Commit Graph

95350 Commits

Author SHA1 Message Date
Bob Weinand
466870e2b0 Fix memory leak when compiling files in phpdbg 2016-10-14 12:24:28 +02:00
Remi Collet
428ef50838 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  use zend_error instead of zend_error_noreturn
2016-10-14 10:54:09 +02:00
Remi Collet
e1f5b6d8df use zend_error instead of zend_error_noreturn 2016-10-14 10:53:40 +02:00
Ferenc Kovacs
d0b9d72da7 Merge branch 'PHP-5.6' into PHP-7.0 2016-10-14 08:08:10 +02:00
Ferenc Kovacs
f7bf9650aa add missing NEWS entries for 5.6.27 2016-10-14 08:06:14 +02:00
Anatol Belski
5ba9eab436 missed piece for renaming 2016-10-13 15:39:02 +02:00
Anatol Belski
730288ae41 rename publicly exposed symbol to avoid name conflicts 2016-10-13 15:23:50 +02:00
Bob Weinand
d14498a475 Ignore non-executable opcodes in line mode of phpdbg_end_oplog() 2016-10-13 14:09:56 +02:00
Christoph M. Becker
b8fab503fe Merge branch 'PHP-5.6' into PHP-7.0 2016-10-13 11:25:11 +02:00
Christoph M. Becker
cc08cbc84d Fix #73280: Stack Buffer Overflow in GD dynamicGetbuf
We make sure to never pass a negative `rlen` as size to memcpy().

Cf. <https://github.com/libgd/libgd/commit/53110871>.
2016-10-13 11:10:02 +02:00
Anatol Belski
ce3e792c2c use already exported symbol 2016-10-13 09:55:37 +02:00
Anatol Belski
3104882cf8 Revert "export symbol missing by phpdbg"
This reverts commit 611ab7fe5b.

Overseen strpprintf is there
2016-10-13 09:50:32 +02:00
Stanislav Malyshev
cd8c9b0614 Fix outlen for openssl function
Even though datalen can't be over int, outlen can.
2016-10-12 23:19:07 -07:00
Stanislav Malyshev
2301608736 Syncronize with 5.6 - __toString should return "" 2016-10-12 23:09:49 -07:00
Stanislav Malyshev
9c50ba42d6 Fix potential overflows in php_pcre_replace_impl 2016-10-12 23:07:47 -07:00
Anatol Belski
0723a226c3 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Clear FG(user_stream_current_filename) when bailing out
  Fix tests
  fix tsrm
  Fix bug #73284 - heap overflow in php_ereg_replace function
  Fix bug #73276 - crash in openssl_random_pseudo_bytes function
  Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML()
  fix bug #73275 - crash in openssl_encrypt function
  Fix for #73240 - Write out of bounds at number_format
  Bug #73218: add mitigation for ICU int overflow
  Add more locale length checks, due to ICU bugs.
  Fix bug #73208 - another missing length check
  Fix bug #73190: memcpy negative parameter _bc_new_num_ex
  Fix bug #73189 - Memcpy negative size parameter php_resolve_path
  Fixed bug #73174 - heap overflow in php_pcre_replace_impl
  Fix bug #73150: missing NULL check in dom_document_save_html
  Fix bug #73147: Use After Free in PHP7 unserialize()
  Fix bug #73082
  Fix bug #73073 - CachingIterator null dereference when convert to string
2016-10-13 01:31:36 +02:00
Keith Smiley
26287132c0 Fixed bug #73237
If the response includes both fields with simple types (which get
concatenated into an XML string) and a complex type (which is parsed
into an object), then the object will parsed into the same zval as the
simple types and will overwrite the string.
2016-10-12 23:12:45 +02:00
Mitch Hagstrand
bcee2fdbec Fixed bug in zend_accel_error() and cleaned up kill_all_lockers()
1. zend_accel_error was only executing clean up if log_verbosity_level is high enough to log
2. Cleaned up kill_all_lockers function and fixed comments.
2016-10-12 23:03:55 +02:00
Bob Weinand
fe49fd7dad Update NEWS
Also add missing include.inc test file
2016-10-12 22:54:32 +02:00
Nikita Popov
fe378c27cc Fix phpdbg tests after lineno change 2016-10-12 22:41:59 +02:00
Nikita Popov
5b429fef42 Fix line number of implicit return in pseudo-main scope 2016-10-12 22:25:41 +02:00
Anatol Belski
611ab7fe5b export symbol missing by phpdbg 2016-10-12 22:18:41 +02:00
Bob Weinand
671d8054f8 Fix accidental PHPDBG_ABI break 2016-10-12 22:16:11 +02:00
Stanislav Malyshev
c4c2cce37d Fix bug #73189 - Memcpy negative size parameter php_resolve_path
(cherry picked from commit da7e89cde8)
2016-10-12 21:31:37 +02:00
Anatol Belski
58b18892bf update len in fallback cases 2016-10-12 20:52:46 +02:00
Bob Weinand
5aae01104f Add stdin command and -s command line parameter to phpdbg
This allows reading the initial script file from stdin instead of being forced to put the script into a file in order to run it with phpdbg.
Especially important for programmatic execution of phpdbg.

Also adding tests/include_once.phpt and tests/set_exception_handler.phpt as I seem to have forgotten to git add them sometime long ago...
2016-10-12 20:15:49 +02:00
Stanislav Malyshev
74b5662536 Fix bug #73190: memcpy negative parameter _bc_new_num_ex
(cherry picked from commit 40e7baab3c)
2016-10-12 19:48:25 +02:00
Stanislav Malyshev
f42cbd749c Fix bug #73147: Use After Free in PHP7 unserialize()
(cherry picked from commit 0e6fe3a4c9)
2016-10-12 17:51:15 +02:00
Anatol Belski
efc1f33b58 fix typo 2016-10-12 17:12:38 +02:00
Anatol Belski
80eb013a92 Revert "Fix for #73240 - Write out of bounds at number_format"
This reverts commit 01280f8deb.

The fix is already merged by Stas.
2016-10-12 16:12:18 +02:00
Anatol Belski
b135ba3fa9 followup with #73276 merge 2016-10-12 16:03:35 +02:00
Anatol Belski
7c6cb1282d fix test 2016-10-12 16:03:09 +02:00
Stanislav Malyshev
7dc8b5e7ae Fix bug #73276 - crash in openssl_random_pseudo_bytes function
(cherry picked from commit 85a22a0af0)
2016-10-12 15:55:42 +02:00
Stanislav Malyshev
4ef79370a8 Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML()
(cherry picked from commit 96a8cf8e1b)
2016-10-12 15:40:21 +02:00
Stanislav Malyshev
01280f8deb Fix for #73240 - Write out of bounds at number_format
(cherry picked from commit 8259130b6b)
2016-10-12 14:55:00 +02:00
Anatol Belski
aaa5d07365 avoid strlen 2016-10-12 13:28:23 +02:00
Stanislav Malyshev
b26b02b2df Bug #73218: add mitigation for ICU int overflow
(cherry picked from commit d946d10293)
2016-10-12 13:22:51 +02:00
Stanislav Malyshev
87a8240b5a Add more locale length checks, due to ICU bugs.
(cherry picked from commit d3eb58332a)
2016-10-12 13:11:16 +02:00
Stanislav Malyshev
d1e878f272 Fix bug #73150: missing NULL check in dom_document_save_html
(cherry picked from commit 1c0e9126fb)
2016-10-12 12:19:41 +02:00
Sara Golemon
43ccf23d70 Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.

Catch the bailout, clear the variable, then continue bailing.

Closes https://bugs.php.net/bug.php?id=73188
2016-10-11 21:55:01 -07:00
Sara Golemon
4d11a8eedf Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.

Catch the bailout, clear the variable, then continue bailing.

Closes https://bugs.php.net/bug.php?id=73188
2016-10-11 21:44:14 -07:00
Stanislav Malyshev
1bdb30a429 Merge branch 'PHP-7.0.12' into PHP-7.0
* PHP-7.0.12:
  set versions and release date
  sync NEWS
  Revert "Fixed bug #73067 (__debugInfo crashes when throwing an exception)"
  Fix for #73240 - Write out of bounds at number_format
  Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object as key
  set versions
  Fix bug #73091 - Unserializing DateInterval object may lead to __toString invocation
2016-10-11 16:46:51 -07:00
Stanislav Malyshev
9c675607e6 Merge remote-tracking branch 'origin/PHP-7.0.12' into PHP-7.0.12
* origin/PHP-7.0.12: (99 commits)
  set versions and release date
  sync NEWS
  Revert "Fixed bug #73067 (__debugInfo crashes when throwing an exception)"
  set versions
  update NEWS
  Ignore potentially misleading dberr values
  update NEWS
  Fixed bug #73172 parse error: Invalid numeric literal
  Fix #53745: cgi.discard_path option is missing from php.ini
  update libs_versions.txt
  update libs_versions.txt
  Fixed bug #73156 (segfault on undefined function)
  Add an include path for freetype which is relevant for cmake builds
  Fix test_image_equals_file() wrt. palette images
  Fixed bug #73163
  Fix #73161: imagecreatefromgd2() may leak memory
  Fix #73159: imagegd2(): unrecognized formats may result in corrupted files
  Fix #73155: imagegd2() writes wrong chunk sizes on boundaries
  Fix #73157 (again): imagegd2() ignores 3rd param if 4 are given
  Fix #73157: imagegd2() ignores 3rd param if 4 are given
  ...
2016-10-11 16:27:13 -07:00
Stanislav Malyshev
689a9b8def Merge branch 'PHP-5.6.27' into PHP-5.6
* PHP-5.6.27:
  Fix tests
  fix tsrm
  Fix bug #73284 - heap overflow in php_ereg_replace function
  Fix bug #73276 - crash in openssl_random_pseudo_bytes function
  Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML()
  fix bug #73275 - crash in openssl_encrypt function
  Fix for #73240 - Write out of bounds at number_format
  Bug #73218: add mitigation for ICU int overflow
  Add more locale length checks, due to ICU bugs.
  Fix bug #73208 - another missing length check
  Fix bug #73190: memcpy negative parameter _bc_new_num_ex
  Fix bug #73189 - Memcpy negative size parameter php_resolve_path
  Fixed bug #73174 - heap overflow in php_pcre_replace_impl
  Fix bug #73150: missing NULL check in dom_document_save_html
  Fix bug #73147: Use After Free in PHP7 unserialize()
  Fix bug #73082
  Fix bug #73073 - CachingIterator null dereference when convert to string
2016-10-11 16:26:35 -07:00
Stanislav Malyshev
082d1f2375 Fix tests 2016-10-11 16:18:08 -07:00
Stanislav Malyshev
c1112ff323 fix tsrm 2016-10-11 14:39:16 -07:00
Stanislav Malyshev
21452a5401 Fix bug #73284 - heap overflow in php_ereg_replace function 2016-10-11 14:16:51 -07:00
Stanislav Malyshev
85a22a0af0 Fix bug #73276 - crash in openssl_random_pseudo_bytes function 2016-10-11 13:37:47 -07:00
Stanislav Malyshev
96a8cf8e1b Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML() 2016-10-11 13:30:52 -07:00
Stanislav Malyshev
8822f7c9f0 fix bug #73275 - crash in openssl_encrypt function 2016-10-11 13:19:20 -07:00