]> granicus.if.org Git - php/log
php
8 years agoAdd more checks for int overflow
Stanislav Malyshev [Mon, 5 Sep 2016 05:18:19 +0000 (22:18 -0700)]
Add more checks for int overflow

8 years agoFix bug #72928 - Out of bound when verify signature of zip phar in phar_parse_zipfile
Stanislav Malyshev [Mon, 5 Sep 2016 05:07:35 +0000 (22:07 -0700)]
Fix bug #72928 - Out of bound when verify signature of zip phar in phar_parse_zipfile

8 years agoFix various int size overflows.
Stanislav Malyshev [Fri, 2 Sep 2016 06:15:34 +0000 (23:15 -0700)]
Fix various int size overflows.

Add function for detection of string zvals with length that does not fit
INT_MAX.

8 years agoSkip regression test for issue that has not yet been released in libgd
Christoph M. Becker [Mon, 12 Sep 2016 11:21:34 +0000 (13:21 +0200)]
Skip regression test for issue that has not yet been released in libgd

<https://github.com/libgd/libgd/issues/177> has been assessed as enhancement,
so most likely it will be released with GD 2.3.

8 years agoSkip test for external GD because of not yet published bugfix
Christoph M. Becker [Mon, 12 Sep 2016 10:34:11 +0000 (12:34 +0200)]
Skip test for external GD because of not yet published bugfix

8 years agoSkip tests for unpatched external libgd regarding libvpx
Christoph M. Becker [Sun, 11 Sep 2016 21:49:09 +0000 (23:49 +0200)]
Skip tests for unpatched external libgd regarding libvpx

Some issues have never been fixed in the external libgd's libvpx binding,
so we skip the respective tests.

8 years agoSplit test for bundled vs. external libgd
Christoph M. Becker [Sun, 11 Sep 2016 17:30:55 +0000 (19:30 +0200)]
Split test for bundled vs. external libgd

The behavior of imagecropauto($im, IMG_CROP_DEFAULT) is rather different
for the bundled and an external libgd, see
<https://github.com/libgd/libgd/issues/298>.
Therefore we split the test for now.

8 years agoMake test case more resilient
Christoph M. Becker [Sun, 11 Sep 2016 16:29:27 +0000 (18:29 +0200)]
Make test case more resilient

This test case fails with external libgd, because libgd < 2.2.4 converts
palette images to truecolor (<https://github.com/libgd/libgd/issues/297>).

However, even if there happens no truecolor conversion, it is not guaranteed
that the palette indexes of the original and the cropped image are identical
(this is, for instance, not the case with current libgd master where the bug
has been fixed). Therefore we check for the expected RGBA value instead of
the palette index.

8 years agoA picture is worth a thousand message digests
Christoph M. Becker [Sun, 19 Jun 2016 12:29:27 +0000 (14:29 +0200)]
A picture is worth a thousand message digests

The bundled GD test suites makes heavy use of md5() to verify the result
of drawing operations. This leads to fragile tests (even a slight change
in a PNG header would cause failure, and of course there is the
possibility of collisions), and even worse, eventual test failures are
rather unrevealing.

Therefore we replace all md5() verification with a simplistic
test_image_equals_file(), which is basically a simplified port of libgd's
gdTestImageCompareToFile(), adapted to the needs of PHPTs.

In the long run better tests helpers should be introduced (see also
<http://news.php.net/php.internals/94081>), but for now this solution
is preferable over the former.

(cherry picked from commit 24f9e96792518ec2a75f26b1eb2471dd7694f2b7)

8 years agoAdd regression test for bug #73053
Christoph M. Becker [Sat, 10 Sep 2016 22:06:45 +0000 (00:06 +0200)]
Add regression test for bug #73053

The test succeeds with libxml < 2.9.4, and is supposed to succeed with
libxml > 2.9.4. Unfortunately, we can't conditionally mark a test case
as XFAIL, so we're simply skipping the test for libxml 2.9.4 instead.

8 years agoupdate NEWS
Anatol Belski [Sat, 10 Sep 2016 09:02:17 +0000 (11:02 +0200)]
update NEWS

8 years agoBug #73058 crypt broken when salt is 'too' long
Anatol Belski [Sat, 10 Sep 2016 00:39:28 +0000 (02:39 +0200)]
Bug #73058 crypt broken when salt is 'too' long

8 years agoRemove ignored --FAIL-- section from test case
Christoph M. Becker [Fri, 9 Sep 2016 14:27:50 +0000 (16:27 +0200)]
Remove ignored --FAIL-- section from test case

This is just confusing.

8 years agoFix #73054: default option ignored when object passed to int filter
Christoph M. Becker [Fri, 9 Sep 2016 12:30:24 +0000 (14:30 +0200)]
Fix #73054: default option ignored when object passed to int filter

If an object that can't be converted to string is validated, we must not
bail out early, but rather check for a requested default value.

8 years agoPartially fix bug #67167 - Wrong return value...
Levi Morrison [Thu, 3 Sep 2015 00:23:26 +0000 (18:23 -0600)]
Partially fix bug #67167 - Wrong return value...

...from FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE

The remainer of the fix would require the filter functions to only
convert to string when it makes sense for that particular filter.

(cherry picked from commit 432dc527adcbc3bf4809f6315350300d42c16c52)

8 years agoFixed Bug #68015 Session does not report invalid uid for files save handler
Yasuo Ohgaki [Fri, 9 Sep 2016 02:30:33 +0000 (11:30 +0900)]
Fixed Bug #68015 Session does not report invalid uid for files save handler

8 years agobackport 59444347 and 3d7343f6
Anatol Belski [Thu, 8 Sep 2016 15:46:53 +0000 (17:46 +0200)]
backport 59444347 and 3d7343f6

8 years agoFix bug26639.phpt
Yasuo Ohgaki [Thu, 8 Sep 2016 05:07:57 +0000 (14:07 +0900)]
Fix bug26639.phpt

8 years agoUpdate NEWS
Yasuo Ohgaki [Thu, 8 Sep 2016 04:35:30 +0000 (13:35 +0900)]
Update NEWS

8 years agoFix Bug #72992 mbstring.internal_encoding doesn't inherit default_charset
Yasuo Ohgaki [Thu, 8 Sep 2016 04:16:50 +0000 (13:16 +0900)]
Fix Bug #72992 mbstring.internal_encoding doesn't inherit default_charset

8 years agoFix #73025: Heap Buffer Overflow in virtual_popen of zend_virtual_cwd.c
Christoph M. Becker [Tue, 6 Sep 2016 10:05:22 +0000 (12:05 +0200)]
Fix #73025: Heap Buffer Overflow in virtual_popen of zend_virtual_cwd.c

`command_length` is retrieved via strlen() and later passed to emalloc()
and memcpy(), so the appropriate type is `size_t`.

We don't add a regression test, because that would need to allocate a string
of at least 2 GiB.

8 years agoUpdate NEWS
Yasuo Ohgaki [Tue, 6 Sep 2016 09:29:20 +0000 (18:29 +0900)]
Update NEWS

8 years agoFixed Bug #66964 mb_convert_variables() cannot detect recursion
Yasuo Ohgaki [Tue, 6 Sep 2016 07:05:34 +0000 (16:05 +0900)]
Fixed Bug #66964 mb_convert_variables() cannot detect recursion

8 years agoFix #70752: Depacking with wrong password leaves 0 length files
Christoph M. Becker [Mon, 5 Sep 2016 22:28:28 +0000 (00:28 +0200)]
Fix #70752: Depacking with wrong password leaves 0 length files

We should not open the output stream before we have tried to open the
archive entry, as failing the latter could leave an empty file behind.

8 years agoUpdated NEWS
Julien Pauli [Mon, 5 Sep 2016 15:03:29 +0000 (17:03 +0200)]
Updated NEWS

8 years agoFixes #72590: Opcache restart with kill_all_lockers does not work
Keyur [Wed, 13 Jul 2016 02:47:46 +0000 (02:47 +0000)]
Fixes #72590: Opcache restart with kill_all_lockers does not work

ACCEL_LOG_ERROR is special and causes a zend_bailout() and the code
never gets to call kill() in the next line after the logging. Change
the log level to WARNING.

8 years agoLimit editorconfig to C code
Nikita Popov [Mon, 5 Sep 2016 12:21:43 +0000 (14:21 +0200)]
Limit editorconfig to C code

PHPT files do not follow this.

[ci skip]

8 years agoUpdated NEWS
Julien Pauli [Mon, 5 Sep 2016 08:17:56 +0000 (10:17 +0200)]
Updated NEWS

8 years agoFix #72972, Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and FILTER_FLAG_NO_PRIV...
Julien Pauli [Thu, 1 Sep 2016 08:36:58 +0000 (10:36 +0200)]
Fix #72972, Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and FILTER_FLAG_NO_PRIV_RANGE

8 years agoAdded editorconfig file
Richard Fussenegger [Sun, 26 Jun 2016 15:51:44 +0000 (17:51 +0200)]
Added editorconfig file

8 years agoImplement #47456: Missing PCRE option 'J'
Christoph M. Becker [Thu, 21 Jul 2016 13:36:42 +0000 (15:36 +0200)]
Implement #47456: Missing PCRE option 'J'

While it is possible to force the same behavior by setting the internal
option (?J), having a dedicated modifier appears to be useful. After all,
J is even listed on the "Pattern Modifiers" man page[1], but the description
referrs to (?J).

[1] <http://php.net/manual/en/reference.pcre.pattern.modifiers.php>

8 years agoMerge branch 'pull-request/2061' into PHP-5.6
Stanislav Malyshev [Mon, 5 Sep 2016 07:29:11 +0000 (00:29 -0700)]
Merge branch 'pull-request/2061' into PHP-5.6

* pull-request/2061:
  Recognize TDS versions 7.3 and 7.4

8 years agoUse integer placeholders, since values can vary with the TDS version
Adam Baratz [Wed, 24 Aug 2016 22:44:55 +0000 (18:44 -0400)]
Use integer placeholders, since values can vary with the TDS version

8 years agoSame issue as #72926 in another place.
Stanislav Malyshev [Mon, 5 Sep 2016 03:49:34 +0000 (20:49 -0700)]
Same issue as #72926 in another place.

8 years agoSync fix for bug #72910 with current upstream
Stanislav Malyshev [Mon, 5 Sep 2016 02:13:22 +0000 (19:13 -0700)]
Sync fix for bug #72910 with current upstream

8 years agoFix #72994: mbc_to_code() out of bounds read
Christoph M. Becker [Sun, 4 Sep 2016 14:37:06 +0000 (16:37 +0200)]
Fix #72994: mbc_to_code() out of bounds read

We're backporting commit 999a3553 to the still supported PHP 5.6.

8 years agoFix #67325: imagetruecolortopalette: white is duplicated in palette
Christoph M. Becker [Sat, 3 Sep 2016 17:46:38 +0000 (19:46 +0200)]
Fix #67325: imagetruecolortopalette: white is duplicated in palette

gdImageTrueColorToPalette() is sometimes wasteful by putting multiple white
color entries into the palette. This is caused by an obvious typo, where
to avoid a division by zero when `total` is zero, `count` is checked instead
of `total`.

We fix this issue to improve the quality of the color quantization.

Cf. <https://github.com/libgd/libgd/commit/24b4550f>

8 years agofix leak and error check order
Anatol Belski [Sat, 3 Sep 2016 14:59:17 +0000 (16:59 +0200)]
fix leak and error check order

8 years agoFix proto comment
Christoph M. Becker [Sat, 3 Sep 2016 11:31:13 +0000 (13:31 +0200)]
Fix proto comment

While we're at it, we also change a related comment to use American English
consistently.

8 years agoMake test case more resilient
Christoph M. Becker [Fri, 2 Sep 2016 22:18:19 +0000 (00:18 +0200)]
Make test case more resilient

When ran from a root directory the test case failed, because the open_basedir
restriction for "../[…]" won't kick in. Therefore we change the current
working directory to the test case's directory, as discussed on internals,
see <http://news.php.net/php.internals/95585>.

8 years agofix double free
Anatol Belski [Fri, 2 Sep 2016 22:01:04 +0000 (00:01 +0200)]
fix double free

8 years agoFix bug #72910
Stanislav Malyshev [Fri, 2 Sep 2016 06:27:06 +0000 (23:27 -0700)]
Fix bug #72910

Merge upstream patch from https://github.com/kkos/oniguruma/commit/65bdf2a0d160d06556415e5f396a75f6b11bad5c

8 years ago5.6.27 will be next
Ferenc Kovacs [Thu, 1 Sep 2016 18:27:19 +0000 (20:27 +0200)]
5.6.27 will be next

8 years agoFix #71882 amendment 2: Negative ftruncate() on php://memory exhausts memory
Christoph M. Becker [Wed, 31 Aug 2016 14:33:14 +0000 (16:33 +0200)]
Fix #71882 amendment 2: Negative ftruncate() on php://memory exhausts memory

8 years agoFix #71882 amendment: Negative ftruncate() on php://memory exhausts memory
Christoph M. Becker [Wed, 31 Aug 2016 12:51:37 +0000 (14:51 +0200)]
Fix #71882 amendment: Negative ftruncate() on php://memory exhausts memory

To avoid BC breaks, we do not raise a warning for now.

8 years agoUpdate NEWS
Yasuo Ohgaki [Wed, 31 Aug 2016 12:06:19 +0000 (21:06 +0900)]
Update NEWS

8 years agoFix #66797: mb_substr only takes 32-bit signed integer
Christoph M. Becker [Tue, 30 Aug 2016 12:48:24 +0000 (14:48 +0200)]
Fix #66797: mb_substr only takes 32-bit signed integer

`from` and `len` are `long`, but get passed to mbfl_substr() which expects
`int`s. Therefore we clamp the values to avoid the undefined conversion
behavior.

8 years agoTest case for bug #72771
Ville Hukkamäki [Fri, 19 Aug 2016 22:05:04 +0000 (22:05 +0000)]
Test case for bug #72771

8 years agoFix #71882: Negative ftruncate() on php://memory exhausts memory
Christoph M. Becker [Mon, 29 Aug 2016 23:53:27 +0000 (01:53 +0200)]
Fix #71882: Negative ftruncate() on php://memory exhausts memory

We must not pass negative sizes to a size_t parameter.

8 years agofix HANDLE leak
Anatol Belski [Mon, 29 Aug 2016 19:45:39 +0000 (21:45 +0200)]
fix HANDLE leak

8 years agoupdate NEWS
Anatol Belski [Mon, 29 Aug 2016 19:20:36 +0000 (21:20 +0200)]
update NEWS

8 years agoensure null termination
Anatol Belski [Mon, 29 Aug 2016 19:03:03 +0000 (21:03 +0200)]
ensure null termination

8 years agoFixed bug #72703 Out of bounds global memory read in BF_crypt triggered by password_v...
Anatol Belski [Mon, 29 Aug 2016 18:25:34 +0000 (20:25 +0200)]
Fixed bug #72703 Out of bounds global memory read in BF_crypt triggered by password_verify

8 years agofix double free
Anatol Belski [Mon, 29 Aug 2016 17:27:47 +0000 (19:27 +0200)]
fix double free

8 years agofix leak
Anatol Belski [Mon, 29 Aug 2016 16:01:21 +0000 (18:01 +0200)]
fix leak

8 years agoAdded .user.ini support.
George Wang [Mon, 29 Aug 2016 01:49:30 +0000 (21:49 -0400)]
Added .user.ini support.
Added LSPHPRC support.
update LiteSpeed SAPI version to 6.10 .

8 years agoFix #65550: get_browser() incorrectly parsers entries with "+" sign
Christoph M. Becker [Fri, 26 Aug 2016 23:02:58 +0000 (01:02 +0200)]
Fix #65550: get_browser() incorrectly parsers entries with "+" sign

+ signs in the browscap patterns are meant to be literal characters, so we
have to escape them for the regex matching.

8 years agoFix #70825: Cannot fetch multiple values with group in ini file
Christoph M. Becker [Thu, 25 Aug 2016 16:10:38 +0000 (18:10 +0200)]
Fix #70825: Cannot fetch multiple values with group in ini file

If we have the position already from the last fetch, we also have to preset
the current group, because it won't be read again.

8 years agoFix #71514: Bad dba_replace condition because of wrong API usage
Christoph M. Becker [Thu, 25 Aug 2016 14:20:30 +0000 (16:20 +0200)]
Fix #71514: Bad dba_replace condition because of wrong API usage

We're backporting commit 9e309a2d to PHP-5.6, because it is a bugfix.

8 years agobackport relevant part from bug #72858 patch in 7.0
Anatol Belski [Thu, 25 Aug 2016 10:46:28 +0000 (12:46 +0200)]
backport relevant part from bug #72858 patch in 7.0

8 years agoFix #68716: possible resource leaks in _php_image_convert()
Christoph M. Becker [Sun, 21 Aug 2016 17:39:58 +0000 (19:39 +0200)]
Fix #68716: possible resource leaks in _php_image_convert()

We properly clean up after ourselves wrt. to closing opened file pointers
and created images.

8 years agoFix #72913: imagecopy() loses single-color transparency on palette images
Christoph M. Becker [Sun, 21 Aug 2016 15:39:23 +0000 (17:39 +0200)]
Fix #72913: imagecopy() loses single-color transparency on palette images

The proper code to handle true-color to palette copies is already contained
in gdImageCopy(), so we can simply remove the buggy duplicated code.

8 years agoFix #66005: imagecopy does not support 1bit transparency on truecolor images
Christoph M. Becker [Sun, 21 Aug 2016 14:07:34 +0000 (16:07 +0200)]
Fix #66005: imagecopy does not support 1bit transparency on truecolor images

We must not copy transparent pixels, see
<https://github.com/libgd/libgd/commit/daac285c>.

8 years agoMerge branch 'PHP-5.6' of git.php.net:/php-src into PHP-5.6
Xinchen Hui [Sun, 21 Aug 2016 09:19:24 +0000 (17:19 +0800)]
Merge branch 'PHP-5.6' of git.php.net:/php-src into PHP-5.6

* 'PHP-5.6' of git.php.net:/php-src:
  Improvements to fix #72714, suggested by nikic
  Fix #65732: grapheme_*() is not Unicode compliant on CR LF sequence
  Fix #72714: _xml_startElementHandler() segmentation fault
  update NEWS
  Fixed bug #72852 imap_mail null dereference
  Revert "Fix dba configuration for Windows"
  Fix dba configuration for Windows
  Fix broken test include
  fix NEWS
  Add myself as PDO_OCI maintainer

8 years agoFixed bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc...
Xinchen Hui [Sun, 21 Aug 2016 09:10:10 +0000 (17:10 +0800)]
Fixed bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:260))

8 years agoImprovements to fix #72714, suggested by nikic
Christoph M. Becker [Sat, 20 Aug 2016 10:42:03 +0000 (12:42 +0200)]
Improvements to fix #72714, suggested by nikic

8 years agoFix #65732: grapheme_*() is not Unicode compliant on CR LF sequence
Christoph M. Becker [Fri, 19 Aug 2016 17:05:33 +0000 (19:05 +0200)]
Fix #65732: grapheme_*() is not Unicode compliant on CR LF sequence

According to the Unicode specification (at least as of 5.1), CRLF sequences
are considered to be a single grapheme. We cater to that special case by
letting grapheme_ascii_check() fail. While it would be trivial to fix
grapheme_ascii_check() wrt. grapheme_strlen(), grapheme_substr() and
grapheme_strrpos() would be much harder to handle, so we accept the slight
performance penalty if CRLF is involved.

8 years agoFix #72714: _xml_startElementHandler() segmentation fault
Christoph M. Becker [Tue, 16 Aug 2016 18:36:33 +0000 (20:36 +0200)]
Fix #72714: _xml_startElementHandler() segmentation fault

The issue is caused by an integer overflow when the `long` passed as
XML_OPTION_SKIP_TAGSTART is assigned to `xml_parser::toffset` which is
declared as `int`. We can simply work around this issue, by clipping
resulting negative values to 0 (and raising a notice in this case), because
the reasonable range for this value is certainly catered to by positive
`int`s.

However, there still remains the issue that `xml_parser::toffset` is later
added to `char *`s, which can cause OOB reads, so we make sure that the
upper bound never exceeds the strlen(). We eschew optimizing `SKIP_TAGSTART`
wrt. to the potentially duplicate strlen() call, because that code path is
unexpected anyway.

8 years agoupdate NEWS
Anatol Belski [Fri, 19 Aug 2016 23:36:37 +0000 (01:36 +0200)]
update NEWS

8 years agoFixed bug #72852 imap_mail null dereference
Anatol Belski [Fri, 19 Aug 2016 23:34:46 +0000 (01:34 +0200)]
Fixed bug #72852 imap_mail null dereference

8 years agoRevert "Fix dba configuration for Windows"
Christoph M. Becker [Fri, 19 Aug 2016 14:35:31 +0000 (16:35 +0200)]
Revert "Fix dba configuration for Windows"

This reverts commit ad76e8a529eabf150f17d313bb035b329bc68dec.

After a discussion with Anatol it seems to be better QA wise to not make
this change in stable versions or betas.

8 years agoFix dba configuration for Windows
Christoph M. Becker [Fri, 19 Aug 2016 09:42:16 +0000 (11:42 +0200)]
Fix dba configuration for Windows

To be able to build the dba extension on Windows, libdb was required. This
is contrary to *nix where each handler can be configured individually. To
avoid BC breaks, we only do minimal modifications, instead of adjusting the
Windows configuration to match the *nix configuration, for now.

8 years agoFix broken test include
Christoph M. Becker [Thu, 18 Aug 2016 15:53:57 +0000 (17:53 +0200)]
Fix broken test include

To avoid that the test stalls, we must always use `t` mode.

8 years agofix NEWS
Ferenc Kovacs [Thu, 18 Aug 2016 11:01:53 +0000 (13:01 +0200)]
fix NEWS

8 years agoAdd myself as PDO_OCI maintainer
Christopher Jones [Thu, 18 Aug 2016 05:47:25 +0000 (15:47 +1000)]
Add myself as PDO_OCI maintainer

8 years agoPrepare for OCI8 PECL release
Christopher Jones [Thu, 18 Aug 2016 03:50:36 +0000 (13:50 +1000)]
Prepare for OCI8 PECL release

8 years agoSkip tests that are supposed to fail due to bugs in old external libgd
Christoph M. Becker [Wed, 17 Aug 2016 12:04:08 +0000 (14:04 +0200)]
Skip tests that are supposed to fail due to bugs in old external libgd

8 years agoMake tests a little more resilient
Christoph M. Becker [Wed, 17 Aug 2016 15:59:33 +0000 (17:59 +0200)]
Make tests a little more resilient

PNG allows identical images to be stored differently what makes nearly all
tests checking the MD5 hash of the PNG representation fail with external
libgd. For now, we use the GD format instead, which doesn't allow for such
differences.

Of course, this md5() checking should be replaced by a image diffing feature
in the long run.

8 years agoFix #68302: impossible to compile php with zip support
Christoph M. Becker [Wed, 17 Aug 2016 10:43:29 +0000 (12:43 +0200)]
Fix #68302: impossible to compile php with zip support

We should not let configure succeed, if SIZEOF_OFF_T == 0, just to let the
compilation fail later. Instead we bail out early, giving a hint regarding
the potential issue, namely misconfigured libraries.

8 years agoFixed bug #72853 (stream_set_blocking doesn't work)
Xinchen Hui [Wed, 17 Aug 2016 08:54:21 +0000 (16:54 +0800)]
Fixed bug #72853 (stream_set_blocking doesn't work)

Implemented  PHP_STREAM_OPTION_META_DATA_API for plain_wrappers

8 years agoUpdate NEWS
Stanislav Malyshev [Wed, 17 Aug 2016 06:44:59 +0000 (23:44 -0700)]
Update NEWS

8 years agoBLock test with memory leak
Stanislav Malyshev [Wed, 17 Aug 2016 05:49:06 +0000 (22:49 -0700)]
BLock test with memory leak

8 years agofix tests
Stanislav Malyshev [Tue, 16 Aug 2016 23:47:53 +0000 (16:47 -0700)]
fix tests

8 years agoFix TSRM build
Stanislav Malyshev [Tue, 16 Aug 2016 23:34:35 +0000 (16:34 -0700)]
Fix TSRM build

8 years agoFix bug #72850 - integer overflow in uuencode
Stanislav Malyshev [Tue, 16 Aug 2016 23:03:44 +0000 (16:03 -0700)]
Fix bug #72850 - integer overflow in uuencode

8 years agoFixed bug #72849 - integer overflow in urlencode
Stanislav Malyshev [Tue, 16 Aug 2016 22:58:05 +0000 (15:58 -0700)]
Fixed bug #72849 - integer overflow in urlencode

8 years agoFix bug #72848 - integer overflow in quoted_printable_encode caused heap corruption
Stanislav Malyshev [Tue, 16 Aug 2016 22:48:31 +0000 (15:48 -0700)]
Fix bug #72848 - integer overflow in quoted_printable_encode caused heap corruption

8 years agoFix bug #72838 - Integer overflow lead to heap corruption in sql_regcase
Stanislav Malyshev [Tue, 16 Aug 2016 06:43:59 +0000 (23:43 -0700)]
Fix bug #72838 -  Integer overflow lead to heap corruption in sql_regcase

8 years agoFix bug #72837 - integer overflow in bzdecompress caused heap corruption
Stanislav Malyshev [Tue, 16 Aug 2016 06:17:26 +0000 (23:17 -0700)]
Fix bug #72837 - integer overflow in bzdecompress caused heap corruption

8 years agoFix bug #72836 - integer overflow in base64_decode caused heap corruption
Stanislav Malyshev [Mon, 15 Aug 2016 06:13:30 +0000 (23:13 -0700)]
Fix bug #72836 - integer overflow in base64_decode caused heap corruption

8 years agoFix for bug #72807 - do not produce strings with negative length
Stanislav Malyshev [Fri, 12 Aug 2016 06:36:25 +0000 (23:36 -0700)]
Fix for bug #72807 - do not produce strings with negative length

8 years agoFix for bug #72790 and bug #72799
Stanislav Malyshev [Thu, 11 Aug 2016 06:43:56 +0000 (23:43 -0700)]
Fix for bug #72790 and bug #72799

8 years agoFix bug #72730 - imagegammacorrect allows arbitrary write access
Stanislav Malyshev [Wed, 10 Aug 2016 07:14:58 +0000 (00:14 -0700)]
Fix bug #72730 - imagegammacorrect allows arbitrary write access

8 years agoFix bug#72697 - select_colors write out-of-bounds
Stanislav Malyshev [Wed, 10 Aug 2016 07:00:14 +0000 (00:00 -0700)]
Fix bug#72697 - select_colors write out-of-bounds

8 years agoFixed bug #72627: Memory Leakage In exif_process_IFD_in_TIFF
Stanislav Malyshev [Mon, 8 Aug 2016 07:49:34 +0000 (00:49 -0700)]
Fixed bug #72627: Memory Leakage In exif_process_IFD_in_TIFF

8 years agoFix bug #72750: wddx_deserialize null dereference
Stanislav Malyshev [Sun, 7 Aug 2016 23:26:52 +0000 (16:26 -0700)]
Fix bug #72750: wddx_deserialize null dereference

8 years agoFix bug #72771: ftps:// opendir wrapper is vulnerable to protocol downgrade attack
Stanislav Malyshev [Sun, 7 Aug 2016 23:17:54 +0000 (16:17 -0700)]
Fix bug #72771: ftps:// opendir wrapper is vulnerable to protocol downgrade attack

8 years agoImprove fix for #72663
Stanislav Malyshev [Sun, 7 Aug 2016 22:33:29 +0000 (15:33 -0700)]
Improve fix for #72663

8 years agoFix bug #70436: Use After Free Vulnerability in unserialize()
Stanislav Malyshev [Sun, 7 Aug 2016 22:16:28 +0000 (15:16 -0700)]
Fix bug #70436: Use After Free Vulnerability in unserialize()

8 years agoFix bug #72749: wddx_deserialize allows illegal memory access
Stanislav Malyshev [Thu, 4 Aug 2016 07:17:42 +0000 (00:17 -0700)]
Fix bug #72749: wddx_deserialize allows illegal memory access