Prepare 5.5.12 final

This reverts commit b05c088a3a.

NEWS

@@ -1,15 +1,10 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2014, PHP 5.5.13
-
-
-?? ??? 2014, PHP 5.5.12
+01 May 2014, PHP 5.5.12
 - Core:
   . Fixed bug #61019 (Out of memory on command stream_get_contents). (Mike)
   . Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace 
     UNIX sockets). (Mike)
-  . Fixed bug #64604 (parse_url is inconsistent with specified port).
-    (Ingo Walz)
   . Fixed bug #66182 (exit in stream filter produces segfault). (Mike)  
   . Fixed bug #66736 (fpassthru broken). (Mike)
   . Fixed bug #67024 (getimagesize should recognize BMP files with negative
@@ -33,6 +28,7 @@ PHP                                                                        NEWS
 
 - FPM:
   . Fixed bug #66482 (unknown entry 'priority' in php-fpm.conf).
+  . Fixed bug #67060 (possible privilege escalation due to insecure default configuration). (CVE-2014-0185) (christian at hoffie dot info)
 
 - JSON:
   . Fixed bug #66021 (Blank line inside empty array/object when

configure.in

@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=5
-PHP_RELEASE_VERSION=13
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=12
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/standard/tests/url/bug64604.phpt

@@ -1,40 +0,0 @@
---TEST--
-Bug #64604 parse_url is inconsistent with specified port
---FILE--
-<?php
-var_dump(parse_url('//localhost/path'));
-var_dump(parse_url('//localhost:80/path'));
-var_dump(parse_url('//localhost:/path'));
-var_dump(parse_url('http://localhost:80/path'));
-?>
---EXPECT--
-array(2) {
-  ["host"]=>
-  string(9) "localhost"
-  ["path"]=>
-  string(5) "/path"
-}
-array(3) {
-  ["host"]=>
-  string(9) "localhost"
-  ["port"]=>
-  int(80)
-  ["path"]=>
-  string(5) "/path"
-}
-array(2) {
-  ["host"]=>
-  string(9) "localhost"
-  ["path"]=>
-  string(5) "/path"
-}
-array(4) {
-  ["scheme"]=>
-  string(4) "http"
-  ["host"]=>
-  string(9) "localhost"
-  ["port"]=>
-  int(80)
-  ["path"]=>
-  string(5) "/path"
-}

ext/standard/tests/url/parse_url_basic_001.phpt

@@ -845,6 +845,13 @@ echo "Done";
   string(1) "/"
 }
 
+--> /rest/Users?filter={"id":"123"}: array(2) {
+  ["path"]=>
+  string(11) "/rest/Users"
+  ["query"]=>
+  string(19) "filter={"id":"123"}"
+}
+
 --> http:///blah.com: bool(false)
 
 --> http://:80: bool(false)

ext/standard/tests/url/parse_url_basic_002.phpt

@@ -110,6 +110,7 @@ echo "Done";
 --> http://[x:80]/   : string(4) "http"
 -->    : NULL
 --> /   : NULL
+--> /rest/Users?filter={"id":"123"}   : NULL
 --> http:///blah.com   : bool(false)
 --> http://:80   : bool(false)
 --> http://user@:80   : bool(false)

ext/standard/tests/url/parse_url_basic_003.phpt

@@ -109,6 +109,7 @@ echo "Done";
 --> http://[x:80]/   : string(6) "[x:80]"
 -->    : NULL
 --> /   : NULL
+--> /rest/Users?filter={"id":"123"}   : NULL
 --> http:///blah.com   : bool(false)
 --> http://:80   : bool(false)
 --> http://user@:80   : bool(false)

ext/standard/tests/url/parse_url_basic_004.phpt

@@ -109,6 +109,7 @@ echo "Done";
 --> http://[x:80]/   : NULL
 -->    : NULL
 --> /   : NULL
+--> /rest/Users?filter={"id":"123"}   : NULL
 --> http:///blah.com   : bool(false)
 --> http://:80   : bool(false)
 --> http://user@:80   : bool(false)

ext/standard/tests/url/parse_url_basic_005.phpt

@@ -109,6 +109,7 @@ echo "Done";
 --> http://[x:80]/   : NULL
 -->    : NULL
 --> /   : NULL
+--> /rest/Users?filter={"id":"123"}   : NULL
 --> http:///blah.com   : bool(false)
 --> http://:80   : bool(false)
 --> http://user@:80   : bool(false)

ext/standard/tests/url/parse_url_basic_006.phpt

@@ -109,6 +109,7 @@ echo "Done";
 --> http://[x:80]/   : NULL
 -->    : NULL
 --> /   : NULL
+--> /rest/Users?filter={"id":"123"}   : NULL
 --> http:///blah.com   : bool(false)
 --> http://:80   : bool(false)
 --> http://user@:80   : bool(false)

ext/standard/tests/url/parse_url_basic_007.phpt

@@ -109,6 +109,7 @@ echo "Done";
 --> http://[x:80]/   : string(1) "/"
 -->    : string(0) ""
 --> /   : string(1) "/"
+--> /rest/Users?filter={"id":"123"}   : string(11) "/rest/Users"
 --> http:///blah.com   : bool(false)
 --> http://:80   : bool(false)
 --> http://user@:80   : bool(false)

ext/standard/tests/url/parse_url_basic_008.phpt

@@ -109,6 +109,7 @@ echo "Done";
 --> http://[x:80]/   : NULL
 -->    : NULL
 --> /   : NULL
+--> /rest/Users?filter={"id":"123"}   : string(19) "filter={"id":"123"}"
 --> http:///blah.com   : bool(false)
 --> http://:80   : bool(false)
 --> http://user@:80   : bool(false)

ext/standard/tests/url/parse_url_basic_009.phpt

@@ -109,6 +109,7 @@ echo "Done";
 --> http://[x:80]/   : NULL
 -->    : NULL
 --> /   : NULL
+--> /rest/Users?filter={"id":"123"}   : NULL
 --> http:///blah.com   : bool(false)
 --> http://:80   : bool(false)
 --> http://user@:80   : bool(false)

ext/standard/tests/url/urls.inc

@@ -89,6 +89,7 @@ $urls = array(
 'http://[x:80]/',
 '',
 '/',
+'/rest/Users?filter={"id":"123"}',
 
 // Severely malformed URLs that do not parse:
 'http:///blah.com',

ext/standard/url.c

@@ -181,10 +181,6 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 		p = e + 1;
 		pp = p;
 
-		if (*s == '/' && *(s+1) == '/') { /* relative-scheme URL */
-			s += 2;
-		}
-
 		while (pp-p < 6 && isdigit(*pp)) {
 			pp++;
 		}
@@ -205,6 +201,10 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 			STR_FREE(ret->scheme);
 			efree(ret);
 			return NULL;
+		} else if (*s == '/' && *(s+1) == '/') { /* relative-scheme URL */
+			s += 2;
+		} else {
+			goto just_path;
 		}
 	} else if (*s == '/' && *(s+1) == '/') { /* relative-scheme URL */
 		s += 2;

main/php_version.h

@@ -2,7 +2,7 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 5
-#define PHP_RELEASE_VERSION 13
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.5.13-dev"
-#define PHP_VERSION_ID 50513
+#define PHP_RELEASE_VERSION 12
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.5.12"
+#define PHP_VERSION_ID 50512

sapi/fpm/fpm/fpm_unix.c

@@ -35,7 +35,7 @@ int fpm_unix_resolve_socket_premissions(struct fpm_worker_pool_s *wp) /* {{{ */
 	/* uninitialized */
 	wp->socket_uid = -1;
 	wp->socket_gid = -1;
-	wp->socket_mode = 0666;
+	wp->socket_mode = 0660;
 
 	if (!c) {
 		return 0;

sapi/fpm/php-fpm.conf.in

@@ -166,10 +166,10 @@ listen = 127.0.0.1:9000
 ; permissions must be set in order to allow connections from a web server. Many
 ; BSD-derived systems allow connections regardless of permissions. 
 ; Default Values: user and group are set as the running user
-;                 mode is set to 0666
+;                 mode is set to 0660
 ;listen.owner = @php_fpm_user@
 ;listen.group = @php_fpm_group@
-;listen.mode = 0666
+;listen.mode = 0660
  
 ; List of ipv4 addresses of FastCGI clients which are allowed to connect.
 ; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original