Commit Graph

622 Commits

Author SHA1 Message Date
Stanislav Malyshev
8c2b3b0568 Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2:
  Fix libmagic buffer overflow issue (CVE-2019-18218)
  bump version
  set versions for release
2019-10-28 20:47:44 -07:00
Stanislav Malyshev
2bdb13a1f7 Merge branch 'PHP-7.1' into PHP-7.2
* PHP-7.1:
  Fix libmagic buffer overflow issue (CVE-2019-18218)
  bump version
  set versions for release
2019-10-28 20:47:30 -07:00
Stanislav Malyshev
469820048d Fix libmagic buffer overflow issue (CVE-2019-18218)
Ported from 46a8443f76
2019-10-27 16:30:38 -07:00
Anatol Belski
b926690947 Fix typo 2019-06-29 13:30:35 +02:00
Joshua Westerheide
6cdeedb8de Add tests from fix #78183 from PHP-7.2 2019-06-29 13:29:53 +02:00
Joshua Westerheide
855bbc88c9 Fix #78183: finfo_file shows wrong mime-type for .tga file
Due to a bug in the underlying libmagic 5.31, .tga images returned mime type "image/x-tgaimage/x-tga".
2019-06-29 13:24:52 +02:00
Anatol Belski
3e92365fa2 Update libmagic.patch [skip ci] 2019-03-08 21:55:15 +01:00
Fabien Villepinte
d9a3cb0b36 Fix typo in libmagic version 2019-03-08 20:51:09 +01:00
Anatol Belski
65ffdc2adf Fixed bug #77576 pull the libmagic implementation of gmtime_r
PHP already has all the checks to handle the *_r function variants.
Thus, reusing it to get right symbols.
2019-03-08 20:32:15 +01:00
Anatol Belski
d874d4a15c Fixed bug #77346 webm files incorrectly detected as application/octet-stream
HEADSUP data from file 5.34 is used from now on
2018-12-28 13:25:40 +01:00
Anatol Belski
2a062f3c02 Rework magic data once more
The change reduces the input size on patterns using posix character
classes. It is still better than reverting to the patterns from the
older version, as the upstream data uses posix classes also in the later
versions. The input reduction speeds up the pattern matching in some
cases.

This patch is functionally almost same as upstream, but might show some diff
when the input is very long. While the magic data in the newer versions is
functionally an improvement, with jit=0 it might show a performance regression.
The slowdown is negligible in the normal usage and is still acceptable for the
malicious input. If some functional regressions show up, this patch should be
reverted and the tests timing should be adapted instead.
2018-11-14 22:23:24 +01:00
Anatol Belski
ee50461e4b Update libmagic.patch [ci skip] 2018-11-10 22:02:44 +01:00
Anatol Belski
1550451020 Update libmagic.patch [ci skip] 2018-11-10 22:01:49 +01:00
Anatol Belski
b50d93bc11 Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2:
  Fork test with pcre.jit=0
2018-11-10 20:07:25 +01:00
Anatol Belski
3fd46e19ac Fork test with pcre.jit=0 2018-11-10 20:06:47 +01:00
Anatol Belski
0e38909170 Rework magic data
Still upstream contains some slower patterns. Those might need to
be patched, if regressions arise.
2018-11-10 18:22:44 +01:00
Anatol Belski
992e4fbc65 Fix regex 2018-11-10 12:13:03 +01:00
Anatol Belski
9d77bf0978 Fix regex 2018-11-10 12:11:02 +01:00
Anatol Belski
60adea5496 Rework magic data
Avoid patching where vanilla data suffices. More precisely, avoid data
using [:space:] posix class in regex, as it is likely to cause performance
regressions.
2018-11-10 01:28:23 +01:00
Anatol Belski
22f71a66ec Sync one more upstream libmagic piece 2018-11-10 00:19:42 +01:00
Anatol Belski
a957af6c06 Update libmagic.patch [ci skip] 2018-11-05 22:25:31 +01:00
Anatol Belski
dbb2cce968 Update libmagic.patch [ci skip] 2018-11-05 22:24:27 +01:00
Anatol Belski
29dcf19f8b Declare function proto in header 2018-11-05 21:29:35 +01:00
Anatol Belski
0e33c2822c Declare function proto in header 2018-11-05 21:28:04 +01:00
Anatol Belski
c621182c42 Backport 7f5f4601 for 7.2 2018-11-04 16:57:55 +01:00
Anatol Belski
7f5f46013b Rework places in libmagic regarding previous CVE-2014-3538 fixes
CVE-2014-3538 was fixed upstream, but the old patch was still kept in
the PHP port. This patch causes performance regressions when PCRE JIT is
not enabled. This is fixed by applying the relevant original code from
the newer libmagic, which makes the old patch obsolete as the
CVE-2014-3538 tests still pass.
2018-11-04 13:11:28 +01:00
Peter Kokot
b746e69887 Sync leading and final newlines in *.phpt sections
This patch adds missing newlines, trims multiple redundant final
newlines into a single one, and trims redundant leading newlines in all
*.phpt sections.

According to POSIX, a line is a sequence of zero or more non-' <newline>'
characters plus a terminating '<newline>' character. [1] Files should
normally have at least one final newline character.

C89 [2] and later standards [3] mention a final newline:
"A source file that is not empty shall end in a new-line character,
which shall not be immediately preceded by a backslash character."

Although it is not mandatory for all files to have a final newline
fixed, a more consistent and homogeneous approach brings less of commit
differences issues and a better development experience in certain text
editors and IDEs.

[1] http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_206
[2] https://port70.net/~nsz/c/c89/c89-draft.html#2.1.1.2
[3] https://port70.net/~nsz/c/c99/n1256.html#5.1.1.2
2018-10-15 04:32:30 +02:00
Peter Kokot
f1d7e3ca0b Sync leading and final newlines in *.phpt sections
This patch adds missing newlines, trims multiple redundant final
newlines into a single one, and trims redundant leading newlines in all
*.phpt sections.

According to POSIX, a line is a sequence of zero or more non-' <newline>'
characters plus a terminating '<newline>' character. [1] Files should
normally have at least one final newline character.

C89 [2] and later standards [3] mention a final newline:
"A source file that is not empty shall end in a new-line character,
which shall not be immediately preceded by a backslash character."

Although it is not mandatory for all files to have a final newline
fixed, a more consistent and homogeneous approach brings less of commit
differences issues and a better development experience in certain text
editors and IDEs.

[1] http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_206
[2] https://port70.net/~nsz/c/c89/c89-draft.html#2.1.1.2
[3] https://port70.net/~nsz/c/c99/n1256.html#5.1.1.2
2018-10-15 04:31:31 +02:00
Peter Kokot
113213f027 Sync leading and final newlines in *.phpt sections
This patch adds missing newlines, trims multiple redundant final
newlines into a single one, and trims redundant leading newlines in all
*.phpt sections.

According to POSIX, a line is a sequence of zero or more non-' <newline>'
characters plus a terminating '<newline>' character. [1] Files should
normally have at least one final newline character.

C89 [2] and later standards [3] mention a final newline:
"A source file that is not empty shall end in a new-line character,
which shall not be immediately preceded by a backslash character."

Although it is not mandatory for all files to have a final newline
fixed, a more consistent and homogeneous approach brings less of commit
differences issues and a better development experience in certain text
editors and IDEs.

[1] http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_206
[2] https://port70.net/~nsz/c/c89/c89-draft.html#2.1.1.2
[3] https://port70.net/~nsz/c/c99/n1256.html#5.1.1.2
2018-10-15 04:29:24 +02:00
Peter Kokot
782352c54a Trim trailing whitespace in *.phpt 2018-10-14 19:45:12 +02:00
Peter Kokot
17ccbeec32 Trim trailing whitespace in *.phpt 2018-10-14 19:44:14 +02:00
Peter Kokot
7af945e271 Trim trailing whitespace in *.phpt 2018-10-14 19:43:12 +02:00
Peter Kokot
1c850bfcca Sync leading and final newlines in source code files
This patch adds missing newlines, trims multiple redundant final
newlines into a single one, and trims redundant leading newlines.

According to POSIX, a line is a sequence of zero or more non-' <newline>'
characters plus a terminating '<newline>' character. [1] Files should
normally have at least one final newline character.

C89 [2] and later standards [3] mention a final newline:
"A source file that is not empty shall end in a new-line character,
which shall not be immediately preceded by a backslash character."

Although it is not mandatory for all files to have a final newline
fixed, a more consistent and homogeneous approach brings less of commit
differences issues and a better development experience in certain text
editors and IDEs.

[1] http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_206
[2] https://port70.net/~nsz/c/c89/c89-draft.html#2.1.1.2
[3] https://port70.net/~nsz/c/c99/n1256.html#5.1.1.2
2018-10-14 12:55:24 +02:00
Peter Kokot
60a69daec6 Sync leading and final newlines in source code files
This patch adds missing newlines, trims multiple redundant final
newlines into a single one, and trims redundant leading newlines.

According to POSIX, a line is a sequence of zero or more non-' <newline>'
characters plus a terminating '<newline>' character. [1] Files should
normally have at least one final newline character.

C89 [2] and later standards [3] mention a final newline:
"A source file that is not empty shall end in a new-line character,
which shall not be immediately preceded by a backslash character."

Although it is not mandatory for all files to have a final newline
fixed, a more consistent and homogeneous approach brings less of commit
differences issues and a better development experience in certain text
editors and IDEs.

[1] http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_206
[2] https://port70.net/~nsz/c/c89/c89-draft.html#2.1.1.2
[3] https://port70.net/~nsz/c/c99/n1256.html#5.1.1.2
2018-10-14 12:54:08 +02:00
Peter Kokot
03f3b8479b Sync leading and final newlines in source code files
This patch adds missing newlines, trims multiple redundant final
newlines into a single one, and trims redundant leading newlines.

According to POSIX, a line is a sequence of zero or more non-' <newline>'
characters plus a terminating '<newline>' character. [1] Files should
normally have at least one final newline character.

C89 [2] and later standards [3] mention a final newline:
"A source file that is not empty shall end in a new-line character,
which shall not be immediately preceded by a backslash character."

Although it is not mandatory for all files to have a final newline
fixed, a more consistent and homogeneous approach brings less of commit
differences issues and a better development experience in certain text
editors and IDEs.

[1] http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_206
[2] https://port70.net/~nsz/c/c89/c89-draft.html#2.1.1.2
[3] https://port70.net/~nsz/c/c99/n1256.html#5.1.1.2
2018-10-14 12:51:01 +02:00
Peter Kokot
902d39a3a7 Trim trailing whitespace in source code files 2018-10-13 14:14:50 +02:00
Peter Kokot
7f6387b59a Trim trailing whitespace in source code files 2018-10-13 14:12:55 +02:00
Anatol Belski
3082600326 Update libmagic.patch [ci skip] 2018-08-06 14:28:32 +02:00
Anatol Belski
e1af7a794a Fix possible stack buffer overflow 2018-08-04 16:56:08 +02:00
Peter Kokot
f2e4de8b56 Fix AC_RUN_IFELSE calls when cross-compiling
AC_RUN_IFELSE program can't be run when cross-compiling. This fix removes
warnings given by autotools scripts.
2018-07-30 06:38:59 +02:00
Peter Kokot
4371945b8b Replace obsolete AC_TRY_FOO with AC_FOO_IFELSE
Autoconf 2.50 released in 2001 made several macros obsolete including
the AC_TRY_RUN, AC_TRY_COMPILE and AC_TRY_LINK:
http://git.savannah.gnu.org/cgit/autoconf.git/tree/ChangeLog.2

These macros should be replaced with the current AC_FOO_IFELSE instead:
- AC_TRY_RUN with AC_RUN_IFELSE and AC_LANG_SOURCE
- AC_TRY_LINK with AC_LINK_IFELSE and AC_LANG_PROGRAM
- AC_TRY_COMPILE with AC_COMPILE_IFELSE and AC_LANG_PROGRAM

PHP 5.4 to 7.1 require Autoconf 2.59+ version, PHP 7.2 and above require
2.64+ version, and the PHP 7.2 phpize script requires 2.59+ version which
are all greater than above mentioned 2.50 version therefore systems
should be well supported by now.

This patch was created with the help of autoupdate script:
autoupdate <file>

Reference docs:
- https://www.gnu.org/software/autoconf/manual/autoconf-2.69/html_node/Obsolete-Macros.html
- https://www.gnu.org/software/autoconf/manual/autoconf-2.59/autoconf.pdf
2018-07-30 02:36:38 +02:00
Peter Kokot
8d3f8ca12a Remove unused Git attributes ident
The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
user who changed it.

In Git this functionality is different and can be done with Git attribute
ident. These need to be defined manually for each file in the
.gitattributes file and are afterwards replaced with 40-character
hexadecimal blob object name which is based only on the particular file
contents.

This patch simplifies handling of $Id$ keywords by removing them since
they are not used anymore.
2018-07-25 00:53:25 +02:00
Gabriel Caruso
c93aba042f
Give a reason why the test was skipped
This will help us debug why a test was skipped in GCOV
(http://gcov.php.net/viewer.php?version=PHP_HEAD&func=skip), and maybe
put them to run again
2018-07-22 16:41:41 -03:00
Peter Kokot
d6ccaef3e6 Bump fileinfo extension version to PHP release version
To sync core extensions and their versioning more the fileinfo extension
can be versioned same way as PHP releases.
2018-06-15 00:28:28 +02:00
Anatol Belski
01b9975639 [ci skip] Update libmagic.patch 2018-06-03 14:06:11 +02:00
Anatol Belski
6f24d75b56 Remove unnecessary decls, php.h is included 2018-06-03 12:45:37 +02:00
Anatol Belski
4363588f2f Align the ported place with libmagic 2018-06-03 12:14:42 +02:00
Dmitry Stogov
f2b4ec4bdc Export standard object handlers, to avoid indirect access 2018-05-31 11:57:22 +03:00
Dmitry Stogov
5eb1f92f31 Use zend_string_release_ex() instread of zend_string_release() in places, where we sure about string persistence. 2018-05-28 16:27:12 +03:00
Anatol Belski
dbea6e154d Update libmagic.patch 2018-04-30 14:29:55 +02:00