Skip to content

Commit 36122c7

Browse files
author
Yasuo Ohgaki
committed
Merge branch 'PHP-5.5' of git.php.net:php-src into PHP-5.5
* 'PHP-5.5' of git.php.net:php-src: (27 commits) bump version Remove compile warning: warning: unused variable ‘j’ [-Wunused-variable] Remove compile warnings: warning: variable ‘lastch’ set but not used [-Wunused-but-set-variable] warning: variable ‘buf’ set but not used [-Wunused-but-set-variable] Remove compile warning: variable ‘streamp’ set but not used [-Wunused-but-set-variable] Remove compile warnings: variable ‘obj_cnt’ set but not used [-Wunused-but-set-variable] unused variable ‘last’ [-Wunused-variable] unused variable ‘j’ [-Wunused-variable] Remove compile warning "variable ‘mekeylen’ set but not used" Reduce (some more) compile noise of 'unused variable' and 'may be used uninitialized' warnings. Update NEWS Update NEWS fix bug #65481 (shutdown segfault due to serialize) Track created curl_slist structs by option so they can be updated in situ. Fixed bug #64503 (Compilation fails with error: conflicting types for 'zendparse'). Fixed bug #64503 (Compilation fails with error: conflicting types for 'zendparse'). added new glob() test fix using wrong buffer pointer Fix bug #65470 Segmentation fault in zend_error() with --enable-dtrace Fix for php bug #64802 includes test case Use in preg_replace_callback() using variables by reference and test for bug #64979 https://bugs.php.net/bug.php?id=64979 add CVE-2011-4718 ...
2 parents 83e251a + 53d9643 commit 36122c7

34 files changed

+618
-141
lines changed

‎NEWS

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,25 @@
11
PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
3-
?? ??? 2013, PHP 5.5.3
3+
?? ??? 2013, PHP 5.5.4
44

55
- Core:
6+
. Fixed bug #65470 (Segmentation fault in zend_error() with
7+
--enable-dtrace). (Chris Jones, Kris Van Hees)
8+
. Fixed bug #65225 (PHP_BINARY incorrectly set). (Patrick Allaert)
69
. Fixed bug #62692 (PHP fails to build with DTrace). (Chris Jones, Kris Van Hees)
710

11+
- cURL:
12+
. Fixed bug #65458 (curl memory leak). (Adam)
13+
14+
- Openssl:
15+
. Fixed bug #64802 (openssl_x509_parse fails to parse subject properly in
16+
some cases). (Mark Jones)
17+
18+
22 Aug 2013, PHP 5.5.3
19+
20+
- Openssl:
21+
. Fixed UMR in fix for CVE-2013-4248.
22+
823
15 Aug 2013, PHP 5.5.2
924

1025
- Core:
@@ -52,7 +67,7 @@ PHP NEWS
5267
- Sessions:
5368
. Implemented strict sessions RFC (https://wiki.php.net/rfc/strict_sessions)
5469
which protects against session fixation attacks and session collisions.
55-
(Yasuo Ohgaki)
70+
(CVE-2011-4718). (Yasuo Ohgaki)
5671
. Fixed possible buffer overflow under Windows. Note: Not a security fix.
5772
(Yasuo)
5873
. Changed session.auto_start to PHP_INI_PERDIR. (Yasuo)

‎Zend/tests/bug64979.phpt

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
--TEST--
2+
Bug #64578 (Closures with static variables can be generators)
3+
--XFAIL--
4+
Bug #64979 not fixed yet.
5+
--FILE--
6+
<?php
7+
8+
function new_closure_gen() {
9+
return function() {
10+
static $foo = 0;
11+
yield ++$foo;
12+
};
13+
}
14+
15+
$closure1 = new_closure_gen();
16+
$closure2 = new_closure_gen();
17+
18+
$gen1 = $closure1();
19+
$gen2 = $closure1();
20+
$gen3 = $closure2();
21+
22+
foreach (array($gen1, $gen2, $gen3) as $gen) {
23+
foreach ($gen as $val) {
24+
print "$val\n";
25+
}
26+
}
27+
28+
?>
29+
--EXPECT--
30+
int(1)
31+
int(2)
32+
int(1)

‎Zend/tests/closure_047.phpt

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
--TEST--
2+
Closure 047: Use in preg_replace_callback() using variables by reference
3+
--FILE--
4+
<?php
5+
6+
function replace_variables($text, $params) {
7+
8+
preg_replace_callback( '/(\?)/', function($matches) use (&$params, &$text) {
9+
10+
$text = preg_replace( '/(\?)/', array_shift( $params ), $text, 1 );
11+
12+
}, $text );
13+
14+
return $text;
15+
}
16+
17+
echo replace_variables('a=?', array('0')) . "\n";
18+
echo replace_variables('a=?, b=?', array('0', '1')) . "\n";
19+
echo replace_variables('a=?, b=?, c=?', array('0', '1', '2')) . "\n";
20+
echo "Done\n";
21+
?>
22+
--EXPECT--
23+
a=0
24+
a=0, b=1
25+
a=0, b=1, c=2
26+
Done

‎Zend/tests/closure_048.phpt

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
--TEST--
2+
Closure 048: Use in preg_replace_callback() using variables by reference
3+
--FILE--
4+
<?php
5+
6+
function replace_variables($text, $params) {
7+
8+
$c = function($matches) use (&$params, &$text) {
9+
$text = preg_replace( '/(\?)/', array_shift( $params ), $text, 1 );
10+
};
11+
12+
preg_replace_callback( '/(\?)/', $c, $text );
13+
14+
return $text;
15+
}
16+
17+
echo replace_variables('a=?', array('0')) . "\n";
18+
echo replace_variables('a=?, b=?', array('0', '1')) . "\n";
19+
echo replace_variables('a=?, b=?, c=?', array('0', '1', '2')) . "\n";
20+
echo "Done\n";
21+
?>
22+
--EXPECT--
23+
a=0
24+
a=0, b=1
25+
a=0, b=1, c=2
26+
Done

‎Zend/zend.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1092,17 +1092,19 @@ ZEND_API void zend_error(int type, const char *format, ...) /* {{{ */
10921092
error_filename = "Unknown";
10931093
}
10941094

1095-
va_start(args, format);
1096-
10971095
#ifdef HAVE_DTRACE
10981096
if(DTRACE_ERROR_ENABLED()) {
10991097
char *dtrace_error_buffer;
1098+
va_start(args, format);
11001099
zend_vspprintf(&dtrace_error_buffer, 0, format, args);
11011100
DTRACE_ERROR(dtrace_error_buffer, (char *)error_filename, error_lineno);
11021101
efree(dtrace_error_buffer);
1102+
va_end(args);
11031103
}
11041104
#endif /* HAVE_DTRACE */
11051105

1106+
va_start(args, format);
1107+
11061108
/* if we don't have a user defined error handler */
11071109
if (!EG(user_error_handler)
11081110
|| !(EG(user_error_handler_error_reporting) & type)

‎configure.in

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
119119

120120
PHP_MAJOR_VERSION=5
121121
PHP_MINOR_VERSION=5
122-
PHP_RELEASE_VERSION=2
122+
PHP_RELEASE_VERSION=4
123123
PHP_EXTRA_VERSION="-dev"
124124
PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
125125
PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

‎ext/bz2/bz2_filter.c

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -215,15 +215,13 @@ static php_stream_filter_status_t php_bz2_compress_filter(
215215
size_t consumed = 0;
216216
int status;
217217
php_stream_filter_status_t exit_status = PSFS_FEED_ME;
218-
bz_stream *streamp;
219218

220219
if (!thisfilter || !thisfilter->abstract) {
221220
/* Should never happen */
222221
return PSFS_ERR_FATAL;
223222
}
224223

225224
data = (php_bz2_filter_data *)(thisfilter->abstract);
226-
streamp = &(data->strm);
227225

228226
while (buckets_in->head) {
229227
size_t bin = 0, desired;

‎ext/curl/interface.c

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1717,9 +1717,9 @@ static void curl_free_post(void **post)
17171717

17181718
/* {{{ curl_free_slist
17191719
*/
1720-
static void curl_free_slist(void **slist)
1720+
static void curl_free_slist(void *slist)
17211721
{
1722-
curl_slist_free_all((struct curl_slist *) *slist);
1722+
curl_slist_free_all(*((struct curl_slist **) slist));
17231723
}
17241724
/* }}} */
17251725

@@ -1790,9 +1790,11 @@ static void alloc_curl_handle(php_curl **ch)
17901790
(*ch)->handlers->read->stream = NULL;
17911791

17921792
zend_llist_init(&(*ch)->to_free->str, sizeof(char *), (llist_dtor_func_t) curl_free_string, 0);
1793-
zend_llist_init(&(*ch)->to_free->slist, sizeof(struct curl_slist), (llist_dtor_func_t) curl_free_slist, 0);
17941793
zend_llist_init(&(*ch)->to_free->post, sizeof(struct HttpPost), (llist_dtor_func_t) curl_free_post, 0);
17951794
(*ch)->safe_upload = 0; /* for now, for BC reason we allow unsafe API */
1795+
1796+
(*ch)->to_free->slist = emalloc(sizeof(HashTable));
1797+
zend_hash_init((*ch)->to_free->slist, 4, NULL, curl_free_slist, 0);
17961798
}
17971799
/* }}} */
17981800

@@ -2043,6 +2045,7 @@ PHP_FUNCTION(curl_copy_handle)
20432045
}
20442046
#endif
20452047

2048+
efree(dupch->to_free->slist);
20462049
efree(dupch->to_free);
20472050
dupch->to_free = ch->to_free;
20482051

@@ -2438,7 +2441,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
24382441

24392442
ph = HASH_OF(*zvalue);
24402443
if (!ph) {
2441-
char *name;
2444+
char *name = NULL;
24422445
switch (option) {
24432446
case CURLOPT_HTTPHEADER:
24442447
name = "CURLOPT_HTTPHEADER";
@@ -2488,7 +2491,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
24882491
return 1;
24892492
}
24902493
}
2491-
zend_llist_add_element(&ch->to_free->slist, &slist);
2494+
zend_hash_index_update(ch->to_free->slist, (ulong) option, &slist, sizeof(struct curl_slist *), NULL);
24922495

24932496
error = curl_easy_setopt(ch->cp, option, slist);
24942497

@@ -3266,8 +3269,9 @@ static void _php_curl_close_ex(php_curl *ch TSRMLS_DC)
32663269
/* cURL destructors should be invoked only by last curl handle */
32673270
if (Z_REFCOUNT_P(ch->clone) <= 1) {
32683271
zend_llist_clean(&ch->to_free->str);
3269-
zend_llist_clean(&ch->to_free->slist);
32703272
zend_llist_clean(&ch->to_free->post);
3273+
zend_hash_destroy(ch->to_free->slist);
3274+
efree(ch->to_free->slist);
32713275
efree(ch->to_free);
32723276
FREE_ZVAL(ch->clone);
32733277
} else {

‎ext/curl/php_curl.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@ struct _php_curl_send_headers {
168168
struct _php_curl_free {
169169
zend_llist str;
170170
zend_llist post;
171-
zend_llist slist;
171+
HashTable *slist;
172172
};
173173

174174
typedef struct {

‎ext/curl/tests/bug65458.phpt

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
--TEST--
2+
Bug #65458 (curl memory leak)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('curl')) exit("skip curl extension not loaded");
6+
?>
7+
--FILE--
8+
<?php
9+
$ch = curl_init();
10+
$init = memory_get_usage();
11+
for ($i = 0; $i < 10000; $i++) {
12+
curl_setopt($ch, CURLOPT_HTTPHEADER, [ "SOAPAction: getItems" ]);
13+
}
14+
15+
$preclose = memory_get_usage();
16+
curl_close($ch);
17+
18+
// This is a slightly tricky heuristic, but basically, we want to ensure
19+
// $preclose - $init has a delta in the order of bytes, not megabytes. Given
20+
// the number of iterations in the loop, if we're wasting memory here, we
21+
// should have megs and megs of extra allocations.
22+
var_dump(($preclose - $init) < 10000);
23+
?>
24+
--EXPECT--
25+
bool(true)

‎ext/ftp/ftp.c

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -790,7 +790,6 @@ int
790790
ftp_get(ftpbuf_t *ftp, php_stream *outstream, const char *path, ftptype_t type, long resumepos TSRMLS_DC)
791791
{
792792
databuf_t *data = NULL;
793-
int lastch;
794793
size_t rcvd;
795794
char arg[11];
796795

@@ -828,7 +827,6 @@ ftp_get(ftpbuf_t *ftp, php_stream *outstream, const char *path, ftptype_t type,
828827
goto bail;
829828
}
830829

831-
lastch = 0;
832830
while ((rcvd = my_recv(ftp, data->fd, data->buf, FTP_BUFSIZE))) {
833831
if (rcvd == -1) {
834832
goto bail;
@@ -1187,12 +1185,9 @@ ftp_readline(ftpbuf_t *ftp)
11871185
int
11881186
ftp_getresp(ftpbuf_t *ftp)
11891187
{
1190-
char *buf;
1191-
11921188
if (ftp == NULL) {
11931189
return 0;
11941190
}
1195-
buf = ftp->inbuf;
11961191
ftp->resp = 0;
11971192

11981193
while (1) {

‎ext/intl/calendar/calendar_methods.cpp

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,6 @@ U_CFUNC PHP_FUNCTION(intlcal_get_keyword_values_for_locale)
184184

185185
U_CFUNC PHP_FUNCTION(intlcal_get_now)
186186
{
187-
UErrorCode status = U_ZERO_ERROR;
188187
intl_error_reset(NULL TSRMLS_CC);
189188

190189
if (zend_parse_parameters_none() == FAILURE) {

‎ext/intl/calendar/gregoriancalendar_methods.cpp

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ static inline GregorianCalendar *fetch_greg(Calendar_object *co) {
3838

3939
static void _php_intlgregcal_constructor_body(INTERNAL_FUNCTION_PARAMETERS)
4040
{
41-
zval *object = getThis();
4241
zval **tz_object = NULL;
4342
zval **args_a[6] = {0},
4443
***args = &args_a[0];
@@ -84,7 +83,7 @@ static void _php_intlgregcal_constructor_body(INTERNAL_FUNCTION_PARAMETERS)
8483
}
8584

8685
// instantion of ICU object
87-
GregorianCalendar *gcal;
86+
GregorianCalendar *gcal = NULL;
8887

8988
if (variant <= 2) {
9089
// From timezone and locale (0 to 2 arguments)

‎ext/intl/msgformat/msgformat_helpers.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -487,7 +487,7 @@ U_CFUNC void umsg_format_helper(MessageFormatter_object *mfo,
487487
}
488488
case Formattable::kLong:
489489
{
490-
int32_t tInt32;
490+
int32_t tInt32 = 0;
491491
retry_klong:
492492
if (Z_TYPE_PP(elem) == IS_DOUBLE) {
493493
if (Z_DVAL_PP(elem) > (double)INT32_MAX ||
@@ -517,7 +517,7 @@ U_CFUNC void umsg_format_helper(MessageFormatter_object *mfo,
517517
}
518518
case Formattable::kInt64:
519519
{
520-
int64_t tInt64;
520+
int64_t tInt64 = 0;
521521
retry_kint64:
522522
if (Z_TYPE_PP(elem) == IS_DOUBLE) {
523523
if (Z_DVAL_PP(elem) > (double)U_INT64_MAX ||

‎ext/intl/resourcebundle/resourcebundle_class.c

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,6 @@ static void resourcebundle_array_fetch(zval *object, zval *offset, zval *return_
163163
{
164164
int32_t meindex = 0;
165165
char * mekey = NULL;
166-
long mekeylen;
167166
zend_bool is_numeric = 0;
168167
char *pbuf;
169168
ResourceBundle_object *rb;
@@ -177,7 +176,6 @@ static void resourcebundle_array_fetch(zval *object, zval *offset, zval *return_
177176
rb->child = ures_getByIndex( rb->me, meindex, rb->child, &INTL_DATA_ERROR_CODE(rb) );
178177
} else if(Z_TYPE_P(offset) == IS_STRING) {
179178
mekey = Z_STRVAL_P(offset);
180-
mekeylen = Z_STRLEN_P(offset);
181179
rb->child = ures_getByKey(rb->me, mekey, rb->child, &INTL_DATA_ERROR_CODE(rb) );
182180
} else {
183181
intl_errors_set(INTL_DATA_ERROR_P(rb), U_ILLEGAL_ARGUMENT_ERROR,

0 commit comments

Comments
 (0)