MFB

diff --git a/Zend/tests/foreach.phpt b/Zend/tests/foreach.phpt
new file mode 100644 (file)
index 0000000..041a763
--- /dev/null
+++ b/Zend/tests/foreach.phpt
@@ -0,0 +1,25 @@
+--TEST--
+foreach() by-ref bug
+--FILE--
+<?php
+$foo = array(1,2,3,4);
+foreach($foo as $key => &$val) {
+       if($val == 3) {
+               $foo[$key] = 0;
+       } else {
+               $val++;
+       }
+}
+var_dump($foo);
+?>
+--EXPECT--     
+array(4) {
+  [0]=>
+  int(2)
+  [1]=>
+  int(3)
+  [2]=>
+  int(0)
+  [3]=>
+  &int(5)
+}

diff --git a/ext/filter/tests/PMOPB45.phpt b/ext/filter/tests/PMOPB45.phpt
new file mode 100644 (file)
index 0000000..532eb21
--- /dev/null
+++ b/ext/filter/tests/PMOPB45.phpt
@@ -0,0 +1,11 @@
+--TEST--
+PMOPB-45-2007:PHP ext/filter Email Validation Vulnerability
+--SKIPIF--
+<?php if (!extension_loaded("filter")) die("skip"); ?>
+--FILE--
+<?php
+       $var = "test@example.com\n";
+       var_dump(filter_var($var, FILTER_VALIDATE_EMAIL));
+?>
+--EXPECT--     
+bool(false)

diff --git a/ext/imap/tests/bug40854.phpt b/ext/imap/tests/bug40854.phpt
new file mode 100644 (file)
index 0000000..3df81ea
--- /dev/null
+++ b/ext/imap/tests/bug40854.phpt
@@ -0,0 +1,57 @@
+--TEST--                                 
+Bug #40854 (imap_mail_compose() creates an invalid terminator for multipart e-mails)
+--SKIPIF--
+<?php
+        if (!extension_loaded("imap")) { 
+                die("skip imap extension not available");  
+        }
+?>
+--FILE--
+<?php
+$envelope["from"]= "joe@example.com";
+$envelope["to"]  = "foo@example.com";
+$envelope["cc"]  = "bar@example.com";
+
+$part1["type"] = TYPEMULTIPART;
+$part1["subtype"] = "mixed";
+
+$part2["type"] = TYPEAPPLICATION;
+$part2["encoding"] = ENCBINARY;
+$part2["subtype"] = "octet-stream";
+$part2["description"] = 'a.txt';
+$part2["contents.data"] = '';
+
+$part3["type"] = TYPETEXT;
+$part3["subtype"] = "plain";
+$part3["description"] = "description3";
+$part3["contents.data"] = "contents.data3\n\n\n\t";
+
+$body[1] = $part1;
+$body[2] = $part2;
+$body[3] = $part3;
+
+echo imap_mail_compose($envelope, $body);
+?>
+--EXPECTF--
+From: joe@example.com
+To: foo@example.com
+cc: bar@example.com
+MIME-Version: 1.0
+Content-Type: MULTIPART/mixed; BOUNDARY="%s"
+
+--%s
+Content-Type: APPLICATION/octet-stream
+Content-Transfer-Encoding: BASE64
+Content-Description: a.txt
+
+
+
+--%s
+Content-Type: TEXT/plain; CHARSET=US-ASCII
+Content-Description: description3
+
+contents.data3
+
+
+       
+--%s--
\ No newline at end of file

diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
index 9ea09addffb099fd4f992eab90ca514acbd7763b..86216268159641e2ea82af34fce39ef6219cd5c0 100644 (file)
--- a/ext/pgsql/pgsql.c
+++ b/ext/pgsql/pgsql.c
@@ -3280,7 +3280,6 @@ PHP_FUNCTION(pg_copy_to)
        char *table_name, *pg_delim = NULL, *pg_null_as = NULL;
        int table_name_len, pg_delim_len, pg_null_as_len;
        char *query;
-       char *query_template = "COPY \"\" TO STDOUT DELIMITERS ':' WITH NULL AS ''";
        int id = -1;
        PGconn *pgsql;
        PGresult *pgsql_result;
@@ -3308,9 +3307,7 @@ PHP_FUNCTION(pg_copy_to)
                pg_null_as = safe_estrdup("\\\\N");
        }
 
-       query = (char *)emalloc(strlen(query_template) + strlen(table_name) + strlen(pg_null_as) + 1);
-       sprintf(query, "COPY \"%s\" TO STDOUT DELIMITERS '%c' WITH NULL AS '%s'",
-                       table_name, *pg_delim, pg_null_as);
+       spprintf(&query, 0, "COPY \"%s\" TO STDOUT DELIMITERS '%c' WITH NULL AS '%s'", table_name, *pg_delim, pg_null_as);
 
        while ((pgsql_result = PQgetResult(pgsql))) {
                PQclear(pgsql_result);
@@ -3418,7 +3415,6 @@ PHP_FUNCTION(pg_copy_from)
        int  table_name_len, pg_delim_len, pg_null_as_len;
        int  pg_null_as_free = 0;
        char *query;
-       char *query_template = "COPY \"\" FROM STDIN DELIMITERS ':' WITH NULL AS ''";
        HashPosition pos;
        int id = -1;
        PGconn *pgsql;
@@ -3441,9 +3437,7 @@ PHP_FUNCTION(pg_copy_from)
 
        ZEND_FETCH_RESOURCE2(pgsql, PGconn *, &pgsql_link, id, "PostgreSQL link", le_link, le_plink);
 
-       query = (char *)emalloc(strlen(query_template) + strlen(table_name) + strlen(pg_null_as) + 1);
-       sprintf(query, "COPY \"%s\" FROM STDIN DELIMITERS '%c' WITH NULL AS '%s'",
-                       table_name, *pg_delim, pg_null_as);
+       spprintf(&query, 0, "COPY \"%s\" FROM STDIN DELIMITERS '%c' WITH NULL AS '%s'", table_name, *pg_delim, pg_null_as);
        while ((pgsql_result = PQgetResult(pgsql))) {
                PQclear(pgsql_result);
        }

diff --git a/ext/standard/dl.c b/ext/standard/dl.c
index 772975a844571edc096c86aa448482888771d6bb..f8cc30c8a5f3ecb824e3502184c450fc94c8f52c 100644 (file)
--- a/ext/standard/dl.c
+++ b/ext/standard/dl.c
@@ -115,12 +115,10 @@ void php_dl(zval *file, int type, zval *return_value, int start_now TSRMLS_DC)
        if (extension_dir && extension_dir[0]){
                int extension_dir_len = strlen(extension_dir);
 
-               libpath = emalloc(extension_dir_len+filename_len+2);
-
                if (IS_SLASH(extension_dir[extension_dir_len-1])) {
-                       sprintf(libpath, "%s%s", extension_dir, filename); /* SAFE */
+                       spprintf(libpath, 0, "%s%s", extension_dir, filename); /* SAFE */
                } else {
-                       sprintf(libpath, "%s%c%s", extension_dir, DEFAULT_SLASH, filename); /* SAFE */
+                       spprintf(libpath, 0, "%s%c%s", extension_dir, DEFAULT_SLASH, filename); /* SAFE */
                }
        } else {
                libpath = estrndup(filename, filename_len);

diff --git a/ext/sybase/php_sybase_db.c b/ext/sybase/php_sybase_db.c
index 0a6f15fb712d205dabbc7ff54c88ca954ee7494c..4f6bbb0e0ed176517f2f83a5f4320c47480034a4 100644 (file)
--- a/ext/sybase/php_sybase_db.c
+++ b/ext/sybase/php_sybase_db.c
@@ -327,9 +327,7 @@ static void php_sybase_do_connect(INTERNAL_FUNCTION_PARAMETERS,int persistent)
                                }
                                convert_to_string_ex(yyhost);
                                host = Z_STRVAL_PP(yyhost);
-                               hashed_details_length = Z_STRLEN_PP(yyhost)+6+5;
-                               hashed_details = (char *) emalloc(hashed_details_length+1);
-                               sprintf(hashed_details,"sybase_%s____", Z_STRVAL_PP(yyhost));
+                               hashed_details_length = spprintf(&hashed_details, 0, "sybase_%s____", Z_STRVAL_PP(yyhost));
                        }
                        break;
                case 2: {
@@ -342,9 +340,7 @@ static void php_sybase_do_connect(INTERNAL_FUNCTION_PARAMETERS,int persistent)
                                convert_to_string_ex(yyuser);
                                host = Z_STRVAL_PP(yyhost);
                                user = Z_STRVAL_PP(yyuser);
-                               hashed_details_length = Z_STRLEN_PP(yyhost)+Z_STRLEN_PP(yyuser)+6+5;
-                               hashed_details = (char *) emalloc(hashed_details_length+1);
-                               sprintf(hashed_details,"sybase_%s_%s___",Z_STRVAL_PP(yyhost),Z_STRVAL_PP(yyuser));
+                               hashed_details_length = spprintf(&hashed_details, 0, "sybase_%s_%s___", Z_STRVAL_PP(yyhost), Z_STRVAL_PP(yyuser));
                        }
                        break;
                case 3: {
@@ -359,9 +355,7 @@ static void php_sybase_do_connect(INTERNAL_FUNCTION_PARAMETERS,int persistent)
                                host = Z_STRVAL_PP(yyhost);
                                user = Z_STRVAL_PP(yyuser);
                                passwd = Z_STRVAL_PP(yypasswd);
-                               hashed_details_length = Z_STRLEN_PP(yyhost)+Z_STRLEN_PP(yyuser)+Z_STRLEN_PP(yypasswd)+6+5;
-                               hashed_details = (char *) emalloc(hashed_details_length+1);
-                               sprintf(hashed_details,"sybase_%s_%s_%s__",Z_STRVAL_PP(yyhost),Z_STRVAL_PP(yyuser),Z_STRVAL_PP(yypasswd)); /* SAFE */
+                               hashed_details_length = spprintf(&hashed_details, 0, "sybase_%s_%s_%s__", Z_STRVAL_PP(yyhost), Z_STRVAL_PP(yyuser), Z_STRVAL_PP(yypasswd));
                        }
                        break;
                case 4: {
@@ -378,9 +372,7 @@ static void php_sybase_do_connect(INTERNAL_FUNCTION_PARAMETERS,int persistent)
                                user = Z_STRVAL_PP(yyuser);
                                passwd = Z_STRVAL_PP(yypasswd);
                                charset = Z_STRVAL_PP(yycharset);
-                               hashed_details_length = Z_STRLEN_PP(yyhost)+Z_STRLEN_PP(yyuser)+Z_STRLEN_PP(yypasswd)+Z_STRLEN_PP(yycharset)+6+5;
-                               hashed_details = (char *) emalloc(hashed_details_length+1);
-                               sprintf(hashed_details,"sybase_%s_%s_%s_%s_",Z_STRVAL_PP(yyhost),Z_STRVAL_PP(yyuser),Z_STRVAL_PP(yypasswd),Z_STRVAL_PP(yycharset)); /* SAFE */
+                               hashed_details_length = spprintf(&hashed_details, 0, "sybase_%s_%s_%s_%s_", Z_STRVAL_PP(yyhost), Z_STRVAL_PP(yyuser), Z_STRVAL_PP(yypasswd), Z_STRVAL_PP(yycharset));
                        }
                        break;
                case 5: {
@@ -399,9 +391,7 @@ static void php_sybase_do_connect(INTERNAL_FUNCTION_PARAMETERS,int persistent)
                                passwd = Z_STRVAL_PP(yypasswd);
                                charset = Z_STRVAL_PP(yycharset);
                                appname = Z_STRVAL_PP(yyappname);
-                               hashed_details_length = Z_STRLEN_PP(yyhost)+Z_STRLEN_PP(yyuser)+Z_STRLEN_PP(yypasswd)+Z_STRLEN_PP(yycharset)+Z_STRLEN_PP(yyappname)+6+5;
-                               hashed_details = (char *) emalloc(hashed_details_length+1);
-                               sprintf(hashed_details,"sybase_%s_%s_%s_%s_%s",Z_STRVAL_PP(yyhost),Z_STRVAL_PP(yyuser),Z_STRVAL_PP(yypasswd),Z_STRVAL_PP(yycharset),Z_STRVAL_PP(yyappname)); /* SAFE */
+                               hashed_details_length = spprintf(hashed_details, 0, "sybase_%s_%s_%s_%s_%s", Z_STRVAL_PP(yyhost), Z_STRVAL_PP(yyuser), Z_STRVAL_PP(yypasswd), Z_STRVAL_PP(yycharset), Z_STRVAL_PP(yyappname));
                        }
                        break;
                default:

diff --git a/ext/tidy/tests/024.phpt b/ext/tidy/tests/024.phpt
index 43f04bd9432d4be2b0e13ea132dcb8d31b827056..f69b962aee7d6b3efb2165d8024b522476168e86 100644 (file)
--- a/ext/tidy/tests/024.phpt
+++ b/ext/tidy/tests/024.phpt
@@ -27,27 +27,13 @@ $tidy->cleanRepair();
 var_dump($tidy->value);
 
 ?>
---EXPECT--
-string(117) "<html>
+--EXPECTF--
+string(11%d) "<html>
 <head>
 <title></title>
 </head>
 <body>
-<wps:block>
-<wps:var>
-<wps:value></wps:var>
-</wps:block>
-</body>
-</html>"
---UEXPECT--
-unicode(117) "<html>
-<head>
-<title></title>
-</head>
-<body>
-<wps:block>
-<wps:var>
-<wps:value></wps:var>
-</wps:block>
+<wps:block>%w<wps:var>
+<wps:value></wps:var>%w</wps:block>
 </body>
 </html>"

diff --git a/ext/xmlrpc/libxmlrpc/base64.c b/ext/xmlrpc/libxmlrpc/base64.c
index 7788d028d7859204d0c1ef8e0095e2939d89d41e..d020bd6646287a8a7a9e5c6242f8080f58c9f027 100644 (file)
--- a/ext/xmlrpc/libxmlrpc/base64.c
+++ b/ext/xmlrpc/libxmlrpc/base64.c
@@ -49,7 +49,7 @@ void buffer_delete(struct buffer_st *b)
   b->data = NULL;
 }
 
-void base64_encode(struct buffer_st *b, const char *source, int length)
+void base64_encode_xmlrpc(struct buffer_st *b, const char *source, int length)
 {
   int i, hiteof = 0;
   int offset = 0;
@@ -114,7 +114,7 @@ void base64_encode(struct buffer_st *b, const char *source, int length)
   buffer_add(b, '\n');
 }
 
-void base64_decode(struct buffer_st *bfr, const char *source, int length)
+void base64_decode_xmlrpc(struct buffer_st *bfr, const char *source, int length)
 {
     int i;
     int offset = 0;

diff --git a/ext/xmlrpc/libxmlrpc/base64.h b/ext/xmlrpc/libxmlrpc/base64.h
index 4cf156ad1e6f8cf183768e3527001d66f89ea629..6a0c8ef6fc855b0850b303d8760917ac83026f58 100644 (file)
--- a/ext/xmlrpc/libxmlrpc/base64.h
+++ b/ext/xmlrpc/libxmlrpc/base64.h
@@ -21,8 +21,8 @@ void buffer_new(struct buffer_st *b);
 void buffer_add(struct buffer_st *b, char c);
 void buffer_delete(struct buffer_st *b);
 
-void base64_encode(struct buffer_st *b, const char *source, int length);
-void base64_decode(struct buffer_st *b, const char *source, int length);
+void base64_encode_xmlrpc(struct buffer_st *b, const char *source, int length);
+void base64_decode_xmlrpc(struct buffer_st *b, const char *source, int length);
 
 /*
 #define DEBUG_MALLOC

diff --git a/main/streams/transports.c b/main/streams/transports.c
index dcc2abf5653e1a8a1078b7b69eddbe1e19751156..e904fe4e4a91faa09920f37c891185859ecb3833 100644 (file)
--- a/main/streams/transports.c
+++ b/main/streams/transports.c
@@ -139,7 +139,7 @@ PHPAPI php_stream *_php_stream_xport_create(const char *name, long namelen, int
                if ((flags & STREAM_XPORT_SERVER) == 0) {
                        /* client */
 
-                       if (flags & STREAM_XPORT_CONNECT) {
+                       if (flags & (STREAM_XPORT_CONNECT|STREAM_XPORT_CONNECT_ASYNC)) {
                                if (-1 == php_stream_xport_connect(stream, name, namelen,
                                                        flags & STREAM_XPORT_CONNECT_ASYNC ? 1 : 0,
                                                        timeout, &error_text, error_code TSRMLS_CC)) {