Skip to content

Commit 0496f54

Browse files
smalyshevsmalyshev
committed
Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6: Update NEWS Fix bug #74087 Fixed parsing of strange formats with mixed month/day and time strings Fix bug #74145 - wddx parsing empty boolean tag leads to SIGSEGV Fixed bug #74111 Fix #74435: Buffer over-read into uninitialized memory Fix bug #74603 - use correct buffer size Fix bug #74651 - check EVP_SealInit as it can return -1 Update NEWS Fix bug #73807
2 parents 3a25a56 + 12107d6 commit 0496f54

File tree

10 files changed

+5623
-6462
lines changed

10 files changed

+5623
-6462
lines changed

‎ext/date/lib/parse_date.c

Lines changed: 5550 additions & 6454 deletions
Large diffs are not rendered by default.

‎ext/date/lib/parse_date.re

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -899,7 +899,7 @@ datefull = day ([ \t.-])* monthtext ([ \t.-])* year;
899899
datenoday = monthtext ([ .\t-])* year4;
900900
datenodayrev = year4 ([ .\t-])* monthtext;
901901
datetextual = monthtext ([ .\t-])* day [,.stndrh\t ]+ year;
902-
datenoyear = monthtext ([ .\t-])* day [,.stndrh\t ]*;
902+
datenoyear = monthtext ([ .\t-])* day ([,.stndrh\t ]+|[\000]);
903903
datenoyearrev = day ([ .\t-])* monthtext;
904904
datenocolon = year4 monthlz daylz;
905905

‎ext/gd/libgd/gd_gif_in.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,9 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd) /* {{{ */
147147
int haveGlobalColormap;
148148
gdImagePtr im = 0;
149149

150+
memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE);
151+
memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE);
152+
150153
/*1.4//imageNumber = 1; */
151154
if (! ReadOK(fd,buf,6)) {
152155
return 0;

‎ext/gd/tests/bug74435.gif

11.2 KB
Loading

‎ext/gd/tests/bug74435.phpt

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
--TEST--
2+
Bug #74435 (Buffer over-read into uninitialized memory)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('gd')) die('skip gd extension not available');
6+
?>
7+
--FILE--
8+
<?php
9+
$im = imagecreatefromgif(__DIR__ . DIRECTORY_SEPARATOR . 'bug74435.gif');
10+
var_dump($im);
11+
$width = imagesx($im);
12+
$height = imagesy($im);
13+
for ($i = 0; $i < $width; $i += 16) {
14+
for ($j = 0; $j < $height; $j += 16) {
15+
if (($index = imagecolorat($im, $i, $j)) >= 2) {
16+
list($red, $green, $blue, $alpha) = array_values(imagecolorsforindex($im, $index));
17+
if ($red !== 0 || $green !== 0 || $blue !== 0 || $alpha !== 0) {
18+
echo "unexpected color at ($i, $j)\n";
19+
}
20+
}
21+
}
22+
}
23+
?>
24+
===DONE===
25+
--EXPECTF--
26+
resource(%d) of type (gd)
27+
===DONE===

‎ext/pcre/pcrelib/pcre_jit_compile.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7307,7 +7307,7 @@ if (opcode == OP_COND || opcode == OP_SCOND)
73077307

73087308
if (*matchingpath == OP_FAIL)
73097309
stacksize = 0;
7310-
if (*matchingpath == OP_RREF)
7310+
else if (*matchingpath == OP_RREF)
73117311
{
73127312
stacksize = GET2(matchingpath, 1);
73137313
if (common->currententry == NULL)

‎ext/standard/tests/serialize/bug74111.phpt

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
--TEST--
2+
Bug #74111: Heap buffer overread (READ: 1) finish_nested_data from unserialize
3+
--FILE--
4+
<?php
5+
$s = 'O:8:"stdClass":00000000';
6+
var_dump(unserialize($s));
7+
?>
8+
--EXPECTF--
9+
Notice: unserialize(): Error at offset 25 of 23 bytes in %s on line %d
10+
bool(false)

‎ext/wddx/tests/bug74145.phpt

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
Bug #74145 (wddx parsing empty boolean tag leads to SIGSEGV)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded("wddx")) print "skip";
6+
?>
7+
--FILE--
8+
<?php
9+
$data = file_get_contents(__DIR__ . '/bug74145.xml');
10+
$wddx = wddx_deserialize($data);
11+
var_dump($wddx);
12+
?>
13+
DONE
14+
--EXPECTF--
15+
NULL
16+
DONE

‎ext/wddx/tests/bug74145.xml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<?xml version='1.0' ?>
2+
<!DOCTYPE et SYSTEM 'w'>
3+
<wddxPacket ven='1.0'>
4+
<array>
5+
<var Name="name">
6+
<boolean ></boolean>
7+
</var>
8+
</array>
9+
</wddxPacket>

‎ext/wddx/wddx.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -761,20 +761,20 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
761761
} else if (!strcmp((char *)name, EL_BOOLEAN)) {
762762
int i;
763763

764+
ALLOC_ZVAL(ent.data);
765+
INIT_PZVAL(ent.data);
766+
Z_TYPE_P(ent.data) = IS_BOOL;
767+
ent.type = ST_BOOLEAN;
768+
SET_STACK_VARNAME;
764769
if (atts) for (i = 0; atts[i]; i++) {
765770
if (!strcmp((char *)atts[i], EL_VALUE) && atts[i+1] && atts[i+1][0]) {
766-
ent.type = ST_BOOLEAN;
767-
SET_STACK_VARNAME;
768-
769771
ZVAL_TRUE(&ent.data);
770772
wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry));
771773
php_wddx_process_data(user_data, atts[i+1], strlen((char *)atts[i+1]));
772774
break;
773775
}
774776
} else {
775-
ent.type = ST_BOOLEAN;
776-
SET_STACK_VARNAME;
777-
ZVAL_FALSE(&ent.data);
777+
ZVAL_FALSE(ent.data);
778778
wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry));
779779
}
780780
} else if (!strcmp((char *)name, EL_NULL)) {

0 commit comments

Comments
 (0)