5.5.31

* pr-1483:
  fixup, both catched by nikic
  use another character device in this test as /dev/console seems that it is different for lxc containers
  the de_DE(iso-8859-1) locale is not available on ubuntu by default, but there is no reason to require that over the utf-8 one
  let's try running our testsuite without sudo

.travis.yml

@@ -1,5 +1,15 @@
 language: c
-
+sudo: false
+addons:
+  apt:
+    packages:
+      - locales
+      - language-pack-de
+      - re2c
+      - libgmp-dev
+      - libicu-dev
+      - libmcrypt-dev
+      - libtidy-dev
 notifications:
     email: 
        on_failure: change
@@ -27,11 +37,6 @@ env:
       - ENABLE_MAINTAINER_ZTS=0 ENABLE_DEBUG=0
       - ENABLE_MAINTAINER_ZTS=1 ENABLE_DEBUG=1
 
-before_install:
-    - sudo cp ./travis/de /var/lib/locales/supported.d/de
-    - sudo dpkg-reconfigure locales
-    - ./travis/install.sh
-
 before_script:
     # Compile PHP
     - ./travis/compile.sh

NEWS

@@ -1,12 +1,30 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-** PHP 5.5 is in security-only mode , please do not commit to this branch **
 
-?? ??? 2015, PHP 5.5.30
+07 Jan 2015, PHP 5.5.31
+
+- FPM:
+  . Fixed bug #70755 (fpm_log.c memory leak and buffer overflow). (Stas)
+
+- GD:
+  . Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index
+    Out of Bounds). (emmanuel dot law at gmail dot com).
+
+- WDDX:
+  . Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization).
+    (taoguangchen at icloud dot com)
+  . Fixed bug #70741 (Session WDDX Packet Deserialization Type Confusion
+    Vulnerability). (taoguangchen at icloud dot com)
+
+- XMLRPC:
+  . Fixed bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker()).
+    (Julien)
+
+01 Oct 2015, PHP 5.5.30
 
 - Phar:
   . Fixed bug #69720 (Null pointer dereference in phar_get_fp_offset()). (Stas)
-  . FIxed bug #70433 (Uninitialized pointer in phar_make_dirstream when zip
+  . Fixed bug #70433 (Uninitialized pointer in phar_make_dirstream when zip
     entry filename is "/"). (Stas)
 
 03 Sep 2015, PHP 5.5.29

configure.in

@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=5
-PHP_RELEASE_VERSION=30
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=31
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/gd/libgd/gd_interpolation.c

@@ -2154,7 +2154,7 @@ gdImagePtr gdImageRotateInterpolated(const gdImagePtr src, const float angle, in
 {
 	const int angle_rounded = (int)floor(angle * 100);
 
-	if (bgcolor < 0) {
+	if (bgcolor < 0 || (!src->trueColor && bgcolor >= gdMaxColors)) {
 		return NULL;
 	}
 

ext/gd/tests/bug70976.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds)
+--SKIPIF--
+<?php
+	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
+?>
+--FILE--
+<?php
+$img = imagerotate(imagecreate(1,1),45,0x7ffffff9);
+var_dump($img);
+?>
+--EXPECTF--
+bool(false)

ext/intl/tests/bug67052.phpt

@@ -12,7 +12,7 @@ if (substr(PHP_OS, 0, 3) == 'WIN') {
 
 function ut_main()
 {
-        setlocale(LC_ALL, 'de_DE');
+        setlocale(LC_ALL, 'de_DE.UTF-8');
         $fmt = new NumberFormatter( 'sl_SI.UTF-8', NumberFormatter::DECIMAL);
         $num = "1.234.567,891";
         $res_str =  $fmt->parse($num)."\n";
@@ -26,5 +26,5 @@ ut_run();
 ?>
 --EXPECT--
 1234567,891
-de_DE
+de_DE.UTF-8
 

ext/phar/tests/bug70433.phpt

@@ -1,7 +1,7 @@
 --TEST--
 Phar - bug #70433 - Uninitialized pointer in phar_make_dirstream when zip entry filename is "/"
 --SKIPIF--
-<?php if (!extension_loaded("phar")) die("skip"); ?>
+<?php if (!extension_loaded("phar") || !extension_loaded("zlib")) die("skip"); ?>
 --FILE--
 <?php
 $phar = new PharData(__DIR__."/bug70433.zip");

ext/standard/tests/file/filetype_variation2.phpt

@@ -7,8 +7,8 @@ Dave Kelsey <d_kelsey@uk.ibm.com>
 if (substr(PHP_OS, 0, 3) == 'WIN') {
     die('skip no /dev on Windows');
 }
-if (!file_exists("/dev/console")) {
-    die('skip /dev/console not available');
+if (!file_exists("/dev/null")) {
+    die('skip /dev/null not available');
 }    
 ?>
 --FILE--
@@ -20,7 +20,7 @@ Description: Returns the type of the file. Possible values are fifo, char,
 */
 
 echo "-- Checking for char --\n";
-print( filetype("/dev/console") )."\n";
+print( filetype("/dev/null") )."\n";
 ?>
 ===DONE===
 --EXPECTF--

ext/wddx/tests/bug70661.phpt

@@ -0,0 +1,69 @@
+--TEST--
+Bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization)
+--SKIPIF--
+<?php
+if (!extension_loaded("wddx")) print "skip";
+?>
+--FILE--
+<?php
+$fakezval = ptr2str(1122334455);
+$fakezval .= ptr2str(0);
+$fakezval .= "\x00\x00\x00\x00";
+$fakezval .= "\x01";
+$fakezval .= "\x00";
+$fakezval .= "\x00\x00";
+
+$x = <<<EOT
+<?xml version='1.0'?>
+<wddxPacket version='1.0'>
+<header/>
+	<data>
+		<struct>
+			<recordset rowCount='1' fieldNames='ryat'>
+				<field name='ryat'>
+					<var name='php_class_name'>
+						<string>stdClass</string>
+					</var>
+					<null/>
+				</field>
+			</recordset>
+		</struct>	
+	</data>
+</wddxPacket>
+EOT;
+
+$y = wddx_deserialize($x);
+
+for ($i = 0; $i < 5; $i++) {
+	$v[$i] = $fakezval.$i;
+}
+
+var_dump($y);
+
+function ptr2str($ptr)
+{
+	$out = '';
+	
+	for ($i = 0; $i < 8; $i++) {
+		$out .= chr($ptr & 0xff);
+		$ptr >>= 8;
+	}
+	
+	return $out;
+}
+?>
+DONE
+--EXPECTF--
+array(1) {
+  [0]=>
+  array(1) {
+    ["ryat"]=>
+    array(2) {
+      ["php_class_name"]=>
+      string(8) "stdClass"
+      [0]=>
+      NULL
+    }
+  }
+}
+DONE

ext/wddx/tests/bug70741.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability)
+--SKIPIF--
+<?php
+if (!extension_loaded("wddx")) print "skip";
+?>
+--FILE--
+<?php
+ini_set('session.serialize_handler', 'wddx');
+session_start();
+
+$hashtable = str_repeat('A', 66);
+$wddx = "<?xml version='1.0'?>
+<wddxPacket version='1.0'>
+<header/>
+	<data>
+		<string>$hashtable</string>
+	</data>
+</wddxPacket>";
+session_decode($wddx);
+?>
+DONE
+--EXPECTF--
+
+Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s on line %d
+DONE

ext/wddx/wddx.c

@@ -72,7 +72,7 @@
 			stack->varname = NULL;					\
 		} else										\
 			ent.varname = NULL;						\
-			
+
 static int le_wddx;
 
 typedef struct {
@@ -171,7 +171,7 @@ zend_module_entry wddx_module_entry = {
 /* }}} */
 
 /* {{{ wddx_stack_init
- */	
+ */
 static int wddx_stack_init(wddx_stack *stack)
 {
 	stack->top = 0;
@@ -239,7 +239,7 @@ static int wddx_stack_destroy(wddx_stack *stack)
 				efree(((st_entry *)stack->elements[i])->varname);
 			}
 			efree(stack->elements[i]);
-		}		
+		}
 		efree(stack->elements);
 	}
 	return SUCCESS;
@@ -270,16 +270,16 @@ PS_SERIALIZER_ENCODE_FUNC(wddx)
 
 	php_wddx_packet_start(packet, NULL, 0);
 	php_wddx_add_chunk_static(packet, WDDX_STRUCT_S);
-	
+
 	PS_ENCODE_LOOP(
 		php_wddx_serialize_var(packet, *struc, key, key_length TSRMLS_CC);
 	);
-	
+
 	php_wddx_add_chunk_static(packet, WDDX_STRUCT_E);
 	php_wddx_packet_end(packet);
 	*newstr = php_wddx_gather(packet);
 	php_wddx_destructor(packet);
-	
+
 	if (newlen) {
 		*newlen = strlen(*newstr);
 	}
@@ -304,11 +304,14 @@ PS_SERIALIZER_DECODE_FUNC(wddx)
 	if (vallen == 0) {
 		return SUCCESS;
 	}
-	
+
 	MAKE_STD_ZVAL(retval);
 
 	if ((ret = php_wddx_deserialize_ex((char *)val, vallen, retval)) == SUCCESS) {
-
+		if (Z_TYPE_P(retval) != IS_ARRAY) {
+			zval_ptr_dtor(&retval);
+			return FAILURE;
+		}
 		for (zend_hash_internal_pointer_reset(Z_ARRVAL_P(retval));
 			 zend_hash_get_current_data(Z_ARRVAL_P(retval), (void **) &ent) == SUCCESS;
 			 zend_hash_move_forward(Z_ARRVAL_P(retval))) {
@@ -343,7 +346,7 @@ PHP_MINIT_FUNCTION(wddx)
 	php_session_register_serializer("wddx",
 									PS_SERIALIZER_ENCODE_NAME(wddx),
 									PS_SERIALIZER_DECODE_NAME(wddx));
-#endif	
+#endif
 
 	return SUCCESS;
 }
@@ -387,7 +390,7 @@ void php_wddx_packet_start(wddx_packet *packet, char *comment, int comment_len)
 void php_wddx_packet_end(wddx_packet *packet)
 {
 	php_wddx_add_chunk_static(packet, WDDX_DATA_E);
-	php_wddx_add_chunk_static(packet, WDDX_PACKET_E);	
+	php_wddx_add_chunk_static(packet, WDDX_PACKET_E);
 }
 /* }}} */
 
@@ -423,14 +426,14 @@ static void php_wddx_serialize_number(wddx_packet *packet, zval *var)
 {
 	char tmp_buf[WDDX_BUF_LEN];
 	zval tmp;
-	
+
 	tmp = *var;
 	zval_copy_ctor(&tmp);
 	convert_to_string(&tmp);
 	snprintf(tmp_buf, sizeof(tmp_buf), WDDX_NUMBER, Z_STRVAL(tmp));
 	zval_dtor(&tmp);
 
-	php_wddx_add_chunk(packet, tmp_buf);	
+	php_wddx_add_chunk(packet, tmp_buf);
 }
 /* }}} */
 
@@ -473,7 +476,7 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 	if (call_user_function_ex(CG(function_table), &obj, fname, &retval, 0, 0, 1, NULL TSRMLS_CC) == SUCCESS) {
 		if (retval && (sleephash = HASH_OF(retval))) {
 			PHP_CLASS_ATTRIBUTES;
-			
+
 			PHP_SET_CLASS_ATTRIBUTES(obj);
 
 			php_wddx_add_chunk_static(packet, WDDX_STRUCT_S);
@@ -487,7 +490,7 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 			PHP_CLEANUP_CLASS_ATTRIBUTES();
 
 			objhash = HASH_OF(obj);
-			
+
 			for (zend_hash_internal_pointer_reset(sleephash);
 				 zend_hash_get_current_data(sleephash, (void **)&varname) == SUCCESS;
 				 zend_hash_move_forward(sleephash)) {
@@ -500,7 +503,7 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 					php_wddx_serialize_var(packet, *ent, Z_STRVAL_PP(varname), Z_STRLEN_PP(varname) TSRMLS_CC);
 				}
 			}
-			
+
 			php_wddx_add_chunk_static(packet, WDDX_STRUCT_E);
 		}
 	} else {
@@ -519,7 +522,7 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 		php_wddx_add_chunk_static(packet, WDDX_VAR_E);
 
 		PHP_CLEANUP_CLASS_ATTRIBUTES();
-		
+
 		objhash = HASH_OF(obj);
 		for (zend_hash_internal_pointer_reset(objhash);
 			 zend_hash_get_current_data(objhash, (void**)&ent) == SUCCESS;
@@ -530,7 +533,7 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 
 			if (zend_hash_get_current_key_ex(objhash, &key, &key_len, &idx, 0, NULL) == HASH_KEY_IS_STRING) {
 				const char *class_name, *prop_name;
-				
+
 				zend_unmangle_property_name(key, key_len-1, &class_name, &prop_name);
 				php_wddx_serialize_var(packet, *ent, prop_name, strlen(prop_name)+1 TSRMLS_CC);
 			} else {
@@ -613,7 +616,7 @@ static void php_wddx_serialize_array(wddx_packet *packet, zval *arr)
 			php_wddx_serialize_var(packet, *ent, NULL, 0 TSRMLS_CC);
 		}
 	}
-	
+
 	if (is_struct) {
 		php_wddx_add_chunk_static(packet, WDDX_STRUCT_E);
 	} else {
@@ -639,12 +642,12 @@ void php_wddx_serialize_var(wddx_packet *packet, zval *var, char *name, int name
 		efree(tmp_buf);
 		efree(name_esc);
 	}
-	
+
 	switch(Z_TYPE_P(var)) {
 		case IS_STRING:
 			php_wddx_serialize_string(packet, var TSRMLS_CC);
 			break;
-			
+
 		case IS_LONG:
 		case IS_DOUBLE:
 			php_wddx_serialize_number(packet, var);
@@ -657,14 +660,14 @@ void php_wddx_serialize_var(wddx_packet *packet, zval *var, char *name, int name
 		case IS_NULL:
 			php_wddx_serialize_unset(packet);
 			break;
-		
+
 		case IS_ARRAY:
 			ht = Z_ARRVAL_P(var);
 			if (ht->nApplyCount > 1) {
 				php_error_docref(NULL TSRMLS_CC, E_RECOVERABLE_ERROR, "WDDX doesn't support circular references");
 				return;
 			}
-			ht->nApplyCount++;															
+			ht->nApplyCount++;
 			php_wddx_serialize_array(packet, var);
 			ht->nApplyCount--;
 			break;
@@ -680,7 +683,7 @@ void php_wddx_serialize_var(wddx_packet *packet, zval *var, char *name, int name
 			ht->nApplyCount--;
 			break;
 	}
-	
+
 	if (name) {
 		php_wddx_add_chunk_static(packet, WDDX_VAR_E);
 	}
@@ -702,12 +705,12 @@ static void php_wddx_add_var(wddx_packet *packet, zval *name_var)
 		if (zend_hash_find(EG(active_symbol_table), Z_STRVAL_P(name_var),
 							Z_STRLEN_P(name_var)+1, (void**)&val) != FAILURE) {
 			php_wddx_serialize_var(packet, *val, Z_STRVAL_P(name_var), Z_STRLEN_P(name_var) TSRMLS_CC);
-		}		
+		}
 	} else if (Z_TYPE_P(name_var) == IS_ARRAY || Z_TYPE_P(name_var) == IS_OBJECT)	{
 		int is_array = Z_TYPE_P(name_var) == IS_ARRAY;
-		
+
 		target_hash = HASH_OF(name_var);
-		
+
 		if (is_array && target_hash->nApplyCount > 1) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
 			return;
@@ -737,10 +740,10 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 {
 	st_entry ent;
 	wddx_stack *stack = (wddx_stack *)user_data;
-	
+
 	if (!strcmp(name, EL_PACKET)) {
 		int i;
-		
+
 		if (atts) for (i=0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_VERSION)) {
 				/* nothing for now */
@@ -749,7 +752,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_STRING)) {
 		ent.type = ST_STRING;
 		SET_STACK_VARNAME;
-		
+
 		ALLOC_ZVAL(ent.data);
 		INIT_PZVAL(ent.data);
 		Z_TYPE_P(ent.data) = IS_STRING;
@@ -759,7 +762,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_BINARY)) {
 		ent.type = ST_BINARY;
 		SET_STACK_VARNAME;
-		
+
 		ALLOC_ZVAL(ent.data);
 		INIT_PZVAL(ent.data);
 		Z_TYPE_P(ent.data) = IS_STRING;
@@ -768,7 +771,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 		wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry));
 	} else if (!strcmp(name, EL_CHAR)) {
 		int i;
-		
+
 		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_CHAR_CODE) && atts[++i] && atts[i][0]) {
 				char tmp_buf[2];
@@ -781,7 +784,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_NUMBER)) {
 		ent.type = ST_NUMBER;
 		SET_STACK_VARNAME;
-		
+
 		ALLOC_ZVAL(ent.data);
 		INIT_PZVAL(ent.data);
 		Z_TYPE_P(ent.data) = IS_LONG;
@@ -810,12 +813,12 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 		ALLOC_ZVAL(ent.data);
 		INIT_PZVAL(ent.data);
 		ZVAL_NULL(ent.data);
-		
+
 		wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry));
 	} else if (!strcmp(name, EL_ARRAY)) {
 		ent.type = ST_ARRAY;
 		SET_STACK_VARNAME;
-		
+
 		ALLOC_ZVAL(ent.data);
 		array_init(ent.data);
 		INIT_PZVAL(ent.data);
@@ -823,14 +826,14 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_STRUCT)) {
 		ent.type = ST_STRUCT;
 		SET_STACK_VARNAME;
-		
+
 		ALLOC_ZVAL(ent.data);
 		array_init(ent.data);
 		INIT_PZVAL(ent.data);
 		wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry));
 	} else if (!strcmp(name, EL_VAR)) {
 		int i;
-		
+
 		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
 				stack->varname = estrdup(atts[i]);
@@ -885,13 +888,13 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 			if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
 				st_entry *recordset;
 				zval **field;
- 
+
 				if (wddx_stack_top(stack, (void**)&recordset) == SUCCESS &&
 					recordset->type == ST_RECORDSET &&
 					zend_hash_find(Z_ARRVAL_P(recordset->data), (char*)atts[i], strlen(atts[i])+1, (void**)&field) == SUCCESS) {
 					ent.data = *field;
 				}
-				
+
 				break;
 			}
 		}
@@ -900,7 +903,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_DATETIME)) {
 		ent.type = ST_DATETIME;
 		SET_STACK_VARNAME;
-		
+
 		ALLOC_ZVAL(ent.data);
 		INIT_PZVAL(ent.data);
 		Z_TYPE_P(ent.data) = IS_LONG;
@@ -962,20 +965,20 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
 		if (stack->top > 1) {
 			stack->top--;
 			wddx_stack_top(stack, (void**)&ent2);
-			
+
 			/* if non-existent field */
 			if (ent2->type == ST_FIELD && ent2->data == NULL) {
 				zval_ptr_dtor(&ent1->data);
 				efree(ent1);
 				return;
 			}
-			
+
 			if (Z_TYPE_P(ent2->data) == IS_ARRAY || Z_TYPE_P(ent2->data) == IS_OBJECT) {
 				target_hash = HASH_OF(ent2->data);
 
 				if (ent1->varname) {
 					if (!strcmp(ent1->varname, PHP_CLASS_NAME_VAR) &&
-						Z_TYPE_P(ent1->data) == IS_STRING && Z_STRLEN_P(ent1->data)) {
+						Z_TYPE_P(ent1->data) == IS_STRING && Z_STRLEN_P(ent1->data) && ent2->type == ST_STRUCT) {
 						zend_bool incomplete_class = 0;
 
 						zend_str_tolower(Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data));
@@ -988,7 +991,7 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
 						/* Initialize target object */
 						MAKE_STD_ZVAL(obj);
 						object_init_ex(obj, *pce);
-						
+
 						/* Merge current hashtable with object's default properties */
 						zend_hash_merge(Z_OBJPROP_P(obj),
 										Z_ARRVAL_P(ent2->data),
@@ -1001,15 +1004,15 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
 
 						/* Clean up old array entry */
 						zval_ptr_dtor(&ent2->data);
-						
+
 						/* Set stack entry to point to the newly created object */
 						ent2->data = obj;
-						
+
 						/* Clean up class name var entry */
 						zval_ptr_dtor(&ent1->data);
 					} else if (Z_TYPE_P(ent2->data) == IS_OBJECT) {
 						zend_class_entry *old_scope = EG(scope);
-	
+
 						EG(scope) = Z_OBJCE_P(ent2->data);
 						Z_DELREF_P(ent1->data);
 						add_property_zval(ent2->data, ent1->varname, ent1->data);
@@ -1048,7 +1051,7 @@ static void php_wddx_process_data(void *user_data, const XML_Char *s, int len)
 	if (!wddx_stack_is_empty(stack) && !stack->done) {
 		wddx_stack_top(stack, (void**)&ent);
 		switch (Z_TYPE_P(ent)) {
-			case ST_STRING: 
+			case ST_STRING:
 				if (Z_STRLEN_P(ent->data) == 0) {
 					STR_FREE(Z_STRVAL_P(ent->data));
 					Z_STRVAL_P(ent->data) = estrndup(s, len);
@@ -1127,16 +1130,16 @@ int php_wddx_deserialize_ex(char *value, int vallen, zval *return_value)
 	XML_Parser parser;
 	st_entry *ent;
 	int retval;
-	
+
 	wddx_stack_init(&stack);
 	parser = XML_ParserCreate("UTF-8");
 
 	XML_SetUserData(parser, &stack);
 	XML_SetElementHandler(parser, php_wddx_push_element, php_wddx_pop_element);
 	XML_SetCharacterDataHandler(parser, php_wddx_process_data);
-	
+
 	XML_Parse(parser, value, vallen, 1);
-	
+
 	XML_ParserFree(parser);
 
 	if (stack.top == 1) {
@@ -1147,7 +1150,7 @@ int php_wddx_deserialize_ex(char *value, int vallen, zval *return_value)
 	} else {
 		retval = FAILURE;
 	}
-		
+
 	wddx_stack_destroy(&stack);
 
 	return retval;
@@ -1162,17 +1165,17 @@ PHP_FUNCTION(wddx_serialize_value)
 	char *comment = NULL;
 	int comment_len = 0;
 	wddx_packet *packet;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "z|s", &var, &comment, &comment_len) == FAILURE) {
 		return;
 	}
-	
+
 	packet = php_wddx_constructor();
 
 	php_wddx_packet_start(packet, comment, comment_len);
 	php_wddx_serialize_var(packet, var, NULL, 0 TSRMLS_CC);
 	php_wddx_packet_end(packet);
-					
+
 	ZVAL_STRINGL(return_value, packet->c, packet->len, 1);
 	smart_str_free(packet);
 	efree(packet);
@@ -1190,19 +1193,19 @@ PHP_FUNCTION(wddx_serialize_vars)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "+", &args, &num_args) == FAILURE) {
 		return;
 	}
-		
+
 	packet = php_wddx_constructor();
 
 	php_wddx_packet_start(packet, NULL, 0);
 	php_wddx_add_chunk_static(packet, WDDX_STRUCT_S);
-	
+
 	for (i=0; i<num_args; i++) {
 		if (Z_TYPE_PP(args[i]) != IS_ARRAY && Z_TYPE_PP(args[i]) != IS_OBJECT) {
 			convert_to_string_ex(args[i]);
 		}
 		php_wddx_add_var(packet, *args[i]);
-	}	
-	
+	}
+
 	php_wddx_add_chunk_static(packet, WDDX_STRUCT_E);
 	php_wddx_packet_end(packet);
 
@@ -1251,7 +1254,7 @@ PHP_FUNCTION(wddx_packet_start)
 	}
 
 	packet = php_wddx_constructor();
-	
+
 	php_wddx_packet_start(packet, comment, comment_len);
 	php_wddx_add_chunk_static(packet, WDDX_STRUCT_S);
 
@@ -1265,15 +1268,15 @@ PHP_FUNCTION(wddx_packet_end)
 {
 	zval *packet_id;
 	wddx_packet *packet = NULL;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r", &packet_id) == FAILURE) {
 		return;
 	}
 
 	ZEND_FETCH_RESOURCE(packet, wddx_packet *, &packet_id, -1, "WDDX packet ID", le_wddx);
-			
-	php_wddx_add_chunk_static(packet, WDDX_STRUCT_E);	
-	
+
+	php_wddx_add_chunk_static(packet, WDDX_STRUCT_E);
+
 	php_wddx_packet_end(packet);
 
 	ZVAL_STRINGL(return_value, packet->c, packet->len, 1);
@@ -1290,7 +1293,7 @@ PHP_FUNCTION(wddx_add_vars)
 	zval ***args = NULL;
 	zval *packet_id;
 	wddx_packet *packet = NULL;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r+", &packet_id, &args, &num_args) == FAILURE) {
 		return;
 	}
@@ -1299,12 +1302,12 @@ PHP_FUNCTION(wddx_add_vars)
 		efree(args);
 		RETURN_FALSE;
 	}
-	
+
 	if (!packet) {
 		efree(args);
 		RETURN_FALSE;
 	}
-		
+
 	for (i=0; i<num_args; i++) {
 		if (Z_TYPE_PP(args[i]) != IS_ARRAY && Z_TYPE_PP(args[i]) != IS_OBJECT) {
 			convert_to_string_ex(args[i]);
@@ -1317,7 +1320,7 @@ PHP_FUNCTION(wddx_add_vars)
 }
 /* }}} */
 
-/* {{{ proto mixed wddx_deserialize(mixed packet) 
+/* {{{ proto mixed wddx_deserialize(mixed packet)
    Deserializes given packet and returns a PHP value */
 PHP_FUNCTION(wddx_deserialize)
 {
@@ -1325,7 +1328,7 @@ PHP_FUNCTION(wddx_deserialize)
 	char *payload;
 	int payload_len;
 	php_stream *stream = NULL;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "z", &packet) == FAILURE) {
 		return;
 	}
@@ -1348,7 +1351,7 @@ PHP_FUNCTION(wddx_deserialize)
 	}
 
 	php_wddx_deserialize_ex(payload, payload_len, return_value);
-		
+
 	if (stream) {
 		pefree(payload, 0);
 	}

ext/xmlrpc/tests/bug70728.phpt

@@ -0,0 +1,30 @@
+--TEST--
+Bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker)
+--SKIPIF--
+<?php
+if (!extension_loaded("xmlrpc")) print "skip";
+?>
+--FILE--
+<?php
+$obj = new stdClass;
+$obj->xmlrpc_type = 'base64';
+$obj->scalar = 0x1122334455;
+var_dump(xmlrpc_encode($obj));
+var_dump($obj);
+?>
+--EXPECTF--	
+string(135) "<?xml version="1.0" encoding="utf-8"?>
+<params>
+<param>
+ <value>
+  <base64>NzM1ODgyMjkyMDU=&#10;</base64>
+ </value>
+</param>
+</params>
+"
+object(stdClass)#1 (2) {
+  ["xmlrpc_type"]=>
+  string(6) "base64"
+  ["scalar"]=>
+  int(73588229205)
+}

ext/xmlrpc/xmlrpc-epi-php.c

@@ -532,7 +532,16 @@ static XMLRPC_VALUE PHP_to_XMLRPC_worker (const char* key, zval* in_val, int dep
 						xReturn = XMLRPC_CreateValueEmpty();
 						XMLRPC_SetValueID(xReturn, key, 0);
 					} else {
-						xReturn = XMLRPC_CreateValueBase64(key, Z_STRVAL_P(val), Z_STRLEN_P(val));
+						if (Z_TYPE_P(val) != IS_STRING) {
+							zval *newvalue;
+							ALLOC_INIT_ZVAL(newvalue);
+							MAKE_COPY_ZVAL(&val, newvalue);
+							convert_to_string(newvalue);
+							xReturn = XMLRPC_CreateValueBase64(key, Z_STRVAL_P(newvalue), Z_STRLEN_P(newvalue));
+							zval_ptr_dtor(&newvalue);
+						} else {
+							xReturn = XMLRPC_CreateValueBase64(key, Z_STRVAL_P(val), Z_STRLEN_P(val));
+						}
 					}
 					break;
 				case xmlrpc_datetime:
@@ -1452,7 +1461,7 @@ XMLRPC_VALUE_TYPE get_zval_xmlrpc_type(zval* value, zval** newvalue) /* {{{ */
 		if (newvalue) {
 			zval** val;
 
-			if ((type == xmlrpc_base64 && Z_TYPE_P(value) != IS_NULL) || type == xmlrpc_datetime) {
+			if ((type == xmlrpc_base64 && Z_TYPE_P(value) == IS_OBJECT) || type == xmlrpc_datetime) {
 				if (zend_hash_find(Z_OBJPROP_P(value), OBJECT_VALUE_ATTR, sizeof(OBJECT_VALUE_ATTR), (void**) &val) == SUCCESS) {
 					*newvalue = *val;
 				}

main/php_version.h

@@ -2,7 +2,7 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 5
-#define PHP_RELEASE_VERSION 30
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.5.30-dev"
-#define PHP_VERSION_ID 50530
+#define PHP_RELEASE_VERSION 31
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.5.31"
+#define PHP_VERSION_ID 50531

sapi/fpm/fpm/fpm_log.c

@@ -448,6 +448,11 @@ int fpm_log_write(char *log_format TSRMLS_DC) /* {{{ */
 				b += len2;
 				len += len2;
 			}
+			if (len >= FPM_LOG_BUFFER) {
+				zlog(ZLOG_NOTICE, "the log buffer is full (%d). The access log request has been truncated.", FPM_LOG_BUFFER);
+				len = FPM_LOG_BUFFER;
+				break;
+			}
 			continue;
 		}
 

travis/compile.sh

@@ -10,7 +10,9 @@ else
 	DEBUG="";
 fi
 ./buildconf --force
-./configure --quiet \
+./configure \
+--prefix=$HOME"/php-install" \
+--quiet \
 $DEBUG \
 $TS \
 --enable-fpm \
@@ -50,4 +52,4 @@ $TS \
 --with-gmp \
 --enable-bcmath
 make -j2 --quiet
-sudo make install
+make install

travis/de

@@ -1,2 +0,0 @@
-de_DE.UTF-8 UTF-8
-de_DE ISO-8859-1

travis/ext/curl/setup.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-export PHP_CURL_HTTP_REMOTE_SERVER="http://localhost"
+export PHP_CURL_HTTP_REMOTE_SERVER="http://localhost:8080"
 cd ./ext/curl/tests/responder
-sudo php -S localhost:80 &
-cd -
+php -S localhost:8080 &
+cd -

travis/install.sh

@@ -1,2 +0,0 @@
-#!/bin/bash
-sudo apt-get install re2c libgmp-dev libicu-dev libmcrypt-dev libtidy-dev