Christoph M. Becker
db1ef5cb00
Merge branch 'PHP-5.6' into PHP-7.0
2016-08-20 02:14:49 +02:00
Christoph M. Becker
9164dc11e2
Fix #72714 : _xml_startElementHandler() segmentation fault
...
The issue is caused by an integer overflow when the `long` passed as
XML_OPTION_SKIP_TAGSTART is assigned to `xml_parser::toffset` which is
declared as `int`. We can simply work around this issue, by clipping
resulting negative values to 0 (and raising a notice in this case), because
the reasonable range for this value is certainly catered to by positive
`int`s.
However, there still remains the issue that `xml_parser::toffset` is later
added to `char *`s, which can cause OOB reads, so we make sure that the
upper bound never exceeds the strlen(). We eschew optimizing `SKIP_TAGSTART`
wrt. to the potentially duplicate strlen() call, because that code path is
unexpected anyway.
2016-08-20 01:58:08 +02:00
Xinchen Hui
f3231a7c76
Unused var
2016-08-17 11:16:48 +08:00
Christoph M. Becker
6202b47e63
Merge branch 'PHP-5.6' into PHP-7.0
2016-08-17 01:22:11 +02:00
Christoph M. Becker
1bb92d5212
#72085 : SEGV on unknown address zif_xml_parse
...
We better make sure that the ZVALs we're accessing as arrays are indeed
arrays.
2016-08-17 00:42:45 +02:00
Joe Watkins
b165114013
fix #72206 (xml_parser_create/xml_parser_free leaks mem)
2016-05-14 08:10:16 +01:00
Anatol Belski
33d41da347
Merge branch 'PHP-5.6' into PHP-7.0
...
* PHP-5.6:
Fix memory leak
Fix bug #72099 : xml_parse_into_struct segmentation fault
5.5.36 now
Fix bug #72094 - Out of bounds heap read access in exif header processing
Fix bug #72093 : bcpowmod accepts negative scale and corrupts _one_ definition
Fix bug #72061 - Out-of-bounds reads in zif_grapheme_stripos with negative offset
Fix for bug #71912 (libgd: signedness vulnerability)
Typo in NEWS
2016-04-27 11:45:29 +02:00
Stanislav Malyshev
e315a162da
Merge branch 'PHP-5.5' into PHP-5.6
...
* PHP-5.5:
Fix memory leak
Fix bug #72099 : xml_parse_into_struct segmentation fault
5.5.36 now
Fix bug #72094 - Out of bounds heap read access in exif header processing
Fix bug #72093 : bcpowmod accepts negative scale and corrupts _one_ definition
Fix bug #72061 - Out-of-bounds reads in zif_grapheme_stripos with negative offset
Fix for bug #71912 (libgd: signedness vulnerability)
Typo in NEWS
Conflicts:
configure.in
main/php_version.h
2016-04-26 23:48:41 -07:00
Stanislav Malyshev
dccda88f27
Fix bug #72099 : xml_parse_into_struct segmentation fault
2016-04-26 22:46:28 -07:00
Nikita Popov
1ac152938c
Move semicolon into TSRMLS_CACHE_EXTERN/DEFINE
...
Also re bug #71575 .
2016-03-03 16:50:01 +01:00
Stanislav Malyshev
57b997ebf9
Fix bug #71637 : Multiple Heap Overflow due to integer overflows
2016-02-21 23:14:29 -08:00
Lior Kaplan
ed35de784f
Merge branch 'PHP-5.6' into PHP-7.0
...
* PHP-5.6:
Happy new year (Update copyright to 2016)
2016-01-01 19:48:25 +02:00
Lior Kaplan
49493a2dcf
Happy new year (Update copyright to 2016)
2016-01-01 19:21:47 +02:00
Xinchen Hui
4171a8f6c6
Internal function argumensts cleanup (strict_types)
2015-12-12 22:52:37 -08:00
Dmitry Stogov
4a2e40bb86
Use ZSTR_ API to access zend_string elements (this is just renaming without semantick changes).
2015-06-30 04:05:24 +03:00
Anatol Belski
663074b6b1
cleanup mod version macros and mod defs, round x
2015-03-23 21:30:22 +01:00
Anatol Belski
ffabfc703d
fix exports
2015-03-23 15:09:06 +01:00
Dmitry Stogov
d146d15003
Optimize zend_string_realloc() add more specialized versions zend_string_extend() and zend_string_truncate()
2015-03-20 02:02:42 +03:00
Anatol Belski
af3ca74501
made ZEND_TSRMLS_CACHE_* macros look like function calls
...
which also comply with the current semantics for such macros
2015-02-16 17:19:32 +01:00
Xinchen Hui
942809909e
Cleanup resource handling APIs
2015-02-02 13:23:16 +08:00
Xinchen Hui
fc33f52d8c
bump year
2015-01-15 23:27:30 +08:00
Xinchen Hui
0579e8278d
bump year
2015-01-15 23:26:37 +08:00
Xinchen Hui
73c1be2653
Bump year
2015-01-15 23:26:03 +08:00
Anatol Belski
bdeb220f48
first shot remove TSRMLS_* things
2014-12-13 23:06:14 +01:00
Anatol Belski
5749b4a997
ext/libxml, ext/xml and ext/soap use static tsrmls pointer
2014-10-17 14:31:17 +02:00
Anatol Belski
c00424e427
bring back all the TSRMLS_FETCH() stuff
...
for better comparability with the mainstream
2014-10-15 09:37:55 +02:00
Anatol Belski
42ddd5f314
cleanup TSRMLS_FETCH in ext/xml
2014-09-26 20:57:14 +02:00
Johannes Schlüter
d0cb715373
s/PHP 5/PHP 7/
2014-09-19 18:33:14 +02:00
Anatol Belski
a7482fd2bf
make xml_utf8_ encode/decode work with size_t
2014-09-14 21:38:46 +02:00
Anatol Belski
6db8d4f829
's' works with size_t round 3
2014-08-27 20:49:36 +02:00
Anatol Belski
3234480827
first show to make 's' work with size_t
2014-08-27 20:49:31 +02:00
Anatol Belski
202e8db1dc
fixed several long vs zend_long casts
2014-08-26 11:26:53 +02:00
Anatol Belski
af59e92b24
master renames phase 7
2014-08-25 21:51:49 +02:00
Anatol Belski
c3e3c98ec6
master renames phase 1
2014-08-25 19:24:55 +02:00
Anatol Belski
ff853d2fe0
fix zpp
2014-08-21 15:47:52 +02:00
Anatol Belski
97c5172ac7
Merge remote-tracking branch 'php/master'
...
Conflicts:
ext/date/lib/parse_date.c
2014-08-19 08:27:43 +02:00
Anatol Belski
63d3f0b844
basic macro replacements, all at once
2014-08-19 08:07:31 +02:00
Dmitry Stogov
7dbb8117e4
Fixed encoding support
2014-08-19 09:28:13 +04:00
Dmitry Stogov
a08b7b7701
cleanup
2014-08-13 19:43:34 +04:00
Dmitry Stogov
c1965f58d4
Use reference counting instead of zval duplication
2014-06-05 16:04:11 +04:00
Dmitry Stogov
0427ae08fb
cleanup
2014-06-03 00:36:31 +04:00
Dmitry Stogov
e75f2d1f76
Fixed bug introduced during conversion to "phpng"
2014-05-07 16:15:29 +04:00
Dmitry Stogov
b54dcab377
Initialize "retval"
2014-05-07 15:36:01 +04:00
Nikita Popov
592aa37f67
Fix memory error in ext/xml
2014-05-05 17:43:13 +02:00
Xinchen Hui
a636c4c03f
Fixed segfault in _xml_xmlchar_zval
2014-05-05 19:52:42 +08:00
Xinchen Hui
fa6f6c8807
Fixed Reference handling in xml_parse_into_struct
2014-05-05 19:45:50 +08:00
Xinchen Hui
d8651fbe1c
Make they are in the same style of Z_ISREF
2014-05-03 16:08:58 +08:00
Xinchen Hui
5984f95d8f
Refactor XML (incompleted)
2014-05-03 15:58:09 +08:00
Dmitry Stogov
050d7e38ad
Cleanup (1-st round)
2014-04-15 15:40:40 +04:00
Xinchen Hui
c081ce628f
Bump year
2014-01-03 11:08:10 +08:00
