]> granicus.if.org Git - php/commitdiff
Merge branch 'PHP-5.6'
authorStanislav Malyshev <stas@php.net>
Tue, 14 Apr 2015 08:20:31 +0000 (01:20 -0700)
committerStanislav Malyshev <stas@php.net>
Tue, 14 Apr 2015 08:28:06 +0000 (01:28 -0700)
* PHP-5.6: (27 commits)
  fix non-standard C
  update NEWS
  5.4.41 next
  fix CVE num
  update NEWS
  Fix bug #69441 (Buffer Overflow when parsing tar/zip/phar in phar_set_inode)
  fix test
  fix type in fix for #69085
  fix memory leak & add test
  Fix tests
  fix CVE num
  Fix bug #69337 (php_stream_url_wrap_http_ex() type-confusion vulnerability)
  Fix test
  Additional fix for bug #69324
  More fixes for bug #69152
  Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions)
  Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar)
  Fixed bug #69316 (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER)
  Fix bug #68486 and bug #69218 (segfault in apache2handler with apache 2.4)
  Fix bug #68819 (Fileinfo on specific file causes spurious OOM and/or segfault)
  ...

Conflicts:
Zend/zend_exceptions.c
ext/curl/interface.c
ext/dom/document.c
ext/fileinfo/libmagic/softmagic.c
ext/gd/gd.c
ext/hash/hash.c
ext/pgsql/pgsql.c
ext/phar/phar.c
ext/phar/phar_internal.h
ext/standard/http_fopen_wrapper.c
ext/standard/link.c
ext/standard/streamsfuncs.c
ext/xmlwriter/php_xmlwriter.c
ext/zlib/zlib.c

16 files changed:
1  2 
Zend/zend_exceptions.c
ext/curl/interface.c
ext/dom/document.c
ext/fileinfo/fileinfo.c
ext/fileinfo/libmagic/softmagic.c
ext/gd/gd.c
ext/hash/hash.c
ext/pgsql/pgsql.c
ext/phar/phar.c
ext/phar/phar_internal.h
ext/standard/http_fopen_wrapper.c
ext/standard/link.c
ext/standard/streamsfuncs.c
ext/xmlwriter/php_xmlwriter.c
ext/zlib/zlib.c
sapi/apache2handler/sapi_apache2.c

index 6eccc8972315b4b971407d5a6838603c9b30847e,f163495906074cba98a7d5a7bf090d85b91e7d86..cda0dd943c7b98f3e86f9f638003c6bf9e783003
@@@ -549,29 -581,28 +549,32 @@@ static void _build_trace_string(smart_s
     Obtain the backtrace for the exception as a string (instead of an array) */
  ZEND_METHOD(exception, getTraceAsString)
  {
 -      zval *trace;
 -      char *res, **str, *s_tmp;
 -      int res_len = 0, *len = &res_len, num = 0;
 +      zval *trace, *frame, rv;
 +      zend_ulong index;
 +      smart_str str = {0};
 +      uint32_t num = 0;
  
        DEFAULT_0_PARAMS;
 -      
 -      res = estrdup("");
 -      str = &res;
  
 -      trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
 +      trace = zend_read_property(base_exception_ce, getThis(), "trace", sizeof("trace")-1, 1, &rv);
+       if(Z_TYPE_P(trace) != IS_ARRAY) {
+               RETURN_FALSE;
+       }
 -      zend_hash_apply_with_arguments(Z_ARRVAL_P(trace) TSRMLS_CC, (apply_func_args_t)_build_trace_string, 3, str, len, &num);
 +      ZEND_HASH_FOREACH_NUM_KEY_VAL(Z_ARRVAL_P(trace), index, frame) {
 +              if (Z_TYPE_P(frame) != IS_ARRAY) {
 +                      zend_error(E_WARNING, "Expected array for frame %pu", index);
 +                      continue;
 +              }
 +
 +              _build_trace_string(&str, Z_ARRVAL_P(frame), num++);
 +      } ZEND_HASH_FOREACH_END();
  
 -      s_tmp = emalloc(1 + MAX_LENGTH_OF_LONG + 7 + 1);
 -      sprintf(s_tmp, "#%d {main}", num);
 -      TRACE_APPEND_STRL(s_tmp, strlen(s_tmp));
 -      efree(s_tmp);
 +      smart_str_appendc(&str, '#');
 +      smart_str_append_long(&str, num);
 +      smart_str_appends(&str, " {main}");
 +      smart_str_0(&str);
  
 -      res[res_len] = '\0';    
 -      RETURN_STRINGL(res, res_len, 0); 
 +      RETURN_NEW_STR(str.s);
  }
  /* }}} */
  
index a51c03f47ffa531c2c255fe89ea245237bb7117a,1ada79b850e85c909c9273ceeae9d13681f870c8..bf8d2f00ebb042ba4d54722d638f64e5d3693929
@@@ -1339,20 -1340,22 +1339,21 @@@ static size_t curl_write(char *data, si
                        fci.symbol_table = NULL;
  
                        ch->in_callback = 1;
 -                      error = zend_call_function(&fci, &t->fci_cache TSRMLS_CC);
 +                      error = zend_call_function(&fci, &t->fci_cache);
                        ch->in_callback = 0;
                        if (error == FAILURE) {
 -                              php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the CURLOPT_WRITEFUNCTION");
 +                              php_error_docref(NULL, E_WARNING, "Could not call the CURLOPT_WRITEFUNCTION");
                                length = -1;
 -                      } else if (retval_ptr) {
 -                              _php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 -                              if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 -                                      convert_to_long_ex(&retval_ptr);
 +                      } else if (!Z_ISUNDEF(retval)) {
++                              _php_curl_verify_handlers(ch, 1);
 +                              if (Z_TYPE(retval) != IS_LONG) {
 +                                      convert_to_long_ex(&retval);
                                }
 -                              length = Z_LVAL_P(retval_ptr);
 -                              zval_ptr_dtor(&retval_ptr);
 +                              length = Z_LVAL(retval);
                        }
  
 -                      zval_ptr_dtor(argv[0]);
 -                      zval_ptr_dtor(argv[1]);
 +                      zval_ptr_dtor(&argv[0]);
 +                      zval_ptr_dtor(&argv[1]);
                        break;
                }
        }
@@@ -1392,19 -1407,21 +1393,20 @@@ static int curl_fnmatch(void *ctx, cons
                        fci.symbol_table = NULL;
  
                        ch->in_callback = 1;
 -                      error = zend_call_function(&fci, &t->fci_cache TSRMLS_CC);
 +                      error = zend_call_function(&fci, &t->fci_cache);
                        ch->in_callback = 0;
                        if (error == FAILURE) {
 -                              php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_FNMATCH_FUNCTION");
 -                      } else if (retval_ptr) {
 -                              _php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 -                              if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 -                                      convert_to_long_ex(&retval_ptr);
 +                              php_error_docref(NULL, E_WARNING, "Cannot call the CURLOPT_FNMATCH_FUNCTION");
 +                      } else if (!Z_ISUNDEF(retval)) {
++                              _php_curl_verify_handlers(ch, 1);
 +                              if (Z_TYPE(retval) != IS_LONG) {
 +                                      convert_to_long_ex(&retval);
                                }
 -                              rval = Z_LVAL_P(retval_ptr);
 -                              zval_ptr_dtor(&retval_ptr);
 +                              rval = Z_LVAL(retval);
                        }
 -                      zval_ptr_dtor(argv[0]);
 -                      zval_ptr_dtor(argv[1]);
 -                      zval_ptr_dtor(argv[2]);
 +                      zval_ptr_dtor(&argv[0]);
 +                      zval_ptr_dtor(&argv[1]);
 +                      zval_ptr_dtor(&argv[2]);
                        break;
                }
        }
@@@ -1451,23 -1486,25 +1453,24 @@@ static size_t curl_progress(void *clien
                        fci.symbol_table = NULL;
  
                        ch->in_callback = 1;
 -                      error = zend_call_function(&fci, &t->fci_cache TSRMLS_CC);
 +                      error = zend_call_function(&fci, &t->fci_cache);
                        ch->in_callback = 0;
                        if (error == FAILURE) {
 -                              php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_PROGRESSFUNCTION");
 -                      } else if (retval_ptr) {
 -                              _php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 -                              if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 -                                      convert_to_long_ex(&retval_ptr);
 +                              php_error_docref(NULL, E_WARNING, "Cannot call the CURLOPT_PROGRESSFUNCTION");
 +                      } else if (!Z_ISUNDEF(retval)) {
++                              _php_curl_verify_handlers(ch, 1);
 +                              if (Z_TYPE(retval) != IS_LONG) {
 +                                      convert_to_long_ex(&retval);
                                }
 -                              if (0 != Z_LVAL_P(retval_ptr)) {
 +                              if (0 != Z_LVAL(retval)) {
                                        rval = 1;
                                }
 -                              zval_ptr_dtor(&retval_ptr);
                        }
 -                      zval_ptr_dtor(argv[0]);
 -                      zval_ptr_dtor(argv[1]);
 -                      zval_ptr_dtor(argv[2]);
 -                      zval_ptr_dtor(argv[3]);
 -                      zval_ptr_dtor(argv[4]);
 +                      zval_ptr_dtor(&argv[0]);
 +                      zval_ptr_dtor(&argv[1]);
 +                      zval_ptr_dtor(&argv[2]);
 +                      zval_ptr_dtor(&argv[3]);
 +                      zval_ptr_dtor(&argv[4]);
                        break;
                }
        }
@@@ -1523,17 -1568,18 +1526,18 @@@ static size_t curl_read(char *data, siz
  #if LIBCURL_VERSION_NUM >= 0x070c01 /* 7.12.1 */
                                length = CURL_READFUNC_ABORT;
  #endif
 -                      } else if (retval_ptr) {
 -                              _php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 -                              if (Z_TYPE_P(retval_ptr) == IS_STRING) {
 -                                      length = MIN((int) (size * nmemb), Z_STRLEN_P(retval_ptr));
 -                                      memcpy(data, Z_STRVAL_P(retval_ptr), length);
 +                      } else if (!Z_ISUNDEF(retval)) {
++                              _php_curl_verify_handlers(ch, 1);
 +                              if (Z_TYPE(retval) == IS_STRING) {
 +                                      length = MIN((int) (size * nmemb), Z_STRLEN(retval));
 +                                      memcpy(data, Z_STRVAL(retval), length);
                                }
 -                              zval_ptr_dtor(&retval_ptr);
 +                              zval_ptr_dtor(&retval);
                        }
  
 -                      zval_ptr_dtor(argv[0]);
 -                      zval_ptr_dtor(argv[1]);
 -                      zval_ptr_dtor(argv[2]);
 +                      zval_ptr_dtor(&argv[0]);
 +                      zval_ptr_dtor(&argv[1]);
 +                      zval_ptr_dtor(&argv[2]);
                        break;
                }
        }
@@@ -1583,19 -1638,21 +1587,20 @@@ static size_t curl_write_header(char *d
                        fci.no_separation = 0;
  
                        ch->in_callback = 1;
 -                      error = zend_call_function(&fci, &t->fci_cache TSRMLS_CC);
 +                      error = zend_call_function(&fci, &t->fci_cache);
                        ch->in_callback = 0;
                        if (error == FAILURE) {
 -                              php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the CURLOPT_HEADERFUNCTION");
 +                              php_error_docref(NULL, E_WARNING, "Could not call the CURLOPT_HEADERFUNCTION");
                                length = -1;
 -                      } else if (retval_ptr) {
 -                              _php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 -                              if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 -                                      convert_to_long_ex(&retval_ptr);
 +                      } else if (!Z_ISUNDEF(retval)) {
++                              _php_curl_verify_handlers(ch, 1);
 +                              if (Z_TYPE(retval) != IS_LONG) {
 +                                      convert_to_long_ex(&retval);
                                }
 -                              length = Z_LVAL_P(retval_ptr);
 -                              zval_ptr_dtor(&retval_ptr);
 +                              length = Z_LVAL(retval);
                        }
 -                      zval_ptr_dtor(argv[0]);
 -                      zval_ptr_dtor(argv[1]);
 +                      zval_ptr_dtor(&argv[0]);
 +                      zval_ptr_dtor(&argv[1]);
                        break;
                }
  
index 92d5fb5d3349ab2de3f93a183a80f74e424f0d1c,c2c436513d8599589c1d3590bc84b1d5b708331a..d435b1c2813685a2dfe560cd38420b39f1aaaa89
@@@ -1379,7 -1519,11 +1379,11 @@@ static xmlDocPtr dom_document_parser(zv
        xmlInitParser();
  
        if (mode == DOM_LOAD_FILE) {
-               char *file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN );
+               char *file_dest;
+               if (CHECK_NULL_PATH(source, source_len)) {
+                       return NULL;
+               }
 -              file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
++              file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN);
                if (file_dest) {
                        ctxt = xmlCreateFileParserCtxt(file_dest);
                }
@@@ -1979,7 -2119,7 +1983,7 @@@ static void dom_load_html(INTERNAL_FUNC
  
        id = getThis();
  
-       if (zend_parse_parameters(ZEND_NUM_ARGS(), "s|l", &source, &source_len, &options) == FAILURE) {
 -      if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &source, &source_len, &options) == FAILURE) {
++      if (zend_parse_parameters(ZEND_NUM_ARGS(), "p|l", &source, &source_len, &options) == FAILURE) {
                return;
        }
  
index c4745f92febb182d467547228d3ea1aaf1fb1f5e,95a6e0e36cbb44d0fe1f3f808ede862ef78768ba..40df99df47e046ee9178066ad8c373054a03e314
@@@ -531,8 -508,13 +531,13 @@@ static void _php_finfo_get_type(INTERNA
                                RETVAL_FALSE;
                                goto clean;
                        }
+                       if (CHECK_NULL_PATH(buffer, buffer_len)) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+                               RETVAL_FALSE;
+                               goto clean;
+                       }
  
 -                      wrap = php_stream_locate_url_wrapper(buffer, &tmp2, 0 TSRMLS_CC);
 +                      wrap = php_stream_locate_url_wrapper(buffer, &tmp2, 0);
  
                        if (wrap) {
                                php_stream *stream;
Simple merge
diff --cc ext/gd/gd.c
index fec29d7519bed48b8d58505c1dd480e0f130f145,0642d45ec23b5b63801b6ea785e1a1521364379a..9105fe6609476fbb8df22553b5af3a842bbfc56e
@@@ -2400,12 -2366,10 +2400,12 @@@ static void _php_image_create_from(INTE
        gdImagePtr im = NULL;
        php_stream *stream;
        FILE * fp = NULL;
 +#ifdef HAVE_GD_JPG
        long ignore_warning;
 +#endif
  
        if (image_type == PHP_GDIMG_TYPE_GD2PART) {
-               if (zend_parse_parameters(ZEND_NUM_ARGS(), "sllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) {
 -              if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) {
++              if (zend_parse_parameters(ZEND_NUM_ARGS(), "pllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) {
                        return;
                }
                if (width < 1 || height < 1) {
                        RETURN_FALSE;
                }
        } else {
-               if (zend_parse_parameters(ZEND_NUM_ARGS(), "s", &file, &file_len) == FAILURE) {
 -              if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) {
++              if (zend_parse_parameters(ZEND_NUM_ARGS(), "p", &file, &file_len) == FAILURE) {
                        return;
                }
        }
@@@ -4152,10 -4044,9 +4152,10 @@@ PHP_FUNCTION(imagepsencodefont
  {
        zval *fnt;
        char *enc, **enc_vector;
 -      int enc_len, *f_ind;
 +      size_t enc_len;
 +      int *f_ind;
  
-       if (zend_parse_parameters(ZEND_NUM_ARGS(), "rs", &fnt, &enc, &enc_len) == FAILURE) {
 -      if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rp", &fnt, &enc, &enc_len) == FAILURE) {
++      if (zend_parse_parameters(ZEND_NUM_ARGS(), "rp", &fnt, &enc, &enc_len) == FAILURE) {
                return;
        }
  
diff --cc ext/hash/hash.c
index 3a15fc6fcc6e87ffe2313b995428afacac2d58cf,780b2e012238f8407d1e6757719790cdb794fde9..0510d3749c30be27d1311883fb766905791e0988
@@@ -462,9 -465,9 +467,9 @@@ PHP_FUNCTION(hash_update_file
        php_stream_context *context;
        php_stream *stream;
        char *filename, buf[1024];
 -      int filename_len, n;
 +      size_t filename_len, n;
  
-       if (zend_parse_parameters(ZEND_NUM_ARGS(), "rs|r", &zhash, &filename, &filename_len, &zcontext) == FAILURE) {
 -      if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rp|r", &zhash, &filename, &filename_len, &zcontext) == FAILURE) {
++      if (zend_parse_parameters(ZEND_NUM_ARGS(), "rp|r", &zhash, &filename, &filename_len, &zcontext) == FAILURE) {
                return;
        }
  
index 536c94157ade1c2e187107a43964d12c24eb8cc6,1a10cfd93de76ed3af04062302f79cb48c506459..6a86b8941bfbb6f4f7c7c119aee7c28959265683
@@@ -3124,9 -3112,9 +3124,9 @@@ PHP_FUNCTION(pg_trace
        PGconn *pgsql;
        FILE *fp = NULL;
        php_stream *stream;
 -      id = PGG(default_link);
 +      zend_resource *link;
  
-       if (zend_parse_parameters(argc, "s|sr", &z_filename, &z_filename_len, &mode, &mode_len, &pgsql_link) == FAILURE) {
 -      if (zend_parse_parameters(argc TSRMLS_CC, "p|sr", &z_filename, &z_filename_len, &mode, &mode_len, &pgsql_link) == FAILURE) {
++      if (zend_parse_parameters(argc, "p|sr", &z_filename, &z_filename_len, &mode, &mode_len, &pgsql_link) == FAILURE) {
                return;
        }
  
diff --cc ext/phar/phar.c
index 8c2b596c3ddf45908f2ab812ae9d8ec02dd9aecd,35dd8393f6a9a56a0481a497e7fb3e47d0e6deb4..c4b6150026ba965ea2937dd236399fdb4f4c7aa7
@@@ -604,48 -601,38 +604,37 @@@ int phar_open_parsed_phar(char *fname, 
   *
   * data is the serialized zval
   */
- int phar_parse_metadata(char **buffer, zval *metadata, int zip_metadata_len) /* {{{ */
 -int phar_parse_metadata(char **buffer, zval **metadata, php_uint32 zip_metadata_len TSRMLS_DC) /* {{{ */
++int phar_parse_metadata(char **buffer, zval *metadata, php_uint32 zip_metadata_len) /* {{{ */
  {
-       const unsigned char *p;
-       php_uint32 buf_len;
        php_unserialize_data_t var_hash;
  
-       if (!zip_metadata_len) {
-               PHAR_GET_32(*buffer, buf_len);
-       } else {
-               buf_len = zip_metadata_len;
-       }
-       if (buf_len) {
+       if (zip_metadata_len) {
+               const unsigned char *p, *p_buff = estrndup(*buffer, zip_metadata_len);
+               p = p_buff;
 -              ALLOC_ZVAL(*metadata);
 -              INIT_ZVAL(**metadata);
 +              ZVAL_NULL(metadata);
-               p = (const unsigned char*) *buffer;
                PHP_VAR_UNSERIALIZE_INIT(var_hash);
  
-               if (!php_var_unserialize(metadata, &p, p + buf_len, &var_hash)) {
 -              if (!php_var_unserialize(metadata, &p, p + zip_metadata_len, &var_hash TSRMLS_CC)) {
++              if (!php_var_unserialize(metadata, &p, p + zip_metadata_len, &var_hash)) {
+                       efree(p_buff);
                        PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
                        zval_ptr_dtor(metadata);
 -                      *metadata = NULL;
 +                      ZVAL_UNDEF(metadata);
                        return FAILURE;
                }
+               efree(p_buff);
                PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
  
                if (PHAR_G(persist)) {
                        /* lazy init metadata */
                        zval_ptr_dtor(metadata);
-                       Z_PTR_P(metadata) = pemalloc(buf_len, 1);
-                       memcpy(Z_PTR_P(metadata), *buffer, buf_len);
-                       *buffer += buf_len;
 -                      *metadata = (zval *) pemalloc(zip_metadata_len, 1);
 -                      memcpy(*metadata, *buffer, zip_metadata_len);
++                      Z_PTR_P(metadata) = pemalloc(zip_metadata_len, 1);
++                      memcpy(Z_PTR_P(metadata), *buffer, zip_metadata_len);
                        return SUCCESS;
                }
        } else {
 -              *metadata = NULL;
 +              ZVAL_UNDEF(metadata);
        }
  
-       if (!zip_metadata_len) {
-               *buffer += buf_len;
-       }
        return SUCCESS;
  }
  /* }}}*/
@@@ -666,7 -653,8 +655,8 @@@ static int phar_parse_pharfile(php_stre
        phar_entry_info entry;
        php_uint32 manifest_len, manifest_count, manifest_flags, manifest_index, tmp_len, sig_flags;
        php_uint16 manifest_ver;
 -      long offset;
+       php_uint32 len;
 +      zend_long offset;
        int sig_len, register_alias = 0, temp_alias = 0;
        char *signature = NULL;
  
        mydata->is_persistent = PHAR_G(persist);
  
        /* check whether we have meta data, zero check works regardless of byte order */
+       PHAR_GET_32(buffer, len);
        if (mydata->is_persistent) {
-               PHAR_GET_32(buffer, mydata->metadata_len);
-               if (phar_parse_metadata(&buffer, &mydata->metadata, mydata->metadata_len) == FAILURE) {
-                       MAPPHAR_FAIL("unable to read phar metadata in .phar file \"%s\"");
-               }
-       } else {
-               if (phar_parse_metadata(&buffer, &mydata->metadata, 0) == FAILURE) {
-                       MAPPHAR_FAIL("unable to read phar metadata in .phar file \"%s\"");
+               mydata->metadata_len = len;
+               if(!len) {
+                       /* FIXME: not sure why this is needed but removing it breaks tests */
+                       PHAR_GET_32(buffer, len);
                }
        }
 -      if (phar_parse_metadata(&buffer, &mydata->metadata, len TSRMLS_CC) == FAILURE) {
+       if(len > endbuffer - buffer) {
+               MAPPHAR_FAIL("internal corruption of phar \"%s\" (trying to read past buffer end)");
+       }
++      if (phar_parse_metadata(&buffer, &mydata->metadata, len) == FAILURE) {
+               MAPPHAR_FAIL("unable to read phar metadata in .phar file \"%s\"");
+       }
+       buffer += len;
  
        /* set up our manifest */
        zend_hash_init(&mydata->manifest, manifest_count,
                        entry.flags |= PHAR_ENT_PERM_DEF_DIR;
                }
  
+               PHAR_GET_32(buffer, len);
                if (entry.is_persistent) {
-                       PHAR_GET_32(buffer, entry.metadata_len);
-                       if (!entry.metadata_len) buffer -= 4;
-                       if (phar_parse_metadata(&buffer, &entry.metadata, entry.metadata_len) == FAILURE) {
-                               pefree(entry.filename, entry.is_persistent);
-                               MAPPHAR_FAIL("unable to read file metadata in .phar file \"%s\"");
-                       }
+                       entry.metadata_len = len;
                } else {
-                       if (phar_parse_metadata(&buffer, &entry.metadata, 0) == FAILURE) {
-                               pefree(entry.filename, entry.is_persistent);
-                               MAPPHAR_FAIL("unable to read file metadata in .phar file \"%s\"");
-                       }
+                       entry.metadata_len = 0;
+               }
+               if (len > endbuffer - buffer) {
+                       MAPPHAR_FAIL("internal corruption of phar \"%s\" (truncated manifest entry)");
+               }
 -              if (phar_parse_metadata(&buffer, &entry.metadata, len TSRMLS_CC) == FAILURE) {
++              if (phar_parse_metadata(&buffer, &entry.metadata, len) == FAILURE) {
+                       pefree(entry.filename, entry.is_persistent);
+                       MAPPHAR_FAIL("unable to read file metadata in .phar file \"%s\"");
                }
+               buffer += len;
  
                entry.offset = entry.offset_abs = offset;
                offset += entry.compressed_filesize;
index a2afd4d53b2bb5e24b65fa4f3deacfd9a7c62a75,b9a8019088de085b88fe522240f255ceea7f31f1..ef752817aab675a2e9bc6d78a829e9772a282df3
@@@ -529,11 -536,14 +529,14 @@@ static inline void phar_set_inode(phar_
  {
        char tmp[MAXPATHLEN];
        int tmp_len;
+       size_t len;
  
-       tmp_len = entry->filename_len + entry->phar->fname_len;
-       memcpy(tmp, entry->phar->fname, entry->phar->fname_len);
-       memcpy(tmp + entry->phar->fname_len, entry->filename, entry->filename_len);
+       tmp_len = MIN(MAXPATHLEN, entry->filename_len + entry->phar->fname_len);
+       len = MIN(entry->phar->fname_len, tmp_len);
+       memcpy(tmp, entry->phar->fname, len);
+       len = MIN(tmp_len - len, entry->filename_len);
+       memcpy(tmp + entry->phar->fname_len, entry->filename, len);
 -      entry->inode = (unsigned short)zend_get_hash_value(tmp, tmp_len);
 +      entry->inode = (unsigned short)zend_hash_func(tmp, tmp_len);
  }
  /* }}} */
  
@@@ -559,23 -569,23 +562,23 @@@ char *phar_create_default_stub(const ch
  char *phar_decompress_filter(phar_entry_info * entry, int return_unknown);
  char *phar_compress_filter(phar_entry_info * entry, int return_unknown);
  
 -void phar_remove_virtual_dirs(phar_archive_data *phar, char *filename, int filename_len TSRMLS_DC);
 -void phar_add_virtual_dirs(phar_archive_data *phar, char *filename, int filename_len TSRMLS_DC);
 -int phar_mount_entry(phar_archive_data *phar, char *filename, int filename_len, char *path, int path_len TSRMLS_DC);
 -char *phar_find_in_include_path(char *file, int file_len, phar_archive_data **pphar TSRMLS_DC);
 -char *phar_fix_filepath(char *path, int *new_len, int use_cwd TSRMLS_DC);
 -phar_entry_info * phar_open_jit(phar_archive_data *phar, phar_entry_info *entry, char **error TSRMLS_DC);
 -int phar_parse_metadata(char **buffer, zval **metadata, php_uint32 zip_metadata_len TSRMLS_DC);
 -void destroy_phar_manifest_entry(void *pDest);
 -int phar_seek_efp(phar_entry_info *entry, off_t offset, int whence, off_t position, int follow_links TSRMLS_DC);
 -php_stream *phar_get_efp(phar_entry_info *entry, int follow_links TSRMLS_DC);
 -int phar_copy_entry_fp(phar_entry_info *source, phar_entry_info *dest, char **error TSRMLS_DC);
 -int phar_open_entry_fp(phar_entry_info *entry, char **error, int follow_links TSRMLS_DC);
 -phar_entry_info *phar_get_link_source(phar_entry_info *entry TSRMLS_DC);
 -int phar_create_writeable_entry(phar_archive_data *phar, phar_entry_info *entry, char **error TSRMLS_DC);
 -int phar_separate_entry_fp(phar_entry_info *entry, char **error TSRMLS_DC);
 -int phar_open_archive_fp(phar_archive_data *phar TSRMLS_DC);
 -int phar_copy_on_write(phar_archive_data **pphar TSRMLS_DC);
 +void phar_remove_virtual_dirs(phar_archive_data *phar, char *filename, int filename_len);
 +void phar_add_virtual_dirs(phar_archive_data *phar, char *filename, int filename_len);
 +int phar_mount_entry(phar_archive_data *phar, char *filename, int filename_len, char *path, int path_len);
 +zend_string *phar_find_in_include_path(char *file, int file_len, phar_archive_data **pphar);
 +char *phar_fix_filepath(char *path, int *new_len, int use_cwd);
 +phar_entry_info * phar_open_jit(phar_archive_data *phar, phar_entry_info *entry, char **error);
- int phar_parse_metadata(char **buffer, zval *metadata, int zip_metadata_len);
++int phar_parse_metadata(char **buffer, zval *metadata, php_uint32 zip_metadata_len);
 +void destroy_phar_manifest_entry(zval *zv);
 +int phar_seek_efp(phar_entry_info *entry, zend_off_t offset, int whence, zend_off_t position, int follow_links);
 +php_stream *phar_get_efp(phar_entry_info *entry, int follow_links);
 +int phar_copy_entry_fp(phar_entry_info *source, phar_entry_info *dest, char **error);
 +int phar_open_entry_fp(phar_entry_info *entry, char **error, int follow_links);
 +phar_entry_info *phar_get_link_source(phar_entry_info *entry);
 +int phar_create_writeable_entry(phar_archive_data *phar, phar_entry_info *entry, char **error);
 +int phar_separate_entry_fp(phar_entry_info *entry, char **error);
 +int phar_open_archive_fp(phar_archive_data *phar);
 +int phar_copy_on_write(phar_archive_data **pphar);
  
  /* tar functions in tar.c */
  int phar_is_tar(char *buf, char *fname);
index 457e80644075f82388bec16aea8e6b34cfa16800,25c83a8e1475b67d25dc936b09a5eefa38bd18d2..d5724fed30d8cd597b81ad1fdd83185c9d394010
@@@ -661,15 -659,26 +661,16 @@@ finish
  
        location[0] = '\0';
  
 -      if (!EG(active_symbol_table)) {
 -              zend_rebuild_symbol_table(TSRMLS_C);
 -      }
 +      symbol_table = zend_rebuild_symbol_table();
  
        if (header_init) {
 -              zval *ztmp;
 -              MAKE_STD_ZVAL(ztmp);
 -              array_init(ztmp);
 -              ZEND_SET_SYMBOL(EG(active_symbol_table), "http_response_header", ztmp);
 +              zval ztmp;
 +              array_init(&ztmp);
 +              zend_set_local_var_str("http_response_header", sizeof("http_response_header")-1, &ztmp, 0);
        }
  
 -      {
 -              zval **rh;
 -              if(zend_hash_find(EG(active_symbol_table), "http_response_header", sizeof("http_response_header"), (void **) &rh) != SUCCESS || Z_TYPE_PP(rh) != IS_ARRAY) {
 -                      php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "HTTP request failed, http_response_header overwritten");
 -                      goto out;
 -              }
 -              response_header = *rh;
 -              Z_ADDREF_P(response_header);
 -      }
 +      response_header = zend_hash_str_find_ind(symbol_table, "http_response_header", sizeof("http_response_header")-1);
++      Z_ADDREF_P(response_header);
  
        if (!php_stream_eof(stream)) {
                size_t tmp_line_len;
@@@ -904,7 -920,11 +905,11 @@@ out
  
        if (stream) {
                if (header_init) {
 -                      stream->wrapperdata = response_header;
 +                      ZVAL_COPY(&stream->wrapperdata, response_header);
+               } else {
+                       if(response_header) {
+                               Z_DELREF_P(response_header);
+                       }
                }
                php_stream_notify_progress_init(context, 0, file_size);
  
                if (transfer_encoding) {
                        php_stream_filter_append(&stream->readfilters, transfer_encoding);
                }
-       } else if (transfer_encoding) {
-               php_stream_filter_free(transfer_encoding);
+       } else {
+               if(response_header) {
+                       Z_DELREF_P(response_header);
+               }
+               if (transfer_encoding) {
 -                      php_stream_filter_free(transfer_encoding TSRMLS_CC);
++                      php_stream_filter_free(transfer_encoding);
+               }
        }
  
        return stream;
index b7fe1ae495ea1e512c3fdf6db4a2822395316ac1,4ed2c5e7ee4c3f622646262b50934b5c7705c064..7001dd880793e9357b3a717858ebd55c807eb6b6
@@@ -59,7 -59,7 +59,7 @@@ PHP_FUNCTION(readlink
        char buff[MAXPATHLEN];
        int ret;
  
-       if (zend_parse_parameters(ZEND_NUM_ARGS(), "s", &link, &link_len) == FAILURE) {
 -      if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &link, &link_len) == FAILURE) {
++      if (zend_parse_parameters(ZEND_NUM_ARGS(), "p", &link, &link_len) == FAILURE) {
                return;
        }
  
index a86aae25f0a3678fa18c6b6fc8220fcc9eedc017,9358ea858827540cb33b71fc4d65412f93e7d969..fa9758b06cc7a0029d27b431f420253d9b815235
@@@ -1489,11 -1545,10 +1489,11 @@@ PHP_FUNCTION(stream_socket_enable_crypt
  Determine what file will be opened by calls to fopen() with a relative path */
  PHP_FUNCTION(stream_resolve_include_path)
  {
 -      char *filename, *resolved_path;
 -      int filename_len;
 +      char *filename;
 +      size_t filename_len;
 +      zend_string *resolved_path;
  
-       if (zend_parse_parameters(ZEND_NUM_ARGS(), "s", &filename, &filename_len) == FAILURE) {
 -      if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &filename, &filename_len) == FAILURE) {
++      if (zend_parse_parameters(ZEND_NUM_ARGS(), "p", &filename, &filename_len) == FAILURE) {
                return;
        }
  
index 3cab7a14587ef9b361c0957fc0d1055eacb6f34c,1042008a307b0d29f7f87e8a1cef5fb077cdcecf..a7da0e79024717e465a250ca67f6acab0c985caf
@@@ -1681,21 -1747,31 +1681,21 @@@ static PHP_FUNCTION(xmlwriter_open_uri
        xmlTextWriterPtr ptr;
        char *source;
        char resolved_path[MAXPATHLEN + 1];
 -      int source_len;
 -
 -#ifdef ZEND_ENGINE_2
 -      zval *this = getThis();
 +      size_t source_len;
 +      zval *self = getThis();
        ze_xmlwriter_object *ze_obj = NULL;
 -#endif
  
-       if (zend_parse_parameters(ZEND_NUM_ARGS(), "s", &source, &source_len) == FAILURE) {
 -#ifndef ZEND_ENGINE_2
 -      xmlOutputBufferPtr out_buffer;
 -      void *ioctx;
 -#endif
 -
 -      if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &source, &source_len) == FAILURE) {
++      if (zend_parse_parameters(ZEND_NUM_ARGS(), "p", &source, &source_len) == FAILURE) {
                return;
        }
 -      
 -#ifdef ZEND_ENGINE_2
 -      if (this) {
 +
 +      if (self) {
                /* We do not use XMLWRITER_FROM_OBJECT, xmlwriter init function here */
 -              ze_obj = (ze_xmlwriter_object*) zend_object_store_get_object(this TSRMLS_CC); 
 +              ze_obj = Z_XMLWRITER_P(self);
        }
 -#endif
  
        if (source_len == 0) {
 -              php_error_docref(NULL TSRMLS_CC, E_WARNING, "Empty string as source");
 +              php_error_docref(NULL, E_WARNING, "Empty string as source");
                RETURN_FALSE;
        }
  
diff --cc ext/zlib/zlib.c
index 0cb94fe6e478eb1616cb56b3196ddcddb0668555,ec958e1257ba57e7f92814ba90ddb453a76ec057..f44f92b86d45f2fcefb63e5a0381d463409a493c
@@@ -583,12 -588,12 +583,12 @@@ static PHP_FUNCTION(gzopen
  {
        char *filename;
        char *mode;
 -      int filename_len, mode_len;
 +      size_t filename_len, mode_len;
        int flags = REPORT_ERRORS;
        php_stream *stream;
 -      long use_include_path = 0;
 +      zend_long use_include_path = 0;
  
-       if (zend_parse_parameters(ZEND_NUM_ARGS(), "ss|l", &filename, &filename_len, &mode, &mode_len, &use_include_path) == FAILURE) {
 -      if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ps|l", &filename, &filename_len, &mode, &mode_len, &use_include_path) == FAILURE) {
++      if (zend_parse_parameters(ZEND_NUM_ARGS(), "ps|l", &filename, &filename_len, &mode, &mode_len, &use_include_path) == FAILURE) {
                return;
        }
  
  static PHP_FUNCTION(readgzfile)
  {
        char *filename;
 -      int filename_len;
 +      size_t filename_len;
        int flags = REPORT_ERRORS;
        php_stream *stream;
 -      int size;
 -      long use_include_path = 0;
 +      size_t size;
 +      zend_long use_include_path = 0;
  
-       if (zend_parse_parameters(ZEND_NUM_ARGS(), "s|l", &filename, &filename_len, &use_include_path) == FAILURE) {
 -      if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &filename, &filename_len, &use_include_path) == FAILURE) {
++      if (zend_parse_parameters(ZEND_NUM_ARGS(), "p|l", &filename, &filename_len, &use_include_path) == FAILURE) {
                return;
        }
  
Simple merge