Merge branch 'PHP-5.4' of git.php.net:/php-src into PHP-5.4

NEWS

@@ -6,6 +6,10 @@ PHP                                                                        NEWS
   . Fixed bug #63305 (zend_mm_heap corrupted with traits). (Dmitry, Laruence)
   . Fixed bug #63369 ((un)serialize() leaves dangling pointers, causes crashes).
     (Tony, Andrew Sitnikov)
+  . Fixed bug #63241 (PHP fails to open Windows deduplicated files).
+    (daniel dot stelter-gliese at innogames dot de)
+  . Fixed bug #62444 (Handle leak in is_readable on windows). 
+    (krazyest at seznam dot cz)
 
 - Curl:
   . Fixed bug #63363 (Curl silently accepts boolean true for SSL_VERIFYHOST).
@@ -15,6 +19,14 @@ PHP                                                                        NEWS
   . Fixed bug #63248 (Load multiple magic files from a directory under Windows).
     (Anatoliy)
 
+- Libxml
+  . Fixed bug #63389 (Missing context check on libxml_set_streams_context()
+    causes memleak). (Laruence)
+
+- Mbstring:
+  . Fixed bug #63447 (max_input_vars doesn't filter variables when
+    mbstring.encoding_translation = On). (Laruence)
+
 - OCI8:
   . Fixed bug #63265 (Add ORA-00028 to the PHP_OCI_HANDLE_ERROR macro)
     (Chris Jones)
@@ -29,6 +41,10 @@ PHP                                                                        NEWS
   . Fixed bug #63297 (Phar fails to write an openssl based signature).
     (Anatoliy)
 
+- Reflection:
+  . Fixed bug #63399 (ReflectionClass::getTraitAliases() incorrectly resolves
+    traitnames). (Laruence)
+
 18 Oct 2012, PHP 5.4.8
 
 - CLI server:
@@ -1329,6 +1345,7 @@ PHP                                                                        NEWS
 - Gd:
   . Fixed bug #60160 (imagefill() doesn't work correctly
     for small images). (Florian)
+  . Fixed potential memory leak on a png error (Rasmus, Paul Saab)
 
 - Intl:
   . Fixed bug #60192 (SegFault when Collator not constructed

TSRM/tsrm_virtual_cwd.c

@@ -40,6 +40,10 @@
 #  define IO_REPARSE_TAG_SYMLINK 0xA000000C
 # endif
 
+# ifndef IO_REPARSE_TAG_DEDUP
+#  define IO_REPARSE_TAG_DEDUP   0x80000013
+# endif
+
 # ifndef VOLUME_NAME_NT
 #  define VOLUME_NAME_NT 0x2
 # endif
@@ -945,6 +949,11 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					return -1;
 				};
 				substitutename[substitutename_len] = 0;
+			}
+			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP) {
+				isabsolute = 1;
+				memcpy(substitutename, path, len + 1);
+				substitutename_len = len;
 			} else {
 				tsrm_free_alloca(pbuffer, use_heap_large);
 				return -1;

TSRM/tsrm_win32.c

@@ -193,7 +193,7 @@ Finished:
 TSRM_API int tsrm_win32_access(const char *pathname, int mode TSRMLS_DC)
 {
 	time_t t;
-	HANDLE thread_token;
+	HANDLE thread_token = NULL;
 	PSID token_sid;
 	SECURITY_INFORMATION sec_info = OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION;
 	GENERIC_MAPPING gen_map = { FILE_GENERIC_READ, FILE_GENERIC_WRITE, FILE_GENERIC_EXECUTE, FILE_ALL_ACCESS };
@@ -363,6 +363,9 @@ Finished_Impersonate:
 		}
 
 Finished:
+		if(thread_token != NULL) {
+			CloseHandle(thread_token);
+		}
 		if(real_path != NULL) {
 			free(real_path);
 			real_path = NULL;

config.guess

@@ -532,7 +532,7 @@ EOF
 		echo rs6000-ibm-aix3.2
 	fi
 	exit ;;
-    *:AIX:*:[456])
+    *:AIX:*:[4567])
 	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
 	if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
 		IBM_ARCH=rs6000

ext/filter/filter_private.h

@@ -109,8 +109,10 @@
 	if (len < 1 && return_if_empty) { \
 		RETURN_VALIDATION_FAILED \
 	} \
-	while (p[len-1] == ' ' || p[len-1] == '\t' || p[len-1] == '\r' || p[len-1] == '\v' || p[len-1] == '\n') { \
-		len--; \
+	if (len > 0) { \
+		while (p[len-1] == ' ' || p[len-1] == '\t' || p[len-1] == '\r' || p[len-1] == '\v' || p[len-1] == '\n') { \
+			len--; \
+		} \
 	} \
 }
 

ext/gd/libgd/gd_png.c

@@ -127,8 +127,8 @@ gdImagePtr gdImageCreateFromPngCtx (gdIOCtx * infile)
 	png_color_16p trans_gray_rgb;
 	png_color_16p trans_color_rgb;
 	png_bytep trans;
-	png_bytep image_data = NULL;
-	png_bytepp row_pointers = NULL;
+	volatile png_bytep image_data = NULL;
+	volatile png_bytepp row_pointers = NULL;
 	gdImagePtr im = NULL;
 	int i, j, *open = NULL;
 	volatile int transparent = -1;

ext/libxml/libxml.c

@@ -918,7 +918,7 @@ static PHP_FUNCTION(libxml_set_streams_context)
 {
 	zval *arg;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "z", &arg) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r", &arg) == FAILURE) {
 		return;
 	}
 	if (LIBXML(stream_context)) {

ext/libxml/tests/004.phpt

@@ -27,26 +27,26 @@ echo "Done\n";
 
 ?>
 --EXPECTF--
-Warning: stream_context_create(): options should have the form ["wrappername"]["optionname"] = $value in %s004.php on line 10
-NULL
+Warning: stream_context_create(): options should have the form ["wrappername"]["optionname"] = $value in %s004.php on line %d
 
-Warning: DOMDocument::load(): supplied argument is not a valid Stream-Context resource in %s004.php on line 18
+Warning: libxml_set_streams_context() expects parameter 1 to be resource, null given in %s004.php on line %d
+NULL
 bool(true)
-NULL
 
-Warning: DOMDocument::load(): supplied argument is not a valid Stream-Context resource in %s004.php on line 18
+Warning: libxml_set_streams_context() expects parameter 1 to be resource, string given in %s004.php on line %d
+NULL
 bool(true)
-NULL
 
-Warning: DOMDocument::load(): supplied argument is not a valid Stream-Context resource in %s004.php on line 18
+Warning: libxml_set_streams_context() expects parameter 1 to be resource, integer given in %s004.php on line %d
+NULL
 bool(true)
-NULL
 
-Warning: DOMDocument::load(): supplied argument is not a valid Stream-Context resource in %s004.php on line 18
+Warning: libxml_set_streams_context() expects parameter 1 to be resource, object given in %s004.php on line %d
+NULL
 bool(true)
-NULL
 
-Warning: DOMDocument::load(): supplied argument is not a valid Stream-Context resource in %s004.php on line 18
+Warning: libxml_set_streams_context() expects parameter 1 to be resource, array given in %s004.php on line %d
+NULL
 bool(true)
 NULL
 bool(true)

ext/libxml/tests/bug63389.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #63389 (Missing context check on libxml_set_streams_context() causes memleak)
+--SKIPIF--
+<?php if (!extension_loaded('libxml')) die('skip'); ?>
+--FILE--
+<?php
+$fp = fopen("php://input", "r");
+libxml_set_streams_context($fp);
+libxml_set_streams_context("a");
+echo "okey";
+?>
+--EXPECTF--
+Warning: libxml_set_streams_context() expects parameter 1 to be resource, string given in %sbug63389.php on line %d
+okey

ext/mbstring/mb_gpc.c

@@ -254,6 +254,12 @@ const mbfl_encoding *_php_mb_encoding_handler_ex(const php_mb_encoding_handler_i
 		n++;
 		var = php_strtok_r(NULL, info->separator, &strtok_buf);
 	} 
+
+	if (n > (PG(max_input_vars) * 2)) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars));
+		goto out;
+	}
+
 	num = n; /* make sure to process initilized vars only */
 	
 	/* initialize converter */

ext/mbstring/tests/bug63447_001.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #63447 (max_input_vars doesn't filter variables when mbstring.encoding_translation = On)
+--SKIPIF--
+<?php
+extension_loaded('mbstring') or die('skip');
+?>
+--INI--
+max_input_nesting_level=10
+max_input_vars=5
+mbstring.encoding_translation=1
+--POST--
+a=1&b=2&c=3&d=4&e=5&f=6
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECT--
+Warning: Unknown: Input variables exceeded 5. To increase the limit change max_input_vars in php.ini. in Unknown on line 0
+array(0) {
+}

ext/mbstring/tests/bug63447_002.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #63447 (max_input_vars doesn't filter variables when mbstring.encoding_translation = On)
+--SKIPIF--
+<?php
+extension_loaded('mbstring') or die('skip');
+?>
+--INI--
+max_input_nesting_level=10
+max_input_vars=4
+mbstring.encoding_translation=1
+--POST--
+a=1&b=2&c=3&d=4&e=5
+--FILE--
+<?php
+var_dump($_POST);
+?>
+--EXPECT--
+Warning: Unknown: Input variables exceeded 4. To increase the limit change max_input_vars in php.ini. in Unknown on line 0
+array(0) {
+}

ext/mbstring/tests/bug63447_003.phpt

@@ -0,0 +1,34 @@
+--TEST--
+Bug #63447 (max_input_vars doesn't filter variables when mbstring.encoding_translation = On)
+--SKIPIF--
+<?php
+extension_loaded('mbstring') or die('skip');
+?>
+--INI--
+max_input_nesting_level=5
+max_input_vars=100
+mbstring.encoding_translation=1
+--POST--
+a=1&b[][][]=2&c[][][][][][]=7
+--FILE--
+<?php
+print_r($_POST);
+?>
+--EXPECT--
+Array
+(
+    [a] => 1
+    [b] => Array
+        (
+            [0] => Array
+                (
+                    [0] => Array
+                        (
+                            [0] => 2
+                        )
+
+                )
+
+        )
+
+)

ext/mysqlnd/mysqlnd_wireprotocol.c

@@ -1201,7 +1201,7 @@ php_mysqlnd_rset_field_read(void * _packet, MYSQLND_CONN_DATA * conn TSRMLS_DC)
 	p += 2;
 	BAIL_IF_NO_MORE_DATA;
 
-	meta->decimals = uint2korr(p);
+	meta->decimals = uint1korr(p);
 	p += 1;
 	BAIL_IF_NO_MORE_DATA;
 

ext/pcre/php_pcre.c

@@ -1866,7 +1866,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_preg_match, 0, 0, 2)
     ZEND_ARG_INFO(0, offset)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_INFO_EX(arginfo_preg_match_all, 0, 0, 3)
+ZEND_BEGIN_ARG_INFO_EX(arginfo_preg_match_all, 0, 0, 2)
     ZEND_ARG_INFO(0, pattern)
     ZEND_ARG_INFO(0, subject)
     ZEND_ARG_INFO(1, subpatterns) /* array */

ext/pdo_pgsql/pgsql_statement.c

@@ -362,8 +362,20 @@ static int pgsql_stmt_param_hook(pdo_stmt_t *stmt, struct pdo_bound_param_data *
 				}
 				break;
 		}
+	} else {
+#endif
+	if (param->is_param) {
+        /* We need to manually convert to a pg native boolean value */
+        if (PDO_PARAM_TYPE(param->param_type) == PDO_PARAM_BOOL &&
+            ((param->param_type & PDO_PARAM_INPUT_OUTPUT) != PDO_PARAM_INPUT_OUTPUT)) {
+            SEPARATE_ZVAL(&param->parameter);
+            param->param_type = PDO_PARAM_STR;
+            ZVAL_STRINGL(param->parameter, Z_BVAL_P(param->parameter) ? "t" : "f", 1, 1);
+        }
+    }
+#if HAVE_PQPREPARE
 	}
-#endif	
+#endif
 	return 1;
 }
 

ext/pdo_pgsql/tests/bug62593.phpt

@@ -0,0 +1,51 @@
+--TEST--
+PDO PgSQL Bug #62593 (Emulate prepares behave strangely with PARAM_BOOL)
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo') || !extension_loaded('pdo_pgsql')) die('skip not loaded');
+require dirname(__FILE__) . '/config.inc';
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+PDOTest::skip();
+?>
+--FILE--
+<?php
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+$db = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
+$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, true);
+$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_SILENT);
+$errors = array();
+
+$value = true;
+$query = $db->prepare('SELECT :foo IS FALSE as val_is_false');
+$query->bindValue(':foo', $value, PDO::PARAM_BOOL);
+$query->execute();
+$errors[] = $query->errorInfo();
+var_dump($value);
+
+$query->bindValue(':foo', 0, PDO::PARAM_BOOL);
+$query->execute();
+$errors[] = $query->errorInfo();
+
+// Verify bindParam maintains reference and only passes when execute is called
+$value = true;
+$query->bindParam(':foo', $value, PDO::PARAM_BOOL);
+$value = false;
+$query->execute();
+$errors[] = $query->errorInfo();
+var_dump($value);
+
+$expect = 'No errors found';
+
+foreach ($errors as $error)
+{
+  if (strpos('Invalid text representation', $error[2]) !== false)
+  {
+    $expect = 'Invalid boolean found';
+  }
+}
+echo $expect;
+?>
+--EXPECTF--
+bool(true)
+bool(false)
+No errors found

ext/reflection/php_reflection.c

@@ -4465,7 +4465,7 @@ ZEND_METHOD(reflection_class, getTraitAliases)
 			zend_trait_method_reference *cur_ref = ce->trait_aliases[i]->trait_method;
 
 			if (ce->trait_aliases[i]->alias) {
-				method_name_len = spprintf(&method_name, 0, "%s::%s", cur_ref->class_name, cur_ref->method_name);
+				method_name_len = spprintf(&method_name, 0, "%s::%s", cur_ref->ce->name, cur_ref->method_name);
 				add_assoc_stringl_ex(return_value, ce->trait_aliases[i]->alias, ce->trait_aliases[i]->alias_len + 1, method_name, method_name_len, 0);
 			}
 			i++;

ext/reflection/tests/bug63399.phpt

@@ -0,0 +1,49 @@
+--TEST--
+Bug #63399 (ReflectionClass::getTraitAliases() incorrectly resolves traitnames)
+--FILE--
+<?php
+trait Trait1 {
+        public function run() {}
+        public function say() {}
+}
+
+trait Trait2 {
+        public function run() {}
+        public function say() {}
+}
+
+class MyClass
+{
+    use Trait1, Trait2 {
+        Trait1::run as execute;
+        Trait1::say insteadof Trait2;
+        Trait2::run insteadof Trait1;
+        Trait2::say as talk;
+    }
+}
+
+$ref = new ReflectionClass('MyClass');
+
+print_r($ref->getTraitAliases());
+print_r($ref->getTraits());
+
+?>
+--EXPECT--
+Array
+(
+    [execute] => Trait1::run
+    [talk] => Trait2::say
+)
+Array
+(
+    [Trait1] => ReflectionClass Object
+        (
+            [name] => Trait1
+        )
+
+    [Trait2] => ReflectionClass Object
+        (
+            [name] => Trait2
+        )
+
+)

ext/reflection/tests/traits005.phpt

@@ -28,14 +28,14 @@ array(0) {
 class C3:
 array(1) {
   ["a1"]=>
-  string(10) "(null)::m1"
+  string(6) "T1::m1"
 }
 
 class C4:
 array(2) {
   ["a1"]=>
-  string(10) "(null)::m1"
+  string(6) "T1::m1"
   ["a2"]=>
-  string(10) "(null)::m2"
+  string(6) "T1::m2"
 }