1
0
mirror of https://github.com/php/php-src.git synced 2026-04-17 04:51:03 +02:00
Commit Graph

4789 Commits

Author SHA1 Message Date
Bob Weinand
3d4e954518 Merge branch 'PHP-7.0' into PHP-7.1 2017-03-14 22:17:10 +01:00
Bob Weinand
8be63ce0e2 Fix stream context changes leaking into copies of previous context 2017-03-14 22:15:41 +01:00
Sara Golemon
1a19b97ac3 Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Detect invalid port in xp_socket parse ip address
2017-03-07 12:11:22 -08:00
Sara Golemon
bab0b99f37 Detect invalid port in xp_socket parse ip address
For historical reasons, fsockopen() accepts the port and hostname
separately: fsockopen('127.0.0.1', 80)

However, with the introdcution of stream transports in PHP 4.3,
it became possible to include the port in the hostname specifier:

fsockopen('127.0.0.1:80')
Or more formally: fsockopen('tcp://127.0.0.1:80')

Confusing results when these two forms are combined, however.
fsockopen('127.0.0.1:80', 443) results in fsockopen() attempting
to connect to '127.0.0.1:80:443' which any reasonable stack would
consider invalid.

Unfortunately, PHP parses the address looking for the first colon
(with special handling for IPv6, don't worry) and calls atoi()
from there.  atoi() in turn, simply stops parsing at the first
non-numeric character and returns the value so far.

The end result is that the explicitly supplied port is treated
as ignored garbage, rather than producing an error.

This diff replaces atoi() with strtol() and inspects the
stop character.  If additional "garbage" of any kind is found,
it fails and returns an error.
2017-03-07 12:10:53 -08:00
Joe Watkins
55bcef1751 prepare 7.1.4 2017-02-28 09:08:05 +00:00
Anatol Belski
21a05b0418 prepare next 2017-02-28 09:46:11 +01:00
Nikita Popov
846bea7f05 Merge branch 'PHP-7.0' into PHP-7.1 2017-02-25 12:57:53 +01:00
Nikita Popov
bbfa1b6419 Improve fix for bug #73807
At least on some architectures memmove() on FreeBSD does not
short-curcuit if src==dst. Check for it explicitly to avoid
quadratic copying.
2017-02-25 12:55:14 +01:00
Anatol Belski
2a61e5495a Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Fixed bug #74090 stream_get_contents maxlength>-1 returns empty string
2017-02-15 14:49:58 +01:00
Anatol Belski
89a5bd6750 Fixed bug #74090 stream_get_contents maxlength>-1 returns empty string 2017-02-15 11:22:47 +01:00
Xinchen Hui
6649aebb89 Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Fixed #73496 (Invalid memory access in zend_inline_hash_func)
2017-02-12 18:56:11 +08:00
Xinchen Hui
ee25eb0eae Fixed #73496 (Invalid memory access in zend_inline_hash_func)
no test script is added because it requre too much memory
2017-02-12 18:55:19 +08:00
Nikita Popov
6d5ea20e0b Merge branch 'PHP-7.0' into PHP-7.1 2017-02-12 00:06:35 +01:00
Denis Yeldandi
9814be4bc2 Fixed bug #69860 2017-02-12 00:06:04 +01:00
Nikita Popov
d2658287fa Merge branch 'PHP-7.0' into PHP-7.1 2017-02-02 18:07:05 +01:00
Nikita Popov
a15bffd105 Fix bug #73807 2017-02-02 18:06:15 +01:00
Joe Watkins
c34bf0015b bump versions 2017-01-31 12:48:05 +00:00
Anatol Belski
536b3ca1e1 bump versions for next in dev 2017-01-31 11:18:23 +01:00
Sara Golemon
005ba2001d Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Fix open_basedir check for glob:// opendir wrapper
2017-01-09 16:08:08 -08:00
Sara Golemon
69fbe3a9ad Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Fix open_basedir check for glob:// opendir wrapper
2017-01-09 16:07:33 -08:00
Sara Golemon
7e49e8e797 Fix open_basedir check for glob:// opendir wrapper
php_check_open_basedir() expects a local filesystem path,
but we're handing it a `glob://...` URI instead.

Move the check to after the path trim so that we're checking
a meaningful pathspec.
2017-01-09 11:02:50 -08:00
Nikita Popov
bb2ab75555 Merge branch 'PHP-7.0' into PHP-7.1 2017-01-07 22:54:16 +01:00
Nikita Popov
a46bbdda2e Fixed bug #67583
As fcgi_request is an opaque struct as of PHP 7, expose a new API
function fcgi_end() which does fcgi_flush() with end=1 and checks/
sets the ->ended flag.
2017-01-07 22:53:28 +01:00
Nikita Popov
f346bd6ee6 Rename fcgi_request.closed to .ended
"closed" refers to whether FCGI_END_REQUEST has been sent, while
the "close" operation does something entirely different. It gets
extra confusing when fcgi_is_closed() does not actually return
fcgi_request.closed...
2017-01-07 22:45:19 +01:00
Anatol Belski
bba09d56e5 Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  add 'e' flag for fopen() to enable CLOEXEC
2017-01-07 12:36:09 +01:00
Evgeniy Makhrov
d0279242ce add 'e' flag for fopen() to enable CLOEXEC 2017-01-07 12:10:51 +01:00
Joe Watkins
d5a1c5a96b Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Increase realpath_cache_size default value
  add UPGRADING note for realpath_cache_size
2017-01-06 05:31:29 +00:00
Markus Staab
782b84c6d5 updated default per proposal
TODO: adjust php.ini defaults
2017-01-06 05:25:08 +00:00
Markus Staab
66b698c3cf Increase realpath_cache_size default value 2017-01-06 05:25:04 +00:00
Ferenc Kovacs
3b14d7b84b 5.6.31 is next 2017-01-06 01:43:11 +01:00
Joe Watkins
4cce1e9a94 wrong version 2017-01-05 17:00:40 +00:00
Joe Watkins
e627aa9841 bump version after release 2017-01-05 16:50:52 +00:00
Anatol Belski
997d902762 move dev to next 2017-01-05 01:12:18 +01:00
Sammy Kaye Powers
dac6c639bb Update copyright headers to 2017 2017-01-04 11:23:42 -06:00
Sammy Kaye Powers
478f119ab9 Update copyright headers to 2017 2017-01-04 11:14:55 -06:00
Nikita Popov
a5027d43dd Merge branch 'PHP-7.0' into PHP-7.1 2017-01-01 21:09:27 +01:00
Nikita Popov
935b5cb11e Flush stderr on win32 in cli_log_message
This allows us to unfork a bunch of tests for Windows.
2017-01-01 21:09:02 +01:00
Anatol Belski
e33ec61f9c Care about intput and output encoding, as per default encoding RFC
If PHP CLI is used with programs with no Unicode support, the default
PHP console codepage might cause backward incompatible behaviors. This
is solved with this patch by separating the handling of I/O codepage.
As per https://wiki.php.net/rfc/default_encoding input_encodnig and
output_encoding are centralized INI settings, so they're used for the
purpose of adjusting the codepage. This gives user the ability to use
UTF-8 internally, while letting the system API to convert the output
to a compatible codepage. This also might solve the font issues on
systems without good true type support.

Note, that there no change to the default behavior - if input and
output encoding are not set, which is the default case, the default
charset applies to both console input and output. The patch is just
a compilment to the backward compatibility, not more and not less.
2016-12-14 02:51:29 +01:00
Davey Shafik
2f5090168f Bump versions and NEWS for 7.1.1-dev 2016-12-02 02:24:54 -08:00
Ferenc Kovacs
e715dafae0 5.6.30 will be next 2016-11-24 01:54:23 +01:00
Anatol Belski
df902a7c28 move dev to next 2016-11-22 11:49:09 +01:00
Ferenc Kovacs
9b3a1e00ab 5.6.29 will be next 2016-10-27 23:10:59 +02:00
Anatol Belski
277e829f10 move dev to 7.0.14 2016-10-25 10:29:51 +02:00
Stanislav Malyshev
f8be3ede4f Fix bug #73189 - Memcpy negative size parameter php_resolve_path
(cherry picked from commit da7e89cde8)
(cherry picked from commit c4c2cce37d)
2016-10-14 01:50:22 +02:00
Sara Golemon
25d4943b44 Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.

Catch the bailout, clear the variable, then continue bailing.

Closes https://bugs.php.net/bug.php?id=73188

(cherry picked from commit 9f86cdaf7f)
2016-10-14 01:34:51 +02:00
Stanislav Malyshev
c4c2cce37d Fix bug #73189 - Memcpy negative size parameter php_resolve_path
(cherry picked from commit da7e89cde8)
2016-10-12 21:31:37 +02:00
Sara Golemon
43ccf23d70 Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.

Catch the bailout, clear the variable, then continue bailing.

Closes https://bugs.php.net/bug.php?id=73188
2016-10-11 21:55:01 -07:00
Sara Golemon
4d11a8eedf Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.

Catch the bailout, clear the variable, then continue bailing.

Closes https://bugs.php.net/bug.php?id=73188
2016-10-11 21:44:14 -07:00
Stanislav Malyshev
689a9b8def Merge branch 'PHP-5.6.27' into PHP-5.6
* PHP-5.6.27:
  Fix tests
  fix tsrm
  Fix bug #73284 - heap overflow in php_ereg_replace function
  Fix bug #73276 - crash in openssl_random_pseudo_bytes function
  Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML()
  fix bug #73275 - crash in openssl_encrypt function
  Fix for #73240 - Write out of bounds at number_format
  Bug #73218: add mitigation for ICU int overflow
  Add more locale length checks, due to ICU bugs.
  Fix bug #73208 - another missing length check
  Fix bug #73190: memcpy negative parameter _bc_new_num_ex
  Fix bug #73189 - Memcpy negative size parameter php_resolve_path
  Fixed bug #73174 - heap overflow in php_pcre_replace_impl
  Fix bug #73150: missing NULL check in dom_document_save_html
  Fix bug #73147: Use After Free in PHP7 unserialize()
  Fix bug #73082
  Fix bug #73073 - CachingIterator null dereference when convert to string
2016-10-11 16:26:35 -07:00
Anatol Belski
bc5efe501e Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  fix datatype
2016-10-06 11:03:09 +02:00