5.6.25

BLock test with memory leak
fix tests
2026-11-11 19:20:50 +00:00 · 2016-08-18 13:07:46 +02:00 · 2016-08-18 12:54:07 +02:00 · 2016-08-18 12:54:00 +02:00 · 2016-08-18 12:53:53 +02:00 · 2016-08-18 12:53:47 +02:00
41 changed files with 1175 additions and 213 deletions
@@ -1,15 +1,24 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2016, PHP 5.6.25
+18 Aug 2016, PHP 5.6.25
+
+- Bz2:
+  . Fixed bug #72837 (integer overflow in bzdecompress caused heap
+    corruption). (Stas)

 - Core:
+  . Fixed bug #70436 (Use After Free Vulnerability in unserialize()).
+    (Taoguang Chen)
+  . Fixed bug #72024 (microtime() leaks memory). (maroszek at gmx dot net)
  . Fixed bug #72581 (previous property undefined in Exception after
    deserialization). (Laruence)
-  . Fixed bug #72024 (microtime() leaks memory). (maroszek at gmx dot net)
  . Implemented FR #72614 (Support "nmake test" on building extensions by
    phpize). (Yuji Uchiyama)
  . Fixed bug #72641 (phpize (on Windows) ignores PHP_PREFIX).
    (Yuji Uchiyama)
+  . Fixed bug #72663 (Create an Unexpected Object and Don't Invoke
+    __wakeup() in Deserialization). (Stas)
+  . Fixed bug #72681 (PHP Session Data Injection Vulnerability). (Stas)

 - Calendar:
  . Fixed bug #67976 (cal_days_month() fails for final month of the French
@@ -22,11 +31,18 @@ PHP                                                                        NEWS
    (maroszek at gmx dot net)
  . Fixed bug #71929 (Certification information (CERTINFO) data parsing error).
    (Pierrick)
+  . Fixed bug #72807 (integer overflow in curl_escape caused heap
+    corruption). (Stas)

 - DOM:
  . Fixed bug #66502 (DOM document dangling reference). (Sean Heelan, cmb)

+- Ereg:
+  . Fixed bug #72838 (Integer overflow lead to heap corruption in
+    sql_regcase). (Stas)
+
 - EXIF:
+  . Fixed bug #72627 (Memory Leakage In exif_process_IFD_in_TIFF). (Stas)
  . Fixed bug #72735 (Samsung picture thumb not read (zero size)). (Kalle, Remi)

 - Filter:
@@ -38,14 +54,16 @@ PHP                                                                        NEWS
    (gooh)

 - GD:
-  . Fixed bug #72596 (imagetypes function won't advertise WEBP support). (cmb)
-  . Fixed bug #72604 (imagearc() ignores thickness for full arcs). (cmb)
-  . Fixed bug #70315 (500 Server Error but page is fully rendered). (cmb)
  . Fixed bug #43828 (broken transparency of imagearc for truecolor in
    blendingmode). (cmb)
  . Fixed bug #66555 (Always false condition in ext/gd/libgd/gdkanji.c). (cmb)
  . Fixed bug #68712 (suspicious if-else statements). (cmb)
+  . Fixed bug #70315 (500 Server Error but page is fully rendered). (cmb)
+  . Fixed bug #72596 (imagetypes function won't advertise WEBP support). (cmb)
+  . Fixed bug #72604 (imagearc() ignores thickness for full arcs). (cmb)
+  . Fixed bug #72697 (select_colors write out-of-bounds). (Stas)
  . Fixed bug #72709 (imagesetstyle() causes OOB read for empty $styles). (cmb)
+  . Fixed bug #72730 (imagegammacorrect allows arbitrary write access). (Stas)

 - Intl:
  . Partially fixed #72506 (idn_to_ascii for UTS #46 incorrect for long domain
@@ -66,30 +84,39 @@ PHP                                                                        NEWS

 - PDO_pgsql:
  . Fixed bug #70313 (PDO statement fails to throw exception). (Matteo)
-  . Implemented FR #72633 (Postgres PDO lastInsertId() should work without
-    specifying a sequence). (Pablo Santiago Sánchez)

 - Reflection:
  . Fixed bug #72222 (ReflectionClass::export doesn't handle array constants).
    (Nikita Nefedov)

+- SNMP:
+  . Fixed bug #72708 (php_snmp_parse_oid integer overflow in memory
+    allocation). (djodjo at gmail dot com)
+
 - Standard:
  . Fixed bug #72330 (CSV fields incorrectly split if escape char followed by
    UTF chars). (cmb)
-
- SPL:
-  . Fixed bug #72684 (AppendIterator segfault with closed generator). (Pierrick)
+  . Fixed bug #72836 (integer overflow in base64_decode). (Stas)
+  . Fixed bug #72848 (integer overflow in quoted_printable_encode). (Stas)
+  . Fixed bug #72849 (integer overflow in urlencode). (Stas)
+  . Fixed bug #72850 (integer overflow in php_uuencode). (Stas)
+  . Fixed bug #72716 (initialize buffer before read). (Stas)

 - Streams:
  . Fixed bug #41021 (Problems with the ftps wrapper). (vhuk)
  . Fixed bug #54431 (opendir() does not work with ftps:// wrapper). (vhuk)
  . Fixed bug #72667 (opendir() with ftp:// attempts to open data stream for
    non-existent directories). (vhuk)
+  . Fixed bug #72764 (ftps:// opendir wrapper data channel encryption fails
+    with IIS FTP 7.5, 8.5). (vhuk)
+  . Fixed bug #72771 (ftps:// wrapper is vulnerable to protocol downgrade
+    attack). (Stas)

 - SPL:
  . Fixed bug #72122 (IteratorIterator breaks '@' error suppression). (kinglozzer)
  . Fixed bug #72646 (SplFileObject::getCsvControl does not return the escape
    character). (cmb)
+  . Fixed bug #72684 (AppendIterator segfault with closed generator). (Pierrick)

 - SQLite3:
  . Implemented FR #72653 (SQLite should allow opening with empty filename).
@@ -98,6 +125,12 @@ PHP                                                                        NEWS
 - Wddx:
  . Fixed bug #72142 (WDDX Packet Injection Vulnerability in
    wddx_serialize_value()). (Taoguang Chen)
+  . Fixed bug #72749 (wddx_deserialize allows illegal memory access) (Stas)
+  . Fixed bug #72750 (wddx_deserialize null dereference). (Stas)
+  . Fixed bug #72790 (wddx_deserialize null dereference with invalid xml).
+    (Stas)
+  . Fixed bug #72799 (wddx_deserialize null dereference in
+    php_wddx_pop_element). (Stas)

 21 Jul 2016, PHP 5.6.24

@@ -447,7 +447,7 @@ ZEND_API int add_property_zval_ex(zval *arg, const char *key, uint key_len, zval
 #define add_property_double(__arg, __key, __d) add_property_double_ex(__arg, __key, strlen(__key)+1, __d TSRMLS_CC)
 #define add_property_string(__arg, __key, __str, __duplicate) add_property_string_ex(__arg, __key, strlen(__key)+1, __str, __duplicate TSRMLS_CC)
 #define add_property_stringl(__arg, __key, __str, __length, __duplicate) add_property_stringl_ex(__arg, __key, strlen(__key)+1, __str, __length, __duplicate TSRMLS_CC)
-#define add_property_zval(__arg, __key, __value) add_property_zval_ex(__arg, __key, strlen(__key)+1, __value TSRMLS_CC)       
+#define add_property_zval(__arg, __key, __value) add_property_zval_ex(__arg, __key, strlen(__key)+1, __value TSRMLS_CC)


 ZEND_API int call_user_function(HashTable *function_table, zval **object_pp, zval *function_name, zval *retval_ptr, zend_uint param_count, zval *params[] TSRMLS_DC);
@@ -458,7 +458,7 @@ ZEND_API extern const zend_fcall_info_cache empty_fcall_info_cache;

 /** Build zend_call_info/cache from a zval*
 *
- * Caller is responsible to provide a return value, otherwise the we will crash. 
+ * Caller is responsible to provide a return value, otherwise the we will crash.
 * fci->retval_ptr_ptr = NULL;
 * In order to pass parameters the following members need to be set:
 * fci->param_count = 0;
@@ -578,6 +578,9 @@ END_EXTERN_C()
 		const char *__s=(s);				\
 		zval *__z = (z);					\
 		Z_STRLEN_P(__z) = strlen(__s);		\
+		if (UNEXPECTED(Z_STRLEN_P(__z) < 0)) { \
+			zend_error(E_ERROR, "String size overflow"); \
+		}									\
 		Z_STRVAL_P(__z) = (duplicate?estrndup(__s, Z_STRLEN_P(__z)):(char*)__s);\
 		Z_TYPE_P(__z) = IS_STRING;			\
 	} while (0)
@@ -120,7 +120,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=6
 PHP_RELEASE_VERSION=25
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -196,7 +196,7 @@ php_stream_ops php_stream_bz2io_ops = {
 };

 /* {{{ Bzip2 stream openers */
-PHP_BZ2_API php_stream *_php_stream_bz2open_from_BZFILE(BZFILE *bz, 
+PHP_BZ2_API php_stream *_php_stream_bz2open_from_BZFILE(BZFILE *bz,
 														const char *mode, php_stream *innerstream STREAMS_DC TSRMLS_DC)
 {
 	struct php_bz2_stream_data_t *self;
@@ -574,15 +574,25 @@ static PHP_FUNCTION(bzdecompress)
 		/* compression is better then 2:1, need to allocate more memory */
 		bzs.avail_out = source_len;
 		size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
+		if (size > INT_MAX) {
+			/* no reason to continue if we're going to drop it anyway */
+			break;
+		}
 		dest = safe_erealloc(dest, 1, bzs.avail_out+1, (size_t) size );
 		bzs.next_out = dest + size;
 	}

 	if (error == BZ_STREAM_END || error == BZ_OK) {
 		size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
-		dest = safe_erealloc(dest, 1, (size_t) size, 1);
-		dest[size] = '\0';
-		RETVAL_STRINGL(dest, (int) size, 0);
+		if (size > INT_MAX) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Decompressed size too big, max is %d", INT_MAX);
+			efree(dest);
+			RETVAL_LONG(BZ_MEM_ERROR);
+		} else {
+			dest = safe_erealloc(dest, 1, (size_t) size, 1);
+			dest[size] = '\0';
+			RETVAL_STRINGL(dest, (int) size, 0);
+		}
 	} else { /* real error */
 		efree(dest);
 		RETVAL_LONG(error);
@@ -3478,6 +3478,10 @@ PHP_FUNCTION(curl_escape)
 	ZEND_FETCH_RESOURCE(ch, php_curl *, &zid, -1, le_curl_name, le_curl);

 	if ((res = curl_easy_escape(ch->cp, str, str_len))) {
+		if (strlen(res) > INT_MAX) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Escaped string is too long, maximum is %d", INT_MAX);
+			RETURN_FALSE;
+		}
 		RETVAL_STRING(res, 1);
 		curl_free(res);
 	} else {
@@ -743,6 +743,11 @@ PHP_EREG_API PHP_FUNCTION(sql_regcase)
 	
 	for (i = j = 0; i < string_len; i++) {
 		c = (unsigned char) string[i];
+		if ( j >= INT_MAX - 1 || (isalpha(c) && j >= INT_MAX - 4)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "String too long, max length is %d", INT_MAX);
+			efree(tmp);
+			RETURN_FALSE;
+		}
 		if (isalpha(c)) {
 			tmp[j++] = '[';
 			tmp[j++] = toupper(c);
@@ -3768,8 +3768,11 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 						fgot = php_stream_read(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
 						if (fgot < ImageInfo->Thumbnail.size) {
 							EXIF_ERRLOG_THUMBEOF(ImageInfo)
+							efree(ImageInfo->Thumbnail.data);
+							ImageInfo->Thumbnail.data = NULL;
+						} else {
+							exif_thumbnail_build(ImageInfo TSRMLS_CC);
 						}
-						exif_thumbnail_build(ImageInfo TSRMLS_CC);
 					}
 #ifdef EXIF_DEBUG
 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read next IFD (THUMBNAIL) done");
@@ -0,0 +1,71 @@
+--TEST--
+Bug #72627 (Memory Leakage In exif_process_IFD_in_TIFF)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+	$exif = exif_read_data(__DIR__ . '/bug72627.tiff',0,0,true);
+	var_dump($exif);
+?>
+--EXPECTF--
+Warning: exif_read_data(%s): Thumbnail goes IFD boundary or end of file reached in %sbug72627.php on line %d
+
+Warning: exif_read_data(%s): Error in TIFF: filesize(x04E2) less than start of IFD dir(x829A0004) in %sbug72627.php on line %d
+
+Warning: exif_read_data(%s): Thumbnail goes IFD boundary or end of file reached in %sbug72627.php on line %d
+array(11) {
+  ["FileName"]=>
+  string(13) "bug72627.tiff"
+  ["FileDateTime"]=>
+  int(%d)
+  ["FileSize"]=>
+  int(1250)
+  ["FileType"]=>
+  int(7)
+  ["MimeType"]=>
+  string(10) "image/tiff"
+  ["SectionsFound"]=>
+  string(30) "ANY_TAG, IFD0, THUMBNAIL, EXIF"
+  ["COMPUTED"]=>
+  array(10) {
+    ["html"]=>
+    string(24) "width="128" height="132""
+    ["Height"]=>
+    int(132)
+    ["Width"]=>
+    int(128)
+    ["IsColor"]=>
+    int(0)
+    ["ByteOrderMotorola"]=>
+    int(0)
+    ["ApertureFNumber"]=>
+    string(5) "f/1.0"
+    ["Thumbnail.FileType"]=>
+    int(2)
+    ["Thumbnail.MimeType"]=>
+    string(10) "image/jpeg"
+    ["Thumbnail.Height"]=>
+    int(132)
+    ["Thumbnail.Width"]=>
+    int(128)
+  }
+  ["XResolution"]=>
+  string(21) "1414812756/1414812756"
+  ["THUMBNAIL"]=>
+  array(5) {
+    ["ImageWidth"]=>
+    int(128)
+    ["ImageLength"]=>
+    int(132)
+    ["JPEGInterchangeFormat"]=>
+    int(1280)
+    ["JPEGInterchangeFormatLength"]=>
+    int(100)
+    ["THUMBNAIL"]=>
+    NULL
+  }
+  ["ExposureTime"]=>
+  string(21) "1414812756/1414812756"
+  ["FNumber"]=>
+  string(21) "1414812756/1414812756"
+}
@@ -288,6 +288,10 @@ if ($pid) {
 			}


+			if ((!empty($ssl)) && (!stream_socket_enable_crypto($pasvs, true, STREAM_CRYPTO_METHOD_SSLv23_SERVER))) {
+				die("SSLv23 handshake failed.\n");
+			}
+
 			if (empty($m[1]) || $m[1] !== 'emptydir') {
 				fputs($fs, "file1\r\nfile1\r\nfile\nb0rk\r\n");
 			}
@@ -403,10 +407,6 @@ if ($pid) {

 			$pasvs = stream_socket_accept($soc,10);

-			if ((!empty($ssl)) && (!stream_socket_enable_crypto($pasvs, true, STREAM_CRYPTO_METHOD_SSLv23_SERVER))) {
-				die("SSLv23 handshake failed.\n");
-			}
-
 		}elseif (preg_match('/^EPSV/', $buf, $matches)) {
 			fputs($s, "550 Extended passsive mode not supported.\r\n");
 		} elseif (preg_match('/^SITE EXEC/', $buf, $matches)) {
@@ -99,7 +99,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int, int);

 #include "gd_ctx.c"

-/* as it is not really public, duplicate declaration here to avoid 
+/* as it is not really public, duplicate declaration here to avoid
   pointless warnings */
 int overflow2(int a, int b);

@@ -1197,7 +1197,7 @@ PHP_MINIT_FUNCTION(gd)
 	REGISTER_LONG_CONSTANT("IMG_CROP_SIDES", GD_CROP_SIDES, CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("IMG_CROP_THRESHOLD", GD_CROP_THRESHOLD, CONST_CS | CONST_PERSISTENT);

-	
+
 	REGISTER_LONG_CONSTANT("IMG_BELL", GD_BELL, CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("IMG_BESSEL", GD_BESSEL, CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("IMG_BILINEAR_FIXED", GD_BILINEAR_FIXED, CONST_CS | CONST_PERSISTENT);
@@ -1658,11 +1658,11 @@ PHP_FUNCTION(imagetruecolortopalette)

 	ZEND_FETCH_RESOURCE(im, gdImagePtr, &IM, -1, "Image", le_gd);

-	if (ncolors <= 0) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number of colors has to be greater than zero");
+	if (ncolors <= 0 || ncolors > INT_MAX) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number of colors has to be greater than zero and no more than %d", INT_MAX);
 		RETURN_FALSE;
 	}
-	gdImageTrueColorToPalette(im, dither, ncolors);
+	gdImageTrueColorToPalette(im, dither, (int)ncolors);

 	RETURN_TRUE;
 }
@@ -3082,6 +3082,11 @@ PHP_FUNCTION(imagegammacorrect)
 		return;
 	}

+	if ( input <= 0.0 || output <= 0.0 ) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Gamma values should be positive");
+		RETURN_FALSE;
+	}
+
 	ZEND_FETCH_RESOURCE(im, gdImagePtr, &IM, -1, "Image", le_gd);

 	if (gdImageTrueColor(im))	{
@@ -3913,7 +3918,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
 #endif /* VIRTUAL_DIR */

 	PHP_GD_CHECK_OPEN_BASEDIR(fontname, "Invalid font filename");
-	
+
 #ifdef HAVE_GD_FREETYPE
 	if (extended) {
 		error = gdImageStringFTEx(im, brect, col, fontname, ptsize, angle, x, y, str, &strex);
@@ -4491,7 +4496,7 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 	int x, y;
 	float x_ratio, y_ratio;
    long ignore_warning;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pplll", &f_org, &f_org_len, &f_dest, &f_dest_len, &height, &width, &threshold) == FAILURE) {
 		return;
 	}
@@ -5374,7 +5379,7 @@ PHP_FUNCTION(imageaffinematrixget)
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Missing y position");
 				RETURN_FALSE;
 			}
-			
+
 			if (type == GD_AFFINE_TRANSLATE) {
 				res = gdAffineTranslate(affine, x, y);
 			} else {
@@ -0,0 +1,17 @@
+--TEST--
+Bug #72697: select_colors write out-of-bounds
+--SKIPIF--
+<?php 
+if (!function_exists("imagecreatetruecolor")) die("skip");
+if (PHP_INT_MAX !== 9223372036854775807) die("skip for 64-bit long systems only");
+?>
+--FILE--
+<?php
+
+$img=imagecreatetruecolor(10, 10);
+imagetruecolortopalette($img, false, PHP_INT_MAX / 8);
+?>
+DONE
+--EXPECTF--
+Warning: imagetruecolortopalette(): Number of colors has to be greater than zero and no more than 2147483647 in %sbug72697.php on line %d
+DONE
@@ -0,0 +1,15 @@
+--TEST--
+Bug #72730: imagegammacorrect allows arbitrary write access
+--SKIPIF--
+<?php 
+if (!function_exists("imagecreatetruecolor")) die("skip");
+?>
+--FILE--
+<?php
+$img =  imagecreatetruecolor(1, 1);
+imagegammacorrect($img, -1, 1337);
+?>
+DONE
+--EXPECTF--
+Warning: imagegammacorrect(): Gamma values should be positive in %sbug72730.php on line %d
+DONE
@@ -25,4 +25,4 @@ Warning: imagetruecolortopalette() expects parameter 3 to be long, resource give

 Warning: imagetruecolortopalette() expects parameter 3 to be long, array given in %s on line %d

-Warning: imagetruecolortopalette(): Number of colors has to be greater than zero in %s on line %d
+Warning: imagetruecolortopalette(): Number of colors has to be greater than zero and no more than %d in %s on line %d
@@ -16,6 +16,6 @@ imagetruecolortopalette($image, true, -1);

 ?>
 --EXPECTF--
-Warning: imagetruecolortopalette(): Number of colors has to be greater than zero in %s on line %d
+Warning: imagetruecolortopalette(): Number of colors has to be greater than zero and no more than %d in %s on line %d

-Warning: imagetruecolortopalette(): Number of colors has to be greater than zero in %s on line %d
+Warning: imagetruecolortopalette(): Number of colors has to be greater than zero and no more than %d in %s on line %d
@@ -358,30 +358,31 @@ static char *pdo_pgsql_last_insert_id(pdo_dbh_t *dbh, const char *name, unsigned
 {
 	pdo_pgsql_db_handle *H = (pdo_pgsql_db_handle *)dbh->driver_data;
 	char *id = NULL;
-	PGresult *res;
-	ExecStatusType status;
-	const char *q[1];
-	q[0] = name;

-	if (PHP_PDO_PGSQL_LASTVAL_PG_VERSION <= PQserverVersion(H->server) && name == NULL) {
-		res = PQexec(H->server, "SELECT LASTVAL()");
-	} else {
-		res = PQexecParams(H->server, "SELECT CURRVAL($1)", 1, NULL, q, NULL, NULL, 0);
-	}
-	status = PQresultStatus(res);
-
-	if (res && (status == PGRES_TUPLES_OK)) {
-		id = estrdup((char *)PQgetvalue(res, 0, 0));
-		*len = PQgetlength(res, 0, 0);
-	} else {
-		pdo_pgsql_error(dbh, status, pdo_pgsql_sqlstate(res));
+	if (name == NULL) {
+		if (H->pgoid == InvalidOid) {
+			return NULL;
+		}
 		*len = spprintf(&id, 0, "%ld", (long) H->pgoid);
-	}
+	} else {
+		PGresult *res;
+		ExecStatusType status;
+		const char *q[1];
+		q[0] = name;
+		res = PQexecParams(H->server, "SELECT CURRVAL($1)", 1, NULL, q, NULL, NULL, 0);
+		status = PQresultStatus(res);

-	if (res) {
-		PQclear(res);
-	}
+		if (res && (status == PGRES_TUPLES_OK)) {
+			id = estrdup((char *)PQgetvalue(res, 0, 0));
+			*len = PQgetlength(res, 0, 0);
+		} else {
+			pdo_pgsql_error(dbh, status, pdo_pgsql_sqlstate(res));
+		}

+		if (res) {
+			PQclear(res);
+		}
+	}
 	return id;
 }

@@ -29,8 +29,6 @@

 #define PHP_PDO_PGSQL_CONNECTION_FAILURE_SQLSTATE "08006"

-#define PHP_PDO_PGSQL_LASTVAL_PG_VERSION 80100
-
 typedef struct {
 	const char *file;
 	int line;
@@ -1,39 +0,0 @@
--TEST--
-currval() vs lastval() - PDO PgSQL Bug #1134 [BUG] New record, PostgreSQL and the Primary key https://github.com/phalcon/cphalcon/issues/1134
--SKIPIF--
-<?php
-if (!extension_loaded('pdo') || !extension_loaded('pdo_pgsql')) die('skip not loaded');
-require dirname(__FILE__) . '/config.inc';
-require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
-PDOTest::skip();
-?>
--FILE--
-<?php
-
-require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
-
-$db = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
-
-$db->setAttribute(PDO::ATTR_STRINGIFY_FETCHES, false);
-
-$db->query('CREATE TABLE test_last_id (id SERIAL NOT NULL, field1 VARCHAR(10))');
-
-$stmt = $db->prepare("INSERT INTO test_last_id (field1) VALUES ('test')");
-
-$stmt->execute();
-
-/**
- * No sequence name informed
- */
-var_dump($db->lastInsertId());
-/**
- * Sequence name informed
- */
-var_dump($db->lastInsertId('test_last_id_id_seq'));
-
-$db->query('DROP TABLE test_last_id');
-
-?>
--EXPECTREGEX--
-string\([0-9]*\)\ \"[0-9]*\"
-string\([0-9]*\)\ \"[0-9]*\"
@@ -924,11 +924,13 @@ PS_SERIALIZER_DECODE_FUNC(php_binary) /* {{{ */
 	int namelen;
 	int has_value;
 	php_unserialize_data_t var_hash;
+	int skip = 0;

 	PHP_VAR_UNSERIALIZE_INIT(var_hash);

 	for (p = val; p < endptr; ) {
 		zval **tmp;
+		skip = 0;
 		namelen = ((unsigned char)(*p)) & (~PS_BIN_UNDEF);

 		if (namelen < 0 || namelen > PS_BIN_MAX || (p + namelen) >= endptr) {
@@ -944,22 +946,25 @@ PS_SERIALIZER_DECODE_FUNC(php_binary) /* {{{ */

 		if (zend_hash_find(&EG(symbol_table), name, namelen + 1, (void **) &tmp) == SUCCESS) {
 			if ((Z_TYPE_PP(tmp) == IS_ARRAY && Z_ARRVAL_PP(tmp) == &EG(symbol_table)) || *tmp == PS(http_session_vars)) {
-				efree(name);
-				continue;
+				skip = 1;
 			}
 		}

 		if (has_value) {
 			ALLOC_INIT_ZVAL(current);
 			if (php_var_unserialize(&current, (const unsigned char **) &p, (const unsigned char *) endptr, &var_hash TSRMLS_CC)) {
-				php_set_session_var(name, namelen, current, &var_hash  TSRMLS_CC);
+				if (!skip) {
+					php_set_session_var(name, namelen, current, &var_hash  TSRMLS_CC);
+				}
 			} else {
 				PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
 				return FAILURE;
 			}
 			var_push_dtor_no_addref(&var_hash, &current);
 		}
-		PS_ADD_VARL(name, namelen);
+		if (!skip) {
+			PS_ADD_VARL(name, namelen);
+		}
 		efree(name);
 	}

@@ -1016,6 +1021,7 @@ PS_SERIALIZER_DECODE_FUNC(php) /* {{{ */
 	int namelen;
 	int has_value;
 	php_unserialize_data_t var_hash;
+	int skip = 0;

 	PHP_VAR_UNSERIALIZE_INIT(var_hash);

@@ -1024,6 +1030,7 @@ PS_SERIALIZER_DECODE_FUNC(php) /* {{{ */
 	while (p < endptr) {
 		zval **tmp;
 		q = p;
+		skip = 0;
 		while (*q != PS_DELIMITER) {
 			if (++q >= endptr) goto break_outer_loop;
 		}
@@ -1040,14 +1047,16 @@ PS_SERIALIZER_DECODE_FUNC(php) /* {{{ */

 		if (zend_hash_find(&EG(symbol_table), name, namelen + 1, (void **) &tmp) == SUCCESS) {
 			if ((Z_TYPE_PP(tmp) == IS_ARRAY && Z_ARRVAL_PP(tmp) == &EG(symbol_table)) || *tmp == PS(http_session_vars)) {
-				goto skip;
+				skip = 1;
 			}
 		}

 		if (has_value) {
 			ALLOC_INIT_ZVAL(current);
 			if (php_var_unserialize(&current, (const unsigned char **) &q, (const unsigned char *) endptr, &var_hash TSRMLS_CC)) {
-				php_set_session_var(name, namelen, current, &var_hash  TSRMLS_CC);
+				if (!skip) {
+					php_set_session_var(name, namelen, current, &var_hash  TSRMLS_CC);
+				}
 			} else {
 				var_push_dtor_no_addref(&var_hash, &current);
 				efree(name);
@@ -1056,7 +1065,9 @@ PS_SERIALIZER_DECODE_FUNC(php) /* {{{ */
 			}
 			var_push_dtor_no_addref(&var_hash, &current);
 		}
-		PS_ADD_VARL(name, namelen);
+		if (!skip) {
+			PS_ADD_VARL(name, namelen);
+		}
 skip:
 		efree(name);

@@ -0,0 +1,16 @@
+--TEST--
+Bug #72681: PHP Session Data Injection Vulnerability
+--SKIPIF--
+<?php include('skipif.inc'); ?>
+--FILE--
+<?php
+ini_set('session.serialize_handler', 'php');
+session_start();
+$_SESSION['_SESSION'] = 'ryat|O:8:"stdClass":0:{}';
+session_write_close();
+session_start();
+var_dump($_SESSION);
+?>
+--EXPECT--
+array(0) {
+}
@@ -1032,7 +1032,7 @@ static int php_snmp_parse_oid(zval *object, int st, struct objid_query *objid_qu
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Got empty OID array");
 			return FALSE;
 		}
-		objid_query->vars = (snmpobjarg *)emalloc(sizeof(snmpobjarg) * zend_hash_num_elements(Z_ARRVAL_PP(oid)));
+		objid_query->vars = (snmpobjarg *)safe_emalloc(sizeof(snmpobjarg), zend_hash_num_elements(Z_ARRVAL_PP(oid)), 0);
 		if (objid_query->vars == NULL) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "emalloc() failed while parsing oid array: %s", strerror(errno));
 			efree(objid_query->vars);
@@ -66,6 +66,12 @@ PHPAPI unsigned char *php_base64_encode(const unsigned char *str, int length, in
 		return NULL;
 	}

+	if (((size_t)length + 2) / 3 > INT_MAX/4 ) {
+		TSRMLS_FETCH();
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "String too long, maximum is %d", INT_MAX/4);
+		return NULL;
+	}
+
 	result = (unsigned char *) safe_emalloc((length + 2) / 3, 4 * sizeof(char), 1);
 	p = result;

@@ -82,6 +82,7 @@ typedef struct _php_ftp_dirstream_data {
 */
 static inline int get_ftp_result(php_stream *stream, char *buffer, size_t buffer_size TSRMLS_DC)
 {
+	buffer[0] = '\0'; /* in case read fails to read anything */
 	while (php_stream_gets(stream, buffer, buffer_size-1) &&
 		   !(isdigit((int) buffer[0]) && isdigit((int) buffer[1]) &&
 			 isdigit((int) buffer[2]) && buffer[3] == ' '));
@@ -105,7 +106,7 @@ static int php_stream_ftp_stream_close(php_stream_wrapper *wrapper, php_stream *
 {
 	php_stream *controlstream = stream->wrapperthis;
 	int ret = 0;
-	
+
 	if (controlstream) {
 		if (strpbrk(stream->mode, "wa+")) {
 			char tmp_line[512];
@@ -154,7 +155,7 @@ static php_stream *php_ftp_fopen_connect(php_stream_wrapper *wrapper, const char
 	/* use port 21 if one wasn't specified */
 	if (resource->port == 0)
 		resource->port = 21;
-	
+
 	transport_len = spprintf(&transport, 0, "tcp://%s:%d", resource->host, resource->port);
 	stream = php_stream_xport_create(transport, transport_len, REPORT_ERRORS, STREAM_XPORT_CLIENT | STREAM_XPORT_CONNECT, NULL, NULL, context, NULL, NULL);
 	efree(transport);
@@ -174,7 +175,7 @@ static php_stream *php_ftp_fopen_connect(php_stream_wrapper *wrapper, const char
 	}

 	if (use_ssl)	{
-	
+
 		/* send the AUTH TLS request name */
 		php_stream_write_string(stream, "AUTH TLS\r\n");

@@ -183,11 +184,12 @@ static php_stream *php_ftp_fopen_connect(php_stream_wrapper *wrapper, const char
 		if (result != 234) {
 			/* AUTH TLS not supported try AUTH SSL */
 			php_stream_write_string(stream, "AUTH SSL\r\n");
-			
+
 			/* get the response */
 			result = GET_FTP_RESULT(stream);
 			if (result != 334) {
-				use_ssl = 0;
+				php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "Server doesn't support FTPS.");
+				goto connect_errexit;
 			} else {
 				/* we must reuse the old SSL session id */
 				/* if we talk to an old ftpd-ssl */
@@ -200,7 +202,7 @@ static php_stream *php_ftp_fopen_connect(php_stream_wrapper *wrapper, const char
 		}

 	}
-	
+
 	if (use_ssl) {
 		if (php_stream_xport_crypto_setup(stream,
 				STREAM_CRYPTO_METHOD_SSLv23_CLIENT, NULL TSRMLS_CC) < 0
@@ -210,13 +212,13 @@ static php_stream *php_ftp_fopen_connect(php_stream_wrapper *wrapper, const char
 			stream = NULL;
 			goto connect_errexit;
 		}
-	
+
 		/* set PBSZ to 0 */
 		php_stream_write_string(stream, "PBSZ 0\r\n");

 		/* ignore the response */
 		result = GET_FTP_RESULT(stream);
-		
+
 		/* set data connection protection level */
 #if FTPS_ENCRYPT_DATA
 		php_stream_write_string(stream, "PROT P\r\n");
@@ -241,7 +243,7 @@ static php_stream *php_ftp_fopen_connect(php_stream_wrapper *wrapper, const char
 		}	\
 		s++;	\
 	}	\
-} 
+}

 	/* send the user name */
 	if (resource->user != NULL) {
@@ -253,10 +255,10 @@ static php_stream *php_ftp_fopen_connect(php_stream_wrapper *wrapper, const char
 	} else {
 		php_stream_write_string(stream, "USER anonymous\r\n");
 	}
-	
+
 	/* get the response */
 	result = GET_FTP_RESULT(stream);
-	
+
 	/* if a password is required, send it */
 	if (result >= 300 && result <= 399) {
 		php_stream_notify_info(context, PHP_STREAM_NOTIFY_AUTH_REQUIRED, tmp_line, 0);
@@ -307,7 +309,7 @@ static php_stream *php_ftp_fopen_connect(php_stream_wrapper *wrapper, const char

 connect_errexit:
 	if (resource) {
-		php_url_free(resource);	
+		php_url_free(resource);
 	}

 	if (stream) {
@@ -338,7 +340,7 @@ static unsigned short php_fopen_do_pasv(php_stream *stream, char *ip, size_t ip_
 		/* EPSV failed, let's try PASV */
 		php_stream_write_string(stream, "PASV\r\n");
 		result = GET_FTP_RESULT(stream);
-		
+
 		/* make sure we got a 227 response */
 		if (result != 227) {
 			return 0;
@@ -358,14 +360,14 @@ static unsigned short php_fopen_do_pasv(php_stream *stream, char *ip, size_t ip_
 			if (*tpath != ',') {
 				return 0;
 			}
-			*tpath='.';	
+			*tpath='.';
 			tpath++;
 		}
 		tpath[-1] = '\0';
 		memcpy(ip, hoststart, ip_size);
 		ip[ip_size-1] = '\0';
 		hoststart = ip;
-		
+
 		/* pull out the MSB of the port */
 		portno = (unsigned short) strtoul(tpath, &ttpath, 10) * 256;
 		if (ttpath == NULL) {
@@ -395,7 +397,7 @@ static unsigned short php_fopen_do_pasv(php_stream *stream, char *ip, size_t ip_
 		/* pull out the port */
 		portno = (unsigned short) strtoul(tpath + 1, &ttpath, 10);
 	}
-#endif	
+#endif
 	if (ttpath == NULL) {
 		/* didn't get correct response from EPSV/PASV */
 		return 0;
@@ -403,7 +405,7 @@ static unsigned short php_fopen_do_pasv(php_stream *stream, char *ip, size_t ip_

 	if (phoststart) {
 		*phoststart = hoststart;
-	}	
+	}

 	return portno;
 }
@@ -473,28 +475,28 @@ php_stream * php_stream_url_wrap_ftp(php_stream_wrapper *wrapper, const char *pa
 	result = GET_FTP_RESULT(stream);
 	if (result > 299 || result < 200)
 		goto errexit;
-	
+
 	/* find out the size of the file (verifying it exists) */
 	php_stream_printf(stream TSRMLS_CC, "SIZE %s\r\n", resource->path);
-	
+
 	/* read the response */
 	result = GET_FTP_RESULT(stream);
 	if (read_write == 1) {
 		/* Read Mode */
 		char *sizestr;
-		
+
 		/* when reading file, it must exist */
 		if (result > 299 || result < 200) {
 			errno = ENOENT;
 			goto errexit;
 		}
-		
+
 		sizestr = strchr(tmp_line, ' ');
 		if (sizestr) {
 			sizestr++;
 			file_size = atoi(sizestr);
 			php_stream_notify_file_size(context, file_size, tmp_line, result);
-		}	
+		}
 	} else if (read_write == 2) {
 		/* when writing file (but not appending), it must NOT exist, unless a context option exists which allows it */
 		if (context && php_stream_context_get_option(context, "ftp", "overwrite", &tmpzval) == SUCCESS) {
@@ -502,7 +504,7 @@ php_stream * php_stream_url_wrap_ftp(php_stream_wrapper *wrapper, const char *pa
 		}
 		if (result <= 299 && result >= 200) {
 			if (allow_overwrite) {
-				/* Context permits overwriting file, 
+				/* Context permits overwriting file,
 				   so we just delete whatever's there in preparation */
 				php_stream_printf(stream TSRMLS_CC, "DELE %s\r\n", resource->path);
 				result = GET_FTP_RESULT(stream);
@@ -533,7 +535,7 @@ php_stream * php_stream_url_wrap_ftp(php_stream_wrapper *wrapper, const char *pa
 			Z_LVAL_PP(tmpzval) > 0) {
 			php_stream_printf(stream TSRMLS_CC, "REST %ld\r\n", Z_LVAL_PP(tmpzval));
 			result = GET_FTP_RESULT(stream);
-			if (result < 300 || result > 399) {			
+			if (result < 300 || result > 399) {
 				php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "Unable to resume from offset %ld", Z_LVAL_PP(tmpzval));
 				goto errexit;
 			}
@@ -547,9 +549,9 @@ php_stream * php_stream_url_wrap_ftp(php_stream_wrapper *wrapper, const char *pa
 	} else {
 		/* Append */
 		memcpy(tmp_line, "APPE", sizeof("APPE"));
-	} 
+	}
 	php_stream_printf(stream TSRMLS_CC, "%s %s\r\n", tmp_line, (resource->path != NULL ? resource->path : "/"));
-	
+
 	/* open the data channel */
 	if (hoststart == NULL) {
 		hoststart = resource->host;
@@ -563,14 +565,14 @@ php_stream * php_stream_url_wrap_ftp(php_stream_wrapper *wrapper, const char *pa

 	result = GET_FTP_RESULT(stream);
 	if (result != 150 && result != 125) {
-		/* Could not retrieve or send the file 
+		/* Could not retrieve or send the file
 		 * this data will only be sent to us after connection on the data port was initiated.
 		 */
 		php_stream_close(datastream);
 		datastream = NULL;
-		goto errexit;	
+		goto errexit;
 	}
-	
+
 	php_stream_context_set(datastream, context);
 	php_stream_notify_progress_init(context, 0, file_size);

@@ -584,7 +586,7 @@ php_stream * php_stream_url_wrap_ftp(php_stream_wrapper *wrapper, const char *pa
 		goto errexit;
 	}

-	/* remember control stream */	
+	/* remember control stream */
 	datastream->wrapperthis = stream;

 	php_url_free(resource);
@@ -668,7 +670,7 @@ static int php_ftp_dirstream_close(php_stream *stream, int close_handle TSRMLS_D
 	/* close data connection */
 	php_stream_close(data->datastream);
 	data->datastream = NULL;
-	
+
 	efree(data);
 	stream->abstract = NULL;

@@ -707,7 +709,7 @@ php_stream * php_stream_ftp_opendir(php_stream_wrapper *wrapper, const char *pat

 	stream = php_ftp_fopen_connect(wrapper, path, mode, options, opened_path, context, &reuseid, &resource, &use_ssl, &use_ssl_on_data TSRMLS_CC);
 	if (!stream) {
-		goto opendir_errexit;	
+		goto opendir_errexit;
 	}

 	/* set the connection to be ascii */
@@ -716,7 +718,7 @@ php_stream * php_stream_ftp_opendir(php_stream_wrapper *wrapper, const char *pat
 	if (result > 299 || result < 200)
 		goto opendir_errexit;

-	// tmp_line isn't relevant after the php_fopen_do_pasv().  
+	// tmp_line isn't relevant after the php_fopen_do_pasv().
 	tmp_line[0] = '\0';

 	/* set up the passive connection */
@@ -736,17 +738,6 @@ php_stream * php_stream_ftp_opendir(php_stream_wrapper *wrapper, const char *pat
 		goto opendir_errexit;
 	}

-	php_stream_context_set(datastream, context);
-	if (use_ssl_on_data && (php_stream_xport_crypto_setup(datastream,
-			STREAM_CRYPTO_METHOD_SSLv23_CLIENT, NULL TSRMLS_CC) < 0 ||
-			php_stream_xport_crypto_enable(datastream, 1 TSRMLS_CC) < 0)) {
-
-		php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "Unable to activate SSL mode");
-		php_stream_close(datastream);
-		datastream = NULL;
-		goto opendir_errexit;	
-	}
-

 	php_stream_printf(stream TSRMLS_CC, "NLST %s\r\n", (resource->path != NULL ? resource->path : "/"));

@@ -760,6 +751,17 @@ php_stream * php_stream_ftp_opendir(php_stream_wrapper *wrapper, const char *pat
 		goto opendir_errexit;
 	}

+	php_stream_context_set(datastream, context);
+	if (use_ssl_on_data && (php_stream_xport_crypto_setup(datastream,
+			STREAM_CRYPTO_METHOD_SSLv23_CLIENT, NULL TSRMLS_CC) < 0 ||
+			php_stream_xport_crypto_enable(datastream, 1 TSRMLS_CC) < 0)) {
+
+		php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "Unable to activate SSL mode");
+		php_stream_close(datastream);
+		datastream = NULL;
+		goto opendir_errexit;
+	}
+
 	php_url_free(resource);

 	dirsdata = emalloc(sizeof *dirsdata);
@@ -811,17 +813,17 @@ static int php_stream_ftp_url_stat(php_stream_wrapper *wrapper, const char *url,
 	}

 	php_stream_write_string(stream, "TYPE I\r\n"); /* we need this since some servers refuse to accept SIZE command in ASCII mode */
-	
+
 	result = GET_FTP_RESULT(stream);

 	if(result < 200 || result > 299) {
 		goto stat_errexit;
 	}
-	
+
 	php_stream_printf(stream TSRMLS_CC, "SIZE %s\r\n", (resource->path != NULL ? resource->path : "/"));
 	result = GET_FTP_RESULT(stream);
 	if (result < 200 || result > 299) {
-		/* Failure either means it doesn't exist 
+		/* Failure either means it doesn't exist
 		   or it's a directory and this server
 		   fails on listing directory sizes */
 		if (ssb->sb.st_mode & S_IFDIR) {
@@ -968,8 +970,8 @@ static int php_stream_ftp_rename(php_stream_wrapper *wrapper, const char *url_fr

 	resource_from = php_url_parse(url_from);
 	resource_to = php_url_parse(url_to);
-	/* Must be same scheme (ftp/ftp or ftps/ftps), same host, and same port 
-		(or a 21/0 0/21 combination which is also "same") 
+	/* Must be same scheme (ftp/ftp or ftps/ftps), same host, and same port
+		(or a 21/0 0/21 combination which is also "same")
 	   Also require paths to/from */
 	if (!resource_from ||
 		!resource_to ||
@@ -979,8 +981,8 @@ static int php_stream_ftp_rename(php_stream_wrapper *wrapper, const char *url_fr
 		!resource_from->host ||
 		!resource_to->host ||
 		strcmp(resource_from->host, resource_to->host) ||
-		(resource_from->port != resource_to->port && 
-		 resource_from->port * resource_to->port != 0 && 
+		(resource_from->port != resource_to->port &&
+		 resource_from->port * resource_to->port != 0 &&
 		 resource_from->port + resource_to->port != 21) ||
 		!resource_from->path ||
 		!resource_to->path) {
@@ -144,7 +144,7 @@ PHPAPI unsigned char *php_quot_print_decode(const unsigned char *str, size_t len
 /* }}} */

 #define PHP_QPRINT_MAXL 75
- 
+
 PHPAPI unsigned char *php_quot_print_encode(const unsigned char *str, size_t length, size_t *ret_length) /* {{{ */
 {
 	unsigned long lp = 0;
@@ -162,9 +162,9 @@ PHPAPI unsigned char *php_quot_print_encode(const unsigned char *str, size_t len
 			lp = 0;
 		} else {
 			if (iscntrl (c) || (c == 0x7f) || (c & 0x80) || (c == '=') || ((c == ' ') && (*str == '\015'))) {
-				if ((((lp+= 3) > PHP_QPRINT_MAXL) && (c <= 0x7f)) 
-            || ((c > 0x7f) && (c <= 0xdf) && ((lp + 3) > PHP_QPRINT_MAXL)) 
-            || ((c > 0xdf) && (c <= 0xef) && ((lp + 6) > PHP_QPRINT_MAXL)) 
+				if ((((lp+= 3) > PHP_QPRINT_MAXL) && (c <= 0x7f))
+            || ((c > 0x7f) && (c <= 0xdf) && ((lp + 3) > PHP_QPRINT_MAXL))
+            || ((c > 0xdf) && (c <= 0xef) && ((lp + 6) > PHP_QPRINT_MAXL))
            || ((c > 0xef) && (c <= 0xf4) && ((lp + 9) > PHP_QPRINT_MAXL))) {
 					*d++ = '=';
 					*d++ = '\015';
@@ -208,7 +208,7 @@ PHP_FUNCTION(quoted_printable_decode)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &arg1, &arg1_len) == FAILURE) {
 		return;
 	}
-    
+
 	if (arg1_len == 0) {
 		/* shortcut */
 		RETURN_EMPTY_STRING();
@@ -219,11 +219,11 @@ PHP_FUNCTION(quoted_printable_decode)
 	while (str_in[i]) {
 		switch (str_in[i]) {
 		case '=':
-			if (str_in[i + 1] && str_in[i + 2] && 
-				isxdigit((int) str_in[i + 1]) && 
+			if (str_in[i + 1] && str_in[i + 2] &&
+				isxdigit((int) str_in[i + 1]) &&
 				isxdigit((int) str_in[i + 2]))
 			{
-				str_out[j++] = (php_hex2int((int) str_in[i + 1]) << 4) 
+				str_out[j++] = (php_hex2int((int) str_in[i + 1]) << 4)
 						+ php_hex2int((int) str_in[i + 2]);
 				i += 3;
 			} else  /* check for soft line break according to RFC 2045*/ {
@@ -254,7 +254,7 @@ PHP_FUNCTION(quoted_printable_decode)
 		}
 	}
 	str_out[j] = '\0';
-    
+
 	RETVAL_STRINGL(str_out, j, 0);
 }
 /* }}} */
@@ -275,6 +275,11 @@ PHP_FUNCTION(quoted_printable_encode)
 	}

 	new_str = (char *)php_quot_print_encode((unsigned char *)str, (size_t)str_len, &new_str_len);
+	if (new_str_len > INT_MAX) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "String too long, max length is %d", INT_MAX);
+		efree(new_str);
+		RETURN_FALSE;
+	}
 	RETURN_STRINGL(new_str, new_str_len, 0);
 }
 /* }}} */
@@ -0,0 +1,65 @@
+--TEST--
+Bug #70436: Use After Free Vulnerability in unserialize()
+--FILE--
+<?php
+
+class obj implements Serializable
+{
+	var $data;
+	
+	function serialize()
+	{
+		return serialize($this->data);
+	}
+	
+	function unserialize($data)
+	{
+		$this->data = unserialize($data);
+	}
+}
+
+$fakezval = ptr2str(1122334455);
+$fakezval .= ptr2str(0);
+$fakezval .= "\x00\x00\x00\x00";
+$fakezval .= "\x01";
+$fakezval .= "\x00";
+$fakezval .= "\x00\x00";
+
+$inner = 'C:3:"obj":3:{ryat';
+$exploit = 'a:4:{i:0;i:1;i:1;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:2;s:'.strlen($fakezval).':"'.$fakezval.'";i:3;R:5;}';
+
+$data = unserialize($exploit);
+
+var_dump($data);
+
+function ptr2str($ptr)
+{
+	$out = '';
+	
+	for ($i = 0; $i < 8; $i++) {
+		$out .= chr($ptr & 0xff);
+		$ptr >>= 8;
+	}
+	
+	return $out;
+}
+?>
+DONE
+--EXPECTF--
+Notice: unserialize(): Error at offset 0 of 3 bytes in %sbug70436.php on line %d
+
+Notice: unserialize(): Error at offset 17 of 17 bytes in %sbug70436.php on line %d
+array(4) {
+  [0]=>
+  int(1)
+  [1]=>
+  object(obj)#%d (1) {
+    ["data"]=>
+    bool(false)
+  }
+  [2]=>
+  string(24) "%s"
+  [3]=>
+  bool(false)
+}
+DONE
@@ -0,0 +1,26 @@
+--TEST--
+Bug #72663: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
+--FILE--
+<?php
+class obj implements Serializable {
+    var $data;
+    function serialize() {
+        return serialize($this->data);
+    }
+    function unserialize($data) {
+        $this->data = unserialize($data);
+    }
+}
+
+$inner = 'a:1:{i:0;O:9:"Exception":2:{s:7:"'."\0".'*'."\0".'file";R:4;}';
+$exploit = 'a:2:{i:0;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:1;R:4;}';
+
+$data = unserialize($exploit);
+echo $data[1];
+?>
+DONE
+--EXPECTF--
+Notice: unserialize(): Unexpected end of serialized data in %sbug72663.php on line %d
+
+Notice: unserialize(): Error at offset 46 of 47 bytes in %sbug72663.php on line %d
+DONE
@@ -0,0 +1,17 @@
+--TEST--
+Bug #72663: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
+--FILE--
+<?php
+
+ini_set('session.serialize_handler', 'php_serialize');
+session_start();
+$sess = 'O:9:"Exception":2:{s:7:"'."\0".'*'."\0".'file";R:1;}';
+session_decode($sess);
+var_dump($_SESSION);
+?>
+DONE
+--EXPECTF--
+Notice: session_decode(): Unexpected end of serialized data in %sbug72663_2.php on line %d
+array(0) {
+}
+DONE
@@ -0,0 +1,20 @@
+--TEST--
+Bug #72663: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
+--XFAIL--
+Memory leak, TBF later.
+--FILE--
+<?php
+class obj {
+	var $ryat;
+	function __wakeup() {
+		$this->ryat = str_repeat('A', 0x112);
+	}
+}
+
+$poc = 'O:8:"stdClass":1:{i:0;O:3:"obj":1:{s:4:"ryat";R:1;';
+unserialize($poc);
+?>
+DONE
+--EXPECTF--
+Notice: unserialize(): Error at offset 51 of 50 bytes in %sbug72663_3.php on line %d
+DONE
@@ -520,6 +520,13 @@ PHPAPI char *php_url_encode(char const *s, int len, int *new_length)
 			*to++ = c;
 		}
 	}
+
+	if ((to-start) > INT_MAX) {
+		TSRMLS_FETCH();
+		/* E_ERROR since most clients won't check for error, and this is rather rare condition */
+		php_error_docref(NULL TSRMLS_CC, E_ERROR, "String overflow, max length is %d", INT_MAX);
+	}
+
 	*to = 0;
 	if (new_length) {
 		*new_length = to - start;
@@ -153,7 +153,7 @@ PHPAPI int php_uudecode(char *src, int src_len, char **dest) /* {{{ */
 		while (s < ee) {
 			if(s+4 > e) {
 				goto err;
-			} 
+			}
 			*p++ = PHP_UU_DEC(*s) << 2 | PHP_UU_DEC(*(s + 1)) >> 4;
 			*p++ = PHP_UU_DEC(*(s + 1)) << 4 | PHP_UU_DEC(*(s + 2)) >> 2;
 			*p++ = PHP_UU_DEC(*(s + 2)) << 6 | PHP_UU_DEC(*(s + 3));
@@ -188,7 +188,7 @@ err:
 }
 /* }}} */

-/* {{{ proto string convert_uuencode(string data) 
+/* {{{ proto string convert_uuencode(string data)
   uuencode a string */
 PHP_FUNCTION(convert_uuencode)
 {
@@ -200,6 +200,11 @@ PHP_FUNCTION(convert_uuencode)
 	}

 	dst_len = php_uuencode(src, src_len, &dst);
+	if (dst_len < 0) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "String too long, max length is %d", INT_MAX);
+		efree(dst);
+		RETURN_FALSE;
+	}

 	RETURN_STRINGL(dst, dst_len, 0);
 }
@@ -962,6 +962,7 @@ PHP_FUNCTION(unserialize)
 	p = (const unsigned char*) buf;
 	PHP_VAR_UNSERIALIZE_INIT(var_hash);
 	if (!php_var_unserialize(&return_value, &p, p + buf_len, &var_hash TSRMLS_CC)) {
+		var_push_dtor(&var_hash, &return_value);
 		PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
 		zval_dtor(return_value);
 		if (!EG(exception)) {
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 */
+/* Generated by re2c 0.13.7.5 */
 #line 1 "ext/standard/var_unserializer.re"
 /*
  +----------------------------------------------------------------------+
@@ -408,7 +408,7 @@ static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 	elements = parse_iv2((*p) + 2, p);

 	(*p) += 2;
-	
+
 	if (ce->serialize == NULL) {
 		object_init_ex(*rval, ce);
 	} else {
@@ -434,9 +434,18 @@ static inline int object_common2(UNSERIALIZE_PARAMETER, long elements)
 	}

 	if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_OBJPROP_PP(rval), elements, 1)) {
+	    /* We've got partially constructed object on our hands here. Wipe it. */
+	    if(Z_TYPE_PP(rval) == IS_OBJECT) {
+	       zend_hash_clean(Z_OBJPROP_PP(rval));
+	    }
+	    ZVAL_NULL(*rval);
 		return 0;
 	}

+    if (Z_TYPE_PP(rval) != IS_OBJECT) {
+        return 0;
+    }
+
 	if (Z_OBJCE_PP(rval) != PHP_IC_ENTRY &&
 		zend_hash_exists(&Z_OBJCE_PP(rval)->function_table, "__wakeup", sizeof("__wakeup"))) {
 		INIT_PZVAL(&fname);
@@ -482,7 +491,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)



-#line 486 "ext/standard/var_unserializer.c"
+#line 495 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -542,9 +551,9 @@ yy2:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy95;
 yy3:
-#line 851 "ext/standard/var_unserializer.re"
+#line 860 "ext/standard/var_unserializer.re"
 	{ return 0; }
-#line 548 "ext/standard/var_unserializer.c"
+#line 557 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy89;
@@ -587,13 +596,13 @@ yy13:
 	goto yy3;
 yy14:
 	++YYCURSOR;
-#line 845 "ext/standard/var_unserializer.re"
+#line 854 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-#line 597 "ext/standard/var_unserializer.c"
+#line 606 "ext/standard/var_unserializer.c"
 yy16:
 	yych = *++YYCURSOR;
 	goto yy3;
@@ -619,11 +628,12 @@ yy20:
 	if (yybm[0+yych] & 128) {
 		goto yy20;
 	}
-	if (yych != ':') goto yy18;
+	if (yych <= '/') goto yy18;
+	if (yych >= ';') goto yy18;
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 698 "ext/standard/var_unserializer.re"
+#line 707 "ext/standard/var_unserializer.re"
 	{
 	size_t len, len2, len3, maxlen;
 	long elements;
@@ -770,7 +780,7 @@ yy20:

 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 774 "ext/standard/var_unserializer.c"
+#line 784 "ext/standard/var_unserializer.c"
 yy25:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -795,7 +805,7 @@ yy27:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 689 "ext/standard/var_unserializer.re"
+#line 698 "ext/standard/var_unserializer.re"
 	{
    if (!var_hash) return 0;

@@ -804,7 +814,7 @@ yy27:
 	return object_common2(UNSERIALIZE_PASSTHRU,
 			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
 }
-#line 808 "ext/standard/var_unserializer.c"
+#line 818 "ext/standard/var_unserializer.c"
 yy32:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy33;
@@ -825,7 +835,7 @@ yy34:
 	yych = *++YYCURSOR;
 	if (yych != '{') goto yy18;
 	++YYCURSOR;
-#line 668 "ext/standard/var_unserializer.re"
+#line 677 "ext/standard/var_unserializer.re"
 	{
 	long elements = parse_iv(start + 2);
 	/* use iv() not uiv() in order to check data range */
@@ -846,7 +856,7 @@ yy34:

 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 850 "ext/standard/var_unserializer.c"
+#line 860 "ext/standard/var_unserializer.c"
 yy39:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy40;
@@ -867,7 +877,7 @@ yy41:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 633 "ext/standard/var_unserializer.re"
+#line 642 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -902,7 +912,7 @@ yy41:
 	ZVAL_STRINGL(*rval, str, len, 0);
 	return 1;
 }
-#line 906 "ext/standard/var_unserializer.c"
+#line 916 "ext/standard/var_unserializer.c"
 yy46:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy47;
@@ -923,7 +933,7 @@ yy48:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 600 "ext/standard/var_unserializer.re"
+#line 609 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -956,7 +966,7 @@ yy48:
 	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-#line 960 "ext/standard/var_unserializer.c"
+#line 970 "ext/standard/var_unserializer.c"
 yy53:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
@@ -1044,7 +1054,7 @@ yy61:
 	}
 yy63:
 	++YYCURSOR;
-#line 590 "ext/standard/var_unserializer.re"
+#line 599 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 use_double:
@@ -1054,7 +1064,7 @@ use_double:
 	ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-#line 1058 "ext/standard/var_unserializer.c"
+#line 1068 "ext/standard/var_unserializer.c"
 yy65:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1113,7 +1123,7 @@ yy73:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 575 "ext/standard/var_unserializer.re"
+#line 584 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
@@ -1128,7 +1138,7 @@ yy73:

 	return 1;
 }
-#line 1132 "ext/standard/var_unserializer.c"
+#line 1142 "ext/standard/var_unserializer.c"
 yy76:
 	yych = *++YYCURSOR;
 	if (yych == 'N') goto yy73;
@@ -1155,7 +1165,7 @@ yy79:
 	if (yych <= '9') goto yy79;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 548 "ext/standard/var_unserializer.re"
+#line 557 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 	int digits = YYCURSOR - start - 3;
@@ -1182,7 +1192,7 @@ yy79:
 	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1186 "ext/standard/var_unserializer.c"
+#line 1196 "ext/standard/var_unserializer.c"
 yy83:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
@@ -1190,24 +1200,24 @@ yy83:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 541 "ext/standard/var_unserializer.re"
+#line 550 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_BOOL(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1201 "ext/standard/var_unserializer.c"
+#line 1211 "ext/standard/var_unserializer.c"
 yy87:
 	++YYCURSOR;
-#line 534 "ext/standard/var_unserializer.re"
+#line 543 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_NULL(*rval);
 	return 1;
 }
-#line 1211 "ext/standard/var_unserializer.c"
+#line 1221 "ext/standard/var_unserializer.c"
 yy89:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1230,7 +1240,7 @@ yy91:
 	if (yych <= '9') goto yy91;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 511 "ext/standard/var_unserializer.re"
+#line 520 "ext/standard/var_unserializer.re"
 	{
 	long id;

@@ -1253,7 +1263,7 @@ yy91:

 	return 1;
 }
-#line 1257 "ext/standard/var_unserializer.c"
+#line 1267 "ext/standard/var_unserializer.c"
 yy95:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1276,7 +1286,7 @@ yy97:
 	if (yych <= '9') goto yy97;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 490 "ext/standard/var_unserializer.re"
+#line 499 "ext/standard/var_unserializer.re"
 	{
 	long id;

@@ -1297,9 +1307,9 @@ yy97:

 	return 1;
 }
-#line 1301 "ext/standard/var_unserializer.c"
+#line 1311 "ext/standard/var_unserializer.c"
 }
-#line 853 "ext/standard/var_unserializer.re"
+#line 862 "ext/standard/var_unserializer.re"


 	return 0;
@@ -412,7 +412,7 @@ static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 	elements = parse_iv2((*p) + 2, p);

 	(*p) += 2;
-	
+
 	if (ce->serialize == NULL) {
 		object_init_ex(*rval, ce);
 	} else {
@@ -438,9 +438,18 @@ static inline int object_common2(UNSERIALIZE_PARAMETER, long elements)
 	}

 	if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_OBJPROP_PP(rval), elements, 1)) {
+	    /* We've got partially constructed object on our hands here. Wipe it. */
+	    if(Z_TYPE_PP(rval) == IS_OBJECT) {
+	       zend_hash_clean(Z_OBJPROP_PP(rval));
+	    }
+	    ZVAL_NULL(*rval);
 		return 0;
 	}

+    if (Z_TYPE_PP(rval) != IS_OBJECT) {
+        return 0;
+    }
+
 	if (Z_OBJCE_PP(rval) != PHP_IC_ENTRY &&
 		zend_hash_exists(&Z_OBJCE_PP(rval)->function_table, "__wakeup", sizeof("__wakeup"))) {
 		INIT_PZVAL(&fname);
@@ -0,0 +1,34 @@
+--TEST--
+Bug #72749: wddx_deserialize allows illegal memory access
+--SKIPIF--
+<?php
+if (!extension_loaded('wddx')) {
+    die('skip. wddx not available');
+}
+?>
+--FILE--
+<?php
+$xml = <<<XML
+<?xml version='1.0'?>
+<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
+<wddxPacket version='1.0'>
+<header/>
+        <data>
+                <struct>
+                     <var name='aDateTime3'>
+                         <dateTime>2\r2004-09-10T05:52:49+00</dateTime>
+                     </var>
+                 </struct>
+        </data>
+</wddxPacket>
+XML;
+
+$array = wddx_deserialize($xml);
+var_dump($array);
+?>
+--EXPECT--
+array(1) {
+  ["aDateTime3"]=>
+  string(24) "2
+2004-09-10T05:52:49+00"
+}
@@ -0,0 +1,34 @@
+--TEST--
+Bug #72750: wddx_deserialize null dereference
+--SKIPIF--
+<?php
+if (!extension_loaded('wddx')) {
+    die('skip. wddx not available');
+}
+?>
+--FILE--
+<?php
+
+$xml = <<< XML
+<?xml version='1.0'?>
+<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
+<wddxPacket version='1.0'>
+<header/>
+        <data>
+                <struct>
+                     <var name='aBinary'>
+                         <binary length='11'>\\tYmluYXJRhdGE=</binary>
+                     </var>
+                 </struct>
+        </data>
+</wddxPacket>
+XML;
+
+$array = wddx_deserialize($xml);
+var_dump($array);
+?>
+--EXPECT--
+array(1) {
+  ["aBinary"]=>
+  string(0) ""
+}
@@ -0,0 +1,35 @@
+--TEST--
+Bug 72790: wddx_deserialize null dereference with invalid xml
+--SKIPIF--
+<?php
+if (!extension_loaded('wddx')) {
+    die('skip. wddx not available');
+}
+?>
+--FILE--
+<?php
+
+$xml = <<< XML
+<?xml version='1.0' ?>
+<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
+<wddxPacket version='1.0'>
+        |array>
+                <var name="XXXX">
+                        <boolean value="this">
+                        </boolean>
+                </var>
+                <var name="YYYY">
+                        <var name="UUUU">
+                                <var name="EZEZ">
+                                </var>
+                        </var>
+                </var>
+        </array>
+</wddxPacket>
+XML;
+
+$array = wddx_deserialize($xml);
+var_dump($array);
+?>
+--EXPECT--
+NULL
@@ -0,0 +1,28 @@
+--TEST--
+Bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
+--SKIPIF--
+<?php
+if (!extension_loaded('wddx')) {
+    die('skip. wddx not available');
+}
+?>
+--FILE--
+<?php
+
+$xml = <<<XML
+<?xml version='1.0'?>
+<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
+<wddxPacket version="1.0">
+    <var name="XXXX">
+        <boolean value="1">
+            <dateTime>1998-06-12T04:32:12+00</dateTime>
+        </boolean>
+    </var>
+</wddxPacket>
+XML;
+
+$array = wddx_deserialize($xml);
+var_dump($array);
+?>
+--EXPECT--
+NULL
@@ -946,10 +946,10 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
 		if (!ent1->data) {
 			if (stack->top > 1) {
 				stack->top--;
+				efree(ent1);
 			} else {
 				stack->done = 1;
 			}
-			efree(ent1);
 			return;
 		}

@@ -959,8 +959,12 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)

 			new_str = php_base64_decode(Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data), &new_len);
 			STR_FREE(Z_STRVAL_P(ent1->data));
-			Z_STRVAL_P(ent1->data) = new_str;
-			Z_STRLEN_P(ent1->data) = new_len;
+			if (new_str) {
+				Z_STRVAL_P(ent1->data) = new_str;
+				Z_STRLEN_P(ent1->data) = new_len;
+			} else {
+				ZVAL_EMPTY_STRING(ent1->data);
+			}
 		}

 		/* Call __wakeup() method on the object. */
@@ -984,7 +988,7 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
 			wddx_stack_top(stack, (void**)&ent2);

 			/* if non-existent field */
-			if (ent2->type == ST_FIELD && ent2->data == NULL) {
+			if (ent2->data == NULL) {
 				zval_ptr_dtor(&ent1->data);
 				efree(ent1);
 				return;
@@ -1123,18 +1127,26 @@ static void php_wddx_process_data(void *user_data, const XML_Char *s, int len)
 			case ST_DATETIME: {
 				char *tmp;

-				tmp = emalloc(len + 1);
-				memcpy(tmp, s, len);
+				if (Z_TYPE_P(ent->data) == IS_STRING) {
+					tmp = safe_emalloc(Z_STRLEN_P(ent->data), 1, (size_t)len + 1);
+					memcpy(tmp, Z_STRVAL_P(ent->data), Z_STRLEN_P(ent->data));
+					memcpy(tmp + Z_STRLEN_P(ent->data), s, len);
+					len += Z_STRLEN_P(ent->data);
+					efree(Z_STRVAL_P(ent->data));
+					Z_TYPE_P(ent->data) = IS_LONG;
+				} else {
+					tmp = emalloc(len + 1);
+					memcpy(tmp, s, len);
+				}
 				tmp[len] = '\0';

 				Z_LVAL_P(ent->data) = php_parse_date(tmp, NULL);
 				/* date out of range < 1969 or > 2038 */
 				if (Z_LVAL_P(ent->data) == -1) {
-					Z_TYPE_P(ent->data) = IS_STRING;
-					Z_STRLEN_P(ent->data) = len;
-					Z_STRVAL_P(ent->data) = estrndup(s, len);
+					ZVAL_STRINGL(ent->data, tmp, len, 0);
+				} else {
+					efree(tmp);
 				}
-				efree(tmp);
 			}
 				break;

@@ -1167,9 +1179,13 @@ int php_wddx_deserialize_ex(char *value, int vallen, zval *return_value)

 	if (stack.top == 1) {
 		wddx_stack_top(&stack, (void**)&ent);
-		*return_value = *(ent->data);
-		zval_copy_ctor(return_value);
-		retval = SUCCESS;
+		if(ent->data == NULL) {
+			retval = FAILURE;
+		} else {
+			*return_value = *(ent->data);
+			zval_copy_ctor(return_value);
+			retval = SUCCESS;
+		}
 	} else {
 		retval = FAILURE;
 	}
@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 6
 #define PHP_RELEASE_VERSION 25
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.6.25-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.6.25"
 #define PHP_VERSION_ID 50625
@@ -0,0 +1,76 @@
+#!/usr/bin/env php
+<?php
+
+// Check if we are being given a mime.types file or if we should use the
+// default URL.
+$source = count($_SERVER['argv']) > 1 ? $_SERVER['argv'][1] : 'https://raw.githubusercontent.com/apache/httpd/trunk/docs/conf/mime.types';
+
+// See if we can actually load it.
+$types = @file($source);
+if ($types === false) {
+	fprintf(STDERR, "Error: unable to read $source\n");
+	exit(1);
+}
+
+// Remove comments and flip into an extensions array.
+$extensions = [];
+array_walk($types, function ($line) use (&$extensions) {
+	$line = trim($line);
+	if ($line && $line[0] != '#') {
+		$fields = preg_split('/\s+/', $line);
+		if (count($fields) > 1) {
+			$mime = array_shift($fields);
+			foreach ($fields as $extension) {
+				$extensions[$extension] = $mime;
+			}
+		}
+	}
+});
+
+?>
+/*
+   +----------------------------------------------------------------------+
+   | PHP Version 7                                                        |
+   +----------------------------------------------------------------------+
+   | Copyright (c) 1997-2015 The PHP Group                                |
+   +----------------------------------------------------------------------+
+   | This source file is subject to version 3.01 of the PHP license,      |
+   | that is bundled with this package in the file LICENSE, and is        |
+   | available through the world-wide-web at the following url:           |
+   | http://www.php.net/license/3_01.txt                                  |
+   | If you did not receive a copy of the PHP license and are unable to   |
+   | obtain it through the world-wide-web, please send a note to          |
+   | license@php.net so we can mail you a copy immediately.               |
+   +----------------------------------------------------------------------+
+   | Author: Moriyoshi Koizumi <moriyoshi@php.net>                        |
+   +----------------------------------------------------------------------+
+*/
+
+/* This is a generated file. Rather than modifying it, please run
+ * "php generate_mime_type_map.php > mime_type_map.h" to regenerate the file. */
+
+#ifndef PHP_CLI_SERVER_MIME_TYPE_MAP_H
+#define PHP_CLI_SERVER_MIME_TYPE_MAP_H
+
+typedef struct php_cli_server_ext_mime_type_pair {
+	const char *ext;
+	const char *mime_type;
+} php_cli_server_ext_mime_type_pair;
+
+static php_cli_server_ext_mime_type_pair mime_type_map[] = {
+<?php foreach ($extensions as $extension => $mime): ?>
+	{ "<?= addcslashes($extension, "\0..\37!@\@\177..\377") ?>", "<?= addcslashes($mime, "\0..\37!@\@\177..\377") ?>" },
+<?php endforeach ?>
+	{ NULL, NULL }
+};
+
+#endif /* PHP_CLI_SERVER_MIME_TYPE_MAP_H */
+
+/*
+ * Local variables:
+ * tab-width: 4
+ * c-basic-offset: 4
+ * End:
+ * vim600: noet sw=4 ts=4 fdm=marker
+ * vim<600: noet sw=4 ts=4
+ */
@@ -0,0 +1,413 @@
+; Start a new pool named 'www'.
+; the variable $pool can we used in any directive and will be replaced by the
+; pool name ('www' here)
+[www]
+
+; Per pool prefix
+; It only applies on the following directives:
+; - 'access.log'
+; - 'slowlog'
+; - 'listen' (unixsocket)
+; - 'chroot'
+; - 'chdir'
+; - 'php_values'
+; - 'php_admin_values'
+; When not set, the global prefix (or @php_fpm_prefix@) applies instead.
+; Note: This directive can also be relative to the global prefix.
+; Default Value: none
+;prefix = /path/to/pools/$pool
+
+; Unix user/group of processes
+; Note: The user is mandatory. If the group is not set, the default user's group
+;       will be used.
+user = @php_fpm_user@
+group = @php_fpm_group@
+
+; The address on which to accept FastCGI requests.
+; Valid syntaxes are:
+;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific IPv4 address on
+;                            a specific port;
+;   '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
+;                            a specific port;
+;   'port'                 - to listen on a TCP socket to all addresses
+;                            (IPv6 and IPv4-mapped) on a specific port;
+;   '/path/to/unix/socket' - to listen on a unix socket.
+; Note: This value is mandatory.
+listen = 127.0.0.1:9000
+
+; Set listen(2) backlog.
+; Default Value: 511 (-1 on FreeBSD and OpenBSD)
+;listen.backlog = 511
+
+; Set permissions for unix socket, if one is used. In Linux, read/write
+; permissions must be set in order to allow connections from a web server. Many
+; BSD-derived systems allow connections regardless of permissions.
+; Default Values: user and group are set as the running user
+;                 mode is set to 0660
+;listen.owner = @php_fpm_user@
+;listen.group = @php_fpm_group@
+;listen.mode = 0660
+; When POSIX Access Control Lists are supported you can set them using
+; these options, value is a comma separated list of user/group names.
+; When set, listen.owner and listen.group are ignored
+;listen.acl_users =
+;listen.acl_groups =
+
+; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect.
+; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
+; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
+; must be separated by a comma. If this value is left blank, connections will be
+; accepted from any ip address.
+; Default Value: any
+;listen.allowed_clients = 127.0.0.1
+
+; Specify the nice(2) priority to apply to the pool processes (only if set)
+; The value can vary from -19 (highest priority) to 20 (lower priority)
+; Note: - It will only work if the FPM master process is launched as root
+;       - The pool processes will inherit the master process priority
+;         unless it specified otherwise
+; Default Value: no set
+; process.priority = -19
+
+; Choose how the process manager will control the number of child processes.
+; Possible Values:
+;   static  - a fixed number (pm.max_children) of child processes;
+;   dynamic - the number of child processes are set dynamically based on the
+;             following directives. With this process management, there will be
+;             always at least 1 children.
+;             pm.max_children      - the maximum number of children that can
+;                                    be alive at the same time.
+;             pm.start_servers     - the number of children created on startup.
+;             pm.min_spare_servers - the minimum number of children in 'idle'
+;                                    state (waiting to process). If the number
+;                                    of 'idle' processes is less than this
+;                                    number then some children will be created.
+;             pm.max_spare_servers - the maximum number of children in 'idle'
+;                                    state (waiting to process). If the number
+;                                    of 'idle' processes is greater than this
+;                                    number then some children will be killed.
+;  ondemand - no children are created at startup. Children will be forked when
+;             new requests will connect. The following parameter are used:
+;             pm.max_children           - the maximum number of children that
+;                                         can be alive at the same time.
+;             pm.process_idle_timeout   - The number of seconds after which
+;                                         an idle process will be killed.
+; Note: This value is mandatory.
+pm = dynamic
+
+; The number of child processes to be created when pm is set to 'static' and the
+; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
+; This value sets the limit on the number of simultaneous requests that will be
+; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
+; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
+; CGI. The below defaults are based on a server without much resources. Don't
+; forget to tweak pm.* to fit your needs.
+; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
+; Note: This value is mandatory.
+pm.max_children = 5
+
+; The number of child processes created on startup.
+; Note: Used only when pm is set to 'dynamic'
+; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
+pm.start_servers = 2
+
+; The desired minimum number of idle server processes.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+pm.min_spare_servers = 1
+
+; The desired maximum number of idle server processes.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+pm.max_spare_servers = 3
+
+; The number of seconds after which an idle process will be killed.
+; Note: Used only when pm is set to 'ondemand'
+; Default Value: 10s
+;pm.process_idle_timeout = 10s;
+
+; The number of requests each child process should execute before respawning.
+; This can be useful to work around memory leaks in 3rd party libraries. For
+; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS.
+; Default Value: 0
+;pm.max_requests = 500
+
+; The URI to view the FPM status page. If this value is not set, no URI will be
+; recognized as a status page. It shows the following informations:
+;   pool                 - the name of the pool;
+;   process manager      - static, dynamic or ondemand;
+;   start time           - the date and time FPM has started;
+;   start since          - number of seconds since FPM has started;
+;   accepted conn        - the number of request accepted by the pool;
+;   listen queue         - the number of request in the queue of pending
+;                          connections (see backlog in listen(2));
+;   max listen queue     - the maximum number of requests in the queue
+;                          of pending connections since FPM has started;
+;   listen queue len     - the size of the socket queue of pending connections;
+;   idle processes       - the number of idle processes;
+;   active processes     - the number of active processes;
+;   total processes      - the number of idle + active processes;
+;   max active processes - the maximum number of active processes since FPM
+;                          has started;
+;   max children reached - number of times, the process limit has been reached,
+;                          when pm tries to start more children (works only for
+;                          pm 'dynamic' and 'ondemand');
+; Value are updated in real time.
+; Example output:
+;   pool:                 www
+;   process manager:      static
+;   start time:           01/Jul/2011:17:53:49 +0200
+;   start since:          62636
+;   accepted conn:        190460
+;   listen queue:         0
+;   max listen queue:     1
+;   listen queue len:     42
+;   idle processes:       4
+;   active processes:     11
+;   total processes:      15
+;   max active processes: 12
+;   max children reached: 0
+;
+; By default the status page output is formatted as text/plain. Passing either
+; 'html', 'xml' or 'json' in the query string will return the corresponding
+; output syntax. Example:
+;   http://www.foo.bar/status
+;   http://www.foo.bar/status?json
+;   http://www.foo.bar/status?html
+;   http://www.foo.bar/status?xml
+;
+; By default the status page only outputs short status. Passing 'full' in the
+; query string will also return status for each pool process.
+; Example:
+;   http://www.foo.bar/status?full
+;   http://www.foo.bar/status?json&full
+;   http://www.foo.bar/status?html&full
+;   http://www.foo.bar/status?xml&full
+; The Full status returns for each process:
+;   pid                  - the PID of the process;
+;   state                - the state of the process (Idle, Running, ...);
+;   start time           - the date and time the process has started;
+;   start since          - the number of seconds since the process has started;
+;   requests             - the number of requests the process has served;
+;   request duration     - the duration in µs of the requests;
+;   request method       - the request method (GET, POST, ...);
+;   request URI          - the request URI with the query string;
+;   content length       - the content length of the request (only with POST);
+;   user                 - the user (PHP_AUTH_USER) (or '-' if not set);
+;   script               - the main script called (or '-' if not set);
+;   last request cpu     - the %cpu the last request consumed
+;                          it's always 0 if the process is not in Idle state
+;                          because CPU calculation is done when the request
+;                          processing has terminated;
+;   last request memory  - the max amount of memory the last request consumed
+;                          it's always 0 if the process is not in Idle state
+;                          because memory calculation is done when the request
+;                          processing has terminated;
+; If the process is in Idle state, then informations are related to the
+; last request the process has served. Otherwise informations are related to
+; the current request being served.
+; Example output:
+;   ************************
+;   pid:                  31330
+;   state:                Running
+;   start time:           01/Jul/2011:17:53:49 +0200
+;   start since:          63087
+;   requests:             12808
+;   request duration:     1250261
+;   request method:       GET
+;   request URI:          /test_mem.php?N=10000
+;   content length:       0
+;   user:                 -
+;   script:               /home/fat/web/docs/php/test_mem.php
+;   last request cpu:     0.00
+;   last request memory:  0
+;
+; Note: There is a real-time FPM status monitoring sample web page available
+;       It's available in: @EXPANDED_DATADIR@/fpm/status.html
+;
+; Note: The value must start with a leading slash (/). The value can be
+;       anything, but it may not be a good idea to use the .php extension or it
+;       may conflict with a real PHP file.
+; Default Value: not set
+;pm.status_path = /status
+
+; The ping URI to call the monitoring page of FPM. If this value is not set, no
+; URI will be recognized as a ping page. This could be used to test from outside
+; that FPM is alive and responding, or to
+; - create a graph of FPM availability (rrd or such);
+; - remove a server from a group if it is not responding (load balancing);
+; - trigger alerts for the operating team (24/7).
+; Note: The value must start with a leading slash (/). The value can be
+;       anything, but it may not be a good idea to use the .php extension or it
+;       may conflict with a real PHP file.
+; Default Value: not set
+;ping.path = /ping
+
+; This directive may be used to customize the response of a ping request. The
+; response is formatted as text/plain with a 200 response code.
+; Default Value: pong
+;ping.response = pong
+
+; The access log file
+; Default: not set
+;access.log = log/$pool.access.log
+
+; The access log format.
+; The following syntax is allowed
+;  %%: the '%' character
+;  %C: %CPU used by the request
+;      it can accept the following format:
+;      - %{user}C for user CPU only
+;      - %{system}C for system CPU only
+;      - %{total}C  for user + system CPU (default)
+;  %d: time taken to serve the request
+;      it can accept the following format:
+;      - %{seconds}d (default)
+;      - %{miliseconds}d
+;      - %{mili}d
+;      - %{microseconds}d
+;      - %{micro}d
+;  %e: an environment variable (same as $_ENV or $_SERVER)
+;      it must be associated with embraces to specify the name of the env
+;      variable. Some exemples:
+;      - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
+;      - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
+;  %f: script filename
+;  %l: content-length of the request (for POST request only)
+;  %m: request method
+;  %M: peak of memory allocated by PHP
+;      it can accept the following format:
+;      - %{bytes}M (default)
+;      - %{kilobytes}M
+;      - %{kilo}M
+;      - %{megabytes}M
+;      - %{mega}M
+;  %n: pool name
+;  %o: output header
+;      it must be associated with embraces to specify the name of the header:
+;      - %{Content-Type}o
+;      - %{X-Powered-By}o
+;      - %{Transfert-Encoding}o
+;      - ....
+;  %p: PID of the child that serviced the request
+;  %P: PID of the parent of the child that serviced the request
+;  %q: the query string
+;  %Q: the '?' character if query string exists
+;  %r: the request URI (without the query string, see %q and %Q)
+;  %R: remote IP address
+;  %s: status (response code)
+;  %t: server time the request was received
+;      it can accept a strftime(3) format:
+;      %d/%b/%Y:%H:%M:%S %z (default)
+;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
+;      e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t
+;  %T: time the log has been written (the request has finished)
+;      it can accept a strftime(3) format:
+;      %d/%b/%Y:%H:%M:%S %z (default)
+;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
+;      e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t
+;  %u: remote user
+;
+; Default: "%R - %u %t \"%m %r\" %s"
+;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
+
+; The log file for slow requests
+; Default Value: not set
+; Note: slowlog is mandatory if request_slowlog_timeout is set
+;slowlog = log/$pool.log.slow
+
+; The timeout for serving a single request after which a PHP backtrace will be
+; dumped to the 'slowlog' file. A value of '0s' means 'off'.
+; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
+; Default Value: 0
+;request_slowlog_timeout = 0
+
+; The timeout for serving a single request after which the worker process will
+; be killed. This option should be used when the 'max_execution_time' ini option
+; does not stop script execution for some reason. A value of '0' means 'off'.
+; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
+; Default Value: 0
+;request_terminate_timeout = 0
+
+; Set open file descriptor rlimit.
+; Default Value: system defined value
+;rlimit_files = 1024
+
+; Set max core size rlimit.
+; Possible Values: 'unlimited' or an integer greater or equal to 0
+; Default Value: system defined value
+;rlimit_core = 0
+
+; Chroot to this directory at the start. This value must be defined as an
+; absolute path. When this value is not set, chroot is not used.
+; Note: you can prefix with '$prefix' to chroot to the pool prefix or one
+; of its subdirectories. If the pool prefix is not set, the global prefix
+; will be used instead.
+; Note: chrooting is a great security feature and should be used whenever
+;       possible. However, all PHP paths will be relative to the chroot
+;       (error_log, sessions.save_path, ...).
+; Default Value: not set
+;chroot =
+
+; Chdir to this directory at the start.
+; Note: relative path can be used.
+; Default Value: current directory or / when chroot
+;chdir = /var/www
+
+; Redirect worker stdout and stderr into main error log. If not set, stdout and
+; stderr will be redirected to /dev/null according to FastCGI specs.
+; Note: on highloaded environement, this can cause some delay in the page
+; process time (several ms).
+; Default Value: no
+;catch_workers_output = yes
+
+; Clear environment in FPM workers
+; Prevents arbitrary environment variables from reaching FPM worker processes
+; by clearing the environment in workers before env vars specified in this
+; pool configuration are added.
+; Setting to "no" will make all environment variables available to PHP code
+; via getenv(), $_ENV and $_SERVER.
+; Default Value: yes
+;clear_env = no
+
+; Limits the extensions of the main script FPM will allow to parse. This can
+; prevent configuration mistakes on the web server side. You should only limit
+; FPM to .php extensions to prevent malicious users to use other extensions to
+; exectute php code.
+; Note: set an empty value to allow all extensions.
+; Default Value: .php
+;security.limit_extensions = .php .php3 .php4 .php5 .php7
+
+; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from
+; the current environment.
+; Default Value: clean env
+;env[HOSTNAME] = $HOSTNAME
+;env[PATH] = /usr/local/bin:/usr/bin:/bin
+;env[TMP] = /tmp
+;env[TMPDIR] = /tmp
+;env[TEMP] = /tmp
+
+; Additional php.ini defines, specific to this pool of workers. These settings
+; overwrite the values previously defined in the php.ini. The directives are the
+; same as the PHP SAPI:
+;   php_value/php_flag             - you can set classic ini defines which can
+;                                    be overwritten from PHP call 'ini_set'.
+;   php_admin_value/php_admin_flag - these directives won't be overwritten by
+;                                     PHP call 'ini_set'
+; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no.
+
+; Defining 'extension' will load the corresponding shared extension from
+; extension_dir. Defining 'disable_functions' or 'disable_classes' will not
+; overwrite previously defined php.ini values, but will append the new value
+; instead.
+
+; Note: path INI options can be relative and will be expanded with the prefix
+; (pool, global or @prefix@)
+
+; Default Value: nothing is defined by default except the values in php.ini and
+;                specified at startup with the -d argument
+;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
+;php_flag[display_errors] = off
+;php_admin_value[error_log] = /var/log/fpm-php.www.log
+;php_admin_flag[log_errors] = on
+;php_admin_value[memory_limit] = 32M
Author	SHA1	Message	Date
Ferenc Kovacs	e37064dae4	5.6.25	2016-08-18 13:07:46 +02:00
Stanislav Malyshev	4eb3ecbccf	BLock test with memory leak	2016-08-18 12:54:07 +02:00
Stanislav Malyshev	64e4b276bd	fix tests	2016-08-18 12:54:00 +02:00
Stanislav Malyshev	f01446dacf	Fix TSRM build	2016-08-18 12:53:53 +02:00
Stanislav Malyshev	c35e4cb20c	Fix bug #72850 - integer overflow in uuencode	2016-08-18 12:53:47 +02:00
Stanislav Malyshev	dc223e524d	Fixed bug #72849 - integer overflow in urlencode	2016-08-18 12:53:39 +02:00
Stanislav Malyshev	444314a291	Fix bug #72848 - integer overflow in quoted_printable_encode caused heap corruption	2016-08-18 12:53:28 +02:00
Stanislav Malyshev	6ba48cff6c	Fix bug #72838 - Integer overflow lead to heap corruption in sql_regcase	2016-08-18 12:53:18 +02:00
Stanislav Malyshev	69236ea979	Fix bug #72837 - integer overflow in bzdecompress caused heap corruption	2016-08-18 12:53:07 +02:00
Stanislav Malyshev	f973877a2f	Fix bug #72836 - integer overflow in base64_decode caused heap corruption	2016-08-18 12:52:59 +02:00
Stanislav Malyshev	791a98eb1c	Fix for bug #72807 - do not produce strings with negative length	2016-08-18 12:52:45 +02:00
Stanislav Malyshev	1f6078e4a5	Fix for bug #72790 and bug #72799	2016-08-18 12:52:39 +02:00
Stanislav Malyshev	229782c0ad	Fix bug #72730 - imagegammacorrect allows arbitrary write access	2016-08-18 12:52:29 +02:00
Stanislav Malyshev	4d76676101	Fix bug#72697 - select_colors write out-of-bounds	2016-08-18 12:52:21 +02:00
Stanislav Malyshev	32a629ef2c	Fixed bug #72627 : Memory Leakage In exif_process_IFD_in_TIFF	2016-08-18 12:52:15 +02:00
Stanislav Malyshev	82b95bb758	Fix bug #72750 : wddx_deserialize null dereference	2016-08-18 12:52:08 +02:00
Stanislav Malyshev	7d5ca3b28d	Fix bug #72771 : ftps:// opendir wrapper is vulnerable to protocol downgrade attack	2016-08-18 12:52:00 +02:00
Stanislav Malyshev	75c0dbdd02	Improve fix for #72663	2016-08-18 12:51:50 +02:00
Stanislav Malyshev	27fe2b42fc	Fix bug #70436 : Use After Free Vulnerability in unserialize()	2016-08-18 12:51:42 +02:00
Stanislav Malyshev	db38282f42	Fix bug #72749 : wddx_deserialize allows illegal memory access	2016-08-18 12:51:27 +02:00
Stanislav Malyshev	b25f44098f	Update comment	2016-08-18 12:51:21 +02:00
Stanislav Malyshev	b9ab6e14ff	Fix bug #72708 - php_snmp_parse_oid integer overflow in memory allocation	2016-08-18 12:51:13 +02:00
Stanislav Malyshev	61156f0d68	Fix bug #72681 - consume data even if we're not storing them	2016-08-18 12:51:06 +02:00
Stanislav Malyshev	c1cfd6a9fe	Fix bug #72663 - destroy broken object when unserializing	2016-08-18 12:50:58 +02:00
Ville Hukkamaki	869c547681	Fix #72764 Negotiate data channel encryption after NLST command. This is to prevent issues with IIS and ProFTPD.	2016-08-18 11:35:37 +02:00
Stanislav Malyshev	9c291f0fa0	Fix bug #72716 - initialize buffer before read	2016-08-18 11:35:24 +02:00
Ferenc Kovacs	58043201f8	#72633 is reverted for now	2016-08-17 00:58:55 +02:00
Ferenc Kovacs	9caabe953a	Revert "- lastInsertId using Postgres Lastval() function" This reverts commit `90c6cbd09b`.	2016-08-17 00:58:15 +02:00
Ferenc Kovacs	cf1f579fcd	Revert "cleanup table after test" This reverts commit `40b3a031b2`.	2016-08-17 00:57:55 +02:00
Ferenc Kovacs	327f538e91	5.6.25RC1	2016-08-04 01:47:14 +02:00