PHP 5.3.23

When checking to make into a reference write, readwrite are checked but not unset

NEWS

@@ -1,6 +1,19 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2013, PHP 5.3.22
+14 Mar 2013, PHP 5.3.23
+
+- SOAP
+  . Improved check that soap.wsdl_cache_dir conforms to open_basedir (Dmitry)
+  . Disabled external entities loading. (Dmitry)
+
+- SPL:
+  . Fixed bug #64264 (SPLFixedArray toArray problem). (Laruence)
+  . Fixed bug #64228 (RecursiveDirectoryIterator always assumes SKIP_DOTS).
+    (patch by kriss@krizalys.com, Laruence)
+  . Fixed bug #52861 (unset fails with ArrayObject and deep arrays). 
+    (Mike Willbanks)
+
+21 Feb 2013, PHP 5.3.22
 
 - Zend Engine:
   . Fixed bug #64099 (Wrong TSRM usage in zend_Register_class alias). (Johannes)
@@ -17,6 +30,14 @@ PHP                                                                        NEWS
 - FPM:
   . Fixed bug #63999 (php with fpm fails to build on Solaris 10 or 11). (Adam)
 
+- SOAP
+  . Added check that soap.wsdl_cache_dir conforms to open_basedir
+    (CVE-2013-1635). (Dmitry)
+  . Disabled external entities loading (CVE-2013-1643). (Dmitry)
+
+- SPL:
+  . Fixed bug #64106 (Segfault on SplFixedArray[][x] = y when extended). (Nikita Popov)
+
 17 Jan 2013, PHP 5.3.21
 
 - Zend Engine:

configure.in

@@ -41,8 +41,8 @@ AC_CONFIG_HEADER(main/php_config.h)
 
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=3
-PHP_RELEASE_VERSION=22
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=23
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/curl/tests/curl_error_basic.phpt

@@ -38,4 +38,4 @@ curl_close($ch);
 ?>
 --EXPECTF--
 == Testing curl_error with a fake URL ==
-string(%d) "%sfakeURL%s"
+string(%d) "%sfakeURL%S"

ext/libxml/libxml.c

@@ -261,6 +261,7 @@ static PHP_GINIT_FUNCTION(libxml)
 	libxml_globals->stream_context = NULL;
 	libxml_globals->error_buffer.c = NULL;
 	libxml_globals->error_list = NULL;
+	libxml_globals->entity_loader_disabled = 0;
 }
 
 /* Channel libxml file io layer through the PHP streams subsystem.
@@ -347,17 +348,16 @@ static int php_libxml_streams_IO_close(void *context)
 	return php_stream_close((php_stream*)context);
 }
 
-static xmlParserInputBufferPtr
-php_libxml_input_buffer_noload(const char *URI, xmlCharEncoding enc)
-{
-	return NULL;
-}
-
 static xmlParserInputBufferPtr
 php_libxml_input_buffer_create_filename(const char *URI, xmlCharEncoding enc)
 {
 	xmlParserInputBufferPtr ret;
 	void *context = NULL;
+	TSRMLS_FETCH();
+
+	if (LIBXML(entity_loader_disabled)) {
+		return NULL;
+	}
 
 	if (URI == NULL)
 		return(NULL);
@@ -834,28 +834,25 @@ static PHP_FUNCTION(libxml_clear_errors)
 }
 /* }}} */
 
+PHP_LIBXML_API zend_bool php_libxml_disable_entity_loader(zend_bool disable TSRMLS_DC)
+{
+	zend_bool old = LIBXML(entity_loader_disabled);
+
+	LIBXML(entity_loader_disabled) = disable;
+	return old;
+}
+
 /* {{{ proto bool libxml_disable_entity_loader([boolean disable]) 
    Disable/Enable ability to load external entities */
 static PHP_FUNCTION(libxml_disable_entity_loader)
 {
 	zend_bool disable = 1;
-	xmlParserInputBufferCreateFilenameFunc old;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|b", &disable) == FAILURE) {
 		return;
 	}
 
-	if (disable == 0) {
-		old = xmlParserInputBufferCreateFilenameDefault(php_libxml_input_buffer_create_filename);
-	} else {
-		old = xmlParserInputBufferCreateFilenameDefault(php_libxml_input_buffer_noload);
-	}
-
-	if (old == php_libxml_input_buffer_noload) {
-		RETURN_TRUE;
-	}
-
-	RETURN_FALSE;
+	RETURN_BOOL(php_libxml_disable_entity_loader(disable TSRMLS_CC));
 }
 /* }}} */
 

ext/libxml/php_libxml.h

@@ -43,6 +43,7 @@ ZEND_BEGIN_MODULE_GLOBALS(libxml)
 	zval *stream_context;
 	smart_str error_buffer;
 	zend_llist *error_list;
+	zend_bool entity_loader_disabled;
 ZEND_END_MODULE_GLOBALS(libxml)
 
 typedef struct _libxml_doc_props {
@@ -93,6 +94,7 @@ PHP_LIBXML_API void php_libxml_ctx_error(void *ctx, const char *msg, ...);
 PHP_LIBXML_API int php_libxml_xmlCheckUTF8(const unsigned char *s);
 PHP_LIBXML_API zval *php_libxml_switch_context(zval *context TSRMLS_DC);
 PHP_LIBXML_API void php_libxml_issue_error(int level, const char *msg TSRMLS_DC);
+PHP_LIBXML_API zend_bool php_libxml_disable_entity_loader(zend_bool disable TSRMLS_DC);
 
 /* Init/shutdown functions*/
 PHP_LIBXML_API void php_libxml_initialize(void);

ext/phar/stream.c

@@ -458,8 +458,11 @@ static int phar_stream_flush(php_stream *stream TSRMLS_DC) /* {{{ */
 {
 	char *error;
 	int ret;
-	if (stream->mode[0] == 'w' || (stream->mode[0] == 'r' && stream->mode[1] == '+')) {
-		ret = phar_flush(((phar_entry_data *)stream->abstract)->phar, 0, 0, 0, &error TSRMLS_CC);
+	phar_entry_data *data = (phar_entry_data *) stream->abstract;
+	
+	if (data->internal_file->is_modified) {
+		data->internal_file->timestamp = time(0);
+		ret = phar_flush(data->phar, 0, 0, 0, &error TSRMLS_CC);
 		if (error) {
 			php_stream_wrapper_log_error(stream->wrapper, REPORT_ERRORS TSRMLS_CC, "%s", error);
 			efree(error);

ext/soap/php_xml.c

@@ -20,6 +20,7 @@
 /* $Id$ */
 
 #include "php_soap.h"
+#include "ext/libxml/php_libxml.h"
 #include "libxml/parser.h"
 #include "libxml/parserInternals.h"
 
@@ -91,13 +92,17 @@ xmlDocPtr soap_xmlParseFile(const char *filename TSRMLS_DC)
 	ctxt = xmlCreateFileParserCtxt(filename);
 	PG(allow_url_fopen) = old_allow_url_fopen;
 	if (ctxt) {
+		zend_bool old;
+
 		ctxt->keepBlanks = 0;
 		ctxt->sax->ignorableWhitespace = soap_ignorableWhitespace;
 		ctxt->sax->comment = soap_Comment;
 		ctxt->sax->warning = NULL;
 		ctxt->sax->error = NULL;
 		/*ctxt->sax->fatalError = NULL;*/
+		old = php_libxml_disable_entity_loader(1 TSRMLS_CC);
 		xmlParseDocument(ctxt);
+		php_libxml_disable_entity_loader(old TSRMLS_CC);
 		if (ctxt->wellFormed) {
 			ret = ctxt->myDoc;
 			if (ret->URL == NULL && ctxt->directory != NULL) {
@@ -128,11 +133,15 @@ xmlDocPtr soap_xmlParseMemory(const void *buf, size_t buf_size)
 	xmlParserCtxtPtr ctxt = NULL;
 	xmlDocPtr ret;
 
+	TSRMLS_FETCH();
+
 /*
 	xmlInitParser();
 */
 	ctxt = xmlCreateMemoryParserCtxt(buf, buf_size);
 	if (ctxt) {
+		zend_bool old;
+
 		ctxt->sax->ignorableWhitespace = soap_ignorableWhitespace;
 		ctxt->sax->comment = soap_Comment;
 		ctxt->sax->warning = NULL;
@@ -141,7 +150,9 @@ xmlDocPtr soap_xmlParseMemory(const void *buf, size_t buf_size)
 #if LIBXML_VERSION >= 20703
 		ctxt->options |= XML_PARSE_HUGE;
 #endif
+		old = php_libxml_disable_entity_loader(1 TSRMLS_CC);
 		xmlParseDocument(ctxt);
+		php_libxml_disable_entity_loader(old TSRMLS_CC);
 		if (ctxt->wellFormed) {
 			ret = ctxt->myDoc;
 			if (ret->URL == NULL && ctxt->directory != NULL) {

ext/soap/soap.c

@@ -568,10 +568,44 @@ ZEND_INI_MH(OnUpdateCacheMode)
 	return SUCCESS;
 }
 
+static PHP_INI_MH(OnUpdateCacheDir)
+{
+	/* Only do the safemode/open_basedir check at runtime */
+	if (stage == PHP_INI_STAGE_RUNTIME || stage == PHP_INI_STAGE_HTACCESS) {
+		char *p;
+
+		if (memchr(new_value, '\0', new_value_length) != NULL) {
+			return FAILURE;
+		}
+
+		/* we do not use zend_memrchr() since path can contain ; itself */
+		if ((p = strchr(new_value, ';'))) {
+			char *p2;
+			p++;
+			if ((p2 = strchr(p, ';'))) {
+				p = p2 + 1;
+			}
+		} else {
+			p = new_value;
+		}
+
+		if (PG(safe_mode) && *p && (!php_checkuid(p, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
+			return FAILURE;
+		}
+
+		if (PG(open_basedir) && *p && php_check_open_basedir(p TSRMLS_CC)) {
+			return FAILURE;
+		}
+	}
+
+	OnUpdateString(entry, new_value, new_value_length, mh_arg1, mh_arg2, mh_arg3, stage TSRMLS_CC);
+	return SUCCESS;
+}
+
 PHP_INI_BEGIN()
 STD_PHP_INI_ENTRY("soap.wsdl_cache_enabled",     "1", PHP_INI_ALL, OnUpdateBool,
                   cache_enabled, zend_soap_globals, soap_globals)
-STD_PHP_INI_ENTRY("soap.wsdl_cache_dir",         "/tmp", PHP_INI_ALL, OnUpdateString,
+STD_PHP_INI_ENTRY("soap.wsdl_cache_dir",         "/tmp", PHP_INI_ALL, OnUpdateCacheDir,
                   cache_dir, zend_soap_globals, soap_globals)
 STD_PHP_INI_ENTRY("soap.wsdl_cache_ttl",         "86400", PHP_INI_ALL, OnUpdateLong,
                   cache_ttl, zend_soap_globals, soap_globals)

ext/spl/spl_array.c

@@ -387,7 +387,11 @@ static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval
 		spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
 		if (intern->fptr_offset_get) {
 			zval *rv;
-			SEPARATE_ARG_IF_REF(offset);
+			if (!offset) {
+				ALLOC_INIT_ZVAL(offset);
+			} else {
+				SEPARATE_ARG_IF_REF(offset);
+			}
 			zend_call_method_with_1_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_get, "offsetGet", &rv, offset);	
 			zval_ptr_dtor(&offset);
 			if (rv) {
@@ -404,7 +408,7 @@ static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval
 	/* When in a write context,
 	 * ZE has to be fooled into thinking this is in a reference set
 	 * by separating (if necessary) and returning as an is_ref=1 zval (even if refcount == 1) */
-	if ((type == BP_VAR_W || type == BP_VAR_RW) && !Z_ISREF_PP(ret)) {
+	if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && !Z_ISREF_PP(ret)) {
 		if (Z_REFCOUNT_PP(ret) > 1) {
 			zval *newval;
 

ext/spl/spl_directory.c

@@ -1431,6 +1431,7 @@ SPL_METHOD(FilesystemIterator, __construct)
 SPL_METHOD(FilesystemIterator, rewind)
 {
 	spl_filesystem_object *intern = (spl_filesystem_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
+	int skip_dots = SPL_HAS_FLAG(intern->flags, SPL_FILE_DIR_SKIPDOTS);
 
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -1442,7 +1443,7 @@ SPL_METHOD(FilesystemIterator, rewind)
 	}
 	do {
 		spl_filesystem_dir_read(intern TSRMLS_CC);
-	} while (spl_filesystem_is_dot(intern->u.dir.entry.d_name));
+	} while (skip_dots && spl_filesystem_is_dot(intern->u.dir.entry.d_name));
 }
 /* }}} */
 

ext/spl/spl_fixedarray.c

@@ -361,7 +361,11 @@ static zval *spl_fixedarray_object_read_dimension(zval *object, zval *offset, in
 
 	if (intern->fptr_offset_get) {
 		zval *rv;
-		SEPARATE_ARG_IF_REF(offset);
+		if (!offset) {
+			ALLOC_INIT_ZVAL(offset);
+		} else {
+			SEPARATE_ARG_IF_REF(offset);
+		}
 		zend_call_method_with_1_params(&object, intern->std.ce, &intern->fptr_offset_get, "offsetGet", &rv, offset);
 		zval_ptr_dtor(&offset);
 		if (rv) {
@@ -607,8 +611,6 @@ SPL_METHOD(SplFixedArray, count)
 SPL_METHOD(SplFixedArray, toArray)
 {
 	spl_fixedarray_object *intern;
-	zval *ret, *tmp;
-	HashTable *ret_ht, *obj_ht;
 
 	if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "")) {
 		return;
@@ -616,15 +618,19 @@ SPL_METHOD(SplFixedArray, toArray)
 
 	intern = (spl_fixedarray_object *)zend_object_store_get_object(getThis() TSRMLS_CC);
 
-	ALLOC_HASHTABLE(ret_ht);
-	zend_hash_init(ret_ht, 0, NULL, ZVAL_PTR_DTOR, 0);
-	ALLOC_INIT_ZVAL(ret);
-	Z_TYPE_P(ret) = IS_ARRAY;
-	obj_ht = spl_fixedarray_object_get_properties(getThis() TSRMLS_CC);
-	zend_hash_copy(ret_ht, obj_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
-	Z_ARRVAL_P(ret) = ret_ht;
-
-	RETURN_ZVAL(ret, 1, 1);
+	array_init(return_value);
+	if (intern->array) {
+		int i = 0;
+		for (; i < intern->array->size; i++) {
+			if (intern->array->elements[i]) {
+				zend_hash_index_update(Z_ARRVAL_P(return_value), i, (void *)&intern->array->elements[i], sizeof(zval *), NULL);
+				Z_ADDREF_P(intern->array->elements[i]);
+			} else {
+				zend_hash_index_update(Z_ARRVAL_P(return_value), i, (void *)&EG(uninitialized_zval_ptr), sizeof(zval *), NULL);
+				Z_ADDREF_P(EG(uninitialized_zval_ptr));
+			}
+		}
+	}
 }
 /* }}} */
 

ext/spl/tests/bug52861.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #52861 (unset failes with ArrayObject and deep arrays)
+--FILE--
+<?php
+$arrayObject = new ArrayObject(array('foo' => array('bar' => array('baz' => 'boo'))));
+
+unset($arrayObject['foo']['bar']['baz']);
+print_r($arrayObject->getArrayCopy());
+?>
+--EXPECT--
+Array
+(
+    [foo] => Array
+        (
+            [bar] => Array
+                (
+                )
+
+        )
+
+)
+

ext/spl/tests/bug64106.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #64106: Segfault on SplFixedArray[][x] = y when extended
+--FILE--
+<?php
+
+class MyFixedArray extends SplFixedArray {
+    public function offsetGet($offset) {}
+}
+
+$array = new MyFixedArray(10);
+$array[][1] = 10;
+
+?>
+--EXPECTF--
+Notice: Indirect modification of overloaded element of MyFixedArray has no effect in %s on line %d

ext/spl/tests/bug64228.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Bug #64228 (RecursiveDirectoryIterator always assumes SKIP_DOTS)
+--FILE--
+<?php
+$dirs = array();
+$empty_dir = __DIR__ . "/empty";
+@mkdir($empty_dir);
+
+$i = new RecursiveDirectoryIterator($empty_dir, FilesystemIterator::KEY_AS_PATHNAME | FilesystemIterator::CURRENT_AS_FILEINFO); // Note the absence of FilesystemIterator::SKIP_DOTS
+foreach ($i as $key => $value) {
+    $dirs[] = $value->getFileName();
+}
+
+@rmdir($empty_dir);
+
+sort($dirs);
+print_r($dirs);
+?>
+--EXPECT--
+Array
+(
+    [0] => .
+    [1] => ..
+)
+

ext/spl/tests/bug64264.phpt

@@ -0,0 +1,29 @@
+--TEST--
+Bug #64264 (SPLFixedArray toArray problem)
+--FILE--
+<?php
+class MyFixedArray extends \SplFixedArray {                                                                                                                                 
+    protected $foo;                                                                                                                                                         
+    protected $bar;                                                                                                                                                         
+}                                                                                                                                                                           
+
+$myFixedArr = new MyFixedArray(1);                                                                                                                                          
+$myFixedArr[0] = 'foo';
+$myFixedArr->setSize(2);
+$myFixedArr[1] = 'bar';
+$myFixedArr->setSize(5);
+$array = $myFixedArr->toArray();
+$array[2] = "ERROR";
+$array[3] = "ERROR";
+$array[4] = "ERROR";
+unset($array[4]);
+$myFixedArr->setSize(2);
+
+print_r($myFixedArr->toArray());
+?>
+--EXPECTF--
+Array
+(
+    [0] => foo
+    [1] => bar
+)

ext/standard/tests/network/http-stream.phpt

@@ -3,6 +3,7 @@ http-stream test
 --SKIPIF--
 <?php
 if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+if (getenv("SKIP_ONLINE_TESTS")) die("skip online test");
 if (!extension_loaded("dom")) die("skip dom extension is not present");
 ?>
 --INI--

main/php_version.h

@@ -2,7 +2,7 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 3
-#define PHP_RELEASE_VERSION 22
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.3.22-dev"
-#define PHP_VERSION_ID 50322
+#define PHP_RELEASE_VERSION 23
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.3.23"
+#define PHP_VERSION_ID 50323

win32/build/libs_version.txt

@@ -1,17 +1,17 @@
 bz2-1.0.6
 cclient-2007e
-freetype-2.4.3
+freetype-2.4.10
 icu-49.1.2
-jpeglib-6b
-libcurl-7.27.0
+jpeglib-8
+libcurl-7.29.0
 libiconv-1.14
 libmcrypt-2.5.8
 libmpir-1.3.1
-libpng-1.2.46
+libpng-1.2.50
 libpq-8.3.6
 libssh2-1.4.2
 libtidy-20090325
 libxslt-1.1.27
 libxml-2.7.8
-openssl-0.9.8x
+openssl-0.9.8y