Arnaud Le Blanc 19b49258d0 Fix GHSA-9pqp-7h25-4f32 ...

multipart/form-data boundaries larger than the read buffer result in erroneous
parsing, which violates data integrity.

Limit boundary size, as allowed by RFC 1521:

    Encapsulation boundaries [...] must be no longer than 70 characters, not
    counting the two leading hyphens.

We correctly parse payloads with boundaries of length up to
FILLUNIT-strlen("\r\n--") bytes, so allow this for BC.

2024-09-23 11:43:26 +01:00

..

streams

Fix GH-15628: php_stream_memory_get_buffer() not zero-terminated

2024-09-01 14:55:40 +02:00

build-defs.h.in

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

explicit_bzero.c

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

fastcgi.c

Fix undefined behaviour in fastcgi.c (#14269)

2024-05-19 22:54:06 +02:00

fastcgi.h

Mark various functions with void arguments.

2021-05-12 14:55:53 +01:00

fopen_wrappers.c

Support sysconf(_SC_GETPW_R_SIZE_MAX) == -1 (#13922)

2024-06-24 19:52:55 +02:00

fopen_wrappers.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

getopt.c

Fixed some spaces used instead of tabs

2021-06-29 11:30:26 +02:00

http_status_codes.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

internal_functions_win32.c

Implement Random Extension

2022-07-19 10:27:38 +01:00

internal_functions.c.in

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

main.c

Support sysconf(_SC_GETPW_R_SIZE_MAX) == -1 (#13922)

2024-06-24 19:52:55 +02:00

network.c

Fix GH-15565: --disable-ipv6 during compilation produces error EAI_SYSTEM not found

2024-08-24 14:14:20 +02:00

output.c

Fix GH-14808: Unexpected null pointer in Zend/zend_string.h with empty output buffer

2024-07-04 15:49:58 +02:00

php_compat.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

php_content_types.c

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

php_content_types.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

php_getopt.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

php_globals.h

Fix GH-8086: Introduce mail.mixed_lf_and_crlf INI

2023-01-19 19:05:39 +00:00

php_ini_builder.c

sapi/*: move duplicate "--define" code to library

2022-04-18 16:52:08 +02:00

php_ini_builder.h

sapi/*: move duplicate "--define" code to library

2022-04-18 16:52:08 +02:00

php_ini.c

Initialise zend_stat_t to fix MSAN build

2022-05-22 16:06:27 +01:00

php_ini.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

php_main.h

Minor refactoring of main/main.c and TSRM (#8608)

2022-05-24 08:34:55 +01:00

php_memory_streams.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

php_network.h

Merge branch 'PHP-8.0' into PHP-8.1

2022-10-22 10:44:06 +02:00

php_odbc_utils.c

Quote when adding to connection string in (PDO_)ODBC

2022-05-27 16:56:44 +02:00

php_odbc_utils.h

Quote when adding to connection string in (PDO_)ODBC

2022-05-27 16:56:44 +02:00

php_open_temporary_file.c

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

php_open_temporary_file.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

php_output.h

Remove unnecessary PHP_FUNCTION() declarations (#7472)

2021-09-07 10:04:00 +02:00

php_reentrancy.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

php_scandir.c

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

php_scandir.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

php_streams.h

Fix stream fclose_stdiocast_flush_in_progress type

2023-11-22 20:39:30 -06:00

php_syslog.c

Fix strict prototype for php_closelog

2022-06-19 22:56:44 +01:00

php_syslog.h

Fix strict prototype for php_closelog

2022-06-19 22:56:44 +01:00

php_ticks.c

Fix GH-10737: PHP 8.1.16 segfaults on line 597 of sapi/apache2handler/sapi_apache2.c

2023-04-08 16:34:07 +02:00

php_ticks.h

Fix GH-10737: PHP 8.1.16 segfaults on line 597 of sapi/apache2handler/sapi_apache2.c

2023-04-08 16:34:07 +02:00

php_variables.c

Merge branch 'PHP-8.1' into PHP-8.2

2024-04-09 23:49:31 -05:00

php_variables.h

Fix bug #75712: getenv in php-fpm should not read $_ENV, $_SERVER

2024-02-04 11:58:18 +00:00

php_version.h

PHP-8.2 is now for PHP 8.2.24-dev

2024-08-13 17:18:16 +03:00

php.h

Replace reallocarray with safe_perealloc

2022-09-29 15:15:40 +02:00

reentrancy.c

Implement Random Extension

2022-07-19 10:27:38 +01:00

rfc1867.c

Fix GHSA-9pqp-7h25-4f32

2024-09-23 11:43:26 +01:00

rfc1867.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

safe_bcmp.c

Fix comment for php_safe_bcmp (#10306)

2023-01-12 23:30:36 +01:00

SAPI.c

Merge branch 'PHP-8.1'

2022-08-29 22:34:48 +01:00

SAPI.h

Merge branch 'PHP-8.1'

2022-08-29 22:34:48 +01:00

snprintf.c

Bring minimum precision inline with spprintf

2023-01-30 19:00:42 +00:00

snprintf.h

Remove FORMAT_CONV_MAX_PRECISION

2021-08-02 15:59:26 +02:00

spprintf.c

Use memrchr() when available

2021-11-24 16:13:34 +03:00

spprintf.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

strlcat.c

strlcpy/strlcat update to last openbsd version.

2022-04-28 15:09:55 +02:00

strlcpy.c

strlcpy/strlcat update to last openbsd version.

2022-04-28 15:09:55 +02:00