Commit graph

99637 commits

Author SHA1 Message Date
Stanislav Malyshev
7dc8b5e7ae Fix bug #73276 - crash in openssl_random_pseudo_bytes function
(cherry picked from commit 85a22a0af0)
2016-10-12 15:55:42 +02:00
Stanislav Malyshev
4ef79370a8 Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML()
(cherry picked from commit 96a8cf8e1b)
2016-10-12 15:40:21 +02:00
Stanislav Malyshev
01280f8deb Fix for #73240 - Write out of bounds at number_format
(cherry picked from commit 8259130b6b)
2016-10-12 14:55:00 +02:00
Anatol Belski
aaa5d07365 avoid strlen 2016-10-12 13:28:23 +02:00
Stanislav Malyshev
b26b02b2df Bug #73218: add mitigation for ICU int overflow
(cherry picked from commit d946d10293)
2016-10-12 13:22:51 +02:00
Stanislav Malyshev
87a8240b5a Add more locale length checks, due to ICU bugs.
(cherry picked from commit d3eb58332a)
2016-10-12 13:11:16 +02:00
Stanislav Malyshev
d1e878f272 Fix bug #73150: missing NULL check in dom_document_save_html
(cherry picked from commit 1c0e9126fb)
2016-10-12 12:19:41 +02:00
Xinchen Hui
b48d6e0c5a Merge branch 'PHP-7.1'
* PHP-7.1:
  Fixed bug #73288 (Segfault in __clone > Exception.toString > __get)
2016-10-12 16:08:41 +08:00
Xinchen Hui
d19898b298 Fixed bug #73288 (Segfault in __clone > Exception.toString > __get)
Actually this is caused by optimization(opcache)
2016-10-12 16:07:56 +08:00
Sara Golemon
43ccf23d70 Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.

Catch the bailout, clear the variable, then continue bailing.

Closes https://bugs.php.net/bug.php?id=73188
2016-10-11 21:55:01 -07:00
Sara Golemon
2ad38bfae3 Merge branch 'PHP-7.1'
* PHP-7.1:
  Clear FG(user_stream_current_filename) when bailing out
2016-10-11 21:53:09 -07:00
Sara Golemon
9f86cdaf7f Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.

Catch the bailout, clear the variable, then continue bailing.

Closes https://bugs.php.net/bug.php?id=73188
2016-10-11 21:46:02 -07:00
Sara Golemon
4d11a8eedf Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.

Catch the bailout, clear the variable, then continue bailing.

Closes https://bugs.php.net/bug.php?id=73188
2016-10-11 21:44:14 -07:00
Sara Golemon
b041bebb88 Change Big Endian backup implementations to use signed indexes
load64() counted down from 7..0, but the decrement turned 0 into 255.
This means the loop would never terminate on Big Endian systems.

Just use signed char integers since we're only dealing with values from 0..7 anyway.

Closes https://bugs.php.net/bug.php?id=73282
2016-10-11 20:43:02 -07:00
Stanislav Malyshev
1bdb30a429 Merge branch 'PHP-7.0.12' into PHP-7.0
* PHP-7.0.12:
  set versions and release date
  sync NEWS
  Revert "Fixed bug #73067 (__debugInfo crashes when throwing an exception)"
  Fix for #73240 - Write out of bounds at number_format
  Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object as key
  set versions
  Fix bug #73091 - Unserializing DateInterval object may lead to __toString invocation
2016-10-11 16:46:51 -07:00
Stanislav Malyshev
9c675607e6 Merge remote-tracking branch 'origin/PHP-7.0.12' into PHP-7.0.12
* origin/PHP-7.0.12: (99 commits)
  set versions and release date
  sync NEWS
  Revert "Fixed bug #73067 (__debugInfo crashes when throwing an exception)"
  set versions
  update NEWS
  Ignore potentially misleading dberr values
  update NEWS
  Fixed bug #73172 parse error: Invalid numeric literal
  Fix #53745: cgi.discard_path option is missing from php.ini
  update libs_versions.txt
  update libs_versions.txt
  Fixed bug #73156 (segfault on undefined function)
  Add an include path for freetype which is relevant for cmake builds
  Fix test_image_equals_file() wrt. palette images
  Fixed bug #73163
  Fix #73161: imagecreatefromgd2() may leak memory
  Fix #73159: imagegd2(): unrecognized formats may result in corrupted files
  Fix #73155: imagegd2() writes wrong chunk sizes on boundaries
  Fix #73157 (again): imagegd2() ignores 3rd param if 4 are given
  Fix #73157: imagegd2() ignores 3rd param if 4 are given
  ...
2016-10-11 16:27:13 -07:00
Stanislav Malyshev
689a9b8def Merge branch 'PHP-5.6.27' into PHP-5.6
* PHP-5.6.27:
  Fix tests
  fix tsrm
  Fix bug #73284 - heap overflow in php_ereg_replace function
  Fix bug #73276 - crash in openssl_random_pseudo_bytes function
  Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML()
  fix bug #73275 - crash in openssl_encrypt function
  Fix for #73240 - Write out of bounds at number_format
  Bug #73218: add mitigation for ICU int overflow
  Add more locale length checks, due to ICU bugs.
  Fix bug #73208 - another missing length check
  Fix bug #73190: memcpy negative parameter _bc_new_num_ex
  Fix bug #73189 - Memcpy negative size parameter php_resolve_path
  Fixed bug #73174 - heap overflow in php_pcre_replace_impl
  Fix bug #73150: missing NULL check in dom_document_save_html
  Fix bug #73147: Use After Free in PHP7 unserialize()
  Fix bug #73082
  Fix bug #73073 - CachingIterator null dereference when convert to string
2016-10-11 16:26:35 -07:00
Stanislav Malyshev
082d1f2375 Fix tests 2016-10-11 16:18:08 -07:00
Stanislav Malyshev
c1112ff323 fix tsrm 2016-10-11 14:39:16 -07:00
Stanislav Malyshev
21452a5401 Fix bug #73284 - heap overflow in php_ereg_replace function 2016-10-11 14:16:51 -07:00
Stanislav Malyshev
85a22a0af0 Fix bug #73276 - crash in openssl_random_pseudo_bytes function 2016-10-11 13:37:47 -07:00
Stanislav Malyshev
96a8cf8e1b Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML() 2016-10-11 13:30:52 -07:00
Stanislav Malyshev
8822f7c9f0 fix bug #73275 - crash in openssl_encrypt function 2016-10-11 13:19:20 -07:00
Adam Baratz
6ddfce116b Fix tests affected by 32b6154a61 2016-10-11 10:15:50 -04:00
Fabrice Fontaine
e6bbc00964 Fix pthreads detection when cross-compiling
pthreads are not working when cross-compiling, indeed configure
sets pthreads_working to no if cross_compiling is detected.
This behavior is implemented in PTHREADS_CHECK. This function call
AC_CACHE_CHECK twice to retrieve ac_cv_pthreads_cflags and
ac_cv_pthreads_lib.
In these calls, the function PTHREADS_CHECK_COMPILE will call AC_TRY_RUN
function which will update the global pthreads_working variable.
This is not compliant with autoconf AC_CACHE_CHECK rules which specify
that "The commands-to-set-it must have no side effects except for
setting the variable cache-id".

So, this patch replaces pthread_working assignments with assignments on
a new local pthread_checked variable. Value of ptreads_working is
computed outside AC_CACHE_CHECK function depending on value of
ac_cv_pthreads_cflags and ac_cv_pthreads_lib.

Moreover, AC_TRY_RUN call is replaced by AC_TRY_LINK which will work
when cross-compiling.

Without this modification, thread safety option (--enable-maintainer-zts)
can not be enabled on embedded buildsystems such as buildroot.

Signed-off-by: Fabrice Fontaine <fabrice.fontaine@orange.com>
2016-10-11 15:16:26 +02:00
Dmitry Stogov
087eef5e61 Merge branch 'PHP-7.1'
* PHP-7.1:
  Fixed referencecounter inference rules
2016-10-11 15:43:42 +03:00
Dmitry Stogov
6046a99b97 Fixed referencecounter inference rules 2016-10-11 15:43:23 +03:00
Anatol Belski
ca6e35f7a5 Merge branch 'PHP-7.1'
* PHP-7.1:
  update NEWS
2016-10-11 11:42:43 +02:00
Anatol Belski
b76aa08935 Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  update NEWS
2016-10-11 11:42:27 +02:00
Anatol Belski
5899f76a7d update NEWS 2016-10-11 11:41:45 +02:00
Anatol Belski
92c55f1580 set versions and release date 2016-10-11 11:26:32 +02:00
Anatol Belski
a5f40e2656 sync NEWS 2016-10-11 11:25:00 +02:00
Anatol Belski
8c9f639a1d Revert "Fixed bug #73067 (__debugInfo crashes when throwing an exception)"
This reverts commit 2d8ab51576.
2016-10-11 11:24:08 +02:00
Anatol Belski
05f394b950 Merge branch 'PHP-7.1'
* PHP-7.1:
  update NEWS
  restore NEWS to the state before breach
  update NEWS
  update NEWS
2016-10-11 11:03:42 +02:00
Anatol Belski
44fb123e5b Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  update NEWS
  update NEWS
2016-10-11 11:03:00 +02:00
Anatol Belski
076aa3c410 update NEWS 2016-10-11 11:01:55 +02:00
Anatol Belski
2629d24c38 restore NEWS to the state before breach 2016-10-11 11:00:52 +02:00
Stanislav Malyshev
3b5262ec4c Fix for #73240 - Write out of bounds at number_format 2016-10-10 23:49:28 -07:00
Stanislav Malyshev
8259130b6b Fix for #73240 - Write out of bounds at number_format 2016-10-10 23:42:50 -07:00
Stanislav Malyshev
61cdd1255d Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object as key 2016-10-10 22:54:29 -07:00
Dmitry Stogov
c8e392c085 Merge branch 'PHP-7.1'
* PHP-7.1:
  Fixed referencecounter inference rules
2016-10-11 01:58:59 +03:00
Dmitry Stogov
fae7d6b9bb Fixed referencecounter inference rules 2016-10-11 01:58:30 +03:00
Adam Baratz
32b6154a61 Fix #73234: Emulated statements let value dictate parameter type
The prepared statement emulator (pdo_sql_parser.*) figures out how to quote
each query parameter. The intended type is specified by the PDO::PARAM_*
consts, but this direction wasn't always followed. In practice, queries could
work as expected, but subtle errors could result. For example, a numeric string
bound as PDO::PARAM_INT would be sent to a driver's quote function. While these
functions are told which type is expected, they generally assume values are
being quoted as strings. This can result in implicit casts, which are bad for
performance.

This commit includes the following changes:
 - Cast values marked as bool/int/null to the appropriate type and bypass the
   driver's quote function.
 - Save some memory by dropping the temporary zval used for casting.
 - Avoid a memory leak if the driver's quote function produces an error.
 - Appropriate test suite updates.
2016-10-10 18:16:17 -04:00
Anatol Belski
29a089d3c9 update NEWS 2016-10-10 20:57:57 +02:00
Anatol Belski
bf400108d9 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  update NEWS
2016-10-10 20:57:23 +02:00
Anatol Belski
4165d97606 update NEWS 2016-10-10 20:55:44 +02:00
Anatol Belski
f51405cd7e Merge branch 'PHP-7.1'
* PHP-7.1:
  add test for bug #73037
2016-10-10 16:04:35 +02:00
Anatol Belski
a8a308f627 Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  add test for bug #73037
2016-10-10 16:04:09 +02:00
Anatol Belski
62c68f7483 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  add test for bug #73037
2016-10-10 16:02:30 +02:00
Anatol Belski
256b150a96 add test for bug #73037 2016-10-10 15:59:52 +02:00