removing the NEWS entry for #41631 as we reverted the fix for now

Revert "Merge branch 'PHP-5.5' into PHP-5.6"
This reverts commit 98e67add15, reversing changes made to 2cdc1a2b74.
2026-11-11 11:10:49 +00:00 · 2014-08-27 15:31:35 +02:00 · 2014-08-27 15:28:06 +02:00 · 2014-08-27 15:27:57 +02:00 · 2014-08-27 10:55:37 +02:00 · 2014-08-27 05:16:41 +02:00
25 changed files with 9976 additions and 635 deletions
@@ -45,6 +45,9 @@ Currently we have the following branches in use::

  master    The active development branch. 

+  PHP-5.6   Is used to release the PHP 5.6.x series. This is a current
+            stable version and is open for bugfixes only.
+
  PHP-5.5   Is used to release the PHP 5.5.x series. This is a current
            stable version and is open for bugfixes only.

@@ -61,6 +64,9 @@ Currently we have the following branches in use::

  PHP-4.4   This branch is closed.

+  PHP-X.Y.Z These branches are used for the release managers for tagging
+            the releases, hence they are closed to the general public.
+
 The next few rules are more of a technical nature::

   1. All changes should first go to the lowest branch (i.e. 5.3) and then 
@@ -232,6 +232,13 @@ PHP 5.6 UPGRADE NOTES
  crypto method from the context is used as a fallback if no crypto method is
  specified at call-time.

+- Reflection:
+  ReflectionClass::newInstanceWithoutConstructor previously didn't allow the
+  instantiation of any internal class which used custom object storage
+  (overriding the default create_object handler), this was changed to only
+  reject the instantiation of such classes if the class is also marked as
+  final.
+
 - XMLReader:
  XMLReader::getAttributeNs and XMLReader::getAttributeNo now return NULL if
  the attribute could not be found, just like XMLReader::getAttribute.
@@ -1,6 +1,6 @@
 $Id$

-UPGRADE NOTES - PHP X.Y
+PHP 5.6 INTERNALS UPGRADE NOTES

 1. Internal API changes
  a. Addition of do_operation and compare object handlers
@@ -22,7 +22,7 @@
 #ifndef ZEND_H
 #define ZEND_H

-#define ZEND_VERSION "2.6.0-dev"
+#define ZEND_VERSION "2.6.0"

 #define ZEND_ENGINE_2

@@ -120,7 +120,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=6
 PHP_RELEASE_VERSION=0
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -2680,6 +2680,9 @@ PHP_FUNCTION(date_create_immutable)
 	if (!php_date_initialize(zend_object_store_get_object(&datetime_object TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 0 TSRMLS_CC)) {
 		zval_dtor(&datetime_object);
 		RETURN_FALSE;
+	} else {
+		zval *datetime_object_ptr = &datetime_object;
+		RETVAL_ZVAL(datetime_object_ptr, 0, 0);
 	}
 	RETVAL_ZVAL(&datetime_object, 0, 0);
 }
@@ -2726,6 +2729,9 @@ PHP_FUNCTION(date_create_immutable_from_format)
 	if (!php_date_initialize(zend_object_store_get_object(&datetime_object TSRMLS_CC), time_str, time_str_len, format_str, timezone_object, 0 TSRMLS_CC)) {
 		zval_dtor(&datetime_object);
 		RETURN_FALSE;
+	} else {
+		zval *datetime_object_ptr = &datetime_object;
+		RETVAL_ZVAL(datetime_object_ptr, 0, 0);
 	}
 	RETVAL_ZVAL(&datetime_object, 0, 0);
 }
@@ -823,7 +823,7 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 		q = (const uint8_t *)(const void *)
 		    ((const char *)(const void *)p + ofs
 		    - 2 * sizeof(uint32_t));
-		if (q > e) {
+		if (q < p || q > e) {
 			DPRINTF(("Ran of the end %p > %p\n", q, e));
 			goto out;
 		}
@@ -124,6 +124,11 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 				RETURN_FALSE;
 			}
 		} else if (Z_TYPE_P(to_zval) == IS_STRING) {
+			if (CHECK_ZVAL_NULL_PATH(to_zval)) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid 2nd parameter, filename must not contain null bytes");
+				RETURN_FALSE;
+			}
+
 			stream = php_stream_open_wrapper(Z_STRVAL_P(to_zval), "wb", REPORT_ERRORS|IGNORE_PATH|IGNORE_URL_WIN, NULL);
 			if (stream == NULL) {
 				RETURN_FALSE;
@@ -0,0 +1,31 @@
+--TEST--
+Testing null byte injection in imagegd2
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegd2 TEST\n";
+imagegd2($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegd2 TEST
+
+Warning: imagegd2() expects parameter 2 to be a valid path, string given in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,31 @@
+--TEST--
+Testing null byte injection in imagegd
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegd TEST\n";
+imagegd($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegd TEST
+
+Warning: imagegd() expects parameter 2 to be a valid path, string given in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagegif
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['GIF Create Support']) || $support['GIF Create Support'] === false) {
+	print 'skip gif support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegif TEST\n";
+imagegif($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegif TEST
+
+Warning: imagegif(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagejpeg
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['JPEG Support']) || $support['JPEG Support'] === false) {
+	print 'skip jpeg support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagejpeg TEST\n";
+imagejpeg($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagejpeg TEST
+
+Warning: imagejpeg(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagepng
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['PNG Support']) || $support['PNG Support'] === false) {
+	print 'skip png support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagepng TEST\n";
+imagepng($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagepng TEST
+
+Warning: imagepng(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagewbmp
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['WBMP Support']) || $support['WBMP Support'] === false) {
+	print 'skip wbmp support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagewbmp TEST\n";
+imagewbmp($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagewbmp TEST
+
+Warning: imagewbmp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagewebp
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['WEBP Support']) || $support['WEBP Support'] === false) {
+	print 'skip webp support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagewebp TEST\n";
+imagewebp($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagewbmp TEST
+
+Warning: imagewebp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -1798,59 +1798,13 @@ static size_t php_openssl_sockop_write(php_stream *stream, const char *buf, size
 }
 /* }}} */

-static void php_openssl_stream_wait_for_data(php_netstream_data_t *sock)
-{
-	int retval;
-	struct timeval *ptimeout;
-
-	if (sock->socket == -1) {
-		return;
-	}
-	
-	sock->timeout_event = 0;
-
-	if (sock->timeout.tv_sec == -1)
-		ptimeout = NULL;
-	else
-		ptimeout = &sock->timeout;
-
-	while(1) {
-		retval = php_pollfd_for(sock->socket, PHP_POLLREADABLE, ptimeout);
-
-		if (retval == 0)
-			sock->timeout_event = 1;
-
-		if (retval >= 0)
-			break;
-
-		if (php_socket_errno() != EINTR)
-			break;
-	}
-}
-
 static size_t php_openssl_sockop_read(php_stream *stream, char *buf, size_t count TSRMLS_DC) /* {{{ */
 {
 	php_openssl_netstream_data_t *sslsock = (php_openssl_netstream_data_t*)stream->abstract;
-	php_netstream_data_t *sock;
 	int nr_bytes = 0;

 	if (sslsock->ssl_active) {
 		int retry = 1;
-		sock = (php_netstream_data_t*)stream->abstract;
-
-		/* The SSL_read() function will block indefinitely waiting for data on a blocking
-		   socket. If we don't poll for readability first this operation has the potential
-		   to hang forever. To avoid this scenario we poll with a timeout before performing
-		   the actual read. If it times out we're finished.
-		*/
-		if (sock->is_blocked) {
-			php_openssl_stream_wait_for_data(sock);
-			if (sock->timeout_event) {
-				stream->eof = 1;
-				php_error_docref(NULL TSRMLS_CC, E_WARNING, "SSL read operation timed out");
-				return nr_bytes;
-			}
-		}

 		do {
 			nr_bytes = SSL_read(sslsock->ssl_handle, buf, count);
@@ -1994,7 +1994,7 @@ static PHP_FUNCTION(session_regenerate_id)
 				RETURN_FALSE;
 			}
 			efree(PS(id));
-			PS(id) = NULL;
+			memset(PS(session_data_hash),'\0', 16);
 		}

 		PS(id) = PS(mod)->s_create_sid(&PS(mod_data), NULL TSRMLS_CC);
@@ -0,0 +1,41 @@
+--TEST--
+Bug #67694	Regression in session_regenerate_id()
+--INI--
+session.save_handler = files
+session.name=PHPSESSID
+session.auto_start = 0
+session.use_cookies = 0
+session.cache_limiter =
+date.timezone = UTC
+--SKIPIF--
+<?php include('skipif.inc'); ?>
+--FILE--
+<?php
+
+$data = date('r');
+
+session_start();
+$id = session_id();
+$_SESSION['init'] = $data;
+
+session_write_close();
+
+session_id($id);
+session_start();
+
+session_regenerate_id(false);
+
+$newid = session_id();
+var_dump($newid != $id);
+
+session_write_close();
+
+unset($_SESSION);
+
+session_id($newid);
+session_start();
+
+var_dump(isset($_SESSION['init']) && $data == $_SESSION['init']);
+--EXPECT--
+bool(true)
+bool(true)
@@ -412,8 +412,14 @@ PHP_FUNCTION(dns_check_record)

 #if HAVE_FULL_DNS_FUNCS

+#define CHECKCP(n) do { \
+	if (cp + n > end) { \
+		return NULL; \
+	} \
+} while (0)
+
 /* {{{ php_parserr */
-static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int store, int raw, zval **subarray)
+static u_char *php_parserr(u_char *cp, u_char *end, querybuf *answer, int type_to_fetch, int store, int raw, zval **subarray)
 {
 	u_short type, class, dlen;
 	u_long ttl;
@@ -425,16 +431,18 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int

 	*subarray = NULL;

-	n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, sizeof(name) - 2);
+	n = dn_expand(answer->qb2, end, cp, name, sizeof(name) - 2);
 	if (n < 0) {
 		return NULL;
 	}
 	cp += n;

+	CHECKCP(10);
 	GETSHORT(type, cp);
 	GETSHORT(class, cp);
 	GETLONG(ttl, cp);
 	GETSHORT(dlen, cp);
+	CHECKCP(dlen);
 	if (type_to_fetch != T_ANY && type != type_to_fetch) {
 		cp += dlen;
 		return cp;
@@ -461,12 +469,14 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int

 	switch (type) {
 		case DNS_T_A:
+			CHECKCP(4);
 			add_assoc_string(*subarray, "type", "A", 1);
 			snprintf(name, sizeof(name), "%d.%d.%d.%d", cp[0], cp[1], cp[2], cp[3]);
 			add_assoc_string(*subarray, "ip", name, 1);
 			cp += dlen;
 			break;
 		case DNS_T_MX:
+			CHECKCP(2);
 			add_assoc_string(*subarray, "type", "MX", 1);
 			GETSHORT(n, cp);
 			add_assoc_long(*subarray, "pri", n);
@@ -485,7 +495,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
 			if (type == DNS_T_PTR) {
 				add_assoc_string(*subarray, "type", "PTR", 1);
 			}
-			n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2);
+			n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2);
 			if (n < 0) {
 				return NULL;
 			}
@@ -495,18 +505,22 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
 		case DNS_T_HINFO:
 			/* See RFC 1010 for values */
 			add_assoc_string(*subarray, "type", "HINFO", 1);
+			CHECKCP(1);
 			n = *cp & 0xFF;
 			cp++;
+			CHECKCP(n);
 			add_assoc_stringl(*subarray, "cpu", (char*)cp, n, 1);
 			cp += n;
+			CHECKCP(1);
 			n = *cp & 0xFF;
 			cp++;
+			CHECKCP(n);
 			add_assoc_stringl(*subarray, "os", (char*)cp, n, 1);
 			cp += n;
 			break;
 		case DNS_T_TXT:
 			{
-				int ll = 0;
+				int l1 = 0, l2 = 0;
 				zval *entries = NULL;

 				add_assoc_string(*subarray, "type", "TXT", 1);
@@ -515,37 +529,41 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
 				MAKE_STD_ZVAL(entries);
 				array_init(entries);
 				
-				while (ll < dlen) {
-					n = cp[ll];
-					if ((ll + n) >= dlen) {
+				while (l1 < dlen) {
+					n = cp[l1];
+					if ((l1 + n) >= dlen) {
 						// Invalid chunk length, truncate
-						n = dlen - (ll + 1);
+						n = dlen - (l1 + 1);
 					}
-					memcpy(tp + ll , cp + ll + 1, n);
-					add_next_index_stringl(entries, cp + ll + 1, n, 1);
-					ll = ll + n + 1;
+					if (n) {
+						memcpy(tp + l2 , cp + l1 + 1, n);
+						add_next_index_stringl(entries, cp + l1 + 1, n, 1);
+					}
+					l1 = l1 + n + 1;
+					l2 = l2 + n;
 				}
-				tp[dlen] = '\0';
+				tp[l2] = '\0';
 				cp += dlen;

-				add_assoc_stringl(*subarray, "txt", tp, (dlen>0)?dlen - 1:0, 0);
+				add_assoc_stringl(*subarray, "txt", tp, l2, 0);
 				add_assoc_zval(*subarray, "entries", entries);
 			}
 			break;
 		case DNS_T_SOA:
 			add_assoc_string(*subarray, "type", "SOA", 1);
-			n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) -2);
+			n = dn_expand(answer->qb2, end, cp, name, (sizeof name) -2);
 			if (n < 0) {
 				return NULL;
 			}
 			cp += n;
 			add_assoc_string(*subarray, "mname", name, 1);
-			n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) -2);
+			n = dn_expand(answer->qb2, end, cp, name, (sizeof name) -2);
 			if (n < 0) {
 				return NULL;
 			}
 			cp += n;
 			add_assoc_string(*subarray, "rname", name, 1);
+			CHECKCP(5*4);
 			GETLONG(n, cp);
 			add_assoc_long(*subarray, "serial", n);
 			GETLONG(n, cp);
@@ -559,6 +577,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
 			break;
 		case DNS_T_AAAA:
 			tp = (u_char*)name;
+			CHECKCP(8*2);
 			for(i=0; i < 8; i++) {
 				GETSHORT(s, cp);
 				if (s != 0) {
@@ -593,6 +612,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
 		case DNS_T_A6:
 			p = cp;
 			add_assoc_string(*subarray, "type", "A6", 1);
+			CHECKCP(1);
 			n = ((int)cp[0]) & 0xFF;
 			cp++;
 			add_assoc_long(*subarray, "masklen", n);
@@ -628,6 +648,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
 				cp++;
 			}
 			for (i = (n + 8) / 16; i < 8; i++) {
+				CHECKCP(2);
 				GETSHORT(s, cp);
 				if (s != 0) {
 					if (tp > (u_char *)name) {
@@ -657,7 +678,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
 			tp[0] = '\0';
 			add_assoc_string(*subarray, "ipv6", name, 1);
 			if (cp < p + dlen) {
-				n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2);
+				n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2);
 				if (n < 0) {
 					return NULL;
 				}
@@ -666,6 +687,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
 			}
 			break;
 		case DNS_T_SRV:
+			CHECKCP(3*2);
 			add_assoc_string(*subarray, "type", "SRV", 1);
 			GETSHORT(n, cp);
 			add_assoc_long(*subarray, "pri", n);
@@ -673,7 +695,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
 			add_assoc_long(*subarray, "weight", n);
 			GETSHORT(n, cp);
 			add_assoc_long(*subarray, "port", n);
-			n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2);
+			n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2);
 			if (n < 0) {
 				return NULL;
 			}
@@ -681,21 +703,35 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
 			add_assoc_string(*subarray, "target", name, 1);
 			break;
 		case DNS_T_NAPTR:
+			CHECKCP(2*2);
 			add_assoc_string(*subarray, "type", "NAPTR", 1);
 			GETSHORT(n, cp);
 			add_assoc_long(*subarray, "order", n);
 			GETSHORT(n, cp);
 			add_assoc_long(*subarray, "pref", n);
+
+			CHECKCP(1);
 			n = (cp[0] & 0xFF);
-			add_assoc_stringl(*subarray, "flags", (char*)++cp, n, 1);
+			cp++;
+			CHECKCP(n);
+			add_assoc_stringl(*subarray, "flags", (char*)cp, n, 1);
 			cp += n;
+
+			CHECKCP(1);
 			n = (cp[0] & 0xFF);
-			add_assoc_stringl(*subarray, "services", (char*)++cp, n, 1);
+			cp++;
+			CHECKCP(n);
+			add_assoc_stringl(*subarray, "services", (char*)cp, n, 1);
 			cp += n;
+
+			CHECKCP(1);
 			n = (cp[0] & 0xFF);
-			add_assoc_stringl(*subarray, "regex", (char*)++cp, n, 1);
+			cp++;
+			CHECKCP(n);
+			add_assoc_stringl(*subarray, "regex", (char*)cp, n, 1);
 			cp += n;
-			n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2);
+
+			n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2);
 			if (n < 0) {
 				return NULL;
 			}
@@ -888,7 +924,7 @@ PHP_FUNCTION(dns_get_record)
 			while (an-- && cp && cp < end) {
 				zval *retval;

-				cp = php_parserr(cp, &answer, type_to_fetch, store_results, raw, &retval);
+				cp = php_parserr(cp, end, &answer, type_to_fetch, store_results, raw, &retval);
 				if (retval != NULL && store_results) {
 					add_next_index_zval(return_value, retval);
 				}
@@ -901,7 +937,7 @@ PHP_FUNCTION(dns_get_record)
 				while (ns-- > 0 && cp && cp < end) {
 					zval *retval = NULL;

-					cp = php_parserr(cp, &answer, DNS_T_ANY, authns != NULL, raw, &retval);
+					cp = php_parserr(cp, end, &answer, DNS_T_ANY, authns != NULL, raw, &retval);
 					if (retval != NULL) {
 						add_next_index_zval(authns, retval);
 					}
@@ -913,7 +949,7 @@ PHP_FUNCTION(dns_get_record)
 				while (ar-- > 0 && cp && cp < end) {
 					zval *retval = NULL;

-					cp = php_parserr(cp, &answer, DNS_T_ANY, 1, raw, &retval);
+					cp = php_parserr(cp, end, &answer, DNS_T_ANY, 1, raw, &retval);
 					if (retval != NULL) {
 						add_next_index_zval(addtl, retval);
 					}
@@ -1,26 +0,0 @@
--TEST--
-Bug #67724 (chained zlib filters silently fail with large amounts of data)
--SKIPIF--
-<?php
-extension_loaded("zlib") or die("skip need ext/zlib");
-?>
--FILE--
-<?php
-echo "Test\n";
-
-$f = fopen(__DIR__."/bug67724.gz.gz", "rb")
-	or die(current(error_get_last()));
-stream_filter_append($f, "zlib.inflate", STREAM_FILTER_READ, ["window" => 30]);
-stream_filter_append($f, "zlib.inflate", STREAM_FILTER_READ, ["window" => 30]);
-for ($i = 0; !feof($f); $i += strlen(fread($f, 0x1000)))
-	;
-fclose($f);
-
-var_dump($i);
-
-?>
-DONE
--EXPECT--
-Test
-int(25600000)
-DONE
@@ -302,8 +302,7 @@ static php_stream_filter *php_zlib_filter_create(const char *filtername, zval *f

 	data->strm.zalloc = (alloc_func) php_zlib_alloc;
 	data->strm.zfree = (free_func) php_zlib_free;
-	data->strm.avail_out = data->outbuf_len = 0x8000;
-	data->inbuf_len = 2048;
+	data->strm.avail_out = data->outbuf_len = data->inbuf_len = 2048;
 	data->strm.next_in = data->inbuf = (Bytef *) pemalloc(data->inbuf_len, persistent);
 	if (!data->inbuf) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Failed allocating %zd bytes", data->inbuf_len);
@@ -992,6 +992,7 @@ PHPAPI char *php_socket_strerror(long err, char *buf, size_t bufsize)
 		buf = estrdup(errstr);
 	} else {
 		strncpy(buf, errstr, bufsize);
+		buf[bufsize?(bufsize-1):0] = 0;
 	}
 	return buf;
 #else
@@ -1016,6 +1017,7 @@ PHPAPI char *php_socket_strerror(long err, char *buf, size_t bufsize)
 		buf = estrdup(sysbuf);
 	} else {
 		strncpy(buf, sysbuf, bufsize);
+		buf[bufsize?(bufsize-1):0] = 0;
 	}

 	if (free_it) {
@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 6
 #define PHP_RELEASE_VERSION 0
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.6.0-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.6.0"
 #define PHP_VERSION_ID 50600
Author	SHA1	Message	Date
Ferenc Kovacs	fc1df8e7a6	removing the NEWS entry for #41631 as we reverted the fix for now	2014-08-27 15:31:35 +02:00
Ferenc Kovacs	030a84a3f0	Revert "Merge branch 'PHP-5.5' into PHP-5.6" This reverts commit `98e67add15`, reversing changes made to `2cdc1a2b74`.	2014-08-27 15:28:06 +02:00
Ferenc Kovacs	8553a9f10c	Revert "fix TS build" This reverts commit `84a4041ba4`.	2014-08-27 15:27:57 +02:00
Ferenc Kovacs	8a14180422	reworked NEWS for 5.6.0GA	2014-08-27 10:55:37 +02:00
Ferenc Kovacs	48a9cea762	update the GIT-RULES with the 5.6 and the release branches	2014-08-27 05:16:41 +02:00
Ferenc Kovacs	97f01febca	better heading for UPGRADING.INTERNALS	2014-08-27 05:16:23 +02:00
Ferenc Kovacs	d8db82231e	remove the -dev suffix from the Zend version	2014-08-27 05:15:58 +02:00
Tjerk Meesters	7db10e43ac	Some changes were lost in the merge commit of #66091	2014-08-27 05:10:34 +02:00
Ferenc Kovacs	5a1ff3bf50	bump versions to stable	2014-08-27 05:00:14 +02:00
Ferenc Kovacs	b0cb9341bd	add the final NEWS entry for 5.6.0	2014-08-27 04:56:51 +02:00
Remi Collet	d7d7d23fcf	Fixed Sec Bug #67717 segfault in dns_get_record CVE-2014-3597 Incomplete fix for CVE-2014-4049 Check possible buffer overflow - pass real buffer end to dn_expand calls - check buffer len before each read	2014-08-27 04:36:57 +02:00
Stanislav Malyshev	7325578bba	fix potentially missing NUL termination	2014-08-27 04:36:44 +02:00
Ferenc Kovacs	2c27515409	improve the grammar for my recent UPGRADING note	2014-08-27 04:35:23 +02:00
Ferenc Kovacs	4b3de4dae1	mention the changes regarding ReflectionClass::newInstanceWithoutConstructor in UPGRADING see the discussion on the mailing list and in the pull request for details: https://github.com/php/php-src/pull/733	2014-08-27 04:35:12 +02:00
Remi Collet	77b09bfc35	Fix bug #67716 - Segfault in cdf.c	2014-08-27 04:31:44 +02:00
Lior Kaplan	b6a63b285c	Bug #67730 : Add tests by Ryan Mauger <ryan@rmauger.co.uk>	2014-08-27 04:29:44 +02:00
Stanislav Malyshev	c9da6430d3	Fix bug #67730 - Null byte injection possible with imagexxx functions	2014-08-27 04:29:28 +02:00
Ferenc Kovacs	d18dd11cbd	Revert "Fixed Bug #67724 " This reverts commit `e4ff7f2ee3`.	2014-08-27 04:28:14 +02:00
Tjerk Meesters	e60d39581a	Fixed #67694 : Regression in session_regenerate_id()	2014-08-27 04:27:26 +02:00
Ferenc Kovacs	7ac17d0d79	bump to RC4	2014-08-14 02:54:13 +02:00
Ferenc Kovacs	b6aace4592	Merge branch 'PHP-5.6' into PHP-5.6.0 * PHP-5.6: (60 commits) new NEWS block for the next release Updated NEWS for #66091 Updated NEWS for #66091 Fixed #66091 updated NEWS updated NEWS updated NEWS backported the fix for bug #41577 fix the failing date tests introduced with the latest timezonedb update Derick confirmed on irc that the new/current behavior is the correct and that the tests should be updated to reflect it Fixed bug #67813 (CachingIterator::__construct InvalidArgumentException wrong message) NEWS entry for `e6d93a1` / `d73d44c` restore FPM compatibility with mod_fastcgi broken since #694 / 67541, fixes bug 67606 Revert "Merge branch 'pull-request/694' into PHP-5.6" Add __debugInfo() to UPGRADING. fix TS build Update NEWS Update NEWS Update NEWS Bug #41631: Observe socket read timeouts in SSL streams wrap int8_t and int16_t with #ifdef to avoid possible clashes ... Conflicts: NEWS	2014-08-14 02:24:20 +02:00
Ferenc Kovacs	cbfc5abc3f	bump to RC3	2014-07-30 11:52:04 +02:00
Ferenc Kovacs	d8116ee400	Merge branch 'PHP-5.6' into PHP-5.6.0 * PHP-5.6: (164 commits) add missing entry to NEWS add missing entries to NEWS add NEWS block for the next RC NEWS entry for #67713 update the exception message to better match the actual check ReflectionClass::newInstanceWithoutConstructor() should be allowed to instantiate every class except those internal classes with a final __construct() Fixed usage after free Undo inadvertent commit of php_version Corrected patch for bug #60616 Wildcards should only be used in the first name component; fixed comment style Fix bug #60616 (odbc_fetch_into returns junk at end of multi-byte char fields) fix SOAP for uninitialzed object fix NEWS Fix missing type checks in various functions Fix SPL objects initialization checks Add object initialization checks for sqlite3 classes Revert "Fix bug #66568: the second arg for unserialize is optional." as we already reverted the introduction of the second arg. update NEWS Fixed bug #67539 (ArrayIterator use-after-free due to object change during sorting) Fixed Bug #67538 (SPL Iterators use-after-free) ... Conflicts: NEWS	2014-07-30 11:50:47 +02:00
Ferenc Kovacs	2d4b95e0e2	bump the version to RC2	2014-07-02 02:23:22 +02:00
Ferenc Kovacs	a0be642ecf	Merge branch 'PHP-5.6' into PHP-5.6.0 * PHP-5.6: (70 commits) add some missing NEWS entries NEWS block for 5.6.0RC3 Fix ext/pgsql builds with libpq < 7.3. updated libs_version.txt updated libs_version.txt updated libmagic.patch in 5.6+ updated libmagic.patch Fixed possible crash because of race conditions on modifying constants in shared memory remove the NEWS entry for the reverted fpm fix remove the NEWS entry for the reverted fpm fix remove the NEWS entry for the reverted fpm fix Revert "Fix Bug #67530 error_log=syslog ignored" --enable-fpm for the travis build fix the last fpm NEWS entry, the other bug is related, but not the same what we fixed here NEWS NEWS Fix bug #67091: make install fails to install libphp5.so on FreeBSD 10.0 adding NEWS entry for the fix for bug #65641 Updated NEWS file for recent phpdbg fixes Fixed issue krakjoe/phpdbg#94 - List behavior is inconsistent ... Conflicts: NEWS	2014-07-02 02:21:53 +02:00
Ferenc Kovacs	6c80e90e23	5.6.0RC1	2014-06-19 02:42:55 +02:00
Ferenc Kovacs	a4e23ef8a3	Merge branch 'PHP-5.6' into PHP-5.6.0 * PHP-5.6: (117 commits) add missing entry to NEWS add missing entry to NEWS add NEWS block for 5.6.0RC2 Add support for gb18030/MySQL 5.7 Fix another problem with MySQL 5.7 new test, missing in `ea466a3` Suppress test failure with MySQL 5.7 Update copyright year to 2014 Update copyright year to 2014 Update copyright year to 2014 Update copyright year to 2014 Update copyright year to 2014 Update copyright year to 2014 NEWS Fix Request #67453 Allow to unserialize empty data. Update copyright year to 2014 Update copyright year for re2c generated files Update copyright year to 2014 Update copyright year for re2c files as well Fix patch for bug #67436 ... Conflicts: NEWS	2014-06-19 02:42:32 +02:00
Ferenc Kovacs	69797e81ed	PHP-5.6.0beta4	2014-06-04 03:22:06 +02:00
Ferenc Kovacs	4ed1713789	Merge branch 'PHP-5.6' into PHP-5.6.0 * PHP-5.6: (51 commits) Fix tests Fix possible segfault depending on memory location... fix gcov data with some locales (again) Update NEWS Fixed startup segfault in non-debug builds Fixes issue #87 Fixed regression introduced by patch for bug #67072 Fixed bug #67329 fileinfo: NULL pointer deference flaw by processing certain CDF files (re)add cve number in NEWS, from 5.4.29 NEWS NEWS NEWS Fix bug #67326 fileinfo: cdf_read_short_sector insufficient boundary check add NEWS block for 5.6.0RC1 Update NEWs Update NEWs Fixed bug #67359 (Segfault in recursiveDirectoryIterator) Check for zero-length keys in spl_array_skip_protected and don't skip them. added CVEs in NEWS updated libmagic.patch for 5.6+ updated libmagic.patch for 5.4+ ... Conflicts: NEWS	2014-06-04 03:22:00 +02:00
Ferenc Kovacs	57e698d582	5.6.0beta3	2014-05-14 09:58:22 +02:00
Ferenc Kovacs	7e35e8b9ef	5.6.0beta3	2014-05-14 09:57:23 +02:00
Ferenc Kovacs	a2edb3e7e4	Merge branch 'PHP-5.6' into PHP-5.6.0 * PHP-5.6: (56 commits) adding NEWS block for beta4 5.4.30 next enable email notifications update NEWS update NEWS update NEWS - Updated to version 2014.3 (2014c) fix test - output can be chunked fix test Fixed test for commit `997be125eb` Add bug fix to NEWS Update UPGRADING according to bug fix improve CURL tests to allow testing without separate server Fixed bug #67199 mb_regex_encoding mishmash fix bug #67253: timelib_meridian_with_check out-of-bounds read Fix bug #67252: convert_uudecode out-of-bounds read Fix bug #67251 - date_parse_from_format out-of-bounds read Fix bug #67250 (iptcparse out-of-bounds read) Fix bug #67248 (imageaffinematrixget missing check of parameters) Fix bug #67247 spl_fixedarray_resize integer overflow ... Conflicts: NEWS	2014-05-14 09:56:02 +02:00
Ferenc Kovacs	a964242f19	5.6.0beta2	2014-05-01 16:42:03 +02:00
Ferenc Kovacs	ce20287810	Merge branch 'PHP-5.6' into PHP-5.6.0 * PHP-5.6: (271 commits) one heading is enough add new NEWS block for alpha3 XFAIL the leaking multibyte tests, we should really get to the bottom of this Fixed numbering in UPGRADING file Updated NEWS for fixed phpdbg issue #85 Added stdion/stdout/stderr constsnts and their php:// wrappers Fixes issue #85 add missing NEWS entry to the correct release where it was added 5.5.12 was released yesterday add missing NEWS entry to the correct release where it was added Updated NEWS entry for phpdbg add missing NEWS entry to the correct release where it was added add some missing NEWS entries fix test locality inconsitency BFN fix bug #64247 (CURLOPT_INFILE doesn't allow reset) Added further notice about removal of IS_CONSTANT_INDEX/ARRAY macros Fix bug #67060: use default mode of 660 separate travis jobs for debug and non-debug builds separate travis jobs for TS and NTS builds put this test back to XFAIL, as it was before, since it is still leaking memory ... Conflicts: NEWS	2014-05-01 16:40:20 +02:00
Ferenc Kovacs	11d102ebbc	Merge branch 'PHP-5.6' into PHP-5.6.0 * PHP-5.6: fix typo fix typo fix typo	2014-04-10 07:11:48 +02:00
Ferenc Kovacs	eb44463e35	5.6.0beta1	2014-04-10 06:49:31 +02:00
Ferenc Kovacs	b3b1c0b63d	remove the beta2 news block as we don't need that in the release tag	2014-04-10 06:47:25 +02:00
Ferenc Kovacs	8871aa912f	Merge branch 'PHP-5.6' into PHP-5.6.0 * PHP-5.6: (240 commits) add a NEWS block for beta2 add missing entries to NEWS abstract namespace for unix sockets is a linux only feature Don't test for specific non-zero substr_compare() return value Add only_integer_keys option to zend_hash_reindex Don't always separate splice replacement array Add zend_hash_splice Add zend_hash_reindex Remove some usages of hashtable internals Updated NEWS fixed bug66702 : regexiterator's invert flag doesn't work as expected Updated NEWS for #67043 Fixed bug 67043 cleanup Fixes bug #66071: isc_interprete is unsafe and deprecated , it is replaced with fb_iterpret updated libs versions fixed the test for ICI >= 52.1 Fix Linux specific fail in error traces Linux apparently does not like memcpy in overlapping regions... add missing skip to the output, so we actually skip this test fix the test according to how new date code does it ...	2014-04-10 06:45:31 +02:00
Ferenc Kovacs	dae8ff251c	5.6.0alpha3	2014-02-27 02:36:56 +01:00
Ferenc Kovacs	79bfef5ba3	Merge branch 'PHP-5.6' into PHP-5.6.0 * PHP-5.6: (136 commits) fix tests broken by `633f898f15` add missing NEWS entry add missing NEWS entry add missing NEWS entry add missing NEWS entry add missing NEWS entry add missing NEWS entry Deprecate CN_match in favor of peer_name in SSL contexts Remove cURL close policy related constants Update stack size in tests/func/010.phpt Don't add num_additional_args in SEND opcodes Disallow use of positional args after unpacking Store arg_num in fcall entry Introduce zend_function_call_entry structure move the default encoding NEWS entry to alpha3, as it was pushed after beta2 was tagged rearrange the NEWS blocks a bit add NEWS block for 5.6.0 beta1 restored that test part in ext/openssl to enable notify/wait remove echo fix stdin reading in new openssl tests ...	2014-02-27 02:35:58 +01:00
Ferenc Kovacs	326ab8b147	5.6.0alpha2	2014-02-12 09:45:18 +01:00
Ferenc Kovacs	99bd2fd9c4	Merge branch 'PHP-5.6' into PHP-5.6.0 * PHP-5.6: (97 commits) update the alpha2 release date Fixed ZTS and added fix to NEWS. Implemented feature #45528: Allow the DateTimeZone constructor to accept timezones per offset too. Rename timelib_get_zone to timelib_parse_zone and export. fix regex to detect valgrind version New PCRE version got stricter fix regex to detect valgrind version New PCRE version got stricter Fixed memory leak in pow operator 5.5.9 now released Added information in NEWS and UPGRADING add T_POW (**) operator add NEWS block for 5.6.0alpha3 updated libs_version.txt updated libs_version.txt update libs_version.txt more tests for ICU >= 52.1 compat fix tests for ICU >= 52.1 Fix year adapt test to curl 7.35.0 upgrade move the NEWS entry into the right section Fixed SNI failure from missing Z_STRVAL_PP ...	2014-02-12 06:43:05 +01:00
Ferenc Kovacs	1f148f7ad9	Revert "5.6.0alpha1" This reverts commit `8648f76bac`.	2014-02-06 03:55:53 +01:00
Ferenc Kovacs	8648f76bac	5.6.0alpha1	2014-01-21 02:30:07 +01:00