Anatol Belski [Wed, 12 Oct 2016 14:24:51 +0000 (16:24 +0200)]
Merge branch 'PHP-7.1'
* PHP-7.1:
Revert "Fix for #73240 - Write out of bounds at number_format"
followup with #73276 merge
fix test
Fix bug #73276 - crash in openssl_random_pseudo_bytes function
Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML()
Fix for #73240 - Write out of bounds at number_format
avoid strlen
Bug #73218: add mitigation for ICU int overflow
Add more locale length checks, due to ICU bugs.
Fix bug #73150: missing NULL check in dom_document_save_html
Clear FG(user_stream_current_filename) when bailing out
set versions and release date
sync NEWS
Revert "Fixed bug #73067 (__debugInfo crashes when throwing an exception)"
Fix for #73240 - Write out of bounds at number_format
Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object as key
set versions
Fix bug #73091 - Unserializing DateInterval object may lead to __toString invocation
Anatol Belski [Wed, 12 Oct 2016 14:06:11 +0000 (16:06 +0200)]
Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
followup with #73276 merge
fix test
Fix bug #73276 - crash in openssl_random_pseudo_bytes function
Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML()
Fix for #73240 - Write out of bounds at number_format
avoid strlen
Bug #73218: add mitigation for ICU int overflow
Add more locale length checks, due to ICU bugs.
Fix bug #73150: missing NULL check in dom_document_save_html
Clear FG(user_stream_current_filename) when bailing out
set versions and release date
sync NEWS
Revert "Fixed bug #73067 (__debugInfo crashes when throwing an exception)"
Fix for #73240 - Write out of bounds at number_format
Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object as key
set versions
Fix bug #73091 - Unserializing DateInterval object may lead to __toString invocation
Sara Golemon [Wed, 12 Oct 2016 04:35:10 +0000 (21:35 -0700)]
Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.
Catch the bailout, clear the variable, then continue bailing.
Sara Golemon [Wed, 12 Oct 2016 04:35:10 +0000 (21:35 -0700)]
Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.
Catch the bailout, clear the variable, then continue bailing.
* PHP-7.0.12:
set versions and release date
sync NEWS
Revert "Fixed bug #73067 (__debugInfo crashes when throwing an exception)"
Fix for #73240 - Write out of bounds at number_format
Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object as key
set versions
Fix bug #73091 - Unserializing DateInterval object may lead to __toString invocation
Merge remote-tracking branch 'origin/PHP-7.0.12' into PHP-7.0.12
* origin/PHP-7.0.12: (99 commits)
set versions and release date
sync NEWS
Revert "Fixed bug #73067 (__debugInfo crashes when throwing an exception)"
set versions
update NEWS
Ignore potentially misleading dberr values
update NEWS
Fixed bug #73172 parse error: Invalid numeric literal
Fix #53745: cgi.discard_path option is missing from php.ini
update libs_versions.txt
update libs_versions.txt
Fixed bug #73156 (segfault on undefined function)
Add an include path for freetype which is relevant for cmake builds
Fix test_image_equals_file() wrt. palette images
Fixed bug #73163
Fix #73161: imagecreatefromgd2() may leak memory
Fix #73159: imagegd2(): unrecognized formats may result in corrupted files
Fix #73155: imagegd2() writes wrong chunk sizes on boundaries
Fix #73157 (again): imagegd2() ignores 3rd param if 4 are given
Fix #73157: imagegd2() ignores 3rd param if 4 are given
...
Adam Baratz [Mon, 10 Oct 2016 22:10:37 +0000 (18:10 -0400)]
Fix #73234: Emulated statements let value dictate parameter type
The prepared statement emulator (pdo_sql_parser.*) figures out how to quote
each query parameter. The intended type is specified by the PDO::PARAM_*
consts, but this direction wasn't always followed. In practice, queries could
work as expected, but subtle errors could result. For example, a numeric string
bound as PDO::PARAM_INT would be sent to a driver's quote function. While these
functions are told which type is expected, they generally assume values are
being quoted as strings. This can result in implicit casts, which are bad for
performance.
This commit includes the following changes:
- Cast values marked as bool/int/null to the appropriate type and bypass the
driver's quote function.
- Save some memory by dropping the temporary zval used for casting.
- Avoid a memory leak if the driver's quote function produces an error.
- Appropriate test suite updates.
Remove channels from getimagesize() results for WebP
Both lossless and lossy WebP can have an alpha channel, but this is
somewhat hard to detect. Furthermore, it is not clear whether an alpha
channel should be counted for getimagesize(). Therefore we remove the
`channel` element from the result array.
Nikita Popov [Sat, 8 Oct 2016 14:56:17 +0000 (16:56 +0200)]
Fix bug #66773, #66862
This a partial backport of 8754b19. It
a) fixes the class/function/constant import table confusion in the
namespaced case, and
b) restricts conflict checks to a single file based on a filename
pointer comparison.
It does not fix the issues with filename reuse (e.g. due to eval)
and late-bound classes. This part of the change requires globals
changes.
This ammends commit 14d4ee93 to also add support for the extended
WebP format, according to
<https://developers.google.com/speed/webp/docs/riff_container>.
This ammends commit 14d4ee93 to also add support for simple lossless
WebP, according to
<https://chromium.googlesource.com/webm/libwebp/+/master/doc/webp-lossless-bitstream-spec.txt>
We add WebP support for getimagesize(), getimagesizefromstring)(),
image_type_to_extension() and image_type_to_mime_type(). For now we
care only about the simple lossy WebP format (VP8) and ignore the
lossless (VP8L) and extended (VP8X) formats. We use image/webp as MIME
type as it appears to be pretty common, even though it is not yet
registered with IANA.
projects / php / log