Commit Graph

4669 Commits

Author SHA1 Message Date
Sara Golemon
bab0b99f37 Detect invalid port in xp_socket parse ip address
For historical reasons, fsockopen() accepts the port and hostname
separately: fsockopen('127.0.0.1', 80)

However, with the introdcution of stream transports in PHP 4.3,
it became possible to include the port in the hostname specifier:

fsockopen('127.0.0.1:80')
Or more formally: fsockopen('tcp://127.0.0.1:80')

Confusing results when these two forms are combined, however.
fsockopen('127.0.0.1:80', 443) results in fsockopen() attempting
to connect to '127.0.0.1:80:443' which any reasonable stack would
consider invalid.

Unfortunately, PHP parses the address looking for the first colon
(with special handling for IPv6, don't worry) and calls atoi()
from there.  atoi() in turn, simply stops parsing at the first
non-numeric character and returns the value so far.

The end result is that the explicitly supplied port is treated
as ignored garbage, rather than producing an error.

This diff replaces atoi() with strtol() and inspects the
stop character.  If additional "garbage" of any kind is found,
it fails and returns an error.
2017-03-07 12:10:53 -08:00
Anatol Belski
21a05b0418 prepare next 2017-02-28 09:46:11 +01:00
Nikita Popov
bbfa1b6419 Improve fix for bug #73807
At least on some architectures memmove() on FreeBSD does not
short-curcuit if src==dst. Check for it explicitly to avoid
quadratic copying.
2017-02-25 12:55:14 +01:00
Anatol Belski
89a5bd6750 Fixed bug #74090 stream_get_contents maxlength>-1 returns empty string 2017-02-15 11:22:47 +01:00
Xinchen Hui
ee25eb0eae Fixed #73496 (Invalid memory access in zend_inline_hash_func)
no test script is added because it requre too much memory
2017-02-12 18:55:19 +08:00
Denis Yeldandi
9814be4bc2 Fixed bug #69860 2017-02-12 00:06:04 +01:00
Nikita Popov
a15bffd105 Fix bug #73807 2017-02-02 18:06:15 +01:00
Anatol Belski
536b3ca1e1 bump versions for next in dev 2017-01-31 11:18:23 +01:00
Sara Golemon
69fbe3a9ad Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Fix open_basedir check for glob:// opendir wrapper
2017-01-09 16:07:33 -08:00
Sara Golemon
7e49e8e797 Fix open_basedir check for glob:// opendir wrapper
php_check_open_basedir() expects a local filesystem path,
but we're handing it a `glob://...` URI instead.

Move the check to after the path trim so that we're checking
a meaningful pathspec.
2017-01-09 11:02:50 -08:00
Nikita Popov
a46bbdda2e Fixed bug #67583
As fcgi_request is an opaque struct as of PHP 7, expose a new API
function fcgi_end() which does fcgi_flush() with end=1 and checks/
sets the ->ended flag.
2017-01-07 22:53:28 +01:00
Nikita Popov
f346bd6ee6 Rename fcgi_request.closed to .ended
"closed" refers to whether FCGI_END_REQUEST has been sent, while
the "close" operation does something entirely different. It gets
extra confusing when fcgi_is_closed() does not actually return
fcgi_request.closed...
2017-01-07 22:45:19 +01:00
Evgeniy Makhrov
d0279242ce add 'e' flag for fopen() to enable CLOEXEC 2017-01-07 12:10:51 +01:00
Markus Staab
782b84c6d5
updated default per proposal
TODO: adjust php.ini defaults
2017-01-06 05:25:08 +00:00
Markus Staab
66b698c3cf
Increase realpath_cache_size default value 2017-01-06 05:25:04 +00:00
Ferenc Kovacs
3b14d7b84b 5.6.31 is next 2017-01-06 01:43:11 +01:00
Anatol Belski
997d902762 move dev to next 2017-01-05 01:12:18 +01:00
Sammy Kaye Powers
478f119ab9 Update copyright headers to 2017 2017-01-04 11:14:55 -06:00
Nikita Popov
935b5cb11e Flush stderr on win32 in cli_log_message
This allows us to unfork a bunch of tests for Windows.
2017-01-01 21:09:02 +01:00
Ferenc Kovacs
e715dafae0 5.6.30 will be next 2016-11-24 01:54:23 +01:00
Anatol Belski
df902a7c28 move dev to next 2016-11-22 11:49:09 +01:00
Ferenc Kovacs
9b3a1e00ab 5.6.29 will be next 2016-10-27 23:10:59 +02:00
Anatol Belski
277e829f10 move dev to 7.0.14 2016-10-25 10:29:51 +02:00
Stanislav Malyshev
c4c2cce37d Fix bug #73189 - Memcpy negative size parameter php_resolve_path
(cherry picked from commit da7e89cde8)
2016-10-12 21:31:37 +02:00
Sara Golemon
43ccf23d70 Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.

Catch the bailout, clear the variable, then continue bailing.

Closes https://bugs.php.net/bug.php?id=73188
2016-10-11 21:55:01 -07:00
Sara Golemon
4d11a8eedf Clear FG(user_stream_current_filename) when bailing out
If a userwrapper opener E_ERRORs then FG(user_stream_current_filename)
would remain set until the next request and would not be pointing
at unallocated memory.

Catch the bailout, clear the variable, then continue bailing.

Closes https://bugs.php.net/bug.php?id=73188
2016-10-11 21:44:14 -07:00
Stanislav Malyshev
689a9b8def Merge branch 'PHP-5.6.27' into PHP-5.6
* PHP-5.6.27:
  Fix tests
  fix tsrm
  Fix bug #73284 - heap overflow in php_ereg_replace function
  Fix bug #73276 - crash in openssl_random_pseudo_bytes function
  Fix bug #73293 - NULL pointer dereference in SimpleXMLElement::asXML()
  fix bug #73275 - crash in openssl_encrypt function
  Fix for #73240 - Write out of bounds at number_format
  Bug #73218: add mitigation for ICU int overflow
  Add more locale length checks, due to ICU bugs.
  Fix bug #73208 - another missing length check
  Fix bug #73190: memcpy negative parameter _bc_new_num_ex
  Fix bug #73189 - Memcpy negative size parameter php_resolve_path
  Fixed bug #73174 - heap overflow in php_pcre_replace_impl
  Fix bug #73150: missing NULL check in dom_document_save_html
  Fix bug #73147: Use After Free in PHP7 unserialize()
  Fix bug #73082
  Fix bug #73073 - CachingIterator null dereference when convert to string
2016-10-11 16:26:35 -07:00
Anatol Belski
ea83e504e5 fix datatype 2016-10-06 11:01:27 +02:00
Stanislav Malyshev
40e7baab3c Fix bug #73190: memcpy negative parameter _bc_new_num_ex 2016-10-03 00:09:02 -07:00
Stanislav Malyshev
da7e89cde8 Fix bug #73189 - Memcpy negative size parameter php_resolve_path 2016-09-28 23:30:48 -07:00
Ferenc Kovacs
703c247c7d 5.6.28 is next 2016-09-29 00:55:36 +02:00
Anatol Belski
cb29c01ed6 prepare next 2016-09-27 12:49:52 +02:00
Anatol Belski
4685297f05 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Revert "Fixed bug #73037 SoapServer reports Bad Request when gzipped"
2016-09-23 18:46:51 +02:00
Anatol Belski
075aa911ff Revert "Fixed bug #73037 SoapServer reports Bad Request when gzipped"
This reverts commit f9a699f6c3.
2016-09-23 18:45:03 +02:00
Anatol Belski
f9a699f6c3 Fixed bug #73037 SoapServer reports Bad Request when gzipped
(cherry picked from commit 410c68788a)
2016-09-23 18:06:12 +02:00
Anatol Belski
410c68788a Fixed bug #73037 SoapServer reports Bad Request when gzipped 2016-09-23 16:02:50 +02:00
Xinchen Hui
ac07008bb7 Fixed bug #72505 (readfile() mangles files larger than 2G) 2016-09-16 20:53:51 +08:00
Ferenc Kovacs
fbb81dd755 5.6.27 will be next 2016-09-01 20:27:19 +02:00
Anatol Belski
bc7460260b prepare for next 2016-08-30 14:11:22 +02:00
Xinchen Hui
3956deb1b2 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Fixed bug #72853 (stream_set_blocking doesn't work)

Conflicts:
	main/streams/plain_wrapper.c
2016-08-17 16:56:02 +08:00
Xinchen Hui
abe00908af Fixed bug #72853 (stream_set_blocking doesn't work)
Implemented  PHP_STREAM_OPTION_META_DATA_API for plain_wrappers
2016-08-17 16:54:21 +08:00
Stanislav Malyshev
75d7666968 Merge branch 'PHP-7.0.10' into PHP-7.0
* PHP-7.0.10:
  Fix bug #72749: wddx_deserialize allows illegal memory access
  Fixed bug #72627: Memory Leakage In exif_process_IFD_in_TIFF
  fix tests
  Fix bug#72697 - select_colors write out-of-bounds
  Fix bug #72708 - php_snmp_parse_oid integer overflow in memory allocation
  Fix bug #72730 - imagegammacorrect allows arbitrary write access
  Fix bug #72750: wddx_deserialize null dereference
  Fix bug #72771: ftps:// opendir wrapper is vulnerable to protocol downgrade attack
  fix tests
  add missing skipif section
  Fix for bug #72790 and bug #72799
  Fix bug #72837 - integer overflow in bzdecompress caused heap corruption
  Fix bug #72742 - memory allocator fails to realloc small block to large one
  Use size_t for path length
  Check for string overflow
  Fix for bug #72782: mcrypt accepts only ints, so don't pass anything else
  Fix bug #72674 - check both curl_escape and curl_unescape
2016-08-16 23:52:22 -07:00
Anatol Belski
6de67244d4 fix blocking pipe stream option value
As revealed by #72857, this value conflicts with the xport option.
Wrong code can otherwise cause streams misbehave, fe if local and
network streams APIs are mixed.
2016-08-17 00:53:15 +02:00
Stanislav Malyshev
6304a611cd Use size_t for path length 2016-08-10 23:46:58 -07:00
Ferenc Kovacs
562c17eb4e 5.6.26 will be next 2016-08-04 01:39:37 +02:00
Nikita Popov
1bcd439cad Fix bug #72724 2016-08-03 00:34:36 +02:00
Anatol Belski
5c51433e2a prepare next 2016-08-02 11:13:20 +02:00
Anatol Belski
9f14920725 fix php_version.h 2016-08-02 11:06:33 +02:00
Pierrick Charron
6714f73545 Merge branch 'PHP-5.6' into PHP-7.0
Conflicts:
	main/streams/streams.c
2016-07-27 00:38:54 -04:00
Pierrick Charron
074b86d845 Fixed bug #72686 (zlib: url support is broken).
zlib: support is broken since a really long time.
It never worked on versions >= PHP5.6 so we can just remove
this dead code.

Bug was introduced 2006-05-14 (Before 5.2.0)
2016-07-27 00:33:13 -04:00