Merge all not yet merged security fixes into the 4_3 branch

diff --git a/ext/mssql/php_mssql.c b/ext/mssql/php_mssql.c
index 7e9d28f8fed4c9d709925ff85d528e06e23ac399..489c6553286b9e4bc6d0259b8bca9204ef731de6 100644 (file)
--- a/ext/mssql/php_mssql.c
+++ b/ext/mssql/php_mssql.c
@@ -344,6 +344,7 @@ PHP_RINIT_FUNCTION(mssql)
 PHP_RSHUTDOWN_FUNCTION(mssql)
 {
        STR_FREE(MS_SQL_G(appname));
+       MS_SQL_G(appname) = NULL;
        if (MS_SQL_G(server_message)) {
                STR_FREE(MS_SQL_G(server_message));
                MS_SQL_G(server_message) = NULL;

diff --git a/ext/session/session.c b/ext/session/session.c
index 7098f1d4420a50f3e3df64fac65c0df6865549d8..67fe998b7a83b68839c962b7351ff5d816db8056 100644 (file)
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -503,13 +503,16 @@ break_outer_loop:
 
 static void php_session_track_init(TSRMLS_D)
 {
+       zval *session_vars = NULL;
+       
        /* Unconditionally destroy existing arrays -- possible dirty data */
        zend_hash_del(&EG(symbol_table), "HTTP_SESSION_VARS", 
                        sizeof("HTTP_SESSION_VARS"));
        zend_hash_del(&EG(symbol_table), "_SESSION", sizeof("_SESSION"));
 
-       MAKE_STD_ZVAL(PS(http_session_vars));
-       array_init(PS(http_session_vars));
+       MAKE_STD_ZVAL(session_vars);
+       array_init(session_vars);
+       PS(http_session_vars) = session_vars;
 
        ZEND_SET_GLOBAL_VAR_WITH_LENGTH("HTTP_SESSION_VARS", sizeof("HTTP_SESSION_VARS"), PS(http_session_vars), 2, 1);
        ZEND_SET_GLOBAL_VAR_WITH_LENGTH("_SESSION", sizeof("_SESSION"), PS(http_session_vars), 2, 1);

diff --git a/ext/sybase/php_sybase_db.c b/ext/sybase/php_sybase_db.c
index 2d90e611a15d7c39ff76ce2658451391e664740a..7aadcfb70b092581b21e2087e24937c55c8a5eb0 100644 (file)
--- a/ext/sybase/php_sybase_db.c
+++ b/ext/sybase/php_sybase_db.c
@@ -297,7 +297,9 @@ PHP_MSHUTDOWN_FUNCTION(sybase)
 PHP_RSHUTDOWN_FUNCTION(sybase)
 {
        efree(php_sybase_module.appname);
+       php_sybase_module.appname = NULL;
        STR_FREE(php_sybase_module.server_message);
+       php_sybase_module.server_message = NULL;
        return SUCCESS;
 }
 

diff --git a/ext/sybase_ct/php_sybase_ct.c b/ext/sybase_ct/php_sybase_ct.c
index b0bb7fe548c392a7c1b70f00aa308ba60e0007ef..06101ddad1c314343c93654dc93eece091a088c1 100644 (file)
--- a/ext/sybase_ct/php_sybase_ct.c
+++ b/ext/sybase_ct/php_sybase_ct.c
@@ -458,11 +458,13 @@ PHP_MSHUTDOWN_FUNCTION(sybase)
 PHP_RSHUTDOWN_FUNCTION(sybase)
 {
        efree(SybCtG(appname));
+       SybCtG(appname) = NULL;
        if (SybCtG(callback_name)) {
                zval_ptr_dtor(&SybCtG(callback_name));
                SybCtG(callback_name)= NULL;
        }
        STR_FREE(SybCtG(server_message));
+       SybCtG(server_message) = NULL;
        return SUCCESS;
 }
 

diff --git a/ext/w32api/w32api.c b/ext/w32api/w32api.c
index 4945ef10dc0a4fc6ea1026fde3d4210d7c3988a3..072ab1d800fe2ef0a6ef063126eefa4ced48c731 100644 (file)
--- a/ext/w32api/w32api.c
+++ b/ext/w32api/w32api.c
@@ -290,20 +290,26 @@ PHP_MSHUTDOWN_FUNCTION(w32api)
  */
 PHP_RINIT_FUNCTION(w32api)
 {
+       HashTable *tmp;
+       WG(funcs) = WG(libraries) = WG(callbacks) = WG(types) = NULL;
+       
        /* Allocate Request Specific HT's here
         */
-       ALLOC_HASHTABLE(WG(funcs));
-       zend_hash_init(WG(funcs), 1, NULL, php_w32api_hash_func_dtor, 1);
-
-       ALLOC_HASHTABLE(WG(libraries));
-       zend_hash_init(WG(libraries), 1, NULL, php_w32api_hash_lib_dtor, 1);
+       ALLOC_HASHTABLE(tmp);
+       zend_hash_init(tmp, 1, NULL, php_w32api_hash_func_dtor, 1);
+       WG(funcs) = tmp;
 
-       ALLOC_HASHTABLE(WG(callbacks));
-       zend_hash_init(WG(callbacks), 1, NULL, php_w32api_hash_callback_dtor, 1);
+       ALLOC_HASHTABLE(tmp);
+       zend_hash_init(tmp, 1, NULL, php_w32api_hash_lib_dtor, 1);
+       WG(libraries) = tmp;
 
-       ALLOC_HASHTABLE(WG(types));
-       zend_hash_init(WG(types), 1, NULL, php_w32api_hash_type_dtor, 1);
+       ALLOC_HASHTABLE(tmp);
+       zend_hash_init(tmp, 1, NULL, php_w32api_hash_callback_dtor, 1);
+       WG(callbacks) = tmp;
 
+       ALLOC_HASHTABLE(tmp);
+       zend_hash_init(tmp, 1, NULL, php_w32api_hash_type_dtor, 1);
+       WG(types) = tmp;
 
        return SUCCESS;
 
@@ -330,6 +336,7 @@ PHP_RSHUTDOWN_FUNCTION(w32api)
        zend_hash_destroy(WG(types));
        FREE_HASHTABLE(WG(types));
 
+       WG(funcs) = WG(libraries) = WG(callbacks) = WG(types) = NULL;
 
        return SUCCESS;
 }

diff --git a/main/main.c b/main/main.c
index 9b53c530f6e08cd025eeb99f98782e36475b83a0..a3a93e3bb283aba84e815d98c034c1f331f44a6f 100644 (file)
--- a/main/main.c
+++ b/main/main.c
@@ -1369,6 +1369,7 @@ static int php_hash_environment(TSRMLS_D)
        int _gpc_flags[5] = {0, 0, 0, 0, 0};
        zend_bool have_variables_order;
        zval *dummy_track_vars_array = NULL;
+       zval *env_vars = NULL;
        zend_bool initialized_dummy_track_vars_array=0;
        int i;
        char *variables_order;
@@ -1401,9 +1402,10 @@ static int php_hash_environment(TSRMLS_D)
        } else {
                variables_order = PG(gpc_order);
                have_variables_order=0;
-               ALLOC_ZVAL(PG(http_globals)[TRACK_VARS_ENV]);
-               array_init(PG(http_globals)[TRACK_VARS_ENV]);
-               INIT_PZVAL(PG(http_globals)[TRACK_VARS_ENV]);
+               ALLOC_ZVAL(env_vars);
+               array_init(env_vars);
+               INIT_PZVAL(env_vars);
+               PG(http_globals)[TRACK_VARS_ENV] = env_vars;
                php_import_environment_variables(PG(http_globals)[TRACK_VARS_ENV] TSRMLS_CC);
                if (PG(register_globals)) {
                        php_autoglobal_merge(&EG(symbol_table), Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_ENV]) TSRMLS_CC);
@@ -1446,9 +1448,10 @@ static int php_hash_environment(TSRMLS_D)
                        case 'E':
                                if (!_gpc_flags[3]) {
                                        if (have_variables_order) {
-                                               ALLOC_ZVAL(PG(http_globals)[TRACK_VARS_ENV]);
-                                               array_init(PG(http_globals)[TRACK_VARS_ENV]);
-                                               INIT_PZVAL(PG(http_globals)[TRACK_VARS_ENV]);
+                                               ALLOC_ZVAL(env_vars);
+                                               array_init(env_vars);
+                                               INIT_PZVAL(env_vars);
+                                               PG(http_globals)[TRACK_VARS_ENV] = env_vars;
                                                php_import_environment_variables(PG(http_globals)[TRACK_VARS_ENV] TSRMLS_CC);
                                                if (PG(register_globals)) {
                                                        php_autoglobal_merge(&EG(symbol_table), Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_ENV]) TSRMLS_CC);

diff --git a/main/rfc1867.c b/main/rfc1867.c
index 91c23b6ba199b4fe5cf0e50fa258e43e3d6fe4a6..c37a711ce041a0577e3d48c2d220d46d564a8478 100644 (file)
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -760,7 +760,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
        char *boundary, *s=NULL, *boundary_end = NULL, *start_arr=NULL, *array_index=NULL;
        char *temp_filename=NULL, *lbuf=NULL, *abuf=NULL;
        int boundary_len=0, total_bytes=0, cancel_upload=0, is_arr_upload=0, array_len=0, max_file_size=0, skip_upload=0;
-       zval *http_post_files=NULL;
+       zval *http_post_files=NULL; HashTable *uploaded_files=NULL;
 #if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
        int str_len = 0, num_vars = 0, num_vars_max = 2*10, *len_list = NULL;
        char **val_list = NULL;
@@ -811,8 +811,9 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
        /* Initialize $_FILES[] */
        zend_hash_init(&PG(rfc1867_protected_variables), 5, NULL, NULL, 0);
 
-       ALLOC_HASHTABLE(SG(rfc1867_uploaded_files));
-       zend_hash_init(SG(rfc1867_uploaded_files), 5, NULL, (dtor_func_t) free_estring, 0);
+       ALLOC_HASHTABLE(uploaded_files);
+       zend_hash_init(uploaded_files, 5, NULL, (dtor_func_t) free_estring, 0);
+       SG(rfc1867_uploaded_files) = uploaded_files;
 
        ALLOC_ZVAL(http_post_files);
        array_init(http_post_files);

diff --git a/sapi/apache/mod_php4.c b/sapi/apache/mod_php4.c
index ac313c75d5e153f37edf4a6453b1b575d367cef1..08511770986e9d431228415abd98578ca1a7e952 100644 (file)
--- a/sapi/apache/mod_php4.c
+++ b/sapi/apache/mod_php4.c
@@ -465,7 +465,7 @@ static void init_request_info(TSRMLS_D)
        request_rec *r = ((request_rec *) SG(server_context));
        char *content_length = (char *) table_get(r->subprocess_env, "CONTENT_LENGTH");
        const char *authorization=NULL;
-       char *tmp;
+       char *tmp, *tmp_user;
 
        SG(request_info).query_string = r->args;
        SG(request_info).path_translated = r->filename;
@@ -482,15 +482,16 @@ static void init_request_info(TSRMLS_D)
                && (!PG(safe_mode) || (PG(safe_mode) && !auth_type(r)))
                && !strcasecmp(getword(r->pool, &authorization, ' '), "Basic")) {
                tmp = uudecode(r->pool, authorization);
-               SG(request_info).auth_user = getword_nulls_nc(r->pool, &tmp, ':');
-               if (SG(request_info).auth_user) {
-                       r->connection->user = pstrdup(r->connection->pool, SG(request_info).auth_user);
+               tmp_user = getword_nulls_nc(r->pool, &tmp, ':');
+               SG(request_info).auth_user = NULL;
+               if (tmp_user) {
+                       r->connection->user = pstrdup(r->connection->pool, tmp_user);
                        r->connection->ap_auth_type = "Basic";
-                       SG(request_info).auth_user = estrdup(SG(request_info).auth_user);
+                       SG(request_info).auth_user = estrdup(tmp_user);
                }
-               SG(request_info).auth_password = tmp;
-               if (SG(request_info).auth_password) {
-                       SG(request_info).auth_password = estrdup(SG(request_info).auth_password);
+               SG(request_info).auth_password = NULL;
+               if (tmp) {
+                       SG(request_info).auth_password = estrdup(tmp);
                }
        } else {
                SG(request_info).auth_user = NULL;