Commit Graph

97275 Commits

Author SHA1 Message Date
Pierre Joye
77a71cba20 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  #72482, Ilegal write/read access caused by gdImageAALine overflow
2016-07-19 19:34:51 +07:00
Pierre Joye
b25009fc2c #72482, Ilegal write/read access caused by gdImageAALine overflow 2016-07-19 19:34:07 +07:00
Pierre Joye
2767d1953f merge conflict 2016-07-19 18:55:09 +07:00
Pierre Joye
1d69028d2f fix #72494, improve input color check and prevent issues when old gd are used, done before gd call 2016-07-19 18:23:51 +07:00
Pierre Joye
834f7a39be Merge branch 'PHP-5.6' of git.php.net:php-src into PHP-5.6 2016-07-19 16:34:55 +07:00
Pierre Joye
dbbfb23c62 Merge branch 'PHP-7.0' of git.php.net:php-src into PHP-7.0 2016-07-19 16:34:15 +07:00
Pierre Joye
1e9273c48b Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  improve fix #72558, free contribRow as well
2016-07-19 16:33:38 +07:00
Pierre Joye
48e76abadd improve fix #72558, free contribRow as well 2016-07-19 16:33:17 +07:00
Stanislav Malyshev
f1ea7d195a Merge branch 'PHP-7.0' of git.php.net:php-src into PHP-7.0
* 'PHP-7.0' of git.php.net:php-src:
2016-07-19 01:57:40 -07:00
Stanislav Malyshev
83d498dafd Merge branch 'PHP-7.0'
* PHP-7.0:
  improve fix #72558, while (u>=0) with unsigned int will always be true
  improve fix #72558, while (u>=0) with unsigned int will always be true
2016-07-19 01:57:08 -07:00
Stanislav Malyshev
caa96c4416 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  improve fix #72558, while (u>=0) with unsigned int will always be true
  improve fix #72558, while (u>=0) with unsigned int will always be true
2016-07-19 01:56:57 -07:00
Stanislav Malyshev
894df05fe8 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  improve fix #72558, while (u>=0) with unsigned int will always be true
2016-07-19 01:56:49 -07:00
Pierre Joye
7521149193 improve fix #72558, while (u>=0) with unsigned int will always be true 2016-07-19 01:56:35 -07:00
Pierre Joye
bc8c722cb4 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  improve fix #72558, while (u>=0) with unsigned int will always be true
2016-07-19 15:53:25 +07:00
Pierre Joye
df09515089 improve fix #72558, while (u>=0) with unsigned int will always be true 2016-07-19 15:51:43 +07:00
Stanislav Malyshev
b2b44c0f0e Merge branch 'PHP-7.0'
* PHP-7.0:
  Fix memory leak
2016-07-19 01:47:59 -07:00
Stanislav Malyshev
9698082306 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Fix memory leak
2016-07-19 01:47:48 -07:00
Stanislav Malyshev
f69362d212 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  Fix memory leak
2016-07-19 01:47:40 -07:00
Stanislav Malyshev
47d6ea6332 Fix memory leak 2016-07-19 01:47:27 -07:00
Stanislav Malyshev
70d6ce3368 Merge branch 'PHP-7.0'
* PHP-7.0: (27 commits)
  fix #72519, possible OOB using imagegif
  fix #72512, invalid read or write for palette image when invalid transparent index is used
  Apparently some envs miss SIZE_MAX
  Fix tests
  Fix bug #72618: NULL Pointer Dereference in exif_process_user_comment
  Partial fix for bug #72613 - do not allow reading past error read
  Partial fix for bug #72613 - do not treat negative returns from bz2 as size_t
  Fix bug #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c
  Fix for bug #72558, Integer overflow error within _gdContributionsAlloc()
  Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE
  update NEWS
  Fixed bug #72570 Segmentation fault when binding parameters on a query without placeholders
  Fix bug #72562 - destroy var_hash properly
  Fix bug #72551 and bug #72552 - check before converting size_t->int
  Fix bug #72541 - size_t overflow lead to heap corruption
  Fix bug #72533 (locale_accept_from_http out-of-bounds access)
  Fix fir bug #72520
  Fix for bug #72513
  Fix for bug #72513
  CS fix and comments with bug ID
  ...

Conflicts:
	ext/standard/basic_functions.c
2016-07-19 01:44:14 -07:00
Stanislav Malyshev
b00f8f2a5b Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  fix #72519, possible OOB using imagegif
  fix #72512, invalid read or write for palette image when invalid transparent index is used
  Apparently some envs miss SIZE_MAX
  Fix tests
  Fix bug #72618: NULL Pointer Dereference in exif_process_user_comment
  Partial fix for bug #72613 - do not treat negative returns from bz2 as size_t
  Fix bug #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c
  Fix for bug #72558, Integer overflow error within _gdContributionsAlloc()
  Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE
  Fix bug #72562 - destroy var_hash properly
  Fix bug #72533 (locale_accept_from_http out-of-bounds access)
  Fix fir bug #72520
  Fix for bug #72513
  Fix for bug #72513
  CS fix and comments with bug ID
  Fix for HTTP_PROXY issue.
  5.6.24RC1
  add tests for bug #72512
  Fixed bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access
  Fixed bug #72479 - same as #72434

Conflicts:
	Zend/zend_virtual_cwd.c
	ext/bz2/bz2.c
	ext/exif/exif.c
	ext/session/session.c
	ext/snmp/snmp.c
	ext/standard/basic_functions.c
	main/SAPI.c
	main/php_variables.c
2016-07-19 01:39:28 -07:00
Stanislav Malyshev
e9a58bee24 Merge branch 'PHP-7.0.9' into PHP-7.0
* PHP-7.0.9:
  Partial fix for bug #72613 - do not allow reading past error read
  update NEWS
  Fixed bug #72570 Segmentation fault when binding parameters on a query without placeholders
  Fix bug #72551 and bug #72552 - check before converting size_t->int
  Fix bug #72541 - size_t overflow lead to heap corruption
  fix possible optimization bug
  set versions

Conflicts:
	configure.in
	ext/pdo_pgsql/tests/bug72570.phpt
	main/php_version.h
2016-07-19 01:08:18 -07:00
Stanislav Malyshev
4d0565b5ba Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  fix #72519, possible OOB using imagegif
  fix #72512, invalid read or write for palette image when invalid transparent index is used
  Apparently some envs miss SIZE_MAX
  Fix tests
  Fix bug #72618: NULL Pointer Dereference in exif_process_user_comment
  Partial fix for bug #72613 - do not treat negative returns from bz2 as size_t
  Fix bug #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c
  Fix for bug #72558, Integer overflow error within _gdContributionsAlloc()
  Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE
  Fix bug #72562 - destroy var_hash properly
  Fix bug #72533 (locale_accept_from_http out-of-bounds access)
  Fix fir bug #72520
  Fix for bug #72513
  CS fix and comments with bug ID
  Fix for HTTP_PROXY issue.
  add tests for bug #72512
  Fixed bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access
  Fixed bug #72479 - same as #72434

Conflicts:
	ext/bz2/bz2.c
	main/SAPI.c
	main/php_variables.c
2016-07-19 00:53:08 -07:00
Stanislav Malyshev
1a88692692 Merge branch 'PHP-5.6.24' into PHP-5.6
* PHP-5.6.24:
  Fix for bug #72513
  5.6.24RC1

Conflicts:
	configure.in
	main/php_version.h
2016-07-19 00:51:27 -07:00
Stanislav Malyshev
f0a17b3a86 Merge branch 'PHP-5.5' of git.php.net:php-src into PHP-5.5
* 'PHP-5.5' of git.php.net:php-src:
  fix #72519, possible OOB using imagegif
2016-07-19 00:44:08 -07:00
Anatol Belski
5c90f9b9cd Merge branch 'PHP-7.0'
* PHP-7.0:
  fix #72519, possible OOB using imagegif
2016-07-19 09:43:02 +02:00
Anatol Belski
905310d144 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  fix #72519, possible OOB using imagegif
2016-07-19 09:42:28 +02:00
Anatol Belski
9bb5f64871 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  fix #72519, possible OOB using imagegif
2016-07-19 09:40:26 +02:00
Pierre Joye
8dc5ffa479 fix #72519, possible OOB using imagegif 2016-07-19 00:37:53 -07:00
Pierre Joye
928aecc002 fix #72512, invalid read or write for palette image when invalid transparent index is used
Conflicts:
	ext/gd/libgd/gd.c
2016-07-19 00:37:38 -07:00
Pierre Joye
7b1572b177 fix #72519, possible OOB using imagegif
fix #72519, possible OOB using imagegif
2016-07-19 09:33:34 +02:00
Pierre Joye
2707271465 Merge branch 'PHP-7.0'
* PHP-7.0:
  fix #72519, possible OOB using imagegif
2016-07-19 14:16:32 +07:00
Pierre Joye
05e8a0febe Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  fix #72519, possible OOB using imagegif
2016-07-19 14:16:20 +07:00
Pierre Joye
b61bd1243a Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  fix #72519, possible OOB using imagegif
2016-07-19 14:16:01 +07:00
Stanislav Malyshev
33c1a55b40 Apparently some envs miss SIZE_MAX 2016-07-19 00:13:25 -07:00
Pierre Joye
2fbce5f51f fix #72519, possible OOB using imagegif 2016-07-19 14:11:44 +07:00
Pierre Joye
6434fc9d2b Merge branch 'PHP-7.0'
* PHP-7.0:
  fix #72512, invalid read or write for palette image when invalid transparent index is used
2016-07-19 13:44:11 +07:00
Pierre Joye
740661bd7a Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  fix #72512, invalid read or write for palette image when invalid transparent index is used
2016-07-19 13:40:34 +07:00
Pierre Joye
511f07b747 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  fix #72512, invalid read or write for palette image when invalid transparent index is used
2016-07-19 13:39:46 +07:00
Pierre Joye
0fbcff1b35 fix #72512, invalid read or write for palette image when invalid transparent index is used 2016-07-19 13:37:23 +07:00
Stanislav Malyshev
08ac37bd2a Merge branch 'PHP-5.5.38' into PHP-5.5
* PHP-5.5.38:
  Fix tests
  Fix bug #72618: NULL Pointer Dereference in exif_process_user_comment
  Partial fix for bug #72613 - do not treat negative returns from bz2 as size_t
  Fix bug #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c
  Fix for bug #72558, Integer overflow error within _gdContributionsAlloc()
  Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE
  Fix bug #72562 - destroy var_hash properly
  Fix bug #72533 (locale_accept_from_http out-of-bounds access)
  Fix fir bug #72520
  Fix for bug #72513
  CS fix and comments with bug ID
  Fix for HTTP_PROXY issue.
  add tests for bug #72512
  Fixed bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access
  Fixed bug #72479 - same as #72434
2016-07-18 23:32:38 -07:00
Stanislav Malyshev
1364742be9 Fix tests 2016-07-18 23:30:51 -07:00
Stanislav Malyshev
41131cd41d Fix bug #72618: NULL Pointer Dereference in exif_process_user_comment 2016-07-18 23:21:51 -07:00
Stanislav Malyshev
5faa15c4ce Partial fix for bug #72613 - do not allow reading past error read 2016-07-18 23:01:36 -07:00
Stanislav Malyshev
f3feddb5b4 Partial fix for bug #72613 - do not treat negative returns from bz2 as size_t 2016-07-18 22:24:52 -07:00
Stanislav Malyshev
e6c48213c2 Fix bug #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c 2016-07-18 21:44:39 -07:00
Anatol Belski
88d86aeb53 add missing header to fix build 2016-07-19 01:30:07 +02:00
Christoph M. Becker
2f81707425 Merge branch 'PHP-7.0' 2016-07-19 00:55:13 +02:00
Christoph M. Becker
d565d4bc1c Merge branch 'PHP-5.6' into PHP-7.0
# Resolved conflicts:
#	ext/gd/gd.c
2016-07-19 00:48:10 +02:00
Christoph M. Becker
3c3980caa1 Merge branch 'pull-request/1991' into PHP-5.6 2016-07-19 00:42:49 +02:00