Nikita Popov [Wed, 27 Jun 2012 10:19:41 +0000 (12:19 +0200)]
Improve JSON error handling
json_encode() no longer throws warnings. Instead only the error code for
json_last_error() is set.
As it is hard to debug the error from just an error code an optional
$as_string parameter was added to json_last_error(), which returns an
error message instead of an error code.
Nikita Popov [Sun, 24 Jun 2012 21:32:50 +0000 (23:32 +0200)]
Fix memory allocation checks for base64 encode
base64_encode used safe_emalloc, but one of the arguments was derived from a
multiplication, thus making the allocation unsafe again.
There was a size check in place, but it was off by a factor of two as it
didn't account for the signedness of the integer type.
The unsafe allocation is not exploitable, but still causes funny behavior
when the sized overflows into a negative number.
To fix the issue the *4 factor is moved into the size argument (where it is
known to be safe), so safe_emalloc can carry out the multiplication.
The size check is removed as it doesn't really make sense once safe_emalloc
works correctly. (Would only cause base64_encode to silently return false
instead of throwing an error. Also could cause problems with other uses of
the base64 encoding API, which all don't check for a NULL return value.)
Furthermore the (length + 2) < 0 check is replaced with just length < 0.
Allowing lengths -2 and -1 doesn't make sense semantically and also is not
honored in the following code (negative length would access unallocated
memory.)
Actually the length < 0 check doesn't make sense altogether, but I left it
there just to be safe.
Nikita Popov [Sat, 23 Jun 2012 18:46:27 +0000 (20:46 +0200)]
Improve json_encode error handling
json_encode() now returns bool(false) for all possible errors, throws the
respective warning and also sets the respective json_last_error() error
code. Three new error codes have been added:
To get a partial JSON output instead of bool(false) the option
JSON_PARTIAL_OUTPUT_ON_ERROR can be specified. In this case the invalid
segments will be replaced either by null (for recursion, unsupported type
and invalid JSON) or 0 (for Inf and NaN).
The warning for invalid UTF-8 stays intact and is thrown also with
display_errors = On. If this behavior is undesired this can be remedied
later.
Scott MacVicar [Mon, 11 Jun 2012 07:16:30 +0000 (00:16 -0700)]
Add PBKDF2 support via openssl()
Summary:
No easy way to put these in the hash extension since we don't really support optional
parameters to certain algorithms. Implemented in openssl for now since it has it already
and is pretty stable.
Only SHA1 is confirmed to work as an algorithm but openssl has a parameter so it can be
changed in the future.
Will backport to 5.4 potentially with Stas' approval.
Test Plan:
Ran newly added tests which came from RFC 6070
Travis will always build all branches. As we just have a .travis.yml
on master, travis will go ahead and checkout PHP-5.3. It fails and
then sends mails. We really don't want to get spammed, so we add
a .travis.yml that is just silent.
Custom extension segfaults during xmlParseFile with FPM SAPI
because the regular list is not prepared during the MINIT phase
and our custom external entity loader tries to open PHP streams.
Anatoliy Belsky [Thu, 7 Jun 2012 19:06:31 +0000 (21:06 +0200)]
Merge branch 'PHP-5.3' into PHP-5.4
* PHP-5.3:
zip windows fixes
fixed bc break related to #57905
fixed a bit overlooked from the last libzip port
brought the fix for #47667 back
fixed zip entry freeing
rechecked the merged libzip, took also the indents from the original to avoid confusion next time
fixed a double freeing crash
fixed header include
initial libzip upgrade patch to 0.10.1
- BFN
Fixed bug #51094 (parse_ini_file() with INI_SCANNER_RAW cuts a value that includes a semi-colon)
Modify the scanner to check if the first char of the raw data is an opening " in which case we
need to find the closing one. Otherwise just search for the next end of value char [\r\n;\000]
By Till Klampaeckel
* PHP-5.3:
Don't depend on a fixed path for PHP shebang but use /usr/bin/env (cherry picked from commit 89c5d981603ed4a2a54f86c20cec4f263c58ded6)
projects / php / log