]> granicus.if.org Git - php/commitdiff
Merge branch 'PHP-5.5' into PHP-5.6.23
authorStanislav Malyshev <stas@php.net>
Tue, 21 Jun 2016 07:01:48 +0000 (00:01 -0700)
committerStanislav Malyshev <stas@php.net>
Tue, 21 Jun 2016 07:01:48 +0000 (00:01 -0700)
* PHP-5.5:
  Fixed bug #72446 - Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow
  update NEWS
  fix tests
  fix build
  Fix bug #72455:  Heap Overflow due to integer overflows
  Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize
  Fixed ##72433: Use After Free Vulnerability in PHP's GC algorithm and unserialize
  Fix bug #72407: NULL Pointer Dereference at _gdScaleVert
  Fix bug #72402: _php_mb_regex_ereg_replace_exec - double free
  Fix bug #72298 pass2_no_dither out-of-bounds access
  Fixed #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow
  Fix bug #72262 - do not overflow int
  Fix bug #72400 and #72403 - prevent signed int overflows for string lengths
  Fix bug #72275: don't allow smart_str to overflow int
  Fix bug #72340: Double Free Courruption in wddx_deserialize
  update NEWS
  Fix #66387: Stack overflow with imagefilltoborder
  Skip test which is 64bits only
  5.5.37 now

Conflicts:
configure.in
ext/mcrypt/mcrypt.c
ext/spl/spl_directory.c
main/php_version.h

1  2 
ext/gd/libgd/gd.c
ext/gd/libgd/gd_interpolation.c
ext/mbstring/php_mbregex.c
ext/mcrypt/mcrypt.c
ext/spl/spl_array.c
ext/spl/spl_directory.c
ext/standard/php_smart_str.h
ext/standard/string.c
ext/standard/url.c
ext/wddx/wddx.c
ext/zip/php_zip.c

Simple merge
Simple merge
Simple merge
Simple merge
Simple merge
index e60078a53939c319ad17731009d974f6d30d1dda,7718fe42d7fa9515244bf56a232c33728ecc6fcc..73a2d70acc67fba4e851f9a73c3ef781e1da44c5
@@@ -2608,14 -2585,8 +2608,14 @@@ SPL_METHOD(SplFileObject, fgetcsv
        char delimiter = intern->u.file.delimiter, enclosure = intern->u.file.enclosure, escape = intern->u.file.escape;
        char *delim = NULL, *enclo = NULL, *esc = NULL;
        int d_len = 0, e_len = 0, esc_len = 0;
-       
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sss", &delim, &d_len, &enclo, &e_len, &esc, &esc_len) == SUCCESS) {
 +
 +              if(!intern->u.file.stream) {
 +                      zend_throw_exception_ex(spl_ce_RuntimeException, 0 TSRMLS_CC, "Object not initialized");
 +                      return;
 +              }
 +
                switch(ZEND_NUM_ARGS())
                {
                case 3:
@@@ -2996,14 -2919,9 +3000,14 @@@ SPL_METHOD(SplFileObject, seek
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &line_pos) == FAILURE) {
                return;
        }
 +      if(!intern->u.file.stream) {
 +              zend_throw_exception_ex(spl_ce_RuntimeException, 0 TSRMLS_CC, "Object not initialized");
 +              return;
 +      }
 +
        if (line_pos < 0) {
                zend_throw_exception_ex(spl_ce_LogicException, 0 TSRMLS_CC, "Can't seek file %s to negative line %ld", intern->file_name, line_pos);
-               RETURN_FALSE;           
+               RETURN_FALSE;
        }
  
        spl_filesystem_file_rewind(getThis(), intern TSRMLS_CC);
@@@ -3058,12 -2976,11 +3062,12 @@@ ZEND_BEGIN_ARG_INFO_EX(arginfo_file_obj
        ZEND_ARG_INFO(0, allowable_tags)
  ZEND_END_ARG_INFO()
  
 -ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fscanf, 1, 0, 1)
 +ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fscanf, 0, 0, 1) 
        ZEND_ARG_INFO(0, format)
 +      ZEND_ARG_VARIADIC_INFO(1, vars)
  ZEND_END_ARG_INFO()
  
- ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fwrite, 0, 0, 1) 
+ ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fwrite, 0, 0, 1)
        ZEND_ARG_INFO(0, str)
        ZEND_ARG_INFO(0, length)
  ZEND_END_ARG_INFO()
Simple merge
Simple merge
index b34f16a5188b3ff23896c380b3123662a7f03b83,fc3f080a41b6f581e88c43595f72a063cfda0ec5..4b52000f645cf91115fd569e50c159ff23d2142b
@@@ -314,13 -314,13 +314,13 @@@ PHPAPI php_url *php_url_parse_ex(char c
        if (e == ue) {
                return ret;
        }
-       
        s = e;
-       
        nohost:
-       
        if ((p = memchr(s, '?', (ue - s)))) {
 -              pp = strchr(s, '#');
 +              pp = memchr(s, '#', (ue - s));
  
                if (pp && pp < p) {
                        if (pp - s) {
diff --cc ext/wddx/wddx.c
Simple merge
Simple merge