Incomplete fix for CVE-2022-31625

[Rodrigo Figueiredo Zaiden]

The upstream fix for CVE-2022-31625 is the following patch: https://github.com/php/php-src/commit/55f6895f4b4c677272fd4ee1113acdbd99c4b5ab

Upstream applied it for php7.4, php8.0 and php8.1, all of them have a pretty similar code for 'ext/pgsql/pgsql.c'.

In php7.2, the code is slight different and I believe the fix suggested in the patch should be applied in some other methods.
Mainly, the fix is to apply the following where we have calls to safe_emalloc() for params:

  - _php_pgsql_free_params(params, num_params);
  + _php_pgsql_free_params(params, i);

and we have this code for the following methods in php7.2:
  pg_query_params
  pg_execute
  pg_send_query_params
  pg_send_execute

the version '7.2.24-0ubuntu0.18.04.12' in bionic is only including the fix in 'pg_query_params'.

as suggested in the upstream bug: https://bugs.php.net/bug.php?id=81720:
 "There are other functions where you use basically the same code (if cannot convert to string,
  then free all params) so it might be worth a look."

I think we should be including in the other methods listed above for php7.2

[Marc Deslauriers (mdeslaur)]

ACK, we should fix the other instances of this in 7.2 and earlier. Nice catch!

[Launchpad Janitor (janitor)]

This bug was fixed in the package php7.2 - 7.2.24-0ubuntu0.18.04.13

---------------
php7.2 (7.2.24-0ubuntu0.18.04.13) bionic-security; urgency=medium

  * SECURITY REGRESSION: Incomplete fix for CVE-2022-31625 (LP: #1980550)
    - debian/patches/CVE-2022-31625-2.patch: include the fix for not
      freeing parameters which haven't initialized yet in
      ext/pgsql/pgsql.c in other methods.

 -- Rodrigo Figueiredo Zaiden <email address hidden> Wed, 06 Jul 2022 09:23:22 -0300