1
0
mirror of https://github.com/php/php-src.git synced 2026-04-23 16:08:35 +02:00
Commit Graph

35935 Commits

Author SHA1 Message Date
Stanislav Malyshev 29e2a204fb Fixed bug #73174 - heap overflow in php_pcre_replace_impl 2016-09-28 22:29:59 -07:00
Stanislav Malyshev 1c0e9126fb Fix bug #73150: missing NULL check in dom_document_save_html 2016-09-25 21:25:01 -07:00
Stanislav Malyshev 0e6fe3a4c9 Fix bug #73147: Use After Free in PHP7 unserialize() 2016-09-25 19:53:59 -07:00
Stanislav Malyshev e1709b7e58 Fix bug #73082 2016-09-25 16:07:14 -07:00
Stanislav Malyshev 33a8af0510 Fix bug #73073 - CachingIterator null dereference when convert to string 2016-09-20 22:59:12 -07:00
Christoph M. Becker fc2cadca2d Merge branch 'pull-request/1845' into PHP-5.6 2016-09-20 01:05:57 +02:00
Julien Pauli 1ed4b13fb6 Do not wrap user exception in case of custom JSON serialization 2016-09-19 16:06:12 +02:00
Christoph M. Becker 6682673070 Fix #73100: session_destroy null dereference in ps_files_path_create 2016-09-16 23:41:10 +02:00
Christoph M. Becker 46df064261 Fix #73003: Integer Overflow in gdImageWebpCtx of gd_webp.c
We add the missing integer overflow check to avoid potential buffer overflows.
2016-09-16 11:37:18 +02:00
Remi Collet 3c117d4136 fix test (32bits) 2016-09-15 15:32:39 +02:00
Remi Collet 55237fe153 fix ZTS build 2016-09-15 13:27:20 +02:00
Christoph M. Becker 7bfb7b62b1 Fix and reactivate regression test for bug #50194
Apparently, different FreeType versions render the string differently, so
we have to cater to these slight differences. Unfortunately, the testing
framework doesn't yet offer a clean API for this, so we work around the
limitations by parsing and checking the output of test_image_equals_file().
2016-09-15 00:46:00 +02:00
Christoph M. Becker 36df4f8419 Skip ext/gd/tests/bug50194.phpt for now
There are apparently issues with the font rendering with different freetype
version; I'll have a look at this issue ASAP.
2016-09-14 20:00:30 +02:00
Christoph M. Becker 09eb6ed35e Fix #50194: imagettftext broken on transparent background w/o alphablending
We must not draw the background pixels of the character glyphs, what has
already been fixed in GD 2.0.26.
2016-09-14 15:47:32 +02:00
Jakub Zelenka 05baa92727 Fix bug #73072 (Invalid path SNI_server_certs causes segfault) 2016-09-13 18:15:34 +01:00
Anatol Belski 248f8c3a91 add test for bug #73068 2016-09-13 15:28:28 +02:00
Anatol Belski fc31d6fed4 fix test portability 2016-09-13 12:00:29 +02:00
Stanislav Malyshev 28f80baf3c Fix bug #72293 - Heap overflow in mysqlnd related to BIT fields 2016-09-12 21:04:23 -07:00
Stanislav Malyshev 33d0ef0fef Fix test 2016-09-12 21:04:23 -07:00
Stanislav Malyshev c4cca4c20e Fix bug #73065: Out-Of-Bounds Read in php_wddx_push_element of wddx.c 2016-09-12 21:04:23 -07:00
Stanislav Malyshev f5a9592ad8 Fix bug #73035 (Out of bound when verify signature of tar phar in phar_parse_tarfile) 2016-09-12 21:04:23 -07:00
Stanislav Malyshev 6a7cc8ff85 Fix bug #73052 - Memory Corruption in During Deserialized-object Destruction 2016-09-12 21:04:23 -07:00
Stanislav Malyshev 7381d4c00e Add check in fgetcsv in case sizeof(unit) != sizeof(size_t) 2016-09-12 21:04:23 -07:00
Stanislav Malyshev ecb7f58a06 Fix bug #73029 - Missing type check when unserializing SplArray 2016-09-12 21:04:23 -07:00
Stanislav Malyshev b88393f08a Fix bug #72860: wddx_deserialize use-after-free 2016-09-12 21:04:23 -07:00
Stanislav Malyshev 65c8caafa8 Also fix overflow in wordwrap 2016-09-12 21:04:23 -07:00
Stanislav Malyshev 6d55ba2656 Fix bug #73007: add locale length check 2016-09-12 21:04:23 -07:00
Stanislav Malyshev ba5ac0d360 Add more checks for int overflow 2016-09-12 21:04:23 -07:00
Stanislav Malyshev 223266e4e4 Fix bug #72928 - Out of bound when verify signature of zip phar in phar_parse_zipfile 2016-09-12 21:04:23 -07:00
Stanislav Malyshev 19866fb76c Fix various int size overflows.
Add function for detection of string zvals with length that does not fit
INT_MAX.
2016-09-12 21:04:23 -07:00
Christoph M. Becker 0cbf634657 Skip regression test for issue that has not yet been released in libgd
<https://github.com/libgd/libgd/issues/177> has been assessed as enhancement,
so most likely it will be released with GD 2.3.
2016-09-12 13:21:34 +02:00
Christoph M. Becker fcdc30b347 Skip test for external GD because of not yet published bugfix 2016-09-12 12:34:11 +02:00
Christoph M. Becker 6d0e773292 Skip tests for unpatched external libgd regarding libvpx
Some issues have never been fixed in the external libgd's libvpx binding,
so we skip the respective tests.
2016-09-11 23:49:09 +02:00
Christoph M. Becker 6ef987e012 Split test for bundled vs. external libgd
The behavior of imagecropauto($im, IMG_CROP_DEFAULT) is rather different
for the bundled and an external libgd, see
<https://github.com/libgd/libgd/issues/298>.
Therefore we split the test for now.
2016-09-11 19:30:55 +02:00
Christoph M. Becker 38455293f7 Make test case more resilient
This test case fails with external libgd, because libgd < 2.2.4 converts
palette images to truecolor (<https://github.com/libgd/libgd/issues/297>).

However, even if there happens no truecolor conversion, it is not guaranteed
that the palette indexes of the original and the cropped image are identical
(this is, for instance, not the case with current libgd master where the bug
has been fixed). Therefore we check for the expected RGBA value instead of
the palette index.
2016-09-11 18:29:27 +02:00
Christoph M. Becker dc09f30933 A picture is worth a thousand message digests
The bundled GD test suites makes heavy use of md5() to verify the result
of drawing operations. This leads to fragile tests (even a slight change
in a PNG header would cause failure, and of course there is the
possibility of collisions), and even worse, eventual test failures are
rather unrevealing.

Therefore we replace all md5() verification with a simplistic
test_image_equals_file(), which is basically a simplified port of libgd's
gdTestImageCompareToFile(), adapted to the needs of PHPTs.

In the long run better tests helpers should be introduced (see also
<http://news.php.net/php.internals/94081>), but for now this solution
is preferable over the former.

(cherry picked from commit 24f9e96792)
2016-09-11 12:56:53 +02:00
Christoph M. Becker 326a4e38fb Add regression test for bug #73053
The test succeeds with libxml < 2.9.4, and is supposed to succeed with
libxml > 2.9.4. Unfortunately, we can't conditionally mark a test case
as XFAIL, so we're simply skipping the test for libxml 2.9.4 instead.
2016-09-11 00:06:45 +02:00
Anatol Belski 669fda00b7 Bug #73058 crypt broken when salt is 'too' long 2016-09-10 02:39:28 +02:00
Christoph M. Becker c42a7f2f3f Remove ignored --FAIL-- section from test case
This is just confusing.
2016-09-09 16:27:50 +02:00
Christoph M. Becker 23e721fc93 Fix #73054: default option ignored when object passed to int filter
If an object that can't be converted to string is validated, we must not
bail out early, but rather check for a requested default value.
2016-09-09 14:30:24 +02:00
Levi Morrison cb91a51b00 Partially fix bug #67167 - Wrong return value...
...from FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE

The remainer of the fix would require the filter functions to only
convert to string when it makes sense for that particular filter.

(cherry picked from commit 432dc527ad)
2016-09-09 12:45:46 +02:00
Yasuo Ohgaki 38553e853b Fixed Bug #68015 Session does not report invalid uid for files save handler 2016-09-09 11:31:54 +09:00
Yasuo Ohgaki 8c700076d7 Fix bug26639.phpt 2016-09-08 14:07:57 +09:00
Yasuo Ohgaki 8bbd0952e5 Fix Bug #72992 mbstring.internal_encoding doesn't inherit default_charset 2016-09-08 13:17:10 +09:00
Yasuo Ohgaki a25f6f89cd Fixed Bug #66964 mb_convert_variables() cannot detect recursion 2016-09-06 16:05:34 +09:00
Christoph M. Becker 8aad3131a1 Fix #70752: Depacking with wrong password leaves 0 length files
We should not open the output stream before we have tried to open the
archive entry, as failing the latter could leave an empty file behind.
2016-09-06 01:03:46 +02:00
Keyur 0045d16863 Fixes #72590: Opcache restart with kill_all_lockers does not work
ACCEL_LOG_ERROR is special and causes a zend_bailout() and the code
never gets to call kill() in the next line after the logging. Change
the log level to WARNING.
2016-09-05 16:59:28 +02:00
Julien Pauli 9834978a8b Fix #72972, Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and FILTER_FLAG_NO_PRIV_RANGE 2016-09-05 10:08:42 +02:00
Christoph M. Becker 39423e425d Implement #47456: Missing PCRE option 'J'
While it is possible to force the same behavior by setting the internal
option (?J), having a dedicated modifier appears to be useful. After all,
J is even listed on the "Pattern Modifiers" man page[1], but the description
referrs to (?J).

[1] <http://php.net/manual/en/reference.pcre.pattern.modifiers.php>
2016-09-05 00:30:48 -07:00
Stanislav Malyshev cee363d609 Merge branch 'pull-request/2061' into PHP-5.6
* pull-request/2061:
  Recognize TDS versions 7.3 and 7.4
2016-09-05 00:29:11 -07:00