PHP-5.6.32

Fix bug #75207, see also
https://bugzilla.redhat.com/show_bug.cgi?id=1295385
https://vcs.pcre.org/pcre?view=revision&revision=1636

(cherry picked from commit d11fceab15)

.travis.yml

@@ -1,3 +1,4 @@
+dist: precise
 language: c
 sudo: false
 addons:

NEWS

@@ -1,6 +1,15 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ?? 2017, PHP 5.6.32
+26 Sep 2017, PHP 5.6.32
+
+- Date:
+  . Fixed bug #75055 (Out-Of-Bounds Read in timelib_meridian()). (Derick)
+
+- mcrypt:
+  . Fixed bug #72535 (arcfour encryption stream filter crashes php). (Leigh)
+
+- PCRE:
+  . Fixed bug #75207 (applied upstream patch for CVE-2016-1283). (Anatol)
 
 06 Jul 2017, PHP 5.6.31
 

configure.in

@@ -120,7 +120,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=6
 PHP_RELEASE_VERSION=32
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/date/lib/parse_date.re

@@ -917,8 +917,8 @@ isoweek          = year4 "-"? "W" weekofyear;
 exif             = year4 ":" monthlz ":" daylz " " hour24lz ":" minutelz ":" secondlz;
 firstdayof       = 'first day of';
 lastdayof        = 'last day of';
-backof           = 'back of ' hour24 space? meridian?;
-frontof          = 'front of ' hour24 space? meridian?;
+backof           = 'back of ' hour24 (space? meridian)?;
+frontof          = 'front of ' hour24 (space? meridian)?;
 
 /* Common Log Format: 10/Oct/2000:13:55:36 -0700 */
 clf              = day "/" monthabbr "/" year4 ":" hour24lz ":" minutelz ":" secondlz space tzcorrection;

ext/date/tests/bug53437_var3.phpt

@@ -40,7 +40,7 @@ object(DateInterval)#%d (15) {
   ["special_amount"]=>
   int(-1)
   ["have_weekday_relative"]=>
-  int(9)
+  int(%d)
   ["have_special_relative"]=>
   int(0)
 }

ext/mcrypt/mcrypt_filter.c

@@ -89,7 +89,7 @@ static php_stream_filter_status_t php_mcrypt_filter(
 			php_stream_bucket_delref(bucket TSRMLS_CC);
 		} else {
 			/* Stream cipher */
-			php_stream_bucket_make_writeable(bucket TSRMLS_CC);
+			bucket = php_stream_bucket_make_writeable(bucket TSRMLS_CC);
 			if (data->encrypt) {
 				mcrypt_generic(data->module, bucket->buf, bucket->buflen);
 			} else {

ext/mcrypt/tests/bug72535.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #72535 arcfour encryption stream filter crashes php
+--SKIPIF--
+<?php if (!extension_loaded("mcrypt")) print "skip"; ?>
+--FILE--
+<?php
+$passphrase = 'My secret';
+$plaintext = 'Secret secret secret data';
+
+$iv = substr(md5('iv' . $passphrase, true), 0, 8);
+$key = substr(md5('pass1' . $passphrase, true) .
+	              md5('pass2' . $passphrase, true), 0, 24);
+$opts = array('iv' => $iv, 'key' => $key, 'mode' => 'stream');
+
+$expected = substr($plaintext . $plaintext, 0, 48);
+
+$fp = fopen('php://memory', 'wb+');
+stream_filter_append($fp, 'mcrypt.arcfour', STREAM_FILTER_WRITE, $opts);
+fwrite($fp, $plaintext);
+?>
+==NOCRASH==
+--EXPECT--
+==NOCRASH==

ext/pcre/pcrelib/pcre_compile.c

@@ -7274,7 +7274,12 @@ for (;; ptr++)
           so far in order to get the number. If the name is not found, leave
           the value of recno as 0 for a forward reference. */
 
-          else
+          /* This patch (removing "else") fixes a problem when a reference is
+          to multiple identically named nested groups from within the nest.
+          Once again, it is not the "proper" fix, and it results in an
+          over-allocation of memory. */
+
+          /* else */
             {
             ng = cd->named_groups;
             for (i = 0; i < cd->names_found; i++, ng++)

ext/pcre/tests/bug75207.phpt

@@ -0,0 +1,10 @@
+--TEST--
+CVE-2016-1283, see bug #75207
+--FILE--
+<?php
+preg_match("/š(?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/", "*b\dc");
+?>
+==DONE==
+--EXPECTF--
+Warning: preg_match(): Compilation failed: unmatched parentheses at offset %d in %s on line %d
+==DONE==

ext/wddx/tests/bug75055.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75055 Out-Of-Bounds Read in timelib_meridian()
+--SKIPIF--
+<?php if (!extension_loaded("wddx")) print "skip"; ?>
+--FILE--
+<?php
+
+$file_str = dirname(__FILE__) . "/bug75055.wddx";
+
+$wddx_str = file_get_contents($file_str);
+print strlen($wddx_str) . " bytes read.\n";
+
+var_dump(wddx_deserialize($wddx_str));
+?>
+--EXPECT--
+323 bytes read.
+array(1) {
+  ["aDateTime"]=>
+  string(12) "frONt of 0 0"
+}

ext/wddx/tests/bug75055.wddx

@@ -0,0 +1,13 @@
+<?xml version='1.0'?>
+<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
+<wddxPacket version='1.0'>
+<header/>
+	<data>
+        	<struct>
+                    <var name='aDateTime'>
+                         <dateTime>frONt of 0 0</dateTime>
+                     </var>
+                </struct>
+	</data>
+</wddxPacket>
+

main/php_version.h

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 6
 #define PHP_RELEASE_VERSION 32
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.6.32-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.6.32"
 #define PHP_VERSION_ID 50632

sapi/fpm/tests/003.phpt

@@ -1,7 +1,10 @@
 --TEST--
 FPM: Test IPv6 support
 --SKIPIF--
-<?php include "skipif.inc"; ?>
+<?php include "skipif.inc";
+      @stream_socket_client('tcp://[::1]:0', $errno);
+      if ($errno != 111) die('skip IPv6 not supported.');
+?>
 --FILE--
 <?php
 

sapi/fpm/tests/004.phpt

@@ -1,7 +1,10 @@
 --TEST--
 FPM: Test IPv4/IPv6 support
 --SKIPIF--
-<?php include "skipif.inc"; ?>
+<?php include "skipif.inc";
+      @stream_socket_client('tcp://[::1]:0', $errno);
+      if ($errno != 111) die('skip IPv6 not supported.');
+?>
 --FILE--
 <?php
 

sapi/fpm/tests/005.phpt

@@ -1,7 +1,10 @@
 --TEST--
 FPM: Test IPv4 allowed clients
 --SKIPIF--
-<?php include "skipif.inc"; ?>
+<?php include "skipif.inc";
+      @stream_socket_client('tcp://[::1]:0', $errno);
+      if ($errno != 111) die('skip IPv6 not supported.');
+?>
 --FILE--
 <?php
 

sapi/fpm/tests/006.phpt

@@ -1,7 +1,10 @@
 --TEST--
 FPM: Test IPv6 allowed clients (bug #68428)
 --SKIPIF--
-<?php include "skipif.inc"; ?>
+<?php include "skipif.inc";
+      @stream_socket_client('tcp://[::1]:0', $errno);
+      if ($errno != 111) die('skip IPv6 not supported.');
+?>
 --FILE--
 <?php
 

sapi/fpm/tests/007.phpt

@@ -1,7 +1,10 @@
 --TEST--
 FPM: Test IPv6 all addresses and access_log (bug #68421)
 --SKIPIF--
-<?php include "skipif.inc"; ?>
+<?php include "skipif.inc";
+      @stream_socket_client('tcp://[::1]:0', $errno);
+      if ($errno != 111) die('skip IPv6 not supported.');
+?>
 --FILE--
 <?php