Update versions for PHP 7.2.28

NEWS

@@ -1,31 +1,5 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-14 May 2020, PHP 7.2.31
-
-- Core:
-  . Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned). 
-    (CVE-2019-11048) (cmb)
-  . Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp 
-    files are not cleaned). (CVE-2019-11048) (cmb)
-
-16 Apr 2020, PHP 7.2.30
-
-- Standard:
-  . Fixed bug #79468 (SIGSEGV when closing stream handle with a stream filter
-    appended). (dinosaur)
-  . Fixed bug #79330 (shell_exec() silently truncates after a null byte). (stas)
-  . Fixed bug #79465 (OOB Read in urldecode()). (stas)
-
-19 Mar 2020, PHP 7.2.29
-
-- EXIF:
-  . Fixed bug #79282 (Use-of-uninitialized-value in exif). (CVE-2020-7064) 
-    (Nikita)
-
-- Standard: 
-  . Fixed bug #79329 (get_headers() silently truncates after a null byte) 
-    (CVE-2020-7066). (cmb)
-
 20 Feb 2020, PHP 7.2.28
 
 - DOM:

configure.ac

@@ -107,7 +107,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
-PHP_RELEASE_VERSION=31
+PHP_RELEASE_VERSION=28
 PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

ext/exif/exif.c

@@ -3692,11 +3692,6 @@ static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf,
 {
 	unsigned exif_value_2a, offset_of_ifd;
 
-	if (length < 2) {
-		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Missing TIFF alignment marker");
-		return;
-	}
-
 	/* set the thumbnail stuff to nothing so we can test to see if they get set up */
 	if (memcmp(CharBuf, "II", 2) == 0) {
 		ImageInfo->motorola_intel = 0;
@@ -3849,7 +3844,7 @@ static int exif_scan_JPEG_header(image_info_type *ImageInfo)
 			return FALSE;
 		}
 
-		sn = exif_file_sections_add(ImageInfo, marker, itemlen, NULL);
+		sn = exif_file_sections_add(ImageInfo, marker, itemlen+1, NULL);
 		Data = ImageInfo->file.list[sn].data;
 
 		/* Store first two pre-read bytes. */

ext/exif/tests/bug79282.phpt

@@ -1,15 +0,0 @@
---TEST--
-Bug #79282: Use-of-uninitialized-value in exif
---FILE--
-<?php
-
-var_dump(exif_read_data('data://image/jpeg;base64,/9jhAAlFeGlmAAAg'));
-
-?>
---EXPECTF--
-Warning: exif_read_data(): Missing TIFF alignment marker in %s on line %d
-
-Warning: exif_read_data(): File structure corrupted in %s on line %d
-
-Warning: exif_read_data(): Invalid JPEG file in %s on line %d
-bool(false)

ext/standard/exec.c

@@ -531,15 +531,6 @@ PHP_FUNCTION(shell_exec)
 		Z_PARAM_STRING(command, command_len)
 	ZEND_PARSE_PARAMETERS_END();
 
-	if (!command_len) {
-		php_error_docref(NULL, E_WARNING, "Cannot execute a blank command");
-		RETURN_FALSE;
-	}
-	if (strlen(command) != command_len) {
-		php_error_docref(NULL, E_WARNING, "NULL byte detected. Possible attack");
-		RETURN_FALSE;
-	}
-
 #ifdef PHP_WIN32
 	if ((in=VCWD_POPEN(command, "rt"))==NULL) {
 #else

ext/standard/tests/filters/bug79468.phpt

@@ -1,21 +0,0 @@
---TEST--
-Bug #79468	SIGSEGV when closing stream handle with a stream filter appended
---SKIPIF--
-<?php
-$filters = stream_get_filters();
-if(! in_array( "string.rot13", $filters )) die( "skip rot13 filter not available." );
-?>
---FILE--
-<?php
-$fp = fopen('php://temp', 'rb');
-$rot13_filter = stream_filter_append($fp, "string.rot13", STREAM_FILTER_WRITE);
-fwrite($fp, "This is ");
-fclose($fp);
-try {
-    stream_filter_remove($rot13_filter);
-} catch (\Throwable $e) {
-    var_dump($e->getMessage());
-}
-?>
---EXPECTF--
-Warning: stream_filter_remove(): Invalid resource given, not a stream filter in %s on line %d

ext/standard/url.c

@@ -559,7 +559,7 @@ PHPAPI size_t php_url_decode(char *str, size_t len)
 #ifndef CHARSET_EBCDIC
 			*dest = (char) php_htoi(data + 1);
 #else
-			*dest = os_toebcdic[(unsigned char) php_htoi(data + 1)];
+			*dest = os_toebcdic[(char) php_htoi(data + 1)];
 #endif
 			data += 2;
 			len -= 2;
@@ -651,7 +651,7 @@ PHPAPI size_t php_raw_url_decode(char *str, size_t len)
 #ifndef CHARSET_EBCDIC
 			*dest = (char) php_htoi(data + 1);
 #else
-			*dest = os_toebcdic[(unsigned char) php_htoi(data + 1)];
+			*dest = os_toebcdic[(char) php_htoi(data + 1)];
 #endif
 			data += 2;
 			len -= 2;
@@ -680,7 +680,7 @@ PHP_FUNCTION(get_headers)
 	php_stream_context *context;
 
 	ZEND_PARSE_PARAMETERS_START(1, 3)
-		Z_PARAM_PATH(url, url_len)
+		Z_PARAM_STRING(url, url_len)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_LONG(format)
 		Z_PARAM_RESOURCE_EX(zcontext, 1, 0)

main/php_version.h

@@ -2,7 +2,7 @@
 /* edit configure.ac to change version number */
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 2
-#define PHP_RELEASE_VERSION 31
+#define PHP_RELEASE_VERSION 28
 #define PHP_EXTRA_VERSION ""
-#define PHP_VERSION "7.2.31"
-#define PHP_VERSION_ID 70231
+#define PHP_VERSION "7.2.28"
+#define PHP_VERSION_ID 70228

main/rfc1867.c

@@ -616,7 +616,7 @@ static void *php_ap_memstr(char *haystack, int haystacklen, char *needle, int ne
 }
 
 /* read until a boundary condition */
-static size_t multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
+static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
 {
 	size_t len, max;
 	char *bound;
@@ -655,7 +655,7 @@ static size_t multipart_buffer_read(multipart_buffer *self, char *buf, size_t by
 		self->buf_begin += len;
 	}
 
-	return len;
+	return (int)len;
 }
 
 /*
@@ -665,7 +665,7 @@ static size_t multipart_buffer_read(multipart_buffer *self, char *buf, size_t by
 static char *multipart_buffer_read_body(multipart_buffer *self, size_t *len)
 {
 	char buf[FILLUNIT], *out=NULL;
-	size_t total_bytes=0, read_bytes=0;
+	int total_bytes=0, read_bytes=0;
 
 	while((read_bytes = multipart_buffer_read(self, buf, sizeof(buf), NULL))) {
 		out = erealloc(out, total_bytes + read_bytes + 1);
@@ -692,8 +692,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
 	char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL;
 	char *lbuf = NULL, *abuf = NULL;
 	zend_string *temp_filename = NULL;
-	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0;
-	size_t array_len = 0;
+	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0;
 	int64_t total_bytes = 0, max_file_size = 0;
 	int skip_upload = 0, anonindex = 0, is_anonymous;
 	HashTable *uploaded_files = NULL;
@@ -1127,7 +1126,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
 			is_arr_upload =	(start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']');
 
 			if (is_arr_upload) {
-				array_len = strlen(start_arr);
+				array_len = (int)strlen(start_arr);
 				if (array_index) {
 					efree(array_index);
 				}

main/streams/streams.c

@@ -477,15 +477,9 @@ fprintf(stderr, "stream_free: %s:%p[%s] preserve_handle=%d release_cast=%d remov
 
 	if (close_options & PHP_STREAM_FREE_RELEASE_STREAM) {
 		while (stream->readfilters.head) {
-			if (stream->readfilters.head->res != NULL) {
-				zend_list_close(stream->readfilters.head->res);
-			}
 			php_stream_filter_remove(stream->readfilters.head, 1);
 		}
 		while (stream->writefilters.head) {
-			if (stream->writefilters.head->res != NULL) {
-				zend_list_close(stream->writefilters.head->res);
-			}
 			php_stream_filter_remove(stream->writefilters.head, 1);
 		}