Thanks John, your analysis looks correct there; sorry about that.  But note that we do not build the oci8 extension in the Red Hat Enterprise Linux binary RPMs, so we can not support this code as such.

We appreciate the feedback and look to use reports such as this to guide our efforts at improving our products. That being said, this bug tracking system is not a mechanism for requesting support, and we are not able to guarantee the timeliness or suitability of a resolution.

If this issue is critical or in any way time sensitive, please raise a ticket
through your regular Red Hat support channels to make certain  it receives the
proper attention and prioritization to assure a timely resolution.

For information on how to contact the Red Hat production support team, please
visit: https://www.redhat.com/support/process/production/#howto

Thanks Joe.  It is not critical or time-sensitive on my part, as I have rectified the patch for my purposes.  I do appreciate OCI is not a supported extension in Red Hat EL; I raised the bug in case Red Hat wants to rectify the faulty CVE patch when the package is next updated due to a 'real' bug.

Created attachment 861145 [details]
Patch to the CVE-2006-7243 patch

Patch to perform the suggested changes. Only changes the part of php-5.3.3-CVE-2006-7243.patch regarding ext/oci8/oci8_interface.c, according to previous comments in this bug. Tested on RHEL6.5 x86_64 with Oracle 11gR2 Instant Client Basic 11.2.0.4.0 x86_64.

Comment on attachment 861145 [details]
Patch to the CVE-2006-7243 patch

Incorrect whitespace.

Created attachment 861168 [details]
Patch to the CVE-2006-7243 patch

Patch to perform the suggested changes. Only changes the part of php-5.3.3-CVE-2006-7243.patch regarding ext/oci8/oci8_interface.c, according to previous comments in this bug. Tested on RHEL6.5 x86_64 with Oracle 11gR2 Instant Client Basic 11.2.0.4.0 x86_64.

Fixed whitespace in patch (sorry about that).

I understand that OCI8 is not supported by Red Hat and that it probably never will be due to the Oracle [Instant]Client dependency, but by applying the attached patch to your distributed version of php-5.3.3-CVE-2006-7243.patch it would be a big convenience to your users that do include OCI8 in a RHEL6 rebuild of PHP since it now compiles cleanly.

There is another problem with the patch in the odbc extension.  The change applied to RHEL-6 php packages is identical to what was applied upstream:

http://git.php.net/?p=php-src.git;a=commitdiff;h=ce96fd6#patch10

Added check does:

  if (strlen(tmp) != Z_STRLEN_PP(tmp)) {

while it should be:

  if (strlen(Z_STRVAL_PP(tmp)) != Z_STRLEN_PP(tmp)) {

Leading to a compile warning:

/builddir/build/BUILD/php-5.3.3/ext/odbc/php_odbc.c: In function 'zif_odbc_execute':
/builddir/build/BUILD/php-5.3.3/ext/odbc/php_odbc.c:1303: warning: passing argument 1 of 'strlen' from incompatible pointer type
/usr/include/string.h:399: note: expected 'const char *' but argument is of type 'struct zval **'

This issue was never fixed upstream in 5.3 branch.  5.4 and later has different check, using CHECK_ZVAL_NULL_PATH():

http://git.php.net/?p=php-src.git;a=commitdiff;h=32b5f8a#patch19

(In reply to Tomas Hoger from comment #7)
> There is another problem with the patch in the odbc extension.  The change
> applied to RHEL-6 php packages is identical to what was applied upstream:
> 
> http://git.php.net/?p=php-src.git;a=commitdiff;h=ce96fd6#patch10
> 
> Added check does:
> 
>   if (strlen(tmp) != Z_STRLEN_PP(tmp)) {
> 
> while it should be:
> 
>   if (strlen(Z_STRVAL_PP(tmp)) != Z_STRLEN_PP(tmp)) {
> 


Fix also applied upstream
http://git.php.net/?p=php-src.git;a=commit;h=adc070ca995384e4de83fa3446c6dfcf946a3f50

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1465.html