1
0
mirror of https://github.com/php/php-src.git synced 2026-04-15 20:11:02 +02:00
Commit Graph

467 Commits

Author SHA1 Message Date
Stanislav Malyshev
aeb6d13185 Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment) 2019-07-29 00:53:37 -07:00
Stanislav Malyshev
dea2989ab8 Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail) 2019-07-29 00:53:28 -07:00
Stanislav Malyshev
73ff4193be Fix bug #77988 - heap-buffer-overflow on php_jpg_get16 2019-05-27 17:28:09 -07:00
Stanislav Malyshev
f80ad18afa Fix bug #77950 - Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG
I do not completely understand what is going on there, but I am pretty
sure dir_entry <= offset_base if not a normal situation, so we better not
to rely on such dir_entry.
2019-04-30 00:05:23 -07:00
Remi Collet
dc1cd3daf2 fix paste issue 2019-04-02 11:05:09 +02:00
Christoph M. Becker
01a4de5c58 Pointer arithmetic on void pointers is illegal
We quick-fix this by casting to char*; it might be more appropriate to
use char pointers in the first place.
2019-04-02 10:39:44 +02:00
Stanislav Malyshev
887a7b5714 Fixed bug #77831 - Heap-buffer-overflow in exif_iif_add_value in EXIF 2019-04-02 00:12:26 -07:00
Stanislav Malyshev
f3aefc6d07 Fix bug #77753 - Heap-buffer-overflow in php_ifd_get32s 2019-03-31 23:09:06 -07:00
Stanislav Malyshev
44f87fbf36 Fix test error message 2019-03-03 19:30:14 -08:00
Stanislav Malyshev
8ac6fee856 Fix bug #77563 - Uninitialized read in exif_process_IFD_in_MAKERNOTE
Also fix for bug #77659
2019-03-03 18:35:43 -08:00
Stanislav Malyshev
5f0e62a3e5 Fix bug #77540 - Invalid Read on exif_process_SOFn 2019-03-03 18:35:26 -08:00
Stanislav Malyshev
5e824a88d0 Fix integer overflows on 32-bits 2019-03-03 18:35:04 -08:00
Peter Kokot
113213f027 Sync leading and final newlines in *.phpt sections
This patch adds missing newlines, trims multiple redundant final
newlines into a single one, and trims redundant leading newlines in all
*.phpt sections.

According to POSIX, a line is a sequence of zero or more non-' <newline>'
characters plus a terminating '<newline>' character. [1] Files should
normally have at least one final newline character.

C89 [2] and later standards [3] mention a final newline:
"A source file that is not empty shall end in a new-line character,
which shall not be immediately preceded by a backslash character."

Although it is not mandatory for all files to have a final newline
fixed, a more consistent and homogeneous approach brings less of commit
differences issues and a better development experience in certain text
editors and IDEs.

[1] http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_206
[2] https://port70.net/~nsz/c/c89/c89-draft.html#2.1.1.2
[3] https://port70.net/~nsz/c/c99/n1256.html#5.1.1.2
2018-10-15 04:29:24 +02:00
Peter Kokot
7af945e271 Trim trailing whitespace in *.phpt 2018-10-14 19:43:12 +02:00
Peter Kokot
03f3b8479b Sync leading and final newlines in source code files
This patch adds missing newlines, trims multiple redundant final
newlines into a single one, and trims redundant leading newlines.

According to POSIX, a line is a sequence of zero or more non-' <newline>'
characters plus a terminating '<newline>' character. [1] Files should
normally have at least one final newline character.

C89 [2] and later standards [3] mention a final newline:
"A source file that is not empty shall end in a new-line character,
which shall not be immediately preceded by a backslash character."

Although it is not mandatory for all files to have a final newline
fixed, a more consistent and homogeneous approach brings less of commit
differences issues and a better development experience in certain text
editors and IDEs.

[1] http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_206
[2] https://port70.net/~nsz/c/c89/c89-draft.html#2.1.1.2
[3] https://port70.net/~nsz/c/c99/n1256.html#5.1.1.2
2018-10-14 12:51:01 +02:00
Peter Kokot
7f6387b59a Trim trailing whitespace in source code files 2018-10-13 14:12:55 +02:00
Stanislav Malyshev
4e92cd172a Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Fixed bug #76459 windows linkinfo lacks openbasedir check
  Add NEWS
  Fixed bug #76459 windows linkinfo lacks openbasedir check
  Fix bug #76557: heap-buffer-overflow (READ of size 48) while reading exif data
  Fix bug #76423 - Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c
2018-07-16 16:52:36 -07:00
Stanislav Malyshev
bddf8140e4 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Add NEWS
  Fixed bug #76459 windows linkinfo lacks openbasedir check
  Fix bug #76557: heap-buffer-overflow (READ of size 48) while reading exif data
  Fix bug #76423 - Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c
2018-07-16 15:13:13 -07:00
Stanislav Malyshev
3462efa386 Fix bug #76557: heap-buffer-overflow (READ of size 48) while reading exif data
Use MAKERNOTE length as data size.
2018-07-16 14:17:51 -07:00
Stanislav Malyshev
1baeae4270 Fix bug #76423 - Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c 2018-07-16 14:16:58 -07:00
Stanislav Malyshev
95ee9efa57 Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Fix tsrm_ls
  Fix #76129 - remove more potential unfiltered outputs for phar
  Fix test
  Fix bug #76248 - Malicious LDAP-Server Response causes Crash
  Fix bug #76249 - fail on invalid sequences
  Fix #76130: Heap Buffer Overflow (READ: 1786) in exif_iif_add_value
  Fix bug #75981: prevent reading beyond buffer start
2018-04-23 22:00:24 -07:00
Stanislav Malyshev
5a18d7a0df Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Fix tsrm_ls
  Fix #76129 - remove more potential unfiltered outputs for phar
  Fix test
  Fix bug #76248 - Malicious LDAP-Server Response causes Crash
  Fix bug #76249 - fail on invalid sequences
  Fix #76130: Heap Buffer Overflow (READ: 1786) in exif_iif_add_value
  Fix bug #75981: prevent reading beyond buffer start
2018-04-23 21:59:57 -07:00
Christoph M. Becker
b4e4788c44 Fix #76130: Heap Buffer Overflow (READ: 1786) in exif_iif_add_value
The MakerNote is not necessarily null-terminated, so we must not use
`strlen()` to avoid OOB reads.  Instead `php_strnlen()` is the proper
way to handle this.
2018-04-22 20:15:02 -07:00
Xinchen Hui
ccd4716ec7 year++ 2018-01-02 12:53:31 +08:00
Christoph M. Becker
62098a10aa Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Use PHP_VERSION for exif
2017-10-11 14:43:51 +02:00
Peter Kokot
74124de048 Use PHP_VERSION for exif 2017-10-04 23:25:36 +02:00
Anatol Belski
d9d152b895 Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Test to cover the change in ce1a0d97
2017-08-01 12:50:52 +02:00
Anatol Belski
a8e25fdbf8 Test to cover the change in ce1a0d97 2017-08-01 12:49:45 +02:00
Stanislav Malyshev
ca6f679417 Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Fix test
2017-01-15 18:42:44 -08:00
Stanislav Malyshev
2c7909697a Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Fix test
2017-01-15 18:42:33 -08:00
Stanislav Malyshev
814966ad33 Fix test 2017-01-15 18:42:22 -08:00
Stanislav Malyshev
19e80ef496 Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Update more functions with path check
2017-01-15 17:32:37 -08:00
Stanislav Malyshev
43d0f2abc5 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Update more functions with path check
2017-01-15 17:32:26 -08:00
Stanislav Malyshev
0ab1af7d3e Update more functions with path check 2017-01-15 17:31:08 -08:00
Nikita Popov
769e17ce9b Merge branch 'PHP-7.0' into PHP-7.1 2017-01-05 11:38:17 +01:00
Nikita Popov
2022dacb99 Merge branch 'PHP-5.6' into PHP-7.0 2017-01-05 11:38:05 +01:00
Nikita Popov
900b17b15f Fix printf modifier 2017-01-05 11:37:06 +01:00
Sammy Kaye Powers
dac6c639bb Update copyright headers to 2017 2017-01-04 11:23:42 -06:00
Sammy Kaye Powers
478f119ab9 Update copyright headers to 2017 2017-01-04 11:14:55 -06:00
Stanislav Malyshev
2075fb2b73 Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Fix bug #73737 FPE when parsing a tag format
  Fix bug #73773 - Seg fault when loading hostile phar
  Fix bug #73825 - Heap out of bounds read on unserialize in finish_nested_data()
  Fix bug #73768 - Memory corruption when loading hostile phar
  Fix int overflows in phar (bug #73764)
2017-01-02 21:07:01 -08:00
Stanislav Malyshev
7f0de1a138 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Fix bug #73737 FPE when parsing a tag format
  Fix bug #73773 - Seg fault when loading hostile phar
  Fix bug #73825 - Heap out of bounds read on unserialize in finish_nested_data()
  Fix bug #73768 - Memory corruption when loading hostile phar
  Fix int overflows in phar (bug #73764)
2017-01-02 21:01:35 -08:00
Stanislav Malyshev
1cda0d7c2f Fix bug #73737 FPE when parsing a tag format 2016-12-31 19:31:49 -08:00
Stanislav Malyshev
defa47b94d Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Same issue as #72926 in another place.
2016-09-04 20:58:09 -07:00
Stanislav Malyshev
a2fdf0f413 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Same issue as #72926 in another place.
2016-09-04 20:57:46 -07:00
Stanislav Malyshev
b578580e88 Same issue as #72926 in another place. 2016-09-04 20:49:34 -07:00
Xinchen Hui
ce6ad9bdd9 Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0: (48 commits)
  Update NEWs
  Unused label
  Fixed bug #72853 (stream_set_blocking doesn't work)
  fix test
  Bug #72663 - part 3
  Bug #72663 - part 2
  Bug #72663 - part 1
  Update NEWS
  BLock test with memory leak
  fix tests
  Fix TSRM build
  Fix bug #72850 - integer overflow in uuencode
  Fixed bug #72849 - integer overflow in urlencode
  Fix bug #72848 - integer overflow in quoted_printable_encode caused heap corruption
  Fix bug #72838 - 	Integer overflow lead to heap corruption in sql_regcase
  Fix bug #72837 - integer overflow in bzdecompress caused heap corruption
  Fix bug #72836 - integer overflow in base64_decode caused heap corruption
  Fix for bug #72807 - do not produce strings with negative length
  Fix for bug #72790 and bug #72799
  Fix bug #72730 - imagegammacorrect allows arbitrary write access
  ...

Conflicts:
	ext/standard/var_unserializer.c
2016-08-17 17:14:30 +08:00
Stanislav Malyshev
0d13325b66 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6: (24 commits)
  Update NEWS
  BLock test with memory leak
  fix tests
  Fix TSRM build
  Fix bug #72850 - integer overflow in uuencode
  Fixed bug #72849 - integer overflow in urlencode
  Fix bug #72848 - integer overflow in quoted_printable_encode caused heap corruption
  Fix bug #72838 - 	Integer overflow lead to heap corruption in sql_regcase
  Fix bug #72837 - integer overflow in bzdecompress caused heap corruption
  Fix bug #72836 - integer overflow in base64_decode caused heap corruption
  Fix for bug #72807 - do not produce strings with negative length
  Fix for bug #72790 and bug #72799
  Fix bug #72730 - imagegammacorrect allows arbitrary write access
  Fix bug#72697 - select_colors write out-of-bounds
  Fixed bug #72627: Memory Leakage In exif_process_IFD_in_TIFF
  Fix bug #72750: wddx_deserialize null dereference
  Fix bug #72771: ftps:// opendir wrapper is vulnerable to protocol downgrade attack
  Improve fix for #72663
  Fix bug #70436: Use After Free Vulnerability in unserialize()
  Fix bug #72749: wddx_deserialize allows illegal memory access
  ...

Conflicts:
	Zend/zend_API.h
	ext/bz2/bz2.c
	ext/curl/interface.c
	ext/ereg/ereg.c
	ext/exif/exif.c
	ext/gd/gd.c
	ext/gd/tests/imagetruecolortopalette_error3.phpt
	ext/gd/tests/imagetruecolortopalette_error4.phpt
	ext/session/session.c
	ext/snmp/snmp.c
	ext/standard/base64.c
	ext/standard/ftp_fopen_wrapper.c
	ext/standard/quot_print.c
	ext/standard/url.c
	ext/standard/uuencode.c
	ext/standard/var.c
	ext/standard/var_unserializer.c
	ext/standard/var_unserializer.re
	ext/wddx/tests/bug72790.phpt
	ext/wddx/tests/bug72799.phpt
	ext/wddx/wddx.c
	sapi/cli/generate_mime_type_map.php
2016-08-17 00:43:33 -07:00
Stanislav Malyshev
f8a75d4eee Merge branch 'PHP-7.0' into PHP-7.0.10
* PHP-7.0: (34 commits)
  Fix URL rewriter partially
  Support "git worktree"
  Add NEWS
  Fix ASSERT logic
  Bugfix 72791: fix memory leak in PDO persistent connections
  Don't copy mime types in CLI server
  Remove obsolete Id tags
  Bump version in OCI8 test
  Fixed bug #72788 (Invalid memory access when using persistent PDO connection)
  Remove typo'd commit
  Fix bug 72788: Invalid memory access when database_object_handle is undefined. Also fix memory leak in dbh_free when using persistent PDO connections.
  Replace dead branch with ZEND_ASSERT()
  Add test for bug #69107: finfo no longer detects PHP files
  Fix bug #55451
  Fix stream_socket_enable_crypto() test
  Remove old $Id$ tags
  Sync with 7.1 branch changes from Nikita & Dimitri to keep OCI8 code identical
  Fix bug #72524 (Binding null values triggers ORA-24816 error)
  Fix the fix (Nikita), thanks!
  Check the return value of dbconvert() in mssql_guid_string(), as it may return -1 in case the conversion failed. In that case false is returned.
  ...

Conflicts:
	ext/standard/ftp_fopen_wrapper.c
2016-08-16 23:50:42 -07:00
Stanislav Malyshev
6dbb1ee46b Fixed bug #72627: Memory Leakage In exif_process_IFD_in_TIFF 2016-08-16 22:55:40 -07:00
Stanislav Malyshev
24fb60ffe9 Fixed bug #72627: Memory Leakage In exif_process_IFD_in_TIFF
(cherry picked from commit 620b01337cc39f856ca68c34c35e154f5f0682fc)

Conflicts:
	ext/exif/exif.c
2016-08-16 15:04:16 +02:00