Skip to content

Commit 9e15ce9

Browse files
author
George Wang
committed
Merge branch 'PHP-5.6' of git.php.net:php-src into PHP-5.6
2 parents 3a169f6 + e09d315 commit 9e15ce9

File tree

91 files changed

+2425
-1520
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

91 files changed

+2425
-1520
lines changed

‎NEWS

Lines changed: 57 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,43 @@
1-
PHP NEWS
1+
PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
33
?? Jul 2015, PHP 5.6.11
44

55
- Core:
6-
. Fixed #69642 (Windows 10 reported as Windows 8).
6+
. Fixed bug #69703 (Use __builtin_clzl on PowerPC).
7+
(dja at axtens dot net, Kalle)
8+
. Fixed bug #69732 (can induce segmentation fault with basic php code).
9+
(Dmitry)
10+
. Fixed bug #69642 (Windows 10 reported as Windows 8).
711
(Christian Wenz, Anatol Belski)
12+
. Fixed bug #69551 (parse_ini_file() and parse_ini_string() segmentation
13+
fault). (Christoph M. Becker)
14+
. Fixed bug #69781 (phpinfo() reports Professional Editions of Windows
15+
7/8/8.1/10 as "Business"). (Christian Wenz)
16+
. Fixed bug #69740 (finally in generator (yield) swallows exception in
17+
iteration). (Nikita)
18+
. Fixed bug #69835 (phpinfo() does not report many Windows SKUs).
19+
(Christian Wenz)
20+
. Fixed bug #69892 (Different arrays compare indentical due to integer key
21+
truncation). (Nikita)
22+
23+
- GD:
24+
. Fixed bug #61221 (imagegammacorrect function loses alpha channel). (cmb)
25+
26+
- GMP:
27+
. Fixed bug #69803 (gmp_random_range() modifies second parameter if GMP
28+
number). (Nikita)
29+
30+
- PDO_pgsql:
31+
. Fixed bug #69752 (PDOStatement::execute() leaks memory with DML
32+
Statements when closeCuror() is u). (Philip Hofstetter)
33+
. Fixed bug #69362 (PDO-pgsql fails to connect if password contains a
34+
leading single quote). (Matteo)
35+
. Fixed bug #69344 (PDO PgSQL Incorrect binding numeric array with gaps).
36+
(Matteo)
37+
38+
- SimpleXML:
39+
. Refactored the fix for bug #66084 (simplexml_load_string() mangles empty
40+
node name). (Christoph Michael Becker)
841

942
- SPL:
1043
. Fixed bug #69737 (Segfault when SplMinHeap::compare produces fatal error).
@@ -23,30 +56,43 @@
2356
(Christoph M. Becker)
2457
. Fixed POST data processing slowdown due to small input buffer size
2558
on Windows. (Jorge Oliveira, Anatol)
26-
. Fixed bug #69703 (Use __builtin_clzl on PowerPC).
27-
(dja at axtens dot net, Kalle)
28-
. Fixed bug #69732 (can induce segmentation fault with basic php code).
29-
(Dmitry)
59+
. Fixed bug #69646 (OS command injection vulnerability in escapeshellarg).
60+
(CVE-2015-4642) (Anatol Belski)
61+
. Fixed bug #69719 (Incorrect handling of paths with NULs). (Stas)
62+
63+
- FTP
64+
. Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in
65+
heap overflow). (CVE-2015-4643) (Max Spelsberg)
3066

3167
- GD:
3268
. Fixed bug #69479 (GD fails to build with newer libvpx). (Remi)
3369

3470
- Iconv:
3571
. Fixed bug #48147 (iconv with //IGNORE cuts the string). (Stas)
3672

73+
- Litespeed SAPI:
74+
. Fixed bug #68812 (Unchecked return value). (George Wang)
75+
76+
- Mail:
77+
. Fixed bug #68776 (mail() does not have mail header injection prevention for
78+
additional headers). (Yasuo)
79+
3780
- MCrypt:
3881
. Added file descriptor caching to mcrypt_create_iv() (Leigh)
3982

83+
- Opcache
84+
. Fixed bug #69549 (Memory leak with opcache.optimization_level=0xFFFFFFFF).
85+
(Laruence, Dmitry)
86+
87+
- PCRE
88+
. Upgraded pcrelib to 8.37. (CVE-2015-2325, CVE-2015-2326)
89+
4090
- Phar:
4191
. Fixed bug #69680 (phar symlink in binary directory broken).
4292
(Matteo Bernardini, Remi)
4393

4494
- Postgres:
45-
. Fixed bug #69667 (segfault in php_pgsql_meta_data). (Remi)
46-
47-
- SimpleXML:
48-
. Refactored the fix for bug #66084 (simplexml_load_string() mangles empty
49-
node name). (Christoph Michael Becker)
95+
. Fixed bug #69667 (segfault in php_pgsql_meta_data). (CVE-2015-4644) (Remi)
5096

5197
- Sqlite3:
5298
. Upgrade bundled sqlite to 3.8.10.2. (CVE-2015-3414, CVE-2015-3415,
@@ -95,9 +141,6 @@
95141
. Fixed bug #68598 (pcntl_exec() should not allow null char). (CVE-2015-4026)
96142
(Stas)
97143

98-
- PCRE
99-
. Upgraded pcrelib to 8.37. (CVE-2015-2325, CVE-2015-2326)
100-
101144
- Phar:
102145
. Fixed bug #69453 (Memory Corruption in phar_parse_tarfile when entry
103146
filename starts with null). (CVE-2015-4021) (Stas)

‎Zend/tests/bug69551.phpt

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
Bug #69551 - parse_ini_file() and parse_ini_string() segmentation fault
3+
--FILE--
4+
<?php
5+
$ini = <<<INI
6+
[Network.eth0]
7+
SubnetMask = "
8+
"
9+
INI;
10+
$settings = parse_ini_string($ini, false, INI_SCANNER_RAW);
11+
var_dump($settings);
12+
?>
13+
--EXPECTF--
14+
Warning: syntax error, unexpected '"' in Unknown on line %d
15+
in %s on line %d
16+
bool(false)

‎Zend/tests/bug69740.phpt

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
--TEST--
2+
Bug #69740: finally in generator (yield) swallows exception in iteration
3+
--FILE--
4+
<?php
5+
6+
function generate() {
7+
try {
8+
yield 1;
9+
yield 2;
10+
} finally {
11+
echo "finally\n";
12+
}
13+
}
14+
15+
foreach (generate() as $i) {
16+
echo $i, "\n";
17+
throw new Exception();
18+
}
19+
20+
?>
21+
--EXPECTF--
22+
1
23+
finally
24+
25+
Fatal error: Uncaught exception 'Exception' in %s:%d
26+
Stack trace:
27+
#0 {main}
28+
thrown in %s on line %d

‎Zend/tests/bug69892.phpt

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
--TEST--
2+
Bug #69892: Different arrays compare indentical due to integer key truncation
3+
--SKIPIF--
4+
<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platforms only"); ?>
5+
--FILE--
6+
<?php
7+
var_dump([0 => 0] === [0x100000000 => 0]);
8+
?>
9+
--EXPECT--
10+
bool(false)

‎Zend/zend_generators.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,9 @@ static void zend_generator_dtor_storage(zend_generator *generator, zend_object_h
198198
if (finally_op_num) {
199199
ex->opline = &ex->op_array->opcodes[finally_op_num];
200200
ex->fast_ret = NULL;
201+
ex->delayed_exception = EG(exception);
202+
EG(exception) = NULL;
203+
201204
generator->flags |= ZEND_GENERATOR_FORCED_CLOSE;
202205
zend_generator_resume(generator TSRMLS_CC);
203206
}

‎Zend/zend_hash.c

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1446,11 +1446,10 @@ ZEND_API int zend_hash_compare(HashTable *ht1, HashTable *ht2, compare_func_t co
14461446
}
14471447
if (ordered) {
14481448
if (p1->nKeyLength==0 && p2->nKeyLength==0) { /* numeric indices */
1449-
result = p1->h - p2->h;
1450-
if (result!=0) {
1449+
if (p1->h != p2->h) {
14511450
HASH_UNPROTECT_RECURSION(ht1);
14521451
HASH_UNPROTECT_RECURSION(ht2);
1453-
return result;
1452+
return p1->h > p2->h ? 1 : -1;
14541453
}
14551454
} else { /* string indices */
14561455
result = p1->nKeyLength - p2->nKeyLength;

‎Zend/zend_ini_scanner.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2029,7 +2029,7 @@ int ini_lex(zval *ini_lval TSRMLS_DC)
20292029
}
20302030

20312031
/* Eat leading and trailing double quotes */
2032-
if (yytext[0] == '"' && yytext[yyleng - 1] == '"') {
2032+
if (yyleng > 1 && yytext[0] == '"' && yytext[yyleng - 1] == '"') {
20332033
SCNG(yy_text)++;
20342034
yyleng = yyleng - 2;
20352035
} else if (sc) {

‎Zend/zend_ini_scanner.l

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -523,7 +523,7 @@ end_raw_value_chars:
523523
}
524524

525525
/* Eat leading and trailing double quotes */
526-
if (yytext[0] == '"' && yytext[yyleng - 1] == '"') {
526+
if (yyleng > 1 && yytext[0] == '"' && yytext[yyleng - 1] == '"') {
527527
SCNG(yy_text)++;
528528
yyleng = yyleng - 2;
529529
} else if (sc) {

0 commit comments

Comments
 (0)