* PHP-5.5:
update NEWS
add NEWS for fixes
Improve fix for #70172
Fix bug #70312 - HAVAL gives wrong hashes in specific cases
fix test
add test
Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage
Fix bug #70172 - Use After Free Vulnerability in unserialize()
Fix bug #70388 - SOAP serialize_function_call() type confusion
Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories
Improve fix for #70385
Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)
Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes)
Fix bug #70219 (Use after free vulnerability in session deserializer)
Fix for bug #69782
Add CVE IDs asigned (post release) to PHP 5.4.43
Add CVE IDs asigned to #69085 (PHP 5.4.39)
5.4.45 next
Conflicts:
ext/pcre/php_pcre.c
ext/standard/var_unserializer.c
ext/standard/var_unserializer.re
ext/zip/php_zip.c
* PHP-5.4:
Improve fix for #70172
Fix bug #70312 - HAVAL gives wrong hashes in specific cases
fix test
add test
Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage
Fix bug #70172 - Use After Free Vulnerability in unserialize()
Fix bug #70388 - SOAP serialize_function_call() type confusion
Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories
Improve fix for #70385
Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)
Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes)
Fix bug #70219 (Use after free vulnerability in session deserializer)
Fix for bug #69782
Add CVE IDs asigned (post release) to PHP 5.4.43
Add CVE IDs asigned to #69085 (PHP 5.4.39)
5.4.45 next
Conflicts:
configure.in
ext/pcre/php_pcre.c
ext/standard/var_unserializer.c
ext/standard/var_unserializer.re
main/php_version.h
This implements a reduced variant of #1226 with just the following
change:
-Fatal error: Uncaught exception 'EngineException' with message 'Call to private method foo::bar() from context ''' in %s:%d
+Fatal error: Uncaught EngineException: Call to private method foo::bar() from context '' in %s:%d
The '' wrapper around messages is very weird if the exception
message itself contains ''. Futhermore having the message wrapped
in '' doesn't work for the "and defined" suffix of
TypeExceptions.
TypeException stays as-is for now because it uses messages that are
incompatible with the way exception messages are displayed.
closure_038.phpt and a few others now show that we're generating
too many exceptions for compound operations on undefined properties
-- this needs to be fixed in a followup.
* PHP-5.6:
Fixed bug #68331 - This was partial patch for https://wiki.php.net/rfc/session-lock-ini
Fixed 2 tests that expects bool retrun value from save handler.
Conflicts:
ext/session/session.c
* PHP-5.6:
Fix bug #67972 (SessionHandler Invalid memory read create_sid()).
Update LSAPI to 6.7, added support for 'filter_input'. Fixed a crash in CLI mode.
5.5.18 now
* PHP-5.5:
Fix bug #67972 (SessionHandler Invalid memory read create_sid()).
Update LSAPI to 6.7, added support for 'filter_input'. Fixed a crash in CLI mode.
5.5.18 now
Conflicts:
configure.in
main/php_version.h
* master:
fix nmake snap when ext name is different in target dll
force atoll macro usage on windows
Enable $ replacement in exif, ldap, pdo_pgsql and tidy
See bug #67635
NEWS
NEWS
improve previous, add message during configure
Fixed bug #67635 php links to systemd libraries without using pkg-config
Improve fix for #66608
Fixed segfault with empty break
New added opcodes don't need to be resloved
Update NEWS
Update NEWS
Update NEWS
Fixed bug #66827 Session raises E_NOTICE when session name variable is array
implemented copy libs of core exts in phpize mode
fix copy the ext dll into the prefix path in phpize mode
fix default prefix in phpize mode
fix file with zero size usage in phpize mode
Conflicts:
Zend/zend_opcode.c
Zend/zend_vm_def.h
Zend/zend_vm_execute.h
ext/session/session.c
* master:
Fix still broken session test. Only return true/false.
Fixed bug #66830 (Empty header causes PHP built-in web server to hang).
Followup fix to custom session save handlers
create locales and re-add test
rm test for now
Conflicts:
ext/session/tests/session_set_save_handler_class_012.phpt
2d9885c introduced some regressions. This addresses those.
* Don't throw return type notice or session write failure when in an exception
* Fix tests to properly return true/false since null is no longer falsy/successy
* Rerecord a few tests to accomodate difference in raised warnings
If the previous value of session.name was NULL then any call to
session_name($string) would result in a segmentation fault.
This changes the behaviour to set the value of session.name to
"PHPSESSID" if a blank value is given in php.ini or via -d on the
command line. There is already protection against setting it to NULL via
session_name() or ini_set().
When Wincache or APC are installed, the resource IDs are not the same.
This is because Wincache takes a few resource objects for itself. As a
result, these tests become false positives.
On Windows boxes, the microtime precision is not granular enough
to reliably register a difference if two calls to uniqid() are made
concurrently. This is a fix to the uniqid() test to avoid the false
positive when run on Windows machines. Also, added a test to exercise
the 'more_entropy' variant of uniqid().
Request #25630
Request #43980
Request #54383
Bug #65359
and many others similar to these that are closed as "wont fix" or
"not a bug".
Current serializers have limitations due to register_globals support
that are no longer supported. Changing existing serializer may cause
compatibility issue. Therefore, new handler is needed to remove
needless limitations.
php_serialize does not have special characters and allow numerical
index in $_SESSION. $_SESSION can be used as ordinary array.
