1
0
mirror of https://github.com/php/php-src.git synced 2026-04-11 10:03:18 +02:00
Commit Graph

12059 Commits

Author SHA1 Message Date
Christoph M. Becker
5f4e034e57 [ci skip] Fix typo (Okt → Oct) 2021-10-26 16:26:23 +02:00
Jakub Zelenka
f47798e685 Fix bug #81026 (PHP-FPM oob R/W in root process leading to priv escalation)
The main change is to store scoreboard procs directly to the variable sized
array rather than indirectly through the pointer.

Signed-off-by: Stanislav Malyshev <stas@php.net>
(cherry picked from commit cb2021e5f6)

Closes GH-7614.
2021-10-26 16:03:33 +02:00
Christoph M. Becker
f2f40b1cf7 7.3.32 is next 2021-09-21 13:18:08 +02:00
Christoph M. Becker
96a5b4e43a [ci skip] Add missing CVE to NEWS 2021-09-21 13:02:42 +02:00
Christoph M. Becker
bb84722364 [ci skip] Add missing NEWS entry 2021-09-21 11:43:36 +02:00
Christoph M. Becker
521bd7ce15 7.3.31 is next 2021-08-24 12:47:21 +02:00
Stanislav Malyshev
b2008ab97d Update NEWS 2021-08-23 23:28:27 -07:00
Christoph M. Becker
53ea910d17 7.3.30 is next 2021-06-29 14:14:53 +02:00
Christoph M. Becker
f5cba2d491 [ci skip] Fix NEWS format 2021-06-29 10:28:35 +02:00
Stanislav Malyshev
c68a687566 Update NEWS 2021-06-20 22:20:38 -07:00
Christoph M. Becker
98c8ad9218 7.3.29 is next 2021-04-27 16:55:20 +02:00
Christoph M. Becker
096f148c61 Fix ./makedist wrt. to GH move
We can no longer export from git.php.net, and apparently exporting from
Github is not supported.  We apply a quick fix to export from the local
clone by default, still leaving an option to export from some other
repo.  This is, unfortunately, a minor BC break in a security release.

Co-authored-by: Remi Collet <remi@php.net>

Closes GH-6919.
2021-04-27 15:48:58 +02:00
Christoph M. Becker
60a68a45c3 Add missing NEWS entry for #80710 2021-04-27 13:38:39 +02:00
Christoph M. Becker
039ca4e219 7.3.28 is next 2021-02-02 17:01:55 +01:00
Stanislav Malyshev
3c939e3f69 Fix bug #80672 - Null Dereference in SoapClient 2021-01-31 21:15:23 -08:00
Stanislav Malyshev
65d7ade684 [ci skip] Fix order 2021-01-04 01:45:15 -08:00
Stanislav Malyshev
8967e66559 [ci skip] Unpdate NEWS 2021-01-04 01:43:45 -08:00
Christoph M. Becker
40d9e3ab86 7.3.27 is next 2020-12-15 11:28:01 +01:00
Nikita Popov
d6fcaf5da4 Fixed bug #80457
On x32 sizeof(size_t) != sizeof(zend_long), so we need to be
careful with sign extension here.

Patch by bruno dot premont at restena dot lu.
2020-12-02 11:26:10 +01:00
Christoph M. Becker
b5ce6df0da 7.3.26 is next 2020-11-10 11:08:16 +01:00
Alexander M. Turek
8eaaabdd58 Fixed bug #80310: Support for icu4c 68.1.
On stable versions, bring back the TRUE/FALSE defines by defining
_U_DEFINE_TRUE_AND_FALSE.

Closes GH-6397.
2020-11-09 14:31:29 +01:00
Christoph M. Becker
2cab085bb3 Fix #80266: parse_url silently drops port number 0
As of commit 81b2f3e[1], `parse_url()` accepts URLs with a zero port,
but does not report that port, what is wrong in hindsight.

Since the port number is stored as `unsigned short` there is no way to
distinguish between port zero and no port.  For BC reasons, we thus
introduce `parse_url_ex2()` which accepts an output parameter that
allows that distinction, and use the new function to fix the behavior.

The introduction of `parse_url_ex2()` has been suggested by Nikita.

[1] <http://git.php.net/?p=php-src.git;a=commit;h=81b2f3e5d9fcdffd87a4fcd12bd8c708a97091e1>

Closes GH-6399.
2020-11-04 14:53:19 +01:00
Christoph M. Becker
9690ded288 Fix #70461: disable md5 code when it is not supported in net-snmp
Patch contributed by Alexander Bergmann.

Closes GH-6389.
2020-11-02 11:36:26 +01:00
Christoph M. Becker
c21e901ba7 Fix #44618: Fetching may rely on uninitialized data
Unless `SQLGetData()` returns `SQL_SUCCESS` or `SQL_SUCCESS_WITH_INFO`,
the `StrLen_or_IndPtr` output argument is not guaranteed to be properly
set.  Thus we handle retrieval failure other than `SQL_ERROR` by
yielding `false` for those column values and raising a warning.

Closes GH-6281.
2020-10-29 11:59:12 +01:00
Christoph M. Becker
6d2bc72530 Fix #80268: loadHTML() truncates at NUL bytes
libxml2 has no particular issues parsing HTML strings with NUL bytes;
these just cause truncation of the current text content, but parsing
continues generally.  Since `::loadHTMLFile()` already supports NUL
bytes, `::loadHTML()` should as well.

Note that this is different from XML, which does not allow any NUL
bytes.

Closes GH-6368.
2020-10-26 13:08:05 +01:00
Christoph M. Becker
7424bfc7ac Fix #62474: com_event_sink crashes on certain arguments
We have to make sure that the variant is of type `VT_DISPATCH` before
we access it as such.

Closes GH-6372.
2020-10-26 11:48:57 +01:00
Christoph M. Becker
848e24f24d Fix #80258: Windows Deduplication Enabled, randon permission errors
A recent bug fix regarding symlinks claimed:

> After resolving reparse points, the path still may be a reparse
> point; in that case we have to resolve that reparse point as well.

While that is basically correct, some reparse points may point to
inaccessible system folders (e.g. `IO_REPARSE_TAG_DEDUP` points to
"\System Volume Information").  Since we don't know details about
arbitrary reparse points, and are mainly interested in nested symlinks,
we take a step back, and only resolve `IO_REPARSE_TAG_SYMLINK` for now.

Close GH-6354.
2020-10-26 11:21:14 +01:00
Christoph M. Becker
2be27074b6 Fix #80280: ADD_EXTENSION_DEP() fails for ext/standard and ext/date
`ADD_EXTENSION_DEP()` relies on the `PHP_<extname>` config variables to
be set to `"yes"`, and since the standard and date extension are always
enabled, we define the respective variables uncoditionally.

Closes GH-6383.
2020-10-26 11:03:05 +01:00
George Peter Banyard
12a09183b3 Fix bug 76618
Apply patch which was attached to the bug in July 2018
2020-10-22 17:01:48 +01:00
Christoph M. Becker
315b95b065 Fix #80242: imap_mail_compose() segfaults for multipart with rfc822
libc-client expects `TYPEMESSAGE` with an explicit subtype of `RFC822`
to have a `nested.msg` (otherwise there will be a segfault during
free), but not to have any `contents.text.data` (this will leak
otherwise).

Closes GH-6345.
2020-10-20 18:58:45 +02:00
Christoph M. Becker
7f3bdda29b Properly fix #80220
The original fix for that bug[1] broke the formerly working composition
of message/rfc822 messages, which results in a segfault when freeing
the message body now.  While `imap_mail_compose()` does not really
support composition of meaningful message/rfc822 messages (although
libc-client appears to support that), some code may still use this to
compose partial messages, and using string manipulation to create the
final message.

The point is that libc-client expects `TYPEMESSAGE` with an explicit
subtype of `RFC822` to have a `nested.msg` (otherwise there will be a
segfault during free), but not to have any `contents.text.data` (this
will leak otherwise).

[1] <http://git.php.net/?p=php-src.git;a=commit;h=0d022ddf03c5fabaaa22e486d1e4a367ed9170a7>

Closes GH-6343.
2020-10-20 13:32:53 +02:00
Christoph M. Becker
5941b30bb8 Fix #80239: imap_rfc822_write_address() leaks memory
We have to free the address when we're finished with it.
2020-10-15 12:54:53 +02:00
Christoph M. Becker
db8bf0a9e0 Fix #64076: imap_sort() does not return FALSE on failure
If unsupported `$search_criteria` are passed to `imap_sort()`, the
function returns an empty array, but there is also an error on the
libc-client error stack ("Unknown search criterion: UNSUPPORTED
(errflg=2)").  If, on the other hand, unsupported `$criteria` or
unsupported `$flags` are passed, the function returns `false`.  We
solve this inconsistency by returning `false` for unsupported
`$search_criteria` as well.

Closes GH-6332.
2020-10-13 19:37:05 +02:00
Christoph M. Becker
2d01a89ad1 7.3.25 is next 2020-10-13 09:52:46 +02:00
Christoph M. Becker
8488c34fc6 Fix #80226: imap_sort() leaks sortpgm memory
We need to free what we have allocated.

Closes GH-6327.
2020-10-12 23:16:31 +02:00
Christoph M. Becker
73e43b6e19 Fix #80216: imap_mail_compose() does not validate types/encodings
We need to check whether the given `type`s and `encoding`s are within
bounds to avoid segfaults and out-of-bound reads.

Closes GH-6323.
2020-10-12 16:27:49 +02:00
Christoph M. Becker
c1962e900a Fix #80223: imap_mail_compose() leaks envelope on malformed bodies
We have to clean up even on failure.

Closes GH-6322.
2020-10-12 15:08:30 +02:00
Christoph M. Becker
0d022ddf03 Fix #80220: imap_mail_compose() may leak memory
Unless `topbod` is of `TYPEMULTIPART`, `mail_free_body()` does not free
the `nested.part`; while we could do this ourselves, instead we just
ignore additional bodies in this case, i.e. we don't attach them in the
first place.

Closes GH-6321.
2020-10-12 13:31:30 +02:00
Christoph M. Becker
62a2387a8d Fix #80215: imap_mail_compose() may modify by-val parameters
We separate the input arrays and all sub-arrays to avoid modification
of the passed parameters.

This should be rewritten to use `zend_string`s for the "master" branch.

Closes GH-6316.
2020-10-10 23:25:06 +02:00
Christoph M. Becker
8bee0fbd37 Fix #80213: imap_mail_compose() segfaults on certain $bodies
We have to cater to non-associative arrays where the key may be `NULL`;
we just skip these elements.

Closes GH-6315.
2020-10-10 19:17:13 +02:00
Christoph M. Becker
e68acd031d Fix #77040: tidyNode::isHtml() is completely broken
The documentation of `tidyNode::isHtml()` states that this method
"checks if a node is part of a HTML document".  That is, of course,
nonsense, since a tidyNode is "an HTML node in an HTML file, as
detected by tidy."

What this method is actually supposed to do is to check whether a node
is an element (unless it is the root element).  This has been broken by
commit d8eeb8e[1], which assumed that `enum TidyNodeType` would
represent flags of a bitmask, what it does not.

[1] <http://git.php.net/?p=php-src.git;a=commit;h=d8eeb8e28673236bca3f066ded75037a5bdf6378>

Closes GH-6290.
2020-10-07 17:43:56 +02:00
Christoph M. Becker
e857dfa7cc Fix #80185: jdtounix() fails after 2037
There is no such thing as the "end of the unix epoch", and if it was,
it would certainly not be 2037-10-11T02:00:00.  There is, however,
potential integer overflow which we need to avoid.

Closes GH-6288.
2020-10-07 13:23:50 +02:00
Christoph M. Becker
69ba81d183 Fix #46050: odbc_next_result corrupts prepared resource
When resetting the result's values, we also have to reset its numcols.
2020-10-05 17:46:37 +02:00
Matteo Beccati
1666cfcca0 [ci skip] moved soap fix to 7.3.23
When committing I didn't notice that version had been just bumped
2020-10-02 09:32:52 +02:00
Stanislav Malyshev
ae95d06f68 [ci skip] Add 7.3.23 security fixes to NEWS 2020-09-29 10:09:33 -07:00
Christoph M. Becker
bf5f07cc8b Fix #80152: odbc_execute() moves internal pointer of $params
As least intrusive fix, we separate the passed array argument.

Closes GH-6219.
2020-09-29 11:34:48 +02:00
Christoph M. Becker
df5efa2fcd Fix #80150: Failure to fetch error message
In case of statement related errors, we need to pass the respective
statement handle to `SQLError()`.

Closes GH-6217.
2020-09-29 11:02:51 +02:00
Christoph M. Becker
6acfb79276 Fix #67465: NULL Pointer dereference in odbc_handle_preparer
We have to initialize `stmt->driver_data` before we use it.

Closes GH-6225.
2020-09-28 22:57:01 +02:00
Christoph M. Becker
a49555a9e1 Fix #80147: BINARY strings may not be properly zero-terminated
We have to manually ensure that all strings fetched from a data source
are zero-terminated.

Closes GH-6213.
2020-09-25 13:51:18 +02:00
Christoph M. Becker
610e7d2c77 Fix #78470: odbc_specialcolumns() no longer accepts $nullable
It is mandatory to pass either `SQL_NO_NULLS` or `SQL_NULLABLE` as
tenth parameter to `SQLSpecialColumns()`; otherwise the function call
fails.  Therefore the user must be allowed to pass the desired value
as parameter to `odbc_specialcolumns()` again.

Closes GH-6200.
2020-09-24 12:15:59 +02:00