Commit Graph

29794 Commits

Author SHA1 Message Date
Matthew Daley
fcbe20d357 Set an LDAP error code when failing ldap_bind due to null bytes
Some applications check a LDAP link's error code after seeing ldap_bind
fail due to a null byte bind attempt and hence incorrectly receive the
last set error code.

Fix by setting an LDAP error code before returning in this case.
2014-09-28 12:23:52 -07:00
Derick Rethans
16e2d954fc - Updated to version 2014.8 (2014h) 2014-09-26 16:26:59 +01:00
Stanislav Malyshev
408b172017 Revert xp_ssl.c to the state of 5.4.32 due to regressions 2014-09-26 00:44:24 -07:00
Ard Biesheuvel
e64da8c20d Fixed bug #66242 (don't assume char is signed)
This fixes a bug in libmagic where a cast to 'char' is assumed to result
in sign extension to occur. However, unqualified 'char' is unsigned on
architectures such as ARM, so the cast needs to be to 'signed char'
explicitly.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
2014-09-20 16:39:48 -07:00
Matteo Beccati
00525b824a Fixed freetype test on multiple environments
Some environments, apparently regardless to the freetype version, output 155, while others 156. I guess we can accept both ;)

This reverts commit 592df89027.
2014-09-16 10:19:29 +02:00
Daniel Lowrey
372844918a Bug #41631: Fix regression from first attempt (6569db8) 2014-09-09 09:01:42 -06:00
Daniel Lowrey
f86b2193a4 Bug #67965: Fix blocking behavior in non-blocking crypto streams 2014-09-09 07:37:57 -06:00
Matteo Beccati
592df89027 Fixed test with freetype >= 2.4.12 2014-09-03 09:43:29 +02:00
Derick Rethans
e665a07ab9 - Updated to version 2014.7 (2014g) 2014-09-01 16:40:49 +01:00
Chris Wright
32be79dcfa Fix stream_select() issue with OpenSSL buffer
Ensure data from OpenSSL internal buffer has been
transfered to PHP stream buffer before a select()
emulation operation is performed

Addresses bug #65137
https://bugs.php.net/bug.php?id=65137

Conflicts:
	ext/openssl/xp_ssl.c
2014-08-27 13:25:50 +01:00
Lior Kaplan
bda1cc6946 Bug #67730: Add tests by Ryan Mauger <ryan@rmauger.co.uk> 2014-08-25 00:29:05 +03:00
Ferenc Kovacs
cb41a7bad1 this test depends on the simplexml ext, not just on xml 2014-08-24 00:08:09 +02:00
Michael Wallner
54fbbded37 fix bug #67865 2014-08-21 22:41:36 +02:00
Anatol Belski
20941b71aa fixed variable corruption under win x64 2014-08-20 15:08:52 +02:00
Sara Golemon
cbe1597b74 Switch use of strtok() to gd_strtok_r()
strtok() is not thread safe, so this will potentially break in
very bad ways if used in ZTS mode.

I'm not sure why gd_strtok_r() exists since it seems to do the
same thing as strtok_r(), but I'll assume it's a portability
decision and do as the Romans do.
2014-08-19 13:16:44 -07:00
Stanislav Malyshev
5a7039035c 5.4.32
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.10 (Darwin)
 
 iF4EABEIAAYFAlPzCaMACgkQL3lWvF2gS10pnwD9GYeG82QTI20oVqzQ4dVF+yks
 xC5ph0RvUVXbJy8ADn4A/2Of7Q520LQYkxZHN0JDTb3EBaTvhG5sF6Yo1gTpJPKS
 =NoE4
 -----END PGP SIGNATURE-----

Merge tag 'PHP-5.4.32' into PHP-5.4

5.4.32

* tag 'PHP-5.4.32':
  5.4.32
  fix potentially missing NUL termination
  Fix bug #67730 - Null byte injection possible with imagexxx functions
  Fixed bug #67717 - segfault in dns_get_record
  Fix bug #67716 - Segfault in cdf.c
  5.4.32 RC1

Conflicts:
	configure.in
	main/php_version.h
2014-08-19 01:33:45 -07:00
Remi Collet
2fefae4771 Fixed Sec Bug #67717 segfault in dns_get_record CVE-2014-3597
Incomplete fix for CVE-2014-4049

Check possible buffer overflow
- pass real buffer end to dn_expand calls
- check buffer len before each read
2014-08-19 08:33:49 +02:00
Stanislav Malyshev
706aefb781 Fix bug #67730 - Null byte injection possible with imagexxx functions 2014-08-18 22:49:10 -07:00
Stanislav Malyshev
529da0f74c Fixed bug #67717 - segfault in dns_get_record 2014-08-18 22:37:25 -07:00
Lior Kaplan
1504f7d630 Correct typo in comments: 'initialized' 2014-08-17 21:32:53 +03:00
Veres Lajos
3f42f2f5d1 typofixes 2014-08-17 15:44:02 +03:00
Keyur Govande
7bfe9bf951 Merge branch 'pull-request/772' into PHP-5.4
* pull-request/772:
  Fix failing tests
  Patch for bug #67839 (mysqli does not handle 4-byte floats correctly)

Before the patch, a value of 9.99 in a FLOAT column came out of mysqli
as 9.9998998641968. This is because it would naively cast a 4-byte float
into PHP's internal 8-byte double.
To fix this, with GCC we use the built-in decimal support to "up-convert"
the 4-byte float to a 8-byte double.
When that is not available, we fall back to converting the float
to a string and then converting the string to a double. This mimics
what MySQL does.
2014-08-15 23:06:55 +00:00
Remi Collet
7ba1409a1a Fix bug #67716 - Segfault in cdf.c 2014-08-14 17:44:19 -07:00
Remi Collet
35f32637b0 Fix bug #67716 - Segfault in cdf.c 2014-08-14 17:21:20 -07:00
Stanislav Malyshev
eab42649ab fix test 2014-08-14 17:07:28 -07:00
Anatol Belski
b7cd099ae0 split the glob() test to test different basedir 2014-08-14 17:04:51 -07:00
Anatol Belski
ad492ca932 fixed glob() edge case on windows, ref bug #47358 2014-08-14 16:58:16 -07:00
Pierre Joye
481c4715d4 - fix bug #47358, glob returns error, should be empty array()
Conflicts:
	ext/standard/dir.c
2014-08-14 16:56:22 -07:00
Keyur Govande
4e2c01617f Fix failing tests 2014-08-14 18:20:26 +00:00
Keyur Govande
c044164a96 Patch for bug #67839 (mysqli does not handle 4-byte floats correctly)
Before the patch, a value of 9.99 in a FLOAT column came out of mysqli
as 9.9998998641968. This is because it would naively cast a 4-byte float
into PHP's internal 8-byte double.
To fix this, with GCC we use the built-in decimal support to "up-convert"
the 4-byte float to a 8-byte double.
When that is not available, we fall back to converting the float
to a string and then converting the string to a double. This mimics
what MySQL does.
2014-08-14 18:19:56 +00:00
Tjerk Meesters
f6896e4395 Fixed #66091 2014-08-13 20:12:42 +08:00
Anatol Belski
daa1fb8ba6 backported the fix for bug #41577 2014-08-12 11:49:46 +02:00
Ferenc Kovacs
39dd715382 fix the failing date tests introduced with the latest timezonedb update
Derick confirmed on irc that the new/current behavior is the correct and that the tests should be updated to reflect it
2014-08-12 10:34:54 +02:00
Anatol Belski
84a4041ba4 fix TS build 2014-08-07 19:49:59 +02:00
Daniel Lowrey
6569db8808 Bug #41631: Observe socket read timeouts in SSL streams 2014-08-07 11:47:42 -04:00
Derick Rethans
7df4087b98 - Updated to version 2014.6 (2014f) 2014-08-07 10:22:09 +01:00
Andrey Hristov
d72b943262 Add EXPECTF 2014-08-06 15:27:29 +03:00
Andrey Hristov
9444bc7997 Merge branch 'PHP-5.4' of git.php.net:php-src into PHP-5.4 2014-08-06 14:52:55 +03:00
Andrey Hristov
547451796c Fix handling of multi-result sets with PS...used to clean not only
the result set but the whole PS.
2014-08-06 14:52:12 +03:00
Michael Wallner
e4ff7f2ee3 Fixed Bug #67724
(chained zlib filters silently fail with large amounts of data)

Use the same buffer size zlib uses internally to avoid
Z_DATA_ERROR on massively compressed data
2014-08-05 15:44:43 +02:00
Remi Collet
cf4753691d Fixed Bug #66901 php-gd 'c_color' NULL pointer dereference
Upstream 463c3bd09b

Notice: this fix don't manage monochrome/monovisual values
but just fix the security issue CVE-2014-2497
failing when trying to load such an image
2014-08-04 10:42:39 +02:00
Anatol Belski
ae74549239 backport the fix for bug #67739 2014-08-04 09:57:08 +02:00
Stanislav Malyshev
61ec9b5b0f add test 2014-08-04 00:08:08 -07:00
Stanislav Malyshev
eeaec70758 Fix bug #67705 (extensive backtracking in rule regular expression) 2014-08-04 00:05:40 -07:00
Peter Cowburn
358aedc454 Bug #51096 - Remove unnecessary ? for first/last day of 2014-07-31 14:21:38 +01:00
Rasmus Lerdorf
8b9719d8b9 We need to turn off any strict mode here for this warning to show up 2014-07-30 12:22:48 -04:00
Tjerk Meesters
da3add26cf Fixed bug #67693 - incorrect push to the empty array 2014-07-30 18:15:14 +08:00
Keyur Govande
65364fe7d0 Corrected patch for bug #60616
For unixODBC, use ODBC version as defined by it (as of v2.2.14 it is 3.5).
This allows us to use newer features like SQL_DESC_OCTET_LENGTH (which
returns the number of bytes required to store the data). This fixes the issue
in #60616. If the newer version is not available, over-allocate to accomodate
4-byte Unicode characters for CHAR and VARCHAR datatypes (and their Wide
counterparts).
version.
Fixed a couple of failing tests.
2014-07-30 02:28:31 +00:00
Keyur Govande
00546bc9b7 Fix bug #60616 (odbc_fetch_into returns junk at end of multi-byte char fields)
The ODBC extension did not support WVARCHAR. WVARCHAR ends up being handled by
the default handler where vallen is set by the driver to the actual bytes
needed for the field. If it is larger than default-lrl then the output is
corrupted (reading past the buffer) because the return functions don't expect
that to happen. The patch add support to handle WVARCHAR just like a regular
VARCHAR.
2014-07-28 23:15:23 +00:00
Stanislav Malyshev
b4a4db467b Fix missing type checks in various functions 2014-07-27 02:42:49 -07:00