5.4.27

CVE-2013-7345

Applied upstream patch:
https://github.com/file/file/commit/ef2329cf71acb59204dd981e2c6cce6c81fe467c

Add the magicdata.patch to track patches applied to upstream data file.

NEWS

@@ -1,10 +1,18 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2014, PHP 5.4.27
+03 Apr 2014, PHP 5.4.27
 
 - Core:
   . Fixed bug #60602 (proc_open() changes environment array) (Tjerk)
 
+- Fileinfo:
+  . Fixed bug #66946 (fileinfo: extensive backtracking in awk rule regular
+    expression). (CVE-2013-7345) (Remi)
+
+- FPM:
+  . Added clear_env configuration directive to disable clearenv() call.
+  (Github PR# 598, Paul Annesley)
+
 - GMP
   . fixed bug#66872 (invalid argument crashes gmp_testbit) (Pierre)
 
@@ -18,7 +26,7 @@ PHP                                                                        NEWS
 - Openssl:
   . Fixed bug #66833 (Default disgest algo is still MD5, switch to SHA1). (Remi)
   
-?? ??? 2014, PHP 5.4.26
+06 Mar 2014, PHP 5.4.26
 
 - JSON:
   . Fixed bug #65753 (JsonSerializeable couldn't implement on module extension)
@@ -28,10 +36,6 @@ PHP                                                                        NEWS
   . Fixed bug #66731 (file: infinite recursion). (CVE-2014-1943) (Remi)
   . Fixed bug #66820 (out-of-bounds memory access in fileinfo). (Remi)
 
-- FPM:
-  . Added clear_env configuration directive to disable clearenv() call.
-  (Github PR# 598, Paul Annesley)
-
 - LDAP:
   . Implemented ldap_modify_batch (https://wiki.php.net/rfc/ldap_modify_batch).
   (Ondřej Hošek)

configure.in

@@ -120,7 +120,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=4
 PHP_RELEASE_VERSION=27
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/fileinfo/magicdata.patch

@@ -0,0 +1,39 @@
+Patches applied to file sources tree before generating magic.mgc
+and before running create_data_file.php to create data_file.c.
+
+
+
+From ef2329cf71acb59204dd981e2c6cce6c81fe467c Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Mon, 25 Mar 2013 14:06:55 +0000
+Subject: [PATCH] limit to 100 repetitions to avoid excessive backtracking
+ Carsten Wolff
+
+---
+ magic/Magdir/commands | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/magic/Magdir/commands b/magic/Magdir/commands
+index 67c3eee..4a7d8dd 100644
+--- a/magic/Magdir/commands
++++ b/magic/Magdir/commands
+@@ -1,6 +1,6 @@
+ 
+ #------------------------------------------------------------------------------
+-# $File: commands,v 1.44 2013/02/05 15:20:47 christos Exp $
++# $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $
+ # commands:  file(1) magic for various shells and interpreters
+ #
+ #0	string/w	:			shell archive or script for antique kernel text
+@@ -49,7 +49,7 @@
+ !:mime	text/x-awk
+ 0	string/wt	#!\ /usr/bin/awk	awk script text executable
+ !:mime	text/x-awk
+-0	regex		=^\\s*BEGIN\\s*[{]	awk script text
++0	regex		=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
+ 
+ # AT&T Bell Labs' Plan 9 shell
+ 0	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
+-- 
+1.8.5.5
+

main/php_version.h

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 4
 #define PHP_RELEASE_VERSION 27
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.4.27-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.4.27"
 #define PHP_VERSION_ID 50427