5.4.38

Port for for bug #68552
Fix bug #68942 (Use after free vulnerability in unserialize() with DateTimeZone)
2026-11-14 04:30:50 +00:00 · 2015-02-17 07:27:21 +01:00 · 2015-02-17 06:53:02 +01:00 · 2015-02-17 06:43:51 +01:00 · 2015-02-17 01:14:05 -02:00 · 2015-02-17 00:23:47 -02:00
51 changed files with 617 additions and 1987 deletions
@@ -1,5 +1,60 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+19 Feb 2015 PHP 5.4.38
+
+- Core:
+  . Removed support for multi-line headers, as the are deprecated by RFC 7230.
+    (Stas)
+  . Added NULL byte protection to exec, system and passthru. (Yasuo)
+  . Fixed bug #68925 (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname
+    buffer overflow). (Stas)
+  . Fixed bug #67827 (broken detection of system crypt sha256/sha512 support).
+    (ncopa at alpinelinux dot org)  
+  . Fixed bug #68942 (Use after free vulnerability in unserialize() with
+    DateTimeZone). (Stas)
+  
+- Enchant: 
+  . Fixed bug #6855 (heap buffer overflow in enchant_broker_request_dict()).
+    (Antony)
+
+- SOAP:
+  . Fixed bug #67427 (SoapServer cannot handle large messages)
+    (brandt at docoloc dot de)
+
+22 Jan 2015 PHP 5.4.37
+- Core:
+  . Fixed bug #68710 (Use After Free Vulnerability in PHP's unserialize()).
+    (CVE-2015-0231) (Stefan Esser)
+
+- CGI:
+  . Fixed bug #68618 (out of bounds read crashes php-cgi). (CVE-2014-9427)
+    (Stas)
+
+- EXIF:
+  . Fixed bug #68799: Free called on unitialized pointer. (CVE-2015-0232) 
+    (Stas)
+
+- Fileinfo:
+  . Removed readelf.c and related code from libmagic sources
+    (Remi, Anatol)
+  . Fixed bug #68735 (fileinfo out-of-bounds memory access).
+    (Anatol)
+
+- OpenSSL:
+  . Fixed bug #55618 (use case-insensitive cert name matching).
+    (Daniel Lowrey)
+
+18 Dec 2014 PHP 5.4.36
+
+- Core:
+  . Upgraded crypt_blowfish to version 1.3. (Leigh)
+  . Fixed bug #68545 (NULL pointer dereference in unserialize.c). (Anatol)
+  . Fixed bug #68594 (Use after free vulnerability in unserialize()).
+    (CVE-2014-8142) (Stefan Esser)
+
+- Mcrypt:
+  . Fixed possible read after end of buffer and use after free. (Dmitry)
+
 13 Nov 2014 PHP 5.4.35

 - Core:
@@ -88,6 +143,9 @@ PHP                                                                        NEWS
  . Fixed bug #67730 (Null byte injection possible with imagexxx functions).
    (CVE-2014-5120) (Ryan Mauger)

+- LiteSpeed:
+  . Updated LiteSpeed SAPI code from V5.5 to V6.6 (George Wang)
+
 - Network:
  . Fixed bug #67717 (segfault in dns_get_record). (CVE-2014-3597) (Remi)

@@ -183,11 +183,11 @@ last commit id to web/php.git, then, mirrors will now sync
 Getting the stable release announced
 ------------------------------------

-1. Run the bumpRelease script for phpweb on your local checkout
+1. Update phpweb/include/releases.inc with the old release info
+  (updates the download archives)

- a. ``php bin/bumpRelease 5`` to create the release file (releases/x_y_z.php)
-    The release announcement file should list in detail security fixes and
-    changes in behavior (whether due to a bug fix or not).
+ a. You can run ``php bin/bumpRelease 5`` if you are making a release for the
+    highest branch, otherwise you have to do this manually, see point 1.b

 b. In case multiple PHP minor versions are in active development you have
    to manually copy the old information to include/releases.inc
@@ -207,8 +207,9 @@ Getting the stable release announced

 f. if the windows builds aren't ready yet prefix the "windows" key with a dot (".windows")

-3. Update phpweb/include/releases.php with the old release info
-  (updates the download archives)
+3. Create the release file (releases/x_y_z.php)
+   Usually we use the same content as for point 6, but included in php template
+   instead of the release xml.

 4. Update php-qa/include/release-qa.php and add the next version as an QARELEASE
   (prepare for next RC)
@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=4
-PHP_RELEASE_VERSION=35
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=38
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -10,7 +10,7 @@
   | http://www.php.net/license/3_01.txt                                  |
   | If you did not receive a copy of the PHP license and are unable to   |
   | obtain it through the world-wide-web, please send a note to          |
-   | license@php.net so we can mail you 6 copy immediately.               |
+   | license@php.net so we can mail you a copy immediately.               |
   +----------------------------------------------------------------------+
   | Author: Sterling Hughes <sterling@php.net>                           |
   +----------------------------------------------------------------------+
@@ -0,0 +1,7 @@
+<?php
+    if (!extension_loaded("curl")) exit("skip curl extension not loaded");
+    if(false === getenv('PHP_CURL_HTTP_REMOTE_SERVER')) {
+        if (php_sapi_name() != "cli") {
+                die("skip PHP_CURL_HTTP_REMOTE_SERVER env variable is not defined");
+        }
+    }
@@ -2575,12 +2575,9 @@ static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht
 	timelib_tzinfo   *tzi;
 	php_timezone_obj *tzobj;

-	if (zend_hash_find(myht, "date", 5, (void**) &z_date) == SUCCESS) {
-		convert_to_string(*z_date);
-		if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS) {
-			convert_to_long(*z_timezone_type);
-			if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS) {
-				convert_to_string(*z_timezone);
+	if (zend_hash_find(myht, "date", 5, (void**) &z_date) == SUCCESS && Z_TYPE_PP(z_date) == IS_STRING) {
+		if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS && Z_TYPE_PP(z_timezone_type) == IS_LONG) {
+			if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS && Z_TYPE_PP(z_timezone) == IS_STRING) {

 				switch (Z_LVAL_PP(z_timezone_type)) {
 					case TIMELIB_ZONETYPE_OFFSET:
@@ -2595,7 +2592,6 @@ static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht

 					case TIMELIB_ZONETYPE_ID: {
 						int ret;
-						convert_to_string(*z_timezone);

 						tzi = php_date_parse_tzfile(Z_STRVAL_PP(z_timezone), DATE_TIMEZONEDB TSRMLS_CC);

@@ -0,0 +1,9 @@
+--TEST--
+Bug #68942 (Use after free vulnerability in unserialize() with DateTime).
+--FILE--
+<?php
+$data = unserialize('a:2:{i:0;O:8:"DateTime":3:{s:4:"date";s:26:"2000-01-01 00:00:00.000000";s:13:"timezone_type";a:2:{i:0;i:1;i:1;i:2;}s:8:"timezone";s:1:"A";}i:1;R:5;}');
+var_dump($data);
+?>
+--EXPECTF--
+Fatal error: Invalid serialization data for DateTime object in %s/bug68942_2.php on line %d
@@ -550,13 +550,12 @@ PHP_FUNCTION(enchant_broker_request_dict)

 	d = enchant_broker_request_dict(pbroker->pbroker, (const char *)tag);
 	if (d) {
+		pos = pbroker->dictcnt++;
 		if (pbroker->dictcnt) {
 			pbroker->dict = (enchant_dict **)erealloc(pbroker->dict, sizeof(enchant_dict *) * pbroker->dictcnt);
-			pos = pbroker->dictcnt++;
 		} else {
 			pbroker->dict = (enchant_dict **)emalloc(sizeof(enchant_dict *));
 			pos = 0;
-			pbroker->dictcnt++;
 		}

 		dict = pbroker->dict[pos] = (enchant_dict *)emalloc(sizeof(enchant_dict));
@@ -607,14 +606,14 @@ PHP_FUNCTION(enchant_broker_request_pwl_dict)

 	d = enchant_broker_request_pwl_dict(pbroker->pbroker, (const char *)pwl);
 	if (d) {
+		pos = pbroker->dictcnt++;
 		if (pbroker->dictcnt) {
-			pos = pbroker->dictcnt++;
 			pbroker->dict = (enchant_dict **)erealloc(pbroker->dict, sizeof(enchant_dict *) * pbroker->dictcnt);
 		} else {
 			pbroker->dict = (enchant_dict **)emalloc(sizeof(enchant_dict *));
 			pos = 0;
-			pbroker->dictcnt++;
 		}
+
 		dict = pbroker->dict[pos] = (enchant_dict *)emalloc(sizeof(enchant_dict));
 		dict->id = pos;
 		dict->pbroker = pbroker;
@@ -2702,7 +2702,7 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 static int exif_process_unicode(image_info_type *ImageInfo, xp_field_type *xp_field, int tag, char *szValuePtr, int ByteCount TSRMLS_DC)
 {
 	xp_field->tag = tag;	
-	
+	xp_field->value = NULL;
 	/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
 	if (zend_multibyte_encoding_converter(
 			(unsigned char**)&xp_field->value, 
@@ -0,0 +1,63 @@
+--TEST--
+Bug #68799 (Free called on unitialized pointer)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+/*
+* Pollute the heap. Helps trigger bug. Sometimes not needed.
+*/
+class A {
+    function __construct() {
+        $a = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa';
+        $this->a = $a . $a . $a . $a . $a . $a;
+    }
+};
+
+function doStuff ($limit) {
+
+    $a = new A;
+
+    $b = array();
+    for ($i = 0; $i < $limit; $i++) {
+        $b[$i] = clone $a;
+    }
+
+    unset($a);
+
+    gc_collect_cycles();
+}
+
+$iterations = 3;
+
+doStuff($iterations);
+doStuff($iterations);
+
+gc_collect_cycles();
+
+print_r(exif_read_data(__DIR__.'/bug68799.jpg'));
+
+?>
+--EXPECTF--
+Array
+(
+    [FileName] => bug68799.jpg
+    [FileDateTime] => %d
+    [FileSize] => 735
+    [FileType] => 2
+    [MimeType] => image/jpeg
+    [SectionsFound] => ANY_TAG, IFD0, WINXP
+    [COMPUTED] => Array
+        (
+            [html] => width="1" height="1"
+            [Height] => 1
+            [Width] => 1
+            [IsColor] => 1
+            [ByteOrderMotorola] => 1
+        )
+
+    [XResolution] => 96/1
+    [YResolution] => 96/1
+    [ResolutionUnit] => 2
+    [Author] => 
+)
@@ -11,7 +11,7 @@ if test "$PHP_FILEINFO" != "no"; then
    libmagic/cdf.c libmagic/cdf_time.c libmagic/compress.c \
    libmagic/encoding.c libmagic/fsmagic.c libmagic/funcs.c \
    libmagic/is_tar.c libmagic/magic.c libmagic/print.c \
-    libmagic/readcdf.c libmagic/readelf.c libmagic/softmagic.c"
+    libmagic/readcdf.c libmagic/softmagic.c"

  PHP_NEW_EXTENSION(fileinfo, fileinfo.c $libmagic_sources, $ext_shared,,-I@ext_srcdir@/libmagic)
  PHP_ADD_BUILD_DIR($ext_builddir/libmagic)
@@ -8,7 +8,7 @@ if (PHP_FILEINFO != 'no') {
 			cdf.c cdf_time.c compress.c \
 			encoding.c fsmagic.c funcs.c \
 			is_tar.c magic.c print.c \
-			readcdf.c readelf.c softmagic.c";
+			readcdf.c softmagic.c";

 	if (VCVERS < 1500) {
 		ADD_FLAG('CFLAGS', '/Zm1000');
@@ -1,6 +1,6 @@
 diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 --- libmagic.orig/apprentice.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/apprentice.c	Mon Apr 14 23:42:51 2014
+++ libmagic/apprentice.c	Sun Jan  4 17:02:29 2015
@@ -29,6 +29,8 @@
  * apprentice - make one pass through /etc/magic, learning its secrets.
  */
@@ -479,6 +479,15 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		return NULL;
 	}
 	return map;
+@@ -1233,7 +1269,7 @@
+ 		 * the sign extension must have happened.
+ 		 */
+ 		case FILE_BYTE:
+-			v = (char) v;
+			v = (signed char) v;
+ 			break;
+ 		case FILE_SHORT:
+ 		case FILE_BESHORT:
@@ -1500,7 +1536,7 @@
 		if (me->cont_count == me->max_count) {
 			struct magic *nm;
@@ -833,7 +842,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 	}
 diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
 --- libmagic.orig/ascmagic.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/ascmagic.c	Mon Apr 14 23:42:51 2014
+++ libmagic/ascmagic.c	Sun Jan  4 17:02:29 2015
@@ -139,7 +139,7 @@
 		/* malloc size is a conservative overestimate; could be
 		   improved, or at least realloced after conversion. */
@@ -872,7 +881,7 @@ diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
 }
 diff -u libmagic.orig/cdf.c libmagic/cdf.c
 --- libmagic.orig/cdf.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/cdf.c	Tue Jul  1 09:00:09 2014
+++ libmagic/cdf.c	Sun Jan  4 17:02:29 2015
@@ -43,7 +43,17 @@
 #include <err.h>
 #endif
@@ -955,7 +964,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 			errno = EFTYPE;
 			return (size_t)-1;
 		}
-@@ -796,7 +812,11 @@
+@@ -796,11 +812,15 @@
 	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
 		goto out;
 	for (i = 0; i < sh.sh_properties; i++) {
@@ -968,6 +977,11 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 		q = (const uint8_t *)(const void *)
 		    ((const char *)(const void *)p + ofs
 		    - 2 * sizeof(uint32_t));
+-		if (q > e) {
+		if (q < p || q > e) {
+ 			DPRINTF(("Ran of the end %p > %p\n", q, e));
+ 			goto out;
+ 		}
@@ -810,6 +830,10 @@
 		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
 		if (inp[i].pi_type & CDF_VECTOR) {
@@ -1056,7 +1070,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 			} else {
 diff -u libmagic.orig/cdf.h libmagic/cdf.h
 --- libmagic.orig/cdf.h	Wed Oct 31 18:03:01 2012
-+++ libmagic/cdf.h	Mon Apr 14 23:32:55 2014
+++ libmagic/cdf.h	Sun Jan  4 17:02:29 2015
@@ -35,10 +35,12 @@
 #ifndef _H_CDF_
 #define _H_CDF_
@@ -1099,7 +1113,7 @@ diff -u libmagic.orig/cdf.h libmagic/cdf.h
 void cdf_unpack_header(cdf_header_t *, char *);
 diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
 --- libmagic.orig/cdf_time.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/cdf_time.c	Mon Apr 14 23:32:55 2014
+++ libmagic/cdf_time.c	Sun Nov  9 19:16:18 2014
@@ -96,7 +96,7 @@
 }
 
@@ -1159,7 +1173,7 @@ diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
 	static const char *ref = "Sat Apr 23 01:30:00 1977";
 diff -u libmagic.orig/compress.c libmagic/compress.c
 --- libmagic.orig/compress.c	Sun Jan  6 21:35:43 2013
-+++ libmagic/compress.c	Mon Apr 14 23:42:51 2014
+++ libmagic/compress.c	Sun Jan  4 17:02:29 2015
@@ -32,6 +32,7 @@
  *	uncompress(method, old, n, newch) - uncompress old into new, 
  *					    using method, return sizeof new
@@ -1322,7 +1336,7 @@ diff -u libmagic.orig/compress.c libmagic/compress.c
 +#endif /* if PHP_FILEINFO_UNCOMPRESS */
 diff -u libmagic.orig/file.h libmagic/file.h
 --- libmagic.orig/file.h	Mon Feb 18 16:40:59 2013
-+++ libmagic/file.h	Mon Apr 14 23:42:51 2014
+++ libmagic/file.h	Sun Jan  4 17:02:29 2015
@@ -33,11 +33,9 @@
 #ifndef __file_h__
 #define __file_h__
@@ -1409,7 +1423,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 	void *map;			/* internal resources used by entry */
 	struct mlist *next, *prev;
 };
-@@ -411,21 +413,18 @@
+@@ -411,21 +413,16 @@
 protected const char *file_fmttime(uint64_t, int, char *);
 protected struct magic_set *file_ms_alloc(int);
 protected void file_ms_free(struct magic_set *);
@@ -1426,8 +1440,8 @@ diff -u libmagic.orig/file.h libmagic/file.h
 -    __attribute__((__format__(__printf__, 2, 3)));
 +protected int file_printf(struct magic_set *, const char *, ...);
 protected int file_reset(struct magic_set *);
- protected int file_tryelf(struct magic_set *, int, const unsigned char *,
-     size_t);
+-protected int file_tryelf(struct magic_set *, int, const unsigned char *,
+-    size_t);
 protected int file_trycdf(struct magic_set *, int, const unsigned char *,
     size_t);
 -#if HAVE_FORK
@@ -1435,7 +1449,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 protected int file_zmagic(struct magic_set *, int, const char *,
     const unsigned char *, size_t);
 #endif
-@@ -438,21 +437,18 @@
+@@ -438,21 +435,18 @@
     unichar **, size_t *, const char **, const char **, const char **);
 protected int file_is_tar(struct magic_set *, const unsigned char *, size_t);
 protected int file_softmagic(struct magic_set *, const unsigned char *, size_t,
@@ -1462,7 +1476,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 protected void file_showstr(FILE *, const char *, size_t);
 protected size_t file_mbswidth(const char *);
 protected const char *file_getbuffer(struct magic_set *);
-@@ -462,16 +458,14 @@
+@@ -462,16 +456,14 @@
     size_t *);
 protected size_t file_pstring_length_size(const struct magic *);
 protected size_t file_pstring_get_length(const struct magic *, const char *);
@@ -1480,7 +1494,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 
 #ifndef HAVE_STRERROR
 extern int sys_nerr;
-@@ -484,32 +478,16 @@
+@@ -484,32 +476,16 @@
 #define strtoul(a, b, c)	strtol(a, b, c)
 #endif
 
@@ -1515,7 +1529,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 
 #if defined(HAVE_MMAP) && defined(HAVE_SYS_MMAN_H) && !defined(QUICK)
 #define QUICK
-@@ -531,6 +509,14 @@
+@@ -531,6 +507,14 @@
 #endif
 #else
 #define FILE_RCSID(id)
@@ -1532,7 +1546,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 #endif /* __file_h__ */
 diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
 --- libmagic.orig/fsmagic.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/fsmagic.c	Mon Apr 14 23:42:51 2014
+++ libmagic/fsmagic.c	Sun Jan  4 17:02:29 2015
@@ -59,27 +59,21 @@
 # define minor(dev)  ((dev) & 0xff)
 #endif
@@ -1899,7 +1913,7 @@ diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
 }
 diff -u libmagic.orig/funcs.c libmagic/funcs.c
 --- libmagic.orig/funcs.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/funcs.c	Mon Apr 14 23:42:51 2014
+++ libmagic/funcs.c	Sun Jan  4 17:02:29 2015
@@ -41,52 +41,42 @@
 #if defined(HAVE_WCTYPE_H)
 #include <wctype.h>
@@ -2193,7 +2207,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
 +
 diff -u libmagic.orig/magic.c libmagic/magic.c
 --- libmagic.orig/magic.c	Fri Jan 11 17:43:09 2013
-+++ libmagic/magic.c	Mon Apr 14 23:42:51 2014
+++ libmagic/magic.c	Sun Jan  4 17:02:29 2015
@@ -25,11 +25,6 @@
  * SUCH DAMAGE.
  */
@@ -2537,7 +2551,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
 magic_error(struct magic_set *ms)
 diff -u libmagic.orig/magic.h libmagic/magic.h
 --- libmagic.orig/magic.h	Thu Mar 21 18:52:42 2013
-+++ libmagic/magic.h	Mon Apr 14 23:42:51 2014
+++ libmagic/magic.h	Sun Jan  4 17:02:29 2015
@@ -87,6 +87,7 @@
 
 const char *magic_getpath(const char *, int);
@@ -2556,7 +2570,7 @@ diff -u libmagic.orig/magic.h libmagic/magic.h
 
 diff -u libmagic.orig/print.c libmagic/print.c
 --- libmagic.orig/print.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/print.c	Mon Apr 14 23:42:51 2014
+++ libmagic/print.c	Sun Jan  4 17:02:29 2015
@@ -29,12 +29,17 @@
  * print.c - debugging printout routines
  */
@@ -2787,7 +2801,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
 	}
 diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 --- libmagic.orig/readcdf.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/readcdf.c	Tue May 27 22:17:37 2014
+++ libmagic/readcdf.c	Sun Jan  4 17:02:29 2015
@@ -30,7 +30,11 @@
 #endif
 
@@ -2861,282 +2875,9 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 		    } else {
 			if (file_printf(ms, "application/CDFV2-corrupt") == -1)
 			    return -1;
-diff -u libmagic.orig/readelf.c libmagic/readelf.c
--- libmagic.orig/readelf.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/readelf.c	Mon Apr 14 23:42:51 2014
-@@ -48,8 +48,8 @@
- private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t,
-     off_t, int *, int);
- private int doshn(struct magic_set *, int, int, int, off_t, int, size_t,
-    off_t, int *, int, int);
-private size_t donote(struct magic_set *, void *, size_t, size_t, int,
-+    off_t, int *, int);
-+private size_t donote(struct magic_set *, unsigned char *, size_t, size_t, int,
-     int, size_t, int *);
- 
- #define	ELF_ALIGN(a)	((((a) + align - 1) / align) * align)
-@@ -127,11 +127,17 @@
- 
- #define elf_getu16(swap, value) getu16(swap, value)
- #define elf_getu32(swap, value) getu32(swap, value)
-#define elf_getu64(swap, value) getu64(swap, value)
-+#ifdef USE_ARRAY_FOR_64BIT_TYPES
-+# define elf_getu64(swap, array) \
-+	((swap ? ((uint64_t)elf_getu32(swap, array[0])) << 32 : elf_getu32(swap, array[0])) + \
-+	 (swap ? elf_getu32(swap, array[1]) : ((uint64_t)elf_getu32(swap, array[1]) << 32)))
-+#else
-+# define elf_getu64(swap, value) getu64(swap, value)
-+#endif
- 
- #define xsh_addr	(clazz == ELFCLASS32			\
-			 ? (void *)&sh32			\
-			 : (void *)&sh64)
-+			 ? (void *) &sh32			\
-+			 : (void *) &sh64)
- #define xsh_sizeof	(clazz == ELFCLASS32			\
- 			 ? sizeof(sh32)				\
- 			 : sizeof(sh64))
-@@ -168,8 +174,8 @@
- 			 ? elf_getu32(swap, ph32.p_filesz)	\
- 			 : elf_getu64(swap, ph64.p_filesz)))
- #define xnh_addr	(clazz == ELFCLASS32			\
-			 ? (void *)&nh32			\
-			 : (void *)&nh64)
-+			 ? (void *) &nh32			\
-+			 : (void *) &nh64)
- #define xph_memsz	(size_t)((clazz == ELFCLASS32		\
- 			 ? elf_getu32(swap, ph32.p_memsz)	\
- 			 : elf_getu64(swap, ph64.p_memsz)))
-@@ -189,8 +195,8 @@
- 			 ? prpsoffsets32[i]			\
- 			 : prpsoffsets64[i])
- #define xcap_addr	(clazz == ELFCLASS32			\
-			 ? (void *)&cap32			\
-			 : (void *)&cap64)
-+			 ? (void *) &cap32			\
-+			 : (void *) &cap64)
- #define xcap_sizeof	(clazz == ELFCLASS32			\
- 			 ? sizeof cap32				\
- 			 : sizeof cap64)
-@@ -292,7 +298,7 @@
- {
- 	Elf32_Phdr ph32;
- 	Elf64_Phdr ph64;
-	size_t offset, len;
-+	size_t offset;
- 	unsigned char nbuf[BUFSIZ];
- 	ssize_t bufsize;
- 
-@@ -306,7 +312,11 @@
- 	 * Loop through all the program headers.
- 	 */
- 	for ( ; num; num--) {
-		if (pread(fd, xph_addr, xph_sizeof, off) == -1) {
-+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
-+			return -1;
-+		}
-+		if (FINFO_READ_FUNC(fd, xph_addr, xph_sizeof) == -1) {
- 			file_badread(ms);
- 			return -1;
- 		}
-@@ -324,8 +334,13 @@
- 		 * This is a PT_NOTE section; loop through all the notes
- 		 * in the section.
- 		 */
-		len = xph_filesz < sizeof(nbuf) ? xph_filesz : sizeof(nbuf);
-		if ((bufsize = pread(fd, nbuf, len, xph_offset)) == -1) {
-+		if (FINFO_LSEEK_FUNC(fd, xph_offset, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
-+			return -1;
-+		}
-+		bufsize = FINFO_READ_FUNC(fd, nbuf,
-+		    ((xph_filesz < sizeof(nbuf)) ? xph_filesz : sizeof(nbuf)));
-+		if (bufsize == -1) {
- 			file_badread(ms);
- 			return -1;
- 		}
-@@ -852,24 +867,12 @@
- 		return 0;
- 	}
- 
-	/* Read offset of name section to be able to read section names later */
-	if (pread(fd, xsh_addr, xsh_sizeof, off + size * strtab) == -1) {
-		file_badread(ms);
-		return -1;
-	}
-	name_off = xsh_offset;
-
- 	for ( ; num; num--) {
-		/* Read the name of this section. */
-		if (pread(fd, name, sizeof(name), name_off + xsh_name) == -1) {
-			file_badread(ms);
-+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
- 			return -1;
- 		}
-		name[sizeof(name) - 1] = '\0';
-		if (strcmp(name, ".debug_info") == 0)
-			stripped = 0;
-
-		if (pread(fd, xsh_addr, xsh_sizeof, off) == -1) {
-+		if (FINFO_READ_FUNC(fd, xsh_addr, xsh_sizeof) == -1) {
- 			file_badread(ms);
- 			return -1;
- 		}
-@@ -894,14 +897,17 @@
- 		/* Things we can determine when we seek */
- 		switch (xsh_type) {
- 		case SHT_NOTE:
-			if ((nbuf = malloc(xsh_size)) == NULL) {
-				file_error(ms, errno, "Cannot allocate memory"
-				    " for note");
-+			nbuf = emalloc((size_t)xsh_size);
-+			if ((noff = FINFO_LSEEK_FUNC(fd, (off_t)xsh_offset, SEEK_SET)) ==
-+			    (off_t)-1) {
-+				file_badread(ms);
-+				efree(nbuf);
- 				return -1;
- 			}
-			if (pread(fd, nbuf, xsh_size, xsh_offset) == -1) {
-+			if (FINFO_READ_FUNC(fd, nbuf, (size_t)xsh_size) !=
-+			    (ssize_t)xsh_size) {
-+				efree(nbuf);
- 				file_badread(ms);
-				free(nbuf);
- 				return -1;
- 			}
- 
-@@ -910,25 +916,16 @@
- 				if (noff >= (off_t)xsh_size)
- 					break;
- 				noff = donote(ms, nbuf, (size_t)noff,
-				    xsh_size, clazz, swap, 4, flags);
-+				    (size_t)xsh_size, clazz, swap, 4,
-+				    flags);
- 				if (noff == 0)
- 					break;
- 			}
-			free(nbuf);
-+			efree(nbuf);
- 			break;
- 		case SHT_SUNW_cap:
-			switch (mach) {
-			case EM_SPARC:
-			case EM_SPARCV9:
-			case EM_IA_64:
-			case EM_386:
-			case EM_AMD64:
-				break;
-			default:
-				goto skip;
-			}
-
-			if (lseek(fd, xsh_offset, SEEK_SET) == (off_t)-1) {
-+			if (FINFO_LSEEK_FUNC(fd, (off_t)xsh_offset, SEEK_SET) ==
-+			    (off_t)-1) {
- 				file_badseek(ms);
- 				return -1;
- 			}
-@@ -940,7 +937,7 @@
- 				    MAX(sizeof cap32, sizeof cap64)];
- 				if ((coff += xcap_sizeof) > (off_t)xsh_size)
- 					break;
-				if (read(fd, cbuf, (size_t)xcap_sizeof) !=
-+				if (FINFO_READ_FUNC(fd, cbuf, (size_t)xcap_sizeof) !=
- 				    (ssize_t)xcap_sizeof) {
- 					file_badread(ms);
- 					return -1;
-@@ -966,13 +963,12 @@
- 					break;
- 				}
- 			}
-			/*FALLTHROUGH*/
-		skip:
-+			break;
-+
- 		default:
- 			break;
- 		}
- 	}
-
- 	if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1)
- 		return -1;
- 	if (cap_hw1) {
-@@ -1051,7 +1047,7 @@
- 	const char *shared_libraries = "";
- 	unsigned char nbuf[BUFSIZ];
- 	ssize_t bufsize;
-	size_t offset, align, len;
-+	size_t offset, align;
- 	
- 	if (size != xph_sizeof) {
- 		if (file_printf(ms, ", corrupted program header size") == -1)
-@@ -1060,8 +1056,13 @@
- 	}
- 
-   	for ( ; num; num--) {
-		if (pread(fd, xph_addr, xph_sizeof, off) == -1) {
-			file_badread(ms);
-+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
-+			return -1;
-+		}
-+
-+  		if (FINFO_READ_FUNC(fd, xph_addr, xph_sizeof) == -1) {
-+  			file_badread(ms);
- 			return -1;
- 		}
- 
-@@ -1099,9 +1100,12 @@
- 			 * This is a PT_NOTE section; loop through all the notes
- 			 * in the section.
- 			 */
-			len = xph_filesz < sizeof(nbuf) ? xph_filesz
-			    : sizeof(nbuf);
-			bufsize = pread(fd, nbuf, len, xph_offset);
-+			if (FINFO_LSEEK_FUNC(fd, xph_offset, SEEK_SET) == (off_t)-1) {
-+				file_badseek(ms);
-+				return -1;
-+			}
-+			bufsize = FINFO_READ_FUNC(fd, nbuf, ((xph_filesz < sizeof(nbuf)) ?
-+			    xph_filesz : sizeof(nbuf)));
- 			if (bufsize == -1) {
- 				file_badread(ms);
- 				return -1;
-@@ -1162,7 +1166,7 @@
- 	/*
- 	 * If we cannot seek, it must be a pipe, socket or fifo.
- 	 */
-	if((lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
-+	if((FINFO_LSEEK_FUNC(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
- 		fd = file_pipe2file(ms, fd, buf, nbytes);
- 
- 	if (fstat(fd, &st) == -1) {
-diff -u libmagic.orig/readelf.h libmagic/readelf.h
--- libmagic.orig/readelf.h	Thu Mar 21 18:45:14 2013
-+++ libmagic/readelf.h	Mon Apr 14 23:42:51 2014
-@@ -44,9 +44,17 @@
- typedef uint32_t	Elf32_Word;
- typedef uint8_t		Elf32_Char;
- 
-+#if SIZEOF_LONG_LONG != 8
-+#define	USE_ARRAY_FOR_64BIT_TYPES
-+typedef	uint32_t 	Elf64_Addr[2];
-+typedef	uint32_t 	Elf64_Off[2];
-+typedef uint32_t 	Elf64_Xword[2];
-+#else
-+#undef USE_ARRAY_FOR_64BIT_TYPES
- typedef	uint64_t 	Elf64_Addr;
- typedef	uint64_t 	Elf64_Off;
- typedef uint64_t 	Elf64_Xword;
-+#endif
- typedef uint16_t	Elf64_Half;
- typedef uint32_t	Elf64_Word;
- typedef uint8_t		Elf64_Char;
 diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 --- libmagic.orig/softmagic.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/softmagic.c	Tue Jul  1 09:00:09 2014
+++ libmagic/softmagic.c	Sun Jan  4 17:02:29 2015
@@ -41,6 +41,11 @@
 #include <stdlib.h>
 #include <time.h>
@@ -3149,6 +2890,15 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 
 private int match(struct magic_set *, struct magic *, uint32_t,
     const unsigned char *, size_t, size_t, int, int, int, int, int *, int *,
+@@ -53,7 +58,7 @@
+ private int32_t moffset(struct magic_set *, struct magic *);
+ private void mdebug(uint32_t, const char *, size_t);
+ private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
+-    const unsigned char *, uint32_t, size_t, size_t);
+    const unsigned char *, uint32_t, size_t, struct magic *);
+ private int mconvert(struct magic_set *, struct magic *, int);
+ private int print_sep(struct magic_set *, int);
+ private int handle_annotation(struct magic_set *, struct magic *);
@@ -62,6 +67,8 @@
 private void cvt_32(union VALUETYPE *, const struct magic *);
 private void cvt_64(union VALUETYPE *, const struct magic *);
@@ -3286,7 +3036,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			break; \
 		} \
 
-@@ -896,10 +881,18 @@
+@@ -896,10 +881,21 @@
 		return 1;
 	}
 	case FILE_PSTRING: {
@@ -3296,21 +3046,87 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 		size_t len = file_pstring_get_length(m, ptr1);
 -		if (len >= sizeof(p->s))
 -			len = sizeof(p->s) - 1;
-+		if (len >= sizeof(p->s)) {
+		sz = sizeof(p->s) - sz; /* maximum length of string */
+		if (len >= sz) {
 +			/*
 +			 * The size of the pascal string length (sz)
 +			 * is 1, 2, or 4. We need at least 1 byte for NUL
 +			 * termination, but we've already truncated the
 +			 * string by p->s, so we need to deduct sz.
+			 * Because we can use one of the bytes of the length
+			 * after we shifted as NUL termination.
 +			 */ 
-+			len = sizeof(p->s) - sz;
+			len = sz;
 +		}
 		while (len--)
 			*ptr1++ = *ptr2++;
 		*ptr1 = '\0';
-@@ -1145,9 +1138,6 @@
- 		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
- 		    nbytes, count);
+@@ -1010,7 +1006,7 @@
+ 
+ private int
+ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
+-    const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
+    const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
+ {
+ 	/*
+ 	 * Note: FILE_SEARCH and FILE_REGEX do not actually copy
+@@ -1030,15 +1026,24 @@
+ 			const char *last;	/* end of search region */
+ 			const char *buf;	/* start of search region */
+ 			const char *end;
+-			size_t lines;
+			size_t lines, linecnt, bytecnt;
+
+			linecnt = m->str_range;
+			bytecnt = linecnt * 80;
+ 
+			if (bytecnt == 0) {
+				bytecnt = 8192;
+			}
+			if (bytecnt > nbytes) {
+				bytecnt = nbytes;
+			}
+ 			if (s == NULL) {
+ 				ms->search.s_len = 0;
+ 				ms->search.s = NULL;
+ 				return 0;
+ 			}
+ 			buf = RCAST(const char *, s) + offset;
+-			end = last = RCAST(const char *, s) + nbytes;
+			end = last = RCAST(const char *, s) + bytecnt;
+ 			/* mget() guarantees buf <= last */
+ 			for (lines = linecnt, b = buf; lines && b < end &&
+ 			     ((b = CAST(const char *,
+@@ -1051,7 +1056,7 @@
+ 					b++;
+ 			}
+ 			if (lines)
+-				last = RCAST(const char *, s) + nbytes;
+				last = RCAST(const char *, s) + bytecnt;
+ 
+ 			ms->search.s = buf;
+ 			ms->search.s_len = last - buf;
+@@ -1125,7 +1130,6 @@
+     int *need_separator, int *returnval)
+ {
+ 	uint32_t soffset, offset = ms->offset;
+-	uint32_t count = m->str_range;
+ 	int rv, oneed_separator;
+ 	char *sbuf, *rbuf;
+ 	union VALUETYPE *p = &ms->ms_value;
+@@ -1137,17 +1141,13 @@
+ 	}
+ 
+ 	if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
+-	    (uint32_t)nbytes, count) == -1)
+	    (uint32_t)nbytes, m) == -1)
+ 		return -1;
+ 
+ 	if ((ms->flags & MAGIC_DEBUG) != 0) {
+ 		fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%zu, "
+-		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
+-		    nbytes, count);
+		    "nbytes=%zu)\n", m->type, m->flag, offset, o, nbytes);
 		mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
 -#ifndef COMPILE_ONLY
 -		file_mdump(m);
@@ -3318,7 +3134,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 	}
 
 	if (m->flag & INDIR) {
-@@ -1191,7 +1181,7 @@
+@@ -1191,7 +1191,7 @@
 		}
 		switch (cvt_flip(m->in_type, flip)) {
 		case FILE_BYTE:
@@ -3327,7 +3143,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1226,7 +1216,7 @@
+@@ -1226,7 +1226,7 @@
 				offset = ~offset;
 			break;
 		case FILE_BESHORT:
@@ -3336,7 +3152,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1278,7 +1268,7 @@
+@@ -1278,7 +1278,7 @@
 				offset = ~offset;
 			break;
 		case FILE_LESHORT:
@@ -3345,7 +3161,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1330,7 +1320,7 @@
+@@ -1330,7 +1330,7 @@
 				offset = ~offset;
 			break;
 		case FILE_SHORT:
@@ -3354,7 +3170,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1367,7 +1357,7 @@
+@@ -1367,7 +1367,7 @@
 			break;
 		case FILE_BELONG:
 		case FILE_BEID3:
@@ -3363,7 +3179,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1438,7 +1428,7 @@
+@@ -1438,7 +1438,7 @@
 			break;
 		case FILE_LELONG:
 		case FILE_LEID3:
@@ -3372,7 +3188,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1508,7 +1498,7 @@
+@@ -1508,7 +1508,7 @@
 				offset = ~offset;
 			break;
 		case FILE_MELONG:
@@ -3381,7 +3197,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1578,7 +1568,7 @@
+@@ -1578,7 +1578,7 @@
 				offset = ~offset;
 			break;
 		case FILE_LONG:
@@ -3390,7 +3206,15 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1644,23 +1634,20 @@
+@@ -1637,30 +1637,27 @@
+ 			if ((ms->flags & MAGIC_DEBUG) != 0)
+ 				fprintf(stderr, "indirect +offs=%u\n", offset);
+ 		}
+-		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
+		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
+ 			return -1;
+ 		ms->offset = offset;
+ 
 		if ((ms->flags & MAGIC_DEBUG) != 0) {
 			mdebug(offset, (char *)(void *)p,
 			    sizeof(union VALUETYPE));
@@ -3416,7 +3240,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			return 0;
 		break;
 
-@@ -1679,38 +1666,40 @@
+@@ -1679,38 +1676,40 @@
 	case FILE_FLOAT:
 	case FILE_BEFLOAT:
 	case FILE_LEFLOAT:
@@ -3463,7 +3287,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 		if ((ms->flags & MAGIC_DEBUG) != 0)
 			fprintf(stderr, "indirect @offs=%u[%d]\n", offset, rv);
 		rbuf = ms->o.buf;
-@@ -1718,16 +1707,26 @@
+@@ -1718,16 +1717,26 @@
 		ms->offset = soffset;
 		if (rv == 1) {
 			if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 &&
@@ -3494,7 +3318,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			return 0;
 		sbuf = m->value.s;
 		if (*sbuf == '^') {
-@@ -1837,6 +1836,42 @@
+@@ -1837,6 +1846,42 @@
 	return file_strncmp(a, b, len, flags);
 }
 
@@ -3537,7 +3361,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 private int
 magiccheck(struct magic_set *ms, struct magic *m)
 {
-@@ -1996,69 +2031,157 @@
+@@ -1996,69 +2041,157 @@
 		break;
 	}
 	case FILE_REGEX: {
@@ -3608,7 +3432,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 +			zval *retval;
 +			zval *subpats;
 +			char *haystack;
-+			
+
 +			MAKE_STD_ZVAL(retval);
 +			ALLOC_INIT_ZVAL(subpats);
 +			
@@ -420,8 +420,6 @@ protected int file_pipe2file(struct magic_set *, int, const void *, size_t);
 protected int file_replace(struct magic_set *, const char *, const char *);
 protected int file_printf(struct magic_set *, const char *, ...);
 protected int file_reset(struct magic_set *);
-protected int file_tryelf(struct magic_set *, int, const unsigned char *,
-    size_t);
 protected int file_trycdf(struct magic_set *, int, const unsigned char *,
    size_t);
 #ifdef PHP_FILEINFO_UNCOMPRESS 
@@ -1,333 +0,0 @@
-/*
- * Copyright (c) Christos Zoulas 2003.
- * All Rights Reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice immediately at the beginning of the file, without modification,
- *    this list of conditions, and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *  
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
- * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-/*
- * @(#)Id: readelf.h,v 1.9 2002/05/16 18:45:56 christos Exp
- *
- * Provide elf data structures for non-elf machines, allowing file
- * non-elf hosts to determine if an elf binary is stripped.
- * Note: cobbled from the linux header file, with modifications
- */
-#ifndef __fake_elf_h__
-#define	__fake_elf_h__
-
-#if HAVE_STDINT_H
-#include <stdint.h>
-#endif
-
-typedef uint32_t	Elf32_Addr;
-typedef uint32_t	Elf32_Off;
-typedef uint16_t	Elf32_Half;
-typedef uint32_t	Elf32_Word;
-typedef uint8_t		Elf32_Char;
-
-#if SIZEOF_LONG_LONG != 8
-#define	USE_ARRAY_FOR_64BIT_TYPES
-typedef	uint32_t 	Elf64_Addr[2];
-typedef	uint32_t 	Elf64_Off[2];
-typedef uint32_t 	Elf64_Xword[2];
-#else
-#undef USE_ARRAY_FOR_64BIT_TYPES
-typedef	uint64_t 	Elf64_Addr;
-typedef	uint64_t 	Elf64_Off;
-typedef uint64_t 	Elf64_Xword;
-#endif
-typedef uint16_t	Elf64_Half;
-typedef uint32_t	Elf64_Word;
-typedef uint8_t		Elf64_Char;
-
-#define	EI_NIDENT	16
-
-typedef struct {
-    Elf32_Char	e_ident[EI_NIDENT];
-    Elf32_Half	e_type;
-    Elf32_Half	e_machine;
-    Elf32_Word	e_version;
-    Elf32_Addr	e_entry;  /* Entry point */
-    Elf32_Off	e_phoff;
-    Elf32_Off	e_shoff;
-    Elf32_Word	e_flags;
-    Elf32_Half	e_ehsize;
-    Elf32_Half	e_phentsize;
-    Elf32_Half	e_phnum;
-    Elf32_Half	e_shentsize;
-    Elf32_Half	e_shnum;
-    Elf32_Half	e_shstrndx;
-} Elf32_Ehdr;
-
-typedef struct {
-    Elf64_Char	e_ident[EI_NIDENT];
-    Elf64_Half	e_type;
-    Elf64_Half	e_machine;
-    Elf64_Word	e_version;
-    Elf64_Addr	e_entry;  /* Entry point */
-    Elf64_Off	e_phoff;
-    Elf64_Off	e_shoff;
-    Elf64_Word	e_flags;
-    Elf64_Half	e_ehsize;
-    Elf64_Half	e_phentsize;
-    Elf64_Half	e_phnum;
-    Elf64_Half	e_shentsize;
-    Elf64_Half	e_shnum;
-    Elf64_Half	e_shstrndx;
-} Elf64_Ehdr;
-
-/* e_type */
-#define	ET_REL		1
-#define	ET_EXEC		2
-#define	ET_DYN		3
-#define	ET_CORE		4
-
-/* e_machine (used only for SunOS 5.x hardware capabilities) */
-#define	EM_SPARC	2
-#define	EM_386		3
-#define	EM_SPARC32PLUS	18
-#define	EM_SPARCV9	43
-#define	EM_IA_64	50
-#define	EM_AMD64	62
-
-/* sh_type */
-#define	SHT_SYMTAB	2
-#define	SHT_NOTE	7
-#define	SHT_DYNSYM	11
-#define	SHT_SUNW_cap	0x6ffffff5	/* SunOS 5.x hw/sw capabilites */
-
-/* elf type */
-#define	ELFDATANONE	0		/* e_ident[EI_DATA] */
-#define	ELFDATA2LSB	1
-#define	ELFDATA2MSB	2
-
-/* elf class */
-#define	ELFCLASSNONE	0
-#define	ELFCLASS32	1
-#define	ELFCLASS64	2
-
-/* magic number */
-#define	EI_MAG0		0		/* e_ident[] indexes */
-#define	EI_MAG1		1
-#define	EI_MAG2		2
-#define	EI_MAG3		3
-#define	EI_CLASS	4
-#define	EI_DATA		5
-#define	EI_VERSION	6
-#define	EI_PAD		7
-
-#define	ELFMAG0		0x7f		/* EI_MAG */
-#define	ELFMAG1		'E'
-#define	ELFMAG2		'L'
-#define	ELFMAG3		'F'
-#define	ELFMAG		"\177ELF"
-
-#define	OLFMAG1		'O'
-#define	OLFMAG		"\177OLF"
-
-typedef struct {
-    Elf32_Word	p_type;
-    Elf32_Off	p_offset;
-    Elf32_Addr	p_vaddr;
-    Elf32_Addr	p_paddr;
-    Elf32_Word	p_filesz;
-    Elf32_Word	p_memsz;
-    Elf32_Word	p_flags;
-    Elf32_Word	p_align;
-} Elf32_Phdr;
-
-typedef struct {
-    Elf64_Word	p_type;
-    Elf64_Word	p_flags;
-    Elf64_Off	p_offset;
-    Elf64_Addr	p_vaddr;
-    Elf64_Addr	p_paddr;
-    Elf64_Xword	p_filesz;
-    Elf64_Xword	p_memsz;
-    Elf64_Xword	p_align;
-} Elf64_Phdr;
-
-#define	PT_NULL		0		/* p_type */
-#define	PT_LOAD		1
-#define	PT_DYNAMIC	2
-#define	PT_INTERP	3
-#define	PT_NOTE		4
-#define	PT_SHLIB	5
-#define	PT_PHDR		6
-#define	PT_NUM		7
-
-typedef struct {
-    Elf32_Word	sh_name;
-    Elf32_Word	sh_type;
-    Elf32_Word	sh_flags;
-    Elf32_Addr	sh_addr;
-    Elf32_Off	sh_offset;
-    Elf32_Word	sh_size;
-    Elf32_Word	sh_link;
-    Elf32_Word	sh_info;
-    Elf32_Word	sh_addralign;
-    Elf32_Word	sh_entsize;
-} Elf32_Shdr;
-
-typedef struct {
-    Elf64_Word	sh_name;
-    Elf64_Word	sh_type;
-    Elf64_Off	sh_flags;
-    Elf64_Addr	sh_addr;
-    Elf64_Off	sh_offset;
-    Elf64_Off	sh_size;
-    Elf64_Word	sh_link;
-    Elf64_Word	sh_info;
-    Elf64_Off	sh_addralign;
-    Elf64_Off	sh_entsize;
-} Elf64_Shdr;
-
-#define	NT_NETBSD_CORE_PROCINFO		1
-
-/* Note header in a PT_NOTE section */
-typedef struct elf_note {
-    Elf32_Word	n_namesz;	/* Name size */
-    Elf32_Word	n_descsz;	/* Content size */
-    Elf32_Word	n_type;		/* Content type */
-} Elf32_Nhdr;
-
-typedef struct {
-    Elf64_Word	n_namesz;
-    Elf64_Word	n_descsz;
-    Elf64_Word	n_type;
-} Elf64_Nhdr;
-
-/* Notes used in ET_CORE */
-#define	NT_PRSTATUS	1
-#define	NT_PRFPREG	2
-#define	NT_PRPSINFO	3
-#define	NT_PRXREG	4
-#define	NT_TASKSTRUCT	4
-#define	NT_PLATFORM	5
-#define	NT_AUXV		6
-
-/* Note types used in executables */
-/* NetBSD executables (name = "NetBSD") */
-#define	NT_NETBSD_VERSION	1
-#define	NT_NETBSD_EMULATION	2
-#define	NT_FREEBSD_VERSION	1
-#define	NT_OPENBSD_VERSION	1
-#define	NT_DRAGONFLY_VERSION	1
-/*
- * GNU executables (name = "GNU")
- * word[0]: GNU OS tags
- * word[1]: major version
- * word[2]: minor version
- * word[3]: tiny version
- */
-#define	NT_GNU_VERSION		1
-
-/* GNU OS tags */
-#define	GNU_OS_LINUX	0
-#define	GNU_OS_HURD	1
-#define	GNU_OS_SOLARIS	2
-#define	GNU_OS_KFREEBSD	3
-#define	GNU_OS_KNETBSD	4
-
-/*
- * GNU Hardware capability information 
- * word[0]: Number of entries
- * word[1]: Bitmask of enabled entries
- * Followed by a byte id, and a NUL terminated string per entry
- */
-#define	NT_GNU_HWCAP		2
-
-/*
- * GNU Build ID generated by ld
- * 160 bit SHA1 [default] 
- * 128 bit md5 or uuid
- */
-#define	NT_GNU_BUILD_ID		3
-
-/* SunOS 5.x hardware/software capabilities */
-typedef struct {
-	Elf32_Word	c_tag;
-	union {
-		Elf32_Word	c_val;
-		Elf32_Addr	c_ptr;
-	} c_un;
-} Elf32_Cap;
-
-typedef struct {
-	Elf64_Xword	c_tag;
-	union {
-		Elf64_Xword	c_val;
-		Elf64_Addr	c_ptr;
-	} c_un;
-} Elf64_Cap;
-
-/* SunOS 5.x hardware/software capability tags */
-#define	CA_SUNW_NULL	0
-#define	CA_SUNW_HW_1	1
-#define	CA_SUNW_SF_1	2
-
-/* SunOS 5.x software capabilities */
-#define	SF1_SUNW_FPKNWN	0x01
-#define	SF1_SUNW_FPUSED	0x02
-#define	SF1_SUNW_MASK	0x03
-
-/* SunOS 5.x hardware capabilities: sparc */
-#define	AV_SPARC_MUL32		0x0001
-#define	AV_SPARC_DIV32		0x0002
-#define	AV_SPARC_FSMULD		0x0004
-#define	AV_SPARC_V8PLUS		0x0008
-#define	AV_SPARC_POPC		0x0010
-#define	AV_SPARC_VIS		0x0020
-#define	AV_SPARC_VIS2		0x0040
-#define	AV_SPARC_ASI_BLK_INIT	0x0080
-#define	AV_SPARC_FMAF		0x0100
-#define	AV_SPARC_FJFMAU		0x4000
-#define	AV_SPARC_IMA		0x8000
-
-/* SunOS 5.x hardware capabilities: 386 */
-#define	AV_386_FPU		0x00000001
-#define	AV_386_TSC		0x00000002
-#define	AV_386_CX8		0x00000004
-#define	AV_386_SEP		0x00000008
-#define	AV_386_AMD_SYSC		0x00000010
-#define	AV_386_CMOV		0x00000020
-#define	AV_386_MMX		0x00000040
-#define	AV_386_AMD_MMX		0x00000080
-#define	AV_386_AMD_3DNow	0x00000100
-#define	AV_386_AMD_3DNowx	0x00000200
-#define	AV_386_FXSR		0x00000400
-#define	AV_386_SSE		0x00000800
-#define	AV_386_SSE2		0x00001000
-#define	AV_386_PAUSE		0x00002000
-#define	AV_386_SSE3		0x00004000
-#define	AV_386_MON		0x00008000
-#define	AV_386_CX16		0x00010000
-#define	AV_386_AHF		0x00020000
-#define	AV_386_TSCP		0x00040000
-#define	AV_386_AMD_SSE4A	0x00080000
-#define	AV_386_POPCNT		0x00100000
-#define	AV_386_AMD_LZCNT	0x00200000
-#define	AV_386_SSSE3		0x00400000
-#define	AV_386_SSE4_1		0x00800000
-#define	AV_386_SSE4_2		0x01000000
-
-#endif
@@ -884,14 +884,17 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
 		size_t sz = file_pstring_length_size(m);
 		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
 		size_t len = file_pstring_get_length(m, ptr1);
-		if (len >= sizeof(p->s)) {
+		sz = sizeof(p->s) - sz; /* maximum length of string */
+		if (len >= sz) {
 			/*
 			 * The size of the pascal string length (sz)
 			 * is 1, 2, or 4. We need at least 1 byte for NUL
 			 * termination, but we've already truncated the
 			 * string by p->s, so we need to deduct sz.
+			 * Because we can use one of the bytes of the length
+			 * after we shifted as NUL termination.
 			 */ 
-			len = sizeof(p->s) - sz;
+			len = sz;
 		}
 		while (len--)
 			*ptr1++ = *ptr2++;
@@ -0,0 +1,16 @@
+--TEST--
+Bug #68735 fileinfo out-of-bounds memory access
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+	$test_file = dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug68735.jpg";
+	$f = new finfo;
+
+	var_dump($f->file($test_file));
+
+?>
+===DONE===
+--EXPECTF--
+string(%d) "JPEG image data, JFIF standard 1.01, comment: "%S""
+===DONE===
@@ -619,8 +619,11 @@ PHP_FUNCTION(mcrypt_generic_init)

 	if (iv_len != iv_size) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Iv size incorrect; supplied length: %d, needed: %d", iv_len, iv_size);
+		if (iv_len > iv_size) {
+			iv_len = iv_size;
+		}
 	}
-	memcpy(iv_s, iv, iv_size);
+	memcpy(iv_s, iv, iv_len);

 	mcrypt_generic_deinit(pm->td);
 	result = mcrypt_generic_init(pm->td, key_s, key_size, iv_s);
@@ -641,8 +644,9 @@ PHP_FUNCTION(mcrypt_generic_init)
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown error");
 				break;
 		}
+	} else {
+		pm->init = 1;
 	}
-	pm->init = 1;
 	RETVAL_LONG(result);

 	efree(iv_s);
@@ -518,7 +518,7 @@ mysqlnd_query_read_result_set_header(MYSQLND_CONN_DATA * conn, MYSQLND_STMT * s
 						conn->current_result = NULL;
 					} else {
 						stmt->result = NULL;
-						memset(stmt, 0, sizeof(MYSQLND_STMT));
+						memset(stmt, 0, sizeof(*stmt));
 						stmt->state = MYSQLND_STMT_INITTED;
 					}
 				} else {
@@ -4556,14 +4556,14 @@ int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stre
 			return FAILURE;
 		}

-		match = strcmp(cnmatch, buf) == 0;
+		match = strcasecmp(cnmatch, buf) == 0;
 		if (!match && strlen(buf) > 3 && buf[0] == '*' && buf[1] == '.') {
 			/* Try wildcard */

 			if (strchr(buf+2, '.')) {
 				char *tmp = strstr(cnmatch, buf+1);

-				match = tmp && strcmp(tmp, buf+2) && tmp == strchr(cnmatch, '.');
+				match = tmp && strcasecmp(tmp, buf+2) && tmp == strchr(cnmatch, '.');
 			}
 		}

@@ -100,6 +100,9 @@ xmlDocPtr soap_xmlParseFile(const char *filename TSRMLS_DC)
 		ctxt->sax->warning = NULL;
 		ctxt->sax->error = NULL;
 		/*ctxt->sax->fatalError = NULL;*/
+#if LIBXML_VERSION >= 20703
+		ctxt->options |= XML_PARSE_HUGE;
+#endif
 		old = php_libxml_disable_entity_loader(1 TSRMLS_CC);
 		xmlParseDocument(ctxt);
 		php_libxml_disable_entity_loader(old TSRMLS_CC);
@@ -170,7 +170,7 @@ main() {
  ac_cv_crypt_blowfish=no
 ])])

-AC_CACHE_CHECK(for SHA512 crypt, ac_cv_crypt_SHA512,[
+AC_CACHE_CHECK(for SHA512 crypt, ac_cv_crypt_sha512,[
 AC_TRY_RUN([
 #if HAVE_UNISTD_H
 #include <unistd.h>
@@ -192,14 +192,14 @@ main() {
 	exit(0);
 #endif
 }],[
-  ac_cv_crypt_SHA512=yes
+  ac_cv_crypt_sha512=yes
 ],[
-  ac_cv_crypt_SHA512=no
+  ac_cv_crypt_sha512=no
 ],[
-  ac_cv_crypt_SHA512=no
+  ac_cv_crypt_sha512=no
 ])])

-AC_CACHE_CHECK(for SHA256 crypt, ac_cv_crypt_SHA256,[
+AC_CACHE_CHECK(for SHA256 crypt, ac_cv_crypt_sha256,[
 AC_TRY_RUN([
 #if HAVE_UNISTD_H
 #include <unistd.h>
@@ -221,11 +221,11 @@ main() {
 	exit(0);
 #endif
 }],[
-  ac_cv_crypt_SHA256=yes
+  ac_cv_crypt_sha256=yes
 ],[
-  ac_cv_crypt_SHA256=no
+  ac_cv_crypt_sha256=no
 ],[
-  ac_cv_crypt_SHA256=no
+  ac_cv_crypt_sha256=no
 ])])


@@ -204,7 +204,7 @@ PHP_FUNCTION(crypt)
 			salt[salt_in_len] = '\0';

 			crypt_res = php_sha512_crypt_r(str, salt, output, needed);
-			if (!crypt_res) {
+			if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETVAL_STRING("*1", 1);
 				} else {
@@ -227,7 +227,7 @@ PHP_FUNCTION(crypt)
 			salt[salt_in_len] = '\0';

 			crypt_res = php_sha256_crypt_r(str, salt, output, needed);
-			if (!crypt_res) {
+			if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETVAL_STRING("*1", 1);
 				} else {
@@ -242,7 +242,6 @@ PHP_FUNCTION(crypt)
 		} else if (
 				salt[0] == '$' &&
 				salt[1] == '2' &&
-				salt[2] >= 'a' && salt[2] <= 'z' &&
 				salt[3] == '$' &&
 				salt[4] >= '0' && salt[4] <= '3' &&
 				salt[5] >= '0' && salt[5] <= '9' &&
@@ -252,7 +251,7 @@ PHP_FUNCTION(crypt)
 			memset(output, 0, PHP_MAX_SALT_LEN + 1);

 			crypt_res = php_crypt_blowfish_rn(str, salt, output, sizeof(output));
-			if (!crypt_res) {
+			if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETVAL_STRING("*1", 1);
 				} else {
@@ -268,7 +267,7 @@ PHP_FUNCTION(crypt)
 			_crypt_extended_init_r();

 			crypt_res = _crypt_extended_r(str, salt, &buffer);
-			if (!crypt_res) {
+			if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETURN_STRING("*1", 1);
 				} else {
@@ -292,7 +291,7 @@ PHP_FUNCTION(crypt)
 #    error Data struct used by crypt_r() is unknown. Please report.
 #  endif
 		crypt_res = crypt_r(str, salt, &buffer);
-		if (!crypt_res) {
+		if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETURN_STRING("*1", 1);
 				} else {
@@ -8,11 +8,11 @@
 * and crypt(3) interfaces added, but optimizations specific to password
 * cracking removed.
 *
- * Written by Solar Designer <solar at openwall.com> in 1998-2011.
+ * Written by Solar Designer <solar at openwall.com> in 1998-2014.
 * No copyright is claimed, and the software is hereby placed in the public
 * domain. In case this attempt to disclaim copyright and place the software
 * in the public domain is deemed null and void, then the software is
- * Copyright (c) 1998-2011 Solar Designer and it is hereby released to the
+ * Copyright (c) 1998-2014 Solar Designer and it is hereby released to the
 * general public under the following terms:
 *
 * Redistribution and use in source and binary forms, with or without
@@ -28,12 +28,12 @@
 * you place this code and any modifications you make under a license
 * of your choice.
 *
- * This implementation is mostly compatible with OpenBSD's bcrypt.c (prefix
- * "$2a$") by Niels Provos <provos at citi.umich.edu>, and uses some of his
- * ideas. The password hashing algorithm was designed by David Mazieres
- * <dm at lcs.mit.edu>. For more information on the level of compatibility,
- * please refer to the comments in BF_set_key() below and to the crypt(3)
- * man page included in the crypt_blowfish tarball.
+ * This implementation is fully compatible with OpenBSD's bcrypt.c for prefix
+ * "$2b$", originally by Niels Provos <provos at citi.umich.edu>, and it uses
+ * some of his ideas. The password hashing algorithm was designed by David
+ * Mazieres <dm at lcs.mit.edu>. For information on the level of
+ * compatibility for bcrypt hash prefixes other than "$2b$", please refer to
+ * the comments in BF_set_key() below and to the included crypt(3) man page.
 *
 * There's a paper on the algorithm that explains its design decisions:
 *
@@ -583,6 +583,7 @@ static void BF_set_key(const char *key, BF_key expanded, BF_key initial,
 * Valid combinations of settings are:
 *
 * Prefix "$2a$": bug = 0, safety = 0x10000
+ * Prefix "$2b$": bug = 0, safety = 0
 * Prefix "$2x$": bug = 1, safety = 0
 * Prefix "$2y$": bug = 0, safety = 0
 */
@@ -646,6 +647,10 @@ static void BF_set_key(const char *key, BF_key expanded, BF_key initial,
 	initial[0] ^= sign;
 }

+static const unsigned char flags_by_subtype[26] =
+	{2, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 4, 0};
+
 static char *BF_crypt(const char *key, const char *setting,
 	char *output, int size,
 	BF_word min)
@@ -653,9 +658,6 @@ static char *BF_crypt(const char *key, const char *setting,
 #if BF_ASM
 	extern void _BF_body_r(BF_ctx *ctx);
 #endif
-	static const unsigned char flags_by_subtype[26] =
-		{2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 4, 0};
 	struct {
 		BF_ctx ctx;
 		BF_key expanded_key;
@@ -821,9 +823,10 @@ char *php_crypt_blowfish_rn(const char *key, const char *setting,
 {
 	const char *test_key = "8b \xd0\xc1\xd2\xcf\xcc\xd8";
 	const char *test_setting = "$2a$00$abcdefghijklmnopqrstuu";
-	static const char * const test_hash[2] =
-		{"VUrPmXD6q/nVSSp7pNDhCR9071IfIRe\0\x55", /* $2x$ */
-		"i1D709vfamulimlGcq0qq3UvuUasvEa\0\x55"}; /* $2a$, $2y$ */
+	static const char * const test_hashes[2] =
+		{"i1D709vfamulimlGcq0qq3UvuUasvEa\0\x55", /* 'a', 'b', 'y' */
+		"VUrPmXD6q/nVSSp7pNDhCR9071IfIRe\0\x55"}; /* 'x' */
+	const char *test_hash = test_hashes[0];
 	char *retval;
 	const char *p;
 	int save_errno, ok;
@@ -845,17 +848,19 @@ char *php_crypt_blowfish_rn(const char *key, const char *setting,
 * detected by the self-test.
 */
 	memcpy(buf.s, test_setting, sizeof(buf.s));
-	if (retval)
+	if (retval) {
+		unsigned int flags = flags_by_subtype[
+		    (unsigned int)(unsigned char)setting[2] - 'a'];
+		test_hash = test_hashes[flags & 1];
 		buf.s[2] = setting[2];
+	}
 	memset(buf.o, 0x55, sizeof(buf.o));
 	buf.o[sizeof(buf.o) - 1] = 0;
 	p = BF_crypt(test_key, buf.s, buf.o, sizeof(buf.o) - (1 + 1), 1);

 	ok = (p == buf.o &&
 	    !memcmp(p, buf.s, 7 + 22) &&
-	    !memcmp(p + (7 + 22),
-	    test_hash[(unsigned int)(unsigned char)buf.s[2] & 1],
-	    31 + 1 + 1 + 1));
+	    !memcmp(p + (7 + 22), test_hash, 31 + 1 + 1 + 1));

 	{
 		const char *k = "\xff\xa3" "34" "\xff\xff\xff\xa3" "345";
@@ -885,7 +890,7 @@ char *_crypt_gensalt_blowfish_rn(const char *prefix, unsigned long count,
 	if (size < 16 || output_size < 7 + 22 + 1 ||
 	    (count && (count < 4 || count > 31)) ||
 	    prefix[0] != '$' || prefix[1] != '2' ||
-	    (prefix[2] != 'a' && prefix[2] != 'y')) {
+	    (prefix[2] != 'a' && prefix[2] != 'b' && prefix[2] != 'y')) {
 		if (output_size > 0) output[0] = '\0';
 		__set_errno((output_size < 7 + 22 + 1) ? ERANGE : EINVAL);
 		return NULL;
@@ -222,6 +222,11 @@ PHP_FUNCTION(gethostbyname)
 		return;
 	}

+	if(hostname_len > MAXFQDNLEN) {
+		/* name too long, protect from CVE-2015-0235 */
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Host name is too long, the limit is %d characters", MAXFQDNLEN);
+		RETURN_STRINGL(hostname, hostname_len, 1);
+	}
 	addr = php_gethostbyname(hostname);

 	RETVAL_STRING(addr, 0);
@@ -242,6 +247,12 @@ PHP_FUNCTION(gethostbynamel)
 		return;
 	}

+	if(hostname_len > MAXFQDNLEN) {
+		/* name too long, protect from CVE-2015-0235 */
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Host name is too long, the limit is %d characters", MAXFQDNLEN);
+		RETURN_FALSE;
+	}
+
 	hp = gethostbyname(hostname);
 	if (hp == NULL || hp->h_addr_list == NULL) {
 		RETURN_FALSE;
@@ -188,6 +188,10 @@ static void php_exec_ex(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot execute a blank command");
 		RETURN_FALSE;
 	}
+	if (strlen(cmd) != cmd_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "NULL byte detected. Possible attack");
+		RETURN_FALSE;
+	}

 	if (!ret_array) {
 		ret = php_exec(mode, cmd, NULL, return_value TSRMLS_CC);
@@ -117,11 +117,11 @@ PHPAPI int strnatcmp_ex(char const *a, size_t a_len, char const *b, size_t b_len
 		ca = *ap; cb = *bp;

 		/* skip over leading zeros */
-		while (leading && ca == '0' && (ap+1 < aend) && isdigit(*(ap+1))) {
+		while (leading && ca == '0' && (ap+1 < aend) && isdigit((int)(unsigned char)*(ap+1))) {
 			ca = *++ap;
 		}

-		while (leading && cb == '0' && (bp+1 < bend) && isdigit(*(bp+1))) {
+		while (leading && cb == '0' && (bp+1 < bend) && isdigit((int)(unsigned char)*(bp+1))) {
 			cb = *++bp;
 		}

@@ -1,14 +1,15 @@
 --TEST--
 Bug #60227 (header() cannot detect the multi-line header with CR), \r before \n
+--INI--
+expose_php=0
 --FILE--
 <?php
 header("X-foo: e\n foo");
-header("X-Foo6: e\rSet-Cookie: ID=123\n d");
 echo 'foo';
 ?>
 --EXPECTF--
+
 Warning: Header may not contain more than a single header, new line detected in %s on line %d
 foo
 --EXPECTHEADERS--
-X-foo: e
-foo
+Content-type: text/html; charset=UTF-8
@@ -1,8 +1,9 @@
 --TEST--
 Bug #60227 (header() cannot detect the multi-line header with CR), \0 before \n
+--INI--
+expose_php=0
 --FILE--
 <?php
-header("X-foo: e\n foo");
 header("X-Foo6: e\0Set-Cookie: ID=\n123\n d");
 echo 'foo';
 ?>
@@ -10,5 +11,4 @@ echo 'foo';
 Warning: Header may not contain NUL bytes in %s on line %d
 foo
 --EXPECTHEADERS--
-X-foo: e
-foo
+Content-type: text/html; charset=UTF-8
@@ -1,8 +1,9 @@
 --TEST--
 Bug #60227 (header() cannot detect the multi-line header with CR), CRLF
+--INI--
+expose_php=0
 --FILE--
 <?php
-header("X-foo: e\r\n foo");
 header("X-foo: e\r\nfoo");
 echo 'foo';
 ?>
@@ -10,5 +11,4 @@ echo 'foo';
 Warning: Header may not contain more than a single header, new line detected in %s on line %d
 foo
 --EXPECTHEADERS--
-X-foo: e
- foo
+Content-type: text/html; charset=UTF-8
@@ -0,0 +1,25 @@
+--TEST--
+exec, system, passthru  — Basic command execution functions
+--SKIPIF--
+<?php
+// If this does not work for Windows, please uncomment or fix test
+// if(substr(PHP_OS, 0, 3) == "WIN") die("skip not for Windows");
+?>
+--FILE--
+<?php
+$cmd = "echo abc\n\0command";
+var_dump(exec($cmd, $output));
+var_dump($output);
+var_dump(system($cmd));
+var_dump(passthru($cmd));
+?>
+--EXPECTF--
+Warning: exec(): NULL byte detected. Possible attack in %s on line %d
+bool(false)
+NULL
+
+Warning: system(): NULL byte detected. Possible attack in %s on line %d
+bool(false)
+
+Warning: passthru(): NULL byte detected. Possible attack in %s on line %d
+bool(false)
@@ -0,0 +1,13 @@
+--TEST--
+Bug #68925 (CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow)
+--FILE--
+<?php
+var_dump(gethostbyname(str_repeat("0", 2501)));
+var_dump(gethostbynamel(str_repeat("0", 2501)));
+?>
+--EXPECTF--
+Warning: gethostbyname(): Host name is too long, the limit is %d characters in %s/bug68925.php on line %d
+string(2501) "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+
+Warning: gethostbynamel(): Host name is too long, the limit is %d characters in %s/bug68925.php on line %d
+bool(false)
@@ -0,0 +1,11 @@
+--TEST--
+Bug #68545 NULL pointer dereference in unserialize.c:var_push_dtor
+--FILE--
+<?php 
+var_dump(unserialize('a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"bar";s:3:"foo";a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"bar";s:3:"foo";s:3:"bar";a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"bar";s:3:"foo";a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"b22";s:3:"bar";s:3:"bar";s:3:"foo";s:3:"bar";a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"bar";s:3:"foo";s:3:"bar";s:3:"bar";')); 
+?>
+===DONE===
+--EXPECTF--
+Notice: unserialize(): Error at offset %d of %d bytes in %sbug68545.php on line %d
+bool(false)
+===DONE===
@@ -0,0 +1,23 @@
+--TEST--
+Bug #68545 Use after free vulnerability in unserialize()
+--FILE--
+<?php
+for ($i=4; $i<100; $i++) {
+	$m = new StdClass();
+
+	$u = array(1);
+
+	$m->aaa = array(1,2,&$u,4,5);
+	$m->bbb = 1;
+	$m->ccc = &$u;
+	$m->ddd = str_repeat("A", $i);
+
+	$z = serialize($m);
+	$z = str_replace("bbb", "aaa", $z);
+	$y = unserialize($z);
+	$z = serialize($y);
+}
+?>
+===DONE===
+--EXPECTF--
+===DONE===
@@ -0,0 +1,25 @@
+--TEST--
+Bug #68710 Use after free vulnerability in unserialize() (bypassing the
+CVE-2014-8142 fix)
+--FILE--
+<?php
+for ($i=4; $i<100; $i++) {
+    $m = new StdClass();
+
+    $u = array(1);
+
+    $m->aaa = array(1,2,&$u,4,5);
+    $m->bbb = 1;
+    $m->ccc = &$u;
+    $m->ddd = str_repeat("A", $i);
+
+    $z = serialize($m);
+    $z = str_replace("aaa", "123", $z);
+    $z = str_replace("bbb", "123", $z);
+    $y = unserialize($z);
+    $z = serialize($y);
+}
+?>
+===DONE===
+--EXPECTF--
+===DONE===
@@ -18,8 +18,10 @@ $tests =array(
 	array('$2x$05$/OK.fbVrR/bpIqNJ5ianF.CE5elHaaO4EbggVDjb8P19RukzXSM3e', "\xff\xff\xa3"),
 	array('$2y$05$/OK.fbVrR/bpIqNJ5ianF.CE5elHaaO4EbggVDjb8P19RukzXSM3e', "\xff\xff\xa3"),
 	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.nqd1wy.pTMdcvrRWxyiGL2eMz.2a85.', "\xff\xff\xa3"),
+	array('$2b$05$/OK.fbVrR/bpIqNJ5ianF.CE5elHaaO4EbggVDjb8P19RukzXSM3e', "\xff\xff\xa3"),
 	array('$2y$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq', "\xa3"),
 	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq', "\xa3"),
+	array('$2b$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq', "\xa3"),
 	array('$2x$05$/OK.fbVrR/bpIqNJ5ianF.o./n25XVfn6oAPaUvHe.Csk4zRfsYPi', "1\xa3345"),
 	array('$2x$05$/OK.fbVrR/bpIqNJ5ianF.o./n25XVfn6oAPaUvHe.Csk4zRfsYPi', "\xff\xa3345"),
 	array('$2x$05$/OK.fbVrR/bpIqNJ5ianF.o./n25XVfn6oAPaUvHe.Csk4zRfsYPi', "\xff\xa334\xff\xff\xff\xa3345"),
@@ -36,14 +38,35 @@ $tests =array(
 	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.R9xrDjiycxMbQE2bp.vgqlYpW5wx2yy', "\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55"),
 	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.9tQZzcJfm3uj2NvJ/n5xkhpqLrMpWCe', "\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff"),
 	array('$2a$05$CCCCCCCCCCCCCCCCCCCCC.7uG0VCzI2bS7j6ymqJi9CdcdxiRTWNy', ''),
-
 );
+
+$tests2 = array(
+	array('$2a$03$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2a$32$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2c$05$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2z$05$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2`$05$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2{$05$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('*0', '*1'),
+);
+
 $i=0;
 foreach($tests as $test) {
-  if(crypt($test[1], $test[0]) == $test[0]) {
+  $result = crypt($test[1], $test[0]);
+  if($result === $test[0]) {
    echo "$i. OK\n";
  } else {
-    echo "$i. Not OK: $test[0] ".crypt($test[1], $test[0])."\n";
+    echo "$i. Not OK: $test[0] $result\n";
+  }
+  $i++;
+}
+
+foreach($tests2 as $test) {
+  $result = crypt('', $test[0]);
+  if($result === $test[1]) {
+    echo "$i. OK\n";
+  } else {
+    echo "$i. Not OK: $test[0] $result\n";
  }
  $i++;
 }
@@ -76,3 +99,12 @@ foreach($tests as $test) {
 23. OK
 24. OK
 25. OK
+26. OK
+27. OK
+28. OK
+29. OK
+30. OK
+31. OK
+32. OK
+33. OK
+34. OK
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 */
+/* Generated by re2c 0.13.7.5 on Thu Jan  1 14:43:18 2015 */
 #line 1 "ext/standard/var_unserializer.re"
 /*
  +----------------------------------------------------------------------+
@@ -61,7 +61,13 @@ static inline void var_push(php_unserialize_data_t *var_hashx, zval **rval)

 PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)
 {
-	var_entries *var_hash = (*var_hashx)->last_dtor;
+	var_entries *var_hash;
+
+	if (!var_hashx || !*var_hashx) {
+		return;
+	}
+
+	var_hash = (*var_hashx)->last_dtor;
 #if VAR_ENTRIES_DBG
 	fprintf(stderr, "var_push_dtor(%ld): %d\n", var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval));
 #endif
@@ -227,7 +233,7 @@ static char *unserialize_str(const unsigned char **p, size_t *len, size_t maxlen
 #define YYMARKER marker


-#line 235 "ext/standard/var_unserializer.re"
+#line 241 "ext/standard/var_unserializer.re"



@@ -337,6 +343,9 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 		} else {
 			/* object properties should include no integers */
 			convert_to_string(key);
+			if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
+				var_push_dtor(var_hash, old_data);
+			}
 			zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data,
 					sizeof data, NULL);
 		}
@@ -474,7 +483,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	
 	

-#line 478 "ext/standard/var_unserializer.c"
+#line 487 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -534,9 +543,9 @@ yy2:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy95;
 yy3:
-#line 829 "ext/standard/var_unserializer.re"
+#line 838 "ext/standard/var_unserializer.re"
 	{ return 0; }
-#line 540 "ext/standard/var_unserializer.c"
+#line 549 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy89;
@@ -579,13 +588,13 @@ yy13:
 	goto yy3;
 yy14:
 	++YYCURSOR;
-#line 823 "ext/standard/var_unserializer.re"
+#line 832 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-#line 589 "ext/standard/var_unserializer.c"
+#line 598 "ext/standard/var_unserializer.c"
 yy16:
 	yych = *++YYCURSOR;
 	goto yy3;
@@ -611,11 +620,12 @@ yy20:
 	if (yybm[0+yych] & 128) {
 		goto yy20;
 	}
-	if (yych != ':') goto yy18;
+	if (yych <= '/') goto yy18;
+	if (yych >= ';') goto yy18;
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 677 "ext/standard/var_unserializer.re"
+#line 686 "ext/standard/var_unserializer.re"
 	{
 	size_t len, len2, len3, maxlen;
 	long elements;
@@ -761,7 +771,7 @@ yy20:

 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 765 "ext/standard/var_unserializer.c"
+#line 775 "ext/standard/var_unserializer.c"
 yy25:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -786,7 +796,7 @@ yy27:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 669 "ext/standard/var_unserializer.re"
+#line 678 "ext/standard/var_unserializer.re"
 	{

 	INIT_PZVAL(*rval);
@@ -794,7 +804,7 @@ yy27:
 	return object_common2(UNSERIALIZE_PASSTHRU,
 			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
 }
-#line 798 "ext/standard/var_unserializer.c"
+#line 808 "ext/standard/var_unserializer.c"
 yy32:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy33;
@@ -815,7 +825,7 @@ yy34:
 	yych = *++YYCURSOR;
 	if (yych != '{') goto yy18;
 	++YYCURSOR;
-#line 649 "ext/standard/var_unserializer.re"
+#line 658 "ext/standard/var_unserializer.re"
 	{
 	long elements = parse_iv(start + 2);
 	/* use iv() not uiv() in order to check data range */
@@ -835,7 +845,7 @@ yy34:

 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 839 "ext/standard/var_unserializer.c"
+#line 849 "ext/standard/var_unserializer.c"
 yy39:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy40;
@@ -856,7 +866,7 @@ yy41:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 620 "ext/standard/var_unserializer.re"
+#line 629 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -885,7 +895,7 @@ yy41:
 	ZVAL_STRINGL(*rval, str, len, 0);
 	return 1;
 }
-#line 889 "ext/standard/var_unserializer.c"
+#line 899 "ext/standard/var_unserializer.c"
 yy46:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy47;
@@ -906,7 +916,7 @@ yy48:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 592 "ext/standard/var_unserializer.re"
+#line 601 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -934,7 +944,7 @@ yy48:
 	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-#line 938 "ext/standard/var_unserializer.c"
+#line 948 "ext/standard/var_unserializer.c"
 yy53:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
@@ -1022,7 +1032,7 @@ yy61:
 	}
 yy63:
 	++YYCURSOR;
-#line 582 "ext/standard/var_unserializer.re"
+#line 591 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 use_double:
@@ -1032,7 +1042,7 @@ use_double:
 	ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-#line 1036 "ext/standard/var_unserializer.c"
+#line 1046 "ext/standard/var_unserializer.c"
 yy65:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1091,7 +1101,7 @@ yy73:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 567 "ext/standard/var_unserializer.re"
+#line 576 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
@@ -1106,7 +1116,7 @@ yy73:

 	return 1;
 }
-#line 1110 "ext/standard/var_unserializer.c"
+#line 1120 "ext/standard/var_unserializer.c"
 yy76:
 	yych = *++YYCURSOR;
 	if (yych == 'N') goto yy73;
@@ -1133,7 +1143,7 @@ yy79:
 	if (yych <= '9') goto yy79;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 540 "ext/standard/var_unserializer.re"
+#line 549 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 	int digits = YYCURSOR - start - 3;
@@ -1160,7 +1170,7 @@ yy79:
 	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1164 "ext/standard/var_unserializer.c"
+#line 1174 "ext/standard/var_unserializer.c"
 yy83:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
@@ -1168,24 +1178,24 @@ yy83:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 533 "ext/standard/var_unserializer.re"
+#line 542 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_BOOL(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1179 "ext/standard/var_unserializer.c"
+#line 1189 "ext/standard/var_unserializer.c"
 yy87:
 	++YYCURSOR;
-#line 526 "ext/standard/var_unserializer.re"
+#line 535 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_NULL(*rval);
 	return 1;
 }
-#line 1189 "ext/standard/var_unserializer.c"
+#line 1199 "ext/standard/var_unserializer.c"
 yy89:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1208,7 +1218,7 @@ yy91:
 	if (yych <= '9') goto yy91;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 503 "ext/standard/var_unserializer.re"
+#line 512 "ext/standard/var_unserializer.re"
 	{
 	long id;

@@ -1231,7 +1241,7 @@ yy91:
 	
 	return 1;
 }
-#line 1235 "ext/standard/var_unserializer.c"
+#line 1245 "ext/standard/var_unserializer.c"
 yy95:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1254,7 +1264,7 @@ yy97:
 	if (yych <= '9') goto yy97;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 482 "ext/standard/var_unserializer.re"
+#line 491 "ext/standard/var_unserializer.re"
 	{
 	long id;

@@ -1275,9 +1285,9 @@ yy97:
 	
 	return 1;
 }
-#line 1279 "ext/standard/var_unserializer.c"
+#line 1289 "ext/standard/var_unserializer.c"
 }
-#line 831 "ext/standard/var_unserializer.re"
+#line 840 "ext/standard/var_unserializer.re"


 	return 0;
@@ -59,7 +59,13 @@ static inline void var_push(php_unserialize_data_t *var_hashx, zval **rval)

 PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)
 {
-	var_entries *var_hash = (*var_hashx)->last_dtor;
+	var_entries *var_hash;
+
+	if (!var_hashx || !*var_hashx) {
+		return;
+	}
+
+	var_hash = (*var_hashx)->last_dtor;
 #if VAR_ENTRIES_DBG
 	fprintf(stderr, "var_push_dtor(%ld): %d\n", var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval));
 #endif
@@ -341,6 +347,9 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 		} else {
 			/* object properties should include no integers */
 			convert_to_string(key);
+			if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
+				var_push_dtor(var_hash, old_data);
+			}
 			zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data,
 					sizeof data, NULL);
 		}
@@ -743,13 +743,8 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 		/* new line/NUL character safety check */
 		int i;
 		for (i = 0; i < header_line_len; i++) {
-			/* RFC 2616 allows new lines if followed by SP or HT */
-			int illegal_break =
-					(header_line[i+1] != ' ' && header_line[i+1] != '\t')
-					&& (
-						header_line[i] == '\n'
-						|| (header_line[i] == '\r' && header_line[i+1] != '\n'));
-			if (illegal_break) {
+			/* RFC 7230 ch. 3.2.4 deprecates folding support */
+			if (header_line[i] == '\n' || header_line[i] == '\r') {
 				efree(header_line);
 				sapi_module.sapi_error(E_WARNING, "Header may not contain "
 						"more than a single header, new line detected");
@@ -24,6 +24,7 @@
 #include "php.h"

 #include <stddef.h>
+#include <errno.h>

 #ifdef PHP_WIN32
 # include "win32/inet.h"
@@ -243,7 +244,12 @@ PHPAPI int php_network_getaddresses(const char *host, int socktype, struct socka
 #else
 	if (!inet_aton(host, &in)) {
 		/* XXX NOT THREAD SAFE (is safe under win32) */
-		host_info = gethostbyname(host);
+		if(strlen(host) > MAXFQDNLEN) {
+			host_info = NULL;
+			errno = E2BIG;
+		} else {
+			host_info = gethostbyname(host);
+		}
 		if (host_info == NULL) {
 			if (error_string) {
 				spprintf(error_string, 0, "php_network_getaddresses: gethostbyname failed. errno=%d", errno);
@@ -311,6 +311,10 @@ END_EXTERN_C()

 /* }}} */

+#ifndef MAXFQDNLEN
+#define MAXFQDNLEN 255
+#endif
+
 #endif /* _PHP_NETWORK_H */

 /*
@@ -2,8 +2,7 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 4
-#define PHP_RELEASE_VERSION 35
-
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.4.35-dev"
-#define PHP_VERSION_ID 50435
+#define PHP_RELEASE_VERSION 38
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.4.38"
+#define PHP_VERSION_ID 50438
@@ -796,6 +796,11 @@ PHPAPI int vspprintf(char **pbuf, size_t max_len, const char *format, va_list ap
 {
 	smart_str xbuf = {0};

+	/* since there are places where (v)spprintf called without checking for null,
+	   a bit of defensive coding here */
+	if(!pbuf) {
+		return 0;
+	}
 	xbuf_format_converter(&xbuf, format, ap);

 	if (max_len && xbuf.len > max_len) {
@@ -240,6 +240,7 @@ $ini_overwrites = array(
 		'ignore_repeated_errors=0',
 		'precision=14',
 		'memory_limit=128M',
+		'log_errors_max_len=0',
 	);

 function write_information($show_html)
@@ -2429,14 +2429,17 @@ consult the installation file that came with this distribution, or visit \n\
 						    int i = 1;

 						    c = file_handle.handle.stream.mmap.buf[i++];
-							while (c != '\n' && c != '\r' && c != EOF) {
+							while (c != '\n' && c != '\r' && i < file_handle.handle.stream.mmap.len) {
 								c = file_handle.handle.stream.mmap.buf[i++];
 							}
 							if (c == '\r') {
-								if (file_handle.handle.stream.mmap.buf[i] == '\n') {
+								if (i < file_handle.handle.stream.mmap.len && file_handle.handle.stream.mmap.buf[i] == '\n') {
 									i++;
 								}
 							}
+							if(i > file_handle.handle.stream.mmap.len) {
+								i = file_handle.handle.stream.mmap.len;
+							}
 							file_handle.handle.stream.mmap.buf += i;
 							file_handle.handle.stream.mmap.len -= i;
 						}
@@ -27,6 +27,10 @@
 #include <stdarg.h>
 #include <errno.h>

+#ifndef MAXFQDNLEN
+#define MAXFQDNLEN 255
+#endif
+
 #ifdef _WIN32

 #include <windows.h>
@@ -611,7 +615,11 @@ int fcgi_listen(const char *path, int backlog)
 			if (sa.sa_inet.sin_addr.s_addr == INADDR_NONE) {
 				struct hostent *hep;

-				hep = gethostbyname(host);
+				if(strlen(host) > MAXFQDNLEN) {
+					hep = NULL;
+				} else {
+					hep = gethostbyname(host);
+				}
 				if (!hep || hep->h_addrtype != AF_INET || !hep->h_addr_list[0]) {
 					fprintf(stderr, "Cannot resolve host name '%s'!\n", host);
 					return -1;
@@ -466,7 +466,7 @@ static sapi_module_struct lsapi_sapi_module =
 };
 /* }}} */

-static int init_request_info( TSRMLS_D )
+static void init_request_info( TSRMLS_D )
 {
    char * pContentType = LSAPI_GetHeader( H_CONTENT_TYPE );
    char * pAuth;
@@ -3376,7 +3376,7 @@ void lsapi_MD5Final(unsigned char digest[16], struct lsapi_MD5Context *ctx)
    lsapi_MD5Transform(ctx->buf, (uint32 *) ctx->in);
    byteReverse((unsigned char *) ctx->buf, 4);
    memmove(digest, ctx->buf, 16);
-    memset(ctx, 0, sizeof(ctx));        /* In case it's sensitive */
+    memset(ctx, 0, sizeof(*ctx));        /* In case it's sensitive */
 }

 /* The four core functions - F1 is optimized somewhat */
Author	SHA1	Message	Date
Stanislav Malyshev	124321fce5	5.4.38	2015-02-17 07:27:21 +01:00
Stanislav Malyshev	bdfe457a2c	Port for for bug #68552	2015-02-17 06:53:02 +01:00
Stanislav Malyshev	7b18981830	Fix bug #68942 (Use after free vulnerability in unserialize() with DateTimeZone) Conflicts: ext/date/php_date.c	2015-02-17 06:43:51 +01:00
Felipe Pena	82d347a477	- BFN	2015-02-17 01:14:05 -02:00
Felipe Pena	8f9ab04d93	- Fixed bug #67827 (broken detection of system crypt sha256/sha512 support)	2015-02-17 00:23:47 -02:00
Felipe Pena	e08bef442c	- Fixed bug #67427 (SoapServer cannot handle large messages) patch by: brandt at docoloc dot de	2015-02-16 13:07:26 -02:00
Yasuo Ohgaki	5b6269a253	Update NEWS	2015-02-14 05:34:57 +09:00
Yasuo Ohgaki	a8722f5330	Add NULL byte protection to exec, system and passthru	2015-02-14 05:25:04 +09:00
George Wang	5e3f0f5671	Fixed #68790 (Missing return)	2015-02-07 12:16:54 -05:00
Stanislav Malyshev	f001c63073	Update header handling to RFC 7230	2015-02-05 20:08:12 -08:00
Stanislav Malyshev	7efbd70b03	fix sizeof size	2015-02-01 12:40:38 -08:00
Stanislav Malyshev	94d6cb4a78	fix TSRM	2015-01-31 23:34:14 -08:00
Stanislav Malyshev	b30a6d6018	Use better constant since MAXHOSTNAMELEN may mean shorter name	2015-01-31 21:46:56 -08:00
Stanislav Malyshev	2cdbd3537f	use right sizeof for memset	2015-01-31 21:30:58 -08:00
Stanislav Malyshev	0f9c708229	Add mitigation for CVE-2015-0235 (bug #68925 )	2015-01-31 19:08:13 -08:00
Ferenc Kovacs	61ad5e24ea	fix some factual errors in the process	2015-01-22 21:27:38 +01:00
Stanislav Malyshev	b3b155ffe2	format	2015-01-20 11:57:17 -08:00
Stanislav Malyshev	547f62ed2a	add CVE	2015-01-20 11:54:45 -08:00
Stanislav Malyshev	ef4896d956	add protection against nulls	2015-01-20 11:46:10 -08:00
Stanislav Malyshev	8825311ce1	5.4.38 next	2015-01-20 10:38:33 -08:00
Stanislav Malyshev	e63f7b47e1	Merge branch 'bug68710' into PHP-5.4 * bug68710: Fix for bug #68710 (Use After Free Vulnerability in PHP's unserialize())	2015-01-20 01:02:26 -08:00
Stanislav Malyshev	fc6aa939f5	Merge branch 'bug68799' into PHP-5.4 * bug68799: Fix bug #68799: Free called on unitialized pointer	2015-01-20 01:00:11 -08:00
Daniel Lowrey	0a76610459	Update NEWS	2015-01-14 18:03:27 +01:00
Daniel Lowrey	e2fe8e164f	Fixed bug #55618 (use case-insensitive cert name matching)	2015-01-14 18:02:50 +01:00
Stanislav Malyshev	2fc178cf44	Fix bug #68799 : Free called on unitialized pointer	2015-01-11 00:51:05 -08:00
Anatol Belski	ebb98e7aeb	updated libmagic.patch in 5.4	2015-01-04 17:04:13 +01:00
Anatol Belski	ede59c8feb	Fixed bug #68735 fileinfo out-of-bounds memory access	2015-01-04 14:20:21 +01:00
Remi Collet	919abf0cb1	removed dead code	2015-01-04 09:40:19 +01:00
Stanislav Malyshev	b585a3aed7	Fix for bug #68710 (Use After Free Vulnerability in PHP's unserialize())	2015-01-01 16:19:05 -08:00
Stanislav Malyshev	f9ad308669	FIx bug #68618 (out of bounds read crashes php-cgi)	2014-12-30 01:23:05 -08:00
Ferenc Kovacs	cd387b4575	add missing NEWS entry	2014-12-17 02:10:36 +01:00
Stanislav Malyshev	8fe4cc6d28	5.4.37	2014-12-16 11:44:41 -08:00
Stanislav Malyshev	53f129a44d	add CVE	2014-12-16 10:16:31 -08:00
Stanislav Malyshev	b75867fff0	add missing test file	2014-12-16 10:15:17 -08:00
Stanislav Malyshev	630f9c33c2	Fix bug #68594 - Use after free vulnerability in unserialize()	2014-12-16 10:15:17 -08:00
Andrea Faulds	034e6decb3	Fix undefined behaviour in strnatcmp	2014-12-13 22:27:10 +00:00
Stanislav Malyshev	97df260b27	update NEWS	2014-12-11 10:41:17 -08:00
Anatol Belski	0323f66fa2	move the test to the right place	2014-12-11 10:39:47 -08:00
Anatol Belski	13f1c276ab	Fixed bug #68545 NULL pointer dereference in unserialize.c	2014-12-11 10:39:37 -08:00
Dmitry Stogov	dd791cd717	Fixed possible read after end of buffer and use after free.	2014-12-08 12:18:27 +03:00
Chris Christoff	0e985d3726	Revert unintentional docblock change Revert unintentional docblock change It looks like commit `dd8e59da8f` introduced an unintended docbloc change. I have reverted this change in this commit.	2014-12-05 13:57:03 -08:00
Ferenc Kovacs	b28c3eb47e	make sure that we don't truncate the stack trace and cause false test failures when the test is executed in a directory with long path	2014-12-02 19:17:58 +01:00
Stanislav Malyshev	84be568366	update news	2014-11-30 21:37:39 -08:00
Leigh	301b7f990a	Apply error-code-salt fix to Windows too Conflicts: ext/standard/crypt.c	2014-11-30 21:07:31 -08:00
Leigh	7e870c596d	Bug fixes in light of failing bcrypt tests Conflicts: ext/standard/crypt.c	2014-11-30 21:06:39 -08:00
Leigh	2d9d10fbbf	Add tests from 1.3. Add missing tests. 3 of the missing tests fail. // TODO	2014-11-30 21:05:40 -08:00
Leigh	29f51e1ca9	Upgrade crypt_blowfish to version 1.3	2014-11-30 21:05:32 -08:00
Stanislav Malyshev	7dbc5e5c69	update for LiteSpeed	2014-11-23 18:05:26 -08:00
Stanislav Malyshev	96cde1841a	Revert "made lsapi_main.c compatible with PHP7/phpng ." This reverts commit `9fb816f45a`. Not a security-related fix.	2014-11-22 00:38:04 -08:00
George Wang	9fb816f45a	made lsapi_main.c compatible with PHP7/phpng .	2014-11-20 16:49:01 -05:00
Stanislav Malyshev	98b22864ff	5.4.36-dev	2014-11-11 16:31:38 -08:00