* PHP-5.4.45:
add test
Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage
Fix bug #70172 - Use After Free Vulnerability in unserialize()
Fix bug #70388 - SOAP serialize_function_call() type confusion
Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories
Improve fix for #70385
Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)
Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes)
Conflicts:
ext/pcre/php_pcre.c
ext/standard/var_unserializer.c
* PHP-5.3:
zip windows fixes
fixed bc break related to #57905
fixed a bit overlooked from the last libzip port
brought the fix for #47667 back
fixed zip entry freeing
rechecked the merged libzip, took also the indents from the original to avoid confusion next time
fixed a double freeing crash
fixed header include
initial libzip upgrade patch to 0.10.1
- BFN
Conflicts:
NEWS
#It is unclear if url_stat handlers should emit a warning in case
#PHP_STREAM_URL_STAT_QUIET is not specified and the resource does
#not exist. Most url_stat handlers never emit messages; the plain
#one does only so in the extraordinary event of an open_basedir
#restriction.
#But in case, php_stat uses PHP_STREAM_URL_STAT_QUIET for the
#FS_EXISTS, which suggests that mere checks on file existence are
#supposed to use this flag (arguably).
#The downside is that important diagnostic messages might be
#omitted.
#It is unclear if url_stat handlers should emit a warning in case
#PHP_STREAM_URL_STAT_QUIET is not specified and the resource does
#not exist. Most url_stat handlers never emit messages; the plain
#one does only so in the extraordinary event of an open_basedir
#restriction.
#But in case, php_stat uses PHP_STREAM_URL_STAT_QUIET for the
#FS_EXISTS, which suggests that mere checks on file existence are
#supposed to use this flag (arguably).
#The downside is that important diagnostic messages might be
#omitted.
Stanislav Malyshev