Update versions for PHP 7.2.30

Close the stream filter resources when removing them from the stream.

NEWS

@@ -1,7 +1,12 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2020, PHP 7.2.30
+16 Apr 2020, PHP 7.2.30
 
+- Standard:
+  . Fixed bug #79468 (SIGSEGV when closing stream handle with a stream filter
+    appended). (dinosaur)
+  . Fixed bug #79330 (shell_exec() silently truncates after a null byte). (stas)
+  . Fixed bug #79465 (OOB Read in urldecode()). (stas)
 
 19 Mar 2020, PHP 7.2.29
 

configure.ac

@@ -108,7 +108,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
 PHP_RELEASE_VERSION=30
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/standard/credits_ext.h

@@ -1,11 +1,11 @@
-/* 
+/*
                       DO NOT EDIT THIS FILE!
 
- it has been automaticaly created by php7/scripts/credits from  
+ it has been automaticaly created by php7/scripts/credits from
  the information found in the various php7/ext/.../CREDITS and
- php7/sapi/.../CREDITS files 
- 
- if you want to change an entry you have to edit the appropriate 
+ php7/sapi/.../CREDITS files
+
+ if you want to change an entry you have to edit the appropriate
  CREDITS file instead
 
 */
@@ -28,7 +28,7 @@ CREDIT_LINE("FTP", "Stefan Esser, Andrew Skalski");
 CREDIT_LINE("GD imaging", "Rasmus Lerdorf, Stig Bakken, Jim Winstead, Jouni Ahto, Ilia Alshanetsky, Pierre-Alain Joye, Marcus Boerger");
 CREDIT_LINE("GetText", "Alex Plotnick");
 CREDIT_LINE("GNU GMP support", "Stanislav Malyshev");
-CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi ");
+CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi");
 CREDIT_LINE("IMAP", "Rex Logan, Mark Musone, Brian Wang, Kaj-Michael Lang, Antoni Pamies Olive, Rasmus Lerdorf, Andrew Skalski, Chuck Hagenbuch, Daniel R Kalowsky");
 CREDIT_LINE("Input Filter", "Rasmus Lerdorf, Derick Rethans, Pierre-Alain Joye, Ilia Alshanetsky");
 CREDIT_LINE("InterBase", "Jouni Ahto, Andrew Avdeev, Ard Biesheuvel");

ext/standard/credits_sapi.h

@@ -1,11 +1,11 @@
-/* 
+/*
                       DO NOT EDIT THIS FILE!
 
- it has been automaticaly created by php7/scripts/credits from  
+ it has been automaticaly created by php7/scripts/credits from
  the information found in the various php7/ext/.../CREDITS and
- php7/sapi/.../CREDITS files 
- 
- if you want to change an entry you have to edit the appropriate 
+ php7/sapi/.../CREDITS files
+
+ if you want to change an entry you have to edit the appropriate
  CREDITS file instead
 
 */

ext/standard/exec.c

@@ -531,6 +531,15 @@ PHP_FUNCTION(shell_exec)
 		Z_PARAM_STRING(command, command_len)
 	ZEND_PARSE_PARAMETERS_END();
 
+	if (!command_len) {
+		php_error_docref(NULL, E_WARNING, "Cannot execute a blank command");
+		RETURN_FALSE;
+	}
+	if (strlen(command) != command_len) {
+		php_error_docref(NULL, E_WARNING, "NULL byte detected. Possible attack");
+		RETURN_FALSE;
+	}
+
 #ifdef PHP_WIN32
 	if ((in=VCWD_POPEN(command, "rt"))==NULL) {
 #else

ext/standard/tests/filters/bug79468.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #79468	SIGSEGV when closing stream handle with a stream filter appended
+--SKIPIF--
+<?php
+$filters = stream_get_filters();
+if(! in_array( "string.rot13", $filters )) die( "skip rot13 filter not available." );
+?>
+--FILE--
+<?php
+$fp = fopen('php://temp', 'rb');
+$rot13_filter = stream_filter_append($fp, "string.rot13", STREAM_FILTER_WRITE);
+fwrite($fp, "This is ");
+fclose($fp);
+try {
+    stream_filter_remove($rot13_filter);
+} catch (\Throwable $e) {
+    var_dump($e->getMessage());
+}
+?>
+--EXPECTF--
+Warning: stream_filter_remove(): Invalid resource given, not a stream filter in %s on line %d

ext/standard/url.c

@@ -559,7 +559,7 @@ PHPAPI size_t php_url_decode(char *str, size_t len)
 #ifndef CHARSET_EBCDIC
 			*dest = (char) php_htoi(data + 1);
 #else
-			*dest = os_toebcdic[(char) php_htoi(data + 1)];
+			*dest = os_toebcdic[(unsigned char) php_htoi(data + 1)];
 #endif
 			data += 2;
 			len -= 2;
@@ -651,7 +651,7 @@ PHPAPI size_t php_raw_url_decode(char *str, size_t len)
 #ifndef CHARSET_EBCDIC
 			*dest = (char) php_htoi(data + 1);
 #else
-			*dest = os_toebcdic[(char) php_htoi(data + 1)];
+			*dest = os_toebcdic[(unsigned char) php_htoi(data + 1)];
 #endif
 			data += 2;
 			len -= 2;

main/php_version.h

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 2
 #define PHP_RELEASE_VERSION 30
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.2.30-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.2.30"
 #define PHP_VERSION_ID 70230

main/streams/streams.c

@@ -477,9 +477,15 @@ fprintf(stderr, "stream_free: %s:%p[%s] preserve_handle=%d release_cast=%d remov
 
 	if (close_options & PHP_STREAM_FREE_RELEASE_STREAM) {
 		while (stream->readfilters.head) {
+			if (stream->readfilters.head->res != NULL) {
+				zend_list_close(stream->readfilters.head->res);
+			}
 			php_stream_filter_remove(stream->readfilters.head, 1);
 		}
 		while (stream->writefilters.head) {
+			if (stream->writefilters.head->res != NULL) {
+				zend_list_close(stream->writefilters.head->res);
+			}
 			php_stream_filter_remove(stream->writefilters.head, 1);
 		}