Merge branch 'master' of git.php.net:php-src

Zend/zend_builtin_functions.c

@@ -1014,7 +1014,7 @@ ZEND_FUNCTION(get_object_vars)
 	while (zend_hash_get_current_data_ex(properties, (void **) &value, &pos) == SUCCESS) {
 		if (zend_hash_get_current_key_ex(properties, &key, &key_len, &num_index, 0, &pos) == HASH_KEY_IS_STRING) {
 			if (zend_check_property_access(zobj, key, key_len-1 TSRMLS_CC) == SUCCESS) {
-				zend_unmangle_property_name_ex(key, key_len - 1, &class_name, &prop_name, &prop_len);
+				zend_unmangle_property_name_ex(key, key_len - 1, &class_name, &prop_name, (int*) &prop_len);
 				/* Not separating references */
 				Z_ADDREF_PP(value);
 				add_assoc_zval_ex(return_value, prop_name, prop_len + 1, *value);

ext/date/lib/parse_date.c

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Sun Mar 31 10:47:54 2013 */
+/* Generated by re2c 0.13.5 on Fri Apr 26 11:10:28 2013 */
 #line 1 "ext/date/lib/parse_date.re"
 /*
    +----------------------------------------------------------------------+
@@ -25089,7 +25089,7 @@ timelib_time *timelib_parse_from_format(char *format, char *string, int len, tim
 				break;
 
 			case '\\': /* escaped char */
-				*fptr++;
+				++fptr;
 				if (*ptr == *fptr) {
 					++ptr;
 				} else {

ext/date/lib/parse_date.re

@@ -2096,7 +2096,7 @@ timelib_time *timelib_parse_from_format(char *format, char *string, int len, tim
 				break;
 
 			case '\\': /* escaped char */
-				*fptr++;
+				++fptr;
 				if (*ptr == *fptr) {
 					++ptr;
 				} else {

ext/date/php_date.c

@@ -614,13 +614,11 @@ static void date_object_free_storage_interval(void *object TSRMLS_DC);
 static void date_object_free_storage_period(void *object TSRMLS_DC);
 
 static zend_object_value date_object_new_date(zend_class_entry *class_type TSRMLS_DC);
-static zend_object_value date_object_new_immutable(zend_class_entry *class_type TSRMLS_DC);
 static zend_object_value date_object_new_timezone(zend_class_entry *class_type TSRMLS_DC);
 static zend_object_value date_object_new_interval(zend_class_entry *class_type TSRMLS_DC);
 static zend_object_value date_object_new_period(zend_class_entry *class_type TSRMLS_DC);
 
 static zend_object_value date_object_clone_date(zval *this_ptr TSRMLS_DC);
-static zend_object_value date_object_clone_immutable(zval *this_ptr TSRMLS_DC);
 static zend_object_value date_object_clone_timezone(zval *this_ptr TSRMLS_DC);
 static zend_object_value date_object_clone_interval(zval *this_ptr TSRMLS_DC);
 static zend_object_value date_object_clone_period(zval *this_ptr TSRMLS_DC);

ext/fileinfo/libmagic.patch

@@ -1,6 +1,6 @@
 diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 --- libmagic.orig/apprentice.c	2013-03-21 18:45:14.000000000 +0100
-+++ libmagic/apprentice.c	2013-04-08 16:14:17.828357711 +0200
++++ libmagic/apprentice.c	2013-04-27 13:53:32.175250261 +0200
 @@ -29,6 +29,8 @@
   * apprentice - make one pass through /etc/magic, learning its secrets.
   */
@@ -352,7 +352,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  		file_oomem(ms, slen);
  		return -1;
  	}
-@@ -1102,14 +1121,14 @@
+@@ -1102,27 +1121,29 @@
  	if (me == NULL)
  		return;
  	for (i = 0; i < nme; i++)
@@ -370,8 +370,9 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	struct magic_entry *mentry[MAGIC_SETS] = { NULL };
  	uint32_t mentrycount[MAGIC_SETS] = { 0 };
  	uint32_t i, j;
-@@ -1117,12 +1136,14 @@
- 	char **filearr = NULL, *mfn;
+ 	size_t files = 0, maxfiles = 0;
+-	char **filearr = NULL, *mfn;
++	char **filearr = NULL;
  	struct stat st;
  	struct magic_map *map;
 -	DIR *dir;
@@ -411,7 +412,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 +		int mflen;
 +		char mfn[MAXPATHLEN];
 +
-+		dir = php_stream_opendir(fn, REPORT_ERRORS, NULL);
++		dir = php_stream_opendir((char *)fn, REPORT_ERRORS, NULL);
  		if (!dir) {
  			errs++;
  			goto out;
@@ -578,7 +579,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 +#ifdef PHP_WIN32
 +	/* Don't bother on windows with php_stream_open_wrapper,
 +	return to give apprentice_load() a chance. */
-+	if (php_stream_stat_path_ex(fn, 0, &st, NULL) == SUCCESS) {
++	if (php_stream_stat_path_ex((char *)fn, 0, &st, NULL) == SUCCESS) {
 +               if (st.sb.st_mode & S_IFDIR) {
 +                       goto error;
 +               }
@@ -751,7 +752,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	}
  
 -	if (write(fd, map->nmagic, nm) != (ssize_t)nm) {
-+	if (php_stream_write(stream, map->nmagic, nm) != (ssize_t)nm) {
++	if (php_stream_write(stream, (const char *)map->nmagic, nm) != (ssize_t)nm) {
  		file_error(ms, errno, "error writing `%s'", dbname);
  		goto out;
  	}
@@ -767,7 +768,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	for (i = 0; i < MAGIC_SETS; i++) {
  		len = m * map->nmagic[i];
 -		if (write(fd, map->magic[i], len) != (ssize_t)len) {
-+		if (php_stream_write(stream, map->magic[i], len) != (ssize_t)len) {
++		if (php_stream_write(stream, (const char *)map->magic[i], len) != (ssize_t)len) {
  			file_error(ms, errno, "error writing `%s'", dbname);
  			goto out;
  		}
@@ -2047,7 +2048,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
 +
 diff -u libmagic.orig/magic.c libmagic/magic.c
 --- libmagic.orig/magic.c	2013-01-11 17:43:09.000000000 +0100
-+++ libmagic/magic.c	2013-04-08 15:42:57.328298809 +0200
++++ libmagic/magic.c	2013-04-27 13:53:32.175250261 +0200
 @@ -25,11 +25,6 @@
   * SUCH DAMAGE.
   */
@@ -2089,7 +2090,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  #if defined(HAVE_UTIMES)
  # include <sys/time.h>
  #elif defined(HAVE_UTIME)
-@@ -71,18 +75,24 @@
+@@ -71,18 +75,25 @@
  #endif
  #endif
  
@@ -2098,14 +2099,14 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
 +# undef S_IFIFO
 +#endif
 +
-+private void free_mlist(struct mlist *);
  private void close_and_restore(const struct magic_set *, const char *, int,
      const struct stat *);
  private int unreadable_info(struct magic_set *, mode_t, const char *);
++#if 0
  private const char* get_default_magic(void);
 -#ifndef COMPILE_ONLY
 -private const char *file_or_fd(struct magic_set *, const char *, int);
--#endif
+ #endif
 +private const char *file_or_stream(struct magic_set *, const char *, php_stream *);
  
  #ifndef	STDIN_FILENO
@@ -2117,7 +2118,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  private const char *
  get_default_magic(void)
  {
-@@ -90,7 +100,7 @@
+@@ -90,7 +101,7 @@
  	static char *default_magic;
  	char *home, *hmagicpath;
  
@@ -2126,7 +2127,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  	struct stat st;
  
  	if (default_magic) {
-@@ -104,17 +114,17 @@
+@@ -104,17 +115,17 @@
  		return MAGIC;
  	if (stat(hmagicpath, &st) == -1) {
  		free(hmagicpath);
@@ -2153,7 +2154,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  	}
  
  	if (asprintf(&default_magic, "%s:%s", hmagicpath, MAGIC) < 0)
-@@ -128,6 +138,7 @@
+@@ -128,6 +139,7 @@
  #else
  	char *hmagicp = hmagicpath;
  	char *tmppath = NULL;
@@ -2161,7 +2162,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  
  #define APPENDPATH() \
  	do { \
-@@ -172,7 +183,7 @@
+@@ -172,7 +184,7 @@
  	}
  
  	/* Third, try to get magic file relative to dll location */
@@ -2170,7 +2171,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  	dllpath[MAX_PATH] = 0;	/* just in case long path gets truncated and not null terminated */
  	if (GetModuleFileNameA(NULL, dllpath, MAX_PATH)){
  		PathRemoveFileSpecA(dllpath);
-@@ -210,6 +221,7 @@
+@@ -210,6 +222,7 @@
  
  	return action == FILE_LOAD ? get_default_magic() : MAGIC;
  }
@@ -2178,7 +2179,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  
  public struct magic_set *
  magic_open(int flags)
-@@ -250,7 +262,7 @@
+@@ -250,7 +263,7 @@
  magic_load(struct magic_set *ms, const char *magicfile)
  {
  	if (ms == NULL)
@@ -2187,7 +2188,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  	return file_apprentice(ms, magicfile, FILE_LOAD);
  }
  
-@@ -262,13 +274,6 @@
+@@ -262,13 +275,6 @@
  	return file_apprentice(ms, magicfile, FILE_COMPILE);
  }
  
@@ -2201,7 +2202,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  
  public int
  magic_list(struct magic_set *ms, const char *magicfile)
-@@ -282,9 +287,6 @@
+@@ -282,9 +288,6 @@
  close_and_restore(const struct magic_set *ms, const char *name, int fd,
      const struct stat *sb)
  {
@@ -2211,7 +2212,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  
  	if ((ms->flags & MAGIC_PRESERVE_ATIME) != 0) {
  		/*
-@@ -311,7 +313,6 @@
+@@ -311,7 +314,6 @@
  	}
  }
  
@@ -2219,7 +2220,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  
  /*
   * find type of descriptor
-@@ -321,7 +322,7 @@
+@@ -321,7 +323,7 @@
  {
  	if (ms == NULL)
  		return NULL;
@@ -2228,7 +2229,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  }
  
  /*
-@@ -332,30 +333,42 @@
+@@ -332,30 +334,42 @@
  {
  	if (ms == NULL)
  		return NULL;
@@ -2277,7 +2278,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  	case -1:		/* error */
  		goto done;
  	case 0:			/* nothing found */
-@@ -365,68 +378,48 @@
+@@ -365,68 +379,48 @@
  		goto done;
  	}
  
@@ -2372,7 +2373,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  	return rv == 0 ? file_getbuffer(ms) : NULL;
  }
  
-@@ -440,14 +433,13 @@
+@@ -440,14 +434,13 @@
  		return NULL;
  	/*
  	 * The main work is done here!
@@ -2410,8 +2411,8 @@ diff -u libmagic.orig/magic.h libmagic/magic.h
  
 diff -u libmagic.orig/print.c libmagic/print.c
 --- libmagic.orig/print.c	2013-03-21 18:45:14.000000000 +0100
-+++ libmagic/print.c	2013-04-08 15:42:57.328298809 +0200
-@@ -28,6 +28,8 @@
++++ libmagic/print.c	2013-04-27 13:53:32.175250261 +0200
+@@ -28,13 +28,17 @@
  /*
   * print.c - debugging printout routines
   */
@@ -2419,8 +2420,9 @@ diff -u libmagic.orig/print.c libmagic/print.c
 +#include "php.h"
  
  #include "file.h"
++#include "cdf.h"
  
-@@ -35,6 +37,7 @@
+ #ifndef lint
  FILE_RCSID("@(#)$File: print.c,v 1.76 2013/02/26 18:25:00 christos Exp $")
  #endif  /* lint */
  
@@ -2428,7 +2430,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
  #include <string.h>
  #include <stdarg.h>
  #include <stdlib.h>
-@@ -43,188 +46,28 @@
+@@ -43,188 +47,28 @@
  #endif
  #include <time.h>
  
@@ -2619,7 +2621,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
 -	(void) fprintf(stderr, "Warning: ");
  	va_start(va, f);
 -	(void) vfprintf(stderr, f, va);
-+	vasprintf(&expanded_format, f, va);
++	if (vasprintf(&expanded_format, f, va)); /* silence */
  	va_end(va);
 -	(void) fputc('\n', stderr);
 +	
@@ -2629,7 +2631,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
  }
  
  protected const char *
-@@ -235,7 +78,7 @@
+@@ -235,7 +79,7 @@
  	struct tm *tm;
  
  	if (flags & FILE_T_WINDOWS) {

ext/fileinfo/libmagic/apprentice.c

@@ -1133,7 +1133,7 @@ apprentice_load(struct magic_set *ms, const char *fn, int action)
 	uint32_t mentrycount[MAGIC_SETS] = { 0 };
 	uint32_t i, j;
 	size_t files = 0, maxfiles = 0;
-	char **filearr = NULL, *mfn;
+	char **filearr = NULL;
 	struct stat st;
 	struct magic_map *map;
 	php_stream *dir;
@@ -1169,7 +1169,7 @@ apprentice_load(struct magic_set *ms, const char *fn, int action)
 		int mflen;
 		char mfn[MAXPATHLEN];
 
-		dir = php_stream_opendir(fn, REPORT_ERRORS, NULL);
+		dir = php_stream_opendir((char *)fn, REPORT_ERRORS, NULL);
 		if (!dir) {
 			errs++;
 			goto out;
@@ -2613,7 +2613,7 @@ apprentice_map(struct magic_set *ms, const char *fn)
 #ifdef PHP_WIN32
 	/* Don't bother on windows with php_stream_open_wrapper,
 	return to give apprentice_load() a chance. */
-	if (php_stream_stat_path_ex(fn, 0, &st, NULL) == SUCCESS) {
+	if (php_stream_stat_path_ex((char *)fn, 0, &st, NULL) == SUCCESS) {
                if (st.sb.st_mode & S_IFDIR) {
                        goto error;
                }
@@ -2778,7 +2778,7 @@ apprentice_compile(struct magic_set *ms, struct magic_map *map, const char *fn)
 		goto out;
 	}
 
-	if (php_stream_write(stream, map->nmagic, nm) != (ssize_t)nm) {
+	if (php_stream_write(stream, (const char *)map->nmagic, nm) != (ssize_t)nm) {
 		file_error(ms, errno, "error writing `%s'", dbname);
 		goto out;
 	}
@@ -2792,7 +2792,7 @@ apprentice_compile(struct magic_set *ms, struct magic_map *map, const char *fn)
 
 	for (i = 0; i < MAGIC_SETS; i++) {
 		len = m * map->nmagic[i];
-		if (php_stream_write(stream, map->magic[i], len) != (ssize_t)len) {
+		if (php_stream_write(stream, (const char *)map->magic[i], len) != (ssize_t)len) {
 			file_error(ms, errno, "error writing `%s'", dbname);
 			goto out;
 		}

ext/fileinfo/libmagic/magic.c

@@ -80,11 +80,12 @@ FILE_RCSID("@(#)$File: magic.c,v 1.78 2013/01/07 18:20:19 christos Exp $")
 # undef S_IFIFO
 #endif
 
-private void free_mlist(struct mlist *);
 private void close_and_restore(const struct magic_set *, const char *, int,
     const struct stat *);
 private int unreadable_info(struct magic_set *, mode_t, const char *);
+#if 0
 private const char* get_default_magic(void);
+#endif
 private const char *file_or_stream(struct magic_set *, const char *, php_stream *);
 
 #ifndef	STDIN_FILENO

ext/fileinfo/libmagic/print.c

@@ -32,6 +32,7 @@
 #include "php.h"
 
 #include "file.h"
+#include "cdf.h"
 
 #ifndef lint
 FILE_RCSID("@(#)$File: print.c,v 1.76 2013/02/26 18:25:00 christos Exp $")
@@ -62,7 +63,7 @@ file_magwarn(struct magic_set *ms, const char *f, ...)
 	TSRMLS_FETCH();
 
 	va_start(va, f);
-	vasprintf(&expanded_format, f, va);
+	if (vasprintf(&expanded_format, f, va)); /* silence */
 	va_end(va);
 	
 	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Warning: %s", expanded_format);

ext/mysqli/mysqli.c

@@ -1271,7 +1271,7 @@ void php_mysqli_fetch_into_hash(INTERNAL_FUNCTION_PARAMETERS, int override_flags
 
 	php_mysqli_fetch_into_hash_aux(return_value, result, fetchtype TSRMLS_CC);
 
-	if (into_object && Z_TYPE_P(return_value) != IS_NULL) {
+	if (into_object && Z_TYPE_P(return_value) == IS_ARRAY) {
 		zval dataset = *return_value;
 		zend_fcall_info fci;
 		zend_fcall_info_cache fcc;

ext/mysqli/tests/bug64726.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #63398 (Segfault when calling fetch_object on a use_result and DB pointer has closed)
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once("connect.inc");
+if (!$IS_MYSQLND) {
+    die("skip mysqlnd only test");
+}
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+require 'connect.inc';
+$db = new my_mysqli($host, $user, $passwd, $db, $port, $socket);
+
+$result = $db->query('SELECT 1', MYSQLI_USE_RESULT);
+$db->close();
+var_dump($result->fetch_object());
+?>
+--EXPECTF--
+Warning: mysqli_result::fetch_object(): Error while reading a row in %sbug64726.php on line %d
+bool(false)

ext/mysqlnd/mysqlnd_result.c

@@ -1479,6 +1479,7 @@ MYSQLND_METHOD(mysqlnd_res, fetch_into)(MYSQLND_RES * result, unsigned int flags
 	mysqlnd_array_init(return_value, mysqlnd_num_fields(result) * 2);
 	if (FAIL == result->m.fetch_row(result, (void *)return_value, flags, &fetched_anything TSRMLS_CC)) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Error while reading a row");
+		zval_dtor(return_value);
 		RETVAL_FALSE;
 	} else if (fetched_anything == FALSE) {
 		zval_dtor(return_value);

sapi/cgi/cgi_main.c

@@ -1818,7 +1818,7 @@ int main(int argc, char *argv[])
 
 	if((query_string = getenv("QUERY_STRING")) != NULL && strchr(query_string, '=') == NULL) {
 		/* we've got query string that has no = - apache CGI will pass it to command line */
-		unsigned char *p;
+		char *p;
 		decoded_query_string = strdup(query_string);
 		php_url_decode(decoded_query_string, strlen(decoded_query_string));
 		for (p = decoded_query_string; *p &&  *p <= ' '; p++) {