Skip to content

Commit 226e21b

Browse files
laruencelaruence
committed
Merge branch 'PHP-5.6' of git.php.net:/php-src into PHP-5.6
* 'PHP-5.6' of git.php.net:/php-src: Improvements to fix #72714, suggested by nikic Fix #65732: grapheme_*() is not Unicode compliant on CR LF sequence Fix #72714: _xml_startElementHandler() segmentation fault update NEWS Fixed bug #72852 imap_mail null dereference Revert "Fix dba configuration for Windows" Fix dba configuration for Windows Fix broken test include fix NEWS Add myself as PDO_OCI maintainer
2 parents b740bb3 + 52793c1 commit 226e21b

File tree

7 files changed

+76
-14
lines changed

7 files changed

+76
-14
lines changed

‎EXTENSIONS

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -205,7 +205,7 @@ STATUS: Working
205205
SINCE: 5.1
206206
-------------------------------------------------------------------------------
207207
EXTENSION: pdo_oci
208-
PRIMARY MAINTAINER: Unknown
208+
PRIMARY MAINTAINER: Christopher Jones <sixd@php.net>
209209
MAINTENANCE: Odd fixes
210210
STATUS: Working
211211
SINCE: 5.1

‎ext/dba/tests/dba_handler.inc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ do {
4040
}
4141
if ($handler != 'cdb') {
4242
$db_writer = dba_open($db_filename, 'c'.$lock_flag, $handler);
43-
if (($dba_reader = @dba_open($db_filename, 'r'.$lock_flag.($lock_flag ? 't' : ''), $handler))===false) {
43+
if (($dba_reader = @dba_open($db_filename, 'r'.$lock_flag.'t', $handler))===false) {
4444
echo "Read during write: not allowed\n";
4545
} else {
4646
echo "Read during write: allowed\n";

‎ext/imap/php_imap.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3922,7 +3922,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
39223922
bt_len++;
39233923
offset = 0;
39243924
addr = NULL;
3925-
rfc822_parse_adrlist(&addr, tempMailTo, NULL);
3925+
rfc822_parse_adrlist(&addr, tempMailTo, "NO HOST");
39263926
while (addr) {
39273927
if (addr->host == NULL || strcmp(addr->host, ERRHOST) == 0) {
39283928
PHP_IMAP_BAD_DEST;
@@ -3951,7 +3951,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
39513951
bt_len++;
39523952
offset = 0;
39533953
addr = NULL;
3954-
rfc822_parse_adrlist(&addr, tempMailTo, NULL);
3954+
rfc822_parse_adrlist(&addr, tempMailTo, "NO HOST");
39553955
while (addr) {
39563956
if (addr->host == NULL || strcmp(addr->host, ERRHOST) == 0) {
39573957
PHP_IMAP_BAD_DEST;
@@ -3977,7 +3977,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
39773977
bt_len++;
39783978
offset = 0;
39793979
addr = NULL;
3980-
rfc822_parse_adrlist(&addr, tempMailTo, NULL);
3980+
rfc822_parse_adrlist(&addr, tempMailTo, "NO HOST");
39813981
while (addr) {
39823982
if (addr->host == NULL || strcmp(addr->host, ERRHOST) == 0) {
39833983
PHP_IMAP_BAD_DEST;

‎ext/intl/grapheme/grapheme_util.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -221,7 +221,7 @@ int grapheme_ascii_check(const unsigned char *day, int32_t len)
221221
{
222222
int ret_len = len;
223223
while ( len-- ) {
224-
if ( *day++ > 0x7f )
224+
if ( *day++ > 0x7f || (*day == '\n' && *(day - 1) == '\r') )
225225
return -1;
226226
}
227227

‎ext/intl/tests/bug65732.phpt

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
--TEST--
2+
Bug #65732 (grapheme_*() is not Unicode compliant on CR LF sequence)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('intl')) die('skip intl extension not available');
6+
?>
7+
--FILE--
8+
<?php
9+
var_dump(grapheme_strlen("\r\n"));
10+
var_dump(grapheme_substr(implode("\r\n", ['abc', 'def', 'ghi']), 5));
11+
var_dump(grapheme_strrpos("a\r\nb", 'b'));
12+
?>
13+
==DONE==
14+
--EXPECT--
15+
int(1)
16+
string(7) "ef
17+
ghi"
18+
int(2)
19+
==DONE==

‎ext/xml/tests/bug72714.phpt

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
--TEST--
2+
Bug #72714 (_xml_startElementHandler() segmentation fault)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('xml')) die('skip xml extension not available');
6+
?>
7+
--FILE--
8+
<?php
9+
function startElement($parser, $name, $attribs) {
10+
var_dump($name);
11+
}
12+
13+
function endElement($parser, $name) {}
14+
15+
function parse($tagstart) {
16+
$xml = '<ns1:total>867</ns1:total>';
17+
18+
$xml_parser = xml_parser_create();
19+
xml_set_element_handler($xml_parser, 'startElement', 'endElement');
20+
21+
xml_parser_set_option($xml_parser, XML_OPTION_SKIP_TAGSTART, $tagstart);
22+
xml_parse($xml_parser, $xml);
23+
24+
xml_parser_free($xml_parser);
25+
}
26+
27+
parse(3015809298423721);
28+
parse(20);
29+
?>
30+
===DONE===
31+
--EXPECTF--
32+
Notice: xml_parser_set_option(): tagstart ignored, because it is out of range in %s%ebug72714.php on line %d
33+
string(9) "NS1:TOTAL"
34+
string(0) ""
35+
===DONE===

‎ext/xml/xml.c

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,10 @@ ZEND_GET_MODULE(xml)
6666
#endif /* COMPILE_DL_XML */
6767
/* }}} */
6868

69+
70+
#define SKIP_TAGSTART(str) ((str) + (parser->toffset > strlen(str) ? strlen(str) : parser->toffset))
71+
72+
6973
/* {{{ function prototypes */
7074
PHP_MINIT_FUNCTION(xml);
7175
PHP_MINFO_FUNCTION(xml);
@@ -785,7 +789,7 @@ void _xml_startElementHandler(void *userData, const XML_Char *name, const XML_Ch
785789

786790
if (parser->startElementHandler) {
787791
args[0] = _xml_resource_zval(parser->index);
788-
args[1] = _xml_string_zval(((char *) tag_name) + parser->toffset);
792+
args[1] = _xml_string_zval(SKIP_TAGSTART((char *) tag_name));
789793
MAKE_STD_ZVAL(args[2]);
790794
array_init(args[2]);
791795

@@ -816,9 +820,9 @@ void _xml_startElementHandler(void *userData, const XML_Char *name, const XML_Ch
816820
array_init(tag);
817821
array_init(atr);
818822

819-
_xml_add_to_info(parser,((char *) tag_name) + parser->toffset);
823+
_xml_add_to_info(parser,SKIP_TAGSTART((char *) tag_name));
820824

821-
add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */
825+
add_assoc_string(tag,"tag",SKIP_TAGSTART((char *) tag_name),1);
822826
add_assoc_string(tag,"type","open",1);
823827
add_assoc_long(tag,"level",parser->level);
824828

@@ -870,7 +874,7 @@ void _xml_endElementHandler(void *userData, const XML_Char *name)
870874

871875
if (parser->endElementHandler) {
872876
args[0] = _xml_resource_zval(parser->index);
873-
args[1] = _xml_string_zval(((char *) tag_name) + parser->toffset);
877+
args[1] = _xml_string_zval(SKIP_TAGSTART((char *) tag_name));
874878

875879
if ((retval = xml_call_handler(parser, parser->endElementHandler, parser->endElementPtr, 2, args))) {
876880
zval_ptr_dtor(&retval);
@@ -887,9 +891,9 @@ void _xml_endElementHandler(void *userData, const XML_Char *name)
887891

888892
array_init(tag);
889893

890-
_xml_add_to_info(parser,((char *) tag_name) + parser->toffset);
894+
_xml_add_to_info(parser,SKIP_TAGSTART((char *) tag_name));
891895

892-
add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */
896+
add_assoc_string(tag,"tag",SKIP_TAGSTART((char *) tag_name),1);
893897
add_assoc_string(tag,"type","close",1);
894898
add_assoc_long(tag,"level",parser->level);
895899

@@ -990,9 +994,9 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
990994

991995
array_init(tag);
992996

993-
_xml_add_to_info(parser,parser->ltags[parser->level-1] + parser->toffset);
997+
_xml_add_to_info(parser,SKIP_TAGSTART(parser->ltags[parser->level-1]));
994998

995-
add_assoc_string(tag,"tag",parser->ltags[parser->level-1] + parser->toffset,1);
999+
add_assoc_string(tag,"tag",SKIP_TAGSTART(parser->ltags[parser->level-1]),1);
9961000
add_assoc_string(tag,"value",decoded_value,0);
9971001
add_assoc_string(tag,"type","cdata",1);
9981002
add_assoc_long(tag,"level",parser->level);
@@ -1633,6 +1637,10 @@ PHP_FUNCTION(xml_parser_set_option)
16331637
case PHP_XML_OPTION_SKIP_TAGSTART:
16341638
convert_to_long_ex(val);
16351639
parser->toffset = Z_LVAL_PP(val);
1640+
if (parser->toffset < 0) {
1641+
php_error_docref(NULL TSRMLS_CC, E_NOTICE, "tagstart ignored, because it is out of range");
1642+
parser->toffset = 0;
1643+
}
16361644
break;
16371645
case PHP_XML_OPTION_SKIP_WHITE:
16381646
convert_to_long_ex(val);

0 commit comments

Comments
 (0)