fix dir separator in test

5.5.24
fix non-standard C
2026-11-10 18:50:50 +00:00 · 2015-04-15 12:43:00 +02:00 · 2015-04-15 10:50:17 +02:00 · 2015-04-15 10:20:58 +02:00 · 2015-04-15 10:19:40 +02:00 · 2015-04-15 10:19:32 +02:00
57 changed files with 589 additions and 209 deletions
@@ -1,6 +1,10 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-02 Apr 2015, PHP 5.5.24RC1
+16 Apr 2015, PHP 5.5.24
+
+- Apache2handler:
+  . Fixed bug #69218 (potential remote code execution with apache 2.4
+    apache2handler). (Gerrit Venema)

 - Core:
  . Fixed bug #66609 (php crashes with __get() and ++ operator in some cases).
@@ -12,13 +16,21 @@ PHP                                                                        NEWS
  . Fixed bug #68917 (parse_url fails on some partial urls). (Wei Dai)
  . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM
    configuration options). (Anatol Belski)
+  . Additional fix for bug #69152 (Type confusion vulnerability in
+    exception::getTraceAsString). (Stas)
  . Fixed bug #69212 (Leaking VIA_HANDLER func when exception thrown in
    __call/... arg passing). (Nikita)
  . Fixed bug #69221 (Segmentation fault when using a generator in combination
    with an Iterator). (Nikita)
+  . Fixed bug #69337 (php_stream_url_wrap_http_ex() type-confusion
+    vulnerability). (Stas)
+  . Fixed bug #69353 (Missing null byte checks for paths in various PHP
+    extensions). (Stas)

 - Curl:
  . Implemented FR#69278 (HTTP2 support). (Masaki Kagaya)
+  . Fixed bug #69316 (Use-after-free in php_curl related to
+    CURLOPT_FILE/_INFILE/_WRITEHEADER). (Laruence)

 - Date:
  . Export date_get_immutable_ce so that it can be used by extensions. (Derick
@@ -29,6 +41,10 @@ PHP                                                                        NEWS
  . Fixed bug #65406 (Enchant broker plugins are in the wrong place in windows
    builds). (Anatol)

+- Fileinfo:
+  . Fixed bug #68819 (Fileinfo on specific file causes spurious OOM and/or
+    segfault). (Anatol Belski)
+
 - Filter:
  . Fixed bug #69202 (FILTER_FLAG_STRIP_BACKTICK ignored unless other
    flags are used). (Jeff Welch)
@@ -39,6 +55,10 @@ PHP                                                                        NEWS
  . Fixed bug #68846 (False detection of CJK Unified Ideographs Extension E).
    (Masaki Kagaya)

+- OPCache
+   . Fixed bug #68677 (Use After Free). (CVE-2015-1351) (Laruence)
+   . Fixed bug #69281 (opcache_is_script_cached no longer works). (danack)
+
 - OpenSSL:
  . Fixed bug #67403 (Add signatureType to openssl_x509_parse).
  . Add a check for RAND_egd to allow compiling against LibreSSL (Leigh)
@@ -50,6 +70,9 @@ PHP                                                                        NEWS
  . Fixed bug #65467 (Call to undefined method cli_arg_typ_string). (Mike)
  . Fixed bug #67761 (Phar::mapPhar fails for Phars inside a path containing 
    ".tar"). (Mike)
+  . Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar). (Stas)
+  . Fixed bug #69441 (Buffer Overflow when parsing tar/zip/phar in
+    phar_set_inode). (Stas)

 - Postgres:
  . Fixed bug #68741 (Null pointer dereference). (CVE-2015-1352) (Laruence)
@@ -1,5 +1,5 @@
 --TEST--
-Bug #43201 (Crash on using unitialized vals and __get/__set)
+Bug #43201 (Crash on using uninitialized vals and __get/__set)
 --FILE--
 <?php
 class Foo {
@@ -591,6 +591,9 @@ ZEND_METHOD(exception, getTraceAsString)
 	str = &res;

 	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
+	if(Z_TYPE_P(trace) != IS_ARRAY) {
+		RETURN_FALSE;
+	}
 	zend_hash_apply_with_arguments(Z_ARRVAL_P(trace) TSRMLS_CC, (apply_func_args_t)_build_trace_string, 3, str, len, &num);

 	s_tmp = emalloc(1 + MAX_LENGTH_OF_LONG + 7 + 1);
@@ -147,8 +147,6 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
 	GC_BENCH_INC(zval_possible_root);

 	if (GC_ZVAL_GET_COLOR(zv) != GC_PURPLE) {
-		GC_ZVAL_SET_PURPLE(zv);
-
 		if (!GC_ZVAL_ADDRESS(zv)) {
 			gc_root_buffer *newRoot = GC_G(unused);

@@ -159,7 +157,6 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
 				GC_G(first_unused)++;
 			} else {
 				if (!GC_G(gc_enabled)) {
-					GC_ZVAL_SET_BLACK(zv);
 					return;
 				}
 				zv->refcount__gc++;
@@ -169,10 +166,10 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
 				if (!newRoot) {
 					return;
 				}
-				GC_ZVAL_SET_PURPLE(zv);
 				GC_G(unused) = newRoot->prev;
 			}

+			GC_ZVAL_SET_PURPLE(zv);
 			newRoot->next = GC_G(roots).next;
 			newRoot->prev = &GC_G(roots);
 			GC_G(roots).next->prev = newRoot;
@@ -203,7 +200,6 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)

 	obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(zv)].bucket.obj;
 	if (GC_GET_COLOR(obj->buffered) != GC_PURPLE) {
-		GC_SET_PURPLE(obj->buffered);
 		if (!GC_ADDRESS(obj->buffered)) {
 			gc_root_buffer *newRoot = GC_G(unused);

@@ -214,7 +210,6 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)
 				GC_G(first_unused)++;
 			} else {
 				if (!GC_G(gc_enabled)) {
-					GC_ZVAL_SET_BLACK(zv);
 					return;
 				}
 				zv->refcount__gc++;
@@ -225,10 +220,10 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)
 					return;
 				}
 				obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(zv)].bucket.obj;
-				GC_SET_PURPLE(obj->buffered);
 				GC_G(unused) = newRoot->prev;
 			}

+			GC_SET_PURPLE(obj->buffered);
 			newRoot->next = GC_G(roots).next;
 			newRoot->prev = &GC_G(roots);
 			GC_G(roots).next->prev = newRoot;
@@ -120,7 +120,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=5
 PHP_RELEASE_VERSION=24
-PHP_EXTRA_VERSION="RC1"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -1354,6 +1354,7 @@ static size_t curl_write(char *data, size_t size, size_t nmemb, void *ctx)
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the CURLOPT_WRITEFUNCTION");
 				length = -1;
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -1419,6 +1420,7 @@ static int curl_fnmatch(void *ctx, const char *pattern, const char *string)
 			if (error == FAILURE) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_FNMATCH_FUNCTION");
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -1497,6 +1499,7 @@ static size_t curl_progress(void *clientp, double dltotal, double dlnow, double
 			if (error == FAILURE) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_PROGRESSFUNCTION");
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -1574,6 +1577,7 @@ static size_t curl_read(char *data, size_t size, size_t nmemb, void *ctx)
 				length = CURL_READFUNC_ABORT;
 #endif
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) == IS_STRING) {
 					length = MIN((int) (size * nmemb), Z_STRLEN_P(retval_ptr));
 					memcpy(data, Z_STRVAL_P(retval_ptr), length);
@@ -1648,6 +1652,7 @@ static size_t curl_write_header(char *data, size_t size, size_t nmemb, void *ctx
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the CURLOPT_HEADERFUNCTION");
 				length = -1;
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -2851,6 +2856,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue TSRMLS_DC)
 					curl_easy_setopt(ch->cp, CURLOPT_SHARE, sh->share);
 				}
 			}
+			break;

 #if LIBCURL_VERSION_NUM >= 0x071500 /* Available since 7.21.0 */
 		case CURLOPT_FNMATCH_FUNCTION:
@@ -0,0 +1,45 @@
+--TEST--
+Bug #69316: Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER
+--SKIPIF--
+<?php include 'skipif.inc'; ?>
+--FILE--
+<?php
+  function hdr_callback($ch, $data) {
+      // close the stream, causing the FILE structure to be free()'d
+      if($GLOBALS['f_file']) {
+          fclose($GLOBALS['f_file']); $GLOBALS['f_file'] = 0;
+
+          // cause an allocation of approx the same size as a FILE structure, size varies a bit depending on platform/libc
+          $FILE_size = (PHP_INT_SIZE == 4 ? 0x160 : 0x238);
+          curl_setopt($ch, CURLOPT_COOKIE, str_repeat("a", $FILE_size - 1));
+      }
+      return strlen($data);
+  }
+
+  include 'server.inc';
+  $host = curl_cli_server_start();
+  $temp_file = dirname(__FILE__) . '/body.tmp';
+  $url = "{$host}/get.php?test=getpost";
+  $ch = curl_init();
+  $f_file = fopen($temp_file, "w") or die("failed to open file\n");
+  curl_setopt($ch, CURLOPT_BUFFERSIZE, 10);
+  curl_setopt($ch, CURLOPT_HEADERFUNCTION, "hdr_callback");
+  curl_setopt($ch, CURLOPT_FILE, $f_file);
+  curl_setopt($ch, CURLOPT_URL, $url);
+  curl_exec($ch);
+  curl_close($ch);
+?>
+===DONE===
+--CLEAN--
+<?php
+unlink(dirname(__FILE__) . '/body.tmp');
+?>
+--EXPECTF--
+Warning: curl_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
+array(1) {
+  ["test"]=>
+  string(7) "getpost"
+}
+array(0) {
+}
+===DONE===
@@ -187,10 +187,10 @@ ZEND_END_ARG_INFO();
 /* }}} */

 /*
-* class DOMDocument extends DOMNode 
+* class DOMDocument extends DOMNode
 *
 * URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-i-Document
-* Since: 
+* Since:
 */

 const zend_function_entry php_dom_document_class_functions[] = { /* {{{ */
@@ -235,10 +235,10 @@ const zend_function_entry php_dom_document_class_functions[] = { /* {{{ */
 };
 /* }}} */

-/* {{{ docType	DOMDocumentType	
-readonly=yes 
+/* {{{ docType	DOMDocumentType
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-B63ED1A31
-Since: 
+Since:
 */
 int dom_document_doctype_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -266,15 +266,15 @@ int dom_document_doctype_read(dom_object *obj, zval **retval TSRMLS_DC)
 		return FAILURE;
 	}
 	return SUCCESS;
-	
+
 }

 /* }}} */

-/* {{{ implementation	DOMImplementation	
-readonly=yes 
+/* {{{ implementation	DOMImplementation
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1B793EBA
-Since: 
+Since:
 */
 int dom_document_implementation_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -285,10 +285,10 @@ int dom_document_implementation_read(dom_object *obj, zval **retval TSRMLS_DC)

 /* }}} */

-/* {{{ documentElement	DOMElement	
-readonly=yes 
+/* {{{ documentElement	DOMElement
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-87CD092
-Since: 
+Since:
 */
 int dom_document_document_element_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -391,8 +391,8 @@ int dom_document_encoding_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ standalone	boolean	
-readonly=no 
+/* {{{ standalone	boolean
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-standalone
 Since: DOM Level 3
 */
@@ -455,7 +455,7 @@ int dom_document_standalone_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ version	string	
+/* {{{ version	string
 readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-version
 Since: DOM Level 3
@@ -520,8 +520,8 @@ int dom_document_version_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ strictErrorChecking	boolean	
-readonly=no 
+/* {{{ strictErrorChecking	boolean
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-strictErrorChecking
 Since: DOM Level 3
 */
@@ -565,7 +565,7 @@ int dom_document_strict_error_checking_write(dom_object *obj, zval *newval TSRML

 /* }}} */

-/* {{{ formatOutput	boolean	
+/* {{{ formatOutput	boolean
 readonly=no
 */
 int dom_document_format_output_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -607,7 +607,7 @@ int dom_document_format_output_write(dom_object *obj, zval *newval TSRMLS_DC)
 }
 /* }}} */

-/* {{{ validateOnParse	boolean	
+/* {{{ validateOnParse	boolean
 readonly=no
 */
 int	dom_document_validate_on_parse_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -649,7 +649,7 @@ int dom_document_validate_on_parse_write(dom_object *obj, zval *newval TSRMLS_DC
 }
 /* }}} */

-/* {{{ resolveExternals	boolean	
+/* {{{ resolveExternals	boolean
 readonly=no
 */
 int dom_document_resolve_externals_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -691,7 +691,7 @@ int dom_document_resolve_externals_write(dom_object *obj, zval *newval TSRMLS_DC
 }
 /* }}} */

-/* {{{ preserveWhiteSpace	boolean	
+/* {{{ preserveWhiteSpace	boolean
 readonly=no
 */
 int dom_document_preserve_whitespace_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -733,7 +733,7 @@ int dom_document_preserve_whitespace_write(dom_object *obj, zval *newval TSRMLS_
 }
 /* }}} */

-/* {{{ recover	boolean	
+/* {{{ recover	boolean
 readonly=no
 */
 int dom_document_recover_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -775,7 +775,7 @@ int dom_document_recover_write(dom_object *obj, zval *newval TSRMLS_DC)
 }
 /* }}} */

-/* {{{ substituteEntities	boolean	
+/* {{{ substituteEntities	boolean
 readonly=no
 */
 int dom_document_substitue_entities_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -817,8 +817,8 @@ int dom_document_substitue_entities_write(dom_object *obj, zval *newval TSRMLS_D
 }
 /* }}} */

-/* {{{ documentURI	string	
-readonly=no 
+/* {{{ documentURI	string
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-documentURI
 Since: DOM Level 3
 */
@@ -881,8 +881,8 @@ int dom_document_document_uri_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ config	DOMConfiguration	
-readonly=yes 
+/* {{{ config	DOMConfiguration
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-config
 Since: DOM Level 3
 */
@@ -897,7 +897,7 @@ int dom_document_config_read(dom_object *obj, zval **retval TSRMLS_DC)

 /* {{{ proto DOMElement dom_document_create_element(string tagName [, string value]);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-2141741547
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_element)
 {
@@ -930,7 +930,7 @@ PHP_FUNCTION(dom_document_create_element)

 /* {{{ proto DOMDocumentFragment dom_document_create_document_fragment();
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-35CB04B5
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_document_fragment)
 {
@@ -957,7 +957,7 @@ PHP_FUNCTION(dom_document_create_document_fragment)

 /* {{{ proto DOMText dom_document_create_text_node(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1975348127
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_text_node)
 {
@@ -985,7 +985,7 @@ PHP_FUNCTION(dom_document_create_text_node)

 /* {{{ proto DOMComment dom_document_create_comment(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1334481328
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_comment)
 {
@@ -1013,7 +1013,7 @@ PHP_FUNCTION(dom_document_create_comment)

 /* {{{ proto DOMCdataSection dom_document_create_cdatasection(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-D26C0AF8
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_cdatasection)
 {
@@ -1041,7 +1041,7 @@ PHP_FUNCTION(dom_document_create_cdatasection)

 /* {{{ proto DOMProcessingInstruction dom_document_create_processing_instruction(string target, string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-135944439
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_processing_instruction)
 {
@@ -1076,7 +1076,7 @@ PHP_FUNCTION(dom_document_create_processing_instruction)

 /* {{{ proto DOMAttr dom_document_create_attribute(string name);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1084891198
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_attribute)
 {
@@ -1110,7 +1110,7 @@ PHP_FUNCTION(dom_document_create_attribute)

 /* {{{ proto DOMEntityReference dom_document_create_entity_reference(string name);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-392B75AE
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_entity_reference)
 {
@@ -1143,7 +1143,7 @@ PHP_FUNCTION(dom_document_create_entity_reference)

 /* {{{ proto DOMNodeList dom_document_get_elements_by_tag_name(string tagname);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-A6C9094
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_get_elements_by_tag_name)
 {
@@ -1177,7 +1177,7 @@ PHP_FUNCTION(dom_document_import_node)
 	xmlDocPtr docp;
 	xmlNodePtr nodep, retnodep;
 	dom_object *intern, *nodeobj;
-	int ret; 
+	int ret;
 	long recursive = 0;

 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "OO|l", &id, dom_document_class_entry, &node, dom_node_class_entry, &recursive) == FAILURE) {
@@ -1188,7 +1188,7 @@ PHP_FUNCTION(dom_document_import_node)

 	DOM_GET_OBJ(nodep, node, xmlNodePtr, nodeobj);

-	if (nodep->type == XML_HTML_DOCUMENT_NODE || nodep->type == XML_DOCUMENT_NODE 
+	if (nodep->type == XML_HTML_DOCUMENT_NODE || nodep->type == XML_DOCUMENT_NODE
 		|| nodep->type == XML_DOCUMENT_TYPE_NODE) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot import: Node Type Not Supported");
 		RETURN_FALSE;
@@ -1278,7 +1278,7 @@ PHP_FUNCTION(dom_document_create_element_ns)
 		RETURN_FALSE;
 	}

-	
+
 	nodep->ns = nsptr;

 	DOM_RET_OBJ(nodep, &ret, intern);
@@ -1580,11 +1580,15 @@ static xmlDocPtr dom_document_parser(zval *id, int mode, char *source, int sourc
 	xmlInitParser();

 	if (mode == DOM_LOAD_FILE) {
-		char *file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
+		char *file_dest;
+		if (CHECK_NULL_PATH(source, source_len)) {
+			return NULL;
+		}
+		file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
 		if (file_dest) {
 			ctxt = xmlCreateFileParserCtxt(file_dest);
 		}
-		
+
 	} else {
 		ctxt = xmlCreateMemoryParserCtxt(source, source_len);
 	}
@@ -1906,7 +1910,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	zval *id;
 	xmlDoc *docp;
 	xmlNodePtr root;
-	long flags = 0; 
+	long flags = 0;
 	int err;
 	dom_object *intern;

@@ -1919,7 +1923,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	err = xmlXIncludeProcessFlags(docp, flags);

 	/* XML_XINCLUDE_START and XML_XINCLUDE_END nodes need to be removed as these
-	are added via xmlXIncludeProcess to mark beginning and ending of xincluded document 
+	are added via xmlXIncludeProcess to mark beginning and ending of xincluded document
 	but are not wanted in resulting document - must be done even if err as it could fail after
 	having processed some xincludes */
 	root = (xmlNodePtr) docp->children;
@@ -1935,7 +1939,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	} else {
 		RETVAL_FALSE;
 	}
-    
+
 }
 /* }}} */

@@ -1956,19 +1960,19 @@ PHP_FUNCTION(dom_document_validate)
 	DOM_GET_OBJ(docp, id, xmlDocPtr, intern);

 	cvp = xmlNewValidCtxt();
-	
+
 	cvp->userData = NULL;
 	cvp->error    = (xmlValidityErrorFunc) php_libxml_error_handler;
 	cvp->warning  = (xmlValidityErrorFunc) php_libxml_error_handler;
-	
+
 	if (xmlValidateDocument(cvp, docp)) {
 		RETVAL_TRUE;
 	} else {
 		RETVAL_FALSE;
 	}
-	
+
 	xmlFreeValidCtxt(cvp);
-	
+
 }
 /* }}} */

@@ -2009,7 +2013,7 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
 		break;
 	case DOM_LOAD_STRING:
 		parser = xmlSchemaNewMemParserCtxt(source, source_len);
-		/* If loading from memory, we need to set the base directory for the document 
+		/* If loading from memory, we need to set the base directory for the document
 		   but it is not apparent how to do that for schema's */
 		break;
 	default:
@@ -2105,7 +2109,7 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
 		break;
 	case DOM_LOAD_STRING:
 		parser = xmlRelaxNGNewMemParserCtxt(source, source_len);
-		/* If loading from memory, we need to set the base directory for the document 
+		/* If loading from memory, we need to set the base directory for the document
 		   but it is not apparent how to do that for schema's */
 		break;
 	default:
@@ -2173,10 +2177,10 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 	int source_len, refcount, ret;
 	long options = 0;
 	htmlParserCtxtPtr ctxt;
-	
+
 	id = getThis();

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &source, &source_len, &options) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &source, &source_len, &options) == FAILURE) {
 		return;
 	}

@@ -2209,7 +2213,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 	htmlParseDocument(ctxt);
 	newdoc = ctxt->myDoc;
 	htmlFreeParserCtxt(ctxt);
-	
+
 	if (!newdoc)
 		RETURN_FALSE;

@@ -2331,13 +2335,13 @@ PHP_FUNCTION(dom_document_save_html)
 			php_dom_throw_error(WRONG_DOCUMENT_ERR, dom_get_strict_error(intern->document) TSRMLS_CC);
 			RETURN_FALSE;
 		}
-		
+
 		buf = xmlBufferCreate();
 		if (!buf) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not fetch buffer");
 			RETURN_FALSE;
 		}
-		
+
 		if (node->type == XML_DOCUMENT_FRAG_NODE) {
 			int one_size;

@@ -13,6 +13,11 @@ assert.bail=true
 $doc = new DOMDocument();
 $result = $doc->loadHTMLFile("");
 assert('$result === false');
+$doc = new DOMDocument();
+$result = $doc->loadHTMLFile("text.html\0something");
+assert('$result === null');
 ?>
 --EXPECTF--
 %r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile(): Empty string supplied as input %s
+
+%r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile() expects parameter 1 to be a valid path, string given %s
@@ -1284,6 +1284,10 @@ int c;
 	register int ncols = (g->ncsets+(CHAR_BIT-1)) / CHAR_BIT;
 	register unsigned uc = (unsigned char)c;

+	if (!g->setbits) {
+		return(0);
+	}
+
 	for (i = 0, col = g->setbits; i < ncols; i++, col += g->csetsize)
 		if (col[uc] != 0)
 			return(1);
@@ -1,5 +1,5 @@
 --TEST--
-Bug #68799 (Free called on unitialized pointer)
+Bug #68799 (Free called on uninitialized pointer)
 --SKIPIF--
 <?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
 --FILE--
@@ -506,6 +506,11 @@ static void _php_finfo_get_type(INTERNAL_FUNCTION_PARAMETERS, int mode, int mime
 				RETVAL_FALSE;
 				goto clean;
 			}
+			if (CHECK_NULL_PATH(buffer, buffer_len)) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+				RETVAL_FALSE;
+				goto clean;
+			}

 			wrap = php_stream_locate_url_wrapper(buffer, &tmp2, 0 TSRMLS_CC);

@@ -1037,6 +1037,9 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
 			if (bytecnt > nbytes) {
 				bytecnt = nbytes;
 			}
+			if (offset > bytecnt) {
+				offset = bytecnt;
+			}
 			if (s == NULL) {
 				ms->search.s_len = 0;
 				ms->search.s = NULL;
@@ -0,0 +1,18 @@
+--TEST--
+Bug #68819 Fileinfo on specific file causes spurious OOM and/or segfault, var 1
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+
+$string = <<<HERE
+----a-----'''---------a---------------a--------a-----a-----a---------a-----as-------a----a--a-------------a--as-----s---------------a---------a---a--s-a-----a-----------asy---------a-----a-----------a----s--------a-------------a-------a--------a----s------------a-----a----------------a----s-----------------\r\n-------------------a-------a-a-------a-----a----a----s----s--------a-----------------------a----a----s-------------a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a----s----s--------a----------a----------------------a----a----s-------------a----------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n------a-------a-a-------a-----a----a---a-----a-----------------------a----a---a-----a------------------s-------a----a---a-----a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s------\r\n-------------------a-------a-a-------a-----a----a---a-------a------------------------a----a---a-----''--a-------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a-------s-----a---a-------------------------a----a-------------a---a-------------------s-------a----a-------------a---a-----as-a--------------a-----a--s----s---------y------------a-----a-s---a-------''----a---s--a-''------''----s------------a-y----------------s------a-----y--a-s--a-s------s--a-s----------''----------------------------a---s--a----a---------a-s---a-s--------s--------a---------s--a-y-------------as----a----a-------------a------a---s--a-s------a--------a----s----y--as--a----a-s---------------a-----a--------------------------------------\r\n-------------------a-------a-a-------a-----a----a-----------s--------a-----------------------a----a--------------------a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a-----------s--------a----------a----------------------a----a--------------------a------------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a---a-----------------------a----a---a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a---a----------a----------------------a----a---a------------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-----a-a-----------a-------a-a-------a-----a----a----a---s-----a-----------------------a----a----a---------a-----------------s-------a----a----a---------a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a--------a----a-----------------------a----a----------a----a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-----a-------------a-------a-a-------a-----a----a--------s-----a---a-------------------------a----a--------------a---a-------------------s-------------a---------------a----a---a---a-----as-a--------------a-----a--s----s---------y------------a-----a-s---a-------''----a---s--a-''------''----s------------a-y----------------s------a-----y--a-s--a-s------s--a-s----------''----------------------------a---s--a----a---------a-s---a-s--------s--------a---------s--a-y-------------as----a----a-------------a------a---s--a-s------a--------a----s----y--as--a----a-s---------------a-----a-----------Line truncated
+HERE;
+
+$finfo = new finfo();
+$type = $finfo->buffer($string);
+
+var_dump($type);
+?>
+--EXPECT--
+string(60) "ASCII text, with very long lines, with CRLF line terminators"
@@ -0,0 +1,26 @@
+--TEST--
+Bug #68819 Fileinfo on specific file causes spurious OOM and/or segfault, var 2
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+
+$string = '';
+
+// These two in any order
+$string .= "\r\n";
+$string .= "''''";
+
+// Total string length > 8192
+$string .= str_repeat(chr(rand(32, 127)), 8184);
+
+// Ending in this string
+$string .= "say";
+
+$finfo = new finfo();
+$type = $finfo->buffer($string);
+var_dump($type);
+
+?>
+--EXPECT--
+string(60) "ASCII text, with very long lines, with CRLF line terminators"
@@ -19,6 +19,7 @@ echo "*** Testing finfo_file() : basic functionality ***\n";
 var_dump( finfo_file( $finfo, __FILE__) );
 var_dump( finfo_file( $finfo, __FILE__, FILEINFO_CONTINUE ) );
 var_dump( finfo_file( $finfo, $magicFile ) );
+var_dump( finfo_file( $finfo, $magicFile.chr(0).$magicFile) );

 ?>
 ===DONE===
@@ -27,4 +28,7 @@ var_dump( finfo_file( $finfo, $magicFile ) );
 string(28) "text/x-php; charset=us-ascii"
 string(22) "PHP script, ASCII text"
 string(25) "text/plain; charset=utf-8"
+
+Warning: finfo_file(): Invalid path in %s/finfo_file_basic.php on line %d
+bool(false)
 ===DONE===
@@ -1417,7 +1417,7 @@ PHP_FUNCTION(imageloadfont)
 	gdFontPtr font;
 	php_stream *stream;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_name) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_name) == FAILURE) {
 		return;
 	}

@@ -2354,7 +2354,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 	long ignore_warning;

 	if (image_type == PHP_GDIMG_TYPE_GD2PART) {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) {
+		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) {
 			return;
 		}
 		if (width < 1 || height < 1) {
@@ -2362,7 +2362,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 			RETURN_FALSE;
 		}
 	} else {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) {
+		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) {
 			return;
 		}
 	}
@@ -4031,7 +4031,7 @@ PHP_FUNCTION(imagepsencodefont)
 	char *enc, **enc_vector;
 	int enc_len, *f_ind;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rs", &fnt, &enc, &enc_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rp", &fnt, &enc, &enc_len) == FAILURE) {
 		return;
 	}

@@ -3,7 +3,7 @@ Testing that imageloadfont() breaks on non-string first parameter
 --CREDITS--
 Neveo Harrison <neveoo [at] gmail [dot] com> #testfest #tek11
 --SKIPIF--
-<?php 
+<?php
 	if (!extension_loaded("gd")) die("skip GD not present");
 ?>
 --FILE--
@@ -11,5 +11,5 @@ Neveo Harrison <neveoo [at] gmail [dot] com> #testfest #tek11
 var_dump( imageloadfont(array()) );
 ?>
 --EXPECTF--
-Warning: imageloadfont() expects parameter 1 to be string, array given in %s on line %d
-NULL
+Warning: imageloadfont() expects parameter 1 to be a valid path, array given in %s on line %d
+NULL
@@ -143,6 +143,7 @@ static void php_hash_do_hash(INTERNAL_FUNCTION_PARAMETERS, int isfilename, zend_
 	}
 	if (isfilename) {
 		if (CHECK_NULL_PATH(data, data_len)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
 			RETURN_FALSE;
 		}
 		stream = php_stream_open_wrapper_ex(data, "rb", REPORT_ERRORS, NULL, DEFAULT_CONTEXT);
@@ -258,6 +259,10 @@ static void php_hash_do_hash_hmac(INTERNAL_FUNCTION_PARAMETERS, int isfilename,
 		RETURN_FALSE;
 	}
 	if (isfilename) {
+		if (CHECK_NULL_PATH(data, data_len)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+			RETURN_FALSE;
+		}
 		stream = php_stream_open_wrapper_ex(data, "rb", REPORT_ERRORS, NULL, DEFAULT_CONTEXT);
 		if (!stream) {
 			/* Stream will report errors opening file */
@@ -462,7 +467,7 @@ PHP_FUNCTION(hash_update_file)
 	char *filename, buf[1024];
 	int filename_len, n;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rs|r", &zhash, &filename, &filename_len, &zcontext) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rp|r", &zhash, &filename, &filename_len, &zcontext) == FAILURE) {
 		return;
 	}

@@ -28,6 +28,9 @@ hash_hmac_file('crc32', $file, $key, TRUE, $extra_arg);
 echo "\n-- Testing hash_hmac_file() function with invalid hash algorithm --\n";
 hash_hmac_file('foo', $file, $key, TRUE);

+echo "\n-- Testing hash_hmac_file() function with bad path --\n";
+hash_hmac_file('crc32', $file.chr(0).$file, $key, TRUE);
+
 ?>
 ===Done===
 --EXPECTF--
@@ -51,4 +54,8 @@ Warning: hash_hmac_file() expects at most 4 parameters, 5 given in %s on line %d
 -- Testing hash_hmac_file() function with invalid hash algorithm --

 Warning: hash_hmac_file(): Unknown hashing algorithm: foo in %s on line %d
+
+-- Testing hash_hmac_file() function with bad path --
+
+Warning: hash_hmac_file(): Invalid path in %s on line %d
 ===Done===
@@ -199,7 +199,6 @@ mysqli_close($link);
 	if (!mysqli_query($link, 'DROP TABLE IF EXISTS test')) {
 		printf("[008] %s [%d] %s\n", $column_def,
 			mysqli_errno($link), mysqli_error($link));
-		continue;
 	}

 	$column_def = array('col1 CHAR(1)', 'col2 CHAR(2)','INDEX idx_col1_col2(col1, col2)');
@@ -220,7 +219,6 @@ mysqli_close($link);
 		while ($field = mysqli_fetch_field($res)) {
 			if (!isset($expected_flags[$field->name])) {
 				printf("[010] Found unexpected field '%s'\n", $field->name);
-				continue;
 			}
 			list($missing_flags, $unexpected_flags, $flags_found) = checkFlags($field->flags, $expected_flags[$field->name], $flags);
 			if ($unexpected_flags)
@@ -960,9 +960,9 @@ int odbc_bindcols(odbc_result *result TSRMLS_DC)
 		charextraalloc = 0;
 		colfieldid = SQL_COLUMN_DISPLAY_SIZE;

-		rc = SQLColAttributes(result->stmt, (SQLUSMALLINT)(i+1), SQL_COLUMN_NAME, 
+		rc = PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(i+1), PHP_ODBC_DESC_BASE_COLUMN_NAME,
 				result->values[i].name, sizeof(result->values[i].name), &colnamelen, 0);
-		rc = SQLColAttributes(result->stmt, (SQLUSMALLINT)(i+1), SQL_COLUMN_TYPE, 
+		rc = PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(i+1), SQL_COLUMN_TYPE, 
 				NULL, 0, NULL, &result->values[i].coltype);
 		
 		/* Don't bind LONG / BINARY columns, so that fetch behaviour can
@@ -997,7 +997,7 @@ int odbc_bindcols(odbc_result *result TSRMLS_DC)
 				charextraalloc = 1;
 #endif
 			default:
-				rc = SQLColAttributes(result->stmt, (SQLUSMALLINT)(i+1), colfieldid,
+				rc = PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(i+1), colfieldid,
 								NULL, 0, NULL, &displaysize);
 				/* Workaround for Oracle ODBC Driver bug (#50162) when fetching TIMESTAMP column */
 				if (result->values[i].coltype == SQL_TIMESTAMP) {
@@ -1091,7 +1091,7 @@ void odbc_column_lengths(INTERNAL_FUNCTION_PARAMETERS, int type)
 		RETURN_FALSE;
 	}

-	SQLColAttributes(result->stmt, (SQLUSMALLINT)pv_num, (SQLUSMALLINT) (type?SQL_COLUMN_SCALE:SQL_COLUMN_PRECISION), NULL, 0, NULL, &len);
+	PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)pv_num, (SQLUSMALLINT) (type?SQL_COLUMN_SCALE:SQL_COLUMN_PRECISION), NULL, 0, NULL, &len);

 	RETURN_LONG(len);
 }
@@ -2135,7 +2135,7 @@ PHP_FUNCTION(odbc_result)
 				   fieldsize = result->longreadlen;
 				}
 			} else {
-			   SQLColAttributes(result->stmt, (SQLUSMALLINT)(field_ind + 1), 
+			   PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(field_ind + 1), 
 					   			(SQLUSMALLINT)((sql_c_type == SQL_C_BINARY) ? SQL_COLUMN_LENGTH :
 					   			SQL_COLUMN_DISPLAY_SIZE),
 					   			NULL, 0, NULL, &fieldsize);
@@ -2871,7 +2871,7 @@ PHP_FUNCTION(odbc_field_type)
 		RETURN_FALSE;
 	}

-	SQLColAttributes(result->stmt, (SQLUSMALLINT)pv_num, SQL_COLUMN_TYPE_NAME, tmp, 31, &tmplen, NULL);
+	PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)pv_num, SQL_COLUMN_TYPE_NAME, tmp, 31, &tmplen, NULL);
 	RETURN_STRING(tmp,1)
 }
 /* }}} */
@@ -281,8 +281,16 @@ void odbc_sql_error(ODBC_SQL_ERROR_PARAMS);

 #if defined(ODBCVER) && (ODBCVER >= 0x0300)
 #define IS_SQL_LONG(x) (x == SQL_LONGVARBINARY || x == SQL_LONGVARCHAR || x == SQL_WLONGVARCHAR)
+
+#define PHP_ODBC_SQLCOLATTRIBUTE SQLColAttribute
+
+#define PHP_ODBC_DESC_BASE_COLUMN_NAME SQL_DESC_BASE_COLUMN_NAME
 #else
 #define IS_SQL_LONG(x) (x == SQL_LONGVARBINARY || x == SQL_LONGVARCHAR)
+
+#define PHP_ODBC_SQLCOLATTRIBUTE SQLColAttributes
+
+#define PHP_ODBC_DESC_BASE_COLUMN_NAME SQL_COLUMN_NAME
 #endif
 #define IS_SQL_BINARY(x) (x == SQL_BINARY || x == SQL_VARBINARY || x == SQL_LONGVARBINARY)

@@ -2,6 +2,11 @@
 odbc_exec(): Getting accurate unicode data from query
 --SKIPIF--
 <?php include 'skipif.inc'; ?>
+<?php 
+	if ("unixODBC" != ODBC_TYPE) {
+		die("skip ODBC_TYPE != unixODBC");
+	}
+?>
 --FILE--
 <?php

@@ -0,0 +1,43 @@
+--TEST--
+Bug #69354 Incorrect use of SQLColAttributes with ODBC 3.0
+--SKIPIF--
+<?php include 'skipif.inc'; ?>
+--FILE--
+<?php
+
+include 'config.inc';
+
+$conn = odbc_connect($dsn, $user, $pass);
+
+@odbc_exec($conn, 'CREATE DATABASE odbcTEST');
+
+odbc_exec($conn, 'CREATE TABLE FOO (ID INT, VARCHAR_COL VARCHAR(100))');
+
+odbc_exec($conn, "INSERT INTO FOO(ID, VARCHAR_COL) VALUES (1, '" . str_repeat("a", 100) . "')");
+
+$res = odbc_exec($conn,"select VARCHAR_COL from FOO");
+if ($res) {
+	if (odbc_fetch_row($res)) {
+		$ret = odbc_result($res,'varchar_col');
+		echo strlen($ret), "\n";
+		echo $ret[0], "\n";
+		echo $ret[strlen($ret)-1], "\n";
+	}
+}
+?>
+==DONE==
+--EXPECT--
+100
+a
+a
+==DONE==
+--CLEAN--
+<?php
+include 'config.inc';
+
+$conn = odbc_connect($dsn, $user, $pass);
+
+odbc_exec($conn, 'DROP TABLE FOO');
+odbc_exec($conn, 'DROP DATABASE odbcTEST');
+
+?>
@@ -2,6 +2,11 @@
 odbc_exec(): Basic test
 --SKIPIF--
 <?php include 'skipif.inc'; ?>
+<?php 
+	if ("unixODBC" != ODBC_TYPE) {
+		die("skip ODBC_TYPE != unixODBC");
+	}
+?>
 --FILE--
 <?php

@@ -11,7 +11,7 @@ $conn = odbc_connect($dsn, $user, $pass);

 odbc_exec($conn, 'CREATE DATABASE odbcTEST');

-odbc_exec($conn, 'CREATE TABLE FOO (TEST INT)');
+odbc_exec($conn, 'CREATE TABLE FOO (TEST INT NOT NULL)');
 odbc_exec($conn, 'ALTER TABLE FOO ADD PRIMARY KEY (TEST)');

 odbc_exec($conn, 'INSERT INTO FOO VALUES (1)');
@@ -0,0 +1,17 @@
+--TEST--
+Test that script cached info is correct with validate_timestamps disabled
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.validate_timestamps=0
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+var_dump(opcache_is_script_cached(__FILE__));
+var_dump(opcache_is_script_cached("nonexistent.php"));
+?>
+--EXPECT--
+bool(true)
+bool(false)
@@ -4,6 +4,7 @@ Test that script cached info is correct
 opcache.enable=1
 opcache.enable_cli=1
 opcache.file_update_protection=0
+opcache.validate_timestamps=1
 --SKIPIF--
 <?php require_once('skipif.inc'); ?>
 --FILE--
@@ -320,14 +320,16 @@ static int filename_is_in_cache(char *filename, int filename_len TSRMLS_DC)
 		persistent_script = zend_accel_hash_find(&ZCSG(hash), filename, filename_len + 1);
 		if (persistent_script) {
 			return !persistent_script->corrupted &&
-				validate_timestamp_and_record(persistent_script, &handle TSRMLS_CC) == SUCCESS;
+				(!ZCG(accel_directives).validate_timestamps ||
+				validate_timestamp_and_record(persistent_script, &handle TSRMLS_CC) == SUCCESS);
 		}
 	}

 	if ((key = accel_make_persistent_key_ex(&handle, filename_len, &key_length TSRMLS_CC)) != NULL) {
 		persistent_script = zend_accel_hash_find(&ZCSG(hash), key, key_length + 1);
 		return persistent_script && !persistent_script->corrupted &&
-			validate_timestamp_and_record(persistent_script, &handle TSRMLS_CC) == SUCCESS;
+			(!ZCG(accel_directives).validate_timestamps ||
+			validate_timestamp_and_record(persistent_script, &handle TSRMLS_CC) == SUCCESS);
 	}

 	return 0;
@@ -346,10 +346,10 @@ void *_zend_shared_memdup(void *source, size_t size, zend_bool free_source TSRML
 	retval = ZCG(mem);;
 	ZCG(mem) = (void*)(((char*)ZCG(mem)) + ZEND_ALIGNED_SIZE(size));
 	memcpy(retval, source, size);
+	zend_shared_alloc_register_xlat_entry(source, retval);
 	if (free_source) {
 		interned_efree((char*)source);
 	}
-	zend_shared_alloc_register_xlat_entry(source, retval);
 	return retval;
 }

@@ -688,7 +688,7 @@ the alternative names that are used. */
 #define foc           number
 #define save_mark     data

-/* These statements are here to stop the compiler complaining about unitialized
+/* These statements are here to stop the compiler complaining about uninitialized
 variables. */

 #ifdef SUPPORT_UCP
@@ -85,10 +85,12 @@ MySQLPDOTest::skip();


 	} catch (PDOException $e) {
-		printf("[001] %s, [%s] %s\n",
+		printf("[001] %s, [%s] %s [%s] %s\n",
 			$e->getMessage(),
-			(is_object($db)) ? $db->errorCode() : 'n/a',
-			(is_object($db)) ? implode(' ', $db->errorInfo()) : 'n/a');
+			(is_object($db1)) ? $db1->errorCode() : 'n/a',
+			(is_object($db1)) ? implode(' ', $db1->errorInfo()) : 'n/a',
+			(is_object($db2)) ? $db2->errorCode() : 'n/a',
+			(is_object($db2)) ? implode(' ', $db2->errorInfo()) : 'n/a');
 	}

 	print "done!";
@@ -3014,7 +3014,7 @@ PHP_FUNCTION(pg_trace)
 	php_stream *stream;
 	id = PGG(default_link);

-	if (zend_parse_parameters(argc TSRMLS_CC, "s|sr", &z_filename, &z_filename_len, &mode, &mode_len, &pgsql_link) == FAILURE) {
+	if (zend_parse_parameters(argc TSRMLS_CC, "p|sr", &z_filename, &z_filename_len, &mode, &mode_len, &pgsql_link) == FAILURE) {
 		return;
 	}

@@ -598,52 +598,41 @@ int phar_open_parsed_phar(char *fname, int fname_len, char *alias, int alias_len
 *
 * Meta-data is in this format:
 * [len32][data...]
- * 
+ *
 * data is the serialized zval
 */
-int phar_parse_metadata(char **buffer, zval **metadata, int zip_metadata_len TSRMLS_DC) /* {{{ */
+int phar_parse_metadata(char **buffer, zval **metadata, php_uint32 zip_metadata_len TSRMLS_DC) /* {{{ */
 {
-	const unsigned char *p;
-	php_uint32 buf_len;
 	php_unserialize_data_t var_hash;

-	if (!zip_metadata_len) {
-		PHAR_GET_32(*buffer, buf_len);
-	} else {
-		buf_len = zip_metadata_len;
-	}
-
-	if (buf_len) {
+	if (zip_metadata_len) {
+		const unsigned char *p, *p_buff = estrndup(*buffer, zip_metadata_len);
+		p = p_buff;
 		ALLOC_ZVAL(*metadata);
 		INIT_ZVAL(**metadata);
-		p = (const unsigned char*) *buffer;
 		PHP_VAR_UNSERIALIZE_INIT(var_hash);

-		if (!php_var_unserialize(metadata, &p, p + buf_len, &var_hash TSRMLS_CC)) {
+		if (!php_var_unserialize(metadata, &p, p + zip_metadata_len, &var_hash TSRMLS_CC)) {
+			efree(p_buff);
 			PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
 			zval_ptr_dtor(metadata);
 			*metadata = NULL;
 			return FAILURE;
 		}
-
+		efree(p_buff);
 		PHP_VAR_UNSERIALIZE_DESTROY(var_hash);

 		if (PHAR_G(persist)) {
 			/* lazy init metadata */
 			zval_ptr_dtor(metadata);
-			*metadata = (zval *) pemalloc(buf_len, 1);
-			memcpy(*metadata, *buffer, buf_len);
-			*buffer += buf_len;
+			*metadata = (zval *) pemalloc(zip_metadata_len, 1);
+			memcpy(*metadata, *buffer, zip_metadata_len);
 			return SUCCESS;
 		}
 	} else {
 		*metadata = NULL;
 	}

-	if (!zip_metadata_len) {
-		*buffer += buf_len;
-	}
-
 	return SUCCESS;
 }
 /* }}}*/
@@ -653,7 +642,7 @@ int phar_parse_metadata(char **buffer, zval **metadata, int zip_metadata_len TSR
 *
 * Parse a new one and add it to the cache, returning either SUCCESS or
 * FAILURE, and setting pphar to the pointer to the manifest entry
- * 
+ *
 * This is used by phar_open_from_filename to process the manifest, but can be called
 * directly.
 */
@@ -664,6 +653,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 	phar_entry_info entry;
 	php_uint32 manifest_len, manifest_count, manifest_flags, manifest_index, tmp_len, sig_flags;
 	php_uint16 manifest_ver;
+	php_uint32 len;
 	long offset;
 	int sig_len, register_alias = 0, temp_alias = 0;
 	char *signature = NULL;
@@ -1029,16 +1019,21 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 	mydata->is_persistent = PHAR_G(persist);

 	/* check whether we have meta data, zero check works regardless of byte order */
+	PHAR_GET_32(buffer, len);
 	if (mydata->is_persistent) {
-		PHAR_GET_32(buffer, mydata->metadata_len);
-		if (phar_parse_metadata(&buffer, &mydata->metadata, mydata->metadata_len TSRMLS_CC) == FAILURE) {
-			MAPPHAR_FAIL("unable to read phar metadata in .phar file \"%s\"");
-		}
-	} else {
-		if (phar_parse_metadata(&buffer, &mydata->metadata, 0 TSRMLS_CC) == FAILURE) {
-			MAPPHAR_FAIL("unable to read phar metadata in .phar file \"%s\"");
+		mydata->metadata_len = len;
+		if(!len) {
+			/* FIXME: not sure why this is needed but removing it breaks tests */
+			PHAR_GET_32(buffer, len);
 		}
 	}
+	if(len > endbuffer - buffer) {
+		MAPPHAR_FAIL("internal corruption of phar \"%s\" (trying to read past buffer end)");
+	}
+	if (phar_parse_metadata(&buffer, &mydata->metadata, len TSRMLS_CC) == FAILURE) {
+		MAPPHAR_FAIL("unable to read phar metadata in .phar file \"%s\"");
+	}
+	buffer += len;

 	/* set up our manifest */
 	zend_hash_init(&mydata->manifest, manifest_count,
@@ -1073,7 +1068,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 			entry.manifest_pos = manifest_index;
 		}

-		if (buffer + entry.filename_len + 20 > endbuffer) {
+		if (entry.filename_len + 20 > endbuffer - buffer) {
 			MAPPHAR_FAIL("internal corruption of phar \"%s\" (truncated manifest entry)");
 		}

@@ -1109,19 +1104,20 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 			entry.flags |= PHAR_ENT_PERM_DEF_DIR;
 		}

+		PHAR_GET_32(buffer, len);
 		if (entry.is_persistent) {
-			PHAR_GET_32(buffer, entry.metadata_len);
-			if (!entry.metadata_len) buffer -= 4;
-			if (phar_parse_metadata(&buffer, &entry.metadata, entry.metadata_len TSRMLS_CC) == FAILURE) {
-				pefree(entry.filename, entry.is_persistent);
-				MAPPHAR_FAIL("unable to read file metadata in .phar file \"%s\"");
-			}
+			entry.metadata_len = len;
 		} else {
-			if (phar_parse_metadata(&buffer, &entry.metadata, 0 TSRMLS_CC) == FAILURE) {
-				pefree(entry.filename, entry.is_persistent);
-				MAPPHAR_FAIL("unable to read file metadata in .phar file \"%s\"");
-			}
+			entry.metadata_len = 0;
 		}
+		if (len > endbuffer - buffer) {
+			MAPPHAR_FAIL("internal corruption of phar \"%s\" (truncated manifest entry)");
+		}
+		if (phar_parse_metadata(&buffer, &entry.metadata, len TSRMLS_CC) == FAILURE) {
+			pefree(entry.filename, entry.is_persistent);
+			MAPPHAR_FAIL("unable to read file metadata in .phar file \"%s\"");
+		}
+		buffer += len;

 		entry.offset = entry.offset_abs = offset;
 		offset += entry.compressed_filesize;
@@ -2239,7 +2235,7 @@ last_time:

 /**
 * Process a phar stream name, ensuring we can handle any of:
- * 
+ *
 * - whatever.phar
 * - whatever.phar.gz
 * - whatever.phar.bz2
@@ -561,10 +561,13 @@ static inline void phar_set_inode(phar_entry_info *entry TSRMLS_DC) /* {{{ */
 {
 	char tmp[MAXPATHLEN];
 	int tmp_len;
+	size_t len;

-	tmp_len = entry->filename_len + entry->phar->fname_len;
-	memcpy(tmp, entry->phar->fname, entry->phar->fname_len);
-	memcpy(tmp + entry->phar->fname_len, entry->filename, entry->filename_len);
+	tmp_len = MIN(MAXPATHLEN, entry->filename_len + entry->phar->fname_len);
+	len = MIN(entry->phar->fname_len, tmp_len);
+	memcpy(tmp, entry->phar->fname, len);
+	len = MIN(tmp_len - len, entry->filename_len);
+	memcpy(tmp + entry->phar->fname_len, entry->filename, len);
 	entry->inode = (unsigned short)zend_get_hash_value(tmp, tmp_len);
 }
 /* }}} */
@@ -597,7 +600,7 @@ int phar_mount_entry(phar_archive_data *phar, char *filename, int filename_len,
 char *phar_find_in_include_path(char *file, int file_len, phar_archive_data **pphar TSRMLS_DC);
 char *phar_fix_filepath(char *path, int *new_len, int use_cwd TSRMLS_DC);
 phar_entry_info * phar_open_jit(phar_archive_data *phar, phar_entry_info *entry, char **error TSRMLS_DC);
-int phar_parse_metadata(char **buffer, zval **metadata, int zip_metadata_len TSRMLS_DC);
+int phar_parse_metadata(char **buffer, zval **metadata, php_uint32 zip_metadata_len TSRMLS_DC);
 void destroy_phar_manifest_entry(void *pDest);
 int phar_seek_efp(phar_entry_info *entry, off_t offset, int whence, off_t position, int follow_links TSRMLS_DC);
 php_stream *phar_get_efp(phar_entry_info *entry, int follow_links TSRMLS_DC);
@@ -0,0 +1,17 @@
+--TEST--
+Bug #69324: Buffer Over-read in unserialize when parsing Phar
+--SKIPIF--
+<?php
+if (!extension_loaded("phar")) die("skip");
+?>
+--FILE--
+<?php
+try {
+$p = new Phar(dirname(__FILE__).'/bug69324.phar', 0);
+$meta=$p->getMetadata();
+var_dump($meta);
+} catch(Exception $e) {
+	echo $e->getMessage();
+}
+--EXPECTF--
+internal corruption of phar "%s" (truncated manifest entry)
@@ -0,0 +1,21 @@
+--TEST--
+Phar: bug #69441: Buffer Overflow when parsing tar/zip/phar in phar_set_inode
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip"); ?>
+--FILE--
+<?php
+$fname = dirname(__FILE__) . '/bug69441.phar';
+try {
+$r = new Phar($fname, 0);
+} catch(UnexpectedValueException $e) {
+	echo $e;
+}
+?>
+
+==DONE==
+--EXPECTF--
+exception 'UnexpectedValueException' with message 'phar error: corrupted central directory entry, no magic signature in zip-based phar "%s/bug69441.phar"' in %s/bug69441.php:%d
+Stack trace:
+#0 %s%ebug69441.php(%d): Phar->__construct('%s', 0)
+#1 {main}
+==DONE==
@@ -2570,7 +2570,7 @@ static int do_request(zval *this_ptr, xmlDoc *request, char *location, char *act
 	}

 	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
-	    (Z_LVAL_PP(trace) == IS_BOOL || Z_LVAL_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
+	    (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
 		add_property_stringl(this_ptr, "__last_request", buf, buf_size, 1);
 	}

@@ -2605,7 +2605,7 @@ static int do_request(zval *this_ptr, xmlDoc *request, char *location, char *act
 		}
 		ret = FALSE;
 	} else if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
-	           (Z_LVAL_PP(trace) == IS_BOOL || Z_LVAL_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
+	           (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
 		add_property_stringl(this_ptr, "__last_response", Z_STRVAL_P(response), Z_STRLEN_P(response), 1);
 	}
 	zval_ptr_dtor(&params[4]);
@@ -2650,7 +2650,7 @@ static void do_soap_call(zval* this_ptr,
 	SOAP_CLIENT_BEGIN_CODE();

 	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
-	    (Z_LVAL_PP(trace) == IS_BOOL || Z_LVAL_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
+	    (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
 		zend_hash_del(Z_OBJPROP_P(this_ptr), "__last_request", sizeof("__last_request"));
 		zend_hash_del(Z_OBJPROP_P(this_ptr), "__last_response", sizeof("__last_response"));
 	}
@@ -1279,6 +1279,8 @@ PHP_METHOD(sqlite3stmt, paramCount)
 	php_sqlite3_stmt *stmt_obj;
 	zval *object = getThis();
 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);
+	
+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)

 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -1295,6 +1297,8 @@ PHP_METHOD(sqlite3stmt, close)
 	php_sqlite3_stmt *stmt_obj;
 	zval *object = getThis();
 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);
+	
+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)

 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -1313,6 +1317,8 @@ PHP_METHOD(sqlite3stmt, reset)
 	php_sqlite3_stmt *stmt_obj;
 	zval *object = getThis();
 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);
+	
+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)

 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -1333,6 +1339,8 @@ PHP_METHOD(sqlite3stmt, clear)
 	php_sqlite3_stmt *stmt_obj;
 	zval *object = getThis();
 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);
+	
+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)

 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -1354,6 +1362,8 @@ PHP_METHOD(sqlite3stmt, readOnly)
 	php_sqlite3_stmt *stmt_obj;
 	zval *object = getThis();
 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);
+	
+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)

 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -1421,6 +1431,8 @@ PHP_METHOD(sqlite3stmt, bindParam)
 	zval *object = getThis();
 	struct php_sqlite3_bound_param param = {0};
 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);
+	
+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)

 	param.param_number = -1;
 	param.type = SQLITE3_TEXT;
@@ -1452,6 +1464,8 @@ PHP_METHOD(sqlite3stmt, bindValue)
 	zval *object = getThis();
 	struct php_sqlite3_bound_param param = {0};
 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);
+	
+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)

 	param.param_number = -1;
 	param.type = SQLITE3_TEXT;
@@ -1487,6 +1501,8 @@ PHP_METHOD(sqlite3stmt, execute)

 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);

+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -0,0 +1,23 @@
+--TEST--
+Bug #66550 (SQLite prepared statement use-after-free)
+--SKIPIF--
+<?php
+if (!extension_loaded('sqlite3')) die('skip');
+?>
+--FILE--
+<?php
+
+$db = new SQLite3(':memory:');
+
+$db->exec('CREATE TABLE foo (id INTEGER, bar STRING)');
+
+$stmt = $db->prepare('SELECT bar FROM foo WHERE id=:id');
+// Close the database connection and free the internal sqlite3_stmt object
+$db->close();
+// Access the sqlite3_stmt object via the php_sqlite3_stmt container
+$stmt->reset();
+?>
+==DONE==
+--EXPECTF--
+Warning: SQLite3Stmt::reset(): The SQLite3 object has not been correctly initialised in %s
+==DONE==
@@ -19,7 +19,7 @@
   |          Sara Golemon <pollita@php.net>                              |
   +----------------------------------------------------------------------+
 */
-/* $Id$ */ 
+/* $Id$ */

 #include "php.h"
 #include "php_globals.h"
@@ -152,7 +152,7 @@ php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper, char *path,
 	}

 	if (strncasecmp(resource->scheme, "http", sizeof("http")) && strncasecmp(resource->scheme, "https", sizeof("https"))) {
-		if (!context || 
+		if (!context ||
 			php_stream_context_get_option(context, wrapper->wops->label, "proxy", &tmpzval) == FAILURE ||
 			Z_TYPE_PP(tmpzval) != IS_STRING ||
 			Z_STRLEN_PP(tmpzval) <= 0) {
@@ -168,7 +168,7 @@ php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper, char *path,
 		transport_string = estrndup(Z_STRVAL_PP(tmpzval), Z_STRLEN_PP(tmpzval));
 	} else {
 		/* Normal http request (possibly with proxy) */
-	
+
 		if (strpbrk(mode, "awx+")) {
 			php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "HTTP wrapper does not support writeable connections");
 			php_url_free(resource);
@@ -207,11 +207,11 @@ php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper, char *path,
 	stream = php_stream_xport_create(transport_string, transport_len, options,
 			STREAM_XPORT_CLIENT | STREAM_XPORT_CONNECT,
 			NULL, &timeout, context, &errstr, NULL);
-    
+
 	if (stream) {
 		php_stream_set_option(stream, PHP_STREAM_OPTION_READ_TIMEOUT, 0, &timeout);
 	}
-			
+
 	if (errstr) {
 		php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", errstr);
 		efree(errstr);
@@ -328,7 +328,7 @@ finish:
 	/* avoid buffering issues while reading header */
 	if (options & STREAM_WILL_CAST)
 		chunk_size = php_stream_set_chunk_size(stream, 1);
-	
+
 	/* avoid problems with auto-detecting when reading the headers -> the headers
 	 * are always in canonical \r\n format */
 	eol_detect = stream->flags & (PHP_STREAM_FLAG_DETECT_EOL | PHP_STREAM_FLAG_EOL_MAC);
@@ -359,7 +359,7 @@ finish:
 			}
 		}
 	}
- 
+
 	if (context && php_stream_context_get_option(context, "http", "protocol_version", &tmpzval) == SUCCESS) {
 		SEPARATE_ZVAL(tmpzval);
 		convert_to_double_ex(tmpzval);
@@ -420,7 +420,7 @@ finish:

 	if (context && php_stream_context_get_option(context, "http", "header", &tmpzval) == SUCCESS) {
 		tmp = NULL;
-		
+
 		if (Z_TYPE_PP(tmpzval) == IS_ARRAY) {
 			HashPosition pos;
 			zval **tmpheader = NULL;
@@ -460,42 +460,42 @@ finish:
 				strip_header(user_headers, tmp, "content-type:");
 			}

-			if ((s = strstr(tmp, "user-agent:")) && 
-			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || 
+			if ((s = strstr(tmp, "user-agent:")) &&
+			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
 			                 *(s-1) == '\t' || *(s-1) == ' ')) {
 				 have_header |= HTTP_HEADER_USER_AGENT;
 			}
 			if ((s = strstr(tmp, "host:")) &&
-			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || 
+			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
 			                 *(s-1) == '\t' || *(s-1) == ' ')) {
 				 have_header |= HTTP_HEADER_HOST;
 			}
 			if ((s = strstr(tmp, "from:")) &&
-			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || 
+			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
 			                 *(s-1) == '\t' || *(s-1) == ' ')) {
 				 have_header |= HTTP_HEADER_FROM;
 				}
 			if ((s = strstr(tmp, "authorization:")) &&
-			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || 
+			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
 			                 *(s-1) == '\t' || *(s-1) == ' ')) {
 				 have_header |= HTTP_HEADER_AUTH;
 			}
 			if ((s = strstr(tmp, "content-length:")) &&
-			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || 
+			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
 			                 *(s-1) == '\t' || *(s-1) == ' ')) {
 				 have_header |= HTTP_HEADER_CONTENT_LENGTH;
 			}
 			if ((s = strstr(tmp, "content-type:")) &&
-			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || 
+			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
 			                 *(s-1) == '\t' || *(s-1) == ' ')) {
 				 have_header |= HTTP_HEADER_TYPE;
 			}
 			/* remove Proxy-Authorization header */
 			if (use_proxy && use_ssl && (s = strstr(tmp, "proxy-authorization:")) &&
-			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || 
+			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
 			                 *(s-1) == '\t' || *(s-1) == ' ')) {
 				char *p = s + sizeof("proxy-authorization:") - 1;
-				
+
 				while (s > tmp && (*(s-1) == ' ' || *(s-1) == '\t')) s--;
 				while (*p != 0 && *p != '\r' && *p != '\n') p++;
 				while (*p == '\r' || *p == '\n') p++;
@@ -534,7 +534,7 @@ finish:
 		}

 		tmp = (char*)php_base64_encode((unsigned char*)scratch, strlen(scratch), NULL);
-		
+
 		if (snprintf(scratch, scratch_len, "Authorization: Basic %s\r\n", tmp) > 0) {
 			php_stream_write(stream, scratch, strlen(scratch));
 			php_stream_notify_info(context, PHP_STREAM_NOTIFY_AUTH_REQUIRED, NULL, 0);
@@ -552,7 +552,7 @@ finish:

 	/* Send Host: header so name-based virtual hosts work */
 	if ((have_header & HTTP_HEADER_HOST) == 0) {
-		if ((use_ssl && resource->port != 443 && resource->port != 0) || 
+		if ((use_ssl && resource->port != 443 && resource->port != 0) ||
 			(!use_ssl && resource->port != 80 && resource->port != 0)) {
 			if (snprintf(scratch, scratch_len, "Host: %s:%i\r\n", resource->host, resource->port) > 0)
 				php_stream_write(stream, scratch, strlen(scratch));
@@ -563,7 +563,7 @@ finish:
 		}
 	}

-	if (context && 
+	if (context &&
 	    php_stream_context_get_option(context, "http", "user_agent", &ua_zval) == SUCCESS &&
 		Z_TYPE_PP(ua_zval) == IS_STRING) {
 		ua_str = Z_STRVAL_PP(ua_zval);
@@ -575,9 +575,9 @@ finish:
 #define _UA_HEADER "User-Agent: %s\r\n"
 		char *ua;
 		size_t ua_len;
-		
+
 		ua_len = sizeof(_UA_HEADER) + strlen(ua_str);
-		
+
 		/* ensure the header is only sent if user_agent is not blank */
 		if (ua_len > sizeof(_UA_HEADER)) {
 			ua = emalloc(ua_len + 1);
@@ -591,7 +591,7 @@ finish:
 			if (ua) {
 				efree(ua);
 			}
-		}	
+		}
 	}

 	if (user_headers) {
@@ -649,8 +649,12 @@ finish:

 	{
 		zval **rh;
-		zend_hash_find(EG(active_symbol_table), "http_response_header", sizeof("http_response_header"), (void **) &rh);
+		if(zend_hash_find(EG(active_symbol_table), "http_response_header", sizeof("http_response_header"), (void **) &rh) != SUCCESS || Z_TYPE_PP(rh) != IS_ARRAY) {
+			php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "HTTP request failed, http_response_header overwritten");
+			goto out;
+		}
 		response_header = *rh;
+		Z_ADDREF_P(response_header);
 	}

 	if (!php_stream_eof(stream)) {
@@ -706,9 +710,9 @@ finish:
 		php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "HTTP request failed, unexpected end of socket!");
 		goto out;
 	}
-	
+
 	/* read past HTTP headers */
-	
+
 	http_header_line = emalloc(HTTP_HEADER_BLOCK_SIZE);

 	while (!body && !php_stream_eof(stream)) {
@@ -738,7 +742,7 @@ finish:
 					follow_location = Z_LVAL_PP(tmpzval);
 				} else if (!(response_code >= 300 && response_code < 304 || 307 == response_code || 308 == response_code)) {
 					/* we shouldn't redirect automatically
-					if follow_location isn't set and response_code not in (300, 301, 302, 303 and 307) 
+					if follow_location isn't set and response_code not in (300, 301, 302, 303 and 307)
 					see http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3.1
 					RFC 7238 defines 308: http://tools.ietf.org/html/rfc7238 */
 					follow_location = 0;
@@ -778,7 +782,7 @@ finish:
 				MAKE_STD_ZVAL(http_header);

 				ZVAL_STRINGL(http_header, http_header_line, http_header_line_length, 1);
-				
+
 				zend_hash_next_index_insert(Z_ARRVAL_P(response_header), &http_header, sizeof(zval *), NULL);
 			}
 		} else {
@@ -803,10 +807,10 @@ finish:
 			char loc_path[HTTP_HEADER_BLOCK_SIZE];

 			*new_path='\0';
-			if (strlen(location)<8 || (strncasecmp(location, "http://", sizeof("http://")-1) && 
-							strncasecmp(location, "https://", sizeof("https://")-1) && 
-							strncasecmp(location, "ftp://", sizeof("ftp://")-1) && 
-							strncasecmp(location, "ftps://", sizeof("ftps://")-1))) 
+			if (strlen(location)<8 || (strncasecmp(location, "http://", sizeof("http://")-1) &&
+							strncasecmp(location, "https://", sizeof("https://")-1) &&
+							strncasecmp(location, "ftp://", sizeof("ftp://")-1) &&
+							strncasecmp(location, "ftps://", sizeof("ftps://")-1)))
 			{
 				if (*location != '/') {
 					if (*(location+1) != '\0' && resource->path) {
@@ -820,7 +824,7 @@ finish:
 								*s = '/';
 							}
 						}
-						s[1] = '\0'; 
+						s[1] = '\0';
 						if (resource->path && *(resource->path) == '/' && *(resource->path + 1) == '\0') {
 							snprintf(loc_path, sizeof(loc_path) - 1, "%s%s", resource->path, location);
 						} else {
@@ -893,18 +897,21 @@ out:

 	if (stream) {
 		if (header_init) {
-			zval_add_ref(&response_header);
 			stream->wrapperdata = response_header;
+		} else {
+			if(response_header) {
+				Z_DELREF_P(response_header);
+			}
 		}
 		php_stream_notify_progress_init(context, 0, file_size);
-		
+
 		/* Restore original chunk size now that we're done with headers */
 		if (options & STREAM_WILL_CAST)
 			php_stream_set_chunk_size(stream, chunk_size);

 		/* restore the users auto-detect-line-endings setting */
 		stream->flags |= eol_detect;
-		
+
 		/* as far as streams are concerned, we are now at the start of
 		 * the stream */
 		stream->position = 0;
@@ -915,8 +922,13 @@ out:
 		if (transfer_encoding) {
 			php_stream_filter_append(&stream->readfilters, transfer_encoding);
 		}
-	} else if (transfer_encoding) {
-		php_stream_filter_free(transfer_encoding TSRMLS_CC);
+	} else {
+		if(response_header) {
+			Z_DELREF_P(response_header);
+		}
+		if (transfer_encoding) {
+			php_stream_filter_free(transfer_encoding TSRMLS_CC);
+		}
 	}

 	return stream;
@@ -59,7 +59,7 @@ PHP_FUNCTION(readlink)
 	char buff[MAXPATHLEN];
 	int ret;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &link, &link_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &link, &link_len) == FAILURE) {
 		return;
 	}

@@ -1549,7 +1549,7 @@ PHP_FUNCTION(stream_resolve_include_path)
 	char *filename, *resolved_path;
 	int filename_len;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &filename, &filename_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &filename, &filename_len) == FAILURE) {
 		return;
 	}

@@ -65,7 +65,7 @@ bool(false)
 Warning: readlink(): %s in %s on line %d
 bool(false)

-Warning: readlink() expects parameter 1 to be string, resource given in %s on line %d
+Warning: readlink() expects parameter 1 to be a valid path, resource given in %s on line %d
 NULL

 Warning: readlink(): %s in %s on line %d
@@ -0,0 +1,41 @@
+--TEST--
+Bug #69337 (Stream context leaks when http request fails)
+--SKIPIF--
+<?php require 'server.inc'; http_server_skipif('tcp://127.0.0.1:22345'); ?>
+--INI--
+allow_url_fopen=1
+allow_url_include=1
+--FILE--
+<?php
+require 'server.inc';
+
+function stream_notification_callback($notification_code, $severity, $message, $message_code, $bytes_transferred, $bytes_max)
+{
+	if($notification_code == STREAM_NOTIFY_REDIRECTED) {
+	  // $http_response_header is now a string, but will be used as an array
+     // by php_stream_url_wrap_http_ex() later on
+       $GLOBALS['http_response_header'] = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\0\0\0\0";
+    }
+}
+
+$ctx = stream_context_create();
+stream_context_set_params($ctx, array("notification" => "stream_notification_callback"));
+
+$responses = array(
+	"data://text/plain,HTTP/1.0 302 Found\r\nLocation: http://127.0.0.1:22345/try-again\r\n\r\n",
+	"data://text/plain,HTTP/1.0 404 Not Found\r\n\r\n",
+);
+
+$pid = http_server("tcp://127.0.0.1:22345", $responses, $output);
+
+$f = file_get_contents('http://127.0.0.1:22345/', 0, $ctx);
+
+http_server_kill($pid);
+var_dump($f);
+?>
+==DONE==
+--EXPECTF--
+string(26) "HTTP/1.0 404 Not Found
+
+"
+==DONE==
@@ -0,0 +1,16 @@
+--TEST--
+Bug #69152: Type Confusion Infoleak Vulnerability in unserialize()
+--FILE--
+<?php
+$x = unserialize('O:9:"exception":1:{s:16:"'."\0".'Exception'."\0".'trace";s:4:"ryat";}');
+echo $x;
+$x =  unserialize('O:4:"test":1:{s:27:"__PHP_Incomplete_Class_Name";R:1;}');
+$x->test();
+
+?>
+--EXPECTF--
+exception 'Exception' in %s:%d
+Stack trace:
+#0 {main}
+
+Fatal error: main(): The script tried to execute a method or access a property of an incomplete object. Please ensure that the class definition "unknown" of the object you are trying to operate on was loaded _before_ unserialize() gets called or provide a __autoload() function to load the class definition  in %s on line %d
@@ -113,7 +113,7 @@ static void xmlwriter_free_resource_ptr(xmlwriter_object *intern TSRMLS_DC)
 		ze_xmlwriter_object *obj = (ze_xmlwriter_object*) zend_object_store_get_object(object TSRMLS_CC); \
 		intern = obj->xmlwriter_ptr; \
 		if (!intern) { \
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid or unitialized XMLWriter object"); \
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid or uninitialized XMLWriter object"); \
 			RETURN_FALSE; \
 		} \
 	}
@@ -1738,7 +1738,7 @@ static PHP_FUNCTION(xmlwriter_write_dtd_entity)
 /* }}} */
 #endif

-/* {{{ proto resource xmlwriter_open_uri(resource xmlwriter, string source)
+/* {{{ proto resource xmlwriter_open_uri(string source)
 Create new xmlwriter using source uri for output */
 static PHP_FUNCTION(xmlwriter_open_uri)
 {
@@ -1759,7 +1759,7 @@ static PHP_FUNCTION(xmlwriter_open_uri)
 	void *ioctx;
 #endif

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &source, &source_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &source, &source_len) == FAILURE) {
 		return;
 	}
 	
@@ -417,7 +417,7 @@ static int php_zip_parse_options(zval *options, long *remove_all_path,
 		ze_zip_object *obj = (ze_zip_object*) zend_object_store_get_object(object TSRMLS_CC); \
 		intern = obj->za; \
 		if (!intern) { \
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid or unitialized Zip object"); \
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid or uninitialized Zip object"); \
 			RETURN_FALSE; \
 		} \
 	}
@@ -1,17 +1,17 @@
 --TEST--
-Test gzopen() function : usage variation 
+Test gzopen() function : usage variation
 --SKIPIF--
-<?php 
+<?php
 if (!extension_loaded("zlib")) {
-	print "skip - zlib extension not loaded"; 
-}	 
+	print "skip - zlib extension not loaded";
+}
 ?>
 --FILE--
 <?php
 /* Prototype  : resource gzopen(string filename, string mode [, int use_include_path])
- * Description: Open a .gz-file and return a .gz-file pointer 
+ * Description: Open a .gz-file and return a .gz-file pointer
 * Source code: ext/zlib/zlib.c
- * Alias to functions: 
+ * Alias to functions:
 */

 echo "*** Testing gzopen() : usage variation ***\n";
@@ -102,9 +102,9 @@ $inputs = array(

      // unset data
      'unset var' => @$unset_var,
-      
+
      // resource variable
-      'resource' => $fp      
+      'resource' => $fp
 );

 // loop through each element of the array for filename
@@ -158,19 +158,19 @@ Error: 2 - gzopen(0.5): failed to open stream: No such file or directory, %s(%d)
 bool(false)

 --empty array--
-Error: 2 - gzopen() expects parameter 1 to be string, array given, %s(%d)
+Error: 2 - gzopen() expects parameter 1 to be a valid path, array given, %s(%d)
 NULL

 --int indexed array--
-Error: 2 - gzopen() expects parameter 1 to be string, array given, %s(%d)
+Error: 2 - gzopen() expects parameter 1 to be a valid path, array given, %s(%d)
 NULL

 --associative array--
-Error: 2 - gzopen() expects parameter 1 to be string, array given, %s(%d)
+Error: 2 - gzopen() expects parameter 1 to be a valid path, array given, %s(%d)
 NULL

 --nested arrays--
-Error: 2 - gzopen() expects parameter 1 to be string, array given, %s(%d)
+Error: 2 - gzopen() expects parameter 1 to be a valid path, array given, %s(%d)
 NULL

 --uppercase NULL--
@@ -210,7 +210,7 @@ Error: 2 - gzopen(Class A object): failed to open stream: No such file or direct
 bool(false)

 --instance of classWithoutToString--
-Error: 2 - gzopen() expects parameter 1 to be string, object given, %s(%d)
+Error: 2 - gzopen() expects parameter 1 to be a valid path, object given, %s(%d)
 NULL

 --undefined var--
@@ -222,7 +222,7 @@ Error: 2 - gzopen(): Filename cannot be empty, %s(%d)
 bool(false)

 --resource--
-Error: 2 - gzopen() expects parameter 1 to be string, resource given, %s(%d)
+Error: 2 - gzopen() expects parameter 1 to be a valid path, resource given, %s(%d)
 NULL
 ===DONE===

@@ -29,15 +29,15 @@ foreach ( $variation as $var ) {
 ===DONE===
 --EXPECTF--

-Warning: readgzfile() expects parameter 1 to be string, array given in %s on line %d
+Warning: readgzfile() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL

-Warning: readgzfile() expects parameter 1 to be string, array given in %s on line %d
+Warning: readgzfile() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL

-Warning: readgzfile() expects parameter 1 to be string, array given in %s on line %d
+Warning: readgzfile() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL

-Warning: readgzfile() expects parameter 1 to be string, array given in %s on line %d
+Warning: readgzfile() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
-===DONE===
+===DONE===
@@ -45,5 +45,5 @@ foreach ( $variation as $var ) {
 --EXPECTF--
 Error: 2 - readgzfile(Class A object): failed to open stream: No such file or directory, %s(%d)
 bool(false)
-Error: 2 - readgzfile() expects parameter 1 to be string, object given, %s(%d)
-NULL
+Error: 2 - readgzfile() expects parameter 1 to be a valid path, object given, %s(%d)
+NULL
@@ -593,7 +593,7 @@ static PHP_FUNCTION(gzopen)
 	php_stream *stream;
 	long use_include_path = 0;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss|l", &filename, &filename_len, &mode, &mode_len, &use_include_path) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ps|l", &filename, &filename_len, &mode, &mode_len, &use_include_path) == FAILURE) {
 		return;
 	}

@@ -621,7 +621,7 @@ static PHP_FUNCTION(readgzfile)
 	int size;
 	long use_include_path = 0;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &filename, &filename_len, &use_include_path) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &filename, &filename_len, &use_include_path) == FAILURE) {
 		return;
 	}

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 5
 #define PHP_RELEASE_VERSION 24
-#define PHP_EXTRA_VERSION "RC1"
-#define PHP_VERSION "5.5.24RC1"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.5.24"
 #define PHP_VERSION_ID 50524
@@ -688,6 +688,7 @@ zend_first_try {
 } zend_end_try();
 		}
 		apr_brigade_cleanup(brigade);
+		apr_pool_cleanup_run(r->pool, (void *)&SG(server_context), php_server_context_cleanup);
 	} else {
 		ctx->r = parent_req;
 	}
Author	SHA1	Message	Date
Anatol Belski	e971b92d4a	fix dir separator in test	2015-04-15 12:43:00 +02:00
Julien Pauli	39a8cc5d2c	5.5.24	2015-04-15 10:50:17 +02:00
Stanislav Malyshev	fc7e056a0b	fix non-standard C	2015-04-15 10:20:58 +02:00
Stanislav Malyshev	945b9ffee6	Fix bug #69441 (Buffer Overflow when parsing tar/zip/phar in phar_set_inode)	2015-04-15 10:19:40 +02:00
Stanislav Malyshev	fe0e422695	fix test	2015-04-15 10:19:32 +02:00
Remi Collet	0c87c34845	fix type in fix for #69085 (cherry picked from commit 085e9ddc26f37ce556b8fd787044746e726264b2)	2015-04-15 10:19:04 +02:00
Stanislav Malyshev	1e273d1833	fix memory leak & add test	2015-04-15 10:18:35 +02:00
Stanislav Malyshev	9ae865e108	Fix tests	2015-04-15 10:18:25 +02:00
Stanislav Malyshev	363e6ce60b	Merge branch 'PHP-5.5-security' into PHP-5.5.24 * PHP-5.5-security: (22 commits) Fixed bug #69316 (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER) Fix bug #68486 and bug #69218 (segfault in apache2handler with apache 2.4) Fix bug #68819 (Fileinfo on specific file causes spurious OOM and/or segfault) updated NEWS added test for bug #69354 revert skipif, this should run everywhere further ODBC 3.0 compliance more compliance with the ODBC 3.0 test fixes Prevent GC from changing zval or object 'color' before they are actually inserted into possible roots buffer. sigh, can't even copypaste without screwing up oop, put both the error number and message for both db object to the error message test fixes Fixed bug #69281 (opcache_is_script_cached no longer works) Fix typo: unitialized -> uninitialized Fix typo: unitialized -> uninitialized Fixed bug #68739 (Missing break / control flow). Fixed bug #68740 (NULL Pointer Dereference). Fixed bug #68677 (Use After Free). Fixed bug #68739 (Missing break / control flow in curl) Fixed bug #68740 (NULL Pointer Dereference) Fixed bug #68677 (Use After Free in OPcache) ... Conflicts: configure.in ext/curl/tests/bug69316.phpt main/php_version.h	2015-04-15 10:17:26 +02:00
Stanislav Malyshev	d0bbb8b133	Fix bug #69337 (php_stream_url_wrap_http_ex() type-confusion vulnerability)	2015-04-15 10:16:36 +02:00
Stanislav Malyshev	82191e8179	Fix test	2015-04-15 10:16:26 +02:00
Stanislav Malyshev	25cb6f001f	Merge branch 'PHP-5.4.40' into PHP-5.5.24 * PHP-5.4.40: Additional fix for bug #69324 More fixes for bug #69152 Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions) Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar) Fixed bug #69316 (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER) Fix bug #68486 and bug #69218 (segfault in apache2handler with apache 2.4) Fix bug #68819 (Fileinfo on specific file causes spurious OOM and/or segfault) Fixed bug #68901 (use after free) Fixed bug #68740 (NULL Pointer Dereference) Fix bug #66550 (SQLite prepared statement use-after-free) Better fix for #68601 for perf https://bitbucket.org/libgd/gd-libgd/commits/81e9a993f2893d651d225646378e3fd1b7465467 Fix bug #68601 buffer read overflow in gd_gif_in.c Revert "Merge branch 'PHP-5.4' of https://git.php.net/repository/php-src into PHP-5.4" Fixed bug #69293 Add ZEND_ARG_CALLABLE_INFO to allow internal function to type hint against callable.	2015-04-15 10:12:46 +02:00
Stanislav Malyshev	b4554a022e	Additional fix for bug #69324 Not so happy about duplication but needed due to bug #69429	2015-04-15 10:12:04 +02:00
Stanislav Malyshev	1da9156e60	More fixes for bug #69152	2015-04-15 10:11:43 +02:00
Stanislav Malyshev	52b93f0cfd	Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions)	2015-04-15 10:11:35 +02:00
Stanislav Malyshev	17cbd0b5b7	Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar)	2015-04-15 10:11:25 +02:00
Stanislav Malyshev	f0ff43ec81	Fixed bug #69316 (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER)	2015-04-15 10:11:15 +02:00
Stanislav Malyshev	01883bcffb	Fix bug #68486 and bug #69218 (segfault in apache2handler with apache 2.4)	2015-04-15 10:11:04 +02:00
Stanislav Malyshev	f678693e1a	Fix bug #68819 (Fileinfo on specific file causes spurious OOM and/or segfault)	2015-04-15 10:10:54 +02:00