1
0
mirror of https://github.com/php/php-src.git synced 2026-04-09 09:03:04 +02:00
Commit Graph

4666 Commits

Author SHA1 Message Date
Anatol Belski
89a5bd6750 Fixed bug #74090 stream_get_contents maxlength>-1 returns empty string 2017-02-15 11:22:47 +01:00
Xinchen Hui
ee25eb0eae Fixed #73496 (Invalid memory access in zend_inline_hash_func)
no test script is added because it requre too much memory
2017-02-12 18:55:19 +08:00
Denis Yeldandi
9814be4bc2 Fixed bug #69860 2017-02-12 00:06:04 +01:00
Nikita Popov
a15bffd105 Fix bug #73807 2017-02-02 18:06:15 +01:00
Anatol Belski
536b3ca1e1 bump versions for next in dev 2017-01-31 11:18:23 +01:00
Sara Golemon
69fbe3a9ad Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Fix open_basedir check for glob:// opendir wrapper
2017-01-09 16:07:33 -08:00
Sara Golemon
7e49e8e797 Fix open_basedir check for glob:// opendir wrapper
php_check_open_basedir() expects a local filesystem path,
but we're handing it a `glob://...` URI instead.

Move the check to after the path trim so that we're checking
a meaningful pathspec.
2017-01-09 11:02:50 -08:00
Nikita Popov
a46bbdda2e Fixed bug #67583
As fcgi_request is an opaque struct as of PHP 7, expose a new API
function fcgi_end() which does fcgi_flush() with end=1 and checks/
sets the ->ended flag.
2017-01-07 22:53:28 +01:00
Nikita Popov
f346bd6ee6 Rename fcgi_request.closed to .ended
"closed" refers to whether FCGI_END_REQUEST has been sent, while
the "close" operation does something entirely different. It gets
extra confusing when fcgi_is_closed() does not actually return
fcgi_request.closed...
2017-01-07 22:45:19 +01:00
Evgeniy Makhrov
d0279242ce add 'e' flag for fopen() to enable CLOEXEC 2017-01-07 12:10:51 +01:00
Markus Staab
782b84c6d5 updated default per proposal
TODO: adjust php.ini defaults
2017-01-06 05:25:08 +00:00
Markus Staab
66b698c3cf Increase realpath_cache_size default value 2017-01-06 05:25:04 +00:00
Ferenc Kovacs
3b14d7b84b 5.6.31 is next 2017-01-06 01:43:11 +01:00
Anatol Belski
997d902762 move dev to next 2017-01-05 01:12:18 +01:00
Sammy Kaye Powers
478f119ab9 Update copyright headers to 2017 2017-01-04 11:14:55 -06:00
Nikita Popov
935b5cb11e Flush stderr on win32 in cli_log_message
This allows us to unfork a bunch of tests for Windows.
2017-01-01 21:09:02 +01:00
Ferenc Kovacs
e715dafae0 5.6.30 will be next 2016-11-24 01:54:23 +01:00
Anatol Belski
df902a7c28 move dev to next 2016-11-22 11:49:09 +01:00
Ferenc Kovacs
9b3a1e00ab 5.6.29 will be next 2016-10-27 23:10:59 +02:00
Anatol Belski
277e829f10 move dev to 7.0.14 2016-10-25 10:29:51 +02:00
Stanislav Malyshev
c4c2cce37d Fix bug #73189 - Memcpy negative size parameter php_resolve_path
(cherry picked from commit da7e89cde8)
2016-10-12 21:31:37 +02:00
Sara Golemon
43ccf23d70 Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.

Catch the bailout, clear the variable, then continue bailing.

Closes https://bugs.php.net/bug.php?id=73188
2016-10-11 21:55:01 -07:00
Sara Golemon
4d11a8eedf Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.

Catch the bailout, clear the variable, then continue bailing.

Closes https://bugs.php.net/bug.php?id=73188
2016-10-11 21:44:14 -07:00
Stanislav Malyshev
689a9b8def Merge branch 'PHP-5.6.27' into PHP-5.6
* PHP-5.6.27:
  Fix tests
  fix tsrm
  Fix bug #73284 - heap overflow in php_ereg_replace function
  Fix bug #73276 - crash in openssl_random_pseudo_bytes function
  Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML()
  fix bug #73275 - crash in openssl_encrypt function
  Fix for #73240 - Write out of bounds at number_format
  Bug #73218: add mitigation for ICU int overflow
  Add more locale length checks, due to ICU bugs.
  Fix bug #73208 - another missing length check
  Fix bug #73190: memcpy negative parameter _bc_new_num_ex
  Fix bug #73189 - Memcpy negative size parameter php_resolve_path
  Fixed bug #73174 - heap overflow in php_pcre_replace_impl
  Fix bug #73150: missing NULL check in dom_document_save_html
  Fix bug #73147: Use After Free in PHP7 unserialize()
  Fix bug #73082
  Fix bug #73073 - CachingIterator null dereference when convert to string
2016-10-11 16:26:35 -07:00
Anatol Belski
ea83e504e5 fix datatype 2016-10-06 11:01:27 +02:00
Stanislav Malyshev
40e7baab3c Fix bug #73190: memcpy negative parameter _bc_new_num_ex 2016-10-03 00:09:02 -07:00
Stanislav Malyshev
da7e89cde8 Fix bug #73189 - Memcpy negative size parameter php_resolve_path 2016-09-28 23:30:48 -07:00
Ferenc Kovacs
703c247c7d 5.6.28 is next 2016-09-29 00:55:36 +02:00
Anatol Belski
cb29c01ed6 prepare next 2016-09-27 12:49:52 +02:00
Anatol Belski
4685297f05 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Revert "Fixed bug #73037 SoapServer reports Bad Request when gzipped"
2016-09-23 18:46:51 +02:00
Anatol Belski
075aa911ff Revert "Fixed bug #73037 SoapServer reports Bad Request when gzipped"
This reverts commit f9a699f6c3.
2016-09-23 18:45:03 +02:00
Anatol Belski
f9a699f6c3 Fixed bug #73037 SoapServer reports Bad Request when gzipped
(cherry picked from commit 410c68788a)
2016-09-23 18:06:12 +02:00
Anatol Belski
410c68788a Fixed bug #73037 SoapServer reports Bad Request when gzipped 2016-09-23 16:02:50 +02:00
Xinchen Hui
ac07008bb7 Fixed bug #72505 (readfile() mangles files larger than 2G) 2016-09-16 20:53:51 +08:00
Ferenc Kovacs
fbb81dd755 5.6.27 will be next 2016-09-01 20:27:19 +02:00
Anatol Belski
bc7460260b prepare for next 2016-08-30 14:11:22 +02:00
Xinchen Hui
3956deb1b2 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Fixed bug #72853 (stream_set_blocking doesn't work)

Conflicts:
	main/streams/plain_wrapper.c
2016-08-17 16:56:02 +08:00
Xinchen Hui
abe00908af Fixed bug #72853 (stream_set_blocking doesn't work)
Implemented  PHP_STREAM_OPTION_META_DATA_API for plain_wrappers
2016-08-17 16:54:21 +08:00
Stanislav Malyshev
75d7666968 Merge branch 'PHP-7.0.10' into PHP-7.0
* PHP-7.0.10:
  Fix bug #72749: wddx_deserialize allows illegal memory access
  Fixed bug #72627: Memory Leakage In exif_process_IFD_in_TIFF
  fix tests
  Fix bug#72697 - select_colors write out-of-bounds
  Fix bug #72708 - php_snmp_parse_oid integer overflow in memory allocation
  Fix bug #72730 - imagegammacorrect allows arbitrary write access
  Fix bug #72750: wddx_deserialize null dereference
  Fix bug #72771: ftps:// opendir wrapper is vulnerable to protocol downgrade attack
  fix tests
  add missing skipif section
  Fix for bug #72790 and bug #72799
  Fix bug #72837 - integer overflow in bzdecompress caused heap corruption
  Fix bug #72742 - memory allocator fails to realloc small block to large one
  Use size_t for path length
  Check for string overflow
  Fix for bug #72782: mcrypt accepts only ints, so don't pass anything else
  Fix bug #72674 - check both curl_escape and curl_unescape
2016-08-16 23:52:22 -07:00
Anatol Belski
6de67244d4 fix blocking pipe stream option value
As revealed by #72857, this value conflicts with the xport option.
Wrong code can otherwise cause streams misbehave, fe if local and
network streams APIs are mixed.
2016-08-17 00:53:15 +02:00
Stanislav Malyshev
6304a611cd Use size_t for path length 2016-08-10 23:46:58 -07:00
Ferenc Kovacs
562c17eb4e 5.6.26 will be next 2016-08-04 01:39:37 +02:00
Nikita Popov
1bcd439cad Fix bug #72724 2016-08-03 00:34:36 +02:00
Anatol Belski
5c51433e2a prepare next 2016-08-02 11:13:20 +02:00
Anatol Belski
9f14920725 fix php_version.h 2016-08-02 11:06:33 +02:00
Pierrick Charron
6714f73545 Merge branch 'PHP-5.6' into PHP-7.0
Conflicts:
	main/streams/streams.c
2016-07-27 00:38:54 -04:00
Pierrick Charron
074b86d845 Fixed bug #72686 (zlib: url support is broken).
zlib: support is broken since a really long time.
It never worked on versions >= PHP5.6 so we can just remove
this dead code.

Bug was introduced 2006-05-14 (Before 5.2.0)
2016-07-27 00:33:13 -04:00
Xinchen Hui
97c0b133c5 Fixed bug #72629 (Caught exception assignment to variables ignores references). 2016-07-20 16:59:14 +08:00
Stanislav Malyshev
b00f8f2a5b Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  fix #72519, possible OOB using imagegif
  fix #72512, invalid read or write for palette image when invalid transparent index is used
  Apparently some envs miss SIZE_MAX
  Fix tests
  Fix bug #72618: NULL Pointer Dereference in exif_process_user_comment
  Partial fix for bug #72613 - do not treat negative returns from bz2 as size_t
  Fix bug #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c
  Fix for bug #72558, Integer overflow error within _gdContributionsAlloc()
  Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE
  Fix bug #72562 - destroy var_hash properly
  Fix bug #72533 (locale_accept_from_http out-of-bounds access)
  Fix fir bug #72520
  Fix for bug #72513
  Fix for bug #72513
  CS fix and comments with bug ID
  Fix for HTTP_PROXY issue.
  5.6.24RC1
  add tests for bug #72512
  Fixed bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access
  Fixed bug #72479 - same as #72434

Conflicts:
	Zend/zend_virtual_cwd.c
	ext/bz2/bz2.c
	ext/exif/exif.c
	ext/session/session.c
	ext/snmp/snmp.c
	ext/standard/basic_functions.c
	main/SAPI.c
	main/php_variables.c
2016-07-19 01:39:28 -07:00
Stanislav Malyshev
4d0565b5ba Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  fix #72519, possible OOB using imagegif
  fix #72512, invalid read or write for palette image when invalid transparent index is used
  Apparently some envs miss SIZE_MAX
  Fix tests
  Fix bug #72618: NULL Pointer Dereference in exif_process_user_comment
  Partial fix for bug #72613 - do not treat negative returns from bz2 as size_t
  Fix bug #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c
  Fix for bug #72558, Integer overflow error within _gdContributionsAlloc()
  Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE
  Fix bug #72562 - destroy var_hash properly
  Fix bug #72533 (locale_accept_from_http out-of-bounds access)
  Fix fir bug #72520
  Fix for bug #72513
  CS fix and comments with bug ID
  Fix for HTTP_PROXY issue.
  add tests for bug #72512
  Fixed bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access
  Fixed bug #72479 - same as #72434

Conflicts:
	ext/bz2/bz2.c
	main/SAPI.c
	main/php_variables.c
2016-07-19 00:53:08 -07:00