| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|\
| |
| |
| |
| | |
* PHP-7.0:
More int->size_t and string overflow fixes
|
| | |
|
|\ \
| |/
| |
| |
| |
| |
| | |
* PHP-7.0:
Add length check for bzcompress too - fix for bug #73356
More string length checks & fixes
More string length checks & fixes
|
| |\
| | |
| | |
| | |
| | | |
* PHP-5.6:
More string length checks & fixes
|
| | | |
|
| | |
| | |
| | |
| | | |
elements)
|
|\ \ \
| | | |
| | | |
| | | |
| | | | |
* PHP-7.0:
Fixed bug #72647 (xmlrpc_encode() unexpected output after referencing array elements)
|
| |/ /
| | |
| | |
| | | |
elements)
|
|\ \ \
| |/ /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
* PHP-7.0: (27 commits)
fix #72519, possible OOB using imagegif
fix #72512, invalid read or write for palette image when invalid transparent index is used
Apparently some envs miss SIZE_MAX
Fix tests
Fix bug #72618: NULL Pointer Dereference in exif_process_user_comment
Partial fix for bug #72613 - do not allow reading past error read
Partial fix for bug #72613 - do not treat negative returns from bz2 as size_t
Fix bug #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c
Fix for bug #72558, Integer overflow error within _gdContributionsAlloc()
Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE
update NEWS
Fixed bug #72570 Segmentation fault when binding parameters on a query without placeholders
Fix bug #72562 - destroy var_hash properly
Fix bug #72551 and bug #72552 - check before converting size_t->int
Fix bug #72541 - size_t overflow lead to heap corruption
Fix bug #72533 (locale_accept_from_http out-of-bounds access)
Fix fir bug #72520
Fix for bug #72513
Fix for bug #72513
CS fix and comments with bug ID
...
Conflicts:
ext/standard/basic_functions.c
|
| |\ \
| | |/
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
* PHP-5.6:
fix #72519, possible OOB using imagegif
fix #72512, invalid read or write for palette image when invalid transparent index is used
Apparently some envs miss SIZE_MAX
Fix tests
Fix bug #72618: NULL Pointer Dereference in exif_process_user_comment
Partial fix for bug #72613 - do not treat negative returns from bz2 as size_t
Fix bug #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c
Fix for bug #72558, Integer overflow error within _gdContributionsAlloc()
Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE
Fix bug #72562 - destroy var_hash properly
Fix bug #72533 (locale_accept_from_http out-of-bounds access)
Fix fir bug #72520
Fix for bug #72513
Fix for bug #72513
CS fix and comments with bug ID
Fix for HTTP_PROXY issue.
5.6.24RC1
add tests for bug #72512
Fixed bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access
Fixed bug #72479 - same as #72434
Conflicts:
Zend/zend_virtual_cwd.c
ext/bz2/bz2.c
ext/exif/exif.c
ext/session/session.c
ext/snmp/snmp.c
ext/standard/basic_functions.c
main/SAPI.c
main/php_variables.c
|
| | |\
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
* PHP-5.5:
fix #72519, possible OOB using imagegif
fix #72512, invalid read or write for palette image when invalid transparent index is used
Apparently some envs miss SIZE_MAX
Fix tests
Fix bug #72618: NULL Pointer Dereference in exif_process_user_comment
Partial fix for bug #72613 - do not treat negative returns from bz2 as size_t
Fix bug #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c
Fix for bug #72558, Integer overflow error within _gdContributionsAlloc()
Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE
Fix bug #72562 - destroy var_hash properly
Fix bug #72533 (locale_accept_from_http out-of-bounds access)
Fix fir bug #72520
Fix for bug #72513
CS fix and comments with bug ID
Fix for HTTP_PROXY issue.
add tests for bug #72512
Fixed bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access
Fixed bug #72479 - same as #72434
Conflicts:
ext/bz2/bz2.c
main/SAPI.c
main/php_variables.c
|
| | | | |
|
| | | | |
|
|\ \ \ \ |
|
| | | | | |
|
| |\ \ \ \
| | |/ / / |
|
| | | | | |
|
| |/ / /
|/| | |
| | | |
| | | |
| | | | |
"%p" replaced by ZEND_LONG_FMT to avoid compilation warnings.
Fixed most incorrect use cases of format specifiers.
|
| | | | |
|
| | | | |
|
| | | |
| | | |
| | | |
| | | | |
This reverts commit 1690dcb827e2b50eb575b1c6acadab0b8f248723.
|
| | | | |
|
|\ \ \ \
| | |/ /
| |/| |
| | | |
| | | | |
* PHP-5.6:
Fixed test on 32-bit platforms (split into 32-bit and 64-bit versions)
|
| | | | |
|
| |\ \ \
| | | |/
| | |/|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
* PHP-5.5:
Update NEWS
Improve fix for bug #70976
Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization)
Fixed bug #70741: Session WDDX Packet Deserialization Type Confusion Vulnerability
Fixed #70728
Fixed bug #70755: fpm_log.c memory leak and buffer overflow
Fix bug #70976: fix boundary check on gdImageRotateInterpolated
typofix
|
| | | | |
|
| | | | |
|
| | | | |
|
| | | | |
|
| | | |
| | | |
| | | |
| | | |
| | | | |
Conflicts:
ext/xmlrpc/xmlrpc-epi-php.c
|
|\ \ \ \
| |/ / /
| | | |
| | | |
| | | | |
* PHP-5.6:
Happy new year (Update copyright to 2016)
|
| | | | |
|
| | | | |
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Conflicts:
ext/ftp/ftp.h
ext/pcre/pcrelib/pcre_printint.c
ext/pcre/pcrelib/sljit/sljitLir.c
ext/pcre/pcrelib/sljit/sljitLir.h
ext/pcre/pcrelib/sljit/sljitNativeARM_32.c
ext/pcre/pcrelib/sljit/sljitNativeTILEGX_64.c
ext/pgsql/pgsql.c
ext/phar/func_interceptors.c
ext/soap/soap.c
ext/standard/image.c
|
| |_|/
|/| | |
|
| | |
| | |
| | |
| | | |
semantick changes).
|
| | | |
|
| | |
| | |
| | |
| | | |
and bring the configs inline with the current libxml2 build
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
|\ \ \
| |/ /
| | |
| | |
| | | |
* PHP-5.6:
Ensure we have enough input data before parsing date
|
| |\ \
| | |/
| | |
| | |
| | | |
* PHP-5.5:
Ensure we have enough input data before parsing date
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This check have be removed in
http://git.php.net/?p=php-src.git;a=commit;h=ba2f87b50667f147c198abd31fc31eb09522f3d7
But the parser really need 17 char.
And the string need to be nul terminated for this check
So avoid reading random byte from memory.
|