MFB

diff --git a/ext/bz2/bz2.c b/ext/bz2/bz2.c
index 682a1522049aadd26811cf565896d4e8c12b1e41..0d27995525b825c6bc9cee16c80b359ac0e2e162 100644 (file)
--- a/ext/bz2/bz2.c
+++ b/ext/bz2/bz2.c
@@ -225,6 +225,10 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 #else
        path_copy = path;
 #endif  
+
+       if (php_check_open_basedir(path_copy TSRMLS_CC)) {
+               return NULL;
+       }
        
        /* try and open it directly first */
        bz_file = BZ2_bzopen(path_copy, mode);
@@ -236,7 +240,7 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
        
        if (bz_file == NULL) {
                /* that didn't work, so try and get something from the network/wrapper */
-               stream = php_stream_open_wrapper(path, mode, options | STREAM_WILL_CAST, opened_path);
+               stream = php_stream_open_wrapper(path, mode, options | STREAM_WILL_CAST | ENFORCE_SAFE_MODE, opened_path);
        
                if (stream) {
                        int fd;

diff --git a/ext/mcrypt/mcrypt.c b/ext/mcrypt/mcrypt.c
index 261690ea5f0b5d6b099b52c8a6d8794df83e0aab..55b549accd69e60124bc4c54a7e4fb89f2983690 100644 (file)
--- a/ext/mcrypt/mcrypt.c
+++ b/ext/mcrypt/mcrypt.c
@@ -1002,8 +1002,8 @@ int php_mcrypt_iv(php_mcrypt_iv_source source, int size, char **iv_str, int *iv_
        int fd, n;
        size_t read_bytes;
        
-       if (size <= 0) {
-               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Can not create an IV with size 0 or smaller");
+       if (size <= 0 || size >= INT_MAX) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Can not create an IV with a size of less then 1 or greater then %d", INT_MAX);
                return FAILURE;
        }
        

diff --git a/ext/shmop/shmop.c b/ext/shmop/shmop.c
index ebd5082c8d99486402951e59bf7a0bb8abfd8d1b..8051e2f84bdffae1319ed0011898f83dfae5da15 100644 (file)
--- a/ext/shmop/shmop.c
+++ b/ext/shmop/shmop.c
@@ -181,6 +181,11 @@ PHP_FUNCTION(shmop_open)
                        goto err;
        }
 
+       if (shmop->shmflg & IPC_CREAT && shmop->size < 1) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Shared memory segment size must be greater then zero.");
+               goto err;
+       }
+
        shmop->shmid = shmget(shmop->key, shmop->size, shmop->shmflg);
        if (shmop->shmid == -1) {
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "unable to attach or create shared memory segment");

diff --git a/ext/standard/array.c b/ext/standard/array.c
index c31a439bc8f46565288f770ffd04a142f929b68e..a55eec02fd1fe218bdaaadd169acea28d3ce9380 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1842,13 +1842,13 @@ double_str:
                        add_next_index_double(return_value, low);
                }
        } else {
-               int low, high;
+               double low, high;
                long lstep;
 long_str:
-               convert_to_long(zlow);
-               convert_to_long(zhigh);
-               low = Z_LVAL_P(zlow);
-               high = Z_LVAL_P(zhigh);
+               convert_to_double(zlow);
+               convert_to_double(zhigh);
+               low = Z_DVAL_P(zlow);
+               high = Z_DVAL_P(zhigh);
                lstep = (long) step;
                                
                if (low > high) {               /* Negative steps */
@@ -1857,18 +1857,18 @@ long_str:
                                goto err;
                        }
                        for (; low >= high; low -= lstep) {
-                               add_next_index_long(return_value, low);
+                               add_next_index_long(return_value, (long)low);
                        }       
-               } else if (high > low) {        /* Positive steps */
+               } else if (high > low) {        /* Positive steps */
                        if (high - low < lstep || lstep <= 0) {
                                err = 1;
                                goto err;
                        }
                        for (; low <= high; low += lstep) {
-                               add_next_index_long(return_value, low);
+                               add_next_index_long(return_value, (long)low);
                        }       
                } else {
-                       add_next_index_long(return_value, low);
+                       add_next_index_long(return_value, (long)low);
                }
        }
 err:
@@ -4104,7 +4104,7 @@ PHP_FUNCTION(array_reduce)
                zend_hash_move_forward_ex(htbl, &pos);
        }
        
-       RETVAL_ZVAL(result, 0, 1);
+       RETVAL_ZVAL(result, 1, 1);
 }
 /* }}} */
 

diff --git a/ext/standard/browscap.c b/ext/standard/browscap.c
index 4e65fb9e0c527a66b7ff5c2a0cd0b6d3a87f44c4..7d3a2e22ff0e7ab2120b769a3a7c5b6eac275b4b 100644 (file)
--- a/ext/standard/browscap.c
+++ b/ext/standard/browscap.c
@@ -55,7 +55,7 @@ static void convert_browscap_pattern(zval *pattern)
 
        php_strtolower(Z_STRVAL_P(pattern), Z_STRLEN_P(pattern));
 
-       t = (char *) malloc(Z_STRLEN_P(pattern)*2 + 3);
+       t = (char *) safe_pemalloc(Z_STRLEN_P(pattern), 2, 3, 1);
 
        t[0] = '^';
 
@@ -100,7 +100,7 @@ static void php_browscap_parser_cb(zval *arg1, zval *arg2, int callback_type, vo
                                zval *new_property;
                                char *new_key;
 
-                               new_property = (zval *) malloc(sizeof(zval));
+                               new_property = (zval *) pemalloc(sizeof(zval), 1);
                                INIT_PZVAL(new_property);
                                Z_STRVAL_P(new_property) = zend_strndup(Z_STRVAL_P(arg2), Z_STRLEN_P(arg2));
                                Z_STRLEN_P(new_property) = Z_STRLEN_P(arg2);
@@ -118,14 +118,14 @@ static void php_browscap_parser_cb(zval *arg1, zval *arg2, int callback_type, vo
                                HashTable *section_properties;
 
                                /*printf("'%s' (%d)\n",$1.value.str.val,$1.value.str.len+1);*/
-                               current_section = (zval *) malloc(sizeof(zval));
+                               current_section = (zval *) pemalloc(sizeof(zval), 1);
                                INIT_PZVAL(current_section);
-                               processed = (zval *) malloc(sizeof(zval));
+                               processed = (zval *) pemalloc(sizeof(zval), 1);
                                INIT_PZVAL(processed);
-                               unprocessed = (zval *) malloc(sizeof(zval));
+                               unprocessed = (zval *) pemalloc(sizeof(zval), 1);
                                INIT_PZVAL(unprocessed);
 
-                               section_properties = (HashTable *) malloc(sizeof(HashTable));
+                               section_properties = (HashTable *) pemalloc(sizeof(HashTable), 1);
                                zend_hash_init(section_properties, 0, NULL, (dtor_func_t) browscap_entry_dtor, 1);
                                current_section->value.ht = section_properties;
                                current_section->type = IS_ARRAY;

diff --git a/ext/standard/proc_open.c b/ext/standard/proc_open.c
index d7d483961892ca09789172bdcf3216a951142f10..afd0ca240b0ed092742c71d40c60d260161eb79b 100644 (file)
--- a/ext/standard/proc_open.c
+++ b/ext/standard/proc_open.c
@@ -777,6 +777,9 @@ PHP_FUNCTION(proc_open)
        channel.errfd = -1;
        /* Duplicate the command as processing downwards will modify it*/
        command_dup = strdup(command);
+       if (!command_dup) {
+               goto exit_fail;
+       }
        /* get a number of args */
        construct_argc_argv(command_dup, NULL, &command_num_args, NULL);
        child_argv = (char**) malloc((command_num_args + 1) * sizeof(char*));

diff --git a/ext/sysvshm/sysvshm.c b/ext/sysvshm/sysvshm.c
index 81c940fa5d5f558dd84890ad36ddbee3d01f62d6..9c69f462b386621b4034467adec8740115c8fb01 100644 (file)
--- a/ext/sysvshm/sysvshm.c
+++ b/ext/sysvshm/sysvshm.c
@@ -118,6 +118,11 @@ PHP_FUNCTION(shm_attach)
                RETURN_FALSE;
        }
 
+       if (shm_size < 1) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Segment size must be greater then zero.");
+               RETURN_FALSE;
+       }
+
        shm_list_ptr = (sysvshm_shm *) emalloc(sizeof(sysvshm_shm));
 
        /* get the id from a specified key or create new shared memory */

diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index 1432f02442b55f15ef7553a0b0e21a1b6f06ee07..0282da2fde7c8d6fa17adf4fcc7d04b82e50298a 100644 (file)
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -984,6 +984,9 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
                                                                        goto bigint;
                                                                }
                                                                l = (long) d;
+                                                               if (l != d) {
+                                                                       goto bigint;
+                                                               }
                                                        case IS_LONG:
                                                                zend_hash_index_update(target_hash, l, &ent1->data, sizeof(zval *), NULL);
                                                                break;
@@ -1034,10 +1037,9 @@ static void php_wddx_process_data(void *user_data, const XML_Char *s, int len)
                                        Z_STRVAL_P(ent->data) = estrndup(decoded, decoded_len);
                                        Z_STRLEN_P(ent->data) = decoded_len;
                                } else {
-                                       Z_STRVAL_P(ent->data) = erealloc(Z_STRVAL_P(ent->data),
-                                                       Z_STRLEN_P(ent->data) + decoded_len + 1);
-                                       strncpy(Z_STRVAL_P(ent->data)+Z_STRLEN_P(ent->data), decoded, decoded_len);
                                        Z_STRLEN_P(ent->data) += decoded_len;
+                                       Z_STRVAL_P(ent->data) = erealloc(Z_STRVAL_P(ent->data), Z_STRLEN_P(ent->data) + 1);
+                                       strlcpy(Z_STRVAL_P(ent->data) + Z_STRLEN_P(ent->data), decoded, Z_STRLEN_P(ent->data) + 1);
                                        Z_STRVAL_P(ent->data)[Z_STRLEN_P(ent->data)] = '\0';
                                }
 

diff --git a/main/streams/plain_wrapper.c b/main/streams/plain_wrapper.c
index 11e05a4672b32833a30ca4e73ff4718b557fe11e..fcedd0d2a4dd31258ed21dc5ed046632c08687f8 100644 (file)
--- a/main/streams/plain_wrapper.c
+++ b/main/streams/plain_wrapper.c
@@ -904,12 +904,12 @@ PHPAPI php_stream *_php_stream_fopen(const char *filename, const char *mode, cha
                                        *opened_path = realpath;
                                        realpath = NULL;
                                }
-                               if (realpath) {
-                                       efree(realpath);
-                               }
                                /* fall through */
 
                        case PHP_STREAM_PERSISTENT_FAILURE:
+                               if (realpath) {
+                                       efree(realpath);
+                               }
                                efree(persistent_id);;
                                return ret;
                }
@@ -948,6 +948,10 @@ PHPAPI php_stream *_php_stream_fopen(const char *filename, const char *mode, cha
 
                                r = do_fstat(self, 0);
                                if ((r == 0 && !S_ISREG(self->sb.st_mode))) {
+                                       if (opened_path) {
+                                               efree(*opened_path);
+                                               *opened_path = NULL;
+                                       }
                                        php_stream_close(ret);
                                        return NULL;
                                }

diff --git a/server-tests.php b/server-tests.php
index 00055c24bd7798402d800b33e164afd71246612b..6b341b3d9d6c70b7b95ead87a4fdd32a6691fd3b 100755 (executable)
--- a/server-tests.php
+++ b/server-tests.php
@@ -3,7 +3,7 @@
    +----------------------------------------------------------------------+
    | PHP Version 5                                                        |
    +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2006 The PHP Group                                |
+   | Copyright (c) 1997-2007 The PHP Group                                |
    +----------------------------------------------------------------------+
    | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |