It's 2014 already, fix copyright year where user visible

Left out all file headers
PHP 5.3.29
2026-11-13 20:20:50 +00:00 · 2014-08-13 21:22:50 +02:00 · 2014-08-13 18:36:10 +02:00 · 2014-07-31 15:40:51 +02:00 · 2014-07-31 15:36:24 +02:00 · 2014-07-18 16:49:00 -07:00
57 changed files with 621 additions and 251 deletions
@@ -98,7 +98,9 @@ test: all
 		TEST_PHP_SRCDIR=$(top_srcdir) \
 		CC="$(CC)" \
 			$(PHP_EXECUTABLE) -n -c $(top_builddir)/tmp-php.ini $(PHP_TEST_SETTINGS) $(top_srcdir)/run-tests.php -n -c $(top_builddir)/tmp-php.ini -d extension_dir=$(top_builddir)/modules/ $(PHP_TEST_SHARED_EXTENSIONS) $(TESTS); \
+		TEST_RESULT_EXIT_CODE=$$?; \
 		rm $(top_builddir)/tmp-php.ini; \
+		exit $$TEST_RESULT_EXIT_CODE; \
 	else \
 		echo "ERROR: Cannot run tests without CLI sapi."; \
 	fi
@@ -1,6 +1,65 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 201?, PHP 5.3.29
+14 Aug 2014, PHP 5.3.29
+
+- Core:
+  . Fixed bug #66127 (Segmentation fault with ArrayObject unset). (Stas)
+  . Fixed bug #67247 (spl_fixedarray_resize integer overflow). (Stas)
+  . Fixed bug #67249 (printf out-of-bounds read). (Stas)
+  . Fixed bug #67250 (iptcparse out-of-bounds read). (Stas)
+  . Fixed bug #67252 (convert_uudecode out-of-bounds read). (Stas)
+  . Fixed bug #67359 (Segfault in recursiveDirectoryIterator). (Laruence)
+  . Fixed bug #67390 (insecure temporary file use in the configure script).
+    (Remi) (CVE-2014-3981)
+  . Fixed bug #67399 (putenv with empty variable may lead to crash). (Stas)
+  . Fixed bug #67492 (unserialize() SPL ArrayObject / SPLObjectStorage Type 
+    Confusion) (CVE-2014-3515). (Stefan Esser)
+  . Fixed bug #67498 (phpinfo() Type Confusion Information Leak Vulnerability).
+    (Stefan Esser)
+
+- COM:
+  . Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas).
+
+- Date:
+  . Fixed bug #66060 (Heap buffer over-read in DateInterval). (CVE-2013-6712)
+    (Remi)
+  . Fixed bug #67251 (date_parse_from_format out-of-bounds read). (Stas)
+  . Fixed bug #67253 (timelib_meridian_with_check out-of-bounds read). (Stas)
+
+- Exif:
+  . Fixed bug #65873 (Integer overflow in exif_read_data()). (Stas)
+
+- Fileinfo:
+  . Fixed bug #66307 (Fileinfo crashes with powerpoint files). (Anatol)
+  . Fixed bug #67326 (fileinfo: cdf_read_short_sector insufficient boundary
+    check). (CVE-2014-0207)
+  . Fixed bug #67327 (fileinfo: CDF infinite loop in nelements DoS).
+    (CVE-2014-0238)
+  . Fixed bug #67328 (fileinfo: fileinfo: numerous file_printf calls resulting
+    in performance degradation). (CVE-2014-0237)
+  . Fixed bug #67410 (fileinfo: mconvert incorrect handling of truncated pascal
+    string size). (Francisco Alonso, Jan Kaluza, Remi)
+  . Fixed bug #67411 (fileinfo: cdf_check_stream_offset insufficient boundary
+    check). (Francisco Alonso, Jan Kaluza, Remi)
+  . Fixed bug #67412 (fileinfo: cdf_count_chain insufficient boundary check).
+    (Francisco Alonso, Jan Kaluza, Remi)
+  . Fixed bug #67413 (fileinfo: cdf_read_property_info insufficient boundary
+    check). (Francisco Alonso, Jan Kaluza, Remi)
+
+- Intl:
+  . Fixed bug #67349 (Locale::parseLocale Double Free). (Stas)
+  . Fixed bug #67397 (Buffer overflow in locale_get_display_name and
+    uloc_getDisplayName (libicu 4.8.1)). (Stas)
+
+- Network:
+  . Fixed bug #67432 (Fix potential segfault in dns_check_record()).
+    (CVE-2014-4049). (Sara)
+
+- OpenSSL:
+  . Fixed missing type checks in OpenSSL options (Yussuf Khalil, Stas).
+
+- Session:
+  . Fixed missing type checks in php_session_create_id (Yussuf Khalil, Stas).

 12 Dec 2013, PHP 5.3.28

@@ -10,6 +69,10 @@ PHP                                                                        NEWS
  . Fixed memory corruption in openssl_x509_parse() (CVE-2013-6420).
    (Stefan Esser).

+- FPM:
+  . Fixed bug #67060 (sapi/fpm: possible privilege escalation due to insecure
+    default configuration) (CVE-2014-0185). (Stas)
+
 11 Jul 2013, PHP 5.3.27

 - Core:
@@ -114,7 +114,7 @@ ZEND_API zval zval_used_for_init; /* True global variable */
 /* version information */
 static char *zend_version_info;
 static uint zend_version_info_length;
-#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2013 Zend Technologies\n"
+#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2014 Zend Technologies\n"
 #define PRINT_ZVAL_INDENT 4

 static void print_hash(zend_write_func_t write_func, HashTable *ht, int indent, zend_bool is_object TSRMLS_DC) /* {{{ */
@@ -1700,7 +1700,7 @@ int main(int argc, char *argv[])
 {
  FILE *fp;
  long position;
-  char *filename = "/tmp/phpglibccheck";
+  char *filename = tmpnam(NULL);
  
  fp = fopen(filename, "w");
  if (fp == NULL) {
@@ -42,7 +42,7 @@ AC_CONFIG_HEADER(main/php_config.h)
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=3
 PHP_RELEASE_VERSION=29
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -698,9 +698,9 @@ PHP_FUNCTION(com_event_sink)
 		/* 0 => typelibname, 1 => dispname */
 		zval **tmp;

-		if (zend_hash_index_find(Z_ARRVAL_P(sink), 0, (void**)&tmp) == SUCCESS)
+		if (zend_hash_index_find(Z_ARRVAL_P(sink), 0, (void**)&tmp) == SUCCESS && Z_TYPE_PP(tmp) == IS_STRING)
 			typelibname = Z_STRVAL_PP(tmp);
-		if (zend_hash_index_find(Z_ARRVAL_P(sink), 1, (void**)&tmp) == SUCCESS)
+		if (zend_hash_index_find(Z_ARRVAL_P(sink), 1, (void**)&tmp) == SUCCESS && Z_TYPE_PP(tmp) == IS_STRING)
 			dispname = Z_STRVAL_PP(tmp);
 	} else if (sink != NULL) {
 		convert_to_string(sink);
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Mon Dec  5 22:02:41 2011 */
+/* Generated by re2c 0.13.5 on Fri Jul 18 16:11:36 2014 */
 #line 1 "ext/date/lib/parse_date.re"
 /*
   +----------------------------------------------------------------------+
@@ -403,9 +403,12 @@ static timelib_sll timelib_meridian_with_check(char **ptr, timelib_sll h)
 {
 	timelib_sll retval = 0;

-	while (!strchr("AaPp", **ptr)) {
+	while (**ptr && !strchr("AaPp", **ptr)) {
 		++*ptr;
 	}
+    if(!**ptr) {
+        return TIMELIB_UNSET;
+    }
 	if (**ptr == 'a' || **ptr == 'A') {
 		if (h == 12) {
 			retval = -12;
@@ -871,11 +874,11 @@ static int scan(Scanner *s, timelib_tz_get_wrapper tz_get_wrapper)
 std:
 	s->tok = cursor;
 	s->len = 0;
-#line 997 "ext/date/lib/parse_date.re"
+#line 1000 "ext/date/lib/parse_date.re"



-#line 879 "ext/date/lib/parse_date.c"
+#line 882 "ext/date/lib/parse_date.c"
 {
 	YYCTYPE yych;
 	unsigned int yyaccept = 0;
@@ -995,7 +998,7 @@ std:
 	}
 yy2:
 	YYDEBUG(2, *YYCURSOR);
-#line 1082 "ext/date/lib/parse_date.re"
+#line 1085 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("firstdayof | lastdayof");
 		TIMELIB_INIT;
@@ -1011,7 +1014,7 @@ yy2:
 		TIMELIB_DEINIT;
 		return TIMELIB_LF_DAY_OF_MONTH;
 	}
-#line 1015 "ext/date/lib/parse_date.c"
+#line 1018 "ext/date/lib/parse_date.c"
 yy3:
 	YYDEBUG(3, *YYCURSOR);
 	++YYCURSOR;
@@ -1034,7 +1037,7 @@ yy3:
 	}
 yy4:
 	YYDEBUG(4, *YYCURSOR);
-#line 1676 "ext/date/lib/parse_date.re"
+#line 1679 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("tzcorrection | tz");
@@ -1047,7 +1050,7 @@ yy4:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIMEZONE;
 	}
-#line 1051 "ext/date/lib/parse_date.c"
+#line 1054 "ext/date/lib/parse_date.c"
 yy5:
 	YYDEBUG(5, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -1358,12 +1361,12 @@ yy12:
 	if (yych <= '9') goto yy1385;
 yy13:
 	YYDEBUG(13, *YYCURSOR);
-#line 1771 "ext/date/lib/parse_date.re"
+#line 1774 "ext/date/lib/parse_date.re"
 	{
 		add_error(s, "Unexpected character");
 		goto std;
 	}
-#line 1367 "ext/date/lib/parse_date.c"
+#line 1370 "ext/date/lib/parse_date.c"
 yy14:
 	YYDEBUG(14, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -2420,11 +2423,11 @@ yy49:
 	if (yych <= '9') goto yy55;
 yy50:
 	YYDEBUG(50, *YYCURSOR);
-#line 1760 "ext/date/lib/parse_date.re"
+#line 1763 "ext/date/lib/parse_date.re"
 	{
 		goto std;
 	}
-#line 2428 "ext/date/lib/parse_date.c"
+#line 2431 "ext/date/lib/parse_date.c"
 yy51:
 	YYDEBUG(51, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -2433,12 +2436,12 @@ yy52:
 	YYDEBUG(52, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(53, *YYCURSOR);
-#line 1765 "ext/date/lib/parse_date.re"
+#line 1768 "ext/date/lib/parse_date.re"
 	{
 		s->pos = cursor; s->line++;
 		goto std;
 	}
-#line 2442 "ext/date/lib/parse_date.c"
+#line 2445 "ext/date/lib/parse_date.c"
 yy54:
 	YYDEBUG(54, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -2825,7 +2828,7 @@ yy72:
 	if (yych == 's') goto yy74;
 yy73:
 	YYDEBUG(73, *YYCURSOR);
-#line 1744 "ext/date/lib/parse_date.re"
+#line 1747 "ext/date/lib/parse_date.re"
 	{
 		timelib_ull i;
 		DEBUG_OUTPUT("relative");
@@ -2840,7 +2843,7 @@ yy73:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 2844 "ext/date/lib/parse_date.c"
+#line 2847 "ext/date/lib/parse_date.c"
 yy74:
 	YYDEBUG(74, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -3602,7 +3605,7 @@ yy166:
 	}
 yy167:
 	YYDEBUG(167, *YYCURSOR);
-#line 1607 "ext/date/lib/parse_date.re"
+#line 1610 "ext/date/lib/parse_date.re"
 	{
 		const timelib_relunit* relunit;
 		DEBUG_OUTPUT("daytext");
@@ -3619,7 +3622,7 @@ yy167:
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEKDAY;
 	}
-#line 3623 "ext/date/lib/parse_date.c"
+#line 3626 "ext/date/lib/parse_date.c"
 yy168:
 	YYDEBUG(168, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -4139,7 +4142,7 @@ yy193:
 	}
 yy194:
 	YYDEBUG(194, *YYCURSOR);
-#line 1666 "ext/date/lib/parse_date.re"
+#line 1669 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("monthtext");
 		TIMELIB_INIT;
@@ -4148,7 +4151,7 @@ yy194:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 4152 "ext/date/lib/parse_date.c"
+#line 4155 "ext/date/lib/parse_date.c"
 yy195:
 	YYDEBUG(195, *YYCURSOR);
 	++YYCURSOR;
@@ -4199,7 +4202,7 @@ yy198:
 	}
 yy199:
 	YYDEBUG(199, *YYCURSOR);
-#line 1412 "ext/date/lib/parse_date.re"
+#line 1415 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datetextual | datenoyear");
@@ -4212,7 +4215,7 @@ yy199:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 4216 "ext/date/lib/parse_date.c"
+#line 4219 "ext/date/lib/parse_date.c"
 yy200:
 	YYDEBUG(200, *YYCURSOR);
 	yyaccept = 6;
@@ -4481,7 +4484,7 @@ yy222:
 	}
 yy223:
 	YYDEBUG(223, *YYCURSOR);
-#line 1714 "ext/date/lib/parse_date.re"
+#line 1717 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("dateshortwithtimeshort | dateshortwithtimelong | dateshortwithtimelongtz");
@@ -4510,7 +4513,7 @@ yy223:
 		TIMELIB_DEINIT;
 		return TIMELIB_SHORTDATE_WITH_TIME;
 	}
-#line 4514 "ext/date/lib/parse_date.c"
+#line 4517 "ext/date/lib/parse_date.c"
 yy224:
 	YYDEBUG(224, *YYCURSOR);
 	yyaccept = 7;
@@ -5208,7 +5211,7 @@ yy278:
 	YYDEBUG(278, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(279, *YYCURSOR);
-#line 1690 "ext/date/lib/parse_date.re"
+#line 1693 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("dateshortwithtimeshort12 | dateshortwithtimelong12");
 		TIMELIB_INIT;
@@ -5231,7 +5234,7 @@ yy278:
 		TIMELIB_DEINIT;
 		return TIMELIB_SHORTDATE_WITH_TIME;
 	}
-#line 5235 "ext/date/lib/parse_date.c"
+#line 5238 "ext/date/lib/parse_date.c"
 yy280:
 	YYDEBUG(280, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -5409,7 +5412,7 @@ yy294:
 	++YYCURSOR;
 yy295:
 	YYDEBUG(295, *YYCURSOR);
-#line 1384 "ext/date/lib/parse_date.re"
+#line 1387 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datenoday");
@@ -5422,7 +5425,7 @@ yy295:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NO_DAY;
 	}
-#line 5426 "ext/date/lib/parse_date.c"
+#line 5429 "ext/date/lib/parse_date.c"
 yy296:
 	YYDEBUG(296, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -6642,7 +6645,7 @@ yy362:
 	if (yych <= '9') goto yy365;
 yy364:
 	YYDEBUG(364, *YYCURSOR);
-#line 1528 "ext/date/lib/parse_date.re"
+#line 1531 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgtextshort");
@@ -6655,7 +6658,7 @@ yy364:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_TEXT;
 	}
-#line 6659 "ext/date/lib/parse_date.c"
+#line 6662 "ext/date/lib/parse_date.c"
 yy365:
 	YYDEBUG(365, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -7293,7 +7296,7 @@ yy392:
 	}
 yy393:
 	YYDEBUG(393, *YYCURSOR);
-#line 1586 "ext/date/lib/parse_date.re"
+#line 1589 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("ago");
 		TIMELIB_INIT;
@@ -7313,7 +7316,7 @@ yy393:
 		TIMELIB_DEINIT;
 		return TIMELIB_AGO;
 	}
-#line 7317 "ext/date/lib/parse_date.c"
+#line 7320 "ext/date/lib/parse_date.c"
 yy394:
 	YYDEBUG(394, *YYCURSOR);
 	yyaccept = 5;
@@ -9063,7 +9066,7 @@ yy454:
 	++YYCURSOR;
 yy455:
 	YYDEBUG(455, *YYCURSOR);
-#line 1289 "ext/date/lib/parse_date.re"
+#line 1292 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("iso8601date4 | iso8601date2 | iso8601dateslash | dateslash");
 		TIMELIB_INIT;
@@ -9074,7 +9077,7 @@ yy455:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 9078 "ext/date/lib/parse_date.c"
+#line 9081 "ext/date/lib/parse_date.c"
 yy456:
 	YYDEBUG(456, *YYCURSOR);
 	yyaccept = 0;
@@ -9634,7 +9637,7 @@ yy475:
 	}
 yy476:
 	YYDEBUG(476, *YYCURSOR);
-#line 1426 "ext/date/lib/parse_date.re"
+#line 1429 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("datenoyearrev");
 		TIMELIB_INIT;
@@ -9645,7 +9648,7 @@ yy476:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 9649 "ext/date/lib/parse_date.c"
+#line 9652 "ext/date/lib/parse_date.c"
 yy477:
 	YYDEBUG(477, *YYCURSOR);
 	yyaccept = 10;
@@ -9786,7 +9789,7 @@ yy488:
 	YYDEBUG(488, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(489, *YYCURSOR);
-#line 1144 "ext/date/lib/parse_date.re"
+#line 1147 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("timetiny12 | timeshort12 | timelong12");
 		TIMELIB_INIT;
@@ -9802,7 +9805,7 @@ yy488:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME12;
 	}
-#line 9806 "ext/date/lib/parse_date.c"
+#line 9809 "ext/date/lib/parse_date.c"
 yy490:
 	YYDEBUG(490, *YYCURSOR);
 	yyaccept = 11;
@@ -9815,7 +9818,7 @@ yy490:
 	}
 yy491:
 	YYDEBUG(491, *YYCURSOR);
-#line 1181 "ext/date/lib/parse_date.re"
+#line 1184 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("timeshort24 | timelong24 | iso8601long");
@@ -9840,7 +9843,7 @@ yy491:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME24_WITH_ZONE;
 	}
-#line 9844 "ext/date/lib/parse_date.c"
+#line 9847 "ext/date/lib/parse_date.c"
 yy492:
 	YYDEBUG(492, *YYCURSOR);
 	yyaccept = 11;
@@ -10150,7 +10153,7 @@ yy523:
 	YYDEBUG(523, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(524, *YYCURSOR);
-#line 1161 "ext/date/lib/parse_date.re"
+#line 1164 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("mssqltime");
 		TIMELIB_INIT;
@@ -10169,7 +10172,7 @@ yy523:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME24_WITH_ZONE;
 	}
-#line 10173 "ext/date/lib/parse_date.c"
+#line 10176 "ext/date/lib/parse_date.c"
 yy525:
 	YYDEBUG(525, *YYCURSOR);
 	yyaccept = 11;
@@ -10275,7 +10278,7 @@ yy534:
 	if (yych <= '9') goto yy541;
 yy535:
 	YYDEBUG(535, *YYCURSOR);
-#line 1343 "ext/date/lib/parse_date.re"
+#line 1346 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datefull");
@@ -10289,7 +10292,7 @@ yy535:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL;
 	}
-#line 10293 "ext/date/lib/parse_date.c"
+#line 10296 "ext/date/lib/parse_date.c"
 yy536:
 	YYDEBUG(536, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -11026,7 +11029,7 @@ yy605:
 	YYDEBUG(606, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(607, *YYCURSOR);
-#line 1358 "ext/date/lib/parse_date.re"
+#line 1361 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("pointed date YYYY");
 		TIMELIB_INIT;
@@ -11037,7 +11040,7 @@ yy605:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL_POINTED;
 	}
-#line 11041 "ext/date/lib/parse_date.c"
+#line 11044 "ext/date/lib/parse_date.c"
 yy608:
 	YYDEBUG(608, *YYCURSOR);
 	yyaccept = 11;
@@ -11073,7 +11076,7 @@ yy611:
 	if (yych <= '9') goto yy605;
 yy612:
 	YYDEBUG(612, *YYCURSOR);
-#line 1370 "ext/date/lib/parse_date.re"
+#line 1373 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pointed date YY");
@@ -11086,7 +11089,7 @@ yy612:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL_POINTED;
 	}
-#line 11090 "ext/date/lib/parse_date.c"
+#line 11093 "ext/date/lib/parse_date.c"
 yy613:
 	YYDEBUG(613, *YYCURSOR);
 	yyaccept = 11;
@@ -11727,7 +11730,7 @@ yy656:
 	}
 yy657:
 	YYDEBUG(657, *YYCURSOR);
-#line 1329 "ext/date/lib/parse_date.re"
+#line 1332 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("gnudateshort");
@@ -11740,7 +11743,7 @@ yy657:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 11744 "ext/date/lib/parse_date.c"
+#line 11747 "ext/date/lib/parse_date.c"
 yy658:
 	YYDEBUG(658, *YYCURSOR);
 	yyaccept = 13;
@@ -11846,7 +11849,7 @@ yy666:
 	}
 yy667:
 	YYDEBUG(667, *YYCURSOR);
-#line 1273 "ext/date/lib/parse_date.re"
+#line 1276 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("americanshort | american");
@@ -11861,7 +11864,7 @@ yy667:
 		TIMELIB_DEINIT;
 		return TIMELIB_AMERICAN;
 	}
-#line 11865 "ext/date/lib/parse_date.c"
+#line 11868 "ext/date/lib/parse_date.c"
 yy668:
 	YYDEBUG(668, *YYCURSOR);
 	yyaccept = 14;
@@ -12094,7 +12097,7 @@ yy700:
 	if (yych <= ':') goto yy704;
 yy701:
 	YYDEBUG(701, *YYCURSOR);
-#line 1556 "ext/date/lib/parse_date.re"
+#line 1559 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("clf");
@@ -12114,7 +12117,7 @@ yy701:
 		TIMELIB_DEINIT;
 		return TIMELIB_CLF;
 	}
-#line 12118 "ext/date/lib/parse_date.c"
+#line 12121 "ext/date/lib/parse_date.c"
 yy702:
 	YYDEBUG(702, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -12666,7 +12669,7 @@ yy763:
 	}
 yy764:
 	YYDEBUG(764, *YYCURSOR);
-#line 1301 "ext/date/lib/parse_date.re"
+#line 1304 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("iso8601date2");
@@ -12679,7 +12682,7 @@ yy764:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 12683 "ext/date/lib/parse_date.c"
+#line 12686 "ext/date/lib/parse_date.c"
 yy765:
 	YYDEBUG(765, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -12718,7 +12721,7 @@ yy771:
 	YYDEBUG(771, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(772, *YYCURSOR);
-#line 1542 "ext/date/lib/parse_date.re"
+#line 1545 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgtextreverse");
@@ -12731,7 +12734,7 @@ yy771:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_TEXT;
 	}
-#line 12735 "ext/date/lib/parse_date.c"
+#line 12738 "ext/date/lib/parse_date.c"
 yy773:
 	YYDEBUG(773, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -12869,7 +12872,7 @@ yy783:
 	}
 yy784:
 	YYDEBUG(784, *YYCURSOR);
-#line 1577 "ext/date/lib/parse_date.re"
+#line 1580 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("year4");
 		TIMELIB_INIT;
@@ -12877,7 +12880,7 @@ yy784:
 		TIMELIB_DEINIT;
 		return TIMELIB_CLF;
 	}
-#line 12881 "ext/date/lib/parse_date.c"
+#line 12884 "ext/date/lib/parse_date.c"
 yy785:
 	YYDEBUG(785, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -13028,7 +13031,7 @@ yy793:
 	}
 yy794:
 	YYDEBUG(794, *YYCURSOR);
-#line 1398 "ext/date/lib/parse_date.re"
+#line 1401 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datenodayrev");
@@ -13041,7 +13044,7 @@ yy794:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NO_DAY;
 	}
-#line 13045 "ext/date/lib/parse_date.c"
+#line 13048 "ext/date/lib/parse_date.c"
 yy795:
 	YYDEBUG(795, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -13256,7 +13259,7 @@ yy814:
 	if (yych <= '7') goto yy817;
 yy815:
 	YYDEBUG(815, *YYCURSOR);
-#line 1509 "ext/date/lib/parse_date.re"
+#line 1512 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll w, d;
 		DEBUG_OUTPUT("isoweek");
@@ -13274,7 +13277,7 @@ yy815:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_WEEK;
 	}
-#line 13278 "ext/date/lib/parse_date.c"
+#line 13281 "ext/date/lib/parse_date.c"
 yy816:
 	YYDEBUG(816, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -13284,7 +13287,7 @@ yy817:
 	YYDEBUG(817, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(818, *YYCURSOR);
-#line 1490 "ext/date/lib/parse_date.re"
+#line 1493 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll w, d;
 		DEBUG_OUTPUT("isoweekday");
@@ -13302,7 +13305,7 @@ yy817:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_WEEK;
 	}
-#line 13306 "ext/date/lib/parse_date.c"
+#line 13309 "ext/date/lib/parse_date.c"
 yy819:
 	YYDEBUG(819, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -13366,7 +13369,7 @@ yy821:
 	}
 yy822:
 	YYDEBUG(822, *YYCURSOR);
-#line 1476 "ext/date/lib/parse_date.re"
+#line 1479 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgydotd");
@@ -13379,7 +13382,7 @@ yy822:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_YEARDAY;
 	}
-#line 13383 "ext/date/lib/parse_date.c"
+#line 13386 "ext/date/lib/parse_date.c"
 yy823:
 	YYDEBUG(823, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -13482,7 +13485,7 @@ yy842:
 	++YYCURSOR;
 yy843:
 	YYDEBUG(843, *YYCURSOR);
-#line 1450 "ext/date/lib/parse_date.re"
+#line 1453 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("xmlrpc | xmlrpcnocolon | soap | wddx | exif");
@@ -13507,7 +13510,7 @@ yy843:
 		TIMELIB_DEINIT;
 		return TIMELIB_XMLRPC_SOAP;
 	}
-#line 13511 "ext/date/lib/parse_date.c"
+#line 13514 "ext/date/lib/parse_date.c"
 yy844:
 	YYDEBUG(844, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -13769,7 +13772,7 @@ yy848:
 	}
 yy849:
 	YYDEBUG(849, *YYCURSOR);
-#line 1438 "ext/date/lib/parse_date.re"
+#line 1441 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("datenocolon");
 		TIMELIB_INIT;
@@ -13780,7 +13783,7 @@ yy849:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NOCOLON;
 	}
-#line 13784 "ext/date/lib/parse_date.c"
+#line 13787 "ext/date/lib/parse_date.c"
 yy850:
 	YYDEBUG(850, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -14700,7 +14703,7 @@ yy973:
 	if (yych <= '9') goto yy996;
 yy974:
 	YYDEBUG(974, *YYCURSOR);
-#line 1315 "ext/date/lib/parse_date.re"
+#line 1318 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("gnudateshorter");
@@ -14713,7 +14716,7 @@ yy974:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 14717 "ext/date/lib/parse_date.c"
+#line 14720 "ext/date/lib/parse_date.c"
 yy975:
 	YYDEBUG(975, *YYCURSOR);
 	yyaccept = 22;
@@ -15722,7 +15725,7 @@ yy1066:
 	}
 yy1068:
 	YYDEBUG(1068, *YYCURSOR);
-#line 1207 "ext/date/lib/parse_date.re"
+#line 1210 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("gnunocolon");
 		TIMELIB_INIT;
@@ -15744,7 +15747,7 @@ yy1068:
 		TIMELIB_DEINIT;
 		return TIMELIB_GNU_NOCOLON;
 	}
-#line 15748 "ext/date/lib/parse_date.c"
+#line 15751 "ext/date/lib/parse_date.c"
 yy1069:
 	YYDEBUG(1069, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -15836,7 +15839,7 @@ yy1075:
 	}
 yy1076:
 	YYDEBUG(1076, *YYCURSOR);
-#line 1253 "ext/date/lib/parse_date.re"
+#line 1256 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("iso8601nocolon");
@@ -15855,7 +15858,7 @@ yy1076:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_NOCOLON;
 	}
-#line 15859 "ext/date/lib/parse_date.c"
+#line 15862 "ext/date/lib/parse_date.c"
 yy1077:
 	YYDEBUG(1077, *YYCURSOR);
 	yyaccept = 25;
@@ -16753,7 +16756,7 @@ yy1117:
 	}
 yy1118:
 	YYDEBUG(1118, *YYCURSOR);
-#line 1649 "ext/date/lib/parse_date.re"
+#line 1652 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -16769,7 +16772,7 @@ yy1118:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 16773 "ext/date/lib/parse_date.c"
+#line 16776 "ext/date/lib/parse_date.c"
 yy1119:
 	YYDEBUG(1119, *YYCURSOR);
 	++YYCURSOR;
@@ -16820,7 +16823,7 @@ yy1126:
 	YYDEBUG(1126, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(1127, *YYCURSOR);
-#line 1122 "ext/date/lib/parse_date.re"
+#line 1125 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -16841,7 +16844,7 @@ yy1126:
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEK_DAY_OF_MONTH;
 	}
-#line 16845 "ext/date/lib/parse_date.c"
+#line 16848 "ext/date/lib/parse_date.c"
 yy1128:
 	YYDEBUG(1128, *YYCURSOR);
 	yyaccept = 26;
@@ -16949,7 +16952,7 @@ yy1141:
 	}
 yy1142:
 	YYDEBUG(1142, *YYCURSOR);
-#line 1625 "ext/date/lib/parse_date.re"
+#line 1628 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -16972,7 +16975,7 @@ yy1142:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 16976 "ext/date/lib/parse_date.c"
+#line 16979 "ext/date/lib/parse_date.c"
 yy1143:
 	YYDEBUG(1143, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -19649,7 +19652,7 @@ yy1294:
 	goto yy1298;
 yy1295:
 	YYDEBUG(1295, *YYCURSOR);
-#line 1099 "ext/date/lib/parse_date.re"
+#line 1102 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("backof | frontof");
 		TIMELIB_INIT;
@@ -19671,7 +19674,7 @@ yy1295:
 		TIMELIB_DEINIT;
 		return TIMELIB_LF_DAY_OF_MONTH;
 	}
-#line 19675 "ext/date/lib/parse_date.c"
+#line 19678 "ext/date/lib/parse_date.c"
 yy1296:
 	YYDEBUG(1296, *YYCURSOR);
 	yyaccept = 28;
@@ -21362,7 +21365,7 @@ yy1385:
 	if (yych <= '9') goto yy1385;
 yy1387:
 	YYDEBUG(1387, *YYCURSOR);
-#line 1057 "ext/date/lib/parse_date.re"
+#line 1060 "ext/date/lib/parse_date.re"
 	{
 		timelib_ull i;

@@ -21386,7 +21389,7 @@ yy1387:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 21390 "ext/date/lib/parse_date.c"
+#line 21393 "ext/date/lib/parse_date.c"
 yy1388:
 	YYDEBUG(1388, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -21822,7 +21825,7 @@ yy1416:
 	++YYCURSOR;
 yy1417:
 	YYDEBUG(1417, *YYCURSOR);
-#line 1045 "ext/date/lib/parse_date.re"
+#line 1048 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("tomorrow");
 		TIMELIB_INIT;
@@ -21833,7 +21836,7 @@ yy1417:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 21837 "ext/date/lib/parse_date.c"
+#line 21840 "ext/date/lib/parse_date.c"
 yy1418:
 	YYDEBUG(1418, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -21868,7 +21871,7 @@ yy1419:
 	}
 yy1420:
 	YYDEBUG(1420, *YYCURSOR);
-#line 1035 "ext/date/lib/parse_date.re"
+#line 1038 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("midnight | today");
 		TIMELIB_INIT;
@@ -21877,7 +21880,7 @@ yy1420:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 21881 "ext/date/lib/parse_date.c"
+#line 21884 "ext/date/lib/parse_date.c"
 yy1421:
 	YYDEBUG(1421, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -23889,7 +23892,7 @@ yy1499:
 	}
 yy1500:
 	YYDEBUG(1500, *YYCURSOR);
-#line 1014 "ext/date/lib/parse_date.re"
+#line 1017 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("now");
 		TIMELIB_INIT;
@@ -23897,7 +23900,7 @@ yy1500:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 23901 "ext/date/lib/parse_date.c"
+#line 23904 "ext/date/lib/parse_date.c"
 yy1501:
 	YYDEBUG(1501, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -24036,7 +24039,7 @@ yy1507:
 	}
 yy1508:
 	YYDEBUG(1508, *YYCURSOR);
-#line 1023 "ext/date/lib/parse_date.re"
+#line 1026 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("noon");
 		TIMELIB_INIT;
@@ -24047,7 +24050,7 @@ yy1508:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 24051 "ext/date/lib/parse_date.c"
+#line 24054 "ext/date/lib/parse_date.c"
 yy1509:
 	YYDEBUG(1509, *YYCURSOR);
 	yyaccept = 0;
@@ -24580,7 +24583,7 @@ yy1530:
 	++YYCURSOR;
 yy1531:
 	YYDEBUG(1531, *YYCURSOR);
-#line 1002 "ext/date/lib/parse_date.re"
+#line 1005 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("yesterday");
 		TIMELIB_INIT;
@@ -24591,7 +24594,7 @@ yy1531:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 24595 "ext/date/lib/parse_date.c"
+#line 24598 "ext/date/lib/parse_date.c"
 yy1532:
 	YYDEBUG(1532, *YYCURSOR);
 	yyaccept = 0;
@@ -24764,7 +24767,7 @@ yy1537:
 		goto yy1531;
 	}
 }
-#line 1775 "ext/date/lib/parse_date.re"
+#line 1778 "ext/date/lib/parse_date.re"

 }

@@ -25121,7 +25124,11 @@ timelib_time *timelib_parse_from_format(char *format, char *string, int len, tim
 				break;

 			case '\\': /* escaped char */
-				*fptr++;
+                if(!fptr[1]) {
+				    add_pbf_error(s, "Escaped character expected", string, begin);
+                    break;
+                }
+				fptr++;
 				if (*ptr == *fptr) {
 					++ptr;
 				} else {
@@ -401,9 +401,12 @@ static timelib_sll timelib_meridian_with_check(char **ptr, timelib_sll h)
 {
 	timelib_sll retval = 0;

-	while (!strchr("AaPp", **ptr)) {
+	while (**ptr && !strchr("AaPp", **ptr)) {
 		++*ptr;
 	}
+    if(!**ptr) {
+        return TIMELIB_UNSET;
+    }
 	if (**ptr == 'a' || **ptr == 'A') {
 		if (h == 12) {
 			retval = -12;
@@ -2128,7 +2131,11 @@ timelib_time *timelib_parse_from_format(char *format, char *string, int len, tim
 				break;

 			case '\\': /* escaped char */
-				*fptr++;
+                if(!fptr[1]) {
+				    add_pbf_error(s, "Escaped character expected", string, begin);
+                    break;
+                }
+				fptr++;
 				if (*ptr == *fptr) {
 					++ptr;
 				} else {
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Mon Dec  5 22:02:31 2011 */
+/* Generated by re2c 0.13.5 on Fri Jul 18 16:11:41 2014 */
 #line 1 "ext/date/lib/parse_iso_intervals.re"
 /*
   +----------------------------------------------------------------------+
@@ -415,7 +415,7 @@ yy6:
 					break;
 			}
 			ptr++;
-		} while (*ptr);
+		} while (!s->errors->error_count && *ptr);
 		s->have_period = 1;
 		TIMELIB_DEINIT;
 		return TIMELIB_PERIOD;
@@ -383,7 +383,7 @@ isoweek          = year4 "-"? "W" weekofyear;
 					break;
 			}
 			ptr++;
-		} while (*ptr);
+		} while (!s->errors->error_count && *ptr);
 		s->have_period = 1;
 		TIMELIB_DEINIT;
 		return TIMELIB_PERIOD;
@@ -0,0 +1,38 @@
+--TEST--
+Bug #67251 (date_parse_from_format out-of-bounds read)
+--INI--
+date.timezone=Europe/Berlin
+--FILE--
+<?php
+var_dump(date_parse_from_format("\\","AAAABBBB"));
+--EXPECT--
+array(12) {
+  ["year"]=>
+  bool(false)
+  ["month"]=>
+  bool(false)
+  ["day"]=>
+  bool(false)
+  ["hour"]=>
+  bool(false)
+  ["minute"]=>
+  bool(false)
+  ["second"]=>
+  bool(false)
+  ["fraction"]=>
+  bool(false)
+  ["warning_count"]=>
+  int(0)
+  ["warnings"]=>
+  array(0) {
+  }
+  ["error_count"]=>
+  int(2)
+  ["errors"]=>
+  array(1) {
+    [0]=>
+    string(13) "Trailing data"
+  }
+  ["is_localtime"]=>
+  bool(false)
+}
@@ -0,0 +1,44 @@
+--TEST--
+Bug #67253 (timelib_meridian_with_check out-of-bounds read)
+--INI--
+date.timezone=Europe/Berlin
+--FILE--
+<?php
+$z = '';
+var_dump(date_parse_from_format("aHa0", "0=G{$z}9UCNnF"));
+--EXPECT--
+array(12) {
+  ["year"]=>
+  bool(false)
+  ["month"]=>
+  bool(false)
+  ["day"]=>
+  bool(false)
+  ["hour"]=>
+  int(0)
+  ["minute"]=>
+  int(0)
+  ["second"]=>
+  int(0)
+  ["fraction"]=>
+  bool(false)
+  ["warning_count"]=>
+  int(0)
+  ["warnings"]=>
+  array(0) {
+  }
+  ["error_count"]=>
+  int(3)
+  ["errors"]=>
+  array(3) {
+    [0]=>
+    string(51) "Meridian can only come after an hour has been found"
+    [1]=>
+    string(29) "A meridian could not be found"
+    [9]=>
+    string(12) "Data missing"
+  }
+  ["is_localtime"]=>
+  bool(false)
+}
+
@@ -2874,7 +2874,12 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 		offset_val = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
 		/* If its bigger than 4 bytes, the dir entry contains an offset. */
 		value_ptr = offset_base+offset_val;
-		if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry) {
+        /* 
+            dir_entry is ImageInfo->file.list[sn].data+2+i*12
+            offset_base is ImageInfo->file.list[sn].data-dir_offset 
+            dir_entry - offset_base is dir_offset+2+i*12
+        */
+		if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base)) {
 			/* It is important to check for IMAGE_FILETYPE_TIFF
 			 * JPEG does not use absolute pointers instead its pointers are
 			 * relative to the start of the TIFF header in APP1 section. */
@@ -277,13 +277,15 @@ cdf_check_stream_offset(const cdf_stream_t *sst, const cdf_header_t *h,
 {
 	const char *b = (const char *)sst->sst_tab;
 	const char *e = ((const char *)p) + tail;
+	size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ?
+	    CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h);
 	(void)&line;
-	if (e >= b && (size_t)(e - b) < CDF_SEC_SIZE(h) * sst->sst_len)
+	if (e >= b && (size_t)(e - b) <= ss * sst->sst_len)
 		return 0;
 	DPRINTF(("%d: offset begin %p end %p %" SIZE_T_FORMAT "u"
 	    " >= %" SIZE_T_FORMAT "u [%" SIZE_T_FORMAT "u %"
 	    SIZE_T_FORMAT "u]\n", line, b, e, (size_t)(e - b),
-	    CDF_SEC_SIZE(h) * sst->sst_len, CDF_SEC_SIZE(h), sst->sst_len));
+	    ss * sst->sst_len, ss, sst->sst_len));
 	errno = EFTYPE;
 	return -1;
 }
@@ -365,10 +367,10 @@ cdf_read_short_sector(const cdf_stream_t *sst, void *buf, size_t offs,
 	size_t ss = CDF_SHORT_SEC_SIZE(h);
 	size_t pos = CDF_SHORT_SEC_POS(h, id);
 	assert(ss == len);
-	if (pos > CDF_SEC_SIZE(h) * sst->sst_len) {
+	if (pos + len > CDF_SEC_SIZE(h) * sst->sst_len) {
 		DPRINTF(("Out of bounds read %" SIZE_T_FORMAT "u > %"
 		    SIZE_T_FORMAT "u\n",
-		    pos, CDF_SEC_SIZE(h) * sst->sst_len));
+		    pos + len, CDF_SEC_SIZE(h) * sst->sst_len));
 		return -1;
 	}
 	(void)memcpy(((char *)buf) + offs,
@@ -468,7 +470,8 @@ size_t
 cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
 {
 	size_t i, j;
-	cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
+	cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
+	    / sizeof(maxsector));

 	DPRINTF(("Chain:"));
 	for (j = i = 0; sid >= 0; i++, j++) {
@@ -478,8 +481,8 @@ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
 			errno = EFTYPE;
 			return (size_t)-1;
 		}
-		if (sid > maxsector) {
-			DPRINTF(("Sector %d > %d\n", sid, maxsector));
+		if (sid >= maxsector) {
+			DPRINTF(("Sector %d >= %d\n", sid, maxsector));
 			errno = EFTYPE;
 			return (size_t)-1;
 		}
@@ -809,7 +812,11 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
 		goto out;
 	for (i = 0; i < sh.sh_properties; i++) {
-		size_t ofs = CDF_GETUINT32(p, (i << 1) + 1);
+		size_t ofs, tail = (i << 1) + 1;
+		if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t),
+		    __LINE__) == -1)
+			goto out;
+		ofs = CDF_GETUINT32(p, tail);
 		q = (const uint8_t *)(const void *)
 		    ((const char *)(const void *)p + ofs
 		    - 2 * sizeof(uint32_t));
@@ -823,6 +830,10 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
 		if (inp[i].pi_type & CDF_VECTOR) {
 			nelements = CDF_GETUINT32(q, 1);
+			if (nelements == 0) {
+				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
+				goto out;
+			}
 			o = 2;
 		} else {
 			nelements = 1;
@@ -897,7 +908,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 			}
 			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
 			    nelements));
-			for (j = 0; j < nelements; j++, i++) {
+			for (j = 0; j < nelements && i < sh.sh_properties; 
+			    j++, i++) 
+			{
 				uint32_t l = CDF_GETUINT32(q, o);
 				inp[i].pi_str.s_len = l;
 				inp[i].pi_str.s_buf = (const char *)
@@ -942,7 +955,7 @@ int
 cdf_unpack_summary_info(const cdf_stream_t *sst, const cdf_header_t *h,
    cdf_summary_info_header_t *ssi, cdf_property_info_t **info, size_t *count)
 {
-	size_t i, maxcount;
+	size_t maxcount;
 	const cdf_summary_info_header_t *si =
 	    CAST(const cdf_summary_info_header_t *, sst->sst_tab);
 	const cdf_section_declaration_t *sd =
@@ -957,21 +970,13 @@ cdf_unpack_summary_info(const cdf_stream_t *sst, const cdf_header_t *h,
 	ssi->si_os = CDF_TOLE2(si->si_os);
 	ssi->si_class = si->si_class;
 	cdf_swap_class(&ssi->si_class);
-	ssi->si_count = CDF_TOLE2(si->si_count);
+	ssi->si_count = CDF_TOLE4(si->si_count);
 	*count = 0;
 	maxcount = 0;
 	*info = NULL;
-	for (i = 0; i < CDF_TOLE4(si->si_count); i++) {
-		if (i >= CDF_LOOP_LIMIT) {
-			DPRINTF(("Unpack summary info loop limit"));
-			errno = EFTYPE;
+	if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset), info,
+		count, &maxcount) == -1) 
 			return -1;
-		}
-		if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset),
-		    info, count, &maxcount) == -1) {
-			return -1;
-		}
-	}
 	return 0;
 }

@@ -56,6 +56,8 @@ cdf_file_property_info(struct magic_set *ms, const cdf_property_info_t *info,
        const char *s;
        int len;

+	memset(&ts, 0, sizeof(ts));
+
        for (i = 0; i < count; i++) {
                cdf_print_property_name(buf, sizeof(buf), info[i].pi_id);
                switch (info[i].pi_type) {
@@ -142,11 +144,13 @@ cdf_file_property_info(struct magic_set *ms, const cdf_property_info_t *info,
                                                return -1;
                                } else {
                                        char *c, *ec;
+                                        const time_t sec = ts.tv_sec;
                                        if (cdf_timestamp_to_timespec(&ts, tp) == -1) {
 											return -1;
 										}
-                                        c = cdf_ctime(&ts.tv_sec);
-                                        if ((ec = strchr(c, '\n')) != NULL)
+                                        c = cdf_ctime(&sec);
+                                        if (c != NULL &&
+					    (ec = strchr(c, '\n')) != NULL)
                                                *ec = '\0';

                                        if (NOTMIME(ms) && file_printf(ms,
@@ -777,10 +777,18 @@ mconvert(struct magic_set *ms, struct magic *m)
 		return 1;
 	}
 	case FILE_PSTRING: {
-		char *ptr1 = p->s, *ptr2 = ptr1 + file_pstring_length_size(m);
+		size_t sz = file_pstring_length_size(m);
+		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
 		size_t len = file_pstring_get_length(m, ptr1);
-		if (len >= sizeof(p->s))
-			len = sizeof(p->s) - 1;
+		if (len >= sizeof(p->s)) {
+			/*
+			 * The size of the pascal string length (sz)
+			 * is 1, 2, or 4. We need at least 1 byte for NUL
+			 * termination, but we've already truncated the
+			 * string by p->s, so we need to deduct sz.
+			 */ 
+			len = sizeof(p->s) - sz;
+		}
 		while (len--)
 			*ptr1++ = *ptr2++;
 		*ptr1 = '\0';
@@ -18,7 +18,7 @@ ksort($results);
 var_dump($results);
 ?>
 --EXPECTF--
-array(7) {
+array(8) {
  ["%s/resources/dir.zip"]=>
  string(15) "application/zip"
  ["%s/resources/test.awk"]=>
@@ -33,4 +33,6 @@ array(7) {
  string(15) "application/pdf"
  ["%s/resources/test.png"]=>
  string(9) "image/png"
+  ["%s/resources/test.ppt"]=>
+  string(29) "application/vnd.ms-powerpoint"
 }
@@ -269,8 +269,7 @@ static char* get_icu_value_internal( char* loc_name , char* tag_name, int* resul
 		grOffset =  findOffset( LOC_GRANDFATHERED , loc_name );
 		if( grOffset >= 0 ){
 			if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
-				tag_value = estrdup(loc_name);
-				return tag_value;
+				return estrdup(loc_name);
 			} else {
 				/* Since Grandfathered , no value , do nothing , retutn NULL */
 				return NULL;
@@ -280,8 +279,8 @@ static char* get_icu_value_internal( char* loc_name , char* tag_name, int* resul
 	if( fromParseLocale==1 ){
 		/* Handle singletons */
 		if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
-			if( strlen(loc_name)>1 && (isIDPrefix(loc_name) ==1 ) ){
-				return loc_name;
+			if( strlen(loc_name)>1 && isIDPrefix(loc_name) ){
+				return estrdup(loc_name);
 			}
 		}

@@ -498,8 +497,16 @@ static void get_icu_disp_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAME
 		RETURN_FALSE;
 	}

+    if(loc_name_len > ULOC_FULLNAME_CAPACITY) {
+        /* See bug 67397: overlong locale names cause trouble in uloc_getDisplayName */
+		spprintf(&msg , 0, "locale_get_display_%s : name too long", tag_name );
+		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,  msg , 1 TSRMLS_CC );
+		efree(msg);
+		RETURN_FALSE;
+    }
+
 	if(loc_name_len == 0) {
-	loc_name = INTL_G(default_locale);
+        loc_name = INTL_G(default_locale);
 	}

 	if( strcmp(tag_name, DISP_NAME) != 0 ){
@@ -10,6 +10,7 @@ var_dump(locale_get_display_name(str_repeat("a", 300), null));
 var_dump(locale_get_display_name(str_repeat("a", 512), null));
 var_dump(locale_get_display_name(str_repeat("a", 600), null));
 --EXPECT--
-string(300) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-string(512) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-string(600) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+bool(false)
+bool(false)
+bool(false)
+
@@ -0,0 +1,21 @@
+--TEST--
+Bug #67397 (Buffer overflow in locale_get_display_name->uloc_getDisplayName (libicu 4.8.1))
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+
+function ut_main()
+{
+    $ret = var_export(ut_loc_get_display_name(str_repeat('*', 256), 'en_us'), true);
+    $ret .= "\n";
+    $ret .= var_export(intl_get_error_message(), true);
+    return $ret;
+}
+
+include_once( 'ut_common.inc' );
+ut_run();
+?>
+--EXPECTF--
+false
+'locale_get_display_name : name too long: U_ILLEGAL_ARGUMENT_ERROR'
@@ -63,7 +63,8 @@ function ut_main()
 //Some Invalid Tags:
        'de-419-DE',
        'a-DE',
-        'ar-a-aaa-b-bbb-a-ccc'
+        'ar-a-aaa-b-bbb-a-ccc',
+	'x-AAAAAA',
    );


@@ -201,3 +202,6 @@ No values found from Locale parsing.
 ---------------------
 ar-a-aaa-b-bbb-a-ccc:
 language : 'ar' ,
+---------------------
+x-AAAAAA:
+private0 : 'AAAAAA' ,
@@ -1317,7 +1317,7 @@ PHP_FUNCTION(odbc_execute)
 			if (Z_STRLEN_PP(tmp) > 2 &&
 				Z_STRVAL_PP(tmp)[0] == '\'' &&
 				Z_STRVAL_PP(tmp)[Z_STRLEN_PP(tmp) - 1] == '\'') {
-				if (strlen(tmp) != Z_STRLEN_PP(tmp)) {
+				if (strlen(Z_STRVAL_PP(tmp)) != Z_STRLEN_PP(tmp)) {
 					RETURN_FALSE;
 				}

@@ -649,7 +649,7 @@ static time_t asn1_time_to_time_t(ASN1_UTCTIME * timestr TSRMLS_DC) /* {{{ */
 		return (time_t)-1;
 	}

-	if (ASN1_STRING_length(timestr) != strlen(ASN1_STRING_data(timestr))) {
+	if (ASN1_STRING_length(timestr) != strlen((char*)ASN1_STRING_data(timestr))) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal length in timestamp");
 		return (time_t)-1;
 	}
@@ -765,13 +765,13 @@ static int add_oid_section(struct php_x509_request * req TSRMLS_DC) /* {{{ */
 			req->config_filename, req->var, req->req_config TSRMLS_CC) == FAILURE) return FAILURE

 #define SET_OPTIONAL_STRING_ARG(key, varname, defval)	\
-	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS) \
+	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING) \
 		varname = Z_STRVAL_PP(item); \
 	else \
 		varname = defval

 #define SET_OPTIONAL_LONG_ARG(key, varname, defval)	\
-	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS) \
+	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_LONG) \
 		varname = Z_LVAL_PP(item); \
 	else \
 		varname = defval
@@ -813,7 +813,7 @@ static int php_openssl_parse_config(struct php_x509_request * req, zval * option

 	SET_OPTIONAL_LONG_ARG("private_key_type", req->priv_key_type, OPENSSL_KEYTYPE_DEFAULT);

-	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), "encrypt_key", sizeof("encrypt_key"), (void**)&item) == SUCCESS) {
+	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), "encrypt_key", sizeof("encrypt_key"), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_BOOL) {
 		req->priv_key_encrypt = Z_BVAL_PP(item);
 	} else {
 		str = CONF_get_string(req->req_config, req->section_name, "encrypt_rsa_key");
@@ -1889,7 +1889,7 @@ PHP_FUNCTION(openssl_pkcs12_export_to_file)
 	}

 	/* parse extra config from args array, promote this to an extra function */
-	if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS)
+	if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING)
 		friendly_name = Z_STRVAL_PP(item);
 	/* certpbe (default RC2-40)
 	   keypbe (default 3DES)
@@ -1967,7 +1967,7 @@ PHP_FUNCTION(openssl_pkcs12_export)
 	}

 	/* parse extra config from args array, promote this to an extra function */
-	if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS)
+	if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING)
 		friendly_name = Z_STRVAL_PP(item);

 	if (args && zend_hash_find(Z_ARRVAL_P(args), "extracerts", sizeof("extracerts"), (void**)&item) == SUCCESS)
@@ -0,0 +1,12 @@
+--TEST--
+Options type checks
+--SKIPIF--
+<?php if (!extension_loaded("openssl")) print "skip"; ?>
+--FILE--
+<?php
+$x = openssl_pkey_new();
+$csr = openssl_csr_new(["countryName" => "DE"], $x, ["x509_extensions" => 0xDEADBEEF]);
+?>
+DONE
+--EXPECT--
+DONE
@@ -362,7 +362,8 @@ PHPAPI char *php_session_create_id(PS_CREATE_SID_ARGS) /* {{{ */

 	if (zend_hash_find(&EG(symbol_table), "_SERVER", sizeof("_SERVER"), (void **) &array) == SUCCESS &&
 		Z_TYPE_PP(array) == IS_ARRAY &&
-		zend_hash_find(Z_ARRVAL_PP(array), "REMOTE_ADDR", sizeof("REMOTE_ADDR"), (void **) &token) == SUCCESS
+		zend_hash_find(Z_ARRVAL_PP(array), "REMOTE_ADDR", sizeof("REMOTE_ADDR"), (void **) &token) == SUCCESS &&
+		Z_TYPE_PP(token) == IS_STRING
 	) {
 		remote_addr = Z_STRVAL_PP(token);
 	}
@@ -408,7 +408,7 @@ static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval
 	/* When in a write context,
 	 * ZE has to be fooled into thinking this is in a reference set
 	 * by separating (if necessary) and returning as an is_ref=1 zval (even if refcount == 1) */
-	if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && !Z_ISREF_PP(ret)) {
+	if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && !Z_ISREF_PP(ret) && ret != &EG(uninitialized_zval_ptr)) {
 		if (Z_REFCOUNT_PP(ret) > 1) {
 			zval *newval;

@@ -1816,7 +1816,7 @@ void spl_array_unserialize_helper(spl_array_object *intern, const unsigned char
 	++p;

 	ALLOC_INIT_ZVAL(pmembers);
-	if (!php_var_unserialize(&pmembers, &p, s + buf_len, var_hash_p TSRMLS_CC)) {
+	if (!php_var_unserialize(&pmembers, &p, s + buf_len, var_hash_p TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) {
 		zval_ptr_dtor(&pmembers);
 		goto outexcept;
 	}
@@ -819,6 +819,7 @@ SPL_METHOD(DirectoryIterator, seek)
 		zend_call_method_with_0_params(&this_ptr, Z_OBJCE_P(getThis()), &intern->u.dir.func_rewind, "rewind", &retval);
 		if (retval) {
 			zval_ptr_dtor(&retval);
+			retval = NULL;
 		}
 	}

@@ -828,6 +829,7 @@ SPL_METHOD(DirectoryIterator, seek)
 		if (retval) {
 			valid = zend_is_true(retval);
 			zval_ptr_dtor(&retval);
+			retval = NULL;
 		}
 		if (!valid) {
 			break;
@@ -116,7 +116,7 @@ static void spl_fixedarray_resize(spl_fixedarray *array, long size TSRMLS_DC) /*
 			array->elements = NULL;
 		}
 	} else if (size > array->size) {
-		array->elements = erealloc(array->elements, sizeof(zval *) * size);
+		array->elements = safe_erealloc(array->elements, size, sizeof(zval *), 0);
 		memset(array->elements + array->size, '\0', sizeof(zval *) * (size - array->size));
 	} else { /* size < array->size */
 		long i;
@@ -858,6 +858,8 @@ static union _zend_function *spl_recursive_it_get_method(zval **object_ptr, char
 				*object_ptr = zobj;
 				function_handler = Z_OBJ_HT_P(*object_ptr)->get_method(object_ptr, method, method_len TSRMLS_CC);
 			}
+		} else {
+			*object_ptr = zobj;
 		}
 	}
 	return function_handler;
@@ -801,7 +801,7 @@ SPL_METHOD(SplObjectStorage, unserialize)
 	++p;

 	ALLOC_INIT_ZVAL(pmembers);
-	if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC)) {
+	if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) {
 		zval_ptr_dtor(&pmembers);
 		goto outexcept;
 	}
@@ -5,8 +5,9 @@ SPL: Test that serialized blob contains unique elements (CVE-2010-2225)

 $badblobs = array(
 'x:i:2;i:0;,i:1;;i:0;,i:2;;m:a:0:{}',
-'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};R:1;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}',
-'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};r:1;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}',
+'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};R:2;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}',
+'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};r:2;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}',
+'x:i:1;O:8:"stdClass":0:{},N;;m:s:40:"1234567890123456789012345678901234567890"',
 );
 foreach($badblobs as $blob) {
 try {
@@ -17,6 +18,7 @@ try {
 	echo $e->getMessage()."\n";
 }
 }
+echo "DONE\n";
 --EXPECTF--
 Error at offset 6 of 34 bytes
 Error at offset 46 of 89 bytes
@@ -42,4 +44,5 @@ object(SplObjectStorage)#2 (1) {
    }
  }
 }
-
+Error at offset 79 of 78 bytes
+DONE
@@ -0,0 +1,25 @@
+--TEST--
+Bug #66127 (Segmentation fault with ArrayObject unset)
+--INI--
+error_reporting = E_ALL & ~E_NOTICE
+--FILE--
+<?php
+function crash()
+{
+    set_error_handler(function () {});
+    $var = 1;
+    trigger_error('error');
+    $var2 = $var;
+    $var3 = $var;
+    trigger_error('error');
+}
+
+$items = new ArrayObject();
+
+unset($items[0]);
+unset($items[0][0]);
+crash();
+echo "Worked!\n";
+?>
+--EXPECT--
+Worked!
@@ -0,0 +1,13 @@
+--TEST--
+Bug #67247 (spl_fixedarray_resize integer overflow)
+--FILE--
+<?php
+$ar = new SplFixedArray(1);
+echo "size: ".$ar->getSize()."\n";
+$ar->setSize((PHP_INT_SIZE==8)?0x2000000000000001:0x40000001);
+echo "size: ".$ar->getSize()."\n";
+?>
+--EXPECTF--
+size: 1
+
+Fatal error: Possible integer overflow in memory allocation (%d * %d + 0) in %s on line %d 
@@ -0,0 +1,28 @@
+--TEST--
+Bug #67359 (Segfault in recursiveDirectoryIterator)
+--FILE--
+<?php
+try
+{
+	$rdi = new recursiveDirectoryIterator(dirname(__FILE__),  FilesystemIterator::SKIP_DOTS | FilesystemIterator::UNIX_PATHS);
+	$it = new recursiveIteratorIterator( $rdi );
+	$it->seek(1);
+	while( $it->valid())
+	{
+		if( $it->isFile() )
+		{
+			$it->current();
+		}
+
+		$it->next();
+	}
+
+	$it->current();
+}
+catch(Exception $e)
+{
+}
+echo "okey"
+?>
+--EXPECTF--
+okey
@@ -12,4 +12,6 @@ $a[] = &$tmp;
 echo "Done\n";
 ?>
 --EXPECTF--	
+Notice: Indirect modification of overloaded element of ArrayIterator has no effect in %s on line %d
+
 Fatal error: Cannot assign by reference to overloaded object in %s on line %d
@@ -4050,39 +4050,42 @@ PHP_FUNCTION(putenv)
 {
 	char *setting;
 	int setting_len;
+	char *p, **env;
+	putenv_entry pe;
+#ifdef PHP_WIN32
+	char *value = NULL;
+	int equals = 0;
+	int error_code;
+#endif

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &setting, &setting_len) == FAILURE) {
 		return;
 	}
+    
+    if(setting_len == 0 || setting[0] == '=') {
+    	php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter syntax");
+    	RETURN_FALSE;
+    }

-	if (setting_len) {
-		char *p, **env;
-		putenv_entry pe;
+	pe.putenv_string = estrndup(setting, setting_len);
+	pe.key = estrndup(setting, setting_len);
+	if ((p = strchr(pe.key, '='))) {	/* nullify the '=' if there is one */
+		*p = '\0';
 #ifdef PHP_WIN32
-		char *value = NULL;
-		int equals = 0;
-		int error_code;
+		equals = 1;
 #endif
+	}

-		pe.putenv_string = estrndup(setting, setting_len);
-		pe.key = estrndup(setting, setting_len);
-		if ((p = strchr(pe.key, '='))) {	/* nullify the '=' if there is one */
-			*p = '\0';
+	pe.key_len = strlen(pe.key);
 #ifdef PHP_WIN32
-			equals = 1;
-#endif
-		}
-
-		pe.key_len = strlen(pe.key);
-#ifdef PHP_WIN32
-		if (equals) {
-			if (pe.key_len < setting_len - 1) {
-				value = p + 1;
-			} else {
-				/* empty string*/
-				value = p;
-			}
+	if (equals) {
+		if (pe.key_len < setting_len - 1) {
+			value = p + 1;
+		} else {
+			/* empty string*/
+			value = p;
 		}
+	}
 #endif

 		if (PG(safe_mode)) {
@@ -4120,55 +4123,51 @@ PHP_FUNCTION(putenv)

 		zend_hash_del(&BG(putenv_ht), pe.key, pe.key_len+1);

-		/* find previous value */
-		pe.previous_value = NULL;
-		for (env = environ; env != NULL && *env != NULL; env++) {
-			if (!strncmp(*env, pe.key, pe.key_len) && (*env)[pe.key_len] == '=') {	/* found it */
+	/* find previous value */
+	pe.previous_value = NULL;
+	for (env = environ; env != NULL && *env != NULL; env++) {
+		if (!strncmp(*env, pe.key, pe.key_len) && (*env)[pe.key_len] == '=') {	/* found it */
 #if defined(PHP_WIN32)
-				/* must copy previous value because MSVCRT's putenv can free the string without notice */
-				pe.previous_value = estrdup(*env);
+			/* must copy previous value because MSVCRT's putenv can free the string without notice */
+			pe.previous_value = estrdup(*env);
 #else
-				pe.previous_value = *env;
+			pe.previous_value = *env;
 #endif
-				break;
-			}
-		}
-
-#if HAVE_UNSETENV
-		if (!p) { /* no '=' means we want to unset it */
-			unsetenv(pe.putenv_string);
-		}
-		if (!p || putenv(pe.putenv_string) == 0) { /* success */
-#else
-# ifndef PHP_WIN32
-		if (putenv(pe.putenv_string) == 0) { /* success */
-# else
-		error_code = SetEnvironmentVariable(pe.key, value);
-#  if _MSC_VER < 1500
-		/* Yet another VC6 bug, unset may return env not found */
-		if (error_code != 0 || 
-			(error_code == 0 && GetLastError() == ERROR_ENVVAR_NOT_FOUND)) {
-#  else
-		if (error_code != 0) { /* success */
-#  endif
-# endif
-#endif
-			zend_hash_add(&BG(putenv_ht), pe.key, pe.key_len + 1, (void **) &pe, sizeof(putenv_entry), NULL);
-#ifdef HAVE_TZSET
-			if (!strncmp(pe.key, "TZ", pe.key_len)) {
-				tzset();
-			}
-#endif
-			RETURN_TRUE;
-		} else {
-			efree(pe.putenv_string);
-			efree(pe.key);
-			RETURN_FALSE;
+			break;
 		}
 	}

-	php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter syntax");
-	RETURN_FALSE;
+#if HAVE_UNSETENV
+	if (!p) { /* no '=' means we want to unset it */
+		unsetenv(pe.putenv_string);
+	}
+	if (!p || putenv(pe.putenv_string) == 0) { /* success */
+#else
+# ifndef PHP_WIN32
+	if (putenv(pe.putenv_string) == 0) { /* success */
+# else
+	error_code = SetEnvironmentVariable(pe.key, value);
+#  if _MSC_VER < 1500
+	/* Yet another VC6 bug, unset may return env not found */
+	if (error_code != 0 || 
+		(error_code == 0 && GetLastError() == ERROR_ENVVAR_NOT_FOUND)) {
+#  else
+	if (error_code != 0) { /* success */
+#  endif
+# endif
+#endif
+		zend_hash_add(&BG(putenv_ht), pe.key, pe.key_len + 1, (void **) &pe, sizeof(putenv_entry), NULL);
+#ifdef HAVE_TZSET
+		if (!strncmp(pe.key, "TZ", pe.key_len)) {
+			tzset();
+		}
+#endif
+		RETURN_TRUE;
+	} else {
+		efree(pe.putenv_string);
+		efree(pe.key);
+		RETURN_FALSE;
+	}
 }
 /* }}} */
 #endif
@@ -507,6 +507,10 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
 				
 				while (ll < dlen) {
 					n = cp[ll];
+					if ((ll + n) >= dlen) {
+						// Invalid chunk length, truncate
+						n = dlen - (ll + 1);
+					}
 					memcpy(tp + ll , cp + ll + 1, n);
 					add_next_index_stringl(entries, cp + ll + 1, n, 1);
 					ll = ll + n + 1;
@@ -379,6 +379,7 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 	int alignment, currarg, adjusting, argnum, width, precision;
 	char *format, *result, padding;
 	int always_sign;
+	int format_len;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "+", &args, &argc) == FAILURE) {
 		return NULL;
@@ -417,11 +418,12 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 	
 	convert_to_string_ex(args[format_offset]);
 	format = Z_STRVAL_PP(args[format_offset]);
+	format_len = Z_STRLEN_PP(args[format_offset]);
 	result = emalloc(size);

 	currarg = 1;

-	while (inpos<Z_STRLEN_PP(args[format_offset])) {
+	while (inpos<format_len) {
 		int expprec = 0, multiuse = 0;
 		zval *tmp;

@@ -476,7 +478,7 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 						/* space padding, the default */
 					} else if (format[inpos] == '+') {
 						always_sign = 1;
-					} else if (format[inpos] == '\'') {
+					} else if (format[inpos] == '\'' && inpos+1<format_len) {
 						padding = format[++inpos];
 					} else {
 						PRINTF_DEBUG(("sprintf: end of modifiers\n"));
@@ -972,16 +972,16 @@ PHPAPI void php_print_info(int flag TSRMLS_DC)

 		php_info_print_table_start();
 		php_info_print_table_header(2, "Variable", "Value");
-		if (zend_hash_find(&EG(symbol_table), "PHP_SELF", sizeof("PHP_SELF"), (void **) &data) != FAILURE) {
+		if (zend_hash_find(&EG(symbol_table), "PHP_SELF", sizeof("PHP_SELF"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
 			php_info_print_table_row(2, "PHP_SELF", Z_STRVAL_PP(data));
 		}
-		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_TYPE", sizeof("PHP_AUTH_TYPE"), (void **) &data) != FAILURE) {
+		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_TYPE", sizeof("PHP_AUTH_TYPE"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
 			php_info_print_table_row(2, "PHP_AUTH_TYPE", Z_STRVAL_PP(data));
 		}
-		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_USER", sizeof("PHP_AUTH_USER"), (void **) &data) != FAILURE) {
+		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_USER", sizeof("PHP_AUTH_USER"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
 			php_info_print_table_row(2, "PHP_AUTH_USER", Z_STRVAL_PP(data));
 		}
-		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_PW", sizeof("PHP_AUTH_PW"), (void **) &data) != FAILURE) {
+		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_PW", sizeof("PHP_AUTH_PW"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
 			php_info_print_table_row(2, "PHP_AUTH_PW", Z_STRVAL_PP(data));
 		}
 		php_print_gpcse_array("_REQUEST", sizeof("_REQUEST")-1 TSRMLS_CC);
@@ -335,6 +335,9 @@ PHP_FUNCTION(iptcparse)
 		recnum = buffer[ inx++ ];

 		if (buffer[ inx ] & (unsigned char) 0x80) { /* long tag */
+            if((inx+6) >= str_len) {
+                break;
+            }
 			len = (((long) buffer[ inx + 2 ]) << 24) + (((long) buffer[ inx + 3 ]) << 16) + 
 				  (((long) buffer[ inx + 4 ]) <<  8) + (((long) buffer[ inx + 5 ]));
 			inx += 6;
@@ -0,0 +1,15 @@
+--TEST--
+phpinfo() Type Confusion Information Leak Vulnerability
+--FILE--
+<?php
+$PHP_SELF = 1;
+phpinfo(INFO_VARIABLES);
+
+?>
+==DONE==
+--EXPECTF--
+phpinfo()
+
+PHP Variables
+%A
+==DONE==
@@ -15,6 +15,9 @@ var_dump(getenv($var_name));
 var_dump(putenv($var_name));
 var_dump(getenv($var_name));

+var_dump(putenv("=123"));
+var_dump(putenv(""));
+
 echo "Done\n";
 ?>
 --EXPECTF--	
@@ -25,4 +28,10 @@ bool(true)
 string(0) ""
 bool(true)
 bool(false)
+
+Warning: putenv(): Invalid parameter syntax in %s on line %d
+bool(false)
+
+Warning: putenv(): Invalid parameter syntax in %s on line %d
+bool(false)
 Done
@@ -0,0 +1,8 @@
+--TEST--
+Bug #67250 (iptcparse out-of-bounds read)
+--FILE--
+<?php
+var_dump(iptcparse("\x1C\x02_\x80___"));
+?>
+--EXPECT--
+bool(false)
@@ -0,0 +1,8 @@
+--TEST--
+Bug #67249 (printf out-of-bounds read)
+--FILE--
+<?php
+var_dump(sprintf("%'", "foo"));
+?>
+--EXPECT--
+string(0) ""
@@ -0,0 +1,13 @@
+--TEST--
+Bug #67252 (convert_uudecode out-of-bounds read)
+--FILE--
+<?php
+
+$a = "M86%A86%A86%A86%A86%A86%A86%A86%A86%A86%A86%A86%A86%A86%A86%A"."\n"."a.";
+var_dump(convert_uudecode($a));
+
+?>
+--EXPECTF--	
+
+Warning: convert_uudecode(): The given parameter is not a valid uuencoded string in %s on line %d
+bool(false)
@@ -151,6 +151,9 @@ PHPAPI int php_uudecode(char *src, int src_len, char **dest) /* {{{ */
 		}

 		while (s < ee) {
+			if(s+4 > e) {
+				goto err;
+			} 
 			*p++ = PHP_UU_DEC(*s) << 2 | PHP_UU_DEC(*(s + 1)) >> 4;
 			*p++ = PHP_UU_DEC(*(s + 1)) << 4 | PHP_UU_DEC(*(s + 2)) >> 2;
 			*p++ = PHP_UU_DEC(*(s + 2)) << 6 | PHP_UU_DEC(*(s + 3));
@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 3
 #define PHP_RELEASE_VERSION 29
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.3.29-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.3.29"
 #define PHP_VERSION_ID 50329
@@ -1956,9 +1956,9 @@ consult the installation file that came with this distribution, or visit \n\
 								SG(request_info).no_headers = 1;
 							}
 #if ZEND_DEBUG
-							php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
+							php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
 #else
-							php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
+							php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
 #endif
 							php_request_shutdown((void *) 0);
 							fcgi_shutdown();
@@ -1,4 +1,4 @@
-.TH PHP 1 "2013" "The PHP Group" "Scripting Language"
+.TH PHP 1 "2014" "The PHP Group" "Scripting Language"
 .SH NAME
 php \- PHP Command Line Interface 'CLI'
 .SH SYNOPSIS
@@ -425,7 +425,7 @@ contributors all around the world.
 .SH VERSION INFORMATION
 This manpage describes \fBphp\fP, version @PHP_VERSION@.
 .SH COPYRIGHT
-Copyright \(co 1997\-2013 The PHP Group
+Copyright \(co 1997\-2014 The PHP Group
 .LP
 This source file is subject to version 3.01 of the PHP license,
 that is bundled with this package in the file LICENSE, and is
@@ -826,7 +826,7 @@ int main(int argc, char *argv[])
 				}

 				request_started = 1;
-				php_printf("PHP %s (%s) (built: %s %s) %s\nCopyright (c) 1997-2013 The PHP Group\n%s",
+				php_printf("PHP %s (%s) (built: %s %s) %s\nCopyright (c) 1997-2014 The PHP Group\n%s",
 					PHP_VERSION, sapi_module.name, __DATE__, __TIME__,
 #if ZEND_DEBUG && defined(HAVE_GCOV)
 					"(DEBUG GCOV)",
@@ -1721,9 +1721,9 @@ int main(int argc, char *argv[])
 				SG(request_info).no_headers = 1;

 #if ZEND_DEBUG
-				php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__,        __TIME__, get_zend_version());
+				php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__,        __TIME__, get_zend_version());
 #else
-				php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__,      get_zend_version());
+				php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__,      get_zend_version());
 #endif
 				php_request_shutdown((void *) 0);
 				fcgi_shutdown();
@@ -35,7 +35,7 @@ int fpm_unix_resolve_socket_premissions(struct fpm_worker_pool_s *wp) /* {{{ */
 	/* uninitialized */
 	wp->socket_uid = -1;
 	wp->socket_gid = -1;
-	wp->socket_mode = 0666;
+	wp->socket_mode = 0660;

 	if (!c) {
 		return 0;
@@ -158,10 +158,10 @@ listen = 127.0.0.1:9000
 ; permissions must be set in order to allow connections from a web server. Many
 ; BSD-derived systems allow connections regardless of permissions. 
 ; Default Values: user and group are set as the running user
-;                 mode is set to 0666
+;                 mode is set to 0660
 ;listen.owner = @php_fpm_user@
 ;listen.group = @php_fpm_group@
-;listen.mode = 0666
+;listen.mode = 0660
 
 ; List of ipv4 addresses of FastCGI clients which are allowed to connect.
 ; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
@@ -719,9 +719,9 @@ static int cli_main( int argc, char * argv[] )
            case 'v':
                if (php_request_startup(TSRMLS_C) != FAILURE) {
 #if ZEND_DEBUG
-                    php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
+                    php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
 #else
-                    php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
+                    php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
 #endif
 #ifdef PHP_OUTPUT_NEWAPI
                    php_output_end_all(TSRMLS_C);
@@ -1111,7 +1111,7 @@ int main(int argc, char *argv[])
 				}
 				SG(headers_sent) = 1;
 				SG(request_info).no_headers = 1;
-				php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
+				php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
 				php_end_ob_buffers(1 TSRMLS_CC);
 				exit(1);
 				break;
@@ -65,7 +65,7 @@ BEGIN
 #endif
            VALUE "FileVersion", EXT_VERSION
            VALUE "InternalName", INTERNAL_NAME
-            VALUE "LegalCopyright", "Copyright © 1997-2013 The PHP Group"
+            VALUE "LegalCopyright", "Copyright © 1997-2014 The PHP Group"
            VALUE "LegalTrademarks", "PHP"
            VALUE "OriginalFilename", FILE_NAME
            VALUE "ProductName", "PHP"
Author	SHA1	Message	Date
Johannes Schlüter	babeca356b	It's 2014 already, fix copyright year where user visible Left out all file headers	2014-08-13 21:22:50 +02:00
Johannes Schlüter	1847cf10c1	PHP 5.3.29	2014-08-13 18:36:10 +02:00
Johannes Schlüter	990ecc12fc	PHP 5.3.29RC1	2014-07-31 15:40:51 +02:00
Stanislav Malyshev	0fe07a0e74	Fix missing type checks in various functions	2014-07-31 15:36:24 +02:00
Stanislav Malyshev	1ffb7fddc2	update NEWS	2014-07-18 16:49:00 -07:00
Stanislav Malyshev	c74efe1b2e	Fix bug #67492 : unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion Conflicts: ext/spl/spl_array.c ext/spl/tests/SplObjectStorage_unserialize_bad.phpt	2014-07-18 16:31:59 -07:00
Xinchen Hui	b5051ff939	Fixed bug #67359 (Segfault in recursiveDirectoryIterator)	2014-07-18 16:28:58 -07:00
Stanislav Malyshev	e2ba5c7987	Fix bug #66127 (Segmentation fault with ArrayObject unset)	2014-07-18 16:28:16 -07:00
Stanislav Malyshev	8e9777a1f1	Fix test - because of big #67397 we don't allow overlong locales anymore	2014-07-18 16:27:11 -07:00
Stanislav Malyshev	e644aad3f9	Fix bug #67397 (Buffer overflow in locale_get_display_name->uloc_getDisplayName (libicu 4.8.1))	2014-07-18 16:26:51 -07:00
Stanislav Malyshev	8ab4e2e90d	Fix bug #67349 : Locale::parseLocale Double Free	2014-07-18 16:26:05 -07:00
Stanislav Malyshev	b512adf78d	Fixed bug #67399 (putenv with empty variable may lead to crash) Conflicts: ext/standard/basic_functions.c	2014-07-18 16:24:54 -07:00
Remi Collet	2fe5bcbeb5	Fixed Bug #67413 fileinfo: cdf_read_property_info insufficient boundary chec Upstream: https://github.com/file/file/commit/93e063ee374b6a75729df9e7201fb511e47e259d Adapted for C standard.	2014-07-18 16:21:01 -07:00
Remi Collet	892def5f12	Bug #67412 fileinfo: cdf_count_chain insufficient boundary check Upstream: https://github.com/file/file/commit/40bade80cbe2af1d0b2cd0420cebd5d5905a2382	2014-07-18 16:20:19 -07:00
Remi Collet	8d1d038509	Fixed Bug #67411 fileinfo: cdf_check_stream_offset insufficient boundary check Upstream: https://github.com/file/file/commit/36fadd29849b8087af9f4586f89dbf74ea45be67 Conflicts: ext/fileinfo/libmagic/cdf.c	2014-07-18 16:19:30 -07:00
Remi Collet	6bd5a06894	Fixed Bug #67410 fileinfo: mconvert incorrect handling of truncated pascal string size Upstream https://github.com/file/file/commit/27a14bc7ba285a0a5ebfdb55e54001aa11932b08	2014-07-18 16:17:36 -07:00
Stanislav Malyshev	ec002bd837	Fix bug #67498 - phpinfo() Type Confusion Information Leak Vulnerability	2014-07-18 16:14:42 -07:00
Remi Collet	52de149ebc	Fix bug #67326 fileinfo: cdf_read_short_sector insufficient boundary check Upstream fix https://github.com/file/file/commit/6d209c1c489457397a5763bca4b28e43aac90391.patch Only revelant part applied	2014-07-18 16:13:07 -07:00
Stanislav Malyshev	2326401fc1	fix bug #67253 : timelib_meridian_with_check out-of-bounds read Conflicts: ext/date/lib/parse_date.c	2014-07-18 16:11:54 -07:00
Stanislav Malyshev	7f527897fe	Fix bug #67252 : convert_uudecode out-of-bounds read	2014-07-18 16:05:52 -07:00
Stanislav Malyshev	d4b67896ec	Fix bug #67250 (iptcparse out-of-bounds read)	2014-07-18 16:02:52 -07:00
Stanislav Malyshev	84605098bc	Fix bug #67247 spl_fixedarray_resize integer overflow	2014-07-18 15:59:59 -07:00
Stanislav Malyshev	ee1ab62763	Fix bug #67328 (fileinfo: numerous file_printf calls resulting in performance degradation) Upstream patch: https://github.com/file/file/commit/b8acc83781d5a24cc5101e525d15efe0482c280d	2014-07-18 15:52:00 -07:00
Stanislav Malyshev	d77ea459bd	Fix bug #67327 : fileinfo: CDF infinite loop in nelements DoS Upstream fix: https://github.com/file/file/commit/f97486ef5dc3e8735440edc4fc8808c63e1a3ef0	2014-07-18 15:50:58 -07:00
Anatol Belski	44be7b7f27	backport this piece from 5.6, related to the #66307 fix Conflicts: ext/fileinfo/libmagic/readcdf.c	2014-07-18 15:50:04 -07:00
Anatol Belski	0335d2ef3e	Fixed bug #66307 Fileinfo crashes with powerpoint files Conflicts: ext/fileinfo/libmagic/readcdf.c ext/fileinfo/tests/finfo_file_002.phpt	2014-07-18 15:48:18 -07:00
Remi Collet	a0bb3fd679	Fixed bug #66060 (Heap buffer over-read in DateInterval) Conflicts: ext/date/lib/parse_iso_intervals.c	2014-07-18 15:39:37 -07:00
Stanislav Malyshev	eca037a51d	Fix bug #65873 - Integer overflow in exif_read_data()	2014-07-18 15:37:15 -07:00
Xinchen Hui	f3230e3522	let make test report the run-test result	2014-07-18 15:33:59 -07:00
Stanislav Malyshev	3c328f0984	Fix bug #67251 - date_parse_from_format out-of-bounds read Conflicts: ext/date/lib/parse_date.c ext/date/lib/parse_date.re	2014-06-15 00:33:24 -07:00
Stanislav Malyshev	d780c2a673	Fix bug #67249 : printf out-of-bounds read	2014-06-13 16:43:56 -07:00
Sara Golemon	d400b74296	Fix potential segfault in dns_get_record() If the remote sends us a packet with a malformed TXT record, we could end up trying to over-consume the packet and wander off into overruns.	2014-06-13 16:42:55 -07:00
Remi Collet	08334293f8	Fix bug #67390 insecure temporary file use in the configure script	2014-06-13 16:41:13 -07:00
Stanislav Malyshev	adc070ca99	fix typo in ODBC code	2014-05-18 23:42:30 -07:00
Stanislav Malyshev	8a22540a95	Fix bug #67060 : use default mode of 660	2014-05-11 23:32:35 -07:00