Bug 20213 - php-ssh2-0.12-9.mga5 segfault in scandir over ssh2
Summary: php-ssh2-0.12-9.mga5 segfault in scandir over ssh2
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL:
Whiteboard: MGA6TOO MGA5-32-OK MGA6-64-OK
Keywords: advisory, has_procedure, validated_update
Depends on:
Blocks:
 
Reported: 2017-01-30 14:58 CET by Dieter Schütze
Modified: 2017-11-20 22:18 CET (History)
6 users (show)

See Also:
Source RPM: php-ssh2-0.12-9.mga5.src.rpm
CVE:
Status comment:


Attachments

Description Dieter Schütze 2017-01-30 14:58:42 CET
same as descripted here:
https://bugs.php.net/bug.php?id=73524

there is a patch available:
https://github.com/php/pecl-networking-ssh2/commit/093906ec1c065e86ad1cd4dabbc89b1ccae11938
Comment 1 Dieter Schütze 2017-01-30 15:11:50 CET
For users with the same trouble
There is a workaround from "perske at munster dot de"

_______________________________________________________

intval() has to be used on every directory access functions as:

fopen("ssh2.sftp://".intval($sftp)."/./", 'r');
scandir('ssh2.sftp://' . intval($sftp) . "/dir/");

Also worth mentioning that setting $sftp = intval($sftp) in advance won't work.

________________________________________________________

This works fine here.
Comment 2 Marja Van Waes 2017-01-30 23:51:53 CET
Assigning to all packagers collectively, since there is no registered maintainer for this package.

CC: (none) => marja11
Assignee: bugsquad => pkg-bugs

Marc Krämer 2017-11-14 23:53:48 CET

Assignee: pkg-bugs => mageia
CC: (none) => mageia

Comment 3 Marc Krämer 2017-11-14 23:58:43 CET
patched & tested the given diff for mga6.
before patch, the following script segfaulted:

<?php
$ssh2 = ssh2_connect('localhost', 22);
if (!ssh2_auth_password($ssh2, 'USER','PASSWORD')) {
  echo("auth error\n");
  exit();
}
$sftp = ssh2_sftp($ssh2);
$te='ssh2.sftp://'.$sftp.'/tmp/';
echo('te='.$te."\n");

echo("before scandir!\n");
$files = scandir($te,SCANDIR_SORT_ASCENDING );
echo("after scandir!\n");

if ($files===false)
  echo("scandir error\n");
else
  echo("scandir success\n");

CC: (none) => lists.jjorge
Status: NEW => ASSIGNED

Comment 4 Marc Krämer 2017-11-15 16:12:33 CET
I have uploaded a patched package for Mageia 5 + 6.

You can test this by using the following script (changing Host, Port, Username, Password):
<?php
$ssh2 = ssh2_connect('localhost', 22);
if (!ssh2_auth_password($ssh2, 'USER','PASSWORD')) {
  echo("auth error\n");
  exit();
}
$sftp = ssh2_sftp($ssh2);
$te='ssh2.sftp://'.$sftp.'/tmp/';
echo('te='.$te."\n");

echo("before scandir!\n");
$files = scandir($te,SCANDIR_SORT_ASCENDING );
echo("after scandir!\n");

if ($files===false)
  echo("scandir error\n");
else
  echo("scandir success\n");

Suggested advisory:
========================

Updated php-ssh2 packages fix segmentation fault on ressource access:

References:
https://bugs.php.net/bug.php?id=73524
https://github.com/php/pecl-networking-ssh2/commit/093906ec1c065e86ad1cd4dabbc89b1ccae11938
========================

Updated packages in core/updates_testing:
========================
php-ssh2-0.12-9.1.mga5.x86_64.rpm
php-ssh2-0.12-10.1.mga6.x86_64.rpm




Source RPMs: 
php-ssh2-0.12-9.1.mga5.src.rpm
php-ssh2-0.12-10.1.mga6.src.rpm

Whiteboard: (none) => MGA6TOO

Marc Krämer 2017-11-15 16:13:12 CET

Assignee: mageia => qa-bugs

Comment 5 Herman Viaene 2017-11-16 14:29:43 CET
MGA5-32 on Asus A6000VM Xfce
No installation issues
Used script from Comment 4 to localhost at CLI:
$ php phpsshtest.py 
te=ssh2.sftp://Resource id #5/tmp/
before scandir!
after scandir!
scandir success

Seems OK.

Whiteboard: MGA6TOO => MGA6TOO MGA5-32-OK
CC: (none) => herman.viaene

Lewis Smith 2017-11-19 12:03:27 CET

Keywords: (none) => advisory, has_procedure

Comment 6 Lewis Smith 2017-11-20 15:37:43 CET
Testing M6/64

BEFORE update: php-ssh2-0.12-10.mga6
Used the given script (for which many thanks to Marc; it made testing this update easy & sure) with own username & password; but it failed initially:
$ php tmp/phpssh2.php 
PHP Warning:  ssh2_connect(): Unable to connect to localhost on port 22 in /home/lewis/tmp/phpssh2.php on line 2
PHP Warning:  ssh2_connect(): Unable to connect to localhost in /home/lewis/tmp/phpssh2.php on line 2
PHP Warning:  ssh2_auth_password() expects parameter 1 to be resource, boolean given in /home/lewis/tmp/phpssh2.php on line 3
auth error
This was resolved by installing & starting openssh-server:

$ php tmp/phpssh2.php 
te=ssh2.sftp://Resource id #5/tmp/
before scandir!
Segmentation fault (core dumped)
[as predicted]

AFTER update: php-ssh2-0.12-10.1.mga6
$ php tmp/phpssh2.php 
te=ssh2.sftp://Resource id #5/tmp/
before scandir!
after scandir!
scandir success

So this update is fine. Validating as it has a good M5/32 test.

Whiteboard: MGA6TOO MGA5-32-OK => MGA6TOO MGA5-32-OK MGA6-64-OK
Keywords: (none) => validated_update
CC: (none) => lewyssmith, sysadmin-bugs

Comment 7 Mageia Robot 2017-11-20 22:18:47 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGAA-2017-0114.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.