summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--NEWS14
-rw-r--r--configure.in2
-rw-r--r--ext/fileinfo/data_file.c2
-rw-r--r--ext/fileinfo/libmagic/softmagic.c29
-rw-r--r--ext/fileinfo/magicdata.patch62
-rw-r--r--ext/fileinfo/tests/cve-2014-3538.phpt35
-rw-r--r--ext/gd/libgd/gdxpm.c7
-rw-r--r--ext/standard/info.c8
-rw-r--r--ext/zlib/tests/bug67724.gz.gzbin0 -> 171 bytes
-rw-r--r--ext/zlib/tests/bug67724.phpt26
-rw-r--r--ext/zlib/zlib_filter.c3
-rw-r--r--main/php_version.h6
12 files changed, 167 insertions, 27 deletions
diff --git a/NEWS b/NEWS
index 32da757bb3..7e0c0f6d03 100644
--- a/NEWS
+++ b/NEWS
@@ -1,10 +1,20 @@
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+?? ??? 2014, PHP 5.4.33
+
?? ??? 2014, PHP 5.4.32
- COM:
. Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas).
+- Fileinfo:
+ . Fixed bug #67705 (extensive backtracking in rule regular expression).
+ (CVE-2014-3538) (Remi)
+
+- GD:
+ . Fixed bug #66901 (php-gd 'c_color' NULL pointer dereference).
+ (CVE-2014-2497) (Remi)
+
- Milter:
. Fixed bug #67715 (php-milter does not build and crashes randomly). (Mike)
@@ -32,6 +42,10 @@ PHP NEWS
. Fixed bug #60616 (odbc_fetch_into returns junk data at end of multi-byte
char fields). (Keyur)
+- Zlib:
+ . Fixed bug #67724 (chained zlib filters silently fail with large amounts of
+ data). (Mike)
+
24 Jul 2014, PHP 5.4.31
- Core:
diff --git a/configure.in b/configure.in
index 9a3a964a4c..8704d73b72 100644
--- a/configure.in
+++ b/configure.in
@@ -119,7 +119,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
PHP_MAJOR_VERSION=5
PHP_MINOR_VERSION=4
-PHP_RELEASE_VERSION=32
+PHP_RELEASE_VERSION=33
PHP_EXTRA_VERSION="-dev"
PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
diff --git a/ext/fileinfo/data_file.c b/ext/fileinfo/data_file.c
index fba4edd90f..15e0fa6a8a 100644
--- a/ext/fileinfo/data_file.c
+++ b/ext/fileinfo/data_file.c
@@ -115198,7 +115198,7 @@ const unsigned char php_magic_database[2606480] = {
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x40, 0x00, 0x3D, 0x1B, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x5E, 0x5C, 0x73, 0x7B, 0x30, 0x2C, 0x31, 0x30, 0x30, 0x7D, 0x42, 0x45, 0x47, 0x49, 0x4E, 0x5C,
0x73, 0x7B, 0x30, 0x2C, 0x31, 0x30, 0x30, 0x7D, 0x5B, 0x7B, 0x5D, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
diff --git a/ext/fileinfo/libmagic/softmagic.c b/ext/fileinfo/libmagic/softmagic.c
index 01e49778bf..7e0c8560e3 100644
--- a/ext/fileinfo/libmagic/softmagic.c
+++ b/ext/fileinfo/libmagic/softmagic.c
@@ -58,7 +58,7 @@ private int32_t mprint(struct magic_set *, struct magic *);
private int32_t moffset(struct magic_set *, struct magic *);
private void mdebug(uint32_t, const char *, size_t);
private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
- const unsigned char *, uint32_t, size_t, size_t);
+ const unsigned char *, uint32_t, size_t, struct magic *);
private int mconvert(struct magic_set *, struct magic *, int);
private int print_sep(struct magic_set *, int);
private int handle_annotation(struct magic_set *, struct magic *);
@@ -1003,7 +1003,7 @@ mdebug(uint32_t offset, const char *str, size_t len)
private int
mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
- const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
+ const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
{
/*
* Note: FILE_SEARCH and FILE_REGEX do not actually copy
@@ -1023,15 +1023,24 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
const char *last; /* end of search region */
const char *buf; /* start of search region */
const char *end;
- size_t lines;
+ size_t lines, linecnt, bytecnt;
+ linecnt = m->str_range;
+ bytecnt = linecnt * 80;
+
+ if (bytecnt == 0) {
+ bytecnt = 8192;
+ }
+ if (bytecnt > nbytes) {
+ bytecnt = nbytes;
+ }
if (s == NULL) {
ms->search.s_len = 0;
ms->search.s = NULL;
return 0;
}
buf = RCAST(const char *, s) + offset;
- end = last = RCAST(const char *, s) + nbytes;
+ end = last = RCAST(const char *, s) + bytecnt;
/* mget() guarantees buf <= last */
for (lines = linecnt, b = buf; lines && b < end &&
((b = CAST(const char *,
@@ -1044,7 +1053,7 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
b++;
}
if (lines)
- last = RCAST(const char *, s) + nbytes;
+ last = RCAST(const char *, s) + bytecnt;
ms->search.s = buf;
ms->search.s_len = last - buf;
@@ -1118,7 +1127,6 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
int *need_separator, int *returnval)
{
uint32_t soffset, offset = ms->offset;
- uint32_t count = m->str_range;
int rv, oneed_separator;
char *sbuf, *rbuf;
union VALUETYPE *p = &ms->ms_value;
@@ -1130,13 +1138,12 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
}
if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
- (uint32_t)nbytes, count) == -1)
+ (uint32_t)nbytes, m) == -1)
return -1;
if ((ms->flags & MAGIC_DEBUG) != 0) {
fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%zu, "
- "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
- nbytes, count);
+ "nbytes=%zu)\n", m->type, m->flag, offset, o, nbytes);
mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
}
@@ -1627,7 +1634,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
if ((ms->flags & MAGIC_DEBUG) != 0)
fprintf(stderr, "indirect +offs=%u\n", offset);
}
- if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
+ if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
return -1;
ms->offset = offset;
@@ -2057,7 +2064,7 @@ magiccheck(struct magic_set *ms, struct magic *m)
zval *retval;
zval *subpats;
char *haystack;
-
+
MAKE_STD_ZVAL(retval);
ALLOC_INIT_ZVAL(subpats);
diff --git a/ext/fileinfo/magicdata.patch b/ext/fileinfo/magicdata.patch
index 26d3bbb656..12fbd3ff56 100644
--- a/ext/fileinfo/magicdata.patch
+++ b/ext/fileinfo/magicdata.patch
@@ -1,4 +1,4 @@
-Patches applied to file sources tree before generating magic.mgc
+Patches applied to file 5.14 sources tree before generating magic.mgc
and before running create_data_file.php to create data_file.c.
@@ -17,14 +17,6 @@ diff --git a/magic/Magdir/commands b/magic/Magdir/commands
index 67c3eee..4a7d8dd 100644
--- a/magic/Magdir/commands
+++ b/magic/Magdir/commands
-@@ -1,6 +1,6 @@
-
- #------------------------------------------------------------------------------
--# $File: commands,v 1.44 2013/02/05 15:20:47 christos Exp $
-+# $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $
- # commands: file(1) magic for various shells and interpreters
- #
- #0 string/w : shell archive or script for antique kernel text
@@ -49,7 +49,7 @@
!:mime text/x-awk
0 string/wt #!\ /usr/bin/awk awk script text executable
@@ -36,4 +28,56 @@ index 67c3eee..4a7d8dd 100644
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
--
1.8.5.5
+From 0b478f445b6b7540b58af5d1fe583fa9e48fd745 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Wed, 28 May 2014 19:52:36 +0000
+Subject: [PATCH] further optimize awk by not looking for the BEGIN regex until
+ we found the BEGIN (Jan Kaluza)
+
+---
+ magic/Magdir/commands | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/magic/Magdir/commands b/magic/Magdir/commands
+index bfffdef..26b2869 100644
+--- a/magic/Magdir/commands
++++ b/magic/Magdir/commands
+@@ -49,7 +49,8 @@
+ !:mime text/x-awk
+ 0 string/wt #!\ /usr/bin/awk awk script text executable
+ !:mime text/x-awk
+-0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
++0 search/16384 BEGIN
++>0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
+
+ # AT&T Bell Labs' Plan 9 shell
+ 0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
+--
+2.0.3
+
+From 71a8b6c0d758acb0f73e2e51421a711b5e9d6668 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Fri, 30 May 2014 16:48:44 +0000
+Subject: [PATCH] Limit regex search for BEGIN to the first 4K of the file.
+
+---
+ magic/Magdir/commands | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/magic/Magdir/commands b/magic/Magdir/commands
+index 26b2869..bcd0f43 100644
+--- a/magic/Magdir/commands
++++ b/magic/Magdir/commands
+@@ -49,8 +49,7 @@
+ !:mime text/x-awk
+ 0 string/wt #!\ /usr/bin/awk awk script text executable
+ !:mime text/x-awk
+-0 search/16384 BEGIN
+->0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
++0 regex/4096 =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
+
+ # AT&T Bell Labs' Plan 9 shell
+ 0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
+--
+2.0.3
diff --git a/ext/fileinfo/tests/cve-2014-3538.phpt b/ext/fileinfo/tests/cve-2014-3538.phpt
new file mode 100644
index 0000000000..d6bc9c68c8
--- /dev/null
+++ b/ext/fileinfo/tests/cve-2014-3538.phpt
@@ -0,0 +1,35 @@
+--TEST--
+Bug #66731: file: extensive backtraking
+--SKIPIF--
+<?php
+if (!class_exists('finfo'))
+ die('skip no fileinfo extension');
+--FILE--
+<?php
+$fd = __DIR__.'/cve-2014-3538.data';
+
+file_put_contents($fd,
+ 'try:' .
+ str_repeat("\n", 1000000));
+
+$fi = finfo_open(FILEINFO_NONE);
+$t = microtime(true);
+var_dump(finfo_file($fi, $fd));
+$t = microtime(true) - $t;
+finfo_close($fi);
+if ($t < 1) {
+ echo "Ok\n";
+} else {
+ printf("Failed, time=%.2f\n", $t);
+}
+
+?>
+Done
+--CLEAN--
+<?php
+@unlink(__DIR__.'/cve-2014-3538.data');
+?>
+--EXPECTF--
+string(%d) "%s"
+Ok
+Done \ No newline at end of file
diff --git a/ext/gd/libgd/gdxpm.c b/ext/gd/libgd/gdxpm.c
index 73f86e5df7..b69414e60d 100644
--- a/ext/gd/libgd/gdxpm.c
+++ b/ext/gd/libgd/gdxpm.c
@@ -31,12 +31,17 @@ gdImagePtr gdImageCreateFromXpm (char *filename)
if (ret != XpmSuccess) {
return 0;
}
+ number = image.ncolors;
+ for(i = 0; i < number; i++) {
+ if (!image.colorTable[i].c_color) {
+ goto done;
+ }
+ }
if (!(im = gdImageCreate(image.width, image.height))) {
goto done;
}
- number = image.ncolors;
colors = (int *) safe_emalloc(number, sizeof(int), 0);
for (i = 0; i < number; i++) {
switch (strlen (image.colorTable[i].c_color)) {
diff --git a/ext/standard/info.c b/ext/standard/info.c
index 98b4a8098c..7868208668 100644
--- a/ext/standard/info.c
+++ b/ext/standard/info.c
@@ -600,6 +600,14 @@ PHPAPI char *php_get_uname(char mode)
php_get_windows_cpu(wincpu, sizeof(wincpu));
dwBuild = (DWORD)(HIWORD(dwVersion));
+
+ /* Windows "version" 6.2 could be Windows 8/Windows Server 2012, but also Windows 8.1/Windows Server 2012 R2 */
+ if (dwWindowsMajorVersion == 6 && dwWindowsMinorVersion == 2) {
+ if (strncmp(winver, "Windows 8.1", 11) == 0 || strncmp(winver, "Windows Server 2012 R2", 22) == 0) {
+ dwWindowsMinorVersion = 3;
+ }
+ }
+
snprintf(tmp_uname, sizeof(tmp_uname), "%s %s %d.%d build %d (%s) %s",
"Windows NT", ComputerName,
dwWindowsMajorVersion, dwWindowsMinorVersion, dwBuild, winver?winver:"unknown", wincpu);
diff --git a/ext/zlib/tests/bug67724.gz.gz b/ext/zlib/tests/bug67724.gz.gz
new file mode 100644
index 0000000000..ab1db9258e
--- /dev/null
+++ b/ext/zlib/tests/bug67724.gz.gz
Binary files differ
diff --git a/ext/zlib/tests/bug67724.phpt b/ext/zlib/tests/bug67724.phpt
new file mode 100644
index 0000000000..1e5026f650
--- /dev/null
+++ b/ext/zlib/tests/bug67724.phpt
@@ -0,0 +1,26 @@
+--TEST--
+Bug #67724 (chained zlib filters silently fail with large amounts of data)
+--SKIPIF--
+<?php
+extension_loaded("zlib") or die("skip need ext/zlib");
+?>
+--FILE--
+<?php
+echo "Test\n";
+
+$f = fopen(__DIR__."/bug67724.gz.gz", "rb")
+ or die(current(error_get_last()));
+stream_filter_append($f, "zlib.inflate", STREAM_FILTER_READ, ["window" => 30]);
+stream_filter_append($f, "zlib.inflate", STREAM_FILTER_READ, ["window" => 30]);
+for ($i = 0; !feof($f); $i += strlen(fread($f, 0x1000)))
+ ;
+fclose($f);
+
+var_dump($i);
+
+?>
+DONE
+--EXPECT--
+Test
+int(25600000)
+DONE
diff --git a/ext/zlib/zlib_filter.c b/ext/zlib/zlib_filter.c
index 2054ec2ca2..47a68e264f 100644
--- a/ext/zlib/zlib_filter.c
+++ b/ext/zlib/zlib_filter.c
@@ -310,7 +310,8 @@ static php_stream_filter *php_zlib_filter_create(const char *filtername, zval *f
data->strm.zalloc = (alloc_func) php_zlib_alloc;
data->strm.zfree = (free_func) php_zlib_free;
- data->strm.avail_out = data->outbuf_len = data->inbuf_len = 2048;
+ data->strm.avail_out = data->outbuf_len = 0x8000;
+ data->inbuf_len = 2048;
data->strm.next_in = data->inbuf = (Bytef *) pemalloc(data->inbuf_len, persistent);
if (!data->inbuf) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Failed allocating %zd bytes", data->inbuf_len);
diff --git a/main/php_version.h b/main/php_version.h
index c6aa024436..f96fab142f 100644
--- a/main/php_version.h
+++ b/main/php_version.h
@@ -2,8 +2,8 @@
/* edit configure.in to change version number */
#define PHP_MAJOR_VERSION 5
#define PHP_MINOR_VERSION 4
-#define PHP_RELEASE_VERSION 32
+#define PHP_RELEASE_VERSION 33
#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.4.32-dev"
-#define PHP_VERSION_ID 50432
+#define PHP_VERSION "5.4.33-dev"
+#define PHP_VERSION_ID 50433
View Lorry Controller Status