PHP 5.3.12

Fix for CVE-2012-1823
PHP 5.3.11
2026-11-10 18:50:50 +00:00 · 2012-05-03 15:54:59 +02:00 · 2012-05-03 15:51:52 +02:00 · 2012-04-25 00:13:15 +02:00 · 2012-04-12 11:28:49 +02:00 · 2012-04-12 11:21:19 +02:00
21 changed files with 972 additions and 664 deletions
@@ -22,3 +22,152 @@ sapi/continuity/capi.c          ident
 Zend/RFCs/002.txt               ident
 Zend/RFCs/003.txt               ident
 NEWS                            merge=NEWS
+/ext/bz2/tests/005.phpt	-crlf
+/ext/dom/tests/dom005.phpt	-crlf
+/ext/dom/tests/DOMImplementation_createDocumentType_basic.phpt	-crlf
+/ext/ereg/tests/009.phpt	-crlf
+/ext/iconv/tests/eucjp2sjis.phpt	-crlf
+/ext/iconv/tests/eucjp2utf8.phpt	-crlf
+/ext/iconv/tests/iconv_stream_filter_delimiter.phpt	-crlf
+/ext/iconv/tests/iconv_stream_filter.phpt	-crlf
+/ext/mbstring/tests/mb_split-compat-01.phpt	-crlf
+/ext/phar/tests/005.phpt	-crlf
+/ext/phar/tests/phar_commitwrite.phpt	-crlf
+/ext/phar/tests/phar_create_in_cwd.phpt	-crlf
+/ext/phar/tests/phar_mount.phpt	-crlf
+/ext/reflection/tests/009.phpt	-crlf
+/ext/reflection/tests/025.phpt	-crlf
+/ext/standard/tests/general_functions/highlight_heredoc.phpt	-crlf
+/ext/standard/tests/general_functions/parse_ini_file.phpt	-crlf
+/ext/standard/tests/general_functions/parse_ini_string_002.phpt	-crlf
+/ext/standard/tests/strings/006.phpt	-crlf
+/ext/standard/tests/strings/addslashes_variation2.phpt	-crlf
+/ext/standard/tests/strings/addslashes_variation3.phpt	-crlf
+/ext/standard/tests/strings/bug21453.phpt	-crlf
+/ext/standard/tests/strings/chop_variation3.phpt	-crlf
+/ext/standard/tests/strings/chunk_split_variation11.phpt	-crlf
+/ext/standard/tests/strings/chunk_split_variation12.phpt	-crlf
+/ext/standard/tests/strings/chunk_split_variation4.phpt	-crlf
+/ext/standard/tests/strings/crc32_variation2.phpt	-crlf
+/ext/standard/tests/strings/crc32_variation3.phpt	-crlf
+/ext/standard/tests/strings/crc32_variation4.phpt	-crlf
+/ext/standard/tests/strings/highlight_file.phpt	-crlf
+/ext/standard/tests/strings/htmlentities_html4.phpt	-crlf
+/ext/standard/tests/strings/lcfirst.phpt	-crlf
+/ext/standard/tests/strings/ltrim.phpt	-crlf
+/ext/standard/tests/strings/nl2br_variation2.phpt	-crlf
+/ext/standard/tests/strings/php_strip_whitespace.phpt	-crlf
+/ext/standard/tests/strings/rtrim.phpt	-crlf
+/ext/standard/tests/strings/sprintf_f_2.phpt	-crlf
+/ext/standard/tests/strings/sprintf_variation15.phpt	-crlf
+/ext/standard/tests/strings/strcspn_variation6.phpt	-crlf
+/ext/standard/tests/strings/strcspn_variation7.phpt	-crlf
+/ext/standard/tests/strings/strcspn_variation8.phpt	-crlf
+/ext/standard/tests/strings/stripos_variation1.phpt	-crlf
+/ext/standard/tests/strings/stripos_variation3.phpt	-crlf
+/ext/standard/tests/strings/stripos_variation4.phpt	-crlf
+/ext/standard/tests/strings/stripos_variation5.phpt	-crlf
+/ext/standard/tests/strings/stripos_variation6.phpt	-crlf
+/ext/standard/tests/strings/stripslashes_variation2.phpt	-crlf
+/ext/standard/tests/strings/stripslashes_variation3.phpt	-crlf
+/ext/standard/tests/strings/stripslashes_variation4.phpt	-crlf
+/ext/standard/tests/strings/stripslashes_variation5.phpt	-crlf
+/ext/standard/tests/strings/str_ireplace.phpt	-crlf
+/ext/standard/tests/strings/strnatcmp_basic.phpt	-crlf
+/ext/standard/tests/strings/strncasecmp_variation9.phpt	-crlf
+/ext/standard/tests/strings/strpos.phpt	-crlf
+/ext/standard/tests/strings/strrchr_variation1.phpt	-crlf
+/ext/standard/tests/strings/strrchr_variation2.phpt	-crlf
+/ext/standard/tests/strings/strrchr_variation3.phpt	-crlf
+/ext/standard/tests/strings/strrchr_variation4.phpt	-crlf
+/ext/standard/tests/strings/strrchr_variation6.phpt	-crlf
+/ext/standard/tests/strings/strrchr_variation7.phpt	-crlf
+/ext/standard/tests/strings/str_replace.phpt	-crlf
+/ext/standard/tests/strings/strrev_variation3.phpt	-crlf
+/ext/standard/tests/strings/strrev_variation4.phpt	-crlf
+/ext/standard/tests/strings/strripos_variation1.phpt	-crlf
+/ext/standard/tests/strings/strripos_variation2.phpt	-crlf
+/ext/standard/tests/strings/strripos_variation3.phpt	-crlf
+/ext/standard/tests/strings/strripos_variation4.phpt	-crlf
+/ext/standard/tests/strings/strripos_variation5.phpt	-crlf
+/ext/standard/tests/strings/strrpos_variation1.phpt	-crlf
+/ext/standard/tests/strings/strrpos_variation2.phpt	-crlf
+/ext/standard/tests/strings/strrpos_variation3.phpt	-crlf
+/ext/standard/tests/strings/strrpos_variation4.phpt	-crlf
+/ext/standard/tests/strings/strrpos_variation5.phpt	-crlf
+/ext/standard/tests/strings/strrpos_variation6.phpt	-crlf
+/ext/standard/tests/strings/strspn_variation5.phpt	-crlf
+/ext/standard/tests/strings/strspn_variation6.phpt	-crlf
+/ext/standard/tests/strings/strspn_variation7.phpt	-crlf
+/ext/standard/tests/strings/strspn_variation8.phpt	-crlf
+/ext/standard/tests/strings/strstr.phpt	-crlf
+/ext/standard/tests/strings/strtok_variation1.phpt	-crlf
+/ext/standard/tests/strings/strtok_variation3.phpt	-crlf
+/ext/standard/tests/strings/strtr_variation1.phpt	-crlf
+/ext/standard/tests/strings/strtr_variation2.phpt	-crlf
+/ext/standard/tests/strings/str_word_count.phpt	-crlf
+/ext/standard/tests/strings/trim1.phpt	-crlf
+/ext/standard/tests/strings/ucfirst.phpt	-crlf
+/ext/standard/tests/strings/vfprintf_variation10.phpt	-crlf
+/ext/standard/tests/strings/vfprintf_variation12.phpt	-crlf
+/ext/standard/tests/strings/vfprintf_variation16.phpt	-crlf
+/ext/standard/tests/strings/vfprintf_variation18.phpt	-crlf
+/ext/standard/tests/strings/vfprintf_variation4.phpt	-crlf
+/ext/standard/tests/strings/vfprintf_variation6.phpt	-crlf
+/ext/standard/tests/strings/vfprintf_variation7.phpt	-crlf
+/ext/standard/tests/strings/vfprintf_variation8.phpt	-crlf
+/ext/standard/tests/strings/vprintf_variation10.phpt	-crlf
+/ext/standard/tests/strings/vprintf_variation12.phpt	-crlf
+/ext/standard/tests/strings/vprintf_variation14.phpt	-crlf
+/ext/standard/tests/strings/vprintf_variation18.phpt	-crlf
+/ext/standard/tests/strings/vprintf_variation4.phpt	-crlf
+/ext/standard/tests/strings/vprintf_variation6.phpt	-crlf
+/ext/standard/tests/strings/vprintf_variation7.phpt	-crlf
+/ext/standard/tests/strings/vprintf_variation8.phpt	-crlf
+/ext/standard/tests/strings/vsprintf_variation10.phpt	-crlf
+/ext/standard/tests/strings/vsprintf_variation12.phpt	-crlf
+/ext/standard/tests/strings/vsprintf_variation14.phpt	-crlf
+/ext/standard/tests/strings/vsprintf_variation16.phpt	-crlf
+/ext/standard/tests/strings/vsprintf_variation4.phpt	-crlf
+/ext/standard/tests/strings/vsprintf_variation6.phpt	-crlf
+/ext/standard/tests/strings/vsprintf_variation7.phpt	-crlf
+/ext/standard/tests/strings/vsprintf_variation8.phpt	-crlf
+/ext/standard/tests/strings/wordwrap.phpt	-crlf
+/ext/tidy/tests/010.phpt	-crlf
+/ext/tidy/tests/012.phpt	-crlf
+/ext/tidy/tests/025.phpt	-crlf
+/ext/tidy/tests/030.phpt	-crlf
+/ext/tokenizer/tests/bug26463.phpt	-crlf
+/ext/tokenizer/tests/token_get_all_variation12.phpt	-crlf
+/ext/tokenizer/tests/token_get_all_variation13.phpt	-crlf
+/ext/tokenizer/tests/token_get_all_variation14.phpt	-crlf
+/ext/tokenizer/tests/token_get_all_variation15.phpt	-crlf
+/ext/tokenizer/tests/token_get_all_variation16.phpt	-crlf
+/ext/tokenizer/tests/token_get_all_variation17.phpt	-crlf
+/ext/tokenizer/tests/token_get_all_variation18.phpt	-crlf
+/ext/tokenizer/tests/token_get_all_variation19.phpt	-crlf
+/ext/tokenizer/tests/token_get_all_variation4.phpt	-crlf
+/ext/tokenizer/tests/token_get_all_variation5.phpt	-crlf
+/ext/tokenizer/tests/token_get_all_variation6.phpt	-crlf
+/ext/tokenizer/tests/token_get_all_variation7.phpt	-crlf
+/ext/tokenizer/tests/token_get_all_variation8.phpt	-crlf
+/ext/tokenizer/tests/token_get_all_variation9.phpt	-crlf
+/ext/xml/tests/bug26614_libxml.phpt	-crlf
+/ext/xmlwriter/tests/004.phpt		-crlf
+/ext/xmlwriter/tests/OO_004.phpt	-crlf
+/ext/zlib/tests/005.phpt			-crlf
+/ext/zlib/tests/gzfile_basic2.phpt	-crlf
+/ext/zlib/tests/gzfile_basic.phpt	-crlf
+/ext/zlib/tests/gzfilegzreadfile.phpt	-crlf
+/ext/zlib/tests/readgzfile_basic2.phpt	-crlf
+/ext/zlib/tests/readgzfile_basic.phpt	-crlf
+/sapi/cli/tests/014.phpt			-crlf
+/tests/run-test/test010.phpt		-crlf
+/Zend/tests/bug35655.phpt			-crlf
+/Zend/tests/bug48930.phpt			-crlf
+/Zend/tests/bug61095.phpt			-crlf
+/Zend/tests/heredoc_017.phpt		-crlf
+/Zend/tests/heredoc_018.phpt		-crlf
+/Zend/tests/nowdoc_013.phpt			-crlf
+/Zend/tests/nowdoc_014.phpt			-crlf
+/Zend/tests/nowdoc_015.phpt			-crlf
@@ -1,8 +1,13 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2012, PHP 5.3.11
+03 Mar 2012, PHP 5.3.12
+- Fix PHP-CGI query string parameter vulnerability, CVE-2012-1823. (Rasmus)
+
+26 Apr 2012, PHP 5.3.11

 - Core:
+  . Fixed bug #61650 (ini parser crashes when using ${xxxx} ini variables
+    (without apache2)). (Laruence)
  . Fixed bug #61273 (call_user_func_array with more than 16333 arguments
    leaks / crashes). (Laruence)
  . Fixed bug #61165 (Segfault - strip_tags()). (Laruence)
@@ -49,6 +54,11 @@ PHP                                                                        NEWS
  . Fixed bug #61172 (Add Apache 2.4 support). (Chris Jones)

 - Fileinfo
+  . Upgraded libmagic to 5.11 (Pierre, Anatoliy)
+  . Fixed bug #61565 where php_stream_open_wrapper_ex tries to open a
+    directory descriptor under windows. (Anatoliy)
+  . Fixed bug #61566 failure caused by the posix lseek and read versions
+    under windows in cdf_read(). (Anatoliy)
  . Fixed bug #61173 (Unable to detect error from finfo constructor). (Gustavo)

 - Firebird Database extension (ibase):
@@ -77,6 +87,10 @@ PHP                                                                        NEWS
 - PDO_Sqlite extension:
  . Add createCollation support. (Damien)

+- pgsql:
+  . Fixed bug #60718 (Compile problem with libpq (PostgreSQL 7.3 or less).
+    (Yasuo Ohgaki)
+
 - Phar:
  . Fixed bug #61184 (Phar::webPhar() generates headers with trailing NUL
    bytes). (Nikic)
@@ -41,8 +41,8 @@ AC_CONFIG_HEADER(main/php_config.h)

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=3
-PHP_RELEASE_VERSION=11
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=12
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -515,11 +515,22 @@ static void _php_finfo_get_type(INTERNAL_FUNCTION_PARAMETERS, int mode, int mime
 			wrap = php_stream_locate_url_wrapper(buffer, &tmp2, 0 TSRMLS_CC);

 			if (wrap) {
+				php_stream *stream;
 				php_stream_context *context = php_stream_context_from_zval(zcontext, 0);
+
+#ifdef PHP_WIN32
+				if (php_stream_stat_path_ex(buffer, 0, &ssb, context) == SUCCESS) {
+					if (ssb.sb.st_mode & S_IFDIR) {
+						ret_val = mime_directory;
+						goto common;
+					}
+				}
+#endif
+
 #if PHP_API_VERSION < 20100412
-				php_stream *stream = php_stream_open_wrapper_ex(buffer, "rb", ENFORCE_SAFE_MODE | REPORT_ERRORS, NULL, context);
+				stream = php_stream_open_wrapper_ex(buffer, "rb", ENFORCE_SAFE_MODE | REPORT_ERRORS, NULL, context);
 #else
-				php_stream *stream = php_stream_open_wrapper_ex(buffer, "rb", REPORT_ERRORS, NULL, context);
+				stream = php_stream_open_wrapper_ex(buffer, "rb", REPORT_ERRORS, NULL, context);
 #endif

 				if (!stream) {
@@ -306,10 +306,10 @@ cdf_read(const cdf_info_t *info, off_t off, void *buf, size_t len)
 	if (info->i_fd == -1)
 		return -1;

-	if (lseek(info->i_fd, off, SEEK_SET) == (off_t)-1)
+	if (FINFO_LSEEK_FUNC(info->i_fd, off, SEEK_SET) == (off_t)-1)
 		return -1;

-	if (read(info->i_fd, buf, len) != (ssize_t)len)
+	if (FINFO_READ_FUNC(info->i_fd, buf, len) != (ssize_t)len)
 		return -1;

 	return (ssize_t)len;
@@ -224,7 +224,7 @@ sread(int fd, void *buf, size_t n, int canbepipe)

 nocheck:
 	do
-		switch ((rv = read(fd, buf, n))) {
+		switch ((rv = FINFO_READ_FUNC(fd, buf, n))) {
 		case -1:
 			if (errno == EINTR)
 				continue;
@@ -301,7 +301,7 @@ file_pipe2file(struct magic_set *ms, int fd, const void *startbuf,
 		return -1;
 	}
 	(void)close(tfd);
-	if (lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) {
+	if (FINFO_LSEEK_FUNC(fd, (off_t)0, SEEK_SET) == (off_t)-1) {
 		file_badseek(ms);
 		return -1;
 	}
@@ -405,7 +405,7 @@ uncompressbuf(struct magic_set *ms, int fd, size_t method,
 		(void) close(0);
 		if (fd != -1) {
 		    (void) dup(fd);
-		    (void) lseek(0, (off_t)0, SEEK_SET);
+		    (void) FINFO_LSEEK_FUNC(0, (off_t)0, SEEK_SET);
 		} else {
 		    (void) dup(fdin[0]);
 		    (void) close(fdin[0]);
@@ -486,4 +486,12 @@ static const char *rcsid(const char *p) { \
 #define FILE_RCSID(id)
 #endif

+#ifdef PHP_WIN32
+#define FINFO_LSEEK_FUNC _lseek
+#define FINFO_READ_FUNC _read
+#else
+#define FINFO_LSEEK_FUNC lseek
+#define FINFO_READ_FUNC read
+#endif
+
 #endif /* __file_h__ */
@@ -309,11 +309,11 @@ dophn_core(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
 	 * Loop through all the program headers.
 	 */
 	for ( ; num; num--) {
-		if (lseek(fd, off, SEEK_SET) == (off_t)-1) {
+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
 			file_badseek(ms);
 			return -1;
 		}
-		if (read(fd, xph_addr, xph_sizeof) == -1) {
+		if (FINFO_READ_FUNC(fd, xph_addr, xph_sizeof) == -1) {
 			file_badread(ms);
 			return -1;
 		}
@@ -331,11 +331,11 @@ dophn_core(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
 		 * This is a PT_NOTE section; loop through all the notes
 		 * in the section.
 		 */
-		if (lseek(fd, xph_offset, SEEK_SET) == (off_t)-1) {
+		if (FINFO_LSEEK_FUNC(fd, xph_offset, SEEK_SET) == (off_t)-1) {
 			file_badseek(ms);
 			return -1;
 		}
-		bufsize = read(fd, nbuf,
+		bufsize = FINFO_READ_FUNC(fd, nbuf,
 		    ((xph_filesz < sizeof(nbuf)) ? xph_filesz : sizeof(nbuf)));
 		if (bufsize == -1) {
 			file_badread(ms);
@@ -858,11 +858,11 @@ doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num,
 	}

 	for ( ; num; num--) {
-		if (lseek(fd, off, SEEK_SET) == (off_t)-1) {
+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
 			file_badseek(ms);
 			return -1;
 		}
-		if (read(fd, xsh_addr, xsh_sizeof) == -1) {
+		if (FINFO_READ_FUNC(fd, xsh_addr, xsh_sizeof) == -1) {
 			file_badread(ms);
 			return -1;
 		}
@@ -888,13 +888,13 @@ doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num,
 		switch (xsh_type) {
 		case SHT_NOTE:
 			nbuf = emalloc((size_t)xsh_size);
-			if ((noff = lseek(fd, (off_t)xsh_offset, SEEK_SET)) ==
+			if ((noff = FINFO_LSEEK_FUNC(fd, (off_t)xsh_offset, SEEK_SET)) ==
 			    (off_t)-1) {
 				file_badread(ms);
 				efree(nbuf);
 				return -1;
 			}
-			if (read(fd, nbuf, (size_t)xsh_size) !=
+			if (FINFO_READ_FUNC(fd, nbuf, (size_t)xsh_size) !=
 			    (ssize_t)xsh_size) {
 				efree(nbuf);
 				file_badread(ms);
@@ -914,7 +914,7 @@ doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num,
 			efree(nbuf);
 			break;
 		case SHT_SUNW_cap:
-			if (lseek(fd, (off_t)xsh_offset, SEEK_SET) ==
+			if (FINFO_LSEEK_FUNC(fd, (off_t)xsh_offset, SEEK_SET) ==
 			    (off_t)-1) {
 				file_badseek(ms);
 				return -1;
@@ -927,7 +927,7 @@ doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num,
 				    MAX(sizeof cap32, sizeof cap64)];
 				if ((coff += xcap_sizeof) > (off_t)xsh_size)
 					break;
-				if (read(fd, cbuf, (size_t)xcap_sizeof) !=
+				if (FINFO_READ_FUNC(fd, cbuf, (size_t)xcap_sizeof) !=
 				    (ssize_t)xcap_sizeof) {
 					file_badread(ms);
 					return -1;
@@ -1046,12 +1046,12 @@ dophn_exec(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
 	}

  	for ( ; num; num--) {
-		if (lseek(fd, off, SEEK_SET) == (off_t)-1) {
+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
 			file_badseek(ms);
 			return -1;
 		}

-  		if (read(fd, xph_addr, xph_sizeof) == -1) {
+  		if (FINFO_READ_FUNC(fd, xph_addr, xph_sizeof) == -1) {
  			file_badread(ms);
 			return -1;
 		}
@@ -1090,11 +1090,11 @@ dophn_exec(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
 			 * This is a PT_NOTE section; loop through all the notes
 			 * in the section.
 			 */
-			if (lseek(fd, xph_offset, SEEK_SET) == (off_t)-1) {
+			if (FINFO_LSEEK_FUNC(fd, xph_offset, SEEK_SET) == (off_t)-1) {
 				file_badseek(ms);
 				return -1;
 			}
-			bufsize = read(fd, nbuf, ((xph_filesz < sizeof(nbuf)) ?
+			bufsize = FINFO_READ_FUNC(fd, nbuf, ((xph_filesz < sizeof(nbuf)) ?
 			    xph_filesz : sizeof(nbuf)));
 			if (bufsize == -1) {
 				file_badread(ms);
@@ -1156,7 +1156,7 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf,
 	/*
 	 * If we cannot seek, it must be a pipe, socket or fifo.
 	 */
-	if((lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
+	if((FINFO_LSEEK_FUNC(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
 		fd = file_pipe2file(ms, fd, buf, nbytes);

 	if (fstat(fd, &st) == -1) {
@@ -14,10 +14,28 @@ var_dump(finfo_open(FILEINFO_MIME, '/foo/bar/inexistent'));

 ?>
 --EXPECTF--
-Warning: finfo_open(): Failed to load magic database at ''. in %s on line %d
+Warning: finfo_open() expects parameter 2 to be a valid path, string given in %s on line %d
 bool(false)
 resource(%d) of type (file_info)
 resource(%d) of type (file_info)
+
+Warning: finfo_open(%s123): failed to open stream: No such file or directory in %s on line %d
+
+Warning: finfo_open(%s123): failed to open stream: No such file or directory in %s on line %d
+
+Warning: finfo_open(): Failed to load magic database at '%s123'. in %s on line %d
 bool(false)
+
+Warning: finfo_open(%s1): failed to open stream: No such file or directory in %s on line %d
+
+Warning: finfo_open(%s1): failed to open stream: No such file or directory in %s on line %d
+
+Warning: finfo_open(): Failed to load magic database at '%s1'. in %s on line %d
 bool(false)
+
+Warning: finfo_open(%sinexistent): failed to open stream: No such file or directory in %s on line %d
+
+Warning: finfo_open(%sinexistent): failed to open stream: No such file or directory in %s on line %d
+
+Warning: finfo_open(): Failed to load magic database at '%sinexistent'. in %s on line %d
 bool(false)
@@ -26,6 +26,12 @@ var_dump( new finfo('foobar') );
 ===DONE===
 --EXPECTF--
 *** Testing finfo_open() : error functionality ***
+
+Warning: finfo_open(%sfoobarfile): failed to open stream: No such file or directory in %s on line %d
+
+Warning: finfo_open(%sfoobarfile): failed to open stream: No such file or directory in %s on line %d
+
+Warning: finfo_open(): Failed to load magic database at '%sfoobarfile'. in %s on line %d
 bool(false)

 Warning: finfo_open() expects parameter 1 to be long, array given in %s on line %d
@@ -37,9 +43,9 @@ bool(false)
 Notice: finfo_open(): Warning: using regular magic file `%s' in %s on line %d
 resource(%d) of type (file_info)

-Warning: finfo_open() expects parameter 1 to be long, %unicode_string_optional% given in %s on line %d
+Warning: finfo_open() expects parameter 1 to be long, string given in %s on line %d
 bool(false)

-Warning: finfo::finfo() expects parameter 1 to be long, %unicode_string_optional% given in %s on line %d
+Warning: finfo::finfo() expects parameter 1 to be long, string given in %s on line %d
 NULL
 ===DONE===
@@ -4807,7 +4807,9 @@ PHP_FUNCTION(pg_get_notify)
 #else 
 		if (atof(PG_VERSION) >= 9.0) {
 #endif 
+#if HAVE_PQPARAMETERSTATUS
 			add_index_string(return_value, 2, pgsql_notify->extra, 1);
+#endif
 		}
 	}
 	if (result_type & PGSQL_ASSOC) {
@@ -4818,7 +4820,9 @@ PHP_FUNCTION(pg_get_notify)
 #else 
 		if (atof(PG_VERSION) >= 9.0) {
 #endif 
+#if HAVE_PQPARAMETERSTATUS
 			add_assoc_string(return_value, "payload", pgsql_notify->extra, 1);
+#endif
 		}
 	}
 	PQfreemem(pgsql_notify);
@@ -10,7 +10,7 @@ header("X-Foo5: e\rSet-Cookie: ID=123");
 echo 'foo';
 ?>
 --EXPECTF--
-Warning: Header may not contain more than a single header, new line detected. in %s on line %d
+Warning: Header may not contain more than a single header, new line detected in %s on line %d
 foo
 --EXPECTHEADERS--
 X-Foo1: a
@@ -7,7 +7,7 @@ header("X-Foo6: e\rSet-Cookie: ID=123\n d");
 echo 'foo';
 ?>
 --EXPECTF--
-Warning: Header may not contain more than a single header, new line detected. in %s on line %d
+Warning: Header may not contain more than a single header, new line detected in %s on line %d
 foo
 --EXPECTHEADERS--
 X-foo: e
@@ -0,0 +1,14 @@
+--TEST--
+Bug #60227 (header() cannot detect the multi-line header with CR), \0 before \n
+--FILE--
+<?php
+header("X-foo: e\n foo");
+header("X-Foo6: e\0Set-Cookie: ID=\n123\n d");
+echo 'foo';
+?>
+--EXPECTF--
+Warning: Header may not contain NUL bytes in %s on line %d
+foo
+--EXPECTHEADERS--
+X-foo: e
+foo
@@ -0,0 +1,14 @@
+--TEST--
+Bug #60227 (header() cannot detect the multi-line header with CR), CRLF
+--FILE--
+<?php
+header("X-foo: e\r\n foo");
+header("X-foo: e\r\nfoo");
+echo 'foo';
+?>
+--EXPECTF--
+Warning: Header may not contain more than a single header, new line detected in %s on line %d
+foo
+--EXPECTHEADERS--
+X-foo: e
+ foo
@@ -0,0 +1,27 @@
+--TEST--
+Bug #60455: stream_get_line and \0 as a delimiter
+--FILE--
+<?php
+class TestStream {
+	private $s = 0;
+	function stream_open($path, $mode, $options, &$opened_path) {
+	        return true;
+	}
+	function stream_read($count) {
+		if ($this->s++ == 0)
+			return "a\0";
+		
+		return "";
+	}
+	function stream_eof() {
+		return $this->s >= 2;
+	}
+	
+}
+
+stream_wrapper_register("test", "TestStream");
+
+$f = fopen("test://", "r");
+var_dump(stream_get_line($f, 100, "\0"));
+--EXPECT--
+string(1) "a"
@@ -590,17 +590,26 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 			return FAILURE;
 		}
 	} else {
-		/* new line safety check */
-		char *s = header_line;
-		while (s = strpbrk(s, "\n\r")) {
-			if (s[1] == ' ' || s[1] == '\t') {
-				/* RFC 2616 allows new lines if followed by SP or HT */
-				s++;
-				continue;
+		/* new line/NUL character safety check */
+		int i;
+		for (i = 0; i < header_line_len; i++) {
+			/* RFC 2616 allows new lines if followed by SP or HT */
+			int illegal_break =
+					(header_line[i+1] != ' ' && header_line[i+1] != '\t')
+					&& (
+						header_line[i] == '\n'
+						|| (header_line[i] == '\r' && header_line[i+1] != '\n'));
+			if (illegal_break) {
+				efree(header_line);
+				sapi_module.sapi_error(E_WARNING, "Header may not contain "
+						"more than a single header, new line detected");
+				return FAILURE;
+			}
+			if (header_line[i] == '\0') {
+				efree(header_line);
+				sapi_module.sapi_error(E_WARNING, "Header may not contain NUL bytes");
+				return FAILURE;
 			}
-			efree(header_line);
-			sapi_module.sapi_error(E_WARNING, "Header may not contain more than a single header, new line detected.");
-			return FAILURE;
 		}
 	}

@@ -945,7 +954,9 @@ SAPI_API char *sapi_getenv(char *name, size_t name_len TSRMLS_DC)
 		} else {
 			return NULL;
 		}
-		sapi_module.input_filter(PARSE_ENV, name, &value, strlen(value), NULL TSRMLS_CC);
+		if (sapi_module.input_filter) {
+			sapi_module.input_filter(PARSE_ENV, name, &value, strlen(value), NULL TSRMLS_CC);
+		}
 		return value;
 	}
 	return NULL;
@@ -2,7 +2,7 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 3
-#define PHP_RELEASE_VERSION 11
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.3.11-dev"
-#define PHP_VERSION_ID 50311
+#define PHP_RELEASE_VERSION 12
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.3.12"
+#define PHP_VERSION_ID 50312
@@ -957,8 +957,8 @@ PHPAPI char *php_stream_get_record(php_stream *stream, size_t maxlen, size_t *re
 	char	*ret_buf,				/* returned buffer */
 			*found_delim = NULL;
 	size_t	buffered_len,
-			tent_ret_len;			/* tentative returned length*/
-	int		has_delim	 = delim_len > 0 && delim[0] != '\0';
+			tent_ret_len;			/* tentative returned length */
+	int		has_delim	 = delim_len > 0;

 	if (maxlen == 0) {
 		return NULL;
@@ -70,6 +70,7 @@
 #include "php_main.h"
 #include "fopen_wrappers.h"
 #include "ext/standard/php_standard.h"
+#include "ext/standard/url.h"

 #ifdef PHP_WIN32
 # include <io.h>
@@ -1507,6 +1508,9 @@ int main(int argc, char *argv[])
 #ifndef PHP_WIN32
 	int status = 0;
 #endif
+	char *query_string;
+	char *decoded_query_string;
+	int skip_getopt = 0;

 #if 0 && defined(PHP_DEBUG)
 	/* IIS is always making things more difficult.  This allows
@@ -1556,7 +1560,16 @@ int main(int argc, char *argv[])
 		}
 	}

-	while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 0, 2)) != -1) {
+	if(query_string = getenv("QUERY_STRING")) {
+		decoded_query_string = strdup(query_string);
+		php_url_decode(decoded_query_string, strlen(decoded_query_string));
+		if(*decoded_query_string == '-' && strchr(decoded_query_string, '=') == NULL) {
+			skip_getopt = 1;
+		}
+		free(decoded_query_string);
+	}
+
+	while (!skip_getopt && (c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 0, 2)) != -1) {
 		switch (c) {
 			case 'c':
 				if (cgi_sapi_module.php_ini_path_override) {
Author	SHA1	Message	Date
Johannes Schlüter	03cb63bc1d	PHP 5.3.12	2012-05-03 15:54:59 +02:00
Rasmus Lerdorf	29300b1f9d	Fix for CVE-2012-1823	2012-05-03 15:51:52 +02:00
Johannes Schlüter	704bbb3263	PHP 5.3.11	2012-04-25 00:13:15 +02:00
Johannes Schlüter	b9562b3085	PHP 5.3.11RC2	2012-04-12 11:28:49 +02:00
Johannes Schlüter	1b444d85e0	Update NEWS	2012-04-12 11:21:19 +02:00
Anatoliy Belsky	cf98706376	Bug #61566 Fileinfo ext\fileinfo\tests\finfo_file_002.phpt fails This patch fixes the failure caused by the posix lseek and read versions under windows in cdf_read() . Additionally all the occurences of lseek and read was replaced by _lseek and _reed for windows.	2012-04-12 11:12:10 +02:00
Anatoliy Belsky	56771b8648	Fix bug #61565 Fileinfo ext\fileinfo\tests\finfo_file_001.phpt fails	2012-04-12 11:11:58 +02:00
Gustavo André dos Santos Lopes	11b5738aef	Disabled EOL conversions on certain tests	2012-04-12 11:10:16 +02:00
Yasuo Ohgaki	aa45b5405e	Fixed bug #60718 Complie problem with libpq (PostgreSQL 7.3 or less)	2012-04-12 11:08:46 +02:00
Derick Rethans	74c92f77c1	- Updated to version 2012.3 (2012c)	2012-04-12 11:08:37 +02:00
Johannes Schlüter	7ac36ec8e5	Cherry-pick `4cc74767` Headers: forbid \r and \n also after \0, allow CRLF followed by HT or SP and forbid \0. See bug #60227. Conflicts: ext/standard/tests/general_functions/bug60227.phpt ext/standard/tests/general_functions/bug60227_1.phpt ext/standard/tests/general_functions/bug60227_2.phpt main/SAPI.c	2012-04-12 11:08:00 +02:00
Xinchen Hui	8ccf065577	Fixed bug #61650 (ini parser crashes when using ${xxxx} ini variables (without apache2))	2012-04-12 11:04:39 +02:00
Gustavo André dos Santos Lopes	a4e6394a06	Fixed bug in new stream_get_line() when using NUL as a delimiter. This is the issue Derick spotted a few days ago..	2012-04-12 11:04:20 +02:00
Johannes Schlüter	9ad0b878d9	PHP 5.3.11RC1	2012-03-29 11:17:41 +02:00