Merge branch '5.4'

8 files changed, 74 insertions, 4 deletions

diff --git a/ext/intl/collator/collator_sort.c b/ext/intl/collator/collator_sort.c
index 76ee8186c9..04a24f013e 100755
--- a/ext/intl/collator/collator_sort.c
+++ b/ext/intl/collator/collator_sort.c
@@ -595,6 +595,8 @@ PHP_FUNCTION( collator_get_sort_key )
 		RETURN_FALSE;
 	}
 
+	/* ucol_getSortKey is exception in that the key length includes the 
+	 * NUL terminator*/
 	key_len = ucol_getSortKey(co->ucoll, ustr, ustr_len, key, 0);
 	if(!key_len) {
 		efree( ustr );
@@ -606,7 +608,7 @@ PHP_FUNCTION( collator_get_sort_key )
 	if(!key_len) {
 		RETURN_FALSE;
 	}
-	RETURN_STRINGL((char *)key, key_len, 0);
+	RETURN_STRINGL((char *)key, key_len - 1, 0);
 }
 /* }}} */
 
diff --git a/ext/intl/dateformat/dateformat.c b/ext/intl/dateformat/dateformat.c
index 6f7432254c..05ba19e7de 100755
--- a/ext/intl/dateformat/dateformat.c
+++ b/ext/intl/dateformat/dateformat.c
@@ -100,6 +100,13 @@ static void datefmt_ctor(INTERNAL_FUNCTION_PARAMETERS)
 
 	INTL_CHECK_LOCALE_LEN_OBJ(locale_len, return_value);
 	DATE_FORMAT_METHOD_FETCH_OBJECT;
+	
+	if (DATE_FORMAT_OBJECT(dfo) != NULL) {
+		intl_errors_set(INTL_DATA_ERROR_P(dfo), U_ILLEGAL_ARGUMENT_ERROR,
+				"datefmt_create: cannot call constructor twice", 0 TSRMLS_CC);
+		return;
+	}
+	
 	/* Convert pattern (if specified) to UTF-16. */
 	if( pattern_str && pattern_str_len>0 ){
 		intl_convert_utf8_to_utf16(&svalue, &slength, pattern_str, pattern_str_len, &INTL_DATA_ERROR_CODE(dfo));
@@ -169,6 +176,8 @@ PHP_FUNCTION( datefmt_create )
  */
 PHP_METHOD( IntlDateFormatter, __construct )
 {
+	/* return_value param is being changed, therefore we will always return
+	 * NULL here */
 	return_value = getThis();
 	datefmt_ctor(INTERNAL_FUNCTION_PARAM_PASSTHRU);
 }
diff --git a/ext/intl/grapheme/grapheme_string.c b/ext/intl/grapheme/grapheme_string.c
index 692e2f80b0..475bbe4184 100755
--- a/ext/intl/grapheme/grapheme_string.c
+++ b/ext/intl/grapheme/grapheme_string.c
@@ -822,6 +822,7 @@ PHP_FUNCTION(grapheme_extract)
 		}
 		else {
 			/* initialize next */
+			zval_dtor(next);
             ZVAL_LONG(next, lstart);
 		}
 	}
diff --git a/ext/intl/locale/locale_methods.c b/ext/intl/locale/locale_methods.c
index 8cc33cd74c..466dba1f20 100755
--- a/ext/intl/locale/locale_methods.c
+++ b/ext/intl/locale/locale_methods.c
@@ -532,7 +532,7 @@ static void get_icu_disp_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAME
 
     /* Get the disp_value for the given locale */
     do{
-        disp_name = erealloc( disp_name , buflen  );
+        disp_name = erealloc( disp_name , buflen * sizeof(UChar)  );
         disp_name_len = buflen;
 
 		if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
@@ -547,6 +547,7 @@ static void get_icu_disp_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAME
 			buflen = uloc_getDisplayName ( mod_loc_name , disp_loc_name , disp_name , disp_name_len , &status);
 		}
 
+		/* U_STRING_NOT_TERMINATED_WARNING is admissible here; don't look for it */
 		if( U_FAILURE( status ) )
 		{
 			if( status == U_BUFFER_OVERFLOW_ERROR )
@@ -1567,11 +1568,11 @@ PHP_FUNCTION(locale_lookup)
 /* }}} */
 
 /* {{{ proto string Locale::acceptFromHttp(string $http_accept)
-* Tries to find out best available locale based on HTTP “Accept-Language” header
+* Tries to find out best available locale based on HTTP �Accept-Language� header
 */
 /* }}} */
 /* {{{ proto string locale_accept_from_http(string $http_accept)
-* Tries to find out best available locale based on HTTP “Accept-Language” header
+* Tries to find out best available locale based on HTTP �Accept-Language� header
 */
 PHP_FUNCTION(locale_accept_from_http)
 {
diff --git a/ext/intl/tests/bug62070.phpt b/ext/intl/tests/bug62070.phpt
new file mode 100644
index 0000000000..a466b05c24
--- /dev/null
+++ b/ext/intl/tests/bug62070.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #62070: Collator::getSortKey() returns garbage
+--SKIPIF--
+<?php
+if (!extension_loaded('intl'))
+	die('skip intl extension not enabled');
+--FILE--
+<?php
+$s1 = 'Hello';
+
+$coll = collator_create('en_US');
+$res = collator_get_sort_key($coll, $s1);
+
+echo urlencode($res);
+--EXPECT--
+5%2F%3D%3DC%01%09%01%8F%08
diff --git a/ext/intl/tests/bug62081.phpt b/ext/intl/tests/bug62081.phpt
new file mode 100644
index 0000000000..7d9e2cec47
--- /dev/null
+++ b/ext/intl/tests/bug62081.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #62081: IntlDateFormatter leaks memory if called twice
+--SKIPIF--
+<?php
+if (!extension_loaded('intl'))
+	die('skip intl extension not enabled');
+--FILE--
+<?php
+ini_set('intl.error_level', E_WARNING);
+$x = new IntlDateFormatter(1,1,1,1,1);
+var_dump($x->__construct(1,1,1,1,1));
+--EXPECTF--
+Warning: IntlDateFormatter::__construct(): datefmt_create: cannot call constructor twice in %s on line %d
+NULL
diff --git a/ext/intl/tests/bug62082.phpt b/ext/intl/tests/bug62082.phpt
new file mode 100644
index 0000000000..e6ca73e300
--- /dev/null
+++ b/ext/intl/tests/bug62082.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #62082: Memory corruption in internal get_icu_disp_value_src_php()
+--SKIPIF--
+<?php
+if (!extension_loaded('intl'))
+	die('skip intl extension not enabled');
+--FILE--
+<?php
+var_dump(locale_get_display_name(str_repeat("a", 300), null));
+var_dump(locale_get_display_name(str_repeat("a", 512), null));
+var_dump(locale_get_display_name(str_repeat("a", 600), null));
+--EXPECT--
+string(300) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+string(512) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+string(600) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
diff --git a/ext/intl/tests/bug62083.phpt b/ext/intl/tests/bug62083.phpt
new file mode 100644
index 0000000000..4baa5c5e9a
--- /dev/null
+++ b/ext/intl/tests/bug62083.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #62083: grapheme_extract() leaks memory
+--SKIPIF--
+<?php
+if (!extension_loaded('intl'))
+	die('skip intl extension not enabled');
+--FILE--
+<?php
+$arr1 = array();
+var_dump(grapheme_extract(-1, -1, -1,-1, $arr1));
+--EXPECT--
+bool(false)