archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-20 09:24:05 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
82731 commits 526 branches 1434 tags 881 MiB
Commit graph

638 commits

Author SHA1 Message Date
Stanislav Malyshev
a6c063d663 Merge branch 'PHP-5.5' into PHP-5.6 
* PHP-5.5:
  More fixes for bug #70219
 2015-09-01 12:51:48 -07:00
Stanislav Malyshev
c19d59c550 Merge branch 'PHP-5.5' into PHP-5.6 
* PHP-5.5:
  update NEWS
  add NEWS for fixes
  Improve fix for #70172
  Fix bug #70312 - HAVAL gives wrong hashes in specific cases
  fix test
  add test
  Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
  Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage
  Fix bug #70172 - Use After Free Vulnerability in unserialize()
  Fix bug #70388 - SOAP serialize_function_call() type confusion
  Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories
  Improve fix for #70385
  Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)
  Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes)
  Fix bug #70219 (Use after free vulnerability in session deserializer)
  Fix for bug #69782
  Add CVE IDs asigned (post release) to PHP 5.4.43
  Add CVE IDs asigned to #69085 (PHP 5.4.39)
  5.4.45 next

Conflicts:
	ext/pcre/php_pcre.c
	ext/standard/var_unserializer.c
	ext/standard/var_unserializer.re
	ext/zip/php_zip.c
 2015-09-01 12:06:41 -07:00
Stanislav Malyshev
33d3acaae7 Merge branch 'PHP-5.4' into PHP-5.5 
* PHP-5.4:
  Improve fix for #70172
  Fix bug #70312 - HAVAL gives wrong hashes in specific cases
  fix test
  add test
  Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
  Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage
  Fix bug #70172 - Use After Free Vulnerability in unserialize()
  Fix bug #70388 - SOAP serialize_function_call() type confusion
  Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories
  Improve fix for #70385
  Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)
  Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes)
  Fix bug #70219 (Use after free vulnerability in session deserializer)
  Fix for bug #69782
  Add CVE IDs asigned (post release) to PHP 5.4.43
  Add CVE IDs asigned to #69085 (PHP 5.4.39)
  5.4.45 next

Conflicts:
	configure.in
	ext/pcre/php_pcre.c
	ext/standard/var_unserializer.c
	ext/standard/var_unserializer.re
	main/php_version.h
 2015-09-01 11:42:19 -07:00
Stanislav Malyshev
fc8eff897b More fixes for bug #70219 2015-08-28 21:50:21 -07:00
Stanislav Malyshev
24dda816d0 Merge branch 'PHP-5.4.45' into PHP-5.5.29 
* PHP-5.4.45:
  Fix bug #70219 (Use after free vulnerability in session deserializer)
  Fix for bug #69782
  5.4.45 next

Conflicts:
	configure.in
	ext/standard/var_unserializer.c
	ext/standard/var_unserializer.re
	main/php_version.h
 2015-08-25 23:08:49 -07:00
Stanislav Malyshev
df4bf28f9f Fix bug #70219 (Use after free vulnerability in session deserializer) 2015-08-23 19:56:12 -07:00
Julien Pauli
2a50877428 Merge branch 'PHP-5.5' into PHP-5.6 
* PHP-5.5:
  Fix flaws in session module
 2015-03-16 16:01:12 +01:00
Julien Pauli
4dba99c226 Fix flaws in session module 2015-03-16 16:00:46 +01:00
Yasuo Ohgaki
2983ef3c48 Merge branch 'PHP-5.5' into PHP-5.6 
* PHP-5.5:
  Fixed bug #68063 Empty session IDs do still start sessions
 2015-02-03 13:41:31 +09:00
Yasuo Ohgaki
853ae39d6e Fixed bug #68063 Empty session IDs do still start sessions 2015-02-03 13:38:49 +09:00
Xinchen Hui
0579e8278d bump year 2015-01-15 23:26:37 +08:00
Xinchen Hui
73c1be2653 Bump year 2015-01-15 23:26:03 +08:00
Yasuo Ohgaki
9e072d9565 Remove unneeded md5 hashing from PHP-5.6 branch. 
It's removed from master already by my previous commit.
 2014-11-12 13:43:54 +09:00
Yasuo Ohgaki
4dd3fbfcd2 Fixed bug #68331 - This was partial patch for https://wiki.php.net/rfc/session-lock-ini 2014-11-06 13:06:29 +09:00
Tjerk Meesters
ce9bdae33f Fixed #67694: Regression in session_regenerate_id() 2014-08-23 09:18:02 +08:00
Stanislav Malyshev
c41ca94824 Merge branch 'PHP-5.5' into PHP-5.6 
* PHP-5.5:
  Fix missing type checks in various functions

Conflicts:
	ext/openssl/openssl.c
 2014-07-28 00:37:32 -07:00
Stanislav Malyshev
531be9662f Merge branch 'PHP-5.4' into PHP-5.5 
* PHP-5.4:
  Fix missing type checks in various functions
 2014-07-28 00:34:27 -07:00
Stanislav Malyshev
b4a4db467b Fix missing type checks in various functions 2014-07-27 02:42:49 -07:00
Xinchen Hui
9bef96d96e Merge branch 'PHP-5.5' into PHP-5.6 2014-07-19 13:12:36 +08:00
Yasuo Ohgaki
f83a6c33b4 Merge branch 'PHP-5.4' into PHP-5.5 
* PHP-5.4:
  Fixed bug #66827 Session raises E_NOTICE when session name variable is array
 2014-07-19 09:53:04 +09:00
Yasuo Ohgaki
e946de29d2 Fixed bug #66827 Session raises E_NOTICE when session name variable is array 2014-07-19 09:52:31 +09:00
Yasuo Ohgaki
6f0ad9ea12 Revert "Implement Bug #54649 Create session_serializer_name()" 
This reverts commit 678ec30655.

Conflicts:
	ext/session/tests/session_serializer_name_basic.phpt
 2014-03-13 06:32:49 +09:00
Yasuo Ohgaki
7dec5789fe Revert "Implemented Request #11100 (session_gc() function)." 
This reverts commit 54a42f0d0c.

Conflicts:
	ext/session/tests/session_gc_basic.phpt
 2014-03-13 06:30:32 +09:00
Anatol Belski
ca27c86110 Merge branch 'PHP-5.5' into PHP-5.6 
* PHP-5.5:
  fix zts
 2014-01-22 12:05:06 +01:00
Anatol Belski
6d1d8ec330 Merge branch 'PHP-5.4' into PHP-5.5 
* PHP-5.4:
  fix zts
 2014-01-22 12:04:25 +01:00
Anatol Belski
34792280bc fix zts 2014-01-22 12:03:54 +01:00
Yasuo Ohgaki
3cc6c6c587 Merge branch 'PHP-5.5' into PHP-5.6 
* PHP-5.5:
  Fixed previous commit may delete unwanted cookies.
  Re-fixed bug #66469
 2014-01-22 19:23:17 +09:00
Yasuo Ohgaki
fa224b1c58 Fixed previous commit may delete unwanted cookies. 2014-01-22 19:23:01 +09:00
Yasuo Ohgaki
58f94345a7 Fixed previous commit may delete unwanted cookies. Sync tests from upper branches. 2014-01-22 19:21:25 +09:00
Yasuo Ohgaki
26a2bed185 Merge branch 'PHP-5.5' into PHP-5.6 
* PHP-5.5:
  Re-fixed bug #66469
 2014-01-22 13:47:55 +09:00
Yasuo Ohgaki
383423a1ee Re-fixed bug #66469 2014-01-22 13:46:59 +09:00
Yasuo Ohgaki
a27e51fd4e Re-fixed bug #66469 2014-01-22 13:40:58 +09:00
Xinchen Hui
bfcdd67865 Merge branch 'PHP-5.5' into PHP-5.6 2014-01-16 14:42:04 +08:00
Xinchen Hui
9799816e0c Merge branch 'PHP-5.4' into PHP-5.5 2014-01-16 14:41:52 +08:00
Xinchen Hui
b777248ded Re-fixed Bug #66481 (Calls to session_name() segfault when session.name is null) 2014-01-16 14:41:12 +08:00
Xinchen Hui
271053ad47 Revert "Bug #66481 Segfaults on session_name()" 
This reverts commit 5662ffb295.
 2014-01-16 14:38:35 +08:00
Yasuo Ohgaki
518327f7e3 Merge branch 'PHP-5.5' into PHP-5.6 
* PHP-5.5:
  Bug #66481 Segfaults on session_name()
 2014-01-16 11:35:11 +09:00
Yasuo Ohgaki
744f38c2d6 Merge branch 'PHP-5.4' into PHP-5.5 
* PHP-5.4:
  Bug #66481 Segfaults on session_name()
 2014-01-16 11:34:31 +09:00
Conor McDermottroe
5662ffb295 Bug #66481 Segfaults on session_name() 
If the previous value of session.name was NULL then any call to
session_name($string) would result in a segmentation fault.

This changes the behaviour to set the value of session.name to
"PHPSESSID" if a blank value is given in php.ini or via -d on the
command line. There is already protection against setting it to NULL via
session_name() or ini_set().
 2014-01-16 11:33:10 +09:00
Yasuo Ohgaki
167eaedcbd Merge branch 'PHP-5.5' into PHP-5.6 
* PHP-5.5:
  Fixed session module is sending multiple set-cookie headers when session.use_strict_mode=1
 2014-01-15 11:07:10 +09:00
Yasuo Ohgaki
f52c251f60 Fixed session module is sending multiple set-cookie headers when session.use_strict_mode=1 2014-01-15 11:06:06 +09:00
Xinchen Hui
c081ce628f Bump year 2014-01-03 11:08:10 +08:00
Xinchen Hui
47c9027772 Bump year 2014-01-03 11:06:16 +08:00
Xinchen Hui
c0d060f5c0 Bump year 2014-01-03 11:04:26 +08:00
Dmitry Stogov
03a37de9b3 Improved empty string handling. Now ZE uses an interned string instead of allocation new empty string each time. (Some extensions might need to be fixed using str_efree() instead of efree() to support interned strings). 2013-12-26 14:47:13 +04:00
Christopher Jones
d9bfe06194 Merge branch 'PHP-5.5' 
* PHP-5.5:
  Reduce compilation noise during normal compilation:     php-5.5/ext/session/session.c:836: warning: unused variable ‘struc’     php-5.5/ext/session/session.c:836: warning: unused variable ‘num_key’     php-5.5/ext/session/session.c:836: warning: unused variable ‘key_length’     php-5.5/ext/session/session.c:836: warning: unused variable ‘key’     php-5.5/ext/session/session.c:835: warning: unused variable ‘key_type’     php-5.5/ext/session/session.c:834: warning: unused variable ‘_ht’     php-5.5/ext/session/session.c:857: warning: unused variable ‘has_value’     php-5.5/ext/session/session.c:856: warning: unused variable ‘namelen’     php-5.5/ext/session/session.c:853: warning: unused variable ‘name’     php-5.5/ext/session/session.c:852: warning: unused variable ‘p’
 2013-08-21 10:35:07 -07:00
Christopher Jones
d85827fb7f Reduce compilation noise during normal compilation: 
php-5.5/ext/session/session.c:836: warning: unused variable ‘struc’
    php-5.5/ext/session/session.c:836: warning: unused variable ‘num_key’
    php-5.5/ext/session/session.c:836: warning: unused variable ‘key_length’
    php-5.5/ext/session/session.c:836: warning: unused variable ‘key’
    php-5.5/ext/session/session.c:835: warning: unused variable ‘key_type’
    php-5.5/ext/session/session.c:834: warning: unused variable ‘_ht’
    php-5.5/ext/session/session.c:857: warning: unused variable ‘has_value’
    php-5.5/ext/session/session.c:856: warning: unused variable ‘namelen’
    php-5.5/ext/session/session.c:853: warning: unused variable ‘name’
    php-5.5/ext/session/session.c:852: warning: unused variable ‘p’

    php-5.5/ext/session/mod_user.c:191: warning: unused variable ‘ret’
 2013-08-21 10:34:09 -07:00
Yasuo Ohgaki
aaf95aa1b6 Merge branch 'PHP-5.5' 
* PHP-5.5:
  Add php_serialize session.serialize_handler. This patch closes
 2013-08-21 11:06:11 +09:00
Yasuo Ohgaki
c51f77fe83 Add php_serialize session.serialize_handler. This patch closes 
Request #25630
  Request #43980
  Request #54383
  Bug #65359

and many others similar to these that are closed as "wont fix" or
"not a bug".

Current serializers have limitations due to register_globals support
that are no longer supported. Changing existing serializer may cause
compatibility issue. Therefore, new handler is needed to remove
needless limitations.

php_serialize does not have special characters and allow numerical
index in $_SESSION. $_SESSION can be used as ordinary array.
 2013-08-21 10:51:51 +09:00
Christopher Jones
3c166c4758 Merge branch 'PHP-5.5' 
* PHP-5.5:
  Reduce (some) compile noise of 'unused variable' and 'may be used uninitialized' warnings.

Conflicts:
	ext/gmp/gmp.c
 2013-08-14 20:47:00 -07:00