Commit Graph

41503 Commits

Author SHA1 Message Date
Xinchen Hui
66caa61188 Skip if no jit is built 2016-10-29 14:23:25 +08:00
Xinchen Hui
e5aa365147 Fixed bug #73392 (A use-after-free in zend allocator management) 2016-10-28 21:21:24 +08:00
Anatol Belski
0f9a4af90b make config.w32 compatible with ICU 58 2016-10-26 13:05:03 +02:00
Christoph M. Becker
af4bfe234c Merge branch 'PHP-5.6' into PHP-7.0 2016-10-25 14:31:41 +02:00
Christoph M. Becker
cd13d0260a Fix #72494: imagecropauto out-of-bounds access
This issue has actually already been fixed with commit 46f2c690. We're
adding a regression test and a NEWS entry, and also port the fix in
gdImageCropThreshold() from libgd:
  * <https://github.com/libgd/libgd/commit/b347e034>
  * <https://github.com/libgd/libgd/commit/46f2c690>
2016-10-25 14:29:48 +02:00
Derick Rethans
7544040469 Updated to version 2016.8 (2016h) 2016-10-24 10:37:13 +01:00
Derick Rethans
4f5a755b9d Updated to version 2016.8 (2016h) 2016-10-24 10:37:07 +01:00
Nikita Popov
89d3e234af Fix test output
Changed due to eca84946a4.
2016-10-23 22:26:25 +02:00
Adam Saponara
55d17662cb Fix bug #71241: array_replace_recursive mutates ref params
`array_replace_recursive` can sometimes mutate its params if
references are nested within. This differs from the PHP 5 behavior.
2016-10-20 13:22:04 +02:00
Leigh
c3361f16c7 Add php_random_int internal API
This is the internal API compliment to `php_random_bytes`
2016-10-20 10:18:07 +01:00
Joe Watkins
295377630a Merge branch 'pull-request/2152' into PHP-7.0 2016-10-20 05:19:10 +01:00
Joe Watkins
8c74be0c52 Revert "Fix bug #47890 #73215 uniqid() should use better random source"
This reverts commit 48f1a17886.
2016-10-18 11:30:19 +01:00
Yasuo Ohgaki
48f1a17886 Fix bug #47890 #73215 uniqid() should use better random source 2016-10-18 09:13:42 +09:00
Christoph M. Becker
0b596f81b8 Merge branch 'PHP-5.6' into PHP-7.0
We also use ZEND_LONG_(MAX|MIN) now instead of LONG_(MAX|MIN).
2016-10-17 23:38:28 +02:00
Christoph M. Becker
86e603a664 Fix #73333: 2147483647 is fetched as string
We return all integers that can be represented as such by PHP as
integers, and only those that exceed the possible range as strings.
On builds which represent integers with 64 bits, the range check is
unnecessary and might cause code checkers to complain, so we skip this
special casing via the preprocessor according to
<http://git.php.net/?p=php-src.git;a=commit;h=99d087e5>.
2016-10-17 23:34:41 +02:00
Joe Watkins
39ee3184ee Merge branch 'pull-request/1817' 2016-10-17 17:01:39 +01:00
Joe Watkins
5eb84337a6 Merge branch 'pull-request/1816' 2016-10-17 17:01:28 +01:00
Joe Watkins
522e4f1174 Merge branch 'pull-request/1814' 2016-10-17 17:01:10 +01:00
Joe Watkins
6806a41e7f Merge branch 'pull-request/1808' 2016-10-17 17:00:50 +01:00
Christopher Jones
8be59a1301 Fixed bug #71148 (Bind reference overwritten on PHP 7) 2016-10-17 12:40:14 +11:00
Remi Collet
f1cf340e19 bump ext/zip version 2016-10-14 17:31:07 +02:00
Remi Collet
428ef50838 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  use zend_error instead of zend_error_noreturn
2016-10-14 10:54:09 +02:00
Remi Collet
e1f5b6d8df use zend_error instead of zend_error_noreturn 2016-10-14 10:53:40 +02:00
Keith Smiley
3b9ba6195d soap #69137 - Invert logic to be correct 2016-10-13 23:56:24 -04:00
Anatol Belski
730288ae41 rename publicly exposed symbol to avoid name conflicts 2016-10-13 15:23:50 +02:00
Christoph M. Becker
b8fab503fe Merge branch 'PHP-5.6' into PHP-7.0 2016-10-13 11:25:11 +02:00
Christoph M. Becker
cc08cbc84d Fix #73280: Stack Buffer Overflow in GD dynamicGetbuf
We make sure to never pass a negative `rlen` as size to memcpy().

Cf. <https://github.com/libgd/libgd/commit/53110871>.
2016-10-13 11:10:02 +02:00
Stanislav Malyshev
cd8c9b0614 Fix outlen for openssl function
Even though datalen can't be over int, outlen can.
2016-10-12 23:19:07 -07:00
Stanislav Malyshev
2301608736 Syncronize with 5.6 - __toString should return "" 2016-10-12 23:09:49 -07:00
Stanislav Malyshev
9c50ba42d6 Fix potential overflows in php_pcre_replace_impl 2016-10-12 23:07:47 -07:00
Keith Smiley
26287132c0 Fixed bug #73237
If the response includes both fields with simple types (which get
concatenated into an XML string) and a complex type (which is parsed
into an object), then the object will parsed into the same zval as the
simple types and will overwrite the string.
2016-10-12 23:12:45 +02:00
Mitch Hagstrand
bcee2fdbec Fixed bug in zend_accel_error() and cleaned up kill_all_lockers()
1. zend_accel_error was only executing clean up if log_verbosity_level is high enough to log
2. Cleaned up kill_all_lockers function and fixed comments.
2016-10-12 23:03:55 +02:00
Anatol Belski
58b18892bf update len in fallback cases 2016-10-12 20:52:46 +02:00
Stanislav Malyshev
74b5662536 Fix bug #73190: memcpy negative parameter _bc_new_num_ex
(cherry picked from commit 40e7baab3c)
2016-10-12 19:48:25 +02:00
Stanislav Malyshev
f42cbd749c Fix bug #73147: Use After Free in PHP7 unserialize()
(cherry picked from commit 0e6fe3a4c9)
2016-10-12 17:51:15 +02:00
Anatol Belski
efc1f33b58 fix typo 2016-10-12 17:12:38 +02:00
Anatol Belski
80eb013a92 Revert "Fix for #73240 - Write out of bounds at number_format"
This reverts commit 01280f8deb.

The fix is already merged by Stas.
2016-10-12 16:12:18 +02:00
Anatol Belski
b135ba3fa9 followup with #73276 merge 2016-10-12 16:03:35 +02:00
Anatol Belski
7c6cb1282d fix test 2016-10-12 16:03:09 +02:00
Stanislav Malyshev
7dc8b5e7ae Fix bug #73276 - crash in openssl_random_pseudo_bytes function
(cherry picked from commit 85a22a0af0)
2016-10-12 15:55:42 +02:00
Stanislav Malyshev
4ef79370a8 Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML()
(cherry picked from commit 96a8cf8e1b)
2016-10-12 15:40:21 +02:00
Stanislav Malyshev
01280f8deb Fix for #73240 - Write out of bounds at number_format
(cherry picked from commit 8259130b6b)
2016-10-12 14:55:00 +02:00
Anatol Belski
aaa5d07365 avoid strlen 2016-10-12 13:28:23 +02:00
Stanislav Malyshev
b26b02b2df Bug #73218: add mitigation for ICU int overflow
(cherry picked from commit d946d10293)
2016-10-12 13:22:51 +02:00
Stanislav Malyshev
87a8240b5a Add more locale length checks, due to ICU bugs.
(cherry picked from commit d3eb58332a)
2016-10-12 13:11:16 +02:00
Stanislav Malyshev
d1e878f272 Fix bug #73150: missing NULL check in dom_document_save_html
(cherry picked from commit 1c0e9126fb)
2016-10-12 12:19:41 +02:00
Sara Golemon
43ccf23d70 Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.

Catch the bailout, clear the variable, then continue bailing.

Closes https://bugs.php.net/bug.php?id=73188
2016-10-11 21:55:01 -07:00
Sara Golemon
4d11a8eedf Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.

Catch the bailout, clear the variable, then continue bailing.

Closes https://bugs.php.net/bug.php?id=73188
2016-10-11 21:44:14 -07:00
Stanislav Malyshev
1bdb30a429 Merge branch 'PHP-7.0.12' into PHP-7.0
* PHP-7.0.12:
  set versions and release date
  sync NEWS
  Revert "Fixed bug #73067 (__debugInfo crashes when throwing an exception)"
  Fix for #73240 - Write out of bounds at number_format
  Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object as key
  set versions
  Fix bug #73091 - Unserializing DateInterval object may lead to __toString invocation
2016-10-11 16:46:51 -07:00
Stanislav Malyshev
9c675607e6 Merge remote-tracking branch 'origin/PHP-7.0.12' into PHP-7.0.12
* origin/PHP-7.0.12: (99 commits)
  set versions and release date
  sync NEWS
  Revert "Fixed bug #73067 (__debugInfo crashes when throwing an exception)"
  set versions
  update NEWS
  Ignore potentially misleading dberr values
  update NEWS
  Fixed bug #73172 parse error: Invalid numeric literal
  Fix #53745: cgi.discard_path option is missing from php.ini
  update libs_versions.txt
  update libs_versions.txt
  Fixed bug #73156 (segfault on undefined function)
  Add an include path for freetype which is relevant for cmake builds
  Fix test_image_equals_file() wrt. palette images
  Fixed bug #73163
  Fix #73161: imagecreatefromgd2() may leak memory
  Fix #73159: imagegd2(): unrecognized formats may result in corrupted files
  Fix #73155: imagegd2() writes wrong chunk sizes on boundaries
  Fix #73157 (again): imagegd2() ignores 3rd param if 4 are given
  Fix #73157: imagegd2() ignores 3rd param if 4 are given
  ...
2016-10-11 16:27:13 -07:00