?

With kind regards, Jan.
-- 
Never write mail to <waja@spamfalle.info>, you have been warned!
-----BEGIN GEEK CODE BLOCK-----
Version: 3.1
GIT d-- s+: a- C+++ UL++++ P+ L+++ E- W+++ N+++ o++ K++ w--- O M V- PS PE
Y++ PGP++ t-- 5 X R tv- b+ DI- D++ G++ e++ h-- r+++ y+++
------END GEEK CODE BLOCK------

[Message part 2 (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>:
Bug#447432; Package php5. (full text, mbox, link).

Acknowledgement sent to Steve Langasek <vorlon@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>. (full text, mbox, link).

Message #15 received at 447432@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>
To: Jan Wagner <waja@cyconet.org>
Cc: 447432@bugs.debian.org
Subject: Re: [php-maint] Bug#447432: suhosin patch breaks realpath() royally
Date: Sun, 21 Oct 2007 02:15:13 -0700
On Sun, Oct 21, 2007 at 10:58:33AM +0200, Jan Wagner wrote:

> On Sunday 21 October 2007 10:16, Steve Langasek wrote:
> > Package: php5
> > Version: 5.2.4-1
> > Severity: important

> > The suhosin patch that's been applied to the Debian packages breaks
> > realpath()'s resolution of filenames where the last component of the path
> > (the filename) is a symlink.  This causes all but two of the readlink tests
> > in ext/standard/tests/file to fail in the current build, e.g.
> > <http://buildd.debian.org/fetch.cgi?pkg=php5&arch=alpha&ver=5.2.4-1&stamp=1
> >190131371&file=log&as=rawhttp://buildd.debian.org/fetch.cgi?pkg=php5&arch=al
> >pha&ver=5.2.4-1&stamp=1190131371&file=log&as=raw>:

> [...]

> > I think the suhosin patch should be unapplied until it stops causing
> > regressions in such straightforward functions.

> was it reported to upstream?

> With kind regards, Jan.

Not by me, but I didn't apply the patch to the package and don't even know
who upstream for it is.  I figure this is Sean's problem. :)

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/

Information forwarded to debian-bugs-dist@lists.debian.org, Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>:
Bug#447432; Package php5. (full text, mbox, link).

Acknowledgement sent to Raphael <atomo64@gmail.com>:
Extra info received and forwarded to list. Copy sent to Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>. (full text, mbox, link).

Message #20 received at 447432@bugs.debian.org (full text, mbox, reply):

From: Raphael <atomo64@gmail.com>
To: suhosin-bugs@hardened-php.net
Cc: 447432@bugs.debian.org, control@bugs.debian.org
Subject: Fwd: Bug#447432: suhosin patch breaks realpath() royally
Date: Sun, 21 Oct 2007 15:59:47 -0500
forwarded 447432 suhosin-bugs@hardened-php.net
thanks

Message to suhosin-bugs:
I'm forwarding a bug report received about suhosin breaking realpath()
when checking symlinks (see message below for more specific
information).
When replying please do so by sending the email to
447432@bugs.debian.org so we keep the record.

Message to BTS:
I'm forwarding the bug report to upstream.
Steve: did you test with the new package version? maybe something
differs between -1 and -2.


---------- Forwarded message ----------
From: Steve Langasek <vorlon@debian.org>
Date: 21 Oct 2007 03:16
Subject: [php-maint] Bug#447432: suhosin patch breaks realpath() royally
To: submit@bugs.debian.org


Package: php5
Version: 5.2.4-1
Severity: important

The suhosin patch that's been applied to the Debian packages breaks
realpath()'s resolution of filenames where the last component of the path
(the filename) is a symlink.  This causes all but two of the readlink tests
in ext/standard/tests/file to fail in the current build, e.g.
<http://buildd.debian.org/fetch.cgi?pkg=php5&arch=alpha&ver=5.2.4-1&stamp=1190131371&file=log&as=rawhttp://buildd.debian.org/fetch.cgi?pkg=php5&arch=alpha&ver=5.2.4-1&stamp=1190131371&file=log&as=raw>:

TEST 2628/3217 [ext/standard/tests/file/readlink_realpath_basic1.phpt]
FAIL Test readlink() and realpath functions: basic functionality -
diff. path notation for links
[ext/standard/tests/file/readlink_realpath_basic1.phpt]
TEST 2629/3217 [ext/standard/tests/file/readlink_realpath_basic2.phpt]
FAIL Test readlink() and realpath functions: basic functionality -
diff. path notation for files
[ext/standard/tests/file/readlink_realpath_basic2.phpt]
TEST 2630/3217 [ext/standard/tests/file/readlink_realpath_error.phpt]
PASS Test readlink() and realpath() functions: error conditions
[ext/standard/tests/file/readlink_realpath_error.phpt]
TEST 2631/3217 [ext/standard/tests/file/readlink_realpath_variation1.phpt]
FAIL Test readlink() and realpath() functions: usage variation -
linkname/filename stored in object
[ext/standard/tests/file/readlink_realpath_variation1.phpt]
TEST 2632/3217 [ext/standard/tests/file/readlink_realpath_variation2.phpt]
FAIL Test readlink() and realpath() functions: usage variation -
linkname/filename stored in array
[ext/standard/tests/file/readlink_realpath_variation2.phpt]
TEST 2633/3217 [ext/standard/tests/file/readlink_realpath_variation3.phpt]
PASS Test readlink() and realpath() functions: usage variation -
invalid args [ext/standard/tests/file/readlink_realpath_variation3.phpt]

I think the suhosin patch should be unapplied until it stops causing
regressions in such straightforward functions.

--
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/


-- 
Atomo64 - Raphael

Please avoid sending me Word, PowerPoint or Excel attachments.
See http://www.gnu.org/philosophy/no-word-attachments.html

Say NO to Microsoft Office broken standard.
See http://www.noooxml.org/petition

Noted your statement that Bug has been forwarded to suhosin-bugs@hardened-php.net. Request was from Raphael <atomo64@gmail.com> to control@bugs.debian.org. (Sun, 21 Oct 2007 21:03:13 GMT) (full text, mbox, link).

Reply sent to Raphael Geissert <atomo64@gmail.com>:
You have taken responsibility. (full text, mbox, link).

Notification sent to Steve Langasek <vorlon@debian.org>:
Bug acknowledged by developer. (full text, mbox, link).

Message #27 received at 447432-done@bugs.debian.org (full text, mbox, reply):

From: Raphael Geissert <atomo64@gmail.com>
To: 447432-done@bugs.debian.org
Subject: Closing #447432: tests passed on 5.2.5
Date: Thu, 21 Feb 2008 22:16:50 -0600
Version: 5.2.5-1

From 
http://buildd.debian.org/fetch.cgi?pkg=php5;ver=5.2.5-1;arch=alpha;stamp=1201500331 :
> TEST 2804/3785 [ext/standard/tests/file/readlink_realpath_basic1.phpt]
> PASS Test readlink() and realpath functions: basic functionality - diff.
> path notation for links(Bug #42038)
> [ext/standard/tests/file/readlink_realpath_basic1.phpt] TEST 2805/3785
> [ext/standard/tests/file/readlink_realpath_basic2.phpt] PASS Test
> readlink() and realpath functions: basic functionality - diff. path
> notation for files [ext/standard/tests/file/readlink_realpath_basic2.phpt]
> TEST 2806/3785 [ext/standard/tests/file/readlink_realpath_error.phpt] PASS
> Test readlink() and realpath() functions: error conditions
> [ext/standard/tests/file/readlink_realpath_error.phpt] TEST 2807/3785
> [ext/standard/tests/file/readlink_realpath_variation1.phpt] PASS Test
> readlink() and realpath() functions: usage variation - linkname/filename
> stored in object(Bug #42038)
> [ext/standard/tests/file/readlink_realpath_variation1.phpt] TEST 2808/3785
> [ext/standard/tests/file/readlink_realpath_variation2.phpt] PASS Test
> readlink() and realpath() functions: usage variation - linkname/filename
> stored in array(Bug #42038)
> [ext/standard/tests/file/readlink_realpath_variation2.phpt] TEST 2809/3785
> [ext/standard/tests/file/readlink_realpath_variation3.phpt] PASS Test
> readlink() and realpath() functions: usage variation - invalid args
> [ext/standard/tests/file/readlink_realpath_variation3.phpt]

Cheers,
-- 
Atomo64 - Raphael

Please avoid sending me Word, PowerPoint or Excel attachments.
See http://www.gnu.org/philosophy/no-word-attachments.html

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Fri, 21 Mar 2008 07:30:17 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sun Jul 2 02:53:51 2023; Machine Name: bembo

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.