Anatol Belski [Tue, 8 Nov 2016 10:13:29 +0000 (11:13 +0100)]
Merge remote-tracking branch 'phpsec/PHP-7.0.13' into PHP-7.0
* phpsec/PHP-7.0.13:
Fixed bug #73418 Integer Overflow in "_php_imap_mail" leads to crash
Fix #72696: imagefilltoborder stackoverflow on truecolor images
Fix #72482: Ilegal write/read access caused by gdImageAALine overflow
Fix bug #73144 and bug #73341 - remove extra dtor
remove unreferenced var came in with merge
Fix bug #73331 - do not try to serialize/unserialize objects wddx can not handle
fix version
set versions
Anatol Belski [Tue, 8 Nov 2016 10:11:22 +0000 (11:11 +0100)]
Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
Fixed bug #73418 Integer Overflow in "_php_imap_mail" leads to crash
Fix #72696: imagefilltoborder stackoverflow on truecolor images
Fix #72482: Ilegal write/read access caused by gdImageAALine overflow
Fix bug #73144 and bug #73341 - remove extra dtor
Fix bug #73331 - do not try to serialize/unserialize objects wddx can not handle
Anatol Belski [Tue, 8 Nov 2016 01:26:43 +0000 (02:26 +0100)]
Enable FTS4 and FTS5 for bundled libsqlite
FTS3 is already enabled by default, and the other FTS versions
seems just to have been missed. Given that, the other FTS plugins
look like a low impact so worth a try. The current bundled libsqlite
versions in 7.x are proven stable already and support FTS5.
Anatol Belski [Sun, 6 Nov 2016 16:51:25 +0000 (17:51 +0100)]
add missing RETURN_STRINGL_CHECK
As RETVAL_STRINGL_CHECK is already there, this one is needed for
completion. One place in ext/bz2 is missing that, so it will likely
be useful for other possible fixes.
Fix #72696: imagefilltoborder stackoverflow on truecolor images
We must not allow negative color values be passed to
gdImageFillToBorder(), because that can lead to infinite recursion
since the recursion termination condition will not necessarily be met.
Fix #72482: Ilegal write/read access caused by gdImageAALine overflow
Instead of rolling our own bounds check we use clip_1d() as it's done
in gdImageLine() and in external libgd. We must not pass the image
width and height, respectively, but rather the largest ordinate value
that is allowed to be accessed, i.e. width-1 and height-1,
respectively.
Fix bug #73331 - do not try to serialize/unserialize objects wddx can not handle
Proper soltion would be to call serialize/unserialize and deal with the result,
but this requires more work that should be done by wddx maintainer (not me).
Fix #72696: imagefilltoborder stackoverflow on truecolor images
We must not allow negative color values be passed to
gdImageFillToBorder(), because that can lead to infinite recursion
since the recursion termination condition will not necessarily be met.
Fix #72482: Ilegal write/read access caused by gdImageAALine overflow
Instead of rolling our own bounds check we use clip_1d() as it's done
in gdImageLine() and in external libgd. We must not pass the image
width and height, respectively, but rather the largest ordinate value
that is allowed to be accessed, i.e. width-1 and height-1,
respectively.
Anatol Belski [Sun, 30 Oct 2016 19:55:38 +0000 (20:55 +0100)]
fix link with deps pdb availability
Unlike debugger, linker is currently not able to read the pdb files,
even if they're put onto path. As result, a lot of LNK4099 warnings
and in some cases also missing debug information in the end binaries.
This is solved by copying the relevant pdb into the build dir, which
then can be picked up on link time. This also leads to the inclusion
of those pdb files into the debug package, so symbols won't be missed
in crash dumps. As otherwise the debug info for dependencies is only
contained in the dependency packages.
Bob Weinand [Sat, 29 Oct 2016 16:49:38 +0000 (18:49 +0200)]
Fixed build failure introduced by PR #2158
Note: AC_TRY_LINK interprets the source as part of a main function, ending up with int main() { /* ... */ int main() { /* ... */ } ; return 0; } here - Using AC_LINK_IFELSE with AC_LANG_SOURCE directly instead.
This issue has actually already been fixed with commit 46f2c690. We're
adding a regression test and a NEWS entry, and also port the fix in
gdImageCropThreshold() from libgd:
* <https://github.com/libgd/libgd/commit/b347e034>
* <https://github.com/libgd/libgd/commit/46f2c690>
Fix bug #73331 - do not try to serialize/unserialize objects wddx can not handle
Proper soltion would be to call serialize/unserialize and deal with the result,
but this requires more work that should be done by wddx maintainer (not me).
Anatol Belski [Tue, 18 Oct 2016 17:11:18 +0000 (19:11 +0200)]
Fixed bug #73329 (Float)"Nano" == NAN
The special cases (float)"inf", etc. were never intended and are
caused by the updated strtod lib. While it might be nice as an
easy way to produce Inf and NaN special values, it was never
documented and cause BC breaches.
We return all integers that can be represented as such by PHP as
integers, and only those that exceed the possible range as strings.
On builds which represent integers with 64 bits, the range check is
unnecessary and might cause code checkers to complain, so we skip this
special casing via the preprocessor according to
<http://git.php.net/?p=php-src.git;a=commit;h=99d087e5>.
projects / php / log