Commit graph

259 commits

Author SHA1 Message Date
Dmitry Stogov
9e709e2fa0 Move constants into read-only data segment 2017-12-14 18:43:44 +03:00
Dmitry Stogov
ed5b4d5c99 Use Zend MM heap 2017-11-01 02:38:26 +03:00
Thomas Punt
932c4b35dc Remove more unnecessary checks on Zend's allocator functions 2017-03-16 12:23:55 +01:00
Sammy Kaye Powers
dac6c639bb Update copyright headers to 2017 2017-01-04 11:23:42 -06:00
Sammy Kaye Powers
9e29f841ce Update copyright headers to 2017 2017-01-02 09:30:12 -06:00
Xinchen Hui
6a43c61bcd Fixed bug #73646 (mb_ereg_search_init null pointer dereference) 2016-12-09 15:55:07 +08:00
Xinchen Hui
229024c725 Fixed bug #73532 (Null pointer dereference in mb_eregi) 2016-11-16 15:05:04 +08:00
ju1ius
03d03243fa Fix #72711: mb_ereg does not clear the $regs parameter on failure
When `mb_ereg` failed to match, it didn't update the `$regs` argument.
Now it will always set it to the empty array.
2016-08-05 13:22:10 +02:00
Christoph M. Becker
9c2814313d Merge branch 'PHP-7.0' into PHP-7.1 2016-07-30 12:04:12 +02:00
Christoph M. Becker
e5940aa795 Merge branch 'PHP-5.6' into PHP-7.0 2016-07-30 12:01:29 +02:00
ju1ius
1d32b80903 fixes bad address given to onig_error_code_to_str
Closes bug #72710

(cherry picked from commit 0fb7eb6723)
2016-07-30 11:46:34 +02:00
Christoph M. Becker
de755310b4 Merge branch 'PHP-7.0' into PHP-7.1
# Resolved conflicts:
#	ext/mbstring/php_mbregex.c
2016-07-28 15:50:41 +02:00
Christoph M. Becker
805dc0ea47 Merge branch 'PHP-5.6' into PHP-7.0
# Resolved conflicts:
#	ext/mbstring/php_mbregex.c
2016-07-28 15:26:29 +02:00
Christoph M. Becker
ee6900c3de Fix #72694: mb_ereg_search_setpos does not accept a string's last position
Setting the search position immediately behind the last character should be
allowed, so we fix this off-by-one error.
2016-07-28 15:21:48 +02:00
Christoph M. Becker
6aaef1ed34 Merge branch 'PHP-7.0' into PHP-7.1 2016-07-28 14:09:29 +02:00
Christoph M. Becker
a621023168 Merge branch 'PHP-5.6' into PHP-7.0 2016-07-28 14:03:40 +02:00
Christoph M. Becker
56cdaecb28 Fix #72693: mb_ereg_search increments search position when a match zero-width
That's caused by an off-by-one error, which we fix.
2016-07-28 13:57:38 +02:00
Christoph M. Becker
db69ea32cb Merge branch 'PHP-7.0' into PHP-7.1 2016-07-28 13:19:15 +02:00
Christoph M. Becker
18a37eeeec Merge branch 'PHP-5.6' into PHP-7.0
# Resolved conflicts:
#	ext/mbstring/php_mbregex.c
2016-07-28 13:12:40 +02:00
Christoph M. Becker
d276e6a838 Fix #72691: mb_ereg_search raises a warning if a match zero-width
That warning doesn't make sense (PCRE doesn't throw such a warning either),
so we remove it.
2016-07-28 13:07:05 +02:00
Masaki Kagaya
eb3e7f7c10 check the encoding of argument for mb_ereg, mb_ereg_replace, mb_ereg_search_init 2016-07-17 14:19:45 +02:00
Christoph M. Becker
0c98f51c84 Implement RFC "Deprecate mb_ereg_replace eval option"
<https://wiki.php.net/rfc/deprecate_mb_ereg_replace_eval_option> has been
accepted, so we implement it.
2016-07-11 11:20:01 +02:00
Aaron Piotrowski
24237027bc Merge branch 'throw-error-in-extensions' 2016-07-05 02:08:39 -05:00
Dmitry Stogov
323b2733f6 Fixed compilation warnings 2016-06-22 00:40:50 +03:00
Stanislav Malyshev
3e0397c25c Merge branch 'PHP-7.0'
* PHP-7.0:
  iFixed bug #72446 - Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow
  update NEWS
  fix tests
  fix build
  Fix bug #72455:  Heap Overflow due to integer overflows
  Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize
  Fixed ##72433: Use After Free Vulnerability in PHP's GC algorithm and unserialize
  Fix bug #72407: NULL Pointer Dereference at _gdScaleVert
  Fix bug #72402: _php_mb_regex_ereg_replace_exec - double free
  Fix bug #72298	pass2_no_dither out-of-bounds access
  Fixed #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow
  Fix bug #72262 - do not overflow int
  Fix bug #72400 and #72403 - prevent signed int overflows for string lengths
  Fix bug #72275: don't allow smart_str to overflow int
  Fix bug #72340: Double Free Courruption in wddx_deserialize
  Fix bug #72321 - use efree() for emalloc allocation
  5.6.23RC1
  fix NEWS
  set versions
2016-06-21 00:27:01 -07:00
Stanislav Malyshev
8705254f2d Merge branch 'PHP-7.0.8' into PHP-7.0
* PHP-7.0.8:
  iFixed bug #72446 - Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow
  update NEWS
  fix tests
  fix build
  Fix bug #72455:  Heap Overflow due to integer overflows
  Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize
  Fixed ##72433: Use After Free Vulnerability in PHP's GC algorithm and unserialize
  Fix bug #72407: NULL Pointer Dereference at _gdScaleVert
  Fix bug #72402: _php_mb_regex_ereg_replace_exec - double free
  Fix bug #72298	pass2_no_dither out-of-bounds access
  Fixed #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow
  Fix bug #72262 - do not overflow int
  Fix bug #72400 and #72403 - prevent signed int overflows for string lengths
  Fix bug #72275: don't allow smart_str to overflow int
  Fix bug #72340: Double Free Courruption in wddx_deserialize
  Fix bug #72321 - use efree() for emalloc allocation
  5.6.23RC1
  fix NEWS
  set versions

Conflicts:
	configure.in
	main/php_version.h
2016-06-21 00:25:49 -07:00
Stanislav Malyshev
2a65544f78 Merge branch 'PHP-5.6.23' into PHP-7.0.8
* PHP-5.6.23: (24 commits)
  iFixed bug #72446 - Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow
  update NEWS
  fix tests
  fix build
  Fix bug #72455:  Heap Overflow due to integer overflows
  Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize
  Fixed ##72433: Use After Free Vulnerability in PHP's GC algorithm and unserialize
  Fix bug #72407: NULL Pointer Dereference at _gdScaleVert
  Fix bug #72402: _php_mb_regex_ereg_replace_exec - double free
  Fix bug #72298	pass2_no_dither out-of-bounds access
  Fixed #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow
  Fix bug #72262 - do not overflow int
  Fix bug #72400 and #72403 - prevent signed int overflows for string lengths
  Fix bug #72275: don't allow smart_str to overflow int
  Fix bug #72340: Double Free Courruption in wddx_deserialize
  update NEWS
  Fix #66387: Stack overflow with imagefilltoborder
  Fix bug #72321 - use efree() for emalloc allocation
  5.6.23RC1
  Fix bug #72140 (segfault after calling ERR_free_strings())
  ...

Conflicts:
	configure.in
	ext/mbstring/php_mbregex.c
	ext/mcrypt/mcrypt.c
	ext/spl/spl_array.c
	ext/spl/spl_directory.c
	ext/standard/php_smart_str.h
	ext/standard/string.c
	ext/standard/url.c
	ext/wddx/wddx.c
	ext/zip/php_zip.c
	main/php_version.h
2016-06-21 00:24:32 -07:00
Stanislav Malyshev
7dde353ee7 Merge branch 'PHP-5.5' into PHP-5.6.23
* PHP-5.5:
  Fixed bug #72446 - Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow
  update NEWS
  fix tests
  fix build
  Fix bug #72455:  Heap Overflow due to integer overflows
  Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize
  Fixed ##72433: Use After Free Vulnerability in PHP's GC algorithm and unserialize
  Fix bug #72407: NULL Pointer Dereference at _gdScaleVert
  Fix bug #72402: _php_mb_regex_ereg_replace_exec - double free
  Fix bug #72298	pass2_no_dither out-of-bounds access
  Fixed #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow
  Fix bug #72262 - do not overflow int
  Fix bug #72400 and #72403 - prevent signed int overflows for string lengths
  Fix bug #72275: don't allow smart_str to overflow int
  Fix bug #72340: Double Free Courruption in wddx_deserialize
  update NEWS
  Fix #66387: Stack overflow with imagefilltoborder
  Skip test which is 64bits only
  5.5.37 now

Conflicts:
	configure.in
	ext/mcrypt/mcrypt.c
	ext/spl/spl_directory.c
	main/php_version.h
2016-06-21 00:01:48 -07:00
Stanislav Malyshev
5b597a2e5b Fix bug #72402: _php_mb_regex_ereg_replace_exec - double free 2016-06-18 21:48:39 -07:00
Xinchen Hui
85fd260916 Merge branch 'PHP-7.0'
* PHP-7.0:
  Fixed(attempt to) bug #72405 (mb_ereg_replace - mbc_to_code (oniguruma) - oob read access)
2016-06-15 14:55:43 +08:00
Xinchen Hui
999a3553d5 Fixed(attempt to) bug #72405 (mb_ereg_replace - mbc_to_code (oniguruma) - oob read access)
according to ext/mbstring/oniguruma/enc/utf8.c, max bytes are 6
2016-06-15 14:54:57 +08:00
Xinchen Hui
14e790a075 Merge branch 'PHP-7.0' 2016-06-13 18:20:37 -07:00
Xinchen Hui
3d56418722 Fixed bug #72399 (Use-After-Free in MBString (search_re)) 2016-06-13 18:20:26 -07:00
Aaron Piotrowski
771e5cc247 Replace zend_ce_error with NULL and replace more E_ERROR with thrown Error 2016-06-13 09:02:17 -05:00
Aaron Piotrowski
e3c681aa5c Merge branch 'master' into throw-error-in-extensions 2016-06-10 22:02:23 -05:00
Xinchen Hui
23e362a46e Merge branch 'PHP-7.0'
* PHP-7.0:
  Fixed bug #72164 (Null Pointer Dereference - mb_ereg_replace)
2016-05-05 17:27:58 +08:00
Xinchen Hui
395863b1d1 Fixed bug #72164 (Null Pointer Dereference - mb_ereg_replace) 2016-05-05 17:27:34 +08:00
Francois Laupretre
882f97042b mb_ereg_search_setpos(): Add support for negative position
Also add missing test for this function
2016-03-09 14:41:38 +01:00
Lior Kaplan
ed35de784f Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Happy new year (Update copyright to 2016)
2016-01-01 19:48:25 +02:00
Lior Kaplan
49493a2dcf Happy new year (Update copyright to 2016) 2016-01-01 19:21:47 +02:00
Nikita Popov
1287c48082 Fix/improve zpp usage
The ext/interbase changes are done blindly, fingers crossed.

Some of these are bug fixes, some make zpp usage more idiomatic.
2015-10-02 09:35:00 +02:00
Nikita Popov
5c95226d50 Various warning fixes 2015-07-17 20:18:25 +02:00
Aaron Piotrowski
7ec1e17464 Update memory freeing and other issues, revert some changes 2015-07-05 23:25:53 -05:00
Aaron Piotrowski
907476f34c Convert E_ERROR to thrown Error in extensions 2015-07-05 12:16:57 -05:00
Dmitry Stogov
4a2e40bb86 Use ZSTR_ API to access zend_string elements (this is just renaming without semantick changes). 2015-06-30 04:05:24 +03:00
Xinchen Hui
2505aea153 Fixed valgrind issue in mb_ereg_replace_variation1.phpt 2015-01-29 19:28:46 +08:00
Xinchen Hui
fc33f52d8c bump year 2015-01-15 23:27:30 +08:00
Xinchen Hui
0579e8278d bump year 2015-01-15 23:26:37 +08:00
Xinchen Hui
73c1be2653 Bump year 2015-01-15 23:26:03 +08:00
Stanislav Malyshev
b7a7b1a624 trailing whitespace removal 2015-01-10 15:07:38 -08:00