PHP 5.3.14RC2

(cherry picked from commit bc1c1beea5)

NEWS

@@ -1,6 +1,17 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2012, PHP 5.3.12
+31 May 2012, PHP 5.3.14 RC2
+- COM:
+  . Fixed bug #62146 com_dotnet cannot be built shared. (Johannes)
+
+- Core:
+  . Fixed CVE-2012-2143. (Solar Designer)
+
+- Intl:
+  . Fixed bug #62082 (Memory corruption in internal function
+    get_icu_disp_value_src_php()). (Gustavo)
+
+17 May 2012, PHP 5.3.14RC1
 
 - CLI SAPI:
   . Fixed bug #61546 (functions related to current script failed when chdir() 

configure.in

@@ -42,7 +42,7 @@ AC_CONFIG_HEADER(main/php_config.h)
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=3
 PHP_RELEASE_VERSION=14
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION="RC2"
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/com_dotnet/com_misc.c

@@ -42,7 +42,7 @@ void php_com_throw_exception(HRESULT code, char *message TSRMLS_DC)
 	}
 }
 
-PHPAPI void php_com_wrap_dispatch(zval *z, IDispatch *disp,
+PHP_COM_DOTNET_API void php_com_wrap_dispatch(zval *z, IDispatch *disp,
 		int codepage TSRMLS_DC)
 {
 	php_com_dotnet_object *obj;
@@ -65,7 +65,7 @@ PHPAPI void php_com_wrap_dispatch(zval *z, IDispatch *disp,
 	z->value.obj.handlers = &php_com_object_handlers;
 }
 
-PHPAPI void php_com_wrap_variant(zval *z, VARIANT *v,
+PHP_COM_DOTNET_API void php_com_wrap_variant(zval *z, VARIANT *v,
 		int codepage TSRMLS_DC)
 {
 	php_com_dotnet_object *obj;
@@ -92,7 +92,7 @@ PHPAPI void php_com_wrap_variant(zval *z, VARIANT *v,
 
 /* this is a convenience function for fetching a particular
  * element from a (possibly multi-dimensional) safe array */
-PHPAPI int php_com_safearray_get_elem(VARIANT *array, VARIANT *dest, LONG dim1 TSRMLS_DC)
+PHP_COM_DOTNET_API int php_com_safearray_get_elem(VARIANT *array, VARIANT *dest, LONG dim1 TSRMLS_DC)
 {
 	UINT dims;
 	LONG lbound, ubound;

ext/com_dotnet/com_olechar.c

@@ -30,7 +30,7 @@
 #include "php_com_dotnet_internal.h"
 
 
-PHPAPI OLECHAR *php_com_string_to_olestring(char *string, uint string_len, int codepage TSRMLS_DC)
+PHP_COM_DOTNET_API OLECHAR *php_com_string_to_olestring(char *string, uint string_len, int codepage TSRMLS_DC)
 {
 	OLECHAR *olestring = NULL;
 	DWORD flags = codepage == CP_UTF8 ? 0 : MB_PRECOMPOSED | MB_ERR_INVALID_CHARS;
@@ -65,7 +65,7 @@ PHPAPI OLECHAR *php_com_string_to_olestring(char *string, uint string_len, int c
 	return olestring;
 }
 
-PHPAPI char *php_com_olestring_to_string(OLECHAR *olestring, uint *string_len, int codepage TSRMLS_DC)
+PHP_COM_DOTNET_API char *php_com_olestring_to_string(OLECHAR *olestring, uint *string_len, int codepage TSRMLS_DC)
 {
 	char *string;
 	uint length = 0;

ext/com_dotnet/com_persist.c

@@ -271,7 +271,7 @@ static void istream_destructor(php_istream *stm)
 }
 /* }}} */
 
-PHPAPI IStream *php_com_wrapper_export_stream(php_stream *stream TSRMLS_DC)
+PHP_COM_DOTNET_API IStream *php_com_wrapper_export_stream(php_stream *stream TSRMLS_DC)
 {
 	php_istream *stm = (php_istream*)CoTaskMemAlloc(sizeof(*stm));
 

ext/com_dotnet/com_typeinfo.c

@@ -35,7 +35,7 @@
  * b) a CLSID, major, minor e.g. "{00000200-0000-0010-8000-00AA006D2EA4},2,0"
  * c) a Type Library name e.g. "Microsoft OLE DB ActiveX Data Objects 1.0 Library"
  */
-PHPAPI ITypeLib *php_com_load_typelib(char *search_string, int codepage TSRMLS_DC)
+PHP_COM_DOTNET_API ITypeLib *php_com_load_typelib(char *search_string, int codepage TSRMLS_DC)
 {
 	ITypeLib *TL = NULL;
 	char *strtok_buf, *major, *minor;
@@ -153,7 +153,7 @@ PHPAPI ITypeLib *php_com_load_typelib(char *search_string, int codepage TSRMLS_D
 }
 
 /* Given a type-library, merge it into the current engine state */
-PHPAPI int php_com_import_typelib(ITypeLib *TL, int mode, int codepage TSRMLS_DC)
+PHP_COM_DOTNET_API int php_com_import_typelib(ITypeLib *TL, int mode, int codepage TSRMLS_DC)
 {
 	int i, j, interfaces;
 	TYPEKIND pTKind;
@@ -224,7 +224,7 @@ void php_com_typelibrary_dtor(void *pDest)
 	ITypeLib_Release(*Lib);
 }
 
-PHPAPI ITypeLib *php_com_load_typelib_via_cache(char *search_string,
+PHP_COM_DOTNET_API ITypeLib *php_com_load_typelib_via_cache(char *search_string,
 	int codepage, int *cached TSRMLS_DC)
 {
 	ITypeLib **TLp;

ext/com_dotnet/com_variant.c

@@ -98,7 +98,7 @@ bogus:
 	}
 }
 
-PHPAPI void php_com_variant_from_zval(VARIANT *v, zval *z, int codepage TSRMLS_DC)
+PHP_COM_DOTNET_API void php_com_variant_from_zval(VARIANT *v, zval *z, int codepage TSRMLS_DC)
 {
 	OLECHAR *olestring;
 	php_com_dotnet_object *obj;
@@ -166,7 +166,7 @@ PHPAPI void php_com_variant_from_zval(VARIANT *v, zval *z, int codepage TSRMLS_D
 	}
 }
 
-PHPAPI int php_com_zval_from_variant(zval *z, VARIANT *v, int codepage TSRMLS_DC)
+PHP_COM_DOTNET_API int php_com_zval_from_variant(zval *z, VARIANT *v, int codepage TSRMLS_DC)
 {
 	OLECHAR *olestring = NULL;
 	int ret = SUCCESS;
@@ -258,7 +258,7 @@ PHPAPI int php_com_zval_from_variant(zval *z, VARIANT *v, int codepage TSRMLS_DC
 }
 
 
-PHPAPI int php_com_copy_variant(VARIANT *dstvar, VARIANT *srcvar TSRMLS_DC)
+PHP_COM_DOTNET_API int php_com_copy_variant(VARIANT *dstvar, VARIANT *srcvar TSRMLS_DC)
 {
 	int ret = SUCCESS;
 	

ext/com_dotnet/com_wrapper.c

@@ -586,7 +586,7 @@ static void disp_destructor(php_dispatchex *disp)
 	CoTaskMemFree(disp);
 }
 
-PHPAPI IDispatch *php_com_wrapper_export_as_sink(zval *val, GUID *sinkid,
+PHP_COM_DOTNET_API IDispatch *php_com_wrapper_export_as_sink(zval *val, GUID *sinkid,
 	   HashTable *id_to_name TSRMLS_DC)
 {
 	php_dispatchex *disp = disp_constructor(val TSRMLS_CC);
@@ -625,7 +625,7 @@ PHPAPI IDispatch *php_com_wrapper_export_as_sink(zval *val, GUID *sinkid,
 	return (IDispatch*)disp;
 }
 
-PHPAPI IDispatch *php_com_wrapper_export(zval *val TSRMLS_DC)
+PHP_COM_DOTNET_API IDispatch *php_com_wrapper_export(zval *val TSRMLS_DC)
 {
 	php_dispatchex *disp = NULL;
 

ext/com_dotnet/php_com_dotnet.h

@@ -28,6 +28,14 @@ extern zend_module_entry com_dotnet_module_entry;
 #include "TSRM.h"
 #endif
 
+#ifdef PHP_WIN32
+# define PHP_COM_DOTNET_API __declspec(dllexport)
+#elif defined(__GNUC__) && __GNUC__ >= 4
+# define PHP_COM_DOTNET_API __attribute__ ((visibility("default")))
+#else
+# define PHP_COM_DOTNET_API
+#endif
+
 PHP_MINIT_FUNCTION(com_dotnet);
 PHP_MSHUTDOWN_FUNCTION(com_dotnet);
 PHP_RINIT_FUNCTION(com_dotnet);

ext/com_dotnet/php_com_dotnet_internal.h

@@ -87,9 +87,9 @@ zend_object_iterator *php_com_saproxy_iter_get(zend_class_entry *ce, zval *objec
 int php_com_saproxy_create(zval *com_object, zval *proxy_out, zval *index TSRMLS_DC);
 
 /* com_olechar.c */
-PHPAPI char *php_com_olestring_to_string(OLECHAR *olestring,
+PHP_COM_DOTNET_API char *php_com_olestring_to_string(OLECHAR *olestring,
 		uint *string_len, int codepage TSRMLS_DC);
-PHPAPI OLECHAR *php_com_string_to_olestring(char *string,
+PHP_COM_DOTNET_API OLECHAR *php_com_string_to_olestring(char *string,
 		uint string_len, int codepage TSRMLS_DC);
 
 
@@ -115,8 +115,8 @@ int php_com_do_invoke_byref(php_com_dotnet_object *obj, char *name, int namelen,
 
 /* com_wrapper.c */
 int php_com_wrapper_minit(INIT_FUNC_ARGS);
-PHPAPI IDispatch *php_com_wrapper_export_as_sink(zval *val, GUID *sinkid, HashTable *id_to_name TSRMLS_DC);
-PHPAPI IDispatch *php_com_wrapper_export(zval *val TSRMLS_DC);
+PHP_COM_DOTNET_API IDispatch *php_com_wrapper_export_as_sink(zval *val, GUID *sinkid, HashTable *id_to_name TSRMLS_DC);
+PHP_COM_DOTNET_API IDispatch *php_com_wrapper_export(zval *val TSRMLS_DC);
 
 /* com_persist.c */
 int php_com_persist_minit(INIT_FUNC_ARGS);
@@ -150,10 +150,10 @@ PHP_FUNCTION(variant_get_type);
 PHP_FUNCTION(variant_set_type);
 PHP_FUNCTION(variant_cast);
 
-PHPAPI void php_com_variant_from_zval_with_type(VARIANT *v, zval *z, VARTYPE type, int codepage TSRMLS_DC);
-PHPAPI void php_com_variant_from_zval(VARIANT *v, zval *z, int codepage TSRMLS_DC);
-PHPAPI int php_com_zval_from_variant(zval *z, VARIANT *v, int codepage TSRMLS_DC);
-PHPAPI int php_com_copy_variant(VARIANT *dst, VARIANT *src TSRMLS_DC);
+PHP_COM_DOTNET_API void php_com_variant_from_zval_with_type(VARIANT *v, zval *z, VARTYPE type, int codepage TSRMLS_DC);
+PHP_COM_DOTNET_API void php_com_variant_from_zval(VARIANT *v, zval *z, int codepage TSRMLS_DC);
+PHP_COM_DOTNET_API int php_com_zval_from_variant(zval *z, VARIANT *v, int codepage TSRMLS_DC);
+PHP_COM_DOTNET_API int php_com_copy_variant(VARIANT *dst, VARIANT *src TSRMLS_DC);
 
 /* com_dotnet.c */
 PHP_FUNCTION(com_dotnet_create_instance);
@@ -162,17 +162,17 @@ void php_com_dotnet_mshutdown(TSRMLS_D);
 
 /* com_misc.c */
 void php_com_throw_exception(HRESULT code, char *message TSRMLS_DC);
-PHPAPI void php_com_wrap_dispatch(zval *z, IDispatch *disp,
+PHP_COM_DOTNET_API void php_com_wrap_dispatch(zval *z, IDispatch *disp,
 		int codepage TSRMLS_DC);
-PHPAPI void php_com_wrap_variant(zval *z, VARIANT *v,
+PHP_COM_DOTNET_API void php_com_wrap_variant(zval *z, VARIANT *v,
 		int codepage TSRMLS_DC);
-PHPAPI int php_com_safearray_get_elem(VARIANT *array, VARIANT *dest, LONG dim1 TSRMLS_DC);
+PHP_COM_DOTNET_API int php_com_safearray_get_elem(VARIANT *array, VARIANT *dest, LONG dim1 TSRMLS_DC);
 
 /* com_typeinfo.c */
-PHPAPI ITypeLib *php_com_load_typelib_via_cache(char *search_string,
+PHP_COM_DOTNET_API ITypeLib *php_com_load_typelib_via_cache(char *search_string,
 		int codepage, int *cached TSRMLS_DC);
-PHPAPI ITypeLib *php_com_load_typelib(char *search_string, int codepage TSRMLS_DC);
-PHPAPI int php_com_import_typelib(ITypeLib *TL, int mode,
+PHP_COM_DOTNET_API ITypeLib *php_com_load_typelib(char *search_string, int codepage TSRMLS_DC);
+PHP_COM_DOTNET_API int php_com_import_typelib(ITypeLib *TL, int mode,
 		int codepage TSRMLS_DC);
 void php_com_typelibrary_dtor(void *pDest);
 ITypeInfo *php_com_locate_typeinfo(char *typelibname, php_com_dotnet_object *obj, char *dispname, int sink TSRMLS_DC);

ext/intl/locale/locale_methods.c

@@ -527,7 +527,7 @@ static void get_icu_disp_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAME
 
     /* Get the disp_value for the given locale */
     do{
-        disp_name = erealloc( disp_name , buflen  );
+        disp_name = erealloc( disp_name , buflen * sizeof(UChar)  );
         disp_name_len = buflen;
 
 		if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
@@ -542,6 +542,7 @@ static void get_icu_disp_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAME
 			buflen = uloc_getDisplayName ( mod_loc_name , disp_loc_name , disp_name , disp_name_len , &status);
 		}
 
+		/* U_STRING_NOT_TERMINATED_WARNING is admissible here; don't look for it */
 		if( U_FAILURE( status ) )
 		{
 			if( status == U_BUFFER_OVERFLOW_ERROR )
@@ -1562,11 +1563,11 @@ PHP_FUNCTION(locale_lookup)
 /* }}} */
 
 /* {{{ proto string Locale::acceptFromHttp(string $http_accept)
-* Tries to find out best available locale based on HTTP “Accept-Language” header
+* Tries to find out best available locale based on HTTP �Accept-Language� header
 */
 /* }}} */
 /* {{{ proto string locale_accept_from_http(string $http_accept)
-* Tries to find out best available locale based on HTTP “Accept-Language” header
+* Tries to find out best available locale based on HTTP �Accept-Language� header
 */
 PHP_FUNCTION(locale_accept_from_http)
 {

ext/intl/tests/bug62082.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #62082: Memory corruption in internal get_icu_disp_value_src_php()
+--SKIPIF--
+<?php
+if (!extension_loaded('intl'))
+	die('skip intl extension not enabled');
+--FILE--
+<?php
+var_dump(locale_get_display_name(str_repeat("a", 300), null));
+var_dump(locale_get_display_name(str_repeat("a", 512), null));
+var_dump(locale_get_display_name(str_repeat("a", 600), null));
+--EXPECT--
+string(300) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+string(512) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+string(600) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"

ext/phar/tar.c

@@ -38,7 +38,7 @@ static php_uint32 phar_tar_number(char *buf, int len) /* {{{ */
 /* }}} */
 
 /* adapted from format_octal() in libarchive
- * 
+ *
  * Copyright (c) 2003-2009 Tim Kientzle
  * All rights reserved.
  *
@@ -161,7 +161,7 @@ static int phar_tar_process_metadata(phar_entry_info *entry, php_stream *fp TSRM
 	size_t save = php_stream_tell(fp), read;
 	phar_entry_info *mentry;
 
-	metadata = (char *) emalloc(entry->uncompressed_filesize + 1);
+	metadata = (char *) safe_emalloc(1, entry->uncompressed_filesize, 1);
 
 	read = php_stream_read(fp, metadata, entry->uncompressed_filesize);
 	if (read != entry->uncompressed_filesize) {
@@ -377,7 +377,7 @@ bail:
 			}
 
 			read = php_stream_read(fp, buf, sizeof(buf));
-	
+
 			if (read != sizeof(buf)) {
 				efree(entry.filename);
 				if (error) {

ext/standard/crypt_freesec.c

@@ -629,7 +629,8 @@ _crypt_extended_r(const char *key, const char *setting,
 	 */
 	q = (u_char *) keybuf;
 	while (q - (u_char *) keybuf < sizeof(keybuf)) {
-		if ((*q++ = *key << 1))
+		*q++ = *key << 1;
+		if (*key)
 			key++;
 	}
 	if (des_setkey((u_char *) keybuf, data))

ext/standard/tests/strings/crypt_chars.phpt

@@ -0,0 +1,19 @@
+--TEST--
+crypt() function - characters > 0x80
+--SKIPIF--
+<?php
+if (!function_exists('crypt')) {
+        die("SKIP crypt() is not available");
+}
+?>
+--FILE--
+<?php
+var_dump(crypt("À1234abcd", "99"));
+var_dump(crypt("À9234abcd", "99"));
+var_dump(crypt("À1234abcd", "_01234567"));
+var_dump(crypt("À9234abcd", "_01234567"));
+--EXPECT--
+string(13) "99PxawtsTfX56"
+string(13) "99jcVcGxUZOWk"
+string(20) "_01234567IBjxKliXXRQ"
+string(20) "_012345678OSGpGQRVHA"

main/php_version.h

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 3
 #define PHP_RELEASE_VERSION 14
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.3.14-dev"
+#define PHP_EXTRA_VERSION "RC2"
+#define PHP_VERSION "5.3.14RC2"
 #define PHP_VERSION_ID 50314