Update version for PHP 7.3.6

(cherry picked from commit c34895e837)

NEWS

@@ -1,21 +1,35 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 7.3.6
+30 May 2019, PHP 7.3.6
 
 - cURL:
   . Implemented FR #72189 (Add missing CURL_VERSION_* constants). (Javier
     Spagnoletti)
 
+- EXIF:
+  . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16).
+    (CVE-2019-11040) (Stas)
+
 - FPM:
   . Fixed bug #77934 (php-fpm kill -USR2 not working). (Jakub Zelenka)
   . Fixed bug #77921 (static.php.net doesn't work anymore). (Peter Kokot)
 
 - GD:
   . Fixed bug #77943 (imageantialias($image, false); does not work). (cmb)
+  . Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm).
+    (CVE-2019-11038) (cmb)
+
+- Iconv:
+  . Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode()
+    due to integer overflow). (CVE-2019-11039). (maris dot adam)
 
 - JSON:
   . Fixed bug #77843 (Use after free with json serializer). (Nikita)
 
+- Opcache:
+  . Fixed possible crashes, because of inconsistent PCRE cache and opcache
+    SHM reset. (Alexey Kalinin, Dmitry)
+
 - PDO_MySQL:
   . Fixed bug #77944 (Wrong meta pdo_type for bigint on LLP64). (cmb)
 
@@ -33,6 +47,9 @@ PHP                                                                        NEWS
   . Fixed bug #77024 (SplFileObject::__toString() may return array). (Craig
     Duncan)
 
+- SQLite:
+  . Fixed bug #77967 (Bypassing open_basedir restrictions via file uris). (Stas)
+
 - Standard:
   . Fixed bug #77931 (Warning for array_map mentions wrong type). (Nikita)
   . Fixed bug #78003 (strip_tags output change since PHP 7.3). (cmb)

Zend/zend.h

@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H
 
-#define ZEND_VERSION "3.3.6-dev"
+#define ZEND_VERSION "3.3.6"
 
 #define ZEND_ENGINE_3
 

configure.ac

@@ -108,7 +108,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=3
 PHP_RELEASE_VERSION=6
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/exif/exif.c

@@ -3920,6 +3920,8 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
 		if (c == 0xFF)
 			return FALSE;
 		marker = c;
+		if (pos>=ImageInfo->Thumbnail.size)
+			return FALSE;
 		length = php_jpg_get16(data+pos);
 		if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) {
 			return FALSE;

ext/exif/tests/bug77988.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #77988 (heap-buffer-overflow on php_jpg_get16)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+exif_read_data(__DIR__."/bug77988.jpg", 'COMMENT', FALSE, TRUE);
+?>
+DONE
+--EXPECTF--
+DONE

ext/gd/libgd/gd_xbm.c

@@ -136,7 +136,11 @@ gdImagePtr gdImageCreateFromXbm(FILE * fd)
 			}
 			h[3] = ch;
 		}
-		sscanf(h, "%x", &b);
+		if (sscanf(h, "%x", &b) != 1) {
+			gd_error("invalid XBM");
+			gdImageDestroy(im);
+			return 0;
+		}
 		for (bit = 1; bit <= max_bit; bit = bit << 1) {
 			gdImageSetPixel(im, x++, y, (b & bit) ? 1 : 0);
 			if (x == im->sx) {

ext/gd/tests/bug77973.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Bug #77973 (Uninitialized read in gdImageCreateFromXbm)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die("skip gd extension not available");
+if (!function_exists('imagecreatefromxbm')) die("skip imagecreatefromxbm not available");
+?>
+--FILE--
+<?php
+$contents = hex2bin("23646566696e6520776964746820320a23646566696e652068656967687420320a737461746963206368617220626974735b5d203d7b0a7a7a787a7a");
+$filepath = __DIR__ . '/bug77973.xbm';
+file_put_contents($filepath, $contents);
+$im = imagecreatefromxbm($filepath);
+var_dump($im);
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromxbm(): invalid XBM in %s on line %d
+
+Warning: imagecreatefromxbm(): '%s' is not a valid XBM file in %s on line %d
+bool(false)
+===DONE===
+--CLEAN--
+<?php
+unlink(__DIR__ . '/bug77973.xbm');
+?>

ext/iconv/iconv.c

@@ -1663,7 +1663,9 @@ static php_iconv_err_t _php_iconv_mime_decode(smart_str *pretval, const char *st
 							 * we can do at this point. */
 							if (*(p1 + 1) == '=') {
 								++p1;
-								--str_left;
+								if (str_left > 1) {
+									--str_left;
+								}
 							}
 
 							err = _php_iconv_appendl(pretval, encoded_word, (size_t)((p1 + 1) - encoded_word), cd_pl);

ext/iconv/tests/bug78069.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('iconv')) die('skip ext/iconv required');
+?>
+--FILE--
+<?php
+$hdr = iconv_mime_decode_headers(file_get_contents(__DIR__ . "/bug78069.data"),2);
+var_dump(count($hdr));
+?>
+DONE
+--EXPECT--
+int(1)
+DONE

ext/opcache/ZendAccelerator.c

@@ -431,7 +431,7 @@ static zend_always_inline zend_string *accel_find_interned_string(zend_string *s
 	}
 
 	if (!ZCG(counted)) {
-		if (accel_activate_add() == FAILURE) {
+		if (!ZCG(accelerator_enabled) || accel_activate_add() == FAILURE) {
 			return str;
 		}
 		ZCG(counted) = 1;
@@ -1164,7 +1164,7 @@ char *accel_make_persistent_key(const char *path, size_t path_length, int *key_l
 			cwd_len = ZSTR_LEN(cwd_str);
 			if (ZCG(cwd_check)) {
 				ZCG(cwd_check) = 0;
-				if ((ZCG(counted) || ZCSG(accelerator_enabled))) {
+				if (ZCG(accelerator_enabled)) {
 
 					zend_string *str = accel_find_interned_string(cwd_str);
 					if (!str) {
@@ -1204,7 +1204,7 @@ char *accel_make_persistent_key(const char *path, size_t path_length, int *key_l
 
 			if (ZCG(include_path_check)) {
 				ZCG(include_path_check) = 0;
-				if ((ZCG(counted) || ZCSG(accelerator_enabled))) {
+				if (ZCG(accelerator_enabled)) {
 
 					zend_string *str = accel_find_interned_string(ZCG(include_path));
 					if (!str) {
@@ -1287,7 +1287,7 @@ int zend_accel_invalidate(const char *filename, size_t filename_len, zend_bool f
 	zend_string *realpath;
 	zend_persistent_script *persistent_script;
 
-	if (!ZCG(enabled) || !accel_startup_ok || !ZCSG(accelerator_enabled) || accelerator_shm_read_lock() != SUCCESS) {
+	if (!ZCG(accelerator_enabled) || accelerator_shm_read_lock() != SUCCESS) {
 		return FAILURE;
 	}
 
@@ -1910,7 +1910,7 @@ zend_op_array *persistent_compile_file(zend_file_handle *file_handle, int type)
 	} else if (file_cache_only) {
 		return file_cache_compile_file(file_handle, type);
 #endif
-	} else if ((!ZCG(counted) && !ZCSG(accelerator_enabled)) ||
+	} else if (!ZCG(accelerator_enabled) ||
 	           (ZCSG(restart_in_progress) && accel_restart_is_active())) {
 #ifdef HAVE_OPCACHE_FILE_CACHE
 		if (ZCG(accel_directives).file_cache) {
@@ -2205,12 +2205,11 @@ static int persistent_stream_open_function(const char *filename, zend_file_handl
 /* zend_resolve_path() replacement for PHP 5.3 and above */
 static zend_string* persistent_zend_resolve_path(const char *filename, size_t filename_len)
 {
-	if (ZCG(enabled) && accel_startup_ok &&
+	if (
 #ifdef HAVE_OPCACHE_FILE_CACHE
 		!file_cache_only &&
 #endif
-	    (ZCG(counted) || ZCSG(accelerator_enabled)) &&
-	    !ZCSG(restart_in_progress)) {
+	    ZCG(accelerator_enabled)) {
 
 		/* check if callback is called from include_once or it's a main request */
 		if ((!EG(current_execute_data) &&
@@ -2359,6 +2358,7 @@ static void accel_activate(void)
 					zend_alter_ini_entry_chars(key, "0", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_RUNTIME);
 					zend_string_release_ex(key, 0);
 					zend_accel_error(ACCEL_LOG_WARNING, "Can't cache files in chroot() directory with too big inode");
+					ZCG(accelerator_enabled) = 0;
 					return;
 				}
 			}
@@ -2416,12 +2416,15 @@ static void accel_activate(void)
 				}
 				accel_restart_leave();
 			}
-		} else {
+		}
+		if (!ZCG(pcre_reseted)) {
 			reset_pcre = 1;
 		}
 		zend_shared_alloc_unlock();
 	}
 
+	ZCG(accelerator_enabled) = ZCSG(accelerator_enabled);
+
 	SHM_PROTECT();
 	HANDLE_UNBLOCK_INTERRUPTIONS();
 
@@ -2433,8 +2436,10 @@ static void accel_activate(void)
 		realpath_cache_clean();
 
 		accel_reset_pcre_cache();
+		ZCG(pcre_reseted) = 0;
 	} else if (reset_pcre) {
 		accel_reset_pcre_cache();
+		ZCG(pcre_reseted) = 1;
 	}
 }
 
@@ -2462,10 +2467,6 @@ static void accel_deactivate(void)
 		zend_string_release_ex(ZCG(cwd), 0);
 		ZCG(cwd) = NULL;
 	}
-
-	if (!ZCG(enabled) || !accel_startup_ok) {
-		return;
-	}
 }
 
 static int accelerator_remove_cb(zend_extension *element1, zend_extension *element2)

ext/opcache/ZendAccelerator.h

@@ -195,6 +195,8 @@ typedef struct _zend_accel_globals {
 	int                     counted;   /* the process uses shared memory */
 	zend_bool               enabled;
 	zend_bool               locked;    /* thread obtained exclusive lock */
+	zend_bool               accelerator_enabled; /* accelerator enabled for current request */
+	zend_bool               pcre_reseted;
 	HashTable               bind_hash; /* prototype and zval lookup table */
 	zend_accel_directives   accel_directives;
 	zend_string            *cwd;                  /* current working directory or NULL */

ext/opcache/zend_accelerator_module.c

@@ -438,11 +438,11 @@ void zend_accel_info(ZEND_MODULE_INFO_FUNC_ARGS)
 {
 	php_info_print_table_start();
 
-	if (ZCG(enabled) && accel_startup_ok &&
+	if (
 #ifdef HAVE_OPCACHE_FILE_CACHE
-		((ZCG(counted) || ZCSG(accelerator_enabled)) || file_cache_only)
+		(ZCG(accelerator_enabled) || file_cache_only)
 #else
-		(ZCG(counted) || ZCSG(accelerator_enabled))
+		(ZCG(accelerator_enabled))
 #endif
 	) {
 		php_info_print_table_row(2, "Opcode Caching", "Up and Running");
@@ -546,7 +546,7 @@ static int accelerator_get_scripts(zval *return_value)
 	struct timeval exec_time;
 	struct timeval fetch_time;
 
-	if (!ZCG(enabled) || !accel_startup_ok || !ZCSG(accelerator_enabled) || accelerator_shm_read_lock() != SUCCESS) {
+	if (!ZCG(accelerator_enabled) || accelerator_shm_read_lock() != SUCCESS) {
 		return 0;
 	}
 
@@ -608,7 +608,7 @@ static ZEND_FUNCTION(opcache_get_status)
 	array_init(return_value);
 
 	/* Trivia */
-	add_assoc_bool(return_value, "opcache_enabled", ZCG(enabled) && (ZCG(counted) || ZCSG(accelerator_enabled)));
+	add_assoc_bool(return_value, "opcache_enabled", ZCG(accelerator_enabled));
 
 #ifdef HAVE_OPCACHE_FILE_CACHE
 	if (ZCG(accel_directives).file_cache) {
@@ -805,7 +805,7 @@ static ZEND_FUNCTION(opcache_compile_file)
 		return;
 	}
 
-	if (!ZCG(enabled) || !accel_startup_ok || !ZCSG(accelerator_enabled)) {
+	if (!ZCG(accelerator_enabled)) {
 		zend_error(E_NOTICE, ACCELERATOR_PRODUCT_NAME " seems to be disabled, can't compile file");
 		RETURN_FALSE;
 	}
@@ -844,7 +844,7 @@ static ZEND_FUNCTION(opcache_is_script_cached)
 		RETURN_FALSE;
 	}
 
-	if (!ZCG(enabled) || !accel_startup_ok || !ZCSG(accelerator_enabled)) {
+	if (!ZCG(accelerator_enabled)) {
 		RETURN_FALSE;
 	}
 

ext/sqlite3/sqlite3.c

@@ -2067,6 +2067,15 @@ static int php_sqlite3_authorizer(void *autharg, int access_type, const char *ar
 		case SQLITE_ATTACH:
 		{
 			if (memcmp(arg3, ":memory:", sizeof(":memory:")) && *arg3) {
+				if (strncmp(arg3, "file:", 5) == 0) {
+					/* starts with "file:" */
+					if (!arg3[5]) {
+						return SQLITE_DENY;
+					}
+					if (php_check_open_basedir(arg3 + 5)) {
+						return SQLITE_DENY;
+					}
+				}
 				if (php_check_open_basedir(arg3)) {
 					return SQLITE_DENY;
 				}

main/php_version.h

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 3
 #define PHP_RELEASE_VERSION 6
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.3.6-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.3.6"
 #define PHP_VERSION_ID 70306