From: Xinchen Hui <laruence@php.net>
Date: Thu, 5 Feb 2015 08:33:20 +0000 (+0800)
Subject: Merge branch 'PHP-5.5' into PHP-5.6
X-Git-Tag: PRE_PHP7_EREG_MYSQL_REMOVALS~3^2~8^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ae900108916885db03a047d5e5b14eddbac63d13;p=php

Merge branch 'PHP-5.5' into PHP-5.6

Conflicts:
	main/streams/memory.c
---

ae900108916885db03a047d5e5b14eddbac63d13
diff --cc NEWS
index 5c94e12519,dd20fa9bd7..063e752fec
--- a/NEWS
+++ b/NEWS
@@@ -1,13 -1,14 +1,15 @@@
 -PHP                                                                        NEWS
 +PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? 2015, PHP 5.5.23
 +?? Feb 2015, PHP 5.6.7
  
  
 -?? ??? 2015, PHP 5.5.22
 +
 +?? Feb 2015, PHP 5.6.6
  
  - Core:
+   . Fixed bug #68986 (pointer returned by php_stream_fopen_temporary_file
+     not validated in memory.c). (nayana at ddproperty dot com)
 -  . Fixed bug #67068 (getClosure returns somethings that's not a closure). 
 +  . Fixed bug #67068 (getClosure returns somethings that's not a closure).
      (Danack at basereality dot com)
    . Fixed bug #68925 (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname
      buffer overflow). (Stas)
diff --cc main/streams/memory.c
index 1577ae5d60,d0f2511aa7..e5b65728a1
--- a/main/streams/memory.c
+++ b/main/streams/memory.c
@@@ -374,7 -373,11 +374,11 @@@ static size_t php_stream_temp_write(php
  		char *membuf = php_stream_memory_get_buffer(ts->innerstream, &memsize);
  
  		if (memsize + count >= ts->smax) {
 -			php_stream *file = php_stream_fopen_tmpfile();
 +			php_stream *file = php_stream_fopen_temporary_file(ts->tmpdir, "php", NULL);
+ 			if (file == NULL) {
+ 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to create temporary file, Check permissions in temporary files directory.");
+ 				return 0;
+ 			}
  			php_stream_write(file, membuf, memsize);
  			php_stream_free_enclosed(ts->innerstream, PHP_STREAM_FREE_CLOSE);
  			ts->innerstream = file;