Commit graph

39603 commits

Author SHA1 Message Date
Dmitry Stogov
a2f8a7675b Prevent HashTable compaction below HT_MIN_SIZE (this may lead to hash collisions). 2015-09-02 13:03:31 +03:00
Stanislav Malyshev
9c35f87e9a Temporary add XFAILs, will fix soon 2015-09-02 01:23:40 -07:00
Stanislav Malyshev
6640aded24 fix memory leak 2015-09-02 01:21:47 -07:00
Stanislav Malyshev
c18f662e3c Merge remote-tracking branch 'origin/master'
* origin/master:
  Add test for ReflectionMethod::getPrototype_basic()
  Added two tests to check the main functionallity of recode extension
  Doubles are not refcounted
  Fix #32490: constructor of mysqli has wrong name
2015-09-02 01:00:16 -07:00
Stanislav Malyshev
9b1a224d4e Merge branch 'PHP-5.6'
* PHP-5.6: (21 commits)
  fix unit tests
  update NEWS
  add NEWS for fixes
  Improve fix for #70172
  Fix bug #70312 - HAVAL gives wrong hashes in specific cases
  fix test
  add test
  Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
  Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage
  Fix bug #70172 - Use After Free Vulnerability in unserialize()
  Fix bug #70388 - SOAP serialize_function_call() type confusion
  Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories
  Improve fix for #70385
  Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)
  Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes)
  Fix bug #70219 (Use after free vulnerability in session deserializer)
  Fix bug ##70284 (Use after free vulnerability in unserialize() with GMP)
  Fix for bug #69782
  Add CVE IDs asigned (post release) to PHP 5.4.43
  Add CVE IDs asigned to #69085 (PHP 5.4.39)
  ...

Conflicts:
	ext/exif/exif.c
	ext/gmp/gmp.c
	ext/pcre/php_pcre.c
	ext/session/session.c
	ext/session/tests/session_decode_variation3.phpt
	ext/soap/soap.c
	ext/spl/spl_observer.c
	ext/standard/var.c
	ext/standard/var_unserializer.c
	ext/standard/var_unserializer.re
	ext/xsl/xsltprocessor.c
2015-09-02 00:37:20 -07:00
marcosptf
519016096f Add test for ReflectionMethod::getPrototype_basic() 2015-09-02 00:28:46 +02:00
Daniel Persson
c98b88aafe Added two tests to check the main functionallity of recode extension 2015-09-02 00:11:45 +02:00
Christoph M. Becker
b15eff6386 Fix #32490: constructor of mysqli has wrong name
As of PHP 7 old style constructor names are deprecated, so we rename
mysqli::mysqli() to mysqli::__construct().
2015-09-01 21:44:16 +02:00
Stanislav Malyshev
3fe509443c Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  fix unit tests
2015-09-01 12:24:14 -07:00
Stanislav Malyshev
4aeff30337 Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
  fix unit tests
2015-09-01 12:23:55 -07:00
Stanislav Malyshev
1922c650ba fix unit tests 2015-09-01 12:23:22 -07:00
Stanislav Malyshev
c19d59c550 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  update NEWS
  add NEWS for fixes
  Improve fix for #70172
  Fix bug #70312 - HAVAL gives wrong hashes in specific cases
  fix test
  add test
  Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
  Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage
  Fix bug #70172 - Use After Free Vulnerability in unserialize()
  Fix bug #70388 - SOAP serialize_function_call() type confusion
  Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories
  Improve fix for #70385
  Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)
  Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes)
  Fix bug #70219 (Use after free vulnerability in session deserializer)
  Fix for bug #69782
  Add CVE IDs asigned (post release) to PHP 5.4.43
  Add CVE IDs asigned to #69085 (PHP 5.4.39)
  5.4.45 next

Conflicts:
	ext/pcre/php_pcre.c
	ext/standard/var_unserializer.c
	ext/standard/var_unserializer.re
	ext/zip/php_zip.c
2015-09-01 12:06:41 -07:00
Stanislav Malyshev
45e7e79485 Merge branch '70284' into PHP-5.6
* 70284:
  Fix bug ##70284 (Use after free vulnerability in unserialize() with GMP)
2015-09-01 12:05:02 -07:00
Stanislav Malyshev
33d3acaae7 Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
  Improve fix for #70172
  Fix bug #70312 - HAVAL gives wrong hashes in specific cases
  fix test
  add test
  Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
  Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage
  Fix bug #70172 - Use After Free Vulnerability in unserialize()
  Fix bug #70388 - SOAP serialize_function_call() type confusion
  Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories
  Improve fix for #70385
  Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)
  Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes)
  Fix bug #70219 (Use after free vulnerability in session deserializer)
  Fix for bug #69782
  Add CVE IDs asigned (post release) to PHP 5.4.43
  Add CVE IDs asigned to #69085 (PHP 5.4.39)
  5.4.45 next

Conflicts:
	configure.in
	ext/pcre/php_pcre.c
	ext/standard/var_unserializer.c
	ext/standard/var_unserializer.re
	main/php_version.h
2015-09-01 11:42:19 -07:00
Stanislav Malyshev
7c31203935 Improve fix for #70172 2015-09-01 11:38:39 -07:00
Dmitry Stogov
d8eee72a84 Fixed possible caching with invalid key value 2015-09-01 12:56:33 +03:00
Stanislav Malyshev
1390a5812b Fix bug #70312 - HAVAL gives wrong hashes in specific cases 2015-09-01 01:16:30 -07:00
Stanislav Malyshev
906f19f136 fix test 2015-09-01 00:59:31 -07:00
Dmitry Stogov
bb4b50636c Fixed one more problem related to bug #70187 (Notice: unserialize(): Unexpected end of serialized data) 2015-09-01 10:39:00 +03:00
Stanislav Malyshev
c8f07ad477 add test 2015-09-01 00:26:12 -07:00
Stanislav Malyshev
259057b2a4 Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList 2015-09-01 00:20:45 -07:00
Stanislav Malyshev
f06a069c46 Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage 2015-09-01 00:14:15 -07:00
Stanislav Malyshev
e8429400d4 Fix bug #70172 - Use After Free Vulnerability in unserialize() 2015-08-31 23:26:14 -07:00
Stanislav Malyshev
e201f01ac1 Fix bug #70388 - SOAP serialize_function_call() type confusion 2015-08-31 21:06:03 -07:00
Dmitry Stogov
89aa1b7392 Ensure proper data alignment 2015-08-31 13:56:42 +03:00
Xinchen Hui
9da99d8c5f Merge branch 'PHP-5.6' of git.php.net:/php-src into PHP-5.6 2015-08-30 05:34:15 -07:00
Xinchen Hui
014abbc840 Merge branch 'PHP-5.6'
Conflicts:
	ext/pdo/pdo_dbh.c
	ext/pdo/php_pdo_driver.h
2015-08-30 05:32:37 -07:00
Xinchen Hui
ef1bd8f0e6 Fixed bug #70389 (PDO constructor changes unrelated variables) 2015-08-30 05:02:38 -07:00
Stanislav Malyshev
f9c2bf73ad Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories 2015-08-30 00:38:08 -07:00
Stanislav Malyshev
ce2c67c8e8 Improve fix for #70385 2015-08-29 23:01:36 -07:00
Matteo Beccati
cb5582d3c1 Merge branch 'PHP-5.6'
* PHP-5.6:
  Added missing skipif for phar+zlib test
2015-08-29 10:48:53 +02:00
Matteo Beccati
9d816f1bcf Added missing skipif for phar+zlib test 2015-08-29 10:47:02 +02:00
Matteo Beccati
6b3e44369d Fixed bug #70386 Can't compile on NetBSD because of missing WCONTINUED
since 90114a3e93
2015-08-29 08:07:45 +02:00
Stanislav Malyshev
03964892c0 Fix bug #70345 (Multiple vulnerabilities related to PCRE functions) 2015-08-28 22:52:50 -07:00
Stanislav Malyshev
64043cb9e5 Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes) 2015-08-28 22:25:41 -07:00
Anatol Belski
00eebd7a47 fix dir separator in test 2015-08-28 11:39:26 +02:00
Anatol Belski
5d2294e8b8 fix path separator in test 2015-08-28 11:38:16 +02:00
Anatol Belski
ebdd9cf6e8 fix test 2015-08-28 11:29:38 +02:00
Jakub Zelenka
6b9f31ab74 Merge branch 'PHP-5.6' 2015-08-27 20:17:33 +01:00
Jakub Zelenka
ad028ebc11 Use new range checks in openssl ext 2015-08-26 19:55:29 +01:00
Anatol Belski
150dead2d9 add range check to ext/soap 2015-08-26 16:39:54 +02:00
Anatol Belski
1553ce2093 add some range checks to pcre 2015-08-26 16:39:53 +02:00
Anatol Belski
ce3e3f7884 more range checks in ext/tidy 2015-08-26 16:39:52 +02:00
Anatol Belski
871acceace add range checks to ext/tidy 2015-08-26 16:39:51 +02:00
Anatol Belski
201afce875 add some range checks to ext/dom 2015-08-26 16:39:50 +02:00
Anatol Belski
a3dceb485a fix test 2015-08-26 16:39:48 +02:00
Anatol Belski
2c523f21c9 add range checks to simplexml 2015-08-26 16:39:47 +02:00
Dmitry Stogov
1f0f768e3f Avoid duplication 2015-08-26 14:53:41 +03:00
Christopher Jones
a52902faf4 Squash some more PHP 7 diffs and improve test portability (Senthil) 2015-08-26 21:22:58 +10:00
Dmitry Stogov
25f9e25526 Fixed bug #70187 (Notice: unserialize(): Unexpected end of serialized data) 2015-08-26 03:27:05 +03:00