Open Build Service

php5.spec Changed

@@ -57,8 +57,6 @@
 Source5:        README.macros
 Source6:        macros.php
 Source7:        php-fpm.init
-Source8:        https://secure.php.net/distributions/php-%{version}.tar.xz.asc
-Source9:        php5.keyring
 Source10:       README.default_socket_timeout
 Source100:      build-test.sh
 
@@ -96,19 +94,10 @@
 Patch20:        php5-odbc-cmp-int-cast.patch
 # https://bugs.php.net/bug.php?id=70461
 Patch21:        php5-fix_net-snmp_disable_MD5.patch
-# CVE-2019-9638 bsc#1128889, CVE-2019-9639 bsc#1128887
-Patch22:        php-CVE-2019-9638,9639.patch
-# CVE-2019-9640 bsc#1128883
-Patch23:        php-CVE-2019-9640.patch
-# CVE-2019-9675 bsc#1128886
-Patch24:        php-CVE-2019-9675.patch
-# CVE-2019-9637 bsc#1128892
-Patch25:        php-CVE-2019-9637.patch
-# CVE-2019-11034 bsc#1132838
-Patch26:        php-CVE-2019-11034.patch
-# CVE-2019-11035 bsc#1132837
-Patch27:        php-CVE-2019-11035.patch
 Patch1000:     session-save-path.patch
+# CVE-2026-109618 CVE-2026-109619 (PHP2Shell), community backport for remicollet/php-src-security
+# https://github.com/Anton-Barinov/php2shell-patches php-5.6-enhanced-remicollet.patch
+Patch1001:      php-CVE-2026-109618,109619.patch
 
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 BuildRequires:  gettext-tools
@@ -1176,13 +1165,8 @@
 %patch19
 %patch20
 %patch21 -p1
-%patch22 -p1
-%patch23 -p1
-%patch24 -p1
-%patch25 -p1
-%patch26 -p1
-%patch27 -p1
 %patch1000 -p1
+%patch1001 -p1
 
 # Safety check for API version change.
 vapi=`sed -n '/#define PHP_API_VERSION/{s/.* //;p}' main/php.h`
@@ -1223,7 +1207,7 @@
 
 # regenerate configure etc.
 # workaround: suhosin-patch updates timestamp of configure, confusing buildconf
-%{__rm} configure
+%{__rm} -f configure
 ./buildconf --force
 
 # export flags

php-CVE-2019-11034.patch Deleted

@@ -1,18 +0,0 @@
-X-Git-Url: http://208.43.231.11:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fexif%2Fexif.c;h=0b5bb5ae2123989a28b2112ab5506777083ad9d5;hp=fe89b854711879274555bdc762ea6e7fa518fa59;hb=f3aefc6d071b807ddacae0a0bc49f09c38e18490;hpb=0ecac37c40a27ffbd59f34b5920735ee0b7f994c
-
-diff --git a/ext/exif/exif.c b/ext/exif/exif.c
-index fe89b85..0b5bb5a 100644
---- a/ext/exif/exif.c
-+++ b/ext/exif/exif.c
-@@ -2802,6 +2802,10 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
- 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
- 		return FALSE;
- 	}
-+	if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
-+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
-+		return FALSE;
-+	}
- 
- 	for (de=0;de<NumDirEntries;de++) {
- 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
-

php-CVE-2019-11035.patch Deleted

@@ -1,148 +0,0 @@
-X-Git-Url: http://208.43.231.11:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fexif%2Fexif.c;h=408bf03d3ec6c2c6d41ec4217f5a12e985f42cb5;hp=0b5bb5ae2123989a28b2112ab5506777083ad9d5;hb=887a7b571407f7a49a5e7cf1e612d21ef83fedb4;hpb=c684d32fb877aa7335842e8b9e7506ef51620e1a
-
-Index: php-5.6.40/ext/exif/exif.c
-===================================================================
---- php-5.6.40.orig/ext/exif/exif.c	2019-04-30 10:45:37.369418979 +0200
-+++ php-5.6.40/ext/exif/exif.c	2019-04-30 10:45:37.377419020 +0200
-@@ -1660,10 +1660,10 @@ static int exif_file_sections_free(image
- /* {{{ exif_iif_add_value
-  Add a value to image_info
- */
--static void exif_iif_add_value(image_info_type *image_info, int section_index, char *name, int tag, int format, int length, void* value, int motorola_intel TSRMLS_DC)
-+static void exif_iif_add_value(image_info_type *image_info, int section_index, char *name, int tag, int format, int length, void* value, size_t value_len, int motorola_intel TSRMLS_DC)
- {
- 	size_t idex;
--	void *vptr;
-+	void *vptr, *vptr_end;
- 	image_info_value *info_value;
- 	image_info_data  *info_data;
- 	image_info_data  *list;
-@@ -1685,8 +1685,12 @@ static void exif_iif_add_value(image_inf
- 
- 	switch (format) {
- 		case TAG_FMT_STRING:
-+			if (length > value_len) {
-+				exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "length > value_len: %d > %zu", length, value_len);
-+				value = NULL;
-+			}
- 			if (value) {
--				length = php_strnlen(value, length);
-+				length = (int)php_strnlen(value, length);
- 				info_value->s = estrndup(value, length);
- 				info_data->length = length;
- 			} else {
-@@ -1708,6 +1712,10 @@ static void exif_iif_add_value(image_inf
- 			if (!length)
- 				break;
- 		case TAG_FMT_UNDEFINED:
-+			if (length > value_len) {
-+				exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "length > value_len: %d > %zu", length, value_len);
-+				value = NULL;
-+			}
- 			if (value) {
- 				if (tag == TAG_MAKER_NOTE) {
- 					length = (int) php_strnlen(value, length);
-@@ -1738,7 +1746,12 @@ static void exif_iif_add_value(image_inf
- 			} else {
- 				info_value = &info_data->value;
- 			}
-+			vptr_end = (char*)value+value_len;
- 			for (idex=0,vptr=value; idex<(size_t)length; idex++,vptr=(char *) vptr + php_tiff_bytes_per_formatformat) {
-+				if ((char*)vptr_end - (char*)vptr < php_tiff_bytes_per_formatformat) {
-+					exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "Value too short");
-+					break;
-+				}
- 				if (length>1) {
- 					info_value = &info_data->value.listidex;
- 				}
-@@ -1774,7 +1787,7 @@ static void exif_iif_add_value(image_inf
- 						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Found value of type single");
- #endif
- 						info_value->f = *(float *)value;
--
-+						break;
- 					case TAG_FMT_DOUBLE:
- #ifdef EXIF_DEBUG
- 						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Found value of type double");
-@@ -1792,9 +1805,9 @@ static void exif_iif_add_value(image_inf
- /* {{{ exif_iif_add_tag
-  Add a tag from IFD to image_info
- */
--static void exif_iif_add_tag(image_info_type *image_info, int section_index, char *name, int tag, int format, size_t length, void* value TSRMLS_DC)
-+static void exif_iif_add_tag(image_info_type *image_info, int section_index, char *name, int tag, int format, size_t length, void* value TSRMLS_DC, size_t value_len)
- {
--	exif_iif_add_value(image_info, section_index, name, tag, format, (int)length, value, image_info->motorola_intel TSRMLS_CC);
-+	exif_iif_add_value(image_info, section_index, name, tag, format, (int)length, value, value_len, image_info->motorola_intel TSRMLS_CC);
- }
- /* }}} */
- 
-@@ -2218,7 +2231,7 @@ static void add_assoc_image_info(zval *v
- */
- static void exif_process_COM (image_info_type *image_info, char *value, size_t length TSRMLS_DC)
- {
--	exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length-2, value+2 TSRMLS_CC);
-+	exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length-2, value+2 TSRMLS_CC, length-2);
- }
- /* }}} */
- 
-@@ -2233,17 +2246,17 @@ static void exif_process_CME (image_info
- 	if (length>3) {
- 		switch(value2) {
- 			case 0:
--				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, length, value TSRMLS_CC);
-+				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, length, value TSRMLS_CC, length);
- 				break;
- 			case 1:
--				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length, value);
-+				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length, value, length);
- 				break;
- 			default:
- 				php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Undefined JPEG2000 comment encoding");
- 				break;
- 		}
- 	} else {
--		exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, 0, NULL);
-+		exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, 0, NULL, 0);
- 		php_error_docref(NULL TSRMLS_CC, E_NOTICE, "JPEG2000 comment section too small");
- 	}
- }
-@@ -2837,7 +2850,7 @@ static int exif_process_IFD_in_MAKERNOTE
- static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table TSRMLS_DC)
- {
- 	size_t length;
--	int tag, format, components;
-+	unsigned int tag, format, components;
- 	char *value_ptr, tagname64, cbuf32, *outside=NULL;
- 	size_t byte_count, offset_val, fpos, fgot;
- 	int64_t byte_count_signed;
-@@ -3148,7 +3161,7 @@ static int exif_process_IFD_TAG(image_in
- 				}
- 		}
- 	}
--	exif_iif_add_tag(ImageInfo, section_index, exif_get_tagname(tag, tagname, sizeof(tagname), tag_table TSRMLS_CC), tag, format, components, value_ptr TSRMLS_CC);
-+	exif_iif_add_tag(ImageInfo, section_index, exif_get_tagname(tag, tagname, sizeof(tagname), tag_table TSRMLS_CC), tag, format, components, value_ptr TSRMLS_CC, byte_count);
- 	EFREE_IF(outside);
- 	return TRUE;
- }
-@@ -3306,10 +3319,10 @@ static void exif_process_APP12(image_inf
- 	size_t l1, l2=0;
- 
- 	if ((l1 = php_strnlen(buffer+2, length-2)) > 0) {
--		exif_iif_add_tag(ImageInfo, SECTION_APP12, "Company", TAG_NONE, TAG_FMT_STRING, l1, buffer+2 TSRMLS_CC);
-+		exif_iif_add_tag(ImageInfo, SECTION_APP12, "Company", TAG_NONE, TAG_FMT_STRING, l1, buffer+2 TSRMLS_CC, l1);
- 		if (length > 2+l1+1) {
- 			l2 = php_strnlen(buffer+2+l1+1, length-2-l1-1);
--			exif_iif_add_tag(ImageInfo, SECTION_APP12, "Info", TAG_NONE, TAG_FMT_STRING, l2, buffer+2+l1+1 TSRMLS_CC);
-+			exif_iif_add_tag(ImageInfo, SECTION_APP12, "Info", TAG_NONE, TAG_FMT_STRING, l2, buffer+2+l1+1 TSRMLS_CC, l2);
- 		}
- 	}
- #ifdef EXIF_DEBUG
-@@ -4107,7 +4120,7 @@ PHP_FUNCTION(exif_read_data)
- 	if (ImageInfo.Thumbnail.size) {
- 		if (read_thumbnail) {
- 			/* not exif_iif_add_str : this is a buffer */
--			exif_iif_add_tag(&ImageInfo, SECTION_THUMBNAIL, "THUMBNAIL", TAG_NONE, TAG_FMT_UNDEFINED, ImageInfo.Thumbnail.size, ImageInfo.Thumbnail.data TSRMLS_CC);
-+			exif_iif_add_tag(&ImageInfo, SECTION_THUMBNAIL, "THUMBNAIL", TAG_NONE, TAG_FMT_UNDEFINED, ImageInfo.Thumbnail.size, ImageInfo.Thumbnail.data TSRMLS_CC, ImageInfo.Thumbnail.size);
- 		}
- 		if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
- 			/* try to evaluate if thumbnail data is present */

php-CVE-2019-9637.patch Deleted

@@ -1,73 +0,0 @@
-Index: php-5.5.14/main/streams/plain_wrapper.c
-===================================================================
---- php-5.5.14.orig/main/streams/plain_wrapper.c	2019-03-20 13:00:00.115945028 +0100
-+++ php-5.5.14/main/streams/plain_wrapper.c	2019-03-20 13:00:32.064130422 +0100
-@@ -1103,34 +1103,51 @@ static int php_plain_files_rename(php_st
- # ifdef EXDEV
- 		if (errno == EXDEV) {
- 			struct stat sb;
-+# if !defined(ZTS) && !defined(TSRM_WIN32) && !defined(NETWARE)
-+			/* not sure what to do in ZTS case, umask is not thread-safe */
-+			int oldmask = umask(077);
-+# endif
-+			int success = 0;
- 			if (php_copy_file(url_from, url_to TSRMLS_CC) == SUCCESS) {
- 				if (VCWD_STAT(url_from, &sb) == 0) {
-+					success = 1;
- #  if !defined(TSRM_WIN32) && !defined(NETWARE)
--					if (VCWD_CHMOD(url_to, sb.st_mode)) {
--						if (errno == EPERM) {
--							php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
--							VCWD_UNLINK(url_from);
--							return 1;
--						}
-+					/*
-+					 * Try to set user and permission info on the target.
-+					 * If we're not root, then some of these may fail.
-+					 * We try chown first TSRMLS_CC, to set proper group info, relying
-+					 * on the system environment to have proper umask to not allow
-+					 * access to the file in the meantime.
-+					 */
-+					if (VCWD_CHOWN(url_to, sb.st_uid, sb.st_gid)) {
- 						php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
--						return 0;
-+						if (errno != EPERM) {
-+							success = 0;
-+						}
- 					}
--					if (VCWD_CHOWN(url_to, sb.st_uid, sb.st_gid)) {
--						if (errno == EPERM) {
-+
-+					if (success) {
-+						if (VCWD_CHMOD(url_to, sb.st_mode)) {
- 							php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
--							VCWD_UNLINK(url_from);
--							return 1;
-+							if (errno != EPERM) {
-+								success = 0;
-+							}
- 						}
--						php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
--						return 0;
- 					}
- #  endif
--					VCWD_UNLINK(url_from);
--					return 1;
-+					if (success) {
-+						VCWD_UNLINK(url_from);
-+					}
-+				} else {
-+					php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
- 				}
-+			} else {
-+				php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
- 			}
--			php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
--			return 0;
-+#  if !defined(ZTS) && !defined(TSRM_WIN32) && !defined(NETWARE)
-+			umask(oldmask);
-+#  endif
-+			return success;
- 		}
- # endif
- #endif

php-CVE-2019-9640.patch Deleted

@@ -1,35 +0,0 @@
-Index: php-5.5.14/ext/exif/exif.c
-===================================================================
---- php-5.5.14.orig/ext/exif/exif.c	2019-03-19 16:07:58.731002056 +0100
-+++ php-5.5.14/ext/exif/exif.c	2019-03-19 16:10:03.031726088 +0100
-@@ -3517,7 +3517,7 @@ static int exif_scan_thumbnail(image_inf
- 			return FALSE;
- 		marker = c;
- 		length = php_jpg_get16(data+pos);
--		if (pos+length>=ImageInfo->Thumbnail.size) {
-+		if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) {
- 			return FALSE;
- 		}
- #ifdef EXIF_DEBUG
-@@ -3538,6 +3538,10 @@ static int exif_scan_thumbnail(image_inf
- 			case M_SOF14:
- 			case M_SOF15:
- 				/* handle SOFn block */
-+				if (length < 8 || ImageInfo->Thumbnail.size - 8 < pos) {
-+					/* exif_process_SOFn needs 8 bytes */
-+					return FALSE;
-+				}
- 				exif_process_SOFn(data+pos, marker, &sof_info);
- 				ImageInfo->Thumbnail.height   = sof_info.height;
- 				ImageInfo->Thumbnail.width    = sof_info.width;
-@@ -4178,7 +4182,9 @@ PHP_FUNCTION(exif_thumbnail)
- 	ZVAL_STRINGL(return_value, ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size, 1);
- 	if (arg_c >= 3) {
- 		if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
--			exif_scan_thumbnail(&ImageInfo TSRMLS_CC);
-+			if (!exif_scan_thumbnail(&ImageInfo TSRMLS_CC)) {
-+				ImageInfo.Thumbnail.width = ImageInfo.Thumbnail.height = 0;
-+			}
- 		}
- 		zval_dtor(p_width);
- 		zval_dtor(p_height);

php-CVE-2019-9675.patch Deleted

php-CVE-2019-9638,9639.patch -> php-CVE-2026-109618,109619.patch Changed

@@ -1,21 +1,708 @@
-Index: php-7.0.7/ext/exif/exif.c
-===================================================================
---- php-7.0.7.orig/ext/exif/exif.c	2019-03-19 14:13:08.617899764 +0100
-+++ php-7.0.7/ext/exif/exif.c	2019-03-19 14:15:02.922567478 +0100
-@@ -2729,7 +2729,7 @@ static int exif_process_IFD_in_MAKERNOTE
- 		break;
- 	}
- 
--	if (maker_note->offset >= value_len) {
-+	if (value_len < 2 || maker_note->offset >= value_len - 1) {
- 		/* Do not go past the value end */
- 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
- 		return FALSE;
-@@ -2782,6 +2782,7 @@ static int exif_process_IFD_in_MAKERNOTE
- 			break;
- 		default:
- 		case MN_OFFSET_NORMAL:
-+			data_len = value_len;
- 			break;
+diff -ruN --exclude=enhance56.py php-5.6.40/Zend/zend_alloc.c php-5.6.40-enhanced/Zend/zend_alloc.c
+--- a/Zend/zend_alloc.c	2019-01-09 12:54:13
++++ b/Zend/zend_alloc.c	2026-10-21 18:49:05
+@@ -91,7 +91,7 @@
+ #if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID)
+ 	kill(getpid(), SIGSEGV);
+ #endif
+-	exit(1);
++	_exit(1);
+ }
+ 
+ /*******************/
+@@ -1740,6 +1740,37 @@
+ 	}
+ }
+ 
++ZEND_API void zend_mm_safe_error_ex(const char *format, ...)
++{
++	const char *error_filename = NULL;
++	uint error_lineno = 0;
++	TSRMLS_FETCH();
++
++	if (zend_is_compiling(TSRMLS_C)) {
++		error_filename = zend_get_compiled_filename(TSRMLS_C);
++		error_lineno = zend_get_compiled_lineno(TSRMLS_C);
++	} else if (EG(in_execution)) {
++		error_filename = EG(active_op_array) ? EG(active_op_array)->filename : NULL;
++		error_lineno = EG(opline_ptr) ? (*EG(opline_ptr))->lineno : 0;
++	}
++	if (!error_filename) {
++		error_filename = "Unknown";
++	}
++
++	{
++		va_list args;
++		va_start(args, format);
++		fprintf(stderr, "\nFatal error: ");
++		vfprintf(stderr, format, args);
++		va_end(args);
++		fprintf(stderr, " in %s on line %u\n", error_filename, error_lineno);
++	}
++#ifdef PHP_WIN32
++	fflush(stderr);
++#endif
++	_exit(1);
++}
++
+ static void zend_mm_safe_error(zend_mm_heap *heap,
+ 	const char *format,
+ 	size_t limit,
+@@ -1749,59 +1780,13 @@
+ #endif
+ 	size_t size)
+ {
+-	if (heap->reserve) {
+-		_zend_mm_free_int(heap, heap->reserve ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC);
+-		heap->reserve = NULL;
+-	}
+-	if (heap->overflow == 0) {
+-		const char *error_filename;
+-		uint error_lineno;
+-		TSRMLS_FETCH();
+-		if (zend_is_compiling(TSRMLS_C)) {
+-			error_filename = zend_get_compiled_filename(TSRMLS_C);
+-			error_lineno = zend_get_compiled_lineno(TSRMLS_C);
+-		} else if (EG(in_execution)) {
+-			error_filename = EG(active_op_array)?EG(active_op_array)->filename:NULL;
+-			error_lineno = EG(opline_ptr)?(*EG(opline_ptr))->lineno:0;
+-		} else {
+-			error_filename = NULL;
+-			error_lineno = 0;
+-		}
+-		if (!error_filename) {
+-			error_filename = "Unknown";
+-		}
+-		heap->overflow = 1;
+-		zend_try {
+-			zend_error_noreturn(E_ERROR,
+-				format,
+-				limit,
++	(void) heap;
++	zend_mm_safe_error_ex(format, limit,
+ #if ZEND_DEBUG
+-				filename,
+-				lineno,
++		filename,
++		lineno,
+ #endif
+-				size);
+-		} zend_catch {
+-			if (heap->overflow == 2) {
+-				fprintf(stderr, "\nFatal error: ");
+-				fprintf(stderr,
+-					format,
+-					limit,
+-#if ZEND_DEBUG
+-					filename,
+-					lineno,
+-#endif
+-					size);
+-				fprintf(stderr, " in %s on line %d\n", error_filename, error_lineno);
+-			}
+-/* See http://support.microsoft.com/kb/190351 */
+-#ifdef PHP_WIN32
+-			fflush(stderr);
+-#endif
+-		} zend_end_try();
+-	} else {
+-		heap->overflow = 2;
+-	}
+-	zend_bailout();
++		size);
+ }
+ 
+ static zend_mm_free_block *zend_mm_search_large_block(zend_mm_heap *heap, size_t true_size)
+@@ -2472,7 +2457,7 @@
+ 	       "rm"(offset));
+ 
+ 	if (UNEXPECTED(overflow)) {
+-		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
++		zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+ 		return 0;
+ 	}
+ 	return res;
+@@ -2501,7 +2486,7 @@
+ 
+ #undef LP_SUFF
+         if (UNEXPECTED(overflow)) {
+-                zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
++                zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+                 return 0;
+         }
+         return res;
+@@ -2522,7 +2507,7 @@
+                "1"(0));
+ 
+         if (UNEXPECTED(overflow)) {
+-                zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
++                zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+                 return 0;
+         }
+         return res;
+@@ -2542,7 +2527,7 @@
+                "r"(offset));
+ 
+         if (UNEXPECTED(overflow)) {
+-                zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
++                zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+                 return 0;
+         }
+         return res;
+@@ -2555,7 +2540,7 @@
+ 	zend_ulong64 res = (zend_ulong64)nmemb * (zend_ulong64)size + (zend_ulong64)offset;
+ 
+ 	if (UNEXPECTED(res > (zend_ulong64)0xFFFFFFFFL)) {
+-		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
++		zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+ 		return 0;
  	}
+ 	return (size_t) res;
+@@ -2570,7 +2555,7 @@
+ 	double _delta = (double)res - _d;
+ 
+ 	if (UNEXPECTED((_d + _delta ) != _d)) {
+-		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
++		zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+ 		return 0;
+ 	}
+ 	return res;
+@@ -2582,7 +2567,7 @@
+ {
+ 	size_t str_size = safe_address(nmemb, size, offset);
+ 	if (UNEXPECTED(str_size > INT_MAX)) {
+-		zend_error_noreturn(E_ERROR, "String allocation overflow, max size is %d", INT_MAX);
++		zend_mm_safe_error_ex("String allocation overflow, max size is %d", INT_MAX);
+ 	}
+ 	return emalloc_rel(str_size);
+ }
+diff -ruN --exclude=enhance56.py php-5.6.40/Zend/zend_alloc.h php-5.6.40-enhanced/Zend/zend_alloc.h
+--- a/Zend/zend_alloc.h	2019-01-09 12:54:13

php5-BNC-457056.patch Changed

php-5.6.40.tar.xz.asc Deleted

php-5.6.40.tar.xz/NEWS Changed

@@ -1,5 +1,336 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+
+Backported from 8.2.32
+
+- OpenSSL:
+  . Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in
+    openssl_encrypt with AES-WRAP-PAD). (David Carlier)
+
+Backported from 8.2.31
+
+- FPM:
+  . Fixed GHSA-7qg2-v9fj-4mwv (XSS within status endpoint). (CVE-2026-6735)
+    (Jakub Zelenka)
+
+- SOAP:
+  . Fixed GHSA-m33r-qmcv-p97q (Use-after-free after header parsing failure with
+    SOAP_PERSISTENCE_SESSION). (CVE-2026-7261) (ilutov)
+  . Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check).
+    (CVE-2026-7262) (ilutov)
+
+Backported from 8.1.31
+
+- CLI:
+  . Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data
+    Processing in CLI SAPI Interface). (nielsdos)
+
+- LDAP:
+  . Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932)
+    (nielsdos)
+
+- Streams:
+  . Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context
+    might allow for CRLF injection in URIs). (CVE-2024-11234) (Jakub Zelenka)
+  . Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with
+    convert.quoted-printable-decode filter). (CVE-2024-11233) (nielsdos)
+
+Backported from 8.1.30
+
+- CGI:
+  . Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection
+    Vulnerability). (CVE-2024-8926) (nielsdos)
+  . Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is
+    bypassable due to the environment variable collision). (CVE-2024-8927)
+    (nielsdos)
+
+- SAPI:
+  . Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data).
+    (CVE-2024-8925) (Arnaud)
+
+Backported from 8.1.29
+
+- CGI:
+  . Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection
+    in PHP-CGI). (CVE-2024-4577) (nielsdos)
+
+- Filter:
+  . Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL).
+    (CVE-2024-5458) (nielsdos)
+
+Backported from 8.1.28
+
+- Standard:
+  . Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to
+    partial CVE-2022-31629 fix). (CVE-2024-2756) (nielsdos)
+  . Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true,
+    opening ATO risk). (CVE-2024-3096) (Jakub Zelenka)
+
+Backported from 8.0.30
+
+- Libxml:
+  . Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading
+    in XML without enabling it). (CVE-2023-3823) (nielsdos, ilutov)
+
+- Phar:
+  . Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()).
+    (CVE-2023-3824) (nielsdos)
+
+Backported from 8.0.29
+
+- Soap:
+  . Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random
+    bytes in HTTP Digest authentication for SOAP).
+    (CVE-2023-3247) (nielsdos, timwolla)
+
+Backported from 8.0.28
+
+- Core:
+  . Fixed bug #81744 (Password_verify() always return true with some hash).
+    (CVE-2023-0567). (Tim Düsterhus)
+  . Fixed bug #81746 (1-byte array overrun in common path resolve code).
+    (CVE-2023-0568). (Niels Dossche)
+  . Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart
+    request body). (CVE-2023-0662) (Jakub Zelenka)
+
+Backported from 8.0.27
+
+- PDO/SQLite:
+  . Fixed bug #81740 (PDO::quote() may return unquoted string).
+    (CVE-2022-31631) (cmb)
+
+Backported from 7.4.32
+
+- Core:
+  . Fixed bug #81727: Don't mangle HTTP variable names that clash with ones
+    that have a specific semantic meaning. (CVE-2022-31629). (Derick)
+
+- Phar:
+  . Fixed bug #81726: phar wrapper: DOS when using quine gzip file.
+    (CVE-2022-31628). (cmb)
+
+Backported from 7.4.30
+
+- mysqlnd:
+  . Fixed bug #81719: mysqlnd/pdo password buffer overflow.
+    (CVE-2022-31626) (c dot fol at ambionics dot io)
+
+- pgsql
+  . Fixed bug #81720: Uninitialized array in pg_query_params().
+    (CVE-2022-31625) (cmb)
+
+Backported from 7.3.33
+
+- XML:
+  . Fix #79971: special character is breaking the path in xml function.
+    (CVE-2021-21707) (cmb)
+
+Backported from 7.3.32
+
+- FPM:
+  . Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege
+    escalation) (CVE-2021-21703). (Jakub Zelenka)
+
+Backported from 7.3.31
+
+- Zip:
+  . Fixed bug #81420 (ZipArchive::extractTo extracts outside of destination).
+    (CVE-2021-21706) (cmb)
+
+Backported from 7.3.30
+
+- Phar:
+  . Fixed bug #81211: Symlinks are followed when creating PHAR archive (cmb)
+
+Backported from 7.3.29
+
+- Core:
+  . Fixed #81122: SSRF bypass in FILTER_VALIDATE_URL. (CVE-2021-21705) (cmb)
+
+- PDO_Firebird:
+  . Fixed #76448: Stack buffer overflow in firebird_info_cb. (CVE-2021-21704)
+    (cmb)
+  . Fixed #76449: SIGSEGV in firebird_handle_doer. (CVE-2021-21704) (cmb)
+  . Fixed #76450: SIGSEGV in firebird_stmt_execute. (CVE-2021-21704) (cmb)
+  . Fixed #76452: Crash while parsing blob data in firebird_fetch_blob.
+    (CVE-2021-21704) (cmb)
+
+Backported from 7.3.28
+
+- Imap:
+  . Fixed bug #80710 (imap_mail_compose() header injection). (cmb, Stas)
+
+Backported from 7.3.27
+
+- SOAP:
+  . Fixed bug #80672 (Null Dereference in SoapClient). (CVE-2021-21702) (cmb, Stas)
+
+Backported from 7.3.26
+
+- Standard:
+  . Fixed bug #77423 (FILTER_VALIDATE_URL accepts URLs with invalid userinfo).
+    (CVE-2020-7071) (cmb)
+
+Backported from 7.2.34
+
+- Core:
+  . Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-`
+    cookies can be sent). (CVE-2020-7070) (Stas)
+
+Backported from 7.2.33
+
+- Core:
+  . Fixed bug #79877 (getimagesize function silently truncates after a null 
+    byte) (cmb)
+
+- Phar:
+  . Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile
+    function). (CVE-2020-7068) (cmb)
+
+Backported from 7.2.31
+
+- Core:
+  . Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned).
+    (CVE-2019-11048) (cmb)
+  . Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp
+    files are not cleaned). (CVE-2019-11048) (cmb)
+
+Backported from 7.2.30
+

php-5.6.40.tar.xz/README.md Changed

@@ -1,39 +1,4 @@
-The PHP Interpreter
-===================
+This is a fork of the official PHP repository which receives backport of security fixes from maintained branches.
 
-This is the github mirror of the official PHP repository located at
-http://git.php.net.
-
-!Build Status(https://secure.travis-ci.org/php/php-src.png?branch=master)(http://travis-ci.org/php/php-src)
-
-Pull Requests
-=============
-PHP accepts pull requests via github. Discussions are done on github, but
-depending on the topic can also be relayed to the official PHP developer
-mailinglist internals@lists.php.net.
-
-New features require an RFC and must be accepted by the developers.
-See https://wiki.php.net/rfc and https://wiki.php.net/rfc/voting for more
-information on the process.
-
-Bug fixes **do not** require an RFC, but require a bugtracker ticket. Always
-open a ticket at https://bugs.php.net and reference the bug id using #NNNNNN.
-
-    Fix #55371: get_magic_quotes_gpc() throws deprecation warning
-
-    After removing magic quotes, the get_magic_quotes_gpc function caused
-    a deprecate warning. get_magic_quotes_gpc can be used to detected
-    the magic_quotes behavior and therefore should not raise a warning at any
-    time. The patch removes this warning
-
-We do not merge pull requests directly on github. All PRs will be
-pulled and pushed through http://git.php.net.
-
-
-Guidelines for contributors
-===========================
-- CODING_STANDARDS(/CODING_STANDARDS)
-- README.GIT-RULES(/README.GIT-RULES)
-- README.MAILINGLIST_RULES(/README.MAILINGLIST_RULES)
-- README.RELEASE_PROCESS(/README.RELEASE_PROCESS)
+This branch is PHP version 5.6.40 with security fix.

php-5.6.40.tar.xz/ext/bcmath/libbcmath/src/str2num.c Changed

php-5.6.40.tar.xz/ext/bcmath/tests/bug78878.phpt Added

php-5.6.40.tar.xz/ext/curl/config.w32 Changed

@@ -4,16 +4,29 @@
 ARG_WITH("curl", "cURL support", "no");
 
 if (PHP_CURL != "no") {
+	var ver_num = NaN;
+	var f = PHP_PHP_BUILD + "/include/curl/curlver.h";
+	if (FSO.FileExists(f)) {
+		var reg = /LIBCURL_VERSION_NUM\s+(0xa-z0-9+)/gi;
+		var m = reg.exec(file_get_contents(PHP_PHP_BUILD + "/include/curl/curlver.h"));
+		if (!!m && m.length >= 2) {
+			ver_num = parseInt(m1);
+		}
+	}
+
 	if (CHECK_LIB("libcurl_a.lib;libcurl.lib", "curl", PHP_CURL) &&
-			CHECK_HEADER_ADD_INCLUDE("curl/easy.h", "CFLAGS_CURL") &&
-			CHECK_LIB("ssleay32.lib", "curl", PHP_CURL) &&
-			CHECK_LIB("libeay32.lib", "curl", PHP_CURL) 
-		&& CHECK_LIB("winmm.lib", "curl", PHP_CURL)
-		&& CHECK_LIB("wldap32.lib", "curl", PHP_CURL)
-		&& (((PHP_ZLIB=="no") && (CHECK_LIB("zlib_a.lib;zlib.lib", "curl", PHP_CURL))) || 
-			(PHP_ZLIB_SHARED && CHECK_LIB("zlib.lib", "curl", PHP_CURL)) || (PHP_ZLIB == "yes" && (!PHP_ZLIB_SHARED)))
+		CHECK_HEADER_ADD_INCLUDE("curl/easy.h", "CFLAGS_CURL") &&
+		SETUP_OPENSSL("curl", PHP_CURL) > 0 &&
+		CHECK_LIB("winmm.lib", "curl", PHP_CURL) &&
+		CHECK_LIB("wldap32.lib", "curl", PHP_CURL) &&
+		(((PHP_ZLIB=="no") && (CHECK_LIB("zlib_a.lib;zlib.lib", "curl", PHP_CURL))) ||
+			(PHP_ZLIB_SHARED && CHECK_LIB("zlib.lib", "curl", PHP_CURL)) || (PHP_ZLIB == "yes" && (!PHP_ZLIB_SHARED))) &&
+		!isNaN(ver_num) &&
+		(ver_num <= parseInt("0x073b00") || ver_num > parseInt("0x073b00") &&
+			CHECK_LIB("normaliz.lib", "curl", PHP_CURL) &&
+			CHECK_LIB("libssh2.lib", "curl", PHP_CURL))
 		) {
-		EXTENSION("curl", "interface.c multi.c share.c curl_file.c", true);
+		EXTENSION("curl", "interface.c multi.c share.c curl_file.c");
 		AC_DEFINE('HAVE_CURL', 1, 'Have cURL library');
 		AC_DEFINE('HAVE_CURL_SSL', 1, 'Have SSL suppurt in cURL');
 		AC_DEFINE('HAVE_CURL_EASY_STRERROR', 1, 'Have curl_easy_strerror in cURL');

php-5.6.40.tar.xz/ext/curl/tests/bug48203-win32.phpt Added

php-5.6.40.tar.xz/ext/curl/tests/bug48203.phpt Changed

php-5.6.40.tar.xz/ext/curl/tests/bug48203_multi-win32.phpt Added

@@ -0,0 +1,89 @@
+--TEST--
+Variation of bug #48203 with curl_multi_exec (Crash when file pointers passed to curl are closed before calling curl_multi_exec)
+--SKIPIF--
+<?php
+include 'skipif.inc';
+if(substr(PHP_OS, 0, 3) != 'WIN' ) {
+    die('skip Windows only test');
+}
+?>
+--FILE--
+<?php
+include 'server.inc';
+function checkForClosedFilePointer($curl_option, $description) {
+	$fp = fopen(dirname(__FILE__) . '/bug48203.tmp', 'w');
+
+	$ch1 = curl_init();
+	$ch2 = curl_init();
+
+	$options = array(
+		CURLOPT_RETURNTRANSFER => 1,
+		$curl_option => $fp,
+		CURLOPT_URL => curl_cli_server_start()
+	);
+
+	// we also need to set CURLOPT_VERBOSE to test CURLOPT_STDERR properly
+	if (CURLOPT_STDERR == $curl_option) {
+		$optionsCURLOPT_VERBOSE = 1;
+	}
+
+	if (CURLOPT_INFILE == $curl_option) {
+	    $optionsCURLOPT_UPLOAD = 1;
+	}
+
+	curl_setopt_array($ch1, $options);
+	curl_setopt_array($ch2, $options);
+
+	fclose($fp); // <-- premature close of $fp caused a crash!
+
+	$mh = curl_multi_init();
+
+	curl_multi_add_handle($mh, $ch1);
+	curl_multi_add_handle($mh, $ch2);
+
+	$active = 0;
+	do {
+		curl_multi_exec($mh, $active);
+	} while ($active > 0);
+
+	curl_multi_remove_handle($mh, $ch1);
+	curl_multi_remove_handle($mh, $ch2);
+	curl_multi_close($mh);
+
+	echo "Ok for $description\n";
+}
+
+$options_to_check = array(
+	"CURLOPT_STDERR", "CURLOPT_WRITEHEADER", "CURLOPT_FILE", "CURLOPT_INFILE"
+);
+
+foreach($options_to_check as $option) {
+	checkForClosedFilePointer(constant($option), $option);
+}
+
+?>
+--CLEAN--
+<?php @unlink(dirname(__FILE__) . '/bug48203.tmp'); ?>
+--EXPECTF--
+Warning: curl_multi_exec(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d
+
+Warning: curl_multi_exec(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d
+%AOk for CURLOPT_STDERR
+%A
+
+Warning: curl_multi_exec(): CURLOPT_WRITEHEADER resource has gone away, resetting to default in %s on line %d
+
+Warning: curl_multi_exec(): CURLOPT_WRITEHEADER resource has gone away, resetting to default in %s on line %d
+Ok for CURLOPT_WRITEHEADER
+
+Warning: curl_multi_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
+
+Warning: curl_multi_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
+Hello World!
+Hello World!Hello World!
+Hello World!Ok for CURLOPT_FILE
+
+Warning: curl_multi_exec(): CURLOPT_INFILE resource has gone away, resetting to default in %s on line %d
+
+Warning: curl_multi_exec(): CURLOPT_INFILE resource has gone away, resetting to default in %s on line %d
+Ok for CURLOPT_INFILE

php-5.6.40.tar.xz/ext/curl/tests/bug48203_multi.phpt Changed

php-5.6.40.tar.xz/ext/curl/tests/bug54798-win32.phpt Added

@@ -0,0 +1,68 @@
+--TEST--
+Bug #54798 (Segfault when CURLOPT_STDERR file pointer is closed before calling curl_exec)
+--SKIPIF--
+<?php 
+include 'skipif.inc';
+if(substr(PHP_OS, 0, 3) != 'WIN' ) {
+    die('skip Windows only');
+}
+?>
+--FILE--
+<?php
+
+function checkForClosedFilePointer($host, $curl_option, $description) {
+	$fp = fopen(dirname(__FILE__) . '/bug54798.tmp', 'w+');
+
+	$ch = curl_init();
+
+	// we also need CURLOPT_VERBOSE to be set to test CURLOPT_STDERR properly
+	if (CURLOPT_STDERR == $curl_option) {
+		curl_setopt($ch, CURLOPT_VERBOSE, 1);
+	}
+
+    if (CURLOPT_INFILE == $curl_option) {
+        curl_setopt($ch, CURLOPT_UPLOAD, 1);
+    }
+
+	curl_setopt($ch, $curl_option, $fp);
+	
+	curl_setopt($ch, CURLOPT_URL, $host);
+	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+
+	fclose($fp); // <-- premature close of $fp caused a crash!
+
+	curl_exec($ch);
+
+	curl_close($ch);
+
+	echo "Ok for $description\n";
+}
+
+$options_to_check = array(
+	"CURLOPT_STDERR",
+    "CURLOPT_WRITEHEADER",
+    "CURLOPT_FILE",
+    "CURLOPT_INFILE"
+);
+
+include 'server.inc';
+$host = curl_cli_server_start();
+foreach($options_to_check as $option) {
+	checkForClosedFilePointer($host, constant($option), $option);
+}
+
+?>
+===DONE===
+--CLEAN--
+<?php @unlink(dirname(__FILE__) . '/bug54798.tmp'); ?>
+--EXPECTF--
+%AOk for CURLOPT_STDERR
+
+%AOk for CURLOPT_WRITEHEADER
+
+%AHello World!
+Hello World!Ok for CURLOPT_FILE
+
+%AOk for CURLOPT_INFILE
+===DONE===
+%A

php-5.6.40.tar.xz/ext/curl/tests/bug54798.phpt Changed

php-5.6.40.tar.xz/ext/curl/tests/bug61948-win32.phpt Changed

@@ -5,19 +5,28 @@
 if(substr(PHP_OS, 0, 3) != 'WIN' )
   die("skip Not Valid for Linux");
 ?>
---INI--
-open_basedir="c:/tmp"
 --FILE--
 <?php
+  $base_dir = dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug61948";
+  mkdir($base_dir . DIRECTORY_SEPARATOR . "foo", 0755, true);
+
+  ini_set("open_basedir", $base_dir);
+
   $ch = curl_init();
   var_dump(curl_setopt($ch, CURLOPT_COOKIEFILE, ""));
-  var_dump(curl_setopt($ch, CURLOPT_COOKIEFILE, "c:/tmp/foo"));
+  var_dump(curl_setopt($ch, CURLOPT_COOKIEFILE, "$base_dir/foo"));
   var_dump(curl_setopt($ch, CURLOPT_COOKIEFILE, "c:/xxx/bar"));
   curl_close($ch);
 ?>
+--CLEAN--
+<?php
+	$base_dir = dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug61948";
+	rmdir("$base_dir/foo");
+	rmdir($base_dir);
+?>
 --EXPECTF--
 %a
 bool(true)
 
-Warning: curl_setopt(): open_basedir restriction in effect. File(c:/xxx/bar) is not within the allowed path(s): (c:/tmp) in %sbug61948-win32.php on line %d
+Warning: curl_setopt(): open_basedir restriction in effect. File(c:/xxx/bar) is not within the allowed path(s): (%sbug61948) in %sbug61948-win32.php on line %d
 bool(false)

php-5.6.40.tar.xz/ext/curl/tests/check_win_config.phpt Changed

php-5.6.40.tar.xz/ext/curl/tests/curl_basic_009.phpt Changed

php-5.6.40.tar.xz/ext/date/lib/parse_date.c Changed

@@ -1,4 +1,5 @@
 /* Generated by re2c 0.15.3 on Tue Oct 24 10:49:45 2017 */
+#line 1 "ext/date/lib/parse_date.re"
 /*
  * The MIT License (MIT)
  *
@@ -823,9 +824,11 @@
 std:
 	s->tok = cursor;
 	s->len = 0;
+#line 950 "ext/date/lib/parse_date.re"
 
 
 
+#line 832 "<stdout>"
 {
 	YYCTYPE yych;
 	unsigned int yyaccept = 0;
@@ -963,6 +966,7 @@
 	}
 yy3:
 	YYDEBUG(3, *YYCURSOR);
+#line 1630 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("tzcorrection | tz");
@@ -975,6 +979,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_TIMEZONE;
 	}
+#line 983 "<stdout>"
 yy4:
 	YYDEBUG(4, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -1283,10 +1288,12 @@
 	if (yych <= '9') goto yy1327;
 yy12:
 	YYDEBUG(12, *YYCURSOR);
+#line 1725 "ext/date/lib/parse_date.re"
 	{
 		add_error(s, "Unexpected character");
 		goto std;
 	}
+#line 1297 "<stdout>"
 yy13:
 	YYDEBUG(13, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -2337,9 +2344,11 @@
 	if (yych <= '9') goto yy54;
 yy49:
 	YYDEBUG(49, *YYCURSOR);
+#line 1714 "ext/date/lib/parse_date.re"
 	{
 		goto std;
 	}
+#line 2352 "<stdout>"
 yy50:
 	YYDEBUG(50, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -2348,10 +2357,12 @@
 	YYDEBUG(51, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(52, *YYCURSOR);
+#line 1719 "ext/date/lib/parse_date.re"
 	{
 		s->pos = cursor; s->line++;
 		goto std;
 	}
+#line 2366 "<stdout>"
 yy53:
 	YYDEBUG(53, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -2734,6 +2745,7 @@
 	if (yych == 's') goto yy73;
 yy72:
 	YYDEBUG(72, *YYCURSOR);
+#line 1698 "ext/date/lib/parse_date.re"
 	{
 		timelib_ull i;
 		DEBUG_OUTPUT("relative");
@@ -2748,6 +2760,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
+#line 2764 "<stdout>"
 yy73:
 	YYDEBUG(73, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -3509,6 +3522,7 @@
 	}
 yy166:
 	YYDEBUG(166, *YYCURSOR);
+#line 1561 "ext/date/lib/parse_date.re"
 	{
 		const timelib_relunit* relunit;
 		DEBUG_OUTPUT("daytext");
@@ -3525,6 +3539,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEKDAY;
 	}
+#line 3543 "<stdout>"
 yy167:
 	YYDEBUG(167, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -4044,6 +4059,7 @@
 	}
 yy193:
 	YYDEBUG(193, *YYCURSOR);
+#line 1620 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("monthtext");
 		TIMELIB_INIT;
@@ -4052,6 +4068,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
+#line 4072 "<stdout>"
 yy194:
 	YYDEBUG(194, *YYCURSOR);
 	++YYCURSOR;
@@ -4300,6 +4317,7 @@
 	goto yy212;
 yy207:
 	YYDEBUG(207, *YYCURSOR);
+#line 1366 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datetextual | datenoyear");
@@ -4312,6 +4330,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
+#line 4334 "<stdout>"
 yy208:
 	YYDEBUG(208, *YYCURSOR);
 	yyaccept = 6;
@@ -4438,6 +4457,7 @@
 	}
 yy221:
 	YYDEBUG(221, *YYCURSOR);
+#line 1668 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("dateshortwithtimeshort | dateshortwithtimelong | dateshortwithtimelongtz");
@@ -4466,6 +4486,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_SHORTDATE_WITH_TIME;
 	}
+#line 4490 "<stdout>"
 yy222:
 	YYDEBUG(222, *YYCURSOR);
 	yyaccept = 7;
@@ -4763,6 +4784,7 @@
 	YYDEBUG(245, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(246, *YYCURSOR);
+#line 1644 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("dateshortwithtimeshort12 | dateshortwithtimelong12");
 		TIMELIB_INIT;
@@ -4785,6 +4807,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_SHORTDATE_WITH_TIME;
 	}
+#line 4811 "<stdout>"
 yy247:
 	YYDEBUG(247, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -5391,6 +5414,7 @@
 	YYDEBUG(296, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(297, *YYCURSOR);
+#line 1338 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datenoday");
@@ -5403,6 +5427,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NO_DAY;
 	}
+#line 5431 "<stdout>"
 yy298:
 	YYDEBUG(298, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -5633,6 +5658,7 @@
 	if (yych <= '9') goto yy306;
 yy305:
 	YYDEBUG(305, *YYCURSOR);
+#line 1482 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgtextshort");
@@ -5645,6 +5671,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_TEXT;
 	}
+#line 5675 "<stdout>"
 yy306:
 	YYDEBUG(306, *YYCURSOR);
 	yych = *++YYCURSOR;

php-5.6.40.tar.xz/ext/date/tests/gmstrftime_variation21.phpt Changed

php-5.6.40.tar.xz/ext/date/tests/strftime_variation21.phpt Changed

php-5.6.40.tar.xz/ext/dom/document.c Changed

@@ -1498,7 +1498,7 @@
 	int validate, recover, resolve_externals, keep_blanks, substitute_ent;
 	int resolved_path_len;
 	int old_error_reporting = 0;
-	char *directory=NULL, resolved_pathMAXPATHLEN;
+	char *directory=NULL, resolved_pathMAXPATHLEN + 1;
 
 	if (id != NULL) {
 		intern = (dom_object *)zend_object_store_get_object(id TSRMLS_CC);
@@ -1577,6 +1577,7 @@
 		options |= XML_PARSE_NOBLANKS;
 	}
 
+	php_libxml_sanitize_parse_ctxt_options(ctxt);
 	xmlCtxtUseOptions(ctxt, options);
 
 	ctxt->recovery = recover;
@@ -1852,6 +1853,7 @@
 	long flags = 0;
 	int err;
 	dom_object *intern;
+	PHP_LIBXML_SANITIZE_GLOBALS_DECL(xinclude);
 
 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "O|l", &id, dom_document_class_entry, &flags) == FAILURE) {
 		return;
@@ -1859,7 +1861,9 @@
 
 	DOM_GET_OBJ(docp, id, xmlDocPtr, intern);
 
+	PHP_LIBXML_SANITIZE_GLOBALS(xinclude);
 	err = xmlXIncludeProcessFlags(docp, flags);
+	PHP_LIBXML_RESTORE_GLOBALS(xinclude);
 
 	/* XML_XINCLUDE_START and XML_XINCLUDE_END nodes need to be removed as these
 	are added via xmlXIncludeProcess to mark beginning and ending of xincluded document
@@ -1891,6 +1895,7 @@
 	xmlDoc *docp;
 	dom_object *intern;
 	xmlValidCtxt *cvp;
+	PHP_LIBXML_SANITIZE_GLOBALS_DECL(validate);
 
 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "O", &id, dom_document_class_entry) == FAILURE) {
 		return;
@@ -1898,6 +1903,7 @@
 
 	DOM_GET_OBJ(docp, id, xmlDocPtr, intern);
 
+	PHP_LIBXML_SANITIZE_GLOBALS(validate);
 	cvp = xmlNewValidCtxt();
 
 	cvp->userData = NULL;
@@ -1909,6 +1915,7 @@
 	} else {
 		RETVAL_FALSE;
 	}
+	PHP_LIBXML_RESTORE_GLOBALS(validate);
 
 	xmlFreeValidCtxt(cvp);
 
@@ -1929,6 +1936,7 @@
 	xmlSchemaValidCtxtPtr   vptr;
 	int                     is_valid;
 	char resolved_pathMAXPATHLEN + 1;
+	PHP_LIBXML_SANITIZE_GLOBALS_DECL(new_parser_ctxt);
 
 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
 		return;
@@ -1941,14 +1949,18 @@
 
 	DOM_GET_OBJ(docp, id, xmlDocPtr, intern);
 
+	PHP_LIBXML_SANITIZE_GLOBALS(new_parser_ctxt);
+
 	switch (type) {
 	case DOM_LOAD_FILE:
 		if (CHECK_NULL_PATH(source, source_len)) {
+			PHP_LIBXML_RESTORE_GLOBALS(new_parser_ctxt);
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
 			RETURN_FALSE;
 		}
 		valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
 		if (!valid_file) {
+			PHP_LIBXML_RESTORE_GLOBALS(new_parser_ctxt);
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
 			RETURN_FALSE;
 		}
@@ -1969,6 +1981,7 @@
 		parser);
 	sptr = xmlSchemaParse(parser);
 	xmlSchemaFreeParserCtxt(parser);
+	PHP_LIBXML_RESTORE_GLOBALS(new_parser_ctxt);
 	if (!sptr) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema");
 		RETURN_FALSE;
@@ -1989,16 +2002,21 @@
 	}
 #endif
 
-	xmlSchemaSetValidOptions(vptr, valid_opts);
-	xmlSchemaSetValidErrors(vptr, php_libxml_error_handler, php_libxml_error_handler, vptr);
-	is_valid = xmlSchemaValidateDoc(vptr, docp);
-	xmlSchemaFree(sptr);
-	xmlSchemaFreeValidCtxt(vptr);
+	if (vptr) {
+		PHP_LIBXML_SANITIZE_GLOBALS_DECL(validate);
+		PHP_LIBXML_SANITIZE_GLOBALS(validate);
+		xmlSchemaSetValidOptions(vptr, valid_opts);
+		xmlSchemaSetValidErrors(vptr, php_libxml_error_handler, php_libxml_error_handler, vptr);
+		is_valid = xmlSchemaValidateDoc(vptr, docp);
+		xmlSchemaFree(sptr);
+		xmlSchemaFreeValidCtxt(vptr);
+		PHP_LIBXML_RESTORE_GLOBALS(validate);
 
-	if (is_valid == 0) {
-		RETURN_TRUE;
-	} else {
-		RETURN_FALSE;
+		if (is_valid == 0) {
+			RETURN_TRUE;
+		} else {
+			RETURN_FALSE;
+		}
 	}
 }
 /* }}} */
@@ -2029,6 +2047,7 @@
 	xmlRelaxNGValidCtxtPtr  vptr;
 	int                     is_valid;
 	char resolved_pathMAXPATHLEN + 1;
+	PHP_LIBXML_SANITIZE_GLOBALS_DECL(parse);
 
 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
 		return;
@@ -2063,12 +2082,14 @@
 		return;
 	}
 
+	PHP_LIBXML_SANITIZE_GLOBALS(parse);
 	xmlRelaxNGSetParserErrors(parser,
 		(xmlRelaxNGValidityErrorFunc) php_libxml_error_handler,
 		(xmlRelaxNGValidityWarningFunc) php_libxml_error_handler,
 		parser);
 	sptr = xmlRelaxNGParse(parser);
 	xmlRelaxNGFreeParserCtxt(parser);
+	PHP_LIBXML_RESTORE_GLOBALS(parse);
 	if (!sptr) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG");
 		RETURN_FALSE;
@@ -2151,6 +2172,7 @@
 		RETURN_FALSE;
 	}
 
+	php_libxml_sanitize_parse_ctxt_options(ctxt);
 	if (options) {
 		htmlCtxtUseOptions(ctxt, options);
 	}

php-5.6.40.tar.xz/ext/dom/documentfragment.c Changed

php-5.6.40.tar.xz/ext/dom/domimplementation.c Changed

php-5.6.40.tar.xz/ext/dom/tests/bug79971_2.phpt Added

php-5.6.40.tar.xz/ext/dom/tests/dom005.phpt Changed

php-5.6.40.tar.xz/ext/exif/exif.c Changed

@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: cad29b729548e4206f0697710cc9e177f26fdff3 $ */
+/* $Id: bf2fd61cd1e4c50e762c11e3712867f2c6ef12d7 $ */
 
 /*  ToDos
  *
@@ -128,7 +128,7 @@
 };
 /* }}} */
 
-#define EXIF_VERSION "1.4 $Id: cad29b729548e4206f0697710cc9e177f26fdff3 $"
+#define EXIF_VERSION "1.4 $Id: bf2fd61cd1e4c50e762c11e3712867f2c6ef12d7 $"
 
 /* {{{ PHP_MINFO_FUNCTION
  */
@@ -1660,10 +1660,10 @@
 /* {{{ exif_iif_add_value
  Add a value to image_info
 */
-static void exif_iif_add_value(image_info_type *image_info, int section_index, char *name, int tag, int format, int length, void* value, int motorola_intel TSRMLS_DC)
+static void exif_iif_add_value(image_info_type *image_info, int section_index, char *name, int tag, int format, int length, void* value, size_t value_len, int motorola_intel TSRMLS_DC)
 {
 	size_t idex;
-	void *vptr;
+	void *vptr, *vptr_end;
 	image_info_value *info_value;
 	image_info_data  *info_data;
 	image_info_data  *list;
@@ -1685,8 +1685,12 @@
 
 	switch (format) {
 		case TAG_FMT_STRING:
+			if (length > value_len) {
+				exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "length > value_len: %d > %zu", length, value_len);
+				value = NULL;
+			}
 			if (value) {
-				length = php_strnlen(value, length);
+				length = (int)php_strnlen(value, length);
 				info_value->s = estrndup(value, length);
 				info_data->length = length;
 			} else {
@@ -1708,6 +1712,10 @@
 			if (!length)
 				break;
 		case TAG_FMT_UNDEFINED:
+			if (length > value_len) {
+				exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "length > value_len: %d > %zu", length, value_len);
+				value = NULL;
+			}
 			if (value) {
 				if (tag == TAG_MAKER_NOTE) {
 					length = (int) php_strnlen(value, length);
@@ -1738,7 +1746,12 @@
 			} else {
 				info_value = &info_data->value;
 			}
+			vptr_end = (char *) value + value_len;
 			for (idex=0,vptr=value; idex<(size_t)length; idex++,vptr=(char *) vptr + php_tiff_bytes_per_formatformat) {
+				if ((char *) vptr_end - (char *) vptr < php_tiff_bytes_per_formatformat) {
+					exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "Value too short");
+					break;
+				}
 				if (length>1) {
 					info_value = &info_data->value.listidex;
 				}
@@ -1774,7 +1787,7 @@
 						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Found value of type single");
 #endif
 						info_value->f = *(float *)value;
-
+						break;
 					case TAG_FMT_DOUBLE:
 #ifdef EXIF_DEBUG
 						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Found value of type double");
@@ -1792,9 +1805,9 @@
 /* {{{ exif_iif_add_tag
  Add a tag from IFD to image_info
 */
-static void exif_iif_add_tag(image_info_type *image_info, int section_index, char *name, int tag, int format, size_t length, void* value TSRMLS_DC)
+static void exif_iif_add_tag(image_info_type *image_info, int section_index, char *name, int tag, int format, size_t length, void* value, size_t value_len TSRMLS_DC)
 {
-	exif_iif_add_value(image_info, section_index, name, tag, format, (int)length, value, image_info->motorola_intel TSRMLS_CC);
+	exif_iif_add_value(image_info, section_index, name, tag, format, (int)length, value, value_len, image_info->motorola_intel TSRMLS_CC);
 }
 /* }}} */
 
@@ -2218,7 +2231,7 @@
 */
 static void exif_process_COM (image_info_type *image_info, char *value, size_t length TSRMLS_DC)
 {
-	exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length-2, value+2 TSRMLS_CC);
+	exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length-2, value+2, length-2 TSRMLS_CC);
 }
 /* }}} */
 
@@ -2233,17 +2246,17 @@
 	if (length>3) {
 		switch(value2) {
 			case 0:
-				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, length, value TSRMLS_CC);
+				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, length, value, length TSRMLS_CC);
 				break;
 			case 1:
-				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length, value);
+				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length, value, length);
 				break;
 			default:
 				php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Undefined JPEG2000 comment encoding");
 				break;
 		}
 	} else {
-		exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, 0, NULL);
+		exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, 0, NULL, 0 TSRMLS_CC);
 		php_error_docref(NULL TSRMLS_CC, E_NOTICE, "JPEG2000 comment section too small");
 	}
 }
@@ -2615,7 +2628,7 @@
 {
 	int   a;
 	char  *decode;
-	size_t len;;
+	size_t len;
 
 	*pszEncoding = NULL;
 	/* Copy the comment */
@@ -2628,11 +2641,11 @@
 			/* First try to detect BOM: ZERO WIDTH NOBREAK SPACE (FEFF 16)
 			 * since we have no encoding support for the BOM yet we skip that.
 			 */
-			if (!memcmp(szValuePtr, "\xFE\xFF", 2)) {
+			if (ByteCount >=2 && !memcmp(szValuePtr, "\xFE\xFF", 2)) {
 				decode = "UCS-2BE";
 				szValuePtr = szValuePtr+2;
 				ByteCount -= 2;
-			} else if (!memcmp(szValuePtr, "\xFF\xFE", 2)) {
+			} else if (ByteCount >=2 && !memcmp(szValuePtr, "\xFF\xFE", 2)) {
 				decode = "UCS-2LE";
 				szValuePtr = szValuePtr+2;
 				ByteCount -= 2;
@@ -2746,12 +2759,13 @@
 			continue;
 		if (maker_note->model && (!ImageInfo->model || strcmp(maker_note->model, ImageInfo->model)))
 			continue;
-		if (maker_note->id_string && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
+		if (maker_note->id_string && value_len >= maker_note->id_string_len
+				&& strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
 			continue;
 		break;
 	}
 
-	if (maker_note->offset >= value_len) {
+	if (value_len < 2 || maker_note->offset >= value_len - 1) {
 		/* Do not go past the value end */
 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
 		return FALSE;
@@ -2804,6 +2818,7 @@
 			break;
 		default:
 		case MN_OFFSET_NORMAL:
+			data_len = value_len;
 			break;
 	}
 
@@ -2811,10 +2826,15 @@
 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
 		return FALSE;
 	}
+	if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
+		return FALSE;
+	}
 
 	for (de=0;de<NumDirEntries;de++) {
-		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
-								  offset_base, data_len, displacement, section_index, 0, maker_note->tag_table TSRMLS_CC)) {
+		size_t offset = 2 + 12 * de;
+		if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
+								  offset_base, data_len - offset, displacement, section_index, 0, maker_note->tag_table TSRMLS_CC)) {
 			return FALSE;
 		}
 	}
@@ -2832,7 +2852,7 @@
 static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table TSRMLS_DC)
 {
 	size_t length;
-	int tag, format, components;
+	unsigned int tag, format, components;
 	char *value_ptr, tagname64, cbuf32, *outside=NULL;
 	size_t byte_count, offset_val, fpos, fgot;
 	int64_t byte_count_signed;
@@ -2883,7 +2903,7 @@
             offset_base is ImageInfo->file.listsn.data-dir_offset
             dir_entry - offset_base is dir_offset+2+i*12
         */
-		if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base)) {
+		if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base) || dir_entry <= offset_base) {

php-5.6.40.tar.xz/ext/exif/tests/bug76557.phpt Changed

php-5.6.40.tar.xz/ext/exif/tests/bug77540.jpg Added

php-5.6.40.tar.xz/ext/exif/tests/bug77540.phpt Added

php-5.6.40.tar.xz/ext/exif/tests/bug77563.jpg Added

php-5.6.40.tar.xz/ext/exif/tests/bug77563.phpt Added

php-5.6.40.tar.xz/ext/exif/tests/bug77753.phpt Added

php-5.6.40.tar.xz/ext/exif/tests/bug77753.tiff Added

php-5.6.40.tar.xz/ext/exif/tests/bug77831.phpt Added

php-5.6.40.tar.xz/ext/exif/tests/bug77831.tiff Added

php-5.6.40.tar.xz/ext/exif/tests/bug77950.phpt Added

php-5.6.40.tar.xz/ext/exif/tests/bug77950.tiff Added

php-5.6.40.tar.xz/ext/exif/tests/bug77988.jpg Added

php-5.6.40.tar.xz/ext/exif/tests/bug77988.phpt Added

php-5.6.40.tar.xz/ext/exif/tests/bug78222.jpg Added

php-5.6.40.tar.xz/ext/exif/tests/bug78222.phpt Added

php-5.6.40.tar.xz/ext/exif/tests/bug78256.jpg Added

php-5.6.40.tar.xz/ext/exif/tests/bug78256.phpt Added

php-5.6.40.tar.xz/ext/exif/tests/bug78793.phpt Added

php-5.6.40.tar.xz/ext/exif/tests/bug78910.phpt Added

php-5.6.40.tar.xz/ext/exif/tests/bug79282.phpt Added

php-5.6.40.tar.xz/ext/filter/logical_filters.c Changed

@@ -66,6 +66,8 @@
 #define FORMAT_IPV4    4
 #define FORMAT_IPV6    6
 
+static int _php_filter_validate_ipv6(const char *str, int str_len TSRMLS_DC);
+
 static int php_filter_parse_int(const char *str, unsigned int str_len, long *ret TSRMLS_DC) { /* {{{ */
 	long ctx_value;
 	int sign = 0, digit = 0;
@@ -445,6 +447,84 @@
 }
 /* }}} */
 
+static int _php_filter_validate_domain(char * domain, int len) /* {{{ */
+{
+	char *e, *s, *t;
+	size_t l;
+	int hostname = 1;
+	unsigned char i = 1;
+
+	s = domain;
+	l = len;
+	e = domain + l;
+	t = e - 1;
+
+	/* Ignore trailing dot */
+	if (*t == '.') {
+		e = t;
+		l--;
+	}
+
+	/* The total length cannot exceed 253 characters (final dot not included) */
+	if (l > 253) {
+		return 0;
+	}
+
+	/* First char must be alphanumeric */
+	if(*s == '.' || (hostname && !isalnum((int)*(unsigned char *)s))) {
+		return 0;
+	}
+
+	while (s < e) {
+		if (*s == '.') {
+			/* The first and the last character of a label must be alphanumeric */
+			if (*(s + 1) == '.' || (hostname && (!isalnum((int)*(unsigned char *)(s - 1)) || !isalnum((int)*(unsigned char *)(s + 1))))) {
+				return 0;
+			}
+
+			/* Reset label length counter */
+			i = 1;
+		} else {
+			if (i > 63 || (hostname && *s != '-' && !isalnum((int)*(unsigned char *)s))) {
+				return 0;
+			}
+
+			i++;
+		}
+
+		s++;
+	}
+
+	return 1;
+}
+/* }}} */
+
+static int is_userinfo_valid(char *str)
+{
+	const char *valid = "-._~!$&'()*+,;=:";
+	const char *p = str;
+	size_t len = strlen(str);
+
+	while (p - str < len) {
+		if (isalpha(*p) || isdigit(*p) || strchr(valid, *p)) {
+			p++;
+		} else if (*p == '%' && p - str <= len - 3 && isdigit(*(p+1)) && isxdigit(*(p+2))) {
+			p += 3;
+		} else {
+			return 0;
+		}
+	}
+	return 1;
+}
+
+static zend_bool php_filter_is_valid_ipv6_hostname(const char *s, size_t l TSRMLS_DC)
+{
+	const char *e = s + l;
+	const char *t = e - 1;
+
+	return *s == '' && *t == '' && _php_filter_validate_ipv6(s + 1, l - 2 TSRMLS_CC);
+}
+
 void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 {
 	php_url *url;
@@ -464,25 +544,26 @@
 	}
 
 	if (url->scheme != NULL && (!strcasecmp(url->scheme, "http") || !strcasecmp(url->scheme, "https"))) {
-		char *e, *s;
+		const char *s;
+		size_t l;
 
 		if (url->host == NULL) {
 			goto bad_url;
 		}
 
-		e = url->host + strlen(url->host);
 		s = url->host;
+		l = strlen(s);
 
-		/* First char of hostname must be alphanumeric */
-		if(!isalnum((int)*(unsigned char *)s)) { 
-			goto bad_url;
-		}
+		if (
+			/* An IPv6 enclosed by square brackets is a valid hostname.*/
+			!php_filter_is_valid_ipv6_hostname(s, l TSRMLS_CC) &&
+			/* Validate domain.
+			 * This includes a loose check for an IPv4 address. */
+			!_php_filter_validate_domain(url->host, l)
 
-		while (s < e) {
-			if (!isalnum((int)*(unsigned char *)s) && *s != '-' && *s != '.') {
-				goto bad_url;
-			}
-			s++;
+		) {
+			php_url_free(url);
+			RETURN_VALIDATION_FAILED
 		}
 	}
 
@@ -496,6 +577,15 @@
 		php_url_free(url);
 		RETURN_VALIDATION_FAILED
 	}
+
+	if ((url->user != NULL && !is_userinfo_valid(url->user))
+		|| (url->pass != NULL && !is_userinfo_valid(url->pass))
+	) {
+		php_url_free(url);
+		RETURN_VALIDATION_FAILED
+
+	}
+
 	php_url_free(url);
 }
 /* }}} */
@@ -554,7 +644,7 @@
 }
 /* }}} */
 
-static int _php_filter_validate_ipv4(char *str, int str_len, int *ip) /* {{{ */
+static int _php_filter_validate_ipv4(const char *str, int str_len, int *ip) /* {{{ */
 {
 	const char *end = str + str_len;
 	int num, m;
@@ -589,15 +679,15 @@
 }
 /* }}} */
 
-static int _php_filter_validate_ipv6(char *str, int str_len TSRMLS_DC) /* {{{ */
+static int _php_filter_validate_ipv6(const char *str, int str_len TSRMLS_DC) /* {{{ */
 {
 	int compressed = 0;
 	int blocks = 0;
 	int n;
 	char *ipv4;
-	char *end;
+	const char *end;
 	int ip4elm4;
-	char *s = str;
+	const char *s = str;
 
 	if (!memchr(str, ':', str_len)) {
 		return 0;

php-5.6.40.tar.xz/ext/filter/tests/bug77423.phpt Added

php-5.6.40.tar.xz/ext/filter/tests/bug81122.phpt Added

php-5.6.40.tar.xz/ext/filter/tests/ghsa-w8qr-v226-r27w.phpt Added

@@ -0,0 +1,41 @@
+--TEST--
+GHSA-w8qr-v226-r27w
+--EXTENSIONS--
+filter
+--FILE--
+<?php
+
+function test($input) {
+    var_dump(filter_var($input, FILTER_VALIDATE_URL));
+}
+
+echo "--- These ones should fail ---\n";
+test("http://test@127.0.0.1");
+test("http://test@::1");
+test("http://test@::1");
+test("http://test@::1");
+test("http://php.net\\@aliyun.com/aaa.do");
+test("http://test@2001:db8:3333:4444:5555:6666:1.2.3.4");
+test("http://test@2001:db8:3333:4444:5555:6666:1.2.3.4");
+test("http://test@2001:db8:3333:4444:5555:6666:1.2.3.4");
+
+echo "--- These ones should work ---\n";
+test("http://test@127.0.0.1");
+test("http://test@2001:db8:3333:4444:5555:6666:1.2.3.4");
+test("http://test@::1");
+
+?>
+--EXPECT--
+--- These ones should fail ---
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+--- These ones should work ---
+string(21) "http://test@127.0.0.1"
+string(50) "http://test@2001:db8:3333:4444:5555:6666:1.2.3.4"
+string(17) "http://test@::1"

php-5.6.40.tar.xz/ext/gd/libgd/xbm.c Changed

php-5.6.40.tar.xz/ext/gd/tests/bug77973.phpt Added

php-5.6.40.tar.xz/ext/iconv/iconv.c Changed

php-5.6.40.tar.xz/ext/iconv/tests/bug78069.data Added

php-5.6.40.tar.xz/ext/iconv/tests/bug78069.phpt Added

php-5.6.40.tar.xz/ext/imap/php_imap.c Changed

@@ -3491,6 +3491,21 @@
 }
 /* }}} */
 
+static zend_bool header_injection(char *p, zend_bool adrlist)
+{
+	while ((p = strpbrk(p, "\r\n")) != NULL) {
+		if (!(p0 == '\r' && p1 == '\n')
+		 /* adrlists do not support folding, but swallow trailing line breaks */
+		 && !((adrlist && p1 == '\0')
+		  /* other headers support folding */
+		  || !adrlist && (p1 == ' ' || p1 == '\t'))) {
+			return 1;
+		}
+		p++;
+	}
+	return 0;
+}
+
 /* {{{ proto string imap_mail_compose(array envelope, array body)
    Create a MIME message based on given envelope and body sections */
 PHP_FUNCTION(imap_mail_compose)
@@ -3511,6 +3526,13 @@
 		return;
 	}
 
+#define CHECK_HEADER_INJECTION(zstr, adrlist, header) \
+	if (header_injection(zstr, adrlist)) { \
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "header injection attempt in " header); \
+		RETVAL_FALSE; \
+		goto done; \
+	}
+
 #define PHP_RFC822_PARSE_ADRLIST(target, value) \
 	str_copy = estrndup(Z_STRVAL_PP(value), Z_STRLEN_PP(value)); \
 	rfc822_parse_adrlist(target, str_copy, "NO HOST"); \
@@ -3519,46 +3541,57 @@
 	env = mail_newenvelope();
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "remail", sizeof("remail"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 0, "remail");
 		env->remail = cpystr(Z_STRVAL_PP(pvalue));
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "return_path", sizeof("return_path"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 1, "return_path");
 		PHP_RFC822_PARSE_ADRLIST(&env->return_path, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "date", sizeof("date"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 0, "date");
 		env->date = cpystr(Z_STRVAL_PP(pvalue));
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "from", sizeof("from"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 1, "from");
 		PHP_RFC822_PARSE_ADRLIST(&env->from, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "reply_to", sizeof("reply_to"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 1, "reply_to");
 		PHP_RFC822_PARSE_ADRLIST(&env->reply_to, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "in_reply_to", sizeof("in_reply_to"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 0, "in_reply_to");
 		env->in_reply_to = cpystr(Z_STRVAL_PP(pvalue));
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "subject", sizeof("subject"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 0, "subject");
 		env->subject = cpystr(Z_STRVAL_PP(pvalue));
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "to", sizeof("to"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 1, "to");
 		PHP_RFC822_PARSE_ADRLIST(&env->to, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "cc", sizeof("cc"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 1, "cc");
 		PHP_RFC822_PARSE_ADRLIST(&env->cc, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "bcc", sizeof("bcc"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 1, "bcc");
 		PHP_RFC822_PARSE_ADRLIST(&env->bcc, pvalue);
 	}
 	if (zend_hash_find(Z_ARRVAL_P(envelope), "message_id", sizeof("message_id"), (void **) &pvalue)== SUCCESS) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 0, "message_id");
 		env->message_id=cpystr(Z_STRVAL_PP(pvalue));
 	}
 
@@ -3568,6 +3601,7 @@
 			while (zend_hash_get_current_data(Z_ARRVAL_PP(pvalue), (void **) &env_data) == SUCCESS) {
 				custom_headers_param = mail_newbody_parameter();
 				convert_to_string_ex(env_data);
+				CHECK_HEADER_INJECTION(Z_STRVAL_PP(env_data), 0, "custom_headers");
 				custom_headers_param->value = (char *) fs_get(Z_STRLEN_PP(env_data) + 1);
 				custom_headers_param->attribute = NULL;
 				memcpy(custom_headers_param->value, Z_STRVAL_PP(env_data), Z_STRLEN_PP(env_data) + 1);
@@ -3598,6 +3632,7 @@
 		}
 		if (zend_hash_find(Z_ARRVAL_PP(data), "charset", sizeof("charset"), (void **) &pvalue)== SUCCESS) {
 			convert_to_string_ex(pvalue);
+			CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 0, "body charset");
 			tmp_param = mail_newbody_parameter();
 			tmp_param->value = cpystr(Z_STRVAL_PP(pvalue));
 			tmp_param->attribute = cpystr("CHARSET");
@@ -3608,10 +3643,12 @@
 			if(Z_TYPE_PP(pvalue) == IS_ARRAY) {
 				disp_param = tmp_param = NULL;
 				while (zend_hash_get_current_data(Z_ARRVAL_PP(pvalue), (void **) &disp_data) == SUCCESS) {
+					CHECK_HEADER_INJECTION(key, 0, "body disposition key");
 					disp_param = mail_newbody_parameter();
 					zend_hash_get_current_key(Z_ARRVAL_PP(pvalue), &key, &ind, 0);
 					disp_param->attribute = cpystr(key);
 					convert_to_string_ex(disp_data);
+					CHECK_HEADER_INJECTION(Z_STRVAL_PP(disp_data), 0, "body disposition value");
 					disp_param->value = (char *) fs_get(Z_STRLEN_PP(disp_data) + 1);
 					memcpy(disp_param->value, Z_STRVAL_PP(disp_data), Z_STRLEN_PP(disp_data) + 1);
 					zend_hash_move_forward(Z_ARRVAL_PP(pvalue));
@@ -3623,18 +3660,22 @@
 		}
 		if (zend_hash_find(Z_ARRVAL_PP(data), "subtype", sizeof("subtype"), (void **) &pvalue)== SUCCESS) {
 			convert_to_string_ex(pvalue);
+			CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 0, "body subtype");
 			bod->subtype = cpystr(Z_STRVAL_PP(pvalue));
 		}
 		if (zend_hash_find(Z_ARRVAL_PP(data), "id", sizeof("id"), (void **) &pvalue)== SUCCESS) {
 			convert_to_string_ex(pvalue);
+			CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 0, "body id");
 			bod->id = cpystr(Z_STRVAL_PP(pvalue));
 		}
 		if (zend_hash_find(Z_ARRVAL_PP(data), "description", sizeof("description"), (void **) &pvalue)== SUCCESS) {
 			convert_to_string_ex(pvalue);
+			CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 0, "body description");
 			bod->description = cpystr(Z_STRVAL_PP(pvalue));
 		}
 		if (zend_hash_find(Z_ARRVAL_PP(data), "disposition.type", sizeof("disposition.type"), (void **) &pvalue)== SUCCESS) {
 			convert_to_string_ex(pvalue);
+			CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 0, "body disposition.type");
 			bod->disposition.type = (char *) fs_get(Z_STRLEN_PP(pvalue) + 1);
 			memcpy(bod->disposition.type, Z_STRVAL_PP(pvalue), Z_STRLEN_PP(pvalue)+1);
 		}
@@ -3642,10 +3683,12 @@
 			if (Z_TYPE_PP(pvalue) == IS_ARRAY) {
 				disp_param = tmp_param = NULL;
 				while (zend_hash_get_current_data(Z_ARRVAL_PP(pvalue), (void **) &disp_data) == SUCCESS) {
+					CHECK_HEADER_INJECTION(key, 0, "body type.parameters key");
 					disp_param = mail_newbody_parameter();
 					zend_hash_get_current_key(Z_ARRVAL_PP(pvalue), &key, &ind, 0);
 					disp_param->attribute = cpystr(key);
 					convert_to_string_ex(disp_data);
+					CHECK_HEADER_INJECTION(Z_STRVAL_PP(disp_data), 0, "body type.parameters value");
 					disp_param->value = (char *) fs_get(Z_STRLEN_PP(disp_data) + 1);
 					memcpy(disp_param->value, Z_STRVAL_PP(disp_data), Z_STRLEN_PP(disp_data) + 1);
 					zend_hash_move_forward(Z_ARRVAL_PP(pvalue));
@@ -3675,6 +3718,7 @@
 		}
 		if (zend_hash_find(Z_ARRVAL_PP(data), "md5", sizeof("md5"), (void **) &pvalue)== SUCCESS) {
 			convert_to_string_ex(pvalue);
+			CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 0, "body md5");
 			bod->md5 = cpystr(Z_STRVAL_PP(pvalue));
 		}
 	}
@@ -3710,6 +3754,7 @@
 			}
 			if (zend_hash_find(Z_ARRVAL_PP(data), "charset", sizeof("charset"), (void **) &pvalue)== SUCCESS) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 0, "body charset");
 				tmp_param = mail_newbody_parameter();
 				tmp_param->value = (char *) fs_get(Z_STRLEN_PP(pvalue) + 1);
 				memcpy(tmp_param->value, Z_STRVAL_PP(pvalue), Z_STRLEN_PP(pvalue) + 1);
@@ -3723,8 +3768,10 @@
 					while (zend_hash_get_current_data(Z_ARRVAL_PP(pvalue), (void **) &disp_data) == SUCCESS) {
 						disp_param = mail_newbody_parameter();
 						zend_hash_get_current_key(Z_ARRVAL_PP(pvalue), &key, &ind, 0);
+						CHECK_HEADER_INJECTION(key, 0, "body type.parameters key");
 						disp_param->attribute = cpystr(key);
 						convert_to_string_ex(disp_data);
+						CHECK_HEADER_INJECTION(Z_STRVAL_PP(disp_data), 0, "body type.parameters value");
 						disp_param->value = (char *) fs_get(Z_STRLEN_PP(disp_data) + 1);
 						memcpy(disp_param->value, Z_STRVAL_PP(disp_data), Z_STRLEN_PP(disp_data) + 1);
 						zend_hash_move_forward(Z_ARRVAL_PP(pvalue));
@@ -3736,18 +3783,22 @@
 			}
 			if (zend_hash_find(Z_ARRVAL_PP(data), "subtype", sizeof("subtype"), (void **) &pvalue)== SUCCESS) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 0, "body subtype");
 				bod->subtype = cpystr(Z_STRVAL_PP(pvalue));
 			}
 			if (zend_hash_find(Z_ARRVAL_PP(data), "id", sizeof("id"), (void **) &pvalue)== SUCCESS) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STRVAL_PP(pvalue), 0, "body id");
 				bod->id = cpystr(Z_STRVAL_PP(pvalue));
 			}
 			if (zend_hash_find(Z_ARRVAL_PP(data), "description", sizeof("description"), (void **) &pvalue)== SUCCESS) {
 				convert_to_string_ex(pvalue);

php-5.6.40.tar.xz/ext/imap/tests/bug80710_1.phpt Added

@@ -0,0 +1,37 @@
+--TEST--
+Bug #80710 (imap_mail_compose() header injection) - MIME Splitting Attack
+--SKIPIF--
+<?php
+if (!extension_loaded("imap")) die("skip imap extension not available");
+?>
+--FILE--
+<?php
+$envelope"from"= "joe@example.com\n From : X-INJECTED";
+$envelope"to"  = "foo@example.com\nFrom: X-INJECTED";
+$envelope"cc"  = "bar@example.com\nFrom: X-INJECTED";
+$envelope"subject"  = "bar@example.com\n\n From : X-INJECTED";
+$envelope"x-remail"  = "bar@example.com\nFrom: X-INJECTED";
+$envelope"something"  = "bar@example.com\nFrom: X-INJECTED";
+
+$part1"type" = TYPEMULTIPART;
+$part1"subtype" = "mixed";
+
+$part2"type" = TYPEAPPLICATION;
+$part2"encoding" = ENCBINARY;
+$part2"subtype" = "octet-stream\nContent-Type: X-INJECTED";
+$part2"description" = "some file\nContent-Type: X-INJECTED";
+$part2"contents.data" = "ABC\nContent-Type: X-INJECTED";
+
+$part3"type" = TYPETEXT;
+$part3"subtype" = "plain";
+$part3"description" = "description3";
+$part3"contents.data" = "contents.data3\n\n\n\t";
+
+$body1 = $part1;
+$body2 = $part2;
+$body3 = $part3;
+
+echo imap_mail_compose($envelope, $body);
+?>
+--EXPECTF--
+Warning: imap_mail_compose(): header injection attempt in from in %s on line %d

php-5.6.40.tar.xz/ext/imap/tests/bug80710_2.phpt Added

@@ -0,0 +1,37 @@
+--TEST--
+Bug #80710 (imap_mail_compose() header injection) - Remail
+--SKIPIF--
+<?php
+if (!extension_loaded("imap")) die("skip imap extension not available");
+?>
+--FILE--
+<?php
+$envelope"from"= "joe@example.com\n From : X-INJECTED";
+$envelope"to"  = "foo@example.com\nFrom: X-INJECTED";
+$envelope"cc"  = "bar@example.com\nFrom: X-INJECTED";
+$envelope"subject"  = "bar@example.com\n\n From : X-INJECTED";
+$envelope"remail"  = "X-INJECTED-REMAIL: X-INJECTED\nFrom: X-INJECTED-REMAIL-FROM"; //<--- Injected as first hdr
+$envelope"something"  = "bar@example.com\nFrom: X-INJECTED";
+
+$part1"type" = TYPEMULTIPART;
+$part1"subtype" = "mixed";
+
+$part2"type" = TYPEAPPLICATION;
+$part2"encoding" = ENCBINARY;
+$part2"subtype" = "octet-stream\nContent-Type: X-INJECTED";
+$part2"description" = "some file\nContent-Type: X-INJECTED";
+$part2"contents.data" = "ABC\nContent-Type: X-INJECTED";
+
+$part3"type" = TYPETEXT;
+$part3"subtype" = "plain";
+$part3"description" = "description3";
+$part3"contents.data" = "contents.data3\n\n\n\t";
+
+$body1 = $part1;
+$body2 = $part2;
+$body3 = $part3;
+
+echo imap_mail_compose($envelope, $body);
+?>
+--EXPECTF--
+Warning: imap_mail_compose(): header injection attempt in remail in %s on line %d

php-5.6.40.tar.xz/ext/interbase/config.m4 Changed

@@ -3,39 +3,54 @@
                           install directory /usr/interbase)
 
 if test "$PHP_INTERBASE" != "no"; then
-  if test "$PHP_INTERBASE" = "yes"; then
-    IBASE_INCDIR=/usr/interbase/include
-    IBASE_LIBDIR=/usr/interbase/lib
+
+  AC_PATH_PROG(FB_CONFIG, fb_config, no)
+
+  if test -x "$FB_CONFIG" && test "$PHP_INTERBASE" = "yes"; then
+    AC_MSG_CHECKING(for libfbconfig)
+    FB_CFLAGS=`$FB_CONFIG --cflags`
+    FB_LIBDIR=`$FB_CONFIG --libs`
+    FB_VERSION=`$FB_CONFIG --version`
+    AC_MSG_RESULT(version $FB_VERSION)
+    PHP_EVAL_LIBLINE($FB_LIBDIR, INTERBASE_SHARED_LIBADD)
+    PHP_EVAL_INCLINE($FB_CFLAGS)
+
   else
-    IBASE_INCDIR=$PHP_INTERBASE/include
-    IBASE_LIBDIR=$PHP_INTERBASE/$PHP_LIBDIR
-  fi
+    if test "$PHP_INTERBASE" = "yes"; then
+      IBASE_INCDIR=/usr/interbase/include
+      IBASE_LIBDIR=/usr/interbase/lib
+    else
+      IBASE_INCDIR=$PHP_INTERBASE/include
+      IBASE_LIBDIR=$PHP_INTERBASE/$PHP_LIBDIR
+    fi
 
-  PHP_CHECK_LIBRARY(fbclient, isc_detach_database,
-  
-    IBASE_LIBNAME=fbclient
-  , 
-    PHP_CHECK_LIBRARY(gds, isc_detach_database,
+    PHP_CHECK_LIBRARY(fbclient, isc_detach_database,
     
-      IBASE_LIBNAME=gds
+      IBASE_LIBNAME=fbclient
     , 
-      PHP_CHECK_LIBRARY(ib_util, isc_detach_database,
+      PHP_CHECK_LIBRARY(gds, isc_detach_database,
       
-        IBASE_LIBNAME=ib_util
+        IBASE_LIBNAME=gds
       , 
-        AC_MSG_ERROR(libgds, libib_util or libfbclient not found! Check config.log for more information.)
+        PHP_CHECK_LIBRARY(ib_util, isc_detach_database,
+        
+          IBASE_LIBNAME=ib_util
+        , 
+          AC_MSG_ERROR(libgds, libib_util or libfbclient not found! Check config.log for more information.)
+        , 
+          -L$IBASE_LIBDIR
+        )
       , 
         -L$IBASE_LIBDIR
       )
     , 
       -L$IBASE_LIBDIR
     )
-  , 
-    -L$IBASE_LIBDIR
-  )
   
-  PHP_ADD_LIBRARY_WITH_PATH($IBASE_LIBNAME, $IBASE_LIBDIR, INTERBASE_SHARED_LIBADD)
-  PHP_ADD_INCLUDE($IBASE_INCDIR)
+    PHP_ADD_LIBRARY_WITH_PATH($IBASE_LIBNAME, $IBASE_LIBDIR, INTERBASE_SHARED_LIBADD)
+    PHP_ADD_INCLUDE($IBASE_INCDIR)
+  fi
+
   AC_DEFINE(HAVE_IBASE,1, )
   PHP_NEW_EXTENSION(interbase, interbase.c ibase_query.c ibase_service.c ibase_events.c ibase_blobs.c, $ext_shared)
   PHP_SUBST(INTERBASE_SHARED_LIBADD)

php-5.6.40.tar.xz/ext/ldap/ldap.c Changed

@@ -23,7 +23,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: 03ca03d3adee59787d58cd342d8f864c5d96252a $ */
+/* $Id: 0b508e6e70f04767c09f0ffff04896b112666ac0 $ */
 #define IS_EXT_MODULE
 
 #ifdef HAVE_CONFIG_H
@@ -60,6 +60,7 @@
 
 #include "ext/standard/php_string.h"
 #include "ext/standard/info.h"
+#include "Zend/zend_exceptions.h"
 
 #ifdef HAVE_LDAP_SASL_H
 #include <sasl.h>
@@ -265,7 +266,7 @@
 
 	php_info_print_table_start();
 	php_info_print_table_row(2, "LDAP Support", "enabled");
-	php_info_print_table_row(2, "RCS Version", "$Id: 03ca03d3adee59787d58cd342d8f864c5d96252a $");
+	php_info_print_table_row(2, "RCS Version", "$Id: 0b508e6e70f04767c09f0ffff04896b112666ac0 $");
 
 	if (LDAPG(max_links) == -1) {
 		snprintf(tmp, 31, "%ld/unlimited", LDAPG(num_links));
@@ -2648,7 +2649,12 @@
 	size_t len = 0;
 
 	for (i = 0; i < valuelen; i++) {
-		len += (map(unsigned char) valuei) ? 3 : 1;
+		size_t addend = (map(unsigned char) valuei) ? 3 : 1;
+		if (len > INT_MAX - addend) {
+			*result = NULL;
+			return;
+		}
+		len += addend;
 	}
 
 	(*result) = (char *) safe_emalloc_string(1, len, 1);
@@ -2715,6 +2721,11 @@
 
 	php_ldap_do_escape(map, value, valuelen, &result, &resultlen);
 
+	if (UNEXPECTED(!result)) {
+		zend_throw_exception(NULL, "Argument #1 ($value) is too long", 0 TSRMLS_CC);
+		return;
+	}
+
 	RETURN_STRINGL(result, resultlen, 0);
 }

php-5.6.40.tar.xz/ext/ldap/tests/GHSA-g665-fm4p-vhff-1.phpt Added

php-5.6.40.tar.xz/ext/ldap/tests/GHSA-g665-fm4p-vhff-2.phpt Added

php-5.6.40.tar.xz/ext/libxml/libxml.c Changed

php-5.6.40.tar.xz/ext/libxml/php_libxml.h Changed

@@ -110,6 +110,50 @@
 #define LIBXML(v) (libxml_globals.v)
 #endif
 
+/* Other extension may override the global state options, these global options
+ * are copied initially to ctxt->options. Set the options to a known good value.
+ * See libxml2 globals.c and parserInternals.c.
+ * The unique_name argument allows multiple sanitizes and restores within the
+ * same function, even nested is necessary. */
+#define PHP_LIBXML_SANITIZE_GLOBALS_DECL(unique_name) \
+	int xml_old_loadsubset_##unique_name; \
+	int xml_old_validate_##unique_name; \
+	int xml_old_pedantic_##unique_name; \
+	int xml_old_substitute_##unique_name; \
+	int xml_old_linenrs_##unique_name; \
+	int xml_old_blanks_##unique_name;
+
+#define PHP_LIBXML_SANITIZE_GLOBALS(unique_name) \
+	xml_old_loadsubset_##unique_name = xmlLoadExtDtdDefaultValue; \
+	xmlLoadExtDtdDefaultValue = 0; \
+	xml_old_validate_##unique_name = xmlDoValidityCheckingDefaultValue; \
+	xmlDoValidityCheckingDefaultValue = 0; \
+	xml_old_pedantic_##unique_name = xmlPedanticParserDefault(0); \
+	xml_old_substitute_##unique_name = xmlSubstituteEntitiesDefault(0); \
+	xml_old_linenrs_##unique_name = xmlLineNumbersDefault(0); \
+	xml_old_blanks_##unique_name = xmlKeepBlanksDefault(1);
+
+#define PHP_LIBXML_RESTORE_GLOBALS(unique_name) \
+	xmlLoadExtDtdDefaultValue = xml_old_loadsubset_##unique_name; \
+	xmlDoValidityCheckingDefaultValue = xml_old_validate_##unique_name; \
+	(void) xmlPedanticParserDefault(xml_old_pedantic_##unique_name); \
+	(void) xmlSubstituteEntitiesDefault(xml_old_substitute_##unique_name); \
+	(void) xmlLineNumbersDefault(xml_old_linenrs_##unique_name); \
+	(void) xmlKeepBlanksDefault(xml_old_blanks_##unique_name);
+
+/* Alternative for above, working directly on the context and not setting globals.
+ * Generally faster because no locking is involved, and this has the advantage that it sets the options to a known good value. */
+static zend_always_inline void php_libxml_sanitize_parse_ctxt_options(xmlParserCtxtPtr ctxt)
+{
+	ctxt->loadsubset = 0;
+	ctxt->validate = 0;
+	ctxt->pedantic = 0;
+	ctxt->replaceEntities = 0;
+	ctxt->linenumbers = 0;
+	ctxt->keepBlanks = 1;
+	ctxt->options = 0;
+}
+
 #else /* HAVE_LIBXML */
 #define libxml_module_ptr NULL
 #endif

php-5.6.40.tar.xz/ext/mbstring/libmbfl/filters/mbfilter_big5.c Changed

@@ -138,6 +138,21 @@
 	{0xf70f,0xf848,0xc740,0xc8fe},
 };
 
+#ifdef PHP_WIN32
+# define inline __inline
+#endif
+
+static inline int is_in_cp950_pua(int c1, int c) {
+	if ((c1 >= 0xfa && c1 <= 0xfe) || (c1 >= 0x8e && c1 <= 0xa0) ||
+			(c1 >= 0x81 && c1 <= 0x8d) || (c1 >= 0xc7 && c1 <= 0xc8)) {
+		return (c >=0x40 && c <= 0x7e) || (c >= 0xa1 && c <= 0xfe);
+	}
+	if (c1 == 0xc6) {
+		return c >= 0xa1 && c <= 0xfe;
+	}
+	return 0;
+}
+
 /*
  * Big5 => wchar
  */
@@ -186,11 +201,7 @@
 			
 			if (filter->from->no_encoding == mbfl_no_encoding_cp950) {
 				/* PUA for CP950 */
-				if (w <= 0 && 
-					(((c1 >= 0xfa && c1 <= 0xfe) || (c1 >= 0x8e && c1 <= 0xa0) ||
-					  (c1 >= 0x81 && c1 <= 0x8d) ||(c1 >= 0xc7 && c1 <= 0xc8)) 
-					 && ((c > 0x39 && c < 0x7f) || (c > 0xa0 && c < 0xff))) ||
-					((c1 == 0xc6) && (c > 0xa0 && c < 0xff))) {
+				if (w <= 0 && is_in_cp950_pua(c1, c)) {
 					c2 = c1 << 8 | c;
 					for (k = 0; k < sizeof(cp950_pua_tbl)/(sizeof(unsigned short)*4); k++) {
 						if (c2 >= cp950_pua_tblk2 && c2 <= cp950_pua_tblk3) {

php-5.6.40.tar.xz/ext/mbstring/oniguruma/regext.c Changed

php-5.6.40.tar.xz/ext/mbstring/tests/bug79037.phpt Added

php-5.6.40.tar.xz/ext/mysql/tests/mysql_connect.phpt Changed

@@ -1,5 +1,7 @@
 --TEST--
 mysql_connect()
+--INI--
+error_reporting=E_ALL&~E_DEPRECATED
 --SKIPIF--
 <?php
 require_once('skipif.inc');
@@ -104,25 +106,5 @@
 print "done!";
 ?>
 --EXPECTF--
-Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in %s on line %d
-
-Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in %s on line %d
-
-Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in %s on line %d
-
 Warning: mysql_connect(): Access denied for user '%s'@'%s' (using password: YES) in %s on line %d
-
-Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in %s on line %d
-
-Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in %s on line %d
-
-Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in %s on line %d
-
-Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in %s on line %d
-
-Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in %s on line %d
-
-Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in %s on line %d
-
-Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in %s on line %d
 done!

php-5.6.40.tar.xz/ext/mysql/tests/mysql_query_load_data_openbasedir.phpt Changed

php-5.6.40.tar.xz/ext/mysqli/tests/bug68077.phpt Changed

php-5.6.40.tar.xz/ext/mysqli/tests/mysqli_expire_password.phpt Changed

php-5.6.40.tar.xz/ext/mysqlnd/mysqlnd_wireprotocol.c Changed

php-5.6.40.tar.xz/ext/opcache/tests/blacklist-win32.phpt Changed

php-5.6.40.tar.xz/ext/opcache/tests/bug66338.phpt Changed

php-5.6.40.tar.xz/ext/opcache/tests/bug66461.phpt Changed

php-5.6.40.tar.xz/ext/opcache/tests/bug67215.phpt Changed

php-5.6.40.tar.xz/ext/opcache/tests/bug71127.phpt Changed

php-5.6.40.tar.xz/ext/opcache/tests/bug71843.phpt Changed

php-5.6.40.tar.xz/ext/opcache/tests/revalidate_path_01.phpt Changed

@@ -25,16 +25,30 @@
 	touch($file1);
 	touch($file2);
 }
-@unlink($link);
-@symlink($dir1, $link);
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+	@rmdir($link);
+	$ln = str_replace('/', '\\', $link);
+	$d1 = realpath($dir1);
+	`mklink /j $ln $d1`;
+} else {
+	@unlink($link);
+	@symlink($dir1, $link);
+}
 
 include "php_cli_server.inc";
 //php_cli_server_start('-d opcache.enable=1 -d opcache.enable_cli=1 -d opcache.revalidate_path=1');
 php_cli_server_start('-d opcache.enable=1 -d opcache.enable_cli=1 -d opcache.revalidate_path=1 -d opcache.file_update_protection=0 -d realpath_cache_size=0');
 echo file_get_contents('http://' . PHP_CLI_SERVER_ADDRESS . '/main.php');
 echo file_get_contents('http://' . PHP_CLI_SERVER_ADDRESS . '/main.php');
-@unlink($link);
-@symlink($dir2, $link);
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+	@rmdir($link);
+	$ln = str_replace('/', '\\', $link);
+	$d2 = realpath($dir2);
+	`mklink /j $ln $d2`;
+} else {
+	@unlink($link);
+	@symlink($dir2, $link);
+}
 echo file_get_contents('http://' . PHP_CLI_SERVER_ADDRESS . '/main.php');
 echo file_get_contents('http://' . PHP_CLI_SERVER_ADDRESS . '/main.php');
 ?>
@@ -48,7 +62,11 @@
 $file2 = "$dir2/index.php";
 $main = "$dir/main.php";
 @unlink($main);
-@unlink($link);
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+	@rmdir($link);
+} else {
+	@unlink($link);
+}
 @unlink($file1);
 @unlink($file2);
 @rmdir($dir1);

php-5.6.40.tar.xz/ext/openssl/openssl.c Changed

@@ -5260,6 +5260,17 @@
 	free_iv = php_openssl_validate_iv(&iv, &iv_len, max_iv_len TSRMLS_CC);
 
 	outlen = data_len + EVP_CIPHER_block_size(cipher_type);
+#ifdef EVP_CIPH_WRAP_MODE
+	if ((EVP_CIPHER_mode(cipher_type)) == EVP_CIPH_WRAP_MODE) {
+		/*
+		 * RFC 5649 wrap-with-padding rounds the input up to the block size
+		 * and prepends an integrity block, we reserve one extra block.
+		 * See EVP_EncryptUpdate(3): wrap mode may write up to
+		 * inl + cipher_block_size bytes.
+		 */
+		outlen += EVP_CIPHER_block_size(cipher_type);
+	}
+#endif
 	outbuf = safe_emalloc(outlen, 1, 1);
 
 	EVP_EncryptInit(&cipher_ctx, cipher_type, NULL, NULL);
@@ -5357,6 +5368,17 @@
 	free_iv = php_openssl_validate_iv(&iv, &iv_len, EVP_CIPHER_iv_length(cipher_type) TSRMLS_CC);
 
 	outlen = data_len + EVP_CIPHER_block_size(cipher_type);
+#ifdef EVP_CIPH_WRAP_MODE
+	if ((EVP_CIPHER_mode(cipher_type)) == EVP_CIPH_WRAP_MODE) {
+		/*
+		 * RFC 5649 wrap-with-padding rounds the input up to the block size
+		 * and prepends an integrity block, we reserve one extra block.
+		 * See EVP_EncryptUpdate(3): wrap mode may write up to
+		 * inl + cipher_block_size bytes.
+		 */
+		outlen += EVP_CIPHER_block_size(cipher_type);
+	}
+#endif
 	outbuf = emalloc(outlen + 1);
 
 	EVP_DecryptInit(&cipher_ctx, cipher_type, NULL, NULL);

php-5.6.40.tar.xz/ext/openssl/tests/bug54992-ca.pem Changed

@@ -1,35 +1,35 @@
 -----BEGIN CERTIFICATE-----
-MIIGAzCCA+ugAwIBAgIUZ7ZvvfVqSEf1EswMT9LfMIPc/U8wDQYJKoZIhvcNAQEL
+MIIGAzCCA+ugAwIBAgIUYS9Vq4aNK1hL5reofVRkM3ioENEwDQYJKoZIhvcNAQEL
 BQAwgZAxCzAJBgNVBAYTAlBUMQ8wDQYDVQQIDAZMaXNib2ExDzANBgNVBAcMBkxp
 c2JvYTEXMBUGA1UECgwOUEhQIEZvdW5kYXRpb24xHjAcBgNVBAMMFVJvb3QgQ0Eg
 Zm9yIFBIUCBUZXN0czEmMCQGCSqGSIb3DQEJARYXaW50ZXJuYWxzQGxpc3RzLnBo
-cC5uZXQwHhcNMTgxMjMxMDg0NDU3WhcNMjAwMjA0MDg0NDU3WjCBkDELMAkGA1UE
+cC5uZXQwHhcNMjAwMjE4MDg1NTQ5WhcNMjEwMzI0MDg1NTQ5WjCBkDELMAkGA1UE
 BhMCUFQxDzANBgNVBAgMBkxpc2JvYTEPMA0GA1UEBwwGTGlzYm9hMRcwFQYDVQQK
 DA5QSFAgRm91bmRhdGlvbjEeMBwGA1UEAwwVUm9vdCBDQSBmb3IgUEhQIFRlc3Rz
 MSYwJAYJKoZIhvcNAQkBFhdpbnRlcm5hbHNAbGlzdHMucGhwLm5ldDCCAiIwDQYJ
-KoZIhvcNAQEBBQADggIPADCCAgoCggIBAPVThsunmhda5hbNi+pXD3WF9ijryB9H
-JDnIbPW/vMffWcQgtiRzc+6aCykBygnhnN91NNRpxOsoLCb7OjUMM0TjhSE9DxKD
-aVLRoDcs5VSaddQjq3AwdkU6ek9InUOeDuZ8gatrpWlEyuQPwwnMAfR9NkcTajuF
-hGO0BlqkHg98GckQD0N5x6CrrDJt6RE6hf9gUZSGSWdPTiETBQUN8LTuxo/ybFSN
-hcpVNCF+r3eozATbSU8YvQU52RmPIZWHHmYb7KtMO3TEX4LnLJUOefUK4qk+ZJ0s
-f4JfnY7RhBlZGh2kIyE5jwqz8/KzKtxrutNaupdTFZO8nX09QSgmDCxVWVclrPaG
-q2ZFYpeauTy71pTm8DjF7PwQI/+PUrBdFIX0V6uxqUEG0pvPdb8zenVbaK4Jh39u
-w0V5tH/rbtd7zZX4vl3bmKo1Wk0SQxd83iXitxLiJnWNOsmrJcM/Hx91kE10+/ly
-zgL/w5A9HSA616kfPdNzny0laH1TXVLJsnyyV3DyfnU4O6VI0JG3WjhgRdMkgobn
-GvGJ2ZsZAxds9lBtT2y+gw5BU+jkSilPk3jM9MA7Kmyci93U9xxMuDNzyUzfcnXR
-UIq99dZWeMMy1LT3buZXrAWu1WRgPdQtDKcQHDIQaIkxlWsT8q2q/wIirb6fwxlw
-vXkFp+aEP35BAgMBAAGjUzBRMB0GA1UdDgQWBBR37F1+W1gcCp8bhZaFFi9JKQhu
-tTAfBgNVHSMEGDAWgBR37F1+W1gcCp8bhZaFFi9JKQhutTAPBgNVHRMBAf8EBTAD
-AQH/MA0GCSqGSIb3DQEBCwUAA4ICAQAYHqpISUI/x8UW33i35rYkFYNvXBMQDc8J
-v4G2eqEBNCOVmHg6P//lq1F2jrtAEr/saESN1uS1Q80sUsthlVsceV1z1isdpugG
-kMbfHxLe0QpthnP3PEChQw30TPB22BThuGVkteNSZKTCPGdzjSTPq2kOR6PCBZRd
-r0r/TW3lT/Ng3KgjT6g7E3ZUpAeFEQMlmNYr/eEOL7K+1jzQrbCLmXbs6rmtffr7
-n4p+wMPMPaSRqQoQ86ff9GPzxWuAQGlytVoiS5Xt3jotd/RWlOy0YQ2QSzOQvFUW
-4te5lwdOvOFnJTo43U3DqASqMcaazvIsN41zVlOyOyKEr9oZERju6FU1aZmuZtHQ
-wMCmXVj/Swj67Zp9tG+vVQenbEk314+8c2nenuOIFP1F2C/NG3vMLIpENRGxpmAm
-s5gIT6mXvJ4JCwWYc75zucOr2KVkDmEziJh/pARuOrOAPdc6NjKku8HBC9UI96+x
-Db4hG2SqXUzShkFX/px7vlCADvgO3FDk2aiyW02PFsItob2O6OB98VGsU26hgRO/
-Czz/jbjWTPHNOt6/fcL0m7XLwlJ+K9gRArY15DeJGumcHEq/Vd/Z8iPQKKdzgF4O
-9XFZvu+VHP82AS5TeiYHCddFJyzktQYcNu5/OBuxzO83d7rpqrLFETTEOL4cN8O7
-LJ7Q89hYAQ==
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBALlJlfDasmObBQiQSsyDVRu0uwVmFFZ7
+fqFVHUMeKpWv0Y3dH5FtpBoMOh41XYI7E1Ex9UTNIYsRedESzEm1DIBsKHHODRsj
+gJVH3jxAEmDPaNQJ0x4zlNmmd7Zz74lo/eJ+oc2rLiJd3NVKCXEWtu2mO5FN/x3Z
+vG+QXkT04tGvwLn4oAdiU4zlf0ttO5xY5GjUXhT6XfZyveceLb4QFowtCTmS1IFf
+eUoybHvjCYyNm9m1B/x297VV73rDvWx7+ptkwG46L5UeG/lrLhnStzM1dxSlENUL
+OGmjFfk00jrRnftat8x31lAa0cFYXudkHpMLxFHprRgsQL+1URjl0nyVT2MLmcit
+kfIMXjRaScJsj+KgW1pymVlIO2qf16Wk4wLubW8/AkSmmSv9ilJeppn7Qh/OuZyj
+epsFX19VdERg42yI0/QIs4cgCvgddlnGuJBDGU5BVFPDYc2BevRvd/x48bDFHJ4w
+dhNrMa9jGDSc8niZ/spK4lE6d7JqFUHuQa2jL8PG5+NcYaftJQAlJt25ze1Km7QO
+pJgRNdEqOp8hcJmfgYbQxGb6s74nMTp+iKOjMLNf1n37QxTPYfKTWP4xnKiva9aA
+jGUMADNgtlFSZt5JaTnEk9m33Nh4FN/siX01+rX4FQ2csIIAQ42Xu/+PRUUYHqXe
+/xGgOhZE9YgZAgMBAAGjUzBRMB0GA1UdDgQWBBSr92+pGtY4Fc5beZWCSzf5FGf9
+mTAfBgNVHSMEGDAWgBSr92+pGtY4Fc5beZWCSzf5FGf9mTAPBgNVHRMBAf8EBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4ICAQCwHTpBGbcnCZc+Y0DLN1mxPOKgcrIHUDQt
+kFaRt901sK9fxhjeOmtcMOxDsVg23BKZ7A+sGkRDa0pxtwqZzrk4r96htJB0mV2y
+zskRjDg8UEjgm2BFFc1ikqHOcidJ0WG6/LSpzR9w6QhAtMpbWLrfS0yIfr9MKywS
+7rOt82USg9Ca8qQxosIUkkatugVjJIjaBbVSREHtaRyDjGqVvB8P6EwESB2Ymltm
++S6LDv0b6NNQyeOLp2fp8JcJmQh5liqcIp0yDVJI8oEppHHkFcROmq/w0cm0Ct/C
+XW+Us2nW5/tVdhm0X2HHN8IItmZEDdM2+AVDoYyKKy13twnClc/0imYoK0I+ARUv
+mF85OmJhODaYhsU8gXwTfnghI4b9Hg++jSRl+jwrvaxwBI+tDGrRCvWCr1T/xVrg
+G8w3MmtIY9MaEyiutK24TeYuR3bMlJqHaQaufm9YTT5vp5MjumUpC4FPM+2JQa1y
+wdAUWyBqHhJF5X4AdVFxcAOHqah1hoky9sUARYd50z85/PhgKH/P2zO5F37NwYSR
+n+DIZDP4AKZ6QEPL8QlteT0EPacZSucwNheSboHFJmT39gGntxSw1hdNcwQ5yaa6
+QMhMfo/w9/i2Yg55RBd5RZCWPb2IlA5RC3qbjPNMC8XrEvhSHOcWTXsfccYgXGeO
+XHgucRqlJg==
 -----END CERTIFICATE-----

php-5.6.40.tar.xz/ext/openssl/tests/bug54992.pem Changed

@@ -1,26 +1,26 @@
 -----BEGIN CERTIFICATE-----
-MIID7jCCAdYCFDw0rvm7q8y5HfispK5A2I2+RBqHMA0GCSqGSIb3DQEBCwUAMIGQ
+MIID7jCCAdYCFEG0vY25vkfkH6Jllbh6eAIsffxMMA0GCSqGSIb3DQEBCwUAMIGQ
 MQswCQYDVQQGEwJQVDEPMA0GA1UECAwGTGlzYm9hMQ8wDQYDVQQHDAZMaXNib2Ex
 FzAVBgNVBAoMDlBIUCBGb3VuZGF0aW9uMR4wHAYDVQQDDBVSb290IENBIGZvciBQ
 SFAgVGVzdHMxJjAkBgkqhkiG9w0BCQEWF2ludGVybmFsc0BsaXN0cy5waHAubmV0
-MB4XDTE4MTIzMTA4NDY0M1oXDTIwMDIwNDA4NDY0M1owWjEXMBUGA1UEAxMOYnVn
+MB4XDTIwMDIxODA4NTYwMVoXDTIxMDMyNDA4NTYwMVowWjEXMBUGA1UEAxMOYnVn
 NTQ5OTIubG9jYWwxCzAJBgNVBAYTAlBUMQ8wDQYDVQQHEwZMaXNib2ExDzANBgNV
 BAgTBkxpc2JvYTEQMA4GA1UEChMHcGhwLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOB
 jQAwgYkCgYEAtUAVQKTgpUPgtFOJ3w3kDJETS45tWeT96kUg1NeYLKW+jNbFhxPo
 PJv7XhfemCaqh2tbq1cdYW906Wp1L+eNQvdTYA2IQG4EQBUlmfyIakOIMsN/RizV
 kF09vlNQwTpaMpqTv7wB8vvwbxb9jbC2ZhQUBEg6PIn18dSstbM9FZ0CAwEAATAN
-BgkqhkiG9w0BAQsFAAOCAgEAKtSMguV5ZQ2KpdZ9MAFa+GiHL0APb58OrvwNK4BF
-6032UZLOWnsBZlo85WGLNnIT/GNzKKr7n9jHeuZcBVOFQLsebahSlfJZs9FPatlI
-9Md1tRzVoTKohjG86HeFhhL+gZQ69SdIcK40wpH1qNv7KyMGA8gnx6rRKbOxZqsx
-pkA/wS7CTqP9/DeOxh/MZPg7N/GZXW1QOz+SE537E9iyiRsbldNYFtwn5iaVfjpr
-xz09wYYW3HJpR+QKPCfJ79JxDhuMHMoUOpIy8vGFnt5zVTcFLa378Sy3vCT1Qwvt
-tTavFGHby4A7OqT6xu+9GTW37OaiV91UelLLV0+MoR4XiMVMX76mvqzmKCp6L9ae
-7RYHrrCtNxkYUKUSkOEc2VHnT+sENkJIZu7zzN7/QNlc0yE9Rtsmgy4QAxo2m9u0
-pUZLAulZ1lS7g/sr7/8Pp17RDvJiJh+oAPyVYZ7OoLF1IoHDHcZI0bqcqhDhiHZs
-PXYqyMCxyYzHFOAOgvbrEkmp8z/E8ATVwdUbAYN1dMrYHre1P4HFEtJh2QiGG2KE
-4jheuNhH1R25AizbwYbD33Kdp7ltCgBlfYqjl771SlgY45QYs0mUdc1Pv39SGIwf
-ZUm7mOWjaTBdYANrkvGM5NNT9kESjKkWykyTg4UF5rHV6nlyexR4b3fjabroi4BS
-v6w=
+BgkqhkiG9w0BAQsFAAOCAgEAmcDl/X+0murSKko+Arl6RFfOB+fpuGeKtS9UAZcH
+w/v7kCvBeRTKs+/BAWbdu3MPXFw4dqvHn+2De/7Fx5yN/KznZnn/aFkGaBWcevQC
+qdGxf9/4SoB+x0fGDuEuZZ/TGiT4V0l7xhx9HBsud5HYt9vFnJDEgSoxlOFDoR13
+6Jefe5kOnHX0dvPuJuZcXquV+5llTYp6clUQkcA8NOuegFEOoM/J5GAYfgHeRtrB
+vjbpIKgIixBUbOwPsrmb3btitPFDT7a1FWNtHmOb1Ij6r+ga6J60Iefr1AfMwnd5
+D6W3E4ztEL9N4RK+uBz5zRk1usFEHw+TaCA4x9xVUXdY8r6ei1xnO9nwA9C1062F
+EVy/HpyxZlrdzFsLWHEWyOnshCdozU14dlkNgc9LImKsMJ+T18GkrF5KtN6NB4tc
+8Zeo7usEWHkwlacKGOr0V3gflU6EfPkQHEsSBSvbzuJ2pej17mqVqdzaRsGliRsC
+P/2cEcxtmoig7rTrS0sBVXLgqxpwBNLEfOKkWVAzBpR86gfGNnJbt3GMPLxma2oP
+tfTUMW4OuUR2GsszDwMmkmNhc7EduJyhcu3BwHChmIW/kbbz32aAFTQnDGO/Dj0G
+f/cROxREv3wCOMZsk56JezZ4F1nWZYcQ2m6xrzyN6DBzc13dQ3Wq9lTJ2vZM8i5E
+jp0=
 -----END CERTIFICATE-----
 -----BEGIN RSA PRIVATE KEY-----
 MIICXgIBAAKBgQC1QBVApOClQ+C0U4nfDeQMkRNLjm1Z5P3qRSDU15gspb6M1sWH

php-5.6.40.tar.xz/ext/openssl/tests/bug65538.phar Changed

@@ -289,64 +289,64 @@
 }
 
 Extract_Phar::go();
-__HALT_COMPILER(); ?>e&#x0;&#x0;&#x0;&#x2;&#x0;&#x0;&#x0;&#x11;&#x0;&#x0;&#x0;&#x1;&#x0;&#x0;&#x0;&#x0;&#x0;&#x0;&#x0;&#x0;&#x0;&#xf;&#x0;&#x0;&#x0;bug54992-ca.pemc&#x8;&#x0;&#x0;êØ)\c&#x8;&#x0;&#x0;&#x4;iÊ¤&#x1;&#x0;&#x0;&#x0;&#x0;&#x0;&#x0;&#xc;&#x0;&#x0;&#x0;bug54992.pem&#xb;	&#x0;&#x0;êØ)\&#xb;	&#x0;&#x0;K&#xf; ¤&#x1;&#x0;&#x0;&#x0;&#x0;&#x0;&#x0;-----BEGIN CERTIFICATE-----
-MIIGAzCCA+ugAwIBAgIUZ7ZvvfVqSEf1EswMT9LfMIPc/U8wDQYJKoZIhvcNAQEL
+__HALT_COMPILER(); ?>e&#x0;&#x0;&#x0;&#x2;&#x0;&#x0;&#x0;&#x11;&#x0;&#x0;&#x0;&#x1;&#x0;&#x0;&#x0;&#x0;&#x0;&#x0;&#x0;&#x0;&#x0;&#xf;&#x0;&#x0;&#x0;bug54992-ca.pemc&#x8;&#x0;&#x0;ª¦K^c&#x8;&#x0;&#x0;úß´&#x1;&#x0;&#x0;&#x0;&#x0;&#x0;&#x0;&#xc;&#x0;&#x0;&#x0;bug54992.pem&#xb;	&#x0;&#x0;ª¦K^&#xb;	&#x0;&#x0;1cb&#x1;´&#x1;&#x0;&#x0;&#x0;&#x0;&#x0;&#x0;-----BEGIN CERTIFICATE-----
+MIIGAzCCA+ugAwIBAgIUYS9Vq4aNK1hL5reofVRkM3ioENEwDQYJKoZIhvcNAQEL
 BQAwgZAxCzAJBgNVBAYTAlBUMQ8wDQYDVQQIDAZMaXNib2ExDzANBgNVBAcMBkxp
 c2JvYTEXMBUGA1UECgwOUEhQIEZvdW5kYXRpb24xHjAcBgNVBAMMFVJvb3QgQ0Eg
 Zm9yIFBIUCBUZXN0czEmMCQGCSqGSIb3DQEJARYXaW50ZXJuYWxzQGxpc3RzLnBo
-cC5uZXQwHhcNMTgxMjMxMDg0NDU3WhcNMjAwMjA0MDg0NDU3WjCBkDELMAkGA1UE
+cC5uZXQwHhcNMjAwMjE4MDg1NTQ5WhcNMjEwMzI0MDg1NTQ5WjCBkDELMAkGA1UE
 BhMCUFQxDzANBgNVBAgMBkxpc2JvYTEPMA0GA1UEBwwGTGlzYm9hMRcwFQYDVQQK
 DA5QSFAgRm91bmRhdGlvbjEeMBwGA1UEAwwVUm9vdCBDQSBmb3IgUEhQIFRlc3Rz
 MSYwJAYJKoZIhvcNAQkBFhdpbnRlcm5hbHNAbGlzdHMucGhwLm5ldDCCAiIwDQYJ
-KoZIhvcNAQEBBQADggIPADCCAgoCggIBAPVThsunmhda5hbNi+pXD3WF9ijryB9H
-JDnIbPW/vMffWcQgtiRzc+6aCykBygnhnN91NNRpxOsoLCb7OjUMM0TjhSE9DxKD
-aVLRoDcs5VSaddQjq3AwdkU6ek9InUOeDuZ8gatrpWlEyuQPwwnMAfR9NkcTajuF
-hGO0BlqkHg98GckQD0N5x6CrrDJt6RE6hf9gUZSGSWdPTiETBQUN8LTuxo/ybFSN
-hcpVNCF+r3eozATbSU8YvQU52RmPIZWHHmYb7KtMO3TEX4LnLJUOefUK4qk+ZJ0s
-f4JfnY7RhBlZGh2kIyE5jwqz8/KzKtxrutNaupdTFZO8nX09QSgmDCxVWVclrPaG
-q2ZFYpeauTy71pTm8DjF7PwQI/+PUrBdFIX0V6uxqUEG0pvPdb8zenVbaK4Jh39u
-w0V5tH/rbtd7zZX4vl3bmKo1Wk0SQxd83iXitxLiJnWNOsmrJcM/Hx91kE10+/ly
-zgL/w5A9HSA616kfPdNzny0laH1TXVLJsnyyV3DyfnU4O6VI0JG3WjhgRdMkgobn
-GvGJ2ZsZAxds9lBtT2y+gw5BU+jkSilPk3jM9MA7Kmyci93U9xxMuDNzyUzfcnXR
-UIq99dZWeMMy1LT3buZXrAWu1WRgPdQtDKcQHDIQaIkxlWsT8q2q/wIirb6fwxlw
-vXkFp+aEP35BAgMBAAGjUzBRMB0GA1UdDgQWBBR37F1+W1gcCp8bhZaFFi9JKQhu
-tTAfBgNVHSMEGDAWgBR37F1+W1gcCp8bhZaFFi9JKQhutTAPBgNVHRMBAf8EBTAD
-AQH/MA0GCSqGSIb3DQEBCwUAA4ICAQAYHqpISUI/x8UW33i35rYkFYNvXBMQDc8J
-v4G2eqEBNCOVmHg6P//lq1F2jrtAEr/saESN1uS1Q80sUsthlVsceV1z1isdpugG
-kMbfHxLe0QpthnP3PEChQw30TPB22BThuGVkteNSZKTCPGdzjSTPq2kOR6PCBZRd
-r0r/TW3lT/Ng3KgjT6g7E3ZUpAeFEQMlmNYr/eEOL7K+1jzQrbCLmXbs6rmtffr7
-n4p+wMPMPaSRqQoQ86ff9GPzxWuAQGlytVoiS5Xt3jotd/RWlOy0YQ2QSzOQvFUW
-4te5lwdOvOFnJTo43U3DqASqMcaazvIsN41zVlOyOyKEr9oZERju6FU1aZmuZtHQ
-wMCmXVj/Swj67Zp9tG+vVQenbEk314+8c2nenuOIFP1F2C/NG3vMLIpENRGxpmAm
-s5gIT6mXvJ4JCwWYc75zucOr2KVkDmEziJh/pARuOrOAPdc6NjKku8HBC9UI96+x
-Db4hG2SqXUzShkFX/px7vlCADvgO3FDk2aiyW02PFsItob2O6OB98VGsU26hgRO/
-Czz/jbjWTPHNOt6/fcL0m7XLwlJ+K9gRArY15DeJGumcHEq/Vd/Z8iPQKKdzgF4O
-9XFZvu+VHP82AS5TeiYHCddFJyzktQYcNu5/OBuxzO83d7rpqrLFETTEOL4cN8O7
-LJ7Q89hYAQ==
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBALlJlfDasmObBQiQSsyDVRu0uwVmFFZ7
+fqFVHUMeKpWv0Y3dH5FtpBoMOh41XYI7E1Ex9UTNIYsRedESzEm1DIBsKHHODRsj
+gJVH3jxAEmDPaNQJ0x4zlNmmd7Zz74lo/eJ+oc2rLiJd3NVKCXEWtu2mO5FN/x3Z
+vG+QXkT04tGvwLn4oAdiU4zlf0ttO5xY5GjUXhT6XfZyveceLb4QFowtCTmS1IFf
+eUoybHvjCYyNm9m1B/x297VV73rDvWx7+ptkwG46L5UeG/lrLhnStzM1dxSlENUL
+OGmjFfk00jrRnftat8x31lAa0cFYXudkHpMLxFHprRgsQL+1URjl0nyVT2MLmcit
+kfIMXjRaScJsj+KgW1pymVlIO2qf16Wk4wLubW8/AkSmmSv9ilJeppn7Qh/OuZyj
+epsFX19VdERg42yI0/QIs4cgCvgddlnGuJBDGU5BVFPDYc2BevRvd/x48bDFHJ4w
+dhNrMa9jGDSc8niZ/spK4lE6d7JqFUHuQa2jL8PG5+NcYaftJQAlJt25ze1Km7QO
+pJgRNdEqOp8hcJmfgYbQxGb6s74nMTp+iKOjMLNf1n37QxTPYfKTWP4xnKiva9aA
+jGUMADNgtlFSZt5JaTnEk9m33Nh4FN/siX01+rX4FQ2csIIAQ42Xu/+PRUUYHqXe
+/xGgOhZE9YgZAgMBAAGjUzBRMB0GA1UdDgQWBBSr92+pGtY4Fc5beZWCSzf5FGf9
+mTAfBgNVHSMEGDAWgBSr92+pGtY4Fc5beZWCSzf5FGf9mTAPBgNVHRMBAf8EBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4ICAQCwHTpBGbcnCZc+Y0DLN1mxPOKgcrIHUDQt
+kFaRt901sK9fxhjeOmtcMOxDsVg23BKZ7A+sGkRDa0pxtwqZzrk4r96htJB0mV2y
+zskRjDg8UEjgm2BFFc1ikqHOcidJ0WG6/LSpzR9w6QhAtMpbWLrfS0yIfr9MKywS
+7rOt82USg9Ca8qQxosIUkkatugVjJIjaBbVSREHtaRyDjGqVvB8P6EwESB2Ymltm
++S6LDv0b6NNQyeOLp2fp8JcJmQh5liqcIp0yDVJI8oEppHHkFcROmq/w0cm0Ct/C
+XW+Us2nW5/tVdhm0X2HHN8IItmZEDdM2+AVDoYyKKy13twnClc/0imYoK0I+ARUv
+mF85OmJhODaYhsU8gXwTfnghI4b9Hg++jSRl+jwrvaxwBI+tDGrRCvWCr1T/xVrg
+G8w3MmtIY9MaEyiutK24TeYuR3bMlJqHaQaufm9YTT5vp5MjumUpC4FPM+2JQa1y
+wdAUWyBqHhJF5X4AdVFxcAOHqah1hoky9sUARYd50z85/PhgKH/P2zO5F37NwYSR
+n+DIZDP4AKZ6QEPL8QlteT0EPacZSucwNheSboHFJmT39gGntxSw1hdNcwQ5yaa6
+QMhMfo/w9/i2Yg55RBd5RZCWPb2IlA5RC3qbjPNMC8XrEvhSHOcWTXsfccYgXGeO
+XHgucRqlJg==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIID7jCCAdYCFDw0rvm7q8y5HfispK5A2I2+RBqHMA0GCSqGSIb3DQEBCwUAMIGQ
+MIID7jCCAdYCFEG0vY25vkfkH6Jllbh6eAIsffxMMA0GCSqGSIb3DQEBCwUAMIGQ
 MQswCQYDVQQGEwJQVDEPMA0GA1UECAwGTGlzYm9hMQ8wDQYDVQQHDAZMaXNib2Ex
 FzAVBgNVBAoMDlBIUCBGb3VuZGF0aW9uMR4wHAYDVQQDDBVSb290IENBIGZvciBQ
 SFAgVGVzdHMxJjAkBgkqhkiG9w0BCQEWF2ludGVybmFsc0BsaXN0cy5waHAubmV0
-MB4XDTE4MTIzMTA4NDY0M1oXDTIwMDIwNDA4NDY0M1owWjEXMBUGA1UEAxMOYnVn
+MB4XDTIwMDIxODA4NTYwMVoXDTIxMDMyNDA4NTYwMVowWjEXMBUGA1UEAxMOYnVn
 NTQ5OTIubG9jYWwxCzAJBgNVBAYTAlBUMQ8wDQYDVQQHEwZMaXNib2ExDzANBgNV
 BAgTBkxpc2JvYTEQMA4GA1UEChMHcGhwLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOB
 jQAwgYkCgYEAtUAVQKTgpUPgtFOJ3w3kDJETS45tWeT96kUg1NeYLKW+jNbFhxPo
 PJv7XhfemCaqh2tbq1cdYW906Wp1L+eNQvdTYA2IQG4EQBUlmfyIakOIMsN/RizV
 kF09vlNQwTpaMpqTv7wB8vvwbxb9jbC2ZhQUBEg6PIn18dSstbM9FZ0CAwEAATAN
-BgkqhkiG9w0BAQsFAAOCAgEAKtSMguV5ZQ2KpdZ9MAFa+GiHL0APb58OrvwNK4BF
-6032UZLOWnsBZlo85WGLNnIT/GNzKKr7n9jHeuZcBVOFQLsebahSlfJZs9FPatlI
-9Md1tRzVoTKohjG86HeFhhL+gZQ69SdIcK40wpH1qNv7KyMGA8gnx6rRKbOxZqsx
-pkA/wS7CTqP9/DeOxh/MZPg7N/GZXW1QOz+SE537E9iyiRsbldNYFtwn5iaVfjpr
-xz09wYYW3HJpR+QKPCfJ79JxDhuMHMoUOpIy8vGFnt5zVTcFLa378Sy3vCT1Qwvt
-tTavFGHby4A7OqT6xu+9GTW37OaiV91UelLLV0+MoR4XiMVMX76mvqzmKCp6L9ae
-7RYHrrCtNxkYUKUSkOEc2VHnT+sENkJIZu7zzN7/QNlc0yE9Rtsmgy4QAxo2m9u0
-pUZLAulZ1lS7g/sr7/8Pp17RDvJiJh+oAPyVYZ7OoLF1IoHDHcZI0bqcqhDhiHZs
-PXYqyMCxyYzHFOAOgvbrEkmp8z/E8ATVwdUbAYN1dMrYHre1P4HFEtJh2QiGG2KE
-4jheuNhH1R25AizbwYbD33Kdp7ltCgBlfYqjl771SlgY45QYs0mUdc1Pv39SGIwf
-ZUm7mOWjaTBdYANrkvGM5NNT9kESjKkWykyTg4UF5rHV6nlyexR4b3fjabroi4BS
-v6w=
+BgkqhkiG9w0BAQsFAAOCAgEAmcDl/X+0murSKko+Arl6RFfOB+fpuGeKtS9UAZcH
+w/v7kCvBeRTKs+/BAWbdu3MPXFw4dqvHn+2De/7Fx5yN/KznZnn/aFkGaBWcevQC
+qdGxf9/4SoB+x0fGDuEuZZ/TGiT4V0l7xhx9HBsud5HYt9vFnJDEgSoxlOFDoR13
+6Jefe5kOnHX0dvPuJuZcXquV+5llTYp6clUQkcA8NOuegFEOoM/J5GAYfgHeRtrB
+vjbpIKgIixBUbOwPsrmb3btitPFDT7a1FWNtHmOb1Ij6r+ga6J60Iefr1AfMwnd5
+D6W3E4ztEL9N4RK+uBz5zRk1usFEHw+TaCA4x9xVUXdY8r6ei1xnO9nwA9C1062F
+EVy/HpyxZlrdzFsLWHEWyOnshCdozU14dlkNgc9LImKsMJ+T18GkrF5KtN6NB4tc
+8Zeo7usEWHkwlacKGOr0V3gflU6EfPkQHEsSBSvbzuJ2pej17mqVqdzaRsGliRsC
+P/2cEcxtmoig7rTrS0sBVXLgqxpwBNLEfOKkWVAzBpR86gfGNnJbt3GMPLxma2oP
+tfTUMW4OuUR2GsszDwMmkmNhc7EduJyhcu3BwHChmIW/kbbz32aAFTQnDGO/Dj0G
+f/cROxREv3wCOMZsk56JezZ4F1nWZYcQ2m6xrzyN6DBzc13dQ3Wq9lTJ2vZM8i5E
+jp0=
 -----END CERTIFICATE-----
 -----BEGIN RSA PRIVATE KEY-----
 MIICXgIBAAKBgQC1QBVApOClQ+C0U4nfDeQMkRNLjm1Z5P3qRSDU15gspb6M1sWH
@@ -363,4 +363,4 @@
 FqU0zPvrnBZ6Zwlgm2cSVQJAPLYA51Z9piajbTuggpioQ5qbUEDkJjmYHbm8eJnK
 h5NW/EtCk4SBxAc+8ElPrvJjtZyOPWfm4vZF5sDKtC3Fkg==
 -----END RSA PRIVATE KEY-----
-Ý¬;lÊ5aOi`u&#xb;ÉaB¢äbR&#x2;&#x0;&#x0;&#x0;GBMB
\ No newline at end of file
+yýzyøký&#x7f;ie&#x7f;¹H&#x2;&#x2;&#x0;&#x0;&#x0;GBMB
\ No newline at end of file

php-5.6.40.tar.xz/ext/openssl/tests/gh22186.phpt Added

@@ -0,0 +1,32 @@
+--TEST--
+GH-22186 (Heap buffer overflow in openssl_encrypt with AES-WRAP-PAD)
+--EXTENSIONS--
+openssl
+--SKIPIF--
+<?php
+/* openssl_get_cipher_methods() enumerates provider ciphers, but openssl_encrypt()
+ * resolves names via the legacy EVP_get_cipherbyname(), so on some builds the
+ * cipher is listed yet not usable. Probe the actual call path instead. */
+if (!@openssl_encrypt("test", "aes-128-wrap-pad", str_repeat("k", 16),
+        OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, str_repeat("\0", 4))) {
+    die('skip aes-128-wrap-pad not usable on this OpenSSL build');
+}
+?>
+--FILE--
+<?php
+$pass = str_repeat("k", 16);
+$iv = str_repeat("\0", 4);
+
+for ($i = 1; $i < 258; $i++) {
+    $data = str_repeat("a", $i);
+    $enc = openssl_encrypt($data, 'aes-128-wrap-pad', $pass, OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, $iv);
+    $dec = openssl_decrypt($enc, 'aes-128-wrap-pad', $pass, OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, $iv);
+    if ($dec !== $data) {
+        die("mismatch at $i\n");
+    }
+}
+
+echo "done\n";
+?>
+--EXPECT--
+done

php-5.6.40.tar.xz/ext/openssl/tests/openssl_error_string_basic.phpt Changed

@@ -6,35 +6,46 @@
 <?php
 // helper function to check openssl errors
 function expect_openssl_errors($name, $expected_error_codes) {
-	$expected_errors = array_fill_keys($expected_error_codes, false);
-	while (($error_string = openssl_error_string()) !== false) {
-		if (strlen($error_string) > 14) {
-			$error_code = substr($error_string, 6, 8);
-			if (isset($expected_errors$error_code)) {
-				$expected_errors$error_code = true;
-			}
-		}
+    $expected_errors = array_fill_keys($expected_error_codes, false);
+    $all_errors = array();
+    while (($error_string = openssl_error_string()) !== false) {
+	if (preg_match(",.+:(0-9A-F+):.+,", $error_string, $m) > 0) {
+            $error_code = $m1;
+            if (isset($expected_errors$error_code)) {
+                $expected_errors$error_code = true;
+            }
+	    $all_errors$error_code = $error_string;
+        } else {
+		$all_errors = $error_string;
 	}
+    }
 
-	$fail = false;
-	foreach ($expected_errors as $error_code => $error_code_found) {
-		if (!$error_code_found) {
-			$fail = true;
-			echo "$name: no error code $error_code\n";
-		}
-	}
+    $fail = false;
+    foreach ($expected_errors as $error_code => $error_code_found) {
+        if (!$error_code_found) {
+            $fail = true;
+            echo "$name: no error code $error_code\n";
+        }
+    }
 
-	if (!$fail) {
-		echo "$name: ok\n";
+    if (!$fail) {
+        echo "$name: ok\n";
+    } else {
+	echo "$name: uncaught errors\n";
+	foreach ($all_errors as $code => $str) {
+		if (!isset($expected_errors$code) || !$expected_errors$code) {
+			echo "\t", $code, ": ", $str, "\n";
+		}
 	}
+    }
 }
 
 // helper for debugging errors
 function dump_openssl_errors($name) {
-	echo "\n$name\n";
-	while (($error_string = openssl_error_string()) !== false) {
-		var_dump($error_string);
-	}
+    echo "\n$name\n";
+    while (($error_string = openssl_error_string()) !== false) {
+        var_dump($error_string);
+    }
 }
 
 // common output file
@@ -71,14 +82,17 @@
 }
 $error_queue_size = 0;
 while (($enc_error_new = openssl_error_string()) !== false) {
-	if ($enc_error_new !== $enc_error) {
-		echo "The new encoding error doesn't match the expected one\n";
-	}
-	++$error_queue_size;
+    if ($enc_error_new !== $enc_error) {
+        echo "The new encoding error doesn't match the expected one\n";
+    }
+    ++$error_queue_size;
 }
 var_dump($error_queue_size);
 echo "\n";
 
+$is_111 = OPENSSL_VERSION_NUMBER >= 0x10101000;
+$err_pem_no_start_line = $is_111 ? '0909006C': '0906D06C';
+
 // PKEY
 echo "PKEY errors\n";
 // file for pkey (file:///) fails when opennig (BIO_new_file)
@@ -86,16 +100,16 @@
 expect_openssl_errors('openssl_pkey_export_to_file opening', '02001002', '2006D080');
 // file or private pkey is not correct PEM - failing PEM_read_bio_PrivateKey
 @openssl_pkey_export_to_file($csr_file, $output_file);
-expect_openssl_errors('openssl_pkey_export_to_file pem', '0906D06C');
+expect_openssl_errors('openssl_pkey_export_to_file pem', $err_pem_no_start_line);
 // file to export cannot be written
 @openssl_pkey_export_to_file($private_key_file, $invalid_file_for_write);
-expect_openssl_errors('openssl_pkey_export_to_file write', '2006D002', '09072007');
-// succesful export
+expect_openssl_errors('openssl_pkey_export_to_file write', '2006D002');
+// successful export
 @openssl_pkey_export($private_key_file_with_pass, $out, 'wrong pwd');
 expect_openssl_errors('openssl_pkey_export', '06065064', '0906A065');
 // invalid x509 for getting public key
 @openssl_pkey_get_public($private_key_file);
-expect_openssl_errors('openssl_pkey_get_public', '0906D06C');
+expect_openssl_errors('openssl_pkey_get_public', $err_pem_no_start_line);
 // private encrypt with unknown padding
 @openssl_private_encrypt("data", $crypted, $private_key_file, 1000);
 expect_openssl_errors('openssl_private_encrypt', '04066076');
@@ -105,7 +119,7 @@
 // public encrypt and decrypt with failed padding check and padding
 @openssl_public_encrypt("data", $crypted, $public_key_file, 1000);
 @openssl_public_decrypt("data", $crypted, $public_key_file);
-expect_openssl_errors('openssl_private_(en|de)crypt padding', '0906D06C', '04068076', '0407006A', '04067072');
+expect_openssl_errors('openssl_private_(en|de)crypt padding', $err_pem_no_start_line, '04068076', '04067072');
 
 // X509
 echo "X509 errors\n";
@@ -114,7 +128,7 @@
 expect_openssl_errors('openssl_x509_export_to_file open', '02001002');
 // file or str cert is not correct PEM - failing PEM_read_bio_X509 or PEM_ASN1_read_bio
 @openssl_x509_export_to_file($csr_file, $output_file);
-expect_openssl_errors('openssl_x509_export_to_file pem', '0906D06C');
+expect_openssl_errors('openssl_x509_export_to_file pem', $err_pem_no_start_line);
 // file to export cannot be written
 @openssl_x509_export_to_file($crt_file, $invalid_file_for_write);
 expect_openssl_errors('openssl_x509_export_to_file write', '2006D002');
@@ -126,10 +140,10 @@
 echo "CSR errors\n";
 // file for csr (file:///) fails when opennig (BIO_new_file)
 @openssl_csr_get_subject("file://" . $invalid_file_for_read);
-expect_openssl_errors('openssl_csr_get_subject open', '02001002', '2006D080', '20068079', '0906D06C');
+expect_openssl_errors('openssl_csr_get_subject open', '02001002', '2006D080');
 // file or str csr is not correct PEM - failing PEM_read_bio_X509_REQ
 @openssl_csr_get_subject($crt_file);
-expect_openssl_errors('openssl_csr_get_subjec pem', '0906D06C');
+expect_openssl_errors('openssl_csr_get_subjec pem', $err_pem_no_start_line);
 
 // other possible cuases that are difficult to catch:
 // - ASN1_STRING_to_UTF8 fails in add_assoc_name_entry

php-5.6.40.tar.xz/ext/openssl/tests/openssl_peer_fingerprint_basic.phpt Changed

@@ -36,13 +36,13 @@
     // openssl x509 -noout -fingerprint -md5 -inform pem -in ext/openssl/tests/bug54992.pem | cut -d '=' -f 2 | tr -d ':' | tr 'A-F' 'a-f'
     // Currently it's 4edbbaf40a6a4b6af22b6d6d9818378f
     // One below is intentionally broken (compare the last character):
-    stream_context_set_option($clientCtx, 'ssl', 'peer_fingerprint', '4edbbaf40a6a4b6af22b6d6d98183780');
+    stream_context_set_option($clientCtx, 'ssl', 'peer_fingerprint', '8054dab6e0412bdd8190226fd213d190');
     var_dump(stream_socket_client($serverUri, $errno, $errstr, 2, $clientFlags, $clientCtx));
 
     // Run the following to get actual sha256 (from sources root):
     // openssl x509 -noout -fingerprint -sha256 -inform pem -in ext/openssl/tests/bug54992.pem | cut -d '=' -f 2 | tr -d ':' | tr 'A-F' 'a-f'
     stream_context_set_option($clientCtx, 'ssl', 'peer_fingerprint', 
-        'sha256' => 'b1d480a2f83594fa243d26378cf611f334d369e59558d87e3de1abe8f36cb997',
+        'sha256' => '06941b4f4f00523f6c81b69ad4424b3506320285a8b1bd084c112435a12ff487',
     );
     var_dump(stream_socket_client($serverUri, $errno, $errstr, 2, $clientFlags, $clientCtx));
 CODE;

php-5.6.40.tar.xz/ext/pcre/pcrelib/pcre_compile.c Changed

php-5.6.40.tar.xz/ext/pcre/tests/bug75457.phpt Added

php-5.6.40.tar.xz/ext/pdo/pdo_sql_parser.c Changed

@@ -1,4 +1,5 @@
 /* Generated by re2c 0.13.5 */
+#line 1 "ext/pdo/pdo_sql_parser.re"
 /*
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
@@ -46,9 +47,11 @@
 	char *cursor = s->cur;
 
 	s->tok = cursor;
+	#line 55 "ext/pdo/pdo_sql_parser.re"
 
 
 	
+#line 55 "ext/pdo/pdo_sql_parser.c"
 {
 	YYCTYPE yych;
 
@@ -77,7 +80,9 @@
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych >= 0x01) goto yy37;
 yy4:
+#line 63 "ext/pdo/pdo_sql_parser.re"
 	{ SKIP_ONE(PDO_PARSER_TEXT); }
+#line 86 "ext/pdo/pdo_sql_parser.c"
 yy5:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych <= 0x00) goto yy4;
@@ -158,7 +163,9 @@
 	default:	goto yy8;
 	}
 yy8:
+#line 62 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_BIND_POS); }
+#line 169 "ext/pdo/pdo_sql_parser.c"
 yy9:
 	yych = *++YYCURSOR;
 	goto yy4;
@@ -195,7 +202,9 @@
 	default:	goto yy12;
 	}
 yy14:
+#line 65 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_TEXT); }
+#line 208 "ext/pdo/pdo_sql_parser.c"
 yy15:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -216,7 +225,9 @@
 yy19:
 	++YYCURSOR;
 yy20:
+#line 64 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_TEXT); }
+#line 231 "ext/pdo/pdo_sql_parser.c"
 yy21:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -235,7 +246,9 @@
 	default:	goto yy25;
 	}
 yy25:
+#line 60 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_TEXT); }
+#line 252 "ext/pdo/pdo_sql_parser.c"
 yy26:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -307,7 +320,9 @@
 	default:	goto yy28;
 	}
 yy28:
+#line 61 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_BIND); }
+#line 326 "ext/pdo/pdo_sql_parser.c"
 yy29:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -335,7 +350,9 @@
 	goto yy31;
 yy34:
 	++YYCURSOR;
+#line 59 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_TEXT); }
+#line 356 "ext/pdo/pdo_sql_parser.c"
 yy36:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -355,8 +372,11 @@
 	goto yy36;
 yy39:
 	++YYCURSOR;
+#line 58 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_TEXT); }
+#line 378 "ext/pdo/pdo_sql_parser.c"
 }
+#line 66 "ext/pdo/pdo_sql_parser.re"
 	
 }

php-5.6.40.tar.xz/ext/pdo_firebird/config.m4 Changed

@@ -8,43 +8,56 @@
     AC_MSG_ERROR(PDO is not enabled! Add --enable-pdo to your configure line.)
   fi
 
-  if test "$PHP_PDO_FIREBIRD" = "yes"; then
-    FIREBIRD_INCDIR=
-    FIREBIRD_LIBDIR=
-    FIREBIRD_LIBDIR_FLAG=
+  AC_PATH_PROG(FB_CONFIG, fb_config, no)
+
+  if test -x "$FB_CONFIG" && test "$PHP_PDO_FIREBIRD" = "yes"; then
+    AC_MSG_CHECKING(for libfbconfig)
+    FB_CFLAGS=`$FB_CONFIG --cflags`
+    FB_LIBDIR=`$FB_CONFIG --libs`
+    FB_VERSION=`$FB_CONFIG --version`
+    AC_MSG_RESULT(version $FB_VERSION)
+    PHP_EVAL_LIBLINE($FB_LIBDIR, PDO_FIREBIRD_SHARED_LIBADD)
+    PHP_EVAL_INCLINE($FB_CFLAGS)
+
   else
-    FIREBIRD_INCDIR=$PHP_PDO_FIREBIRD/include
-    FIREBIRD_LIBDIR=$PHP_PDO_FIREBIRD/$PHP_LIBDIR
-    FIREBIRD_LIBDIR_FLAG=-L$FIREBIRD_LIBDIR
-  fi
+    if test "$PHP_PDO_FIREBIRD" = "yes"; then
+      FIREBIRD_INCDIR=
+      FIREBIRD_LIBDIR=
+      FIREBIRD_LIBDIR_FLAG=
+    else
+      FIREBIRD_INCDIR=$PHP_PDO_FIREBIRD/include
+      FIREBIRD_LIBDIR=$PHP_PDO_FIREBIRD/$PHP_LIBDIR
+      FIREBIRD_LIBDIR_FLAG=-L$FIREBIRD_LIBDIR
+    fi
 
-  PHP_CHECK_LIBRARY(fbclient, isc_detach_database,
-  
-    FIREBIRD_LIBNAME=fbclient
-  , 
-    PHP_CHECK_LIBRARY(gds, isc_detach_database,
+    PHP_CHECK_LIBRARY(fbclient, isc_detach_database,
     
-      FIREBIRD_LIBNAME=gds
+      FIREBIRD_LIBNAME=fbclient
     , 
-      PHP_CHECK_LIBRARY(ib_util, isc_detach_database,
+      PHP_CHECK_LIBRARY(gds, isc_detach_database,
       
-        FIREBIRD_LIBNAME=ib_util
+        FIREBIRD_LIBNAME=gds
       , 
-        AC_MSG_ERROR(libfbclient, libgds or libib_util not found! Check config.log for more information.)
+        PHP_CHECK_LIBRARY(ib_util, isc_detach_database,
+        
+          FIREBIRD_LIBNAME=ib_util
+        , 
+          AC_MSG_ERROR(libfbclient, libgds or libib_util not found! Check config.log for more information.)
+        , 
+          $FIREBIRD_LIBDIR_FLAG
+        )
       , 
         $FIREBIRD_LIBDIR_FLAG
       )
     , 
       $FIREBIRD_LIBDIR_FLAG
     )
-  , 
-    $FIREBIRD_LIBDIR_FLAG
-  )
+    PHP_ADD_LIBRARY_WITH_PATH($FIREBIRD_LIBNAME, $FIREBIRD_LIBDIR, PDO_FIREBIRD_SHARED_LIBADD)
+    PHP_ADD_INCLUDE($FIREBIRD_INCDIR)
+  fi
  
   PHP_CHECK_PDO_INCLUDES
 
-  PHP_ADD_LIBRARY_WITH_PATH($FIREBIRD_LIBNAME, $FIREBIRD_LIBDIR, PDO_FIREBIRD_SHARED_LIBADD)
-  PHP_ADD_INCLUDE($FIREBIRD_INCDIR)
   AC_DEFINE(HAVE_PDO_FIREBIRD,1, )
   PHP_NEW_EXTENSION(pdo_firebird, pdo_firebird.c firebird_driver.c firebird_statement.c, $ext_shared,,-I$pdo_cv_inc_path)
   PHP_SUBST(PDO_FIREBIRD_SHARED_LIBADD)

php-5.6.40.tar.xz/ext/pdo_firebird/firebird_driver.c Changed

@@ -140,7 +140,7 @@
 	HashTable *np;
 
 	do {
-		isc_stmt_handle s = NULL;
+		isc_stmt_handle s = PDO_FIREBIRD_HANDLE_INITIALIZER;
 		XSQLDA num_sqlda;
 		static char const info = { isc_info_sql_stmt_type };
 		char result8;
@@ -221,7 +221,7 @@
 static long firebird_handle_doer(pdo_dbh_t *dbh, const char *sql, long sql_len TSRMLS_DC) /* {{{ */
 {
 	pdo_firebird_db_handle *H = (pdo_firebird_db_handle *)dbh->driver_data;
-	isc_stmt_handle stmt = NULL;
+	isc_stmt_handle stmt = PDO_FIREBIRD_HANDLE_INITIALIZER;
 	static char const info_count = { isc_info_sql_records };
 	char result64;
 	int ret = 0;
@@ -240,21 +240,32 @@
 	/* execute the statement */
 	if (isc_dsql_execute2(H->isc_status, &H->tr, &stmt, PDO_FB_SQLDA_VERSION, &in_sqlda, &out_sqlda)) {
 		RECORD_ERROR(dbh);
-		return -1;
+		ret = -1;
+		goto free_statement;
 	}
 	
 	/* find out how many rows were affected */
 	if (isc_dsql_sql_info(H->isc_status, &stmt, sizeof(info_count), const_cast(info_count),
 			sizeof(result),	result)) {
 		RECORD_ERROR(dbh);
-		return -1;
+		ret = -1;
+		goto free_statement;
 	}
 
 	if (result0 == isc_info_sql_records) {
 		unsigned i = 3, result_size = isc_vax_integer(&result1,2);
 
+		if (result_size > sizeof(result)) {
+			ret = -1;
+			goto free_statement;
+		}
 		while (resulti != isc_info_end && i < result_size) {
 			short len = (short)isc_vax_integer(&resulti+1,2);
+			/* bail out on bad len */
+			if (len != 1 && len != 2 && len != 4) {
+				ret = -1;
+				goto free_statement;
+			}
 			if (resulti != isc_info_req_select_count) {
 				ret += isc_vax_integer(&resulti+3,len);
 			}
@@ -267,6 +278,12 @@
 		RECORD_ERROR(dbh);
 	}
 
+free_statement:
+
+	if (isc_dsql_free_statement(H->isc_status, &stmt, DSQL_drop)) {
+		RECORD_ERROR(dbh);
+	}
+
 	return ret;
 }
 /* }}} */
@@ -531,14 +548,16 @@
 }
 /* }}} */
 
+#define INFO_BUF_LEN 512
+
 /* callback to used to report database server info */
 static void firebird_info_cb(void *arg, char const *s) /* {{{ */
 {
 	if (arg) {
 		if (*(char*)arg) { /* second call */
-			strcat(arg, " ");
+			strlcat(arg, " ", INFO_BUF_LEN);
 		}
-		strcat(arg, s);
+		strlcat(arg, s, INFO_BUF_LEN);
 	}
 }
 /* }}} */
@@ -549,8 +568,8 @@
 	pdo_firebird_db_handle *H = (pdo_firebird_db_handle *)dbh->driver_data;
 
 	switch (attr) {
-		char tmp512;
-		
+		char tmpINFO_BUF_LEN;
+
 		case PDO_ATTR_AUTOCOMMIT:
 			ZVAL_LONG(val,dbh->auto_commit);
 			return 1;

php-5.6.40.tar.xz/ext/pdo_firebird/firebird_statement.c Changed

@@ -120,8 +120,14 @@
 				}
 				if (result0 == isc_info_sql_records) {
 					unsigned i = 3, result_size = isc_vax_integer(&result1, 2);
+					if (result_size > sizeof(result)) {
+						goto error;
+					}
 					while (resulti != isc_info_end && i < result_size) {
 						short len = (short) isc_vax_integer(&resulti + 1, 2);
+						if (len != 1 && len != 2 && len != 4) {
+							goto error;
+						}
 						if (resulti != isc_info_req_select_count) {
 							affected_rows += isc_vax_integer(&resulti + 3, len);
 						}
@@ -145,7 +151,8 @@
 		return 1;
 	} while (0);
 
-	RECORD_ERROR(stmt);	
+error:
+	RECORD_ERROR(stmt);
 
 	return 0;
 }
@@ -223,7 +230,7 @@
 {
 	pdo_firebird_stmt *S = (pdo_firebird_stmt*)stmt->driver_data;
 	pdo_firebird_db_handle *H = S->H;
-	isc_blob_handle blobh = NULL;
+	isc_blob_handle blobh = PDO_FIREBIRD_HANDLE_INITIALIZER;
 	char const bl_item = isc_info_blob_total_length;
 	char bl_info20;
 	unsigned short i;
@@ -267,8 +274,13 @@
 		unsigned short seg_len;
 		ISC_STATUS stat;
 
-		*ptr = S->fetch_bufcolno = erealloc(*ptr, *len+1);
-	
+		/* prevent overflow */
+		if (*len == (LONG_MAX * 2UL +1UL)) {
+			result = 0;
+			goto fetch_blob_end;
+		}
+		*ptr = S->fetch_bufcolno = erealloc(S->fetch_bufcolno, *len+1);
+
 		for (cur_len = stat = 0; (!stat || stat == isc_segment) && cur_len < *len; cur_len += seg_len) {
 	
 			unsigned short chunk_size = (*len-cur_len) > USHRT_MAX ? USHRT_MAX
@@ -412,7 +424,7 @@
 {
 	pdo_firebird_stmt *S = (pdo_firebird_stmt*)stmt->driver_data;
 	pdo_firebird_db_handle *H = S->H;
-	isc_blob_handle h = NULL;
+	isc_blob_handle h = PDO_FIREBIRD_HANDLE_INITIALIZER;
 	unsigned long put_cnt = 0, rem_cnt;
 	unsigned short chunk_size;
 	int result = 1;

php-5.6.40.tar.xz/ext/pdo_firebird/php_pdo_firebird_int.h Changed

php-5.6.40.tar.xz/ext/pdo_firebird/tests/bug_76448.data Added

php-5.6.40.tar.xz/ext/pdo_firebird/tests/bug_76448.phpt Added

php-5.6.40.tar.xz/ext/pdo_firebird/tests/bug_76449.data Added

php-5.6.40.tar.xz/ext/pdo_firebird/tests/bug_76449.phpt Added

php-5.6.40.tar.xz/ext/pdo_firebird/tests/bug_76450.data Added

php-5.6.40.tar.xz/ext/pdo_firebird/tests/bug_76450.phpt Added

php-5.6.40.tar.xz/ext/pdo_firebird/tests/bug_76452.data Added

php-5.6.40.tar.xz/ext/pdo_firebird/tests/bug_76452.phpt Added

php-5.6.40.tar.xz/ext/pdo_firebird/tests/bug_76488.phpt Added

php-5.6.40.tar.xz/ext/pdo_mysql/tests/pdo_mysql_exec.phpt Changed

php-5.6.40.tar.xz/ext/pdo_mysql/tests/pdo_mysql_stmt_getcolumnmeta.phpt Changed

@@ -162,37 +162,37 @@
 	test_meta($db, 100, 'INT', -2147483648, 'LONG', ($is_mysqlnd) ? PDO::PARAM_INT : PDO::PARAM_STR);
 	test_meta($db, 110, 'INT UNSIGNED', 4294967295, 'LONG', ($is_mysqlnd) ? PDO::PARAM_INT : PDO::PARAM_STR);
 
-	test_meta($db, 120, 'BIGINT', -9223372036854775808, 'LONGLONG', ($is_mysqlnd) ? ((PHP_INT_SIZE == 4) ? PDO::PARAM_STR : PDO::PARAM_INT) : PDO::PARAM_STR);
-	test_meta($db, 130, 'BIGINT UNSIGNED', 18446744073709551615, 'LONGLONG', ($is_mysqlnd) ? ((PHP_INT_SIZE == 4) ? PDO::PARAM_STR : PDO::PARAM_INT) : PDO::PARAM_STR);
+	test_meta($db, 120, 'BIGINT', '-9223372036854775808', 'LONGLONG', ($is_mysqlnd) ? ((PHP_INT_SIZE == 4) ? PDO::PARAM_STR : PDO::PARAM_INT) : PDO::PARAM_STR);
+	test_meta($db, 130, 'BIGINT UNSIGNED', '18446744073709551615', 'LONGLONG', ($is_mysqlnd) ? ((PHP_INT_SIZE == 4) ? PDO::PARAM_STR : PDO::PARAM_INT) : PDO::PARAM_STR);
 
 	test_meta($db, 130, 'REAL', -1.01, ($real_as_float) ? 'FLOAT' : 'DOUBLE', PDO::PARAM_STR);
 	test_meta($db, 140, 'REAL UNSIGNED', 1.01, ($real_as_float) ? 'FLOAT' : 'DOUBLE', PDO::PARAM_STR);
-	test_meta($db, 150, 'REAL ZEROFILL', -1.01, ($real_as_float) ? 'FLOAT' : 'DOUBLE', PDO::PARAM_STR);
+	test_meta($db, 150, 'REAL ZEROFILL', 1.01, ($real_as_float) ? 'FLOAT' : 'DOUBLE', PDO::PARAM_STR);
 	test_meta($db, 160, 'REAL UNSIGNED ZEROFILL', 1.01, ($real_as_float) ? 'FLOAT' : 'DOUBLE', PDO::PARAM_STR);
 
 	test_meta($db, 170, 'DOUBLE', -1.01, 'DOUBLE', PDO::PARAM_STR);
 	test_meta($db, 180, 'DOUBLE UNSIGNED', 1.01, 'DOUBLE', PDO::PARAM_STR);
-	test_meta($db, 190, 'DOUBLE ZEROFILL', -1.01, 'DOUBLE', PDO::PARAM_STR);
+	test_meta($db, 190, 'DOUBLE ZEROFILL', 1.01, 'DOUBLE', PDO::PARAM_STR);
 	test_meta($db, 200, 'DOUBLE UNSIGNED ZEROFILL', 1.01, 'DOUBLE', PDO::PARAM_STR);
 
 	test_meta($db, 210, 'FLOAT', -1.01, 'FLOAT', PDO::PARAM_STR);
 	test_meta($db, 220, 'FLOAT UNSIGNED', 1.01, 'FLOAT', PDO::PARAM_STR);
-	test_meta($db, 230, 'FLOAT ZEROFILL', -1.01, 'FLOAT', PDO::PARAM_STR);
+	test_meta($db, 230, 'FLOAT ZEROFILL', 1.01, 'FLOAT', PDO::PARAM_STR);
 	test_meta($db, 240, 'FLOAT UNSIGNED ZEROFILL', 1.01, 'FLOAT', PDO::PARAM_STR);
 
 	test_meta($db, 250, 'DECIMAL', -1.01, array('DECIMAL', 'NEWDECIMAL'), PDO::PARAM_STR);
 	test_meta($db, 260, 'DECIMAL UNSIGNED', 1.01, array('DECIMAL', 'NEWDECIMAL'), PDO::PARAM_STR);
-	test_meta($db, 270, 'DECIMAL ZEROFILL', -1.01, array('DECIMAL', 'NEWDECIMAL'), PDO::PARAM_STR);
+	test_meta($db, 270, 'DECIMAL ZEROFILL', 1.01, array('DECIMAL', 'NEWDECIMAL'), PDO::PARAM_STR);
 	test_meta($db, 280, 'DECIMAL UNSIGNED ZEROFILL', 1.01, array('DECIMAL', 'NEWDECIMAL'), PDO::PARAM_STR);
 
 	test_meta($db, 290, 'NUMERIC', -1.01, array('DECIMAL', 'NEWDECIMAL'), PDO::PARAM_STR);
 	test_meta($db, 300, 'NUMERIC UNSIGNED', 1.01, array('DECIMAL', 'NEWDECIMAL'), PDO::PARAM_STR);
-	test_meta($db, 310, 'NUMERIC ZEROFILL', -1.01, array('DECIMAL', 'NEWDECIMAL'), PDO::PARAM_STR);
+	test_meta($db, 310, 'NUMERIC ZEROFILL', 1.01, array('DECIMAL', 'NEWDECIMAL'), PDO::PARAM_STR);
 	test_meta($db, 320, 'NUMERIC UNSIGNED ZEROFILL', 1.01, array('DECIMAL', 'NEWDECIMAL'), PDO::PARAM_STR);
 
 	test_meta($db, 330, 'DATE', '2008-04-23', array('DATE', 'NEWDATE'), PDO::PARAM_STR);
 	test_meta($db, 340, 'TIME', '14:37:00', 'TIME', PDO::PARAM_STR);
-	test_meta($db, 350, 'TIMESTAMP', time(), 'TIMESTAMP', PDO::PARAM_STR);
+	test_meta($db, 350, 'TIMESTAMP', '2008-03-23 14:38:00', 'TIMESTAMP', PDO::PARAM_STR);
 	test_meta($db, 360, 'DATETIME', '2008-03-23 14:38:00', 'DATETIME', PDO::PARAM_STR);
 	test_meta($db, 370, 'YEAR', '2008', 'YEAR', ($is_mysqlnd) ? PDO::PARAM_INT : PDO::PARAM_STR);

php-5.6.40.tar.xz/ext/pdo_pgsql/tests/bug48764.phpt Changed

php-5.6.40.tar.xz/ext/pdo_pgsql/tests/bug_33876.phpt Changed

php-5.6.40.tar.xz/ext/pdo_pgsql/tests/copy_from.phpt Changed

php-5.6.40.tar.xz/ext/pdo_pgsql/tests/copy_to.phpt Changed

php-5.6.40.tar.xz/ext/pdo_sqlite/sqlite_driver.c Changed

php-5.6.40.tar.xz/ext/pdo_sqlite/tests/bug81740.phpt Added

php-5.6.40.tar.xz/ext/pgsql/pgsql.c Changed

php-5.6.40.tar.xz/ext/pgsql/tests/bug81720.phpt Added

php-5.6.40.tar.xz/ext/phar/dirstream.c Changed

php-5.6.40.tar.xz/ext/phar/phar.c Changed

@@ -17,7 +17,7 @@
   +----------------------------------------------------------------------+
 */
 
-/* $Id: 6e5cec2462a6ded53d4379ea9a69487a60d5c43c $ */
+/* $Id: 45190e22aa09bbda02092b385bd5eb09cb3a4a9c $ */
 
 #define PHAR_MAIN 1
 #include "phar_internal.h"
@@ -1385,6 +1385,9 @@
 	/* set up our manifest */
 	mydata = ecalloc(1, sizeof(phar_archive_data));
 	mydata->fname = expand_filepath(fname, NULL TSRMLS_CC);
+	if (mydata->fname == NULL) {
+		return FAILURE;
+	}
 	fname_len = strlen(mydata->fname);
 #ifdef PHP_WIN32
 	phar_unixify_path_separators(mydata->fname, fname_len);
@@ -1577,6 +1580,7 @@
 	const char gz_magic = "\x1f\x8b\x08";
 	const char bz_magic = "BZh";
 	char *pos, test = '\0';
+	int recursion_count = 3; // arbitrary limit to avoid too deep or even infinite recursion
 	const int window_size = 1024;
 	char buffer1024 + sizeof(token); /* a 1024 byte window + the size of the halt_compiler token (moving window) */
 	const long readsize = sizeof(buffer) - sizeof(token);
@@ -1604,7 +1608,7 @@
 			MAPPHAR_ALLOC_FAIL("internal corruption of phar \"%s\" (truncated entry)")
 		}
 
-		if (!test) {
+		if (!test && recursion_count) {
 			test = '\1';
 			pos = buffer+tokenlen;
 			if (!memcmp(pos, gz_magic, 3)) {
@@ -1666,6 +1670,10 @@
 
 				/* now, start over */
 				test = '\0';
+				if (!--recursion_count) {
+					MAPPHAR_ALLOC_FAIL("unable to decompress gzipped phar archive \"%s\"");
+					break;
+				}
 				continue;
 			} else if (!memcmp(pos, bz_magic, 3)) {
 				php_stream_filter *filter;
@@ -1704,6 +1712,10 @@
 
 				/* now, start over */
 				test = '\0';
+				if (!--recursion_count) {
+					MAPPHAR_ALLOC_FAIL("unable to decompress bzipped phar archive \"%s\"");
+					break;
+				}
 				continue;
 			}
 
@@ -3594,7 +3606,7 @@
 	php_info_print_table_header(2, "Phar: PHP Archive support", "enabled");
 	php_info_print_table_row(2, "Phar EXT version", PHP_PHAR_VERSION);
 	php_info_print_table_row(2, "Phar API version", PHP_PHAR_API_VERSION);
-	php_info_print_table_row(2, "SVN revision", "$Id: 6e5cec2462a6ded53d4379ea9a69487a60d5c43c $");
+	php_info_print_table_row(2, "SVN revision", "$Id: 45190e22aa09bbda02092b385bd5eb09cb3a4a9c $");
 	php_info_print_table_row(2, "Phar-based phar archives", "enabled");
 	php_info_print_table_row(2, "Tar-based phar archives", "enabled");
 	php_info_print_table_row(2, "ZIP-based phar archives", "enabled");

php-5.6.40.tar.xz/ext/phar/phar_object.c Changed

@@ -1427,6 +1427,8 @@
 	zend_class_entry *ce = p_obj->c;
 	phar_archive_object *phar_obj = p_obj->p;
 	char *str = "stream";
+	php_stream_statbuf ssb;
+	char ch;
 
 	iter->funcs->get_current_data(iter, &value TSRMLS_CC);
 
@@ -1550,7 +1552,7 @@
 		base = temp;
 		base_len = strlen(base);
 
-		if (strstr(fname, base)) {
+		if (fname_len >= base_len && strncmp(fname, base, base_len) == 0 && ((ch = fnamebase_len - IS_SLASH(basebase_len - 1)) == '\0' || IS_SLASH(ch))) {
 			str_key_len = fname_len - base_len;
 
 			if (str_key_len <= 0) {
@@ -1709,6 +1711,16 @@
 		php_stream_copy_to_stream_ex(fp, p_obj->fp, PHP_STREAM_COPY_ALL, &contents_len);
 		data->internal_file->uncompressed_filesize = data->internal_file->compressed_filesize =
 			php_stream_tell(p_obj->fp) - data->internal_file->offset;
+		if (php_stream_stat(fp, &ssb) != -1) {
+			data->internal_file->flags = ssb.sb.st_mode & PHAR_ENT_PERM_MASK ;
+		} else {
+#ifndef _WIN32
+			mode_t mask;
+			mask = umask(0);
+			umask(mask);
+			data->internal_file->flags &= ~mask;
+#endif
+		}
 	}
 
 	if (close_fp) {
@@ -2026,7 +2038,7 @@
 	char *newname = NULL, *newpath = NULL;
 	zval *ret, arg1;
 	zend_class_entry *ce;
-	char *error;
+	char *error = NULL;
 	const char *pcr_error;
 	int ext_len = ext ? strlen(ext) : 0;
 	int oldname_len;
@@ -2186,6 +2198,8 @@
 	phar_flush(phar, 0, 0, 1, &error TSRMLS_CC);
 
 	if (error) {
+		zend_hash_del(&(PHAR_G(phar_fname_map)), newpath, phar->fname_len);
+		*sphar = NULL;
 		zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "%s", error);
 		efree(error);
 		efree(oldpath);

php-5.6.40.tar.xz/ext/phar/tar.c Changed

php-5.6.40.tar.xz/ext/phar/tests/GHSA-jqcx-ccgc-xwhv.phpt Added

php-5.6.40.tar.xz/ext/phar/tests/bug69720.phpt Changed

php-5.6.40.tar.xz/ext/phar/tests/bug71488.phpt Changed

php-5.6.40.tar.xz/ext/phar/tests/bug77396.phpt Added

php-5.6.40.tar.xz/ext/phar/tests/bug77586 Added

php-5.6.40.tar.xz/ext/phar/tests/bug77586.phpt Added

php-5.6.40.tar.xz/ext/phar/tests/bug77586/files Added

php-5.6.40.tar.xz/ext/phar/tests/bug77586/files/link-nktarAMLdJBv7BGYnpzg-ZDycSpWN3Ne3kacltOSE-EqfhStJ1EoBpGuoua6VE-dne29hvpNWXiVbepwIf8-NRHWM9LITLo3nXZnKVNC Added

php-5.6.40.tar.xz/ext/phar/tests/bug79082.phpt Added

@@ -0,0 +1,52 @@
+--TEST--
+Phar: Bug #79082: Files added to tar with Phar::buildFromIterator have all-access permissions
+--SKIPIF--
+<?php 
+if (!extension_loaded("phar")) die("skip"); 
+if (defined("PHP_WINDOWS_VERSION_MAJOR")) die("skip not for Windows")
+?>
+--FILE--
+<?php
+umask(022);
+var_dump(decoct(umask()));
+chmod(__DIR__ . '/test79082/test79082-testfile', 0644);
+chmod(__DIR__ . '/test79082/test79082-testfile2', 0400);
+
+foreach(Phar::TAR => 'tar', Phar::ZIP => 'zip' as $mode => $ext) {
+	clearstatcache();
+	$phar = new PharData(__DIR__ . '/test79082.' . $ext, null, null, $mode);
+	$phar->buildFromIterator(new \RecursiveDirectoryIterator(__DIR__ . '/test79082', \FilesystemIterator::SKIP_DOTS), __DIR__ . '/test79082');
+	$phar->extractTo(__DIR__);
+	var_dump(decoct(stat(__DIR__ . '/test79082-testfile')'mode'));
+	var_dump(decoct(stat(__DIR__ . '/test79082-testfile2')'mode'));
+	unlink(__DIR__ . '/test79082-testfile');
+	unlink(__DIR__ . '/test79082-testfile2');
+}
+foreach(Phar::TAR => 'tar', Phar::ZIP => 'zip' as $mode => $ext) {
+	clearstatcache();
+	$phar = new PharData(__DIR__ . '/test79082-d.' . $ext, null, null, $mode);
+	$phar->buildFromDirectory(__DIR__ . '/test79082');
+	$phar->extractTo(__DIR__);
+	var_dump(decoct(stat(__DIR__ . '/test79082-testfile')'mode'));
+	var_dump(decoct(stat(__DIR__ . '/test79082-testfile2')'mode'));
+	unlink(__DIR__ . '/test79082-testfile');
+	unlink(__DIR__ . '/test79082-testfile2');
+}
+?>
+--CLEAN--
+<?
+unlink(__DIR__ . '/test79082.tar');
+unlink(__DIR__ . '/test79082.zip');
+unlink(__DIR__ . '/test79082-d.tar');
+unlink(__DIR__ . '/test79082-d.zip');
+?>
+--EXPECT--
+string(2) "22"
+string(6) "100644"
+string(6) "100400"
+string(6) "100644"
+string(6) "100400"
+string(6) "100644"
+string(6) "100400"
+string(6) "100644"
+string(6) "100400"

php-5.6.40.tar.xz/ext/phar/tests/bug79797.phar Added

php-5.6.40.tar.xz/ext/phar/tests/bug79797.phpt Added

php-5.6.40.tar.xz/ext/phar/tests/bug81211.phpt Added

@@ -0,0 +1,45 @@
+--TEST--
+Bug #81211 (Symlinks are followed when creating PHAR archive)
+--SKIPIF--
+<?php
+if (!extension_loaded('phar')) die('skip phar extension is not available');
+if (PHP_OS_FAMILY === 'Windows') {
+    if (false === include __DIR__ . '/../../standard/tests/file/windows_links/common.inc') {
+        die('skip windows_links/common.inc is not available');
+    }
+    skipIfSeCreateSymbolicLinkPrivilegeIsDisabled(__FILE__);
+}
+?>
+--FILE--
+<?php
+mkdir(__DIR__ . '/bug81211');
+mkdir(__DIR__ . '/bug81211/foobar');
+mkdir(__DIR__ . '/bug81211/foo');
+
+file_put_contents(__DIR__ . '/bug81211/foobar/file', 'this file should NOT be included in the archive!');
+symlink(__DIR__ . '/bug81211/foobar/file', __DIR__ . '/bug81211/foo/symlink');
+
+$archive = new PharData(__DIR__ . '/bug81211/archive.tar');
+try {
+    $archive->buildFromDirectory(__DIR__ . '/bug81211/foo');
+} catch (UnexpectedValueException $ex) {
+    echo $ex->getMessage(), PHP_EOL;
+}
+try {
+    $archive->buildFromIterator(new RecursiveDirectoryIterator(__DIR__ . '/bug81211/foo', FilesystemIterator::SKIP_DOTS), __DIR__ . '/bug81211/foo');
+} catch (UnexpectedValueException $ex) {
+    echo $ex->getMessage(), PHP_EOL;
+}
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/bug81211/archive.tar');
+@unlink(__DIR__ . '/bug81211/foo/symlink');
+@unlink(__DIR__ . '/bug81211/foobar/file');
+@rmdir(__DIR__ . '/bug81211/foo');
+@rmdir(__DIR__ . '/bug81211/foobar');
+@rmdir(__DIR__ . '/bug81211');
+?>
+--EXPECTF--
+Iterator RecursiveIteratorIterator returned a path "%s%ebug81211%efoobar%efile" that is not in the base directory "%s%ebug81211%efoo"
+Iterator RecursiveDirectoryIterator returned a path "%s%ebug81211%efoobar%efile" that is not in the base directory "%s%ebug81211%efoo"

php-5.6.40.tar.xz/ext/phar/tests/bug81726.gz Added

php-5.6.40.tar.xz/ext/phar/tests/bug81726.phpt Added

php-5.6.40.tar.xz/ext/phar/tests/create_path_error.phpt Changed

@@ -75,10 +75,10 @@
 6:
 7:
 8:
-9:Error: file_put_contents(phar:///%s): failed to open stream: phar error: invalid path "%s" contains illegal character
-10:Error: file_put_contents(phar:///%s): failed to open stream: phar error: invalid path "%s" contains illegal character
-11:Error: file_put_contents(phar:///%s): failed to open stream: phar error: invalid path "%s" contains illegal character
-12:Error: file_put_contents(phar:///%s): failed to open stream: phar error: invalid path "%s" contains illegal character
-13:Error: file_put_contents(phar:///%s): failed to open stream: phar error: invalid path "%s" contains illegal character
+9:Error: file_put_contents(phar://%s): failed to open stream: phar error: invalid path "%s" contains illegal character
+10:Error: file_put_contents(phar://%s): failed to open stream: phar error: invalid path "%s" contains illegal character
+11:Error: file_put_contents(phar://%s): failed to open stream: phar error: invalid path "%s" contains illegal character
+12:Error: file_put_contents(phar://%s): failed to open stream: phar error: invalid path "%s" contains illegal character
+13:Error: file_put_contents(phar://%s): failed to open stream: phar error: invalid path "%s" contains illegal character
 Error: Phar::offsetSet() expects parameter 1 to be a valid path, string given===DONE===

php-5.6.40.tar.xz/ext/phar/tests/phar_bz2.phpt Changed

php-5.6.40.tar.xz/ext/phar/tests/phar_gzip.phpt Changed

php-5.6.40.tar.xz/ext/phar/tests/tar/phar_commitwrite.phpt Changed

php-5.6.40.tar.xz/ext/phar/tests/tar/phar_setsignaturealgo2.phpt Changed

php-5.6.40.tar.xz/ext/phar/tests/tar/rename.phpt Changed

php-5.6.40.tar.xz/ext/phar/tests/tar/rename_dir.phpt Changed

php-5.6.40.tar.xz/ext/phar/tests/tar/rmdir.phpt Changed

php-5.6.40.tar.xz/ext/phar/tests/tar/tar_gzip.phpt Changed

php-5.6.40.tar.xz/ext/phar/tests/test79082 Added

php-5.6.40.tar.xz/ext/phar/tests/test79082/test79082-testfile Added

php-5.6.40.tar.xz/ext/phar/tests/test79082/test79082-testfile2 Added

php-5.6.40.tar.xz/ext/phar/tests/zip/phar_commitwrite.phpt Changed

php-5.6.40.tar.xz/ext/phar/tests/zip/rename.phpt Changed

php-5.6.40.tar.xz/ext/phar/tests/zip/rename_dir.phpt Changed

php-5.6.40.tar.xz/ext/phar/tests/zip/rmdir.phpt Changed

php-5.6.40.tar.xz/ext/phar/zip.c Changed

php-5.6.40.tar.xz/ext/session/session.c Changed

php-5.6.40.tar.xz/ext/session/tests/bug79221.phpt Added

@@ -0,0 +1,45 @@
+--TEST--
+Null Pointer Dereference in PHP Session Upload Progress
+--INI--
+error_reporting=0
+file_uploads=1
+upload_max_filesize=1024
+session.save_path=
+session.name=PHPSESSID
+session.serialize_handler=php
+session.use_strict_mode=0
+session.use_cookies=1
+session.use_only_cookies=0
+session.upload_progress.enabled=1
+session.upload_progress.cleanup=0
+session.upload_progress.prefix=upload_progress_
+session.upload_progress.name=PHP_SESSION_UPLOAD_PROGRESS
+session.upload_progress.freq=1%
+session.upload_progress.min_freq=0.000000001
+--COOKIE--
+PHPSESSID=session-upload
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="PHPSESSID"
+
+session-upload
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="PHP_SESSION_UPLOAD_PROGRESS"
+
+ryat
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; file="file"; ryat="filename"
+
+1
+-----------------------------20896060251896012921717172737--
+--FILE--
+<?php
+
+session_start();
+var_dump($_SESSION);
+session_destroy();
+
+--EXPECTF--
+array(0) {
+}

php-5.6.40.tar.xz/ext/simplexml/simplexml.c Changed

@@ -18,7 +18,7 @@
   +----------------------------------------------------------------------+
 */
 
-/* $Id: d7077fc935154236afb4fe70814ba358efdbdca4 $ */
+/* $Id: 4cf86cac147a2349cd8e3e6fc7e7682a4da989c5 $ */
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
@@ -2182,12 +2182,15 @@
 	long            options = 0;
 	zend_class_entry *ce= sxe_class_entry;
 	zend_bool       isprefix = 0;
+	PHP_LIBXML_SANITIZE_GLOBALS_DECL(read_file);
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|C!lsb", &filename, &filename_len, &ce, &options, &ns, &ns_len, &isprefix) == FAILURE) {
 		return;
 	}
 
+	PHP_LIBXML_SANITIZE_GLOBALS(read_file);
 	docp = xmlReadFile(filename, NULL, options);
+	PHP_LIBXML_RESTORE_GLOBALS(read_file);
 
 	if (! docp) {
 		RETURN_FALSE;
@@ -2220,12 +2223,15 @@
 	long            options = 0;
 	zend_class_entry *ce= sxe_class_entry;
 	zend_bool       isprefix = 0;
+	PHP_LIBXML_SANITIZE_GLOBALS_DECL(read_memory);
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|C!lsb", &data, &data_len, &ce, &options, &ns, &ns_len, &isprefix) == FAILURE) {
 		return;
 	}
 
+	PHP_LIBXML_SANITIZE_GLOBALS(read_memory);
 	docp = xmlReadMemory(data, data_len, NULL, NULL, options);
+	PHP_LIBXML_RESTORE_GLOBALS(read_memory);
 
 	if (! docp) {
 		RETURN_FALSE;
@@ -2256,6 +2262,7 @@
 	long            options = 0;
 	zend_bool       is_url = 0, isprefix = 0;
 	zend_error_handling error_handling;
+	PHP_LIBXML_SANITIZE_GLOBALS_DECL(read_file_or_memory);
 
 	zend_replace_error_handling(EH_THROW, NULL, &error_handling TSRMLS_CC);
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|lbsb", &data, &data_len, &options, &is_url, &ns, &ns_len, &isprefix) == FAILURE) {
@@ -2265,7 +2272,9 @@
 
 	zend_restore_error_handling(&error_handling TSRMLS_CC);
 
+	PHP_LIBXML_SANITIZE_GLOBALS(read_file_or_memory);
 	docp = is_url ? xmlReadFile(data, NULL, options) : xmlReadMemory(data, data_len, NULL, NULL, options);
+	PHP_LIBXML_RESTORE_GLOBALS(read_file_or_memory);
 
 	if (!docp) {
 		((php_libxml_node_object *)sxe)->document = NULL;
@@ -2671,7 +2680,7 @@
 {
 	php_info_print_table_start();
 	php_info_print_table_header(2, "Simplexml support", "enabled");
-	php_info_print_table_row(2, "Revision", "$Id: d7077fc935154236afb4fe70814ba358efdbdca4 $");
+	php_info_print_table_row(2, "Revision", "$Id: 4cf86cac147a2349cd8e3e6fc7e7682a4da989c5 $");
 	php_info_print_table_row(2, "Schema support",
 #ifdef LIBXML_SCHEMAS_ENABLED
 		"enabled");

php-5.6.40.tar.xz/ext/simplexml/tests/008.phpt Changed

php-5.6.40.tar.xz/ext/simplexml/tests/bug79971_1.phpt Added

php-5.6.40.tar.xz/ext/simplexml/tests/bug79971_1.xml Added

php-5.6.40.tar.xz/ext/soap/php_encoding.c Changed

php-5.6.40.tar.xz/ext/soap/php_http.c Changed

php-5.6.40.tar.xz/ext/soap/php_sdl.c Changed

@@ -318,6 +318,8 @@
 	ctx->context = NULL;
 }
 
+#define SAFE_STR(a) ((a)?((const char *)a):"")
+
 static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include TSRMLS_DC)
 {
 	sdlPtr tmpsdl = ctx->sdl;
@@ -379,7 +381,7 @@
 				if (node_is_equal_ex(trav2, "schema", XSD_NAMESPACE)) {
 					load_schema(ctx, trav2 TSRMLS_CC);
 				} else if (is_wsdl_element(trav2) && !node_is_equal(trav2,"documentation")) {
-					soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
+					soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
 				}
 				trav2 = trav2->next;
 			}
@@ -440,7 +442,7 @@
 				soap_error0(E_ERROR, "Parsing WSDL: <service> has no name attribute");
 			}
 		} else if (!node_is_equal(trav,"documentation")) {
-			soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
+			soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav->name));
 		}
 		trav = trav->next;
 	}
@@ -550,7 +552,7 @@
 				}
 				smart_str_free(&key);
 			} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
-				soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
+				soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav->name));
 			}
 			trav = trav->next;
 		}
@@ -655,7 +657,7 @@
 			}
 			smart_str_free(&key);
 		} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
-			soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
+			soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav->name));
 		}
 		trav = trav->next;
 	}
@@ -687,14 +689,14 @@
 		sdlParamPtr param;
 
 		if (trav->ns != NULL && strcmp((char*)trav->ns->href, WSDL_NAMESPACE) != 0) {
-			soap_error1(E_ERROR, "Parsing WSDL: Unexpected extensibility element <%s>", trav->name);
+			soap_error1(E_ERROR, "Parsing WSDL: Unexpected extensibility element <%s>",  SAFE_STR(trav->name));
 		}
 		if (node_is_equal(trav,"documentation")) {
 			trav = trav->next;
 			continue;
 		}
 		if (!node_is_equal(trav,"part")) {
-			soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
+			soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav->name));
 		}
 		part = trav;
 		param = emalloc(sizeof(sdlParam));
@@ -703,7 +705,7 @@
 
 		name = get_attribute(part->properties, "name");
 		if (name == NULL) {
-			soap_error1(E_ERROR, "Parsing WSDL: No name associated with <part> '%s'", message->name);
+			soap_error1(E_ERROR, "Parsing WSDL: No name associated with <part> '%s'",  SAFE_STR(message->name));
 		}
 
 		param->paramName = estrdup((char*)name->children->content);
@@ -773,7 +775,7 @@
 					continue;
 				}
 				if (!node_is_equal(trav,"port")) {
-					soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
+					soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav->name));
 				}
 
 				port = trav;
@@ -812,7 +814,7 @@
 						}
 					}
 					if (trav2 != address && is_wsdl_element(trav2) && !node_is_equal(trav2,"documentation")) {
-						soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
+						soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav2->name));
 					}
 				  trav2 = trav2->next;
 				}
@@ -914,7 +916,7 @@
 						continue;
 					}
 					if (!node_is_equal(trav2,"operation")) {
-						soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
+						soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav2->name));
 					}
 
 					operation = trav2;
@@ -933,7 +935,7 @@
 						           !node_is_equal(trav3,"output") &&
 						           !node_is_equal(trav3,"fault") &&
 						           !node_is_equal(trav3,"documentation")) {
-							soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav3->name);
+							soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav3->name));
 						}
 						trav3 = trav3->next;
 					}
@@ -1111,7 +1113,7 @@
 												}
 											}
 										} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
-											soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
+											soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav->name));
 										}
 										trav = trav->next;
 									}

php-5.6.40.tar.xz/ext/soap/php_xml.c Changed

@@ -94,6 +94,7 @@
 	if (ctxt) {
 		zend_bool old;
 
+		php_libxml_sanitize_parse_ctxt_options(ctxt);
 		ctxt->keepBlanks = 0;
 		ctxt->sax->ignorableWhitespace = soap_ignorableWhitespace;
 		ctxt->sax->comment = soap_Comment;
@@ -145,6 +146,7 @@
 	if (ctxt) {
 		zend_bool old;
 
+		php_libxml_sanitize_parse_ctxt_options(ctxt);
 		ctxt->sax->ignorableWhitespace = soap_ignorableWhitespace;
 		ctxt->sax->comment = soap_Comment;
 		ctxt->sax->warning = NULL;
@@ -205,7 +207,7 @@
 
 int attr_is_equal_ex(xmlAttrPtr node, char *name, char *ns)
 {
-	if (name == NULL || strcmp((char*)node->name, name) == 0) {
+	if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 0)) {
 		if (ns) {
 			xmlNsPtr nsPtr = attr_find_ns(node);
 			if (nsPtr) {
@@ -221,7 +223,7 @@
 
 int node_is_equal_ex(xmlNodePtr node, char *name, char *ns)
 {
-	if (name == NULL || strcmp((char*)node->name, name) == 0) {
+	if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 0)) {
 		if (ns) {
 			xmlNsPtr nsPtr = node_find_ns(node);
 			if (nsPtr) {

php-5.6.40.tar.xz/ext/soap/soap.c Changed

@@ -1837,7 +1837,17 @@
 					php_output_discard(TSRMLS_C);
 					soap_server_fault_ex(function, &h->retval, h TSRMLS_CC);
 					efree(fn_name);
-					if (service->type == SOAP_CLASS && soap_obj) {zval_ptr_dtor(&soap_obj);}
+					if (service->type == SOAP_CLASS && soap_obj) {
+#if HAVE_PHP_SESSION && !defined(COMPILE_DL_SESSION)
+					    if (service->soap_class.persistance != SOAP_PERSISTENCE_SESSION) {
+						zval_ptr_dtor(&soap_obj);
+						soap_obj = NULL;
+					    }
+#else
+					    zval_ptr_dtor(&soap_obj);
+					    soap_obj = NULL;
+#endif
+					}
 					goto fail;
 				} else if (EG(exception)) {
 					php_output_discard(TSRMLS_C);
@@ -1852,7 +1862,17 @@
 						soap_server_fault_ex(function, EG(exception), h TSRMLS_CC);
 					}
 					efree(fn_name);
-					if (service->type == SOAP_CLASS && soap_obj) {zval_ptr_dtor(&soap_obj);}
+					if (service->type == SOAP_CLASS && soap_obj) {
+#if HAVE_PHP_SESSION && !defined(COMPILE_DL_SESSION)
+					    if (service->soap_class.persistance != SOAP_PERSISTENCE_SESSION) {
+						zval_ptr_dtor(&soap_obj);
+						soap_obj = NULL;
+					    }
+#else
+					    zval_ptr_dtor(&soap_obj);
+					    soap_obj = NULL;
+#endif
+					}
 					goto fail;
 				}
 			} else if (h->mustUnderstand) {
@@ -2838,7 +2858,7 @@
 	} zend_catch {
 		_bailout = 1;
 	} zend_end_try();
-	
+
 	if (SOAP_GLOBAL(encoding) != NULL) {
 		xmlCharEncCloseFunc(SOAP_GLOBAL(encoding));
 	}

php-5.6.40.tar.xz/ext/soap/tests/GHSA-hmxp-6pc4-f3vv.phpt Added

@@ -0,0 +1,39 @@
+--TEST--
+GHSA-hmxp-6pc4-f3vv: Null pointer dereference on missing Apache map value
+--CREDITS--
+Ilia Alshanetsky (iliaal)
+--EXTENSIONS--
+soap
+--FILE--
+<?php
+
+$request = <<<XML
+<?xml version="1.0" encoding="UTF-8"?>
+<soap:Envelope
+    xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+    xmlns:apache="http://xml.apache.org/xml-soap">
+
+    <soap:Body>
+        <test>
+            <map xsi:type="apache:Map">
+                <item><key>hello</key></item>
+            </map>
+        </test>
+    </soap:Body>
+</soap:Envelope>
+XML;
+
+$server = new SoapServer(null, 
+    'uri' => 'urn:test',
+    'typemap' => 'type_name' => 'anything',
+);
+$server->addFunction('test');
+function test($m) { return null; }
+$server->handle($request);
+
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>SOAP-ERROR: Encoding: Can't decode apache map, missing value</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>

php-5.6.40.tar.xz/ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt Added

@@ -0,0 +1,62 @@
+--TEST--
+GHSA-m33r-qmcv-p97q: Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION
+--CREDITS--
+Ilia Alshanetsky (iliaal)
+--EXTENSIONS--
+soap
+session
+--FILE--
+<?php
+
+class Handler {
+  function __call($name, $args) {
+    if ($name == "return") {
+        return new SoapFault('Server', 'denied');
+    } else if ($name == "throw") {
+        throw new SoapFault('Server', 'denied');
+    } else if ($name == "hello") {
+        return 'ok';
+    } else {
+      return new SoapFault("Server","Function $name doesn't exist");
+    }
+  }
+}
+
+session_start();
+
+$srv = new SoapServer(null, 'uri' => 'urn:a');
+$srv->setClass(Handler::class);
+$srv->setPersistence(SOAP_PERSISTENCE_SESSION);
+
+$x = <<<XML
+<?xml version="1.0" encoding="UTF-8"?>
+<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:a="urn:a">
+    <soap:Header>
+        <a:return/>
+    </soap:Header>
+    <soap:Body>
+        <a:hello/>
+    </soap:Body>
+</soap:Envelope>
+XML;
+$srv->handle($x);
+
+$x = <<<XML
+<?xml version="1.0" encoding="UTF-8"?>
+<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:a="urn:a">
+    <soap:Header>
+        <a:throw/>
+    </soap:Header>
+    <soap:Body>
+        <a:hello/>
+    </soap:Body>
+</soap:Envelope>
+XML;
+$srv->handle($x);
+
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>denied</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>denied</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>

php-5.6.40.tar.xz/ext/soap/tests/bug80672.phpt Added

php-5.6.40.tar.xz/ext/soap/tests/bug80672.xml Added

php-5.6.40.tar.xz/ext/spl/spl_directory.c Changed

@@ -691,10 +691,10 @@
 
 	if (SPL_HAS_FLAG(ctor_flags, DIT_CTOR_FLAGS)) {
 		flags = SPL_FILE_DIR_KEY_AS_PATHNAME|SPL_FILE_DIR_CURRENT_AS_FILEINFO;
-		parsed = zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &path, &len, &flags);
+		parsed = zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &path, &len, &flags);
 	} else {
 		flags = SPL_FILE_DIR_KEY_AS_PATHNAME|SPL_FILE_DIR_CURRENT_AS_SELF;
-		parsed = zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &path, &len);
+		parsed = zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &path, &len);
 	}
 	if (SPL_HAS_FLAG(ctor_flags, SPL_FILE_DIR_SKIPDOTS)) {
 		flags |= SPL_FILE_DIR_SKIPDOTS;
@@ -1135,7 +1135,7 @@
 
 	zend_replace_error_handling(EH_THROW, spl_ce_RuntimeException, &error_handling TSRMLS_CC);
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &path, &len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &path, &len) == FAILURE) {
 		zend_restore_error_handling(&error_handling TSRMLS_CC);
 		return;
 	}

php-5.6.40.tar.xz/ext/spl/tests/bug54291.phpt Changed

php-5.6.40.tar.xz/ext/spl/tests/bug77431.phpt Added

php-5.6.40.tar.xz/ext/spl/tests/bug78863.phpt Added

php-5.6.40.tar.xz/ext/sqlite3/libsqlite/sqlite3.c Changed

@@ -1,6 +1,6 @@
 /******************************************************************************
 ** This file is an amalgamation of many separate C source files from SQLite
-** version 3.8.10.2.  By combining all the individual C code files into this 
+** version 3.28.0.  By combining all the individual C code files into this
 ** single large file, the entire code can be compiled as a single translation
 ** unit.  This allows many compilers to do optimizations that would not be
 ** possible if the files were compiled separately.  Performance improvements
@@ -9,7 +9,7 @@
 **
 ** This file is all you need to compile SQLite.  To use SQLite in other
 ** programs, you need this file and the "sqlite3.h" header file that defines
-** the programming interface to the SQLite library.  (If you do not have 
+** the programming interface to the SQLite library.  (If you do not have
 ** the "sqlite3.h" header file at hand, you will find a copy embedded within
 ** the text of this file.  Search for "Begin file sqlite3.h" to find the start
 ** of the embedded sqlite3.h header file.) Additional code files may be needed
@@ -22,6 +22,776 @@
 #ifndef SQLITE_PRIVATE
 # define SQLITE_PRIVATE static
 #endif
+/************** Begin file ctime.c *******************************************/
+/*
+** 2010 February 23
+**
+** The author disclaims copyright to this source code.  In place of
+** a legal notice, here is a blessing:
+**
+**    May you do good and not evil.
+**    May you find forgiveness for yourself and forgive others.
+**    May you share freely, never taking more than you give.
+**
+*************************************************************************
+**
+** This file implements routines used to report what compile-time options
+** SQLite was built with.
+*/
+
+#ifndef SQLITE_OMIT_COMPILEOPTION_DIAGS
+
+/*
+** Include the configuration header output by 'configure' if we're using the
+** autoconf-based build
+*/
+#if defined(_HAVE_SQLITE_CONFIG_H) && !defined(SQLITECONFIG_H)
+#include "config.h"
+#define SQLITECONFIG_H 1
+#endif
+
+/* These macros are provided to "stringify" the value of the define
+** for those options in which the value is meaningful. */
+#define CTIMEOPT_VAL_(opt) #opt
+#define CTIMEOPT_VAL(opt) CTIMEOPT_VAL_(opt)
+
+/* Like CTIMEOPT_VAL, but especially for SQLITE_DEFAULT_LOOKASIDE. This
+** option requires a separate macro because legal values contain a single
+** comma. e.g. (-DSQLITE_DEFAULT_LOOKASIDE="100,100") */
+#define CTIMEOPT_VAL2_(opt1,opt2) #opt1 "," #opt2
+#define CTIMEOPT_VAL2(opt) CTIMEOPT_VAL2_(opt)
+
+/*
+** An array of names of all compile-time options.  This array should 
+** be sorted A-Z.
+**
+** This array looks large, but in a typical installation actually uses
+** only a handful of compile-time options, so most times this array is usually
+** rather short and uses little memory space.
+*/
+static const char * const sqlite3azCompileOpt = {
+
+/* 
+** BEGIN CODE GENERATED BY tool/mkctime.tcl 
+*/
+#if SQLITE_32BIT_ROWID
+  "32BIT_ROWID",
+#endif
+#if SQLITE_4_BYTE_ALIGNED_MALLOC
+  "4_BYTE_ALIGNED_MALLOC",
+#endif
+#if SQLITE_64BIT_STATS
+  "64BIT_STATS",
+#endif
+#if SQLITE_ALLOW_COVERING_INDEX_SCAN
+  "ALLOW_COVERING_INDEX_SCAN",
+#endif
+#if SQLITE_ALLOW_URI_AUTHORITY
+  "ALLOW_URI_AUTHORITY",
+#endif
+#ifdef SQLITE_BITMASK_TYPE
+  "BITMASK_TYPE=" CTIMEOPT_VAL(SQLITE_BITMASK_TYPE),
+#endif
+#if SQLITE_BUG_COMPATIBLE_20160819
+  "BUG_COMPATIBLE_20160819",
+#endif
+#if SQLITE_CASE_SENSITIVE_LIKE
+  "CASE_SENSITIVE_LIKE",
+#endif
+#if SQLITE_CHECK_PAGES
+  "CHECK_PAGES",
+#endif
+#if defined(__clang__) && defined(__clang_major__)
+  "COMPILER=clang-" CTIMEOPT_VAL(__clang_major__) "."
+                    CTIMEOPT_VAL(__clang_minor__) "."
+                    CTIMEOPT_VAL(__clang_patchlevel__),
+#elif defined(_MSC_VER)
+  "COMPILER=msvc-" CTIMEOPT_VAL(_MSC_VER),
+#elif defined(__GNUC__) && defined(__VERSION__)
+  "COMPILER=gcc-" __VERSION__,
+#endif
+#if SQLITE_COVERAGE_TEST
+  "COVERAGE_TEST",
+#endif
+#if SQLITE_DEBUG
+  "DEBUG",
+#endif
+#if SQLITE_DEFAULT_AUTOMATIC_INDEX
+  "DEFAULT_AUTOMATIC_INDEX",
+#endif
+#if SQLITE_DEFAULT_AUTOVACUUM
+  "DEFAULT_AUTOVACUUM",
+#endif
+#ifdef SQLITE_DEFAULT_CACHE_SIZE
+  "DEFAULT_CACHE_SIZE=" CTIMEOPT_VAL(SQLITE_DEFAULT_CACHE_SIZE),
+#endif
+#if SQLITE_DEFAULT_CKPTFULLFSYNC
+  "DEFAULT_CKPTFULLFSYNC",
+#endif
+#ifdef SQLITE_DEFAULT_FILE_FORMAT
+  "DEFAULT_FILE_FORMAT=" CTIMEOPT_VAL(SQLITE_DEFAULT_FILE_FORMAT),
+#endif
+#ifdef SQLITE_DEFAULT_FILE_PERMISSIONS
+  "DEFAULT_FILE_PERMISSIONS=" CTIMEOPT_VAL(SQLITE_DEFAULT_FILE_PERMISSIONS),
+#endif
+#if SQLITE_DEFAULT_FOREIGN_KEYS
+  "DEFAULT_FOREIGN_KEYS",
+#endif
+#ifdef SQLITE_DEFAULT_JOURNAL_SIZE_LIMIT
+  "DEFAULT_JOURNAL_SIZE_LIMIT=" CTIMEOPT_VAL(SQLITE_DEFAULT_JOURNAL_SIZE_LIMIT),
+#endif
+#ifdef SQLITE_DEFAULT_LOCKING_MODE
+  "DEFAULT_LOCKING_MODE=" CTIMEOPT_VAL(SQLITE_DEFAULT_LOCKING_MODE),
+#endif
+#ifdef SQLITE_DEFAULT_LOOKASIDE
+  "DEFAULT_LOOKASIDE=" CTIMEOPT_VAL2(SQLITE_DEFAULT_LOOKASIDE),
+#endif
+#if SQLITE_DEFAULT_MEMSTATUS
+  "DEFAULT_MEMSTATUS",
+#endif
+#ifdef SQLITE_DEFAULT_MMAP_SIZE
+  "DEFAULT_MMAP_SIZE=" CTIMEOPT_VAL(SQLITE_DEFAULT_MMAP_SIZE),
+#endif
+#ifdef SQLITE_DEFAULT_PAGE_SIZE
+  "DEFAULT_PAGE_SIZE=" CTIMEOPT_VAL(SQLITE_DEFAULT_PAGE_SIZE),
+#endif
+#ifdef SQLITE_DEFAULT_PCACHE_INITSZ
+  "DEFAULT_PCACHE_INITSZ=" CTIMEOPT_VAL(SQLITE_DEFAULT_PCACHE_INITSZ),
+#endif
+#ifdef SQLITE_DEFAULT_PROXYDIR_PERMISSIONS
+  "DEFAULT_PROXYDIR_PERMISSIONS=" CTIMEOPT_VAL(SQLITE_DEFAULT_PROXYDIR_PERMISSIONS),
+#endif
+#if SQLITE_DEFAULT_RECURSIVE_TRIGGERS
+  "DEFAULT_RECURSIVE_TRIGGERS",
+#endif
+#ifdef SQLITE_DEFAULT_ROWEST
+  "DEFAULT_ROWEST=" CTIMEOPT_VAL(SQLITE_DEFAULT_ROWEST),
+#endif
+#ifdef SQLITE_DEFAULT_SECTOR_SIZE
+  "DEFAULT_SECTOR_SIZE=" CTIMEOPT_VAL(SQLITE_DEFAULT_SECTOR_SIZE),
+#endif
+#ifdef SQLITE_DEFAULT_SYNCHRONOUS
+  "DEFAULT_SYNCHRONOUS=" CTIMEOPT_VAL(SQLITE_DEFAULT_SYNCHRONOUS),
+#endif
+#ifdef SQLITE_DEFAULT_WAL_AUTOCHECKPOINT
+  "DEFAULT_WAL_AUTOCHECKPOINT=" CTIMEOPT_VAL(SQLITE_DEFAULT_WAL_AUTOCHECKPOINT),
+#endif
+#ifdef SQLITE_DEFAULT_WAL_SYNCHRONOUS
+  "DEFAULT_WAL_SYNCHRONOUS=" CTIMEOPT_VAL(SQLITE_DEFAULT_WAL_SYNCHRONOUS),
+#endif
+#ifdef SQLITE_DEFAULT_WORKER_THREADS
+  "DEFAULT_WORKER_THREADS=" CTIMEOPT_VAL(SQLITE_DEFAULT_WORKER_THREADS),
+#endif
+#if SQLITE_DIRECT_OVERFLOW_READ
+  "DIRECT_OVERFLOW_READ",
+#endif
+#if SQLITE_DISABLE_DIRSYNC
+  "DISABLE_DIRSYNC",
+#endif
+#if SQLITE_DISABLE_FTS3_UNICODE
+  "DISABLE_FTS3_UNICODE",
+#endif
+#if SQLITE_DISABLE_FTS4_DEFERRED
+  "DISABLE_FTS4_DEFERRED",
+#endif
+#if SQLITE_DISABLE_INTRINSIC
+  "DISABLE_INTRINSIC",
+#endif
+#if SQLITE_DISABLE_LFS
+  "DISABLE_LFS",
+#endif
+#if SQLITE_DISABLE_PAGECACHE_OVERFLOW_STATS

php-5.6.40.tar.xz/ext/sqlite3/libsqlite/sqlite3.h Changed

@@ -1,5 +1,5 @@
 /*
-** 2001 September 15
+** 2001-09-15
 **
 ** The author disclaims copyright to this source code.  In place of
 ** a legal notice, here is a blessing:
@@ -23,15 +23,15 @@
 **
 ** The official C-language API documentation for SQLite is derived
 ** from comments in this file.  This file is the authoritative source
-** on how SQLite interfaces are suppose to operate.
+** on how SQLite interfaces are supposed to operate.
 **
 ** The name of this file under configuration management is "sqlite.h.in".
 ** The makefile makes some minor changes to this file (such as inserting
 ** the version number) and changes its name to "sqlite3.h" as
 ** part of the build process.
 */
-#ifndef _SQLITE3_H_
-#define _SQLITE3_H_
+#ifndef SQLITE3_H
+#define SQLITE3_H
 #include <stdarg.h>     /* Needed for the definition of va_list */
 
 /*
@@ -54,8 +54,17 @@
 #ifndef SQLITE_CDECL
 # define SQLITE_CDECL
 #endif
+#ifndef SQLITE_APICALL
+# define SQLITE_APICALL
+#endif
 #ifndef SQLITE_STDCALL
-# define SQLITE_STDCALL
+# define SQLITE_STDCALL SQLITE_APICALL
+#endif
+#ifndef SQLITE_CALLBACK
+# define SQLITE_CALLBACK
+#endif
+#ifndef SQLITE_SYSAPI
+# define SQLITE_SYSAPI
 #endif
 
 /*
@@ -99,37 +108,40 @@
 ** be held constant and Z will be incremented or else Y will be incremented
 ** and Z will be reset to zero.
 **
-** Since version 3.6.18, SQLite source code has been stored in the
+** Since version 3.6.18 (dateof:3.6.18), 
+** SQLite source code has been stored in the
 ** <a href="http://www.fossil-scm.org/">Fossil configuration management
 ** system</a>.  ^The SQLITE_SOURCE_ID macro evaluates to
 ** a string which identifies a particular check-in of SQLite
 ** within its configuration management system.  ^The SQLITE_SOURCE_ID
-** string contains the date and time of the check-in (UTC) and an SHA1
-** hash of the entire source tree.
+** string contains the date and time of the check-in (UTC) and a SHA1
+** or SHA3-256 hash of the entire source tree.  If the source code has
+** been edited in any way since it was last checked in, then the last
+** four hexadecimal digits of the hash may be modified.
 **
 ** See also: sqlite3_libversion(),
 ** sqlite3_libversion_number(), sqlite3_sourceid(),
 ** sqlite_version() and sqlite_source_id().
 */
-#define SQLITE_VERSION        "3.8.10.2"
-#define SQLITE_VERSION_NUMBER 3008010
-#define SQLITE_SOURCE_ID      "2015-05-20 18:17:19 2ef4f3a5b1d1d0c4338f8243d40a2452cc1f7fe4"
+#define SQLITE_VERSION        "3.28.0"
+#define SQLITE_VERSION_NUMBER 3028000
+#define SQLITE_SOURCE_ID      "2019-04-16 19:49:53 884b4b7e502b4e991677b53971277adfaf0a04a284f8e483e2553d0f83156b50"
 
 /*
 ** CAPI3REF: Run-Time Library Version Numbers
-** KEYWORDS: sqlite3_version, sqlite3_sourceid
+** KEYWORDS: sqlite3_version sqlite3_sourceid
 **
 ** These interfaces provide the same information as the SQLITE_VERSION,
 ** SQLITE_VERSION_NUMBER, and SQLITE_SOURCE_ID C preprocessor macros
 ** but are associated with the library instead of the header file.  ^(Cautious
 ** programmers might include assert() statements in their application to
 ** verify that values returned by these interfaces match the macros in
-** the header, and thus insure that the application is
+** the header, and thus ensure that the application is
 ** compiled with matching library and header files.
 **
 ** <blockquote><pre>
 ** assert( sqlite3_libversion_number()==SQLITE_VERSION_NUMBER );
-** assert( strcmp(sqlite3_sourceid(),SQLITE_SOURCE_ID)==0 );
+** assert( strncmp(sqlite3_sourceid(),SQLITE_SOURCE_ID,80)==0 );
 ** assert( strcmp(sqlite3_libversion(),SQLITE_VERSION)==0 );
 ** </pre></blockquote>)^
 **
@@ -139,16 +151,18 @@
 ** function is provided for use in DLLs since DLL users usually do not have
 ** direct access to string constants within the DLL.  ^The
 ** sqlite3_libversion_number() function returns an integer equal to
-** SQLITE_VERSION_NUMBER.  ^The sqlite3_sourceid() function returns 
+** SQLITE_VERSION_NUMBER.  ^(The sqlite3_sourceid() function returns 
 ** a pointer to a string constant whose value is the same as the 
-** SQLITE_SOURCE_ID C preprocessor macro.
+** SQLITE_SOURCE_ID C preprocessor macro.  Except if SQLite is built
+** using an edited copy of the amalgamation, then the last four characters
+** of the hash might be different from SQLITE_SOURCE_ID.)^
 **
 ** See also: sqlite_version() and sqlite_source_id().
 */
 SQLITE_API SQLITE_EXTERN const char sqlite3_version;
-SQLITE_API const char *SQLITE_STDCALL sqlite3_libversion(void);
-SQLITE_API const char *SQLITE_STDCALL sqlite3_sourceid(void);
-SQLITE_API int SQLITE_STDCALL sqlite3_libversion_number(void);
+SQLITE_API const char *sqlite3_libversion(void);
+SQLITE_API const char *sqlite3_sourceid(void);
+SQLITE_API int sqlite3_libversion_number(void);
 
 /*
 ** CAPI3REF: Run-Time Library Compilation Options Diagnostics
@@ -173,8 +187,11 @@
 ** sqlite_compileoption_get() and the compile_options pragma.
 */
 #ifndef SQLITE_OMIT_COMPILEOPTION_DIAGS
-SQLITE_API int SQLITE_STDCALL sqlite3_compileoption_used(const char *zOptName);
-SQLITE_API const char *SQLITE_STDCALL sqlite3_compileoption_get(int N);
+SQLITE_API int sqlite3_compileoption_used(const char *zOptName);
+SQLITE_API const char *sqlite3_compileoption_get(int N);
+#else
+# define sqlite3_compileoption_used(X) 0
+# define sqlite3_compileoption_get(X)  ((void*)0)
 #endif
 
 /*
@@ -213,7 +230,7 @@
 **
 ** See the threading mode documentation for additional information.
 */
-SQLITE_API int SQLITE_STDCALL sqlite3_threadsafe(void);
+SQLITE_API int sqlite3_threadsafe(void);
 
 /*
 ** CAPI3REF: Database Connection Handle
@@ -249,7 +266,11 @@
 */
 #ifdef SQLITE_INT64_TYPE
   typedef SQLITE_INT64_TYPE sqlite_int64;
-  typedef unsigned SQLITE_INT64_TYPE sqlite_uint64;
+# ifdef SQLITE_UINT64_TYPE
+    typedef SQLITE_UINT64_TYPE sqlite_uint64;
+# else  
+    typedef unsigned SQLITE_INT64_TYPE sqlite_uint64;
+# endif
 #elif defined(_MSC_VER) || defined(__BORLANDC__)
   typedef __int64 sqlite_int64;
   typedef unsigned __int64 sqlite_uint64;
@@ -310,8 +331,8 @@
 ** ^Calling sqlite3_close() or sqlite3_close_v2() with a NULL pointer
 ** argument is a harmless no-op.
 */
-SQLITE_API int SQLITE_STDCALL sqlite3_close(sqlite3*);
-SQLITE_API int SQLITE_STDCALL sqlite3_close_v2(sqlite3*);
+SQLITE_API int sqlite3_close(sqlite3*);
+SQLITE_API int sqlite3_close_v2(sqlite3*);
 
 /*
 ** The type for a callback function.
@@ -347,7 +368,7 @@
 ** from sqlite3_malloc() and passed back through the 5th parameter.
 ** To avoid memory leaks, the application should invoke sqlite3_free()
 ** on error message strings returned through the 5th parameter of
-** of sqlite3_exec() after the error message string is no longer needed.
+** sqlite3_exec() after the error message string is no longer needed.
 ** ^If the 5th parameter to sqlite3_exec() is not NULL and no errors
 ** occur, then sqlite3_exec() sets the pointer in its 5th parameter to
 ** NULL before returning.
@@ -374,7 +395,7 @@
 ** Restrictions:
 **
 ** <ul>
-** <li> The application must insure that the 1st parameter to sqlite3_exec()
+** <li> The application must ensure that the 1st parameter to sqlite3_exec()
 **      is a valid and open database connection.
 ** <li> The application must not close the database connection specified by
 **      the 1st parameter to sqlite3_exec() while sqlite3_exec() is running.
@@ -382,7 +403,7 @@
 **      the 2nd parameter of sqlite3_exec() while sqlite3_exec() is running.
 ** </ul>
 */
-SQLITE_API int SQLITE_STDCALL sqlite3_exec(
+SQLITE_API int sqlite3_exec(
   sqlite3*,                                  /* An open database */
   const char *sql,                           /* SQL to be evaluated */
   int (*callback)(void*,int,char**,char**),  /* Callback function */
@@ -403,7 +424,7 @@
 */
 #define SQLITE_OK           0   /* Successful result */
 /* beginning-of-error-codes */
-#define SQLITE_ERROR        1   /* SQL error or missing database */
+#define SQLITE_ERROR        1   /* Generic error */
 #define SQLITE_INTERNAL     2   /* Internal logic error in SQLite */

php-5.6.40.tar.xz/ext/sqlite3/libsqlite/sqlite3ext.h Changed

@@ -15,12 +15,10 @@
 ** as extensions by SQLite should #include this file instead of 
 ** sqlite3.h.
 */
-#ifndef _SQLITE3EXT_H_
-#define _SQLITE3EXT_H_
+#ifndef SQLITE3EXT_H
+#define SQLITE3EXT_H
 #include "sqlite3.h"
 
-typedef struct sqlite3_api_routines sqlite3_api_routines;
-
 /*
 ** The following structure holds pointers to all of the SQLite API
 ** routines.
@@ -136,7 +134,7 @@
   int  (*set_authorizer)(sqlite3*,int(*)(void*,int,const char*,const char*,
                          const char*,const char*),void*);
   void  (*set_auxdata)(sqlite3_context*,int,void*,void (*)(void*));
-  char * (*snprintf)(int,char*,const char*,...);
+  char * (*xsnprintf)(int,char*,const char*,...);
   int  (*step)(sqlite3_stmt*);
   int  (*table_column_metadata)(sqlite3*,const char*,const char*,const char*,
                                 char const**,char const**,int*,int*,int*);
@@ -248,7 +246,7 @@
   int (*uri_boolean)(const char*,const char*,int);
   sqlite3_int64 (*uri_int64)(const char*,const char*,sqlite3_int64);
   const char *(*uri_parameter)(const char*,const char*);
-  char *(*vsnprintf)(int,char*,const char*,va_list);
+  char *(*xvsnprintf)(int,char*,const char*,va_list);
   int (*wal_checkpoint_v2)(sqlite3*,const char*,int,int*,int*);
   /* Version 3.8.7 and later */
   int (*auto_extension)(void(*)(void));
@@ -267,9 +265,76 @@
   void (*result_text64)(sqlite3_context*,const char*,sqlite3_uint64,
                          void(*)(void*), unsigned char);
   int (*strglob)(const char*,const char*);
+  /* Version 3.8.11 and later */
+  sqlite3_value *(*value_dup)(const sqlite3_value*);
+  void (*value_free)(sqlite3_value*);
+  int (*result_zeroblob64)(sqlite3_context*,sqlite3_uint64);
+  int (*bind_zeroblob64)(sqlite3_stmt*, int, sqlite3_uint64);
+  /* Version 3.9.0 and later */
+  unsigned int (*value_subtype)(sqlite3_value*);
+  void (*result_subtype)(sqlite3_context*,unsigned int);
+  /* Version 3.10.0 and later */
+  int (*status64)(int,sqlite3_int64*,sqlite3_int64*,int);
+  int (*strlike)(const char*,const char*,unsigned int);
+  int (*db_cacheflush)(sqlite3*);
+  /* Version 3.12.0 and later */
+  int (*system_errno)(sqlite3*);
+  /* Version 3.14.0 and later */
+  int (*trace_v2)(sqlite3*,unsigned,int(*)(unsigned,void*,void*,void*),void*);
+  char *(*expanded_sql)(sqlite3_stmt*);
+  /* Version 3.18.0 and later */
+  void (*set_last_insert_rowid)(sqlite3*,sqlite3_int64);
+  /* Version 3.20.0 and later */
+  int (*prepare_v3)(sqlite3*,const char*,int,unsigned int,
+                    sqlite3_stmt**,const char**);
+  int (*prepare16_v3)(sqlite3*,const void*,int,unsigned int,
+                      sqlite3_stmt**,const void**);
+  int (*bind_pointer)(sqlite3_stmt*,int,void*,const char*,void(*)(void*));
+  void (*result_pointer)(sqlite3_context*,void*,const char*,void(*)(void*));
+  void *(*value_pointer)(sqlite3_value*,const char*);
+  int (*vtab_nochange)(sqlite3_context*);
+  int (*value_nochange)(sqlite3_value*);
+  const char *(*vtab_collation)(sqlite3_index_info*,int);
+  /* Version 3.24.0 and later */
+  int (*keyword_count)(void);
+  int (*keyword_name)(int,const char**,int*);
+  int (*keyword_check)(const char*,int);
+  sqlite3_str *(*str_new)(sqlite3*);
+  char *(*str_finish)(sqlite3_str*);
+  void (*str_appendf)(sqlite3_str*, const char *zFormat, ...);
+  void (*str_vappendf)(sqlite3_str*, const char *zFormat, va_list);
+  void (*str_append)(sqlite3_str*, const char *zIn, int N);
+  void (*str_appendall)(sqlite3_str*, const char *zIn);
+  void (*str_appendchar)(sqlite3_str*, int N, char C);
+  void (*str_reset)(sqlite3_str*);
+  int (*str_errcode)(sqlite3_str*);
+  int (*str_length)(sqlite3_str*);
+  char *(*str_value)(sqlite3_str*);
+  /* Version 3.25.0 and later */
+  int (*create_window_function)(sqlite3*,const char*,int,int,void*,
+                            void (*xStep)(sqlite3_context*,int,sqlite3_value**),
+                            void (*xFinal)(sqlite3_context*),
+                            void (*xValue)(sqlite3_context*),
+                            void (*xInv)(sqlite3_context*,int,sqlite3_value**),
+                            void(*xDestroy)(void*));
+  /* Version 3.26.0 and later */
+  const char *(*normalized_sql)(sqlite3_stmt*);
+  /* Version 3.28.0 and later */
+  int (*stmt_isexplain)(sqlite3_stmt*);
+  int (*value_frombind)(sqlite3_value*);
 };
 
 /*
+** This is the function signature used for all extension entry points.  It
+** is also defined in the file "loadext.c".
+*/
+typedef int (*sqlite3_loadext_entry)(
+  sqlite3 *db,                       /* Handle to the database. */
+  char **pzErrMsg,                   /* Used to set error string on failure. */
+  const sqlite3_api_routines *pThunk /* Extension API function pointers. */
+);
+
+/*
 ** The following macros redefine the API routines so that they are
 ** redirected through the global sqlite3_api structure.
 **
@@ -280,7 +345,7 @@
 ** the API.  So the redefinition macros are only valid if the
 ** SQLITE_CORE macros is undefined.
 */
-#ifndef SQLITE_CORE
+#if !defined(SQLITE_CORE) && !defined(SQLITE_OMIT_LOAD_EXTENSION)
 #define sqlite3_aggregate_context      sqlite3_api->aggregate_context
 #ifndef SQLITE_OMIT_DEPRECATED
 #define sqlite3_aggregate_count        sqlite3_api->aggregate_count
@@ -383,7 +448,7 @@
 #define sqlite3_rollback_hook          sqlite3_api->rollback_hook
 #define sqlite3_set_authorizer         sqlite3_api->set_authorizer
 #define sqlite3_set_auxdata            sqlite3_api->set_auxdata
-#define sqlite3_snprintf               sqlite3_api->snprintf
+#define sqlite3_snprintf               sqlite3_api->xsnprintf
 #define sqlite3_step                   sqlite3_api->step
 #define sqlite3_table_column_metadata  sqlite3_api->table_column_metadata
 #define sqlite3_thread_cleanup         sqlite3_api->thread_cleanup
@@ -407,6 +472,7 @@
 #define sqlite3_value_text16le         sqlite3_api->value_text16le
 #define sqlite3_value_type             sqlite3_api->value_type
 #define sqlite3_vmprintf               sqlite3_api->vmprintf
+#define sqlite3_vsnprintf              sqlite3_api->xvsnprintf
 #define sqlite3_overload_function      sqlite3_api->overload_function
 #define sqlite3_prepare_v2             sqlite3_api->prepare_v2
 #define sqlite3_prepare16_v2           sqlite3_api->prepare16_v2
@@ -482,7 +548,7 @@
 #define sqlite3_uri_boolean            sqlite3_api->uri_boolean
 #define sqlite3_uri_int64              sqlite3_api->uri_int64
 #define sqlite3_uri_parameter          sqlite3_api->uri_parameter
-#define sqlite3_uri_vsnprintf          sqlite3_api->vsnprintf
+#define sqlite3_uri_vsnprintf          sqlite3_api->xvsnprintf
 #define sqlite3_wal_checkpoint_v2      sqlite3_api->wal_checkpoint_v2
 /* Version 3.8.7 and later */
 #define sqlite3_auto_extension         sqlite3_api->auto_extension
@@ -497,9 +563,60 @@
 #define sqlite3_result_blob64          sqlite3_api->result_blob64
 #define sqlite3_result_text64          sqlite3_api->result_text64
 #define sqlite3_strglob                sqlite3_api->strglob
-#endif /* SQLITE_CORE */
+/* Version 3.8.11 and later */
+#define sqlite3_value_dup              sqlite3_api->value_dup
+#define sqlite3_value_free             sqlite3_api->value_free
+#define sqlite3_result_zeroblob64      sqlite3_api->result_zeroblob64
+#define sqlite3_bind_zeroblob64        sqlite3_api->bind_zeroblob64
+/* Version 3.9.0 and later */
+#define sqlite3_value_subtype          sqlite3_api->value_subtype
+#define sqlite3_result_subtype         sqlite3_api->result_subtype
+/* Version 3.10.0 and later */
+#define sqlite3_status64               sqlite3_api->status64
+#define sqlite3_strlike                sqlite3_api->strlike
+#define sqlite3_db_cacheflush          sqlite3_api->db_cacheflush
+/* Version 3.12.0 and later */
+#define sqlite3_system_errno           sqlite3_api->system_errno
+/* Version 3.14.0 and later */
+#define sqlite3_trace_v2               sqlite3_api->trace_v2
+#define sqlite3_expanded_sql           sqlite3_api->expanded_sql
+/* Version 3.18.0 and later */
+#define sqlite3_set_last_insert_rowid  sqlite3_api->set_last_insert_rowid
+/* Version 3.20.0 and later */
+#define sqlite3_prepare_v3             sqlite3_api->prepare_v3
+#define sqlite3_prepare16_v3           sqlite3_api->prepare16_v3
+#define sqlite3_bind_pointer           sqlite3_api->bind_pointer
+#define sqlite3_result_pointer         sqlite3_api->result_pointer
+#define sqlite3_value_pointer          sqlite3_api->value_pointer
+/* Version 3.22.0 and later */
+#define sqlite3_vtab_nochange          sqlite3_api->vtab_nochange
+#define sqlite3_value_nochange         sqlite3_api->value_nochange
+#define sqlite3_vtab_collation         sqlite3_api->vtab_collation
+/* Version 3.24.0 and later */
+#define sqlite3_keyword_count          sqlite3_api->keyword_count
+#define sqlite3_keyword_name           sqlite3_api->keyword_name
+#define sqlite3_keyword_check          sqlite3_api->keyword_check
+#define sqlite3_str_new                sqlite3_api->str_new
+#define sqlite3_str_finish             sqlite3_api->str_finish
+#define sqlite3_str_appendf            sqlite3_api->str_appendf
+#define sqlite3_str_vappendf           sqlite3_api->str_vappendf
+#define sqlite3_str_append             sqlite3_api->str_append
+#define sqlite3_str_appendall          sqlite3_api->str_appendall
+#define sqlite3_str_appendchar         sqlite3_api->str_appendchar
+#define sqlite3_str_reset              sqlite3_api->str_reset
+#define sqlite3_str_errcode            sqlite3_api->str_errcode
+#define sqlite3_str_length             sqlite3_api->str_length
+#define sqlite3_str_value              sqlite3_api->str_value
+/* Version 3.25.0 and later */
+#define sqlite3_create_window_function sqlite3_api->create_window_function
+/* Version 3.26.0 and later */
+#define sqlite3_normalized_sql         sqlite3_api->normalized_sql
+/* Version 3.28.0 and later */
+#define sqlite3_stmt_isexplain         sqlite3_api->isexplain

php-5.6.40.tar.xz/ext/sqlite3/php_sqlite3.h Changed

php-5.6.40.tar.xz/ext/sqlite3/sqlite3.c Changed

@@ -82,6 +82,9 @@
 */
 PHP_INI_BEGIN()
 	STD_PHP_INI_ENTRY("sqlite3.extension_dir",  NULL, PHP_INI_SYSTEM, OnUpdateString, extension_dir, zend_sqlite3_globals, sqlite3_globals)
+#if SQLITE_VERSION_NUMBER >= 3026000
+	STD_PHP_INI_ENTRY("sqlite3.defensive",  "1", PHP_INI_SYSTEM, OnUpdateBool, dbconfig_defensive, zend_sqlite3_globals, sqlite3_globals)
+#endif
 PHP_INI_END()
 /* }}} */
 
@@ -177,6 +180,12 @@
 		sqlite3_set_authorizer(db_obj->db, php_sqlite3_authorizer, NULL);
 	}
 
+#if SQLITE_VERSION_NUMBER >= 3026000
+	if (SQLITE3G(dbconfig_defensive)) {
+		sqlite3_db_config(db_obj->db, SQLITE_DBCONFIG_DEFENSIVE, 1, NULL);
+	}
+#endif
+
 	if (fullpath != filename) {
 		efree(fullpath);
 	}
@@ -2053,6 +2062,15 @@
 				}
 #endif
 
+				if (strncmp(arg3, "file:", 5) == 0) {
+					/* starts with "file:" */
+					if (!arg35) {
+						return SQLITE_DENY;
+					}
+					if (php_check_open_basedir(arg3 + 5 TSRMLS_CC)) {
+						return SQLITE_DENY;
+					}
+				}
 				if (php_check_open_basedir(arg3 TSRMLS_CC)) {
 					return SQLITE_DENY;
 				}

php-5.6.40.tar.xz/ext/sqlite3/tests/sqlite3_defensive.phpt Added

@@ -0,0 +1,40 @@
+--TEST--
+SQLite3 defensive mode ini setting
+--SKIPIF--
+<?php require_once(__DIR__ . '/skipif.inc');
+
+if (SQLite3::version()'versionNumber' < 3026000) {
+	die("skip: sqlite3 library version < 3.26: no support for defensive mode");
+}
+
+?>
+--INI--
+sqlite3.defensive=On
+--FILE--
+<?php
+
+$db = new SQLite3(':memory:');
+var_dump($db->exec('CREATE TABLE test (a, b);'));
+
+// This does not generate an error!
+var_dump($db->exec('PRAGMA writable_schema = ON;'));
+var_dump($db->querySingle('PRAGMA writable_schema;'));
+
+// Should be 1
+var_dump($db->querySingle('SELECT COUNT(*) FROM sqlite_master;'));
+
+// Should generate an error!
+var_dump($db->querySingle('DELETE FROM sqlite_master;'));
+
+// Should still be 1
+var_dump($db->querySingle('SELECT COUNT(*) FROM sqlite_master;'));
+?>
+--EXPECTF--
+bool(true)
+bool(true)
+int(1)
+int(1)
+
+Warning: SQLite3::querySingle(): Unable to prepare statement: 1, table sqlite_master may not be modified in %s on line %d
+bool(false)
+int(1)
\ No newline at end of file

php-5.6.40.tar.xz/ext/standard/crypt.c Changed

php-5.6.40.tar.xz/ext/standard/crypt_blowfish.c Changed

php-5.6.40.tar.xz/ext/standard/exec.c Changed

php-5.6.40.tar.xz/ext/standard/filters.c Changed

@@ -800,7 +800,7 @@
 	lb_ptr = inst->lb_ptr;
 	lb_cnt = inst->lb_cnt;
 
-	if ((in_pp == NULL || in_left_p == NULL) && (lb_ptr >=lb_cnt)) {
+	if (in_pp == NULL || in_left_p == NULL) {
 		return PHP_CONV_ERR_SUCCESS;
 	}
 
@@ -1027,7 +1027,7 @@
 	lb_ptr = inst->lb_ptr;
 	lb_cnt = inst->lb_cnt;
 
-	if ((in_pp == NULL || in_left_p == NULL) && lb_cnt == lb_ptr) {
+	if (in_pp == NULL || in_left_p == NULL) {
 		if (inst->scan_stat != 0) {
 			return PHP_CONV_ERR_UNEXPECTED_EOS;
 		}
@@ -1124,8 +1124,7 @@
 					*ps == (unsigned char)inst->lbcharslb_cnt) {
 					lb_cnt++;
 					scan_stat = 5;
-				}
-				if (*ps != '\t' && *ps != ' ') {
+				} else if (*ps != '\t' && *ps != ' ') {
 					err = PHP_CONV_ERR_INVALID_SEQ;
 					goto out;
 				}
@@ -1133,6 +1132,9 @@
 			} break;
 
 			case 5: {
+				if (icnt == 0) {
+					goto out;
+				}
 				if (!inst->lbchars && lb_cnt == 1 && *ps == '\n') {
 					/* auto-detect soft line breaks, found network line break */
 					lb_cnt = lb_ptr = 0;
@@ -1146,15 +1148,13 @@
 					/* soft line break */
 					lb_cnt = lb_ptr = 0;
 					scan_stat = 0;
-				} else if (icnt > 0) {
+				} else {
 					if (*ps == (unsigned char)inst->lbcharslb_cnt) {
 						lb_cnt++;
 						ps++, icnt--;
 					} else {
 						scan_stat = 6; /* no break for short-cut */
 					}
-				} else {
-					goto out;
 				}
 			} break;

php-5.6.40.tar.xz/ext/standard/http_fopen_wrapper.c Changed

@@ -178,6 +178,16 @@
 			return NULL;
 		}
 
+		/* Should we send the entire path in the request line, default to no. */
+		if (context && php_stream_context_get_option(context, "http", "request_fulluri", &tmpzval) == SUCCESS) {
+			zval ztmp = **tmpzval;
+
+			zval_copy_ctor(&ztmp);
+			convert_to_boolean(&ztmp);
+			request_fulluri = Z_BVAL(ztmp) ? 1 : 0;
+			zval_dtor(&ztmp);
+		}
+
 		use_ssl = resource->scheme && (strlen(resource->scheme) > 4) && resource->scheme4 == 's';
 		/* choose default ports */
 		if (use_ssl && resource->port == 0)
@@ -197,6 +207,13 @@
 		}
 	}
 
+	if (request_fulluri && (strchr(path, '\n') != NULL || strchr(path, '\r') != NULL)) {
+		php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "HTTP wrapper full URI path does not allow CR or LF characters");
+		php_url_free(resource);
+		efree(transport_string);
+		return NULL;
+	}
+
 	if (context && php_stream_context_get_option(context, wrapper->wops->label, "timeout", &tmpzval) == SUCCESS) {
 		SEPARATE_ZVAL(tmpzval);
 		convert_to_double_ex(tmpzval);
@@ -382,18 +399,6 @@
 		strncpy(scratch, "GET ", scratch_len);
 	}
 
-	/* Should we send the entire path in the request line, default to no. */
-	if (!request_fulluri &&
-		context &&
-		php_stream_context_get_option(context, "http", "request_fulluri", &tmpzval) == SUCCESS) {
-		zval ztmp = **tmpzval;
-
-		zval_copy_ctor(&ztmp);
-		convert_to_boolean(&ztmp);
-		request_fulluri = Z_BVAL(ztmp) ? 1 : 0;
-		zval_dtor(&ztmp);
-	}
-
 	if (request_fulluri) {
 		/* Ask for everything */
 		strcat(scratch, path);

php-5.6.40.tar.xz/ext/standard/image.c Changed

php-5.6.40.tar.xz/ext/standard/link_win32.c Changed

php-5.6.40.tar.xz/ext/standard/password.c Changed

php-5.6.40.tar.xz/ext/standard/string.c Changed

@@ -4720,7 +4720,7 @@
 				switch (state) {
 					case 1: /* HTML/XML */
 						lc = '>';
-						if (is_xml && *(p -1) == '-') {
+						if (is_xml && p >= buf + 1 && *(p-1) == '-') {
 							break;
 						}
 						in_q = state = is_xml = 0;
@@ -4741,7 +4741,7 @@
 						break;
 
 					case 2: /* PHP */
-						if (!br && lc != '\"' && *(p-1) == '?') {
+						if (!br && lc != '\"' && p >= buf + 1 && *(p-1) == '?') {
 							in_q = state = 0;
 							tp = tbuf;
 						}
@@ -4770,7 +4770,7 @@
 				if (state == 4) {
 					/* Inside  */
 					break;
-				} else if (state == 2 && *(p-1) != '\\') {
+				} else if (state == 2 && p >= buf + 1 && *(p-1) != '\\') {
 					if (lc == c) {
 						lc = '\0';
 					} else if (lc != '\\') {
@@ -4797,7 +4797,7 @@
 
 			case '!':
 				/* JavaScript & Other HTML scripting languages */
-				if (state == 1 && *(p-1) == '<') {
+				if (state == 1 && p >= buf + 1 && *(p-1) == '<') {
 					state = 3;
 					lc = c;
 				} else {
@@ -4824,7 +4824,7 @@
 
 			case '?':
 
-				if (state == 1 && *(p-1) == '<') {
+				if (state == 1 && p >= buf + 1 && *(p-1) == '<') {
 					br=0;
 					state=2;
 					break;

php-5.6.40.tar.xz/ext/standard/tests/GHSA-96wq-48vp-hh57.phpt Added

php-5.6.40.tar.xz/ext/standard/tests/bug81727.phpt Added

php-5.6.40.tar.xz/ext/standard/tests/crypt Added

php-5.6.40.tar.xz/ext/standard/tests/crypt/bcrypt_salt_dollar.phpt Added

@@ -0,0 +1,82 @@
+--TEST--
+bcrypt correctly rejects salts containing $
+--FILE--
+<?php
+for ($i = 0; $i < 23; $i++) {
+	$salt = '$2y$04$' . str_repeat('0', $i) . '$';
+	$result = crypt("foo", $salt);
+	var_dump($salt);
+	var_dump($result);
+	var_dump($result === $salt);
+}
+?>
+--EXPECT--
+string(8) "$2y$04$$"
+string(2) "*0"
+bool(false)
+string(9) "$2y$04$0$"
+string(2) "*0"
+bool(false)
+string(10) "$2y$04$00$"
+string(2) "*0"
+bool(false)
+string(11) "$2y$04$000$"
+string(2) "*0"
+bool(false)
+string(12) "$2y$04$0000$"
+string(2) "*0"
+bool(false)
+string(13) "$2y$04$00000$"
+string(2) "*0"
+bool(false)
+string(14) "$2y$04$000000$"
+string(2) "*0"
+bool(false)
+string(15) "$2y$04$0000000$"
+string(2) "*0"
+bool(false)
+string(16) "$2y$04$00000000$"
+string(2) "*0"
+bool(false)
+string(17) "$2y$04$000000000$"
+string(2) "*0"
+bool(false)
+string(18) "$2y$04$0000000000$"
+string(2) "*0"
+bool(false)
+string(19) "$2y$04$00000000000$"
+string(2) "*0"
+bool(false)
+string(20) "$2y$04$000000000000$"
+string(2) "*0"
+bool(false)
+string(21) "$2y$04$0000000000000$"
+string(2) "*0"
+bool(false)
+string(22) "$2y$04$00000000000000$"
+string(2) "*0"
+bool(false)
+string(23) "$2y$04$000000000000000$"
+string(2) "*0"
+bool(false)
+string(24) "$2y$04$0000000000000000$"
+string(2) "*0"
+bool(false)
+string(25) "$2y$04$00000000000000000$"
+string(2) "*0"
+bool(false)
+string(26) "$2y$04$000000000000000000$"
+string(2) "*0"
+bool(false)
+string(27) "$2y$04$0000000000000000000$"
+string(2) "*0"
+bool(false)
+string(28) "$2y$04$00000000000000000000$"
+string(2) "*0"
+bool(false)
+string(29) "$2y$04$000000000000000000000$"
+string(2) "*0"
+bool(false)
+string(30) "$2y$04$0000000000000000000000$"
+string(60) "$2y$04$000000000000000000000u2a2UpVexIt9k3FMJeAVr3c04F5tcI8K"
+bool(false)

php-5.6.40.tar.xz/ext/standard/tests/file/bug41655_1.phpt Changed

php-5.6.40.tar.xz/ext/standard/tests/file/bug79099.phpt Added

php-5.6.40.tar.xz/ext/standard/tests/file/pathinfo_basic1-win32.phpt Changed

php-5.6.40.tar.xz/ext/standard/tests/file/pathinfo_basic2-win32.phpt Changed

php-5.6.40.tar.xz/ext/standard/tests/file/windows_links/bug78862.phpt Added

php-5.6.40.tar.xz/ext/standard/tests/file/windows_links/common.inc Changed

php-5.6.40.tar.xz/ext/standard/tests/filters/bug74267.phpt Added

php-5.6.40.tar.xz/ext/standard/tests/filters/ghsa-r977-prxv-hc43.phpt Added

@@ -0,0 +1,12 @@
+--TEST--
+GHSA-r977-prxv-hc43: Single byte overread with convert.quoted-printable-decode filter
+--FILE--
+<?php
+
+$input_data = str_repeat('A', 8189)."X=\r";
+$filter_url = "php://filter/convert.quoted-printable-decode/resource=data:," . urlencode($input_data);
+var_dump(file_get_contents($filter_url));
+
+?>
+--EXPECT--
+string(8190) "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAX"

php-5.6.40.tar.xz/ext/standard/tests/ghsa-wpj3-hf5j-x4v4.phpt Added

@@ -0,0 +1,63 @@
+--TEST--
+ghsa-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix)
+--COOKIE--
+..Host-test=ignore_1;
+._Host-test=ignore_2;
+.Host-test=ignore_3;
+_.Host-test=ignore_4;
+__Host-test=ignore_5;
+_Host-test=ignore_6;
+.Host-test=ignore_7;
+_Host-test=ignore_8;
+Host-test=ignore_9;
+..Host-test=ignore_10;
+._Host-test=ignore_11;
+.Host-test=ignore_12;
+_.Host-test=ignore_13;
+__Host-test=legitimate_14;
+_Host-test=legitimate_15;
+.Host-test=ignore_16;
+_Host-test=ignore_17;
+Host-test=ignore_18;
+..Secure-test=ignore_1;
+._Secure-test=ignore_2;
+.Secure-test=ignore_3;
+_.Secure-test=ignore_4;
+__Secure-test=ignore_5;
+_Secure-test=ignore_6;
+.Secure-test=ignore_7;
+_Secure-test=ignore_8;
+Secure-test=ignore_9;
+..Secure-test=ignore_10;
+._Secure-test=ignore_11;
+.Secure-test=ignore_12;
+_.Secure-test=ignore_13;
+__Secure-test=legitimate_14;
+_Secure-test=legitimate_15;
+.Secure-test=ignore_16;
+_Secure-test=ignore_17;
+Secure-test=ignore_18;
+--FILE--
+<?php
+var_dump($_COOKIE);
+?>
+--EXPECT--
+array(3) {
+  "__Host-test"=>
+  array(1) {
+    0=>
+    string(13) "legitimate_14"
+  }
+  "_"=>
+  array(2) {
+    "Host-test"=>
+    string(13) "legitimate_15"
+    "Secure-test"=>
+    string(13) "legitimate_15"
+  }
+  "__Secure-test"=>
+  array(1) {
+    0=>
+    string(13) "legitimate_14"
+  }
+}

php-5.6.40.tar.xz/ext/standard/tests/http/ghsa-c5f2-jwm7-mmq2.phpt Added

php-5.6.40.tar.xz/ext/standard/tests/image/bug79877.phpt Added

php-5.6.40.tar.xz/ext/standard/tests/password/password_bcrypt_errors.phpt Changed

php-5.6.40.tar.xz/ext/standard/tests/password/password_bcrypt_short.phpt Added

php-5.6.40.tar.xz/ext/standard/tests/serialize/bug64146.phpt Changed

php-5.6.40.tar.xz/ext/standard/tests/streams/stream_socket_enable_crypto-win32.phpt Changed

php-5.6.40.tar.xz/ext/standard/tests/strings/bug65769.phpt Changed

php-5.6.40.tar.xz/ext/standard/url.c Changed

php-5.6.40.tar.xz/ext/standard/url_scanner_ex.c Changed

@@ -1,4 +1,5 @@
 /* Generated by re2c 0.14.3 */
+#line 1 "ext/standard/url_scanner_ex.re"
 /*
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
@@ -94,6 +95,7 @@
 	STD_PHP_INI_ENTRY("url_rewriter.tags", "a=href,area=href,frame=src,form=,fieldset=", PHP_INI_ALL, OnUpdateTags, url_adapt_state_ex, php_basic_globals, basic_globals)
 PHP_INI_END()
 
+#line 102 "ext/standard/url_scanner_ex.re"
 
 
 #define YYFILL(n) goto done
@@ -138,6 +140,7 @@
 
 scan:
 
+#line 144 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm = {
@@ -183,13 +186,19 @@
 	if (yych <= '#') goto yy6;
 	if (yych >= ';') goto yy4;
 	++YYCURSOR;
+#line 146 "ext/standard/url_scanner_ex.re"
 	{ smart_str_append(dest, url); return; }
+#line 192 "ext/standard/url_scanner_ex.c"
 yy4:
 	++YYCURSOR;
+#line 147 "ext/standard/url_scanner_ex.re"
 	{ sep = separator; goto scan; }
+#line 197 "ext/standard/url_scanner_ex.c"
 yy6:
 	++YYCURSOR;
+#line 148 "ext/standard/url_scanner_ex.re"
 	{ bash = p - 1; goto done; }
+#line 202 "ext/standard/url_scanner_ex.c"
 yy8:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -197,8 +206,11 @@
 	if (yybm0+yych & 128) {
 		goto yy8;
 	}
+#line 149 "ext/standard/url_scanner_ex.re"
 	{ goto scan; }
+#line 212 "ext/standard/url_scanner_ex.c"
 }
+#line 150 "ext/standard/url_scanner_ex.re"
 
 done:
 	
@@ -378,6 +390,7 @@
 state_plain:
 	start = YYCURSOR;
 
+#line 394 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm = {
@@ -420,7 +433,9 @@
 		goto yy15;
 	}
 	++YYCURSOR;
+#line 329 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); STATE = STATE_TAG; goto state_tag; }
+#line 439 "ext/standard/url_scanner_ex.c"
 yy15:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -428,13 +443,17 @@
 	if (yybm0+yych & 128) {
 		goto yy15;
 	}
+#line 330 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); goto state_plain; }
+#line 449 "ext/standard/url_scanner_ex.c"
 }
+#line 331 "ext/standard/url_scanner_ex.re"
 
 
 state_tag:	
 	start = YYCURSOR;
 
+#line 457 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm = {
@@ -485,10 +504,14 @@
 	yych = *YYCURSOR;
 	goto yy25;
 yy21:
+#line 336 "ext/standard/url_scanner_ex.re"
 	{ handle_tag(STD_ARGS); /* Sets STATE */; passthru(STD_ARGS); if (STATE == STATE_PLAIN) goto state_plain; else goto state_next_arg; }
+#line 510 "ext/standard/url_scanner_ex.c"
 yy22:
 	++YYCURSOR;
+#line 337 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); goto state_plain_begin; }
+#line 515 "ext/standard/url_scanner_ex.c"
 yy24:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -499,6 +522,7 @@
 	}
 	goto yy21;
 }
+#line 338 "ext/standard/url_scanner_ex.re"
 
 
 state_next_arg_begin:
@@ -507,6 +531,7 @@
 state_next_arg:
 	start = YYCURSOR;
 
+#line 535 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm = {
@@ -571,20 +596,28 @@
 	++YYCURSOR;
 	if ((yych = *YYCURSOR) == '>') goto yy39;
 yy29:
+#line 349 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); goto state_plain_begin; }
+#line 602 "ext/standard/url_scanner_ex.c"
 yy30:
 	++YYCURSOR;
 yy31:
+#line 346 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); handle_form(STD_ARGS); goto state_plain_begin; }
+#line 608 "ext/standard/url_scanner_ex.c"
 yy32:
 	++YYCURSOR;
 	yych = *YYCURSOR;
 	goto yy38;
 yy33:
+#line 347 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); goto state_next_arg; }
+#line 616 "ext/standard/url_scanner_ex.c"
 yy34:
 	++YYCURSOR;
+#line 348 "ext/standard/url_scanner_ex.re"
 	{ --YYCURSOR; STATE = STATE_ARG; goto state_arg; }
+#line 621 "ext/standard/url_scanner_ex.c"
 yy36:
 	yych = *++YYCURSOR;
 	goto yy29;
@@ -602,11 +635,13 @@
 	yych = *YYCURSOR;
 	goto yy31;
 }
+#line 350 "ext/standard/url_scanner_ex.re"
 
 
 state_arg:
 	start = YYCURSOR;
 
+#line 645 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm = {
@@ -654,10 +689,14 @@
 	yych = *YYCURSOR;
 	goto yy47;
 yy43:
+#line 355 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); handle_arg(STD_ARGS); STATE = STATE_BEFORE_VAL; goto state_before_val; }
+#line 695 "ext/standard/url_scanner_ex.c"
 yy44:
 	++YYCURSOR;
+#line 356 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); STATE = STATE_NEXT_ARG; goto state_next_arg; }
+#line 700 "ext/standard/url_scanner_ex.c"
 yy46:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -668,11 +707,13 @@
 	}
 	goto yy43;
 }
+#line 357 "ext/standard/url_scanner_ex.re"
 
 
 state_before_val:
 	start = YYCURSOR;
 
+#line 717 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm = {
@@ -719,13 +760,17 @@
 	if (yych == ' ') goto yy57;
 	if (yych == '=') goto yy55;
 yy51:
+#line 363 "ext/standard/url_scanner_ex.re"
 	{ --YYCURSOR; goto state_next_arg_begin; }
+#line 766 "ext/standard/url_scanner_ex.c"

php-5.6.40.tar.xz/ext/standard/var_unserializer.c Changed

@@ -1,4 +1,5 @@
 /* Generated by re2c 0.15.3 */
+#line 1 "ext/standard/var_unserializer.re"
 /*
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
@@ -279,6 +280,7 @@
 #define YYMARKER marker
 
 
+#line 288 "ext/standard/var_unserializer.re"
 
 
 
@@ -526,6 +528,7 @@
 
 
 
+#line 532 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm = {
@@ -584,7 +587,9 @@
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy95;
 yy3:
+#line 908 "ext/standard/var_unserializer.re"
 	{ return 0; }
+#line 593 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy89;
@@ -627,11 +632,13 @@
 	goto yy3;
 yy14:
 	++YYCURSOR;
+#line 902 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
+#line 642 "ext/standard/var_unserializer.c"
 yy16:
 	yych = *++YYCURSOR;
 	goto yy3;
@@ -662,6 +669,7 @@
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
+#line 748 "ext/standard/var_unserializer.re"
 	{
 	size_t len, len2, len3, maxlen;
 	long elements;
@@ -815,6 +823,7 @@
 
 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
+#line 827 "ext/standard/var_unserializer.c"
 yy25:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -839,6 +848,7 @@
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
+#line 735 "ext/standard/var_unserializer.re"
 	{
 	long elements;
     if (!var_hash) return 0;
@@ -851,6 +861,7 @@
 	}
 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
+#line 865 "ext/standard/var_unserializer.c"
 yy32:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy33;
@@ -871,6 +882,7 @@
 	yych = *++YYCURSOR;
 	if (yych != '{') goto yy18;
 	++YYCURSOR;
+#line 714 "ext/standard/var_unserializer.re"
 	{
 	long elements = parse_iv(start + 2);
 	/* use iv() not uiv() in order to check data range */
@@ -891,6 +903,7 @@
 
 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
+#line 907 "ext/standard/var_unserializer.c"
 yy39:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy40;
@@ -911,6 +924,7 @@
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
+#line 679 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -945,6 +959,7 @@
 	ZVAL_STRINGL(*rval, str, len, 0);
 	return 1;
 }
+#line 963 "ext/standard/var_unserializer.c"
 yy46:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy47;
@@ -965,6 +980,7 @@
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
+#line 646 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -997,6 +1013,7 @@
 	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
+#line 1017 "ext/standard/var_unserializer.c"
 yy53:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
@@ -1084,6 +1101,7 @@
 	}
 yy63:
 	++YYCURSOR;
+#line 636 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 use_double:
@@ -1093,6 +1111,7 @@
 	ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
+#line 1115 "ext/standard/var_unserializer.c"
 yy65:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1151,6 +1170,7 @@
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
+#line 621 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
@@ -1165,6 +1185,7 @@
 
 	return 1;
 }
+#line 1189 "ext/standard/var_unserializer.c"
 yy76:
 	yych = *++YYCURSOR;
 	if (yych == 'N') goto yy73;
@@ -1191,6 +1212,7 @@
 	if (yych <= '9') goto yy79;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
+#line 594 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 	int digits = YYCURSOR - start - 3;
@@ -1217,6 +1239,7 @@
 	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
+#line 1243 "ext/standard/var_unserializer.c"
 yy83:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
@@ -1224,20 +1247,24 @@
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
+#line 587 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_BOOL(*rval, parse_iv(start + 2));
 	return 1;
 }
+#line 1258 "ext/standard/var_unserializer.c"
 yy87:
 	++YYCURSOR;
+#line 580 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_NULL(*rval);
 	return 1;
 }
+#line 1268 "ext/standard/var_unserializer.c"
 yy89:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1260,6 +1287,7 @@

php-5.6.40.tar.xz/ext/xml/compat.c Changed

php-5.6.40.tar.xz/ext/xmlreader/php_xmlreader.c Changed

@@ -283,6 +283,7 @@
 	xmlRelaxNGParserCtxtPtr parser = NULL;
 	xmlRelaxNGPtr           sptr;
 	char resolved_pathMAXPATHLEN + 1;
+	PHP_LIBXML_SANITIZE_GLOBALS_DECL(parse);
 
 	switch (type) {
 	case XMLREADER_LOAD_FILE:
@@ -305,6 +306,7 @@
 		return NULL;
 	}
 
+	PHP_LIBXML_SANITIZE_GLOBALS(parse);
 	if (error_func || warn_func) {
 		xmlRelaxNGSetParserErrors(parser,
 			(xmlRelaxNGValidityErrorFunc) error_func,
@@ -313,6 +315,7 @@
 	}
 	sptr = xmlRelaxNGParse(parser);
 	xmlRelaxNGFreeParserCtxt(parser);
+	PHP_LIBXML_RESTORE_GLOBALS(parse);
 
 	return sptr;
 }
@@ -886,7 +889,10 @@
 	valid_file = _xmlreader_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
 
 	if (valid_file) {
+		PHP_LIBXML_SANITIZE_GLOBALS_DECL(reader_for_file);
+		PHP_LIBXML_SANITIZE_GLOBALS(reader_for_file);
 		reader = xmlReaderForFile(valid_file, encoding, options);
+		PHP_LIBXML_RESTORE_GLOBALS(reader_for_file);
 	}
 
 	if (reader == NULL) {
@@ -963,7 +969,10 @@
 
 	intern = (xmlreader_object *)zend_object_store_get_object(id TSRMLS_CC);
 	if (intern && intern->ptr) {
+		PHP_LIBXML_SANITIZE_GLOBALS_DECL(schema);
+		PHP_LIBXML_SANITIZE_GLOBALS(schema);
 		retval = xmlTextReaderSchemaValidate(intern->ptr, source);
+		PHP_LIBXML_RESTORE_GLOBALS(schema);
 
 		if (retval == 0) {
 			RETURN_TRUE;
@@ -1044,7 +1053,7 @@
 	xmlreader_object *intern = NULL;
 	char *source, *uri = NULL, *encoding = NULL;
 	int resolved_path_len, ret = 0;
-	char *directory=NULL, resolved_pathMAXPATHLEN;
+	char *directory=NULL, resolved_pathMAXPATHLEN + 1;
 	xmlParserInputBufferPtr inputbfr;
 	xmlTextReaderPtr reader;
 
@@ -1069,6 +1078,7 @@
 	inputbfr = xmlParserInputBufferCreateMem(source, source_len, XML_CHAR_ENCODING_NONE);
 
     if (inputbfr != NULL) {
+		PHP_LIBXML_SANITIZE_GLOBALS_DECL(text_reader);
 /* Get the URI of the current script so that we can set the base directory in libxml */
 #if HAVE_GETCWD
 		directory = VCWD_GETCWD(resolved_path, MAXPATHLEN);
@@ -1083,6 +1093,7 @@
 			}
 			uri = (char *) xmlCanonicPath((const xmlChar *) resolved_path);
 		}
+		PHP_LIBXML_SANITIZE_GLOBALS(text_reader);
 		reader = xmlNewTextReader(inputbfr, uri);
 
 		if (reader != NULL) {
@@ -1103,9 +1114,11 @@
 					xmlFree(uri);
 				}
 
+				PHP_LIBXML_RESTORE_GLOBALS(text_reader);
 				return;
 			}
 		}
+		PHP_LIBXML_RESTORE_GLOBALS(text_reader);
 	}
 
 	if (uri) {

php-5.6.40.tar.xz/ext/xmlreader/tests/bug64230.phpt Changed

php-5.6.40.tar.xz/ext/xsl/xsltprocessor.c Changed

@@ -408,10 +408,11 @@
 	xmlDoc *doc = NULL, *newdoc = NULL;
 	xsltStylesheetPtr sheetp, oldsheetp;
 	xsl_object *intern;
-	int prevSubstValue, prevExtDtdValue, clone_docu = 0;
+	int clone_docu = 0;
 	xmlNode *nodep = NULL;
 	zend_object_handlers *std_hnd;
 	zval *cloneDocu, *member;
+	PHP_LIBXML_SANITIZE_GLOBALS_DECL(parse);
 
 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Oo", &id, xsl_xsltprocessor_class_entry, &docp) == FAILURE) {
 		RETURN_FALSE;
@@ -431,13 +432,12 @@
 	stylesheet document otherwise the node proxies will be a mess */
 	newdoc = xmlCopyDoc(doc, 1);
 	xmlNodeSetBase((xmlNodePtr) newdoc, (xmlChar *)doc->URL);
-	prevSubstValue = xmlSubstituteEntitiesDefault(1);
-	prevExtDtdValue = xmlLoadExtDtdDefaultValue;
+	PHP_LIBXML_SANITIZE_GLOBALS(parse);
+	xmlSubstituteEntitiesDefault(1);
 	xmlLoadExtDtdDefaultValue = XML_DETECT_IDS | XML_COMPLETE_ATTRS;
 
 	sheetp = xsltParseStylesheetDoc(newdoc);
-	xmlSubstituteEntitiesDefault(prevSubstValue);
-	xmlLoadExtDtdDefaultValue = prevExtDtdValue;
+	PHP_LIBXML_RESTORE_GLOBALS(parse);
 
 	if (!sheetp) {
 		xmlFreeDoc(newdoc);

php-5.6.40.tar.xz/ext/zip/php_zip.c Changed

php-5.6.40.tar.xz/ext/zip/tests/bug81420.phpt Added

php-5.6.40.tar.xz/ext/zip/tests/bug81420.zip Added

php-5.6.40.tar.xz/main/fopen_wrappers.c Changed

php-5.6.40.tar.xz/main/main.c Changed

php-5.6.40.tar.xz/main/php_variables.c Changed

@@ -56,6 +56,21 @@
 	php_register_variable_ex(var, &new_entry, track_vars_array TSRMLS_CC);
 }
 
+/* Discard variable if mangling made it start with __Host-, where pre-mangling it did not start with __Host-
+ * Discard variable if mangling made it start with __Secure-, where pre-mangling it did not start with __Secure- */
+static zend_bool php_is_forbidden_variable_name(const char *mangled_name, size_t mangled_name_len, const char *pre_mangled_name)
+{
+	if (mangled_name_len >= sizeof("__Host-")-1 && strncmp(mangled_name, "__Host-", sizeof("__Host-")-1) == 0 && strncmp(pre_mangled_name, "__Host-", sizeof("__Host-")-1) != 0) {
+		return 1;
+	}
+
+	if (mangled_name_len >= sizeof("__Secure-")-1 && strncmp(mangled_name, "__Secure-", sizeof("__Secure-")-1) == 0 && strncmp(pre_mangled_name, "__Secure-", sizeof("__Secure-")-1) != 0) {
+		return 1;
+	}
+
+	return 0;
+}
+
 PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars_array TSRMLS_DC)
 {
 	char *p = NULL;
@@ -184,6 +199,12 @@
 					return;
 				}
 			} else {
+				if (php_is_forbidden_variable_name(index, index_len, var_name)) {
+					zval_dtor(val);
+					free_alloca(var_orig, use_heap);
+					return;
+				}
+
 				if (zend_symtable_find(symtable1, index, index_len + 1, (void **) &gpc_element_p) == FAILURE
 					|| Z_TYPE_PP(gpc_element_p) != IS_ARRAY) {
 					MAKE_STD_ZVAL(gpc_element);
@@ -214,6 +235,12 @@
 				zval_ptr_dtor(&gpc_element);
 			}
 		} else {
+			if (php_is_forbidden_variable_name(index, index_len, var_name)) {
+				zval_dtor(val);
+				free_alloca(var_orig, use_heap);
+				return;
+			}
+
 			/*
 			 * According to rfc2965, more specific paths are listed above the less specific ones.
 			 * If we encounter a duplicate cookie name, we should skip it, since it is not possible
@@ -472,7 +499,9 @@
 			unsigned int new_val_len;
 
 			*val++ = '\0';
-			php_url_decode(var, strlen(var));
+			if (arg != PARSE_COOKIE) {
+				php_url_decode(var, strlen(var));
+			}
 			val_len = php_url_decode(val, strlen(val));
 			val = estrndup(val, val_len);
 			if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len TSRMLS_CC)) {
@@ -483,7 +512,9 @@
 			int val_len;
 			unsigned int new_val_len;
 
-			php_url_decode(var, strlen(var));
+			if (arg != PARSE_COOKIE) {
+				php_url_decode(var, strlen(var));
+			}
 			val_len = 0;
 			val = estrndup("", val_len);
 			if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len TSRMLS_CC)) {

php-5.6.40.tar.xz/main/rfc1867.c Changed

@@ -609,9 +609,9 @@
 }
 
 /* read until a boundary condition */
-static int multipart_buffer_read(multipart_buffer *self, char *buf, int bytes, int *end TSRMLS_DC)
+static unsigned int multipart_buffer_read(multipart_buffer *self, char *buf, unsigned int bytes, int *end TSRMLS_DC)
 {
-	int len, max;
+	unsigned int len, max;
 	char *bound;
 
 	/* fill buffer if needed */
@@ -658,7 +658,7 @@
 static char *multipart_buffer_read_body(multipart_buffer *self, unsigned int *len TSRMLS_DC)
 {
 	char bufFILLUNIT, *out=NULL;
-	int total_bytes=0, read_bytes=0;
+	unsigned int total_bytes=0, read_bytes=0;
 
 	while((read_bytes = multipart_buffer_read(self, buf, sizeof(buf), NULL TSRMLS_CC))) {
 		out = erealloc(out, total_bytes + read_bytes + 1);
@@ -684,7 +684,8 @@
 {
 	char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL;
 	char *temp_filename = NULL, *lbuf = NULL, *abuf = NULL;
-	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0;
+	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0;
+	unsigned int array_len = 0;
 	int64_t total_bytes = 0, max_file_size = 0;
 	int skip_upload = 0, anonindex = 0, is_anonymous;
 	zval *http_post_files = NULL;
@@ -696,11 +697,13 @@
 	void *event_extra_data = NULL;
 	unsigned int llen = 0;
 	int upload_cnt = INI_INT("max_file_uploads");
+	int body_parts_cnt = INI_INT("max_multipart_body_parts");
 	const zend_encoding *internal_encoding = zend_multibyte_get_internal_encoding(TSRMLS_C);
 	php_rfc1867_getword_t getword;
 	php_rfc1867_getword_conf_t getword_conf;
 	php_rfc1867_basename_t _basename;
 	long count = 0;
+	int body_parts_limit;
 
 	if (php_rfc1867_encoding_translation(TSRMLS_C) && internal_encoding) {
 		getword = php_rfc1867_getword;
@@ -717,6 +720,11 @@
 		return;
 	}
 
+	if (body_parts_cnt < 0) {
+		body_parts_cnt = PG(max_input_vars) + upload_cnt;
+	}
+	body_parts_limit = body_parts_cnt;
+
 	/* Get the boundary */
 	boundary = strstr(content_type_dup, "boundary");
 	if (!boundary) {
@@ -755,6 +763,13 @@
 		boundary_len = boundary_end-boundary;
 	}
 
+	/* Boundaries larger than FILLUNIT-strlen("\r\n--") characters lead to
+	 * erroneous parsing */
+	if (boundary_len > FILLUNIT-strlen("\r\n--")) {
+		sapi_module.sapi_error(E_WARNING, "Boundary too large in multipart/form-data POST data");
+		return;
+	}
+
 	/* Initialize the buffer */
 	if (!(mbuff = multipart_buffer_new(boundary, boundary_len TSRMLS_CC))) {
 		sapi_module.sapi_error(E_WARNING, "Unable to initialize the input buffer");
@@ -801,6 +816,11 @@
 			char *pair = NULL;
 			int end = 0;
 
+			if (--body_parts_cnt < 0) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Multipart body parts limit exceeded %d. To increase the limit change max_multipart_body_parts in php.ini.", body_parts_limit);
+				goto fileupload_done;
+			}
+
 			while (isspace(*cd)) {
 				++cd;
 			}
@@ -924,7 +944,10 @@
 				skip_upload = 1;
 			} else if (upload_cnt <= 0) {
 				skip_upload = 1;
-				sapi_module.sapi_error(E_WARNING, "Maximum number of allowable file uploads has been exceeded");
+				if (upload_cnt == 0) {
+					--upload_cnt;
+					sapi_module.sapi_error(E_WARNING, "Maximum number of allowable file uploads has been exceeded");
+				}
 			}
 
 			/* Return with an error if the posted data is garbled */

php-5.6.40.tar.xz/main/streams/plain_wrapper.c Changed

@@ -1126,34 +1126,50 @@
 # ifdef EXDEV
 		if (errno == EXDEV) {
 			struct stat sb;
+# if !defined(ZTS) && !defined(TSRM_WIN32) && !defined(NETWARE)
+			/* not sure what to do in ZTS case, umask is not thread-safe */
+			int oldmask = umask(077);
+# endif
+			int success = 0;
 			if (php_copy_file(url_from, url_to TSRMLS_CC) == SUCCESS) {
 				if (VCWD_STAT(url_from, &sb) == 0) {
+					success = 1;
 #  if !defined(TSRM_WIN32) && !defined(NETWARE)
-					if (VCWD_CHMOD(url_to, sb.st_mode)) {
+					/*
+					 * Try to set user and permission info on the target.
+					 * If we're not root, then some of these may fail.
+					 * We try chown first, to set proper group info, relying
+					 * on the system environment to have proper umask to not allow
+					 * access to the file in the meantime.
+					 */
+					if (VCWD_CHOWN(url_to, sb.st_uid, sb.st_gid)) {
+						php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
 						if (errno == EPERM) {
-							php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
-							VCWD_UNLINK(url_from);
-							return 1;
+							success = 0;
 						}
-						php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
-						return 0;
 					}
-					if (VCWD_CHOWN(url_to, sb.st_uid, sb.st_gid)) {
-						if (errno == EPERM) {
+					if (success) {
+						if (VCWD_CHMOD(url_to, sb.st_mode)) {
 							php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
-							VCWD_UNLINK(url_from);
-							return 1;
+							if (errno == EPERM) {
+								success = 0;
+							}
 						}
-						php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
-						return 0;
 					}
 #  endif
-					VCWD_UNLINK(url_from);
-					return 1;
+					if (success) {
+						VCWD_UNLINK(url_from);
+					}
+				} else {
+					php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
 				}
+			} else {
+				php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
 			}
-			php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
-			return 0;
+#  if !defined(ZTS) && !defined(TSRM_WIN32) && !defined(NETWARE)
+			umask(oldmask);
+#  endif
+			return success;
 		}
 # endif
 #endif

php-5.6.40.tar.xz/php.ini-development Changed

php-5.6.40.tar.xz/php.ini-production Changed

php-5.6.40.tar.xz/run-tests.php Changed

php-5.6.40.tar.xz/sapi/cgi/cgi_main.c Changed

@@ -1830,8 +1830,18 @@
 		}
 	}
 
+	/* Apache CGI will pass the query string to the command line if it doesn't contain a '='.
+	 * This can create an issue where a malicious request can pass command line arguments to
+	 * the executable. Ideally we skip argument parsing when we're in cgi or fastcgi mode,
+	 * but that breaks PHP scripts on Linux with a hashbang: `#!/php-cgi -d option=value`.
+	 * Therefore, this code only prevents passing arguments if the query string starts with a '-'.
+	 * Similarly, scripts spawned in subprocesses on Windows may have the same issue.
+	 * However, Windows has lots of conversion rules and command line parsing rules that
+	 * are too difficult and dangerous to reliably emulate. */
 	if((query_string = getenv("QUERY_STRING")) != NULL && strchr(query_string, '=') == NULL) {
-		/* we've got query string that has no = - apache CGI will pass it to command line */
+#ifdef PHP_WIN32
+		skip_getopt = cgi || fastcgi;
+#else
 		unsigned char *p;
 		decoded_query_string = strdup(query_string);
 		php_url_decode(decoded_query_string, strlen(decoded_query_string));
@@ -1841,7 +1851,9 @@
 		if(*p == '-') {
 			skip_getopt = 1;
 		}
+
 		free(decoded_query_string);
+#endif
 	}
 
 	while (!skip_getopt && (c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 0, 2)) != -1) {
@@ -1930,18 +1942,17 @@
 
 	/* check force_cgi after startup, so we have proper output */
 	if (cgi && CGIG(force_redirect)) {
-		/* Apache will generate REDIRECT_STATUS,
-		 * Netscape and redirect.so will generate HTTP_REDIRECT_STATUS.
-		 * redirect.so and installation instructions available from
-		 * http://www.koehntopp.de/php.
-		 *   -- kk@netuse.de
-		 */
-		if (!getenv("REDIRECT_STATUS") &&
-			!getenv ("HTTP_REDIRECT_STATUS") &&
-			/* this is to allow a different env var to be configured
-			 * in case some server does something different than above */
-			(!CGIG(redirect_status_env) || !getenv(CGIG(redirect_status_env)))
-		) {
+		/* This is to allow a different environment variable to be configured
+		 * in case the we cannot auto-detect which environment variable to use.
+		 * Checking this first to allow user overrides in case the environment
+		 * variable can be set by an untrusted party. */
+		const char *redirect_status_env = CGIG(redirect_status_env);
+		if (!redirect_status_env) {
+			/* Apache will generate REDIRECT_STATUS. */
+			redirect_status_env = "REDIRECT_STATUS";
+		}
+
+		if (!getenv(redirect_status_env)) {
 			zend_try {
 				SG(sapi_headers).http_response_code = 400;
 				PUTS("<b>Security Alert!</b> The PHP CGI cannot be accessed directly.\n\n\

php-5.6.40.tar.xz/sapi/cgi/tests/bug69487.phpt Changed

php-5.6.40.tar.xz/sapi/cgi/tests/ghsa-3qgc-jrrr-25jv.phpt Added

php-5.6.40.tar.xz/sapi/cli/php_cli_server.c Changed

php-5.6.40.tar.xz/sapi/cli/tests/ghsa-4w77-75f9-2c8w.phpt Added

php-5.6.40.tar.xz/sapi/fpm/fpm/fpm_children.c Changed

@@ -239,7 +239,7 @@
 
 			fpm_child_unlink(child);
 
-			fpm_scoreboard_proc_free(wp->scoreboard, child->scoreboard_i);
+			fpm_scoreboard_proc_free(child);
 
 			fpm_clock_get(&tv1);
 
@@ -249,9 +249,9 @@
 				if (!fpm_pctl_can_spawn_children()) {
 					severity = ZLOG_DEBUG;
 				}
-				zlog(severity, "pool %s child %d exited %s after %ld.%06d seconds from start", child->wp->config->name, (int) pid, buf, tv2.tv_sec, (int) tv2.tv_usec);
+				zlog(severity, "pool %s child %d exited %s after %ld.%06d seconds from start", wp->config->name, (int) pid, buf, tv2.tv_sec, (int) tv2.tv_usec);
 			} else {
-				zlog(ZLOG_DEBUG, "pool %s child %d has been killed by the process management after %ld.%06d seconds from start", child->wp->config->name, (int) pid, tv2.tv_sec, (int) tv2.tv_usec);
+				zlog(ZLOG_DEBUG, "pool %s child %d has been killed by the process management after %ld.%06d seconds from start", wp->config->name, (int) pid, tv2.tv_sec, (int) tv2.tv_usec);
 			}
 
 			fpm_child_close(child, 1 /* in event_loop */);
@@ -317,7 +317,7 @@
 		return 0;
 	}
 
-	if (0 > fpm_scoreboard_proc_alloc(wp->scoreboard, &c->scoreboard_i)) {
+	if (0 > fpm_scoreboard_proc_alloc(c)) {
 		fpm_stdio_discard_pipes(c);
 		fpm_child_free(c);
 		return 0;
@@ -329,7 +329,7 @@
 
 static void fpm_resources_discard(struct fpm_child_s *child) /* {{{ */
 {
-	fpm_scoreboard_proc_free(child->wp->scoreboard, child->scoreboard_i);
+	fpm_scoreboard_proc_free(child);
 	fpm_stdio_discard_pipes(child);
 	fpm_child_free(child);
 }
@@ -342,10 +342,10 @@
 		if (wp == child->wp) {
 			continue;
 		}
-		fpm_scoreboard_free(wp->scoreboard);
+		fpm_scoreboard_free(wp);
 	}
 
-	fpm_scoreboard_child_use(child->wp->scoreboard, child->scoreboard_i, getpid());
+	fpm_scoreboard_child_use(child, getpid());
 	fpm_stdio_child_use_pipes(child);
 	fpm_child_free(child);
 }

php-5.6.40.tar.xz/sapi/fpm/fpm/fpm_main.c Changed

php-5.6.40.tar.xz/sapi/fpm/fpm/fpm_request.c Changed

php-5.6.40.tar.xz/sapi/fpm/fpm/fpm_scoreboard.c Changed

@@ -8,6 +8,7 @@
 #include <time.h>
 
 #include "fpm_config.h"
+#include "fpm_children.h"
 #include "fpm_scoreboard.h"
 #include "fpm_shm.h"
 #include "fpm_sockets.h"
@@ -25,7 +26,6 @@
 int fpm_scoreboard_init_main() /* {{{ */
 {
 	struct fpm_worker_pool_s *wp;
-	unsigned int i;
 
 #ifdef HAVE_TIMES
 #if (defined(HAVE_SYSCONF) && defined(_SC_CLK_TCK))
@@ -42,7 +42,7 @@
 
 
 	for (wp = fpm_worker_all_pools; wp; wp = wp->next) {
-		size_t scoreboard_size, scoreboard_nprocs_size;
+		size_t scoreboard_procs_size;
 		void *shm_mem;
 
 		if (wp->config->pm_max_children < 1) {
@@ -55,22 +55,15 @@
 			return -1;
 		}
 
-		scoreboard_size        = sizeof(struct fpm_scoreboard_s) + (wp->config->pm_max_children) * sizeof(struct fpm_scoreboard_proc_s *);
-		scoreboard_nprocs_size = sizeof(struct fpm_scoreboard_proc_s) * wp->config->pm_max_children;
-		shm_mem                = fpm_shm_alloc(scoreboard_size + scoreboard_nprocs_size);
+		scoreboard_procs_size = sizeof(struct fpm_scoreboard_proc_s) * wp->config->pm_max_children;
+		shm_mem = fpm_shm_alloc(sizeof(struct fpm_scoreboard_s) + scoreboard_procs_size);
 
 		if (!shm_mem) {
 			return -1;
 		}
-		wp->scoreboard         = shm_mem;
+		wp->scoreboard = shm_mem;
+		wp->scoreboard->pm = wp->config->pm;
 		wp->scoreboard->nprocs = wp->config->pm_max_children;
-		shm_mem               += scoreboard_size;
-
-		for (i = 0; i < wp->scoreboard->nprocs; i++, shm_mem += sizeof(struct fpm_scoreboard_proc_s)) {
-			wp->scoreboard->procsi = shm_mem;
-		}
-
-		wp->scoreboard->pm          = wp->config->pm;
 		wp->scoreboard->start_epoch = time(NULL);
 		strlcpy(wp->scoreboard->pool, wp->config->name, sizeof(wp->scoreboard->pool));
 	}
@@ -164,28 +157,47 @@
 }
 /* }}} */
 
-struct fpm_scoreboard_proc_s *fpm_scoreboard_proc_get(struct fpm_scoreboard_s *scoreboard, int child_index) /* {{{*/
+static inline struct fpm_scoreboard_proc_s *fpm_scoreboard_proc_get_ex(
+		struct fpm_scoreboard_s *scoreboard, int child_index, unsigned int nprocs) /* {{{*/
 {
 	if (!scoreboard) {
-		scoreboard = fpm_scoreboard;
+		return NULL;
 	}
 
-	if (!scoreboard) {
+	if (child_index < 0 || (unsigned int)child_index >= nprocs) {
 		return NULL;
 	}
 
+	return &scoreboard->procschild_index;
+}
+/* }}} */
+
+struct fpm_scoreboard_proc_s *fpm_scoreboard_proc_get(
+		struct fpm_scoreboard_s *scoreboard, int child_index) /* {{{*/
+{
+	if (!scoreboard) {
+		scoreboard = fpm_scoreboard;
+	}
+
 	if (child_index < 0) {
 		child_index = fpm_scoreboard_i;
 	}
 
-	if (child_index < 0 || child_index >= scoreboard->nprocs) {
-		return NULL;
-	}
+	return fpm_scoreboard_proc_get_ex(scoreboard, child_index, scoreboard->nprocs);
+}
+
+struct fpm_scoreboard_proc_s *fpm_scoreboard_proc_get_from_child(struct fpm_child_s *child) /* {{{*/
+{
+	struct fpm_worker_pool_s *wp = child->wp;
+	unsigned int nprocs = wp->config->pm_max_children;
+	struct fpm_scoreboard_s *scoreboard = wp->scoreboard;
+	int child_index = child->scoreboard_i;
 
-	return scoreboard->procschild_index;
+	return fpm_scoreboard_proc_get_ex(scoreboard, child_index, nprocs);
 }
 /* }}} */
 
+
 struct fpm_scoreboard_s *fpm_scoreboard_acquire(struct fpm_scoreboard_s *scoreboard, int nohang) /* {{{ */
 {
 	struct fpm_scoreboard_s *s;
@@ -236,28 +248,28 @@
 	proc->lock = 0;
 }
 
-void fpm_scoreboard_free(struct fpm_scoreboard_s *scoreboard) /* {{{ */
+void fpm_scoreboard_free(struct fpm_worker_pool_s *wp) /* {{{ */
 {
-	size_t scoreboard_size, scoreboard_nprocs_size;
+	size_t scoreboard_procs_size;
+	struct fpm_scoreboard_s *scoreboard = wp->scoreboard;
 
 	if (!scoreboard) {
 		zlog(ZLOG_ERROR, "**scoreboard is NULL");
 		return;
 	}
 
-	scoreboard_size        = sizeof(struct fpm_scoreboard_s) + (scoreboard->nprocs) * sizeof(struct fpm_scoreboard_proc_s *);
-	scoreboard_nprocs_size = sizeof(struct fpm_scoreboard_proc_s) * scoreboard->nprocs;
-	
-	fpm_shm_free(scoreboard, scoreboard_size + scoreboard_nprocs_size);
+	scoreboard_procs_size = sizeof(struct fpm_scoreboard_proc_s) * wp->config->pm_max_children;
+
+	fpm_shm_free(scoreboard, sizeof(struct fpm_scoreboard_s) + scoreboard_procs_size);
 }
 /* }}} */
 
-void fpm_scoreboard_child_use(struct fpm_scoreboard_s *scoreboard, int child_index, pid_t pid) /* {{{ */
+void fpm_scoreboard_child_use(struct fpm_child_s *child, pid_t pid) /* {{{ */
 {
 	struct fpm_scoreboard_proc_s *proc;
-	fpm_scoreboard = scoreboard;
-	fpm_scoreboard_i = child_index;
-	proc = fpm_scoreboard_proc_get(scoreboard, child_index);
+	fpm_scoreboard = child->wp->scoreboard;
+	fpm_scoreboard_i = child->scoreboard_i;
+	proc = fpm_scoreboard_proc_get_from_child(child);
 	if (!proc) {
 		return;
 	}
@@ -266,18 +278,22 @@
 }
 /* }}} */
 
-void fpm_scoreboard_proc_free(struct fpm_scoreboard_s *scoreboard, int child_index) /* {{{ */
+void fpm_scoreboard_proc_free(struct fpm_child_s *child) /* {{{ */
 {
+	struct fpm_worker_pool_s *wp = child->wp;
+	struct fpm_scoreboard_s *scoreboard = wp->scoreboard;
+	int child_index = child->scoreboard_i;
+
 	if (!scoreboard) {
 		return;
 	}
 
-	if (child_index < 0 || child_index >= scoreboard->nprocs) {
+	if (child_index < 0 || child_index >= wp->config->pm_max_children) {
 		return;
 	}
 
-	if (scoreboard->procschild_index && scoreboard->procschild_index->used > 0) {
-		memset(scoreboard->procschild_index, 0, sizeof(struct fpm_scoreboard_proc_s));
+	if (scoreboard->procschild_index.used > 0) {
+		memset(&scoreboard->procschild_index, 0, sizeof(struct fpm_scoreboard_proc_s));
 	}
 
 	/* set this slot as free to avoid search on next alloc */
@@ -285,41 +301,44 @@
 }
 /* }}} */
 
-int fpm_scoreboard_proc_alloc(struct fpm_scoreboard_s *scoreboard, int *child_index) /* {{{ */
+int fpm_scoreboard_proc_alloc(struct fpm_child_s *child) /* {{{ */
 {
 	int i = -1;
+	struct fpm_worker_pool_s *wp = child->wp;
+	struct fpm_scoreboard_s *scoreboard = wp->scoreboard;
+	int nprocs = wp->config->pm_max_children;
 
-	if (!scoreboard || !child_index) {
+	if (!scoreboard) {
 		return -1;
 	}
 
 	/* first try the slot which is supposed to be free */
-	if (scoreboard->free_proc >= 0 && scoreboard->free_proc < scoreboard->nprocs) {
-		if (scoreboard->procsscoreboard->free_proc && !scoreboard->procsscoreboard->free_proc->used) {
+	if (scoreboard->free_proc >= 0 && scoreboard->free_proc < nprocs) {
+		if (!scoreboard->procsscoreboard->free_proc.used) {
 			i = scoreboard->free_proc;
 		}
 	}
 
 	if (i < 0) { /* the supposed free slot is not, let's search for a free slot */

php-5.6.40.tar.xz/sapi/fpm/fpm/fpm_scoreboard.h Changed

@@ -65,7 +65,7 @@
 	unsigned int nprocs;
 	int free_proc;
 	unsigned long int slow_rq;
-	struct fpm_scoreboard_proc_s *procs;
+	struct fpm_scoreboard_proc_s procs;
 };
 
 int fpm_scoreboard_init_main();
@@ -74,18 +74,19 @@
 void fpm_scoreboard_update(int idle, int active, int lq, int lq_len, int requests, int max_children_reached, int slow_rq, int action, struct fpm_scoreboard_s *scoreboard);
 struct fpm_scoreboard_s *fpm_scoreboard_get();
 struct fpm_scoreboard_proc_s *fpm_scoreboard_proc_get(struct fpm_scoreboard_s *scoreboard, int child_index);
+struct fpm_scoreboard_proc_s *fpm_scoreboard_proc_get_from_child(struct fpm_child_s *child);
 
 struct fpm_scoreboard_s *fpm_scoreboard_acquire(struct fpm_scoreboard_s *scoreboard, int nohang);
 void fpm_scoreboard_release(struct fpm_scoreboard_s *scoreboard);
 struct fpm_scoreboard_proc_s *fpm_scoreboard_proc_acquire(struct fpm_scoreboard_s *scoreboard, int child_index, int nohang);
 void fpm_scoreboard_proc_release(struct fpm_scoreboard_proc_s *proc);
 
-void fpm_scoreboard_free(struct fpm_scoreboard_s *scoreboard);
+void fpm_scoreboard_free(struct fpm_worker_pool_s *wp);
 
-void fpm_scoreboard_child_use(struct fpm_scoreboard_s *scoreboard, int child_index, pid_t pid);
+void fpm_scoreboard_child_use(struct fpm_child_s *child, pid_t pid);
 
-void fpm_scoreboard_proc_free(struct fpm_scoreboard_s *scoreboard, int child_index);
-int fpm_scoreboard_proc_alloc(struct fpm_scoreboard_s *scoreboard, int *child_index);
+void fpm_scoreboard_proc_free(struct fpm_child_s *child);
+int fpm_scoreboard_proc_alloc(struct fpm_child_s *child);
 
 #ifdef HAVE_TIMES
 float fpm_scoreboard_get_tick();

php-5.6.40.tar.xz/sapi/fpm/fpm/fpm_status.c Changed

@@ -384,8 +384,8 @@
 		/* no need to test the var 'full' */
 		if (full_syntax) {
 			int i, first;
-			size_t len;
-			char *query_string;
+			size_t len, len_uri;
+			char *query_string, *request_uri_string;
 			struct timeval duration, now;
 #ifdef HAVE_FPM_LQ
 			float cpu;
@@ -399,10 +399,10 @@
 
 			first = 1;
 			for (i=0; i<scoreboard_p->nprocs; i++) {
-				if (!scoreboard_p->procsi || !scoreboard_p->procsi->used) {
+				if (!scoreboard_p->procsi.used) {
 					continue;
 				}
-				proc = *scoreboard_p->procsi;
+				proc = scoreboard_p->procsi;
 
 				if (first) {
 					first = 0;
@@ -412,13 +412,22 @@
 					}
 				}
 
+				request_uri_string = NULL;
+				len_uri = 0;
+				if (proc.request_uri0 != '\0') {
+					if (!encode) {
+						request_uri_string = proc.request_uri;
+					} else {
+						request_uri_string = php_escape_html_entities_ex((unsigned char *)proc.request_uri, strlen(proc.request_uri), &len_uri, 1, ENT_DISALLOWED | ENT_HTML_DOC_XML1 | ENT_COMPAT, NULL, 1 TSRMLS_CC);
+					}
+				}
 				query_string = NULL;
 				len = 0;
 				if (proc.query_string0 != '\0') {
 					if (!encode) {
 						query_string = proc.query_string;
 					} else {
-						query_string = php_escape_html_entities_ex((unsigned char *)proc.query_string, strlen(proc.query_string), &len, 1, ENT_HTML_IGNORE_ERRORS & ENT_COMPAT, NULL, 1 TSRMLS_CC);
+						query_string = php_escape_html_entities_ex((unsigned char *)proc.query_string, strlen(proc.query_string), &len, 1, ENT_DISALLOWED | ENT_HTML_DOC_XML1 | ENT_COMPAT, NULL, 1 TSRMLS_CC);
 					}
 				}
 
@@ -445,7 +454,7 @@
 					proc.requests,
 					duration.tv_sec * 1000000UL + duration.tv_usec,
 					proc.request_method0 != '\0' ? proc.request_method : "-",
-					proc.request_uri0 != '\0' ? proc.request_uri : "-",
+					request_uri_string ? request_uri_string: "-",
 					query_string ? "?" : "",
 					query_string ? query_string : "",
 					proc.content_length,
@@ -461,6 +470,9 @@
 				if (len > 0 && query_string) {
 					efree(query_string);
 				}
+				if (len_uri > 0 && request_uri_string) {
+					efree(request_uri_string);
+				}
 			}
 
 			if (full_post) {

php-5.6.40.tar.xz/sapi/fpm/fpm/fpm_worker_pool.c Changed

php-5.6.40.tar.xz/sapi/fpm/tests/ghsa-7qg2-v9fj-4mwv-status-xss.phpt Added

@@ -0,0 +1,62 @@
+--TEST--
+FPM: GHSA-7qg2-v9fj-4mwv - status xss
+--SKIPIF--
+<?php include "skipif.inc"; ?>
+--FILE--
+<?php
+
+include "include.inc";
+
+$logfile = dirname(__FILE__).'/php-fpm.log.tmp';
+$port = 9000+PHP_INT_SIZE;
+
+$cfg = <<<EOT
+global
+error_log = $logfile
+unconfined
+listen = 127.0.0.1:$port
+pm.status_path = /status
+pm = dynamic
+pm.max_children = 5
+pm.start_servers = 2
+pm.min_spare_servers = 2
+pm.max_spare_servers = 3
+EOT;
+
+$fpm = run_fpm($cfg, $tail);
+if (is_resource($fpm)) {
+    fpm_display_log($tail, 2);
+    try {
+
+		$html = run_request('127.0.0.1', $port, '/<script>alert(1)</script>', '<script>alert(2)</script>');
+
+		$html = run_request('127.0.0.1', $port, '/status', 'full&html');
+		var_dump(strpos($html, 'text/html') && strpos($html, 'DOCTYPE') && strpos($html, 'PHP-FPM Status Page'));
+
+		// output only if script present but not escaped
+		if (strpos($html, 'alert') && strpos($html, '<script>')) {
+			var_dump($html);
+		}
+
+		echo "IPv4 ok\n";
+	} catch (Exception $e) {
+		echo "IPv4 error\n";
+	}
+
+	proc_terminate($fpm);
+    stream_get_contents($tail);
+    fclose($tail);
+    proc_close($fpm);
+}
+
+?>
+--EXPECTF--
+%d-%s-%d %d:%d:%d NOTICE: fpm is running, pid %d
+%d-%s-%d %d:%d:%d NOTICE: ready to handle connections
+bool(true)
+IPv4 ok
+--CLEAN--
+<?php
+    $logfile = dirname(__FILE__).'/php-fpm.log.tmp';
+    @unlink($logfile);
+?>

php-5.6.40.tar.xz/sapi/tests Deleted

php-5.6.40.tar.xz/sapi/tests/test001.phpt Deleted

php-5.6.40.tar.xz/sapi/tests/test002.phpt Deleted

php-5.6.40.tar.xz/sapi/tests/test003.phpt Deleted

php-5.6.40.tar.xz/sapi/tests/test004.phpt Deleted

php-5.6.40.tar.xz/sapi/tests/test005.phpt Deleted

php-5.6.40.tar.xz/sapi/tests/test006.phpt Deleted

@@ -1,73 +0,0 @@
---TEST--
-Multipart Form POST Data
---HEADERS--
-return <<<END
-Content-Type=multipart/form-data; boundary=---------------------------240723202011929
-Content-Length=862
-END;
---ENV--
-return <<<END
-CONTENT_TYPE=multipart/form-data; boundary=---------------------------240723202011929
-CONTENT_LENGTH=862
-END;
---POST--
------------------------------240723202011929
-Content-Disposition: form-data; name="entry"
-
-entry box
------------------------------240723202011929
-Content-Disposition: form-data; name="password"
-
-password box
------------------------------240723202011929
-Content-Disposition: form-data; name="radio1"
-
-test 1
------------------------------240723202011929
-Content-Disposition: form-data; name="checkbox1"
-
-test 1
------------------------------240723202011929
-Content-Disposition: form-data; name="choices"
-
-Choice 1
------------------------------240723202011929
-Content-Disposition: form-data; name="choices"
-
-Choice 2
------------------------------240723202011929
-Content-Disposition: form-data; name="file"; filename="info.php"
-Content-Type: application/octet-stream
-
-<?php
-phpinfo();
-?>
------------------------------240723202011929--
-
---FILE--
-<?php 
-error_reporting(0);
-print_r($_POST);
-print_r($_FILES);
-?>
---EXPECTF--
-Array
-(
-    entry => entry box
-    password => password box
-    radio1 => test 1
-    checkbox1 => test 1
-    choices => Choice 2
-)
-Array
-(
-    file => Array
-        (
-            name => info.php
-            type => application/octet-stream
-            tmp_name => %s
-            error => 0
-            size => 21
-        )
-
-)

php-5.6.40.tar.xz/sapi/tests/test007.phpt Deleted

@@ -1,46 +0,0 @@
---TEST--
-Multipart Form POST Data, incorrect content length
---HEADERS--
-return <<<END
-Content-Type=multipart/form-data; boundary=---------------------------240723202011929
-Content-Length=100
-END;
---POST--
------------------------------240723202011929
-Content-Disposition: form-data; name="entry"
-
-entry box
------------------------------240723202011929
-Content-Disposition: form-data; name="password"
-
-password box
------------------------------240723202011929
-Content-Disposition: form-data; name="radio1"
-
-test 1
------------------------------240723202011929
-Content-Disposition: form-data; name="checkbox1"
-
-test 1
------------------------------240723202011929
-Content-Disposition: form-data; name="choices"
-
-Choice 1
------------------------------240723202011929
-Content-Disposition: form-data; name="choices"
-
-Choice 2
------------------------------240723202011929
-Content-Disposition: form-data; name="file"; filename="info.php"
-Content-Type: application/octet-stream
-
-<?php
-phpinfo();
-?>
------------------------------240723202011929--
-
---FILE--
-<?php 
-print @$_POST'choices';
-?>
---EXPECT--

php-5.6.40.tar.xz/tests/basic/022.phpt Changed

php-5.6.40.tar.xz/tests/basic/023.phpt Changed

php-5.6.40.tar.xz/tests/basic/GHSA-9pqp-7h25-4f32.inc Added

php-5.6.40.tar.xz/tests/basic/GHSA-9pqp-7h25-4f32.phpt Added

@@ -0,0 +1,104 @@
+--TEST--
+GHSA-9pqp-7h25-4f32
+--SKIPIF--
+<?php
+if (!getenv('TEST_PHP_CGI_EXECUTABLE')) {
+    die("skip php-cgi not available");
+}
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+    die("skip not for Windows in CI - probably resource issue");
+}
+?>
+--FILE--
+<?php
+
+const FILLUNIT = 5 * 1024;
+
+function test($boundaryLen) {
+    printf("Boundary len: %d\n", $boundaryLen);
+
+    $cmd = 
+        getenv('TEST_PHP_CGI_EXECUTABLE'),
+        '-C',
+        '-n',
+        '-dlog_errors=1',
+        __DIR__ . '/GHSA-9pqp-7h25-4f32.inc',
+    ;
+    $cmd = implode(' ', $cmd);
+
+    $boundary = str_repeat('A', $boundaryLen);
+    $body = ""
+        . "--$boundary\r\n"
+        . "Content-Disposition: form-data; name=\"koko\"\r\n"
+        . "\r\n"
+        . "BBB\r\n--" . substr($boundary, 0, -1) . "CCC\r\n"
+        . "--$boundary--\r\n"
+        ;
+
+    $env = array_merge($_ENV, 
+        'REDIRECT_STATUS' => '1',
+        'CONTENT_TYPE' => "multipart/form-data; boundary=$boundary",
+        'CONTENT_LENGTH' => strlen($body),
+        'REQUEST_METHOD' => 'POST',
+        'SCRIPT_FILENAME' => __DIR__ . '/GHSA-9pqp-7h25-4f32.inc',
+    );
+
+    $spec = 
+        0 => 'pipe', 'r',
+        1 => STDOUT,
+        2 => STDOUT,
+    ;
+
+    $pipes = ;
+
+    print "Starting...\n";
+
+    $handle = proc_open($cmd, $spec, $pipes, getcwd(), $env);
+
+    fwrite($pipes0, $body);
+
+    $status = proc_close($handle);
+
+    print "\n";
+}
+
+for ($offset = -1; $offset <= 1; $offset++) {
+    test(FILLUNIT - strlen("\r\n--") + $offset);
+}
+
+?>
+--EXPECTF--
+Boundary len: 5115
+Starting...
+X-Powered-By: %s
+Content-type: text/html; charset=UTF-8
+
+Hello world
+array(1) {
+  "koko"=>
+  string(5124) "BBB
+--AAA%sCCC"
+}
+
+Boundary len: 5116
+Starting...
+X-Powered-By: %s
+Content-type: text/html; charset=UTF-8
+
+Hello world
+array(1) {
+  "koko"=>
+  string(5125) "BBB
+--AAA%sCCC"
+}
+
+Boundary len: 5117
+Starting...
+PHP Warning:  Boundary too large in multipart/form-data POST data in Unknown on line 0
+X-Powered-By: %s
+Content-type: text/html; charset=UTF-8
+
+Hello world
+array(0) {
+}
+

php-5.6.40.tar.xz/tests/basic/bug79699.phpt Added

php-5.6.40.tar.xz/win32/build/Makefile Changed

php-5.6.40.tar.xz/win32/build/confutils.js Changed

@@ -2320,3 +2320,25 @@
 	ARG_ENABLE('one-shot', 'Optimize for fast build - best for release and snapshot builders, not so hot for edit-and-rebuild hacking', 'no');
 }
 
+function SETUP_OPENSSL(target, path_to_check, common_name, use_env, add_dir_part, add_to_flag_only)
+{
+	var ret = 0;
+	var cflags_var = "CFLAGS_" + target.toUpperCase();
+
+	if (CHECK_LIB("libcrypto.lib", target, path_to_check) &&
+			CHECK_LIB("libssl.lib", target, path_to_check) &&
+			CHECK_LIB("crypt32.lib", target, path_to_check, common_name) &&
+			CHECK_HEADER_ADD_INCLUDE("openssl/ssl.h", cflags_var, path_to_check, use_env, add_dir_part, add_to_flag_only)) {
+		/* Openssl 1.1.x */
+		return 2;
+	} else if (CHECK_LIB("ssleay32.lib", target, path_to_check, common_name) &&
+			CHECK_LIB("libeay32.lib", target, path_to_check, common_name) &&
+			CHECK_LIB("crypt32.lib", target, path_to_check, common_name) &&
+			CHECK_HEADER_ADD_INCLUDE("openssl/ssl.h", cflags_var, path_to_check, use_env, add_dir_part, add_to_flag_only)) {
+		/* Openssl 1.0.x and lower */
+		return 1;
+	}
+
+	return ret;
+}
+

php5.keyring Deleted

@@ -1,30 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v2
-
-mQENBFLVC7IBCADuliK8f77e1nnCyfegYfzwW2+CiAiuA0niFMDZWlnuEBNSW6WH
-hkEi66Ct0V8uRyjFgmqx862dpbc/Z2rnQ/TWxDtHbGRxjXbGPlmNliwU6jJQGX+Q
-nQc3b4b/ilIvOyoeY0ULIeOxuWnCmpP7ts/NDncNf+YpKeGg3dx/WA+YM+sMvByX
-RC532Mw0/omq2gpW7q7krDkD7rvWI1fgAcx/72I4T5CrkYKJynaq2JII/KA9nafu
-E9B4+U+qatT3BAkDD1afir+0JzD9uOWFrnqLZ3BqPhLzdAeb9CLvFlnkhg594269
-MOJiN9JM+XD1w+bjfLTWSOrgv+JZt29NlbZhABEBAAG0HkZlcmVuYyBLb3ZhY3Mg
-PHR5cmFlbEBwaHAubmV0PokBPgQTAQIAKAUCUtULsgIbAwUJC0c1AAYLCQgHAwIG
-FQgCCQoLBBYCAwECHgECF4AACgkQwr8LxDPPyLNrIQf+Ok5cr4fNSG+OHUMoux6M
-W7hqhOKMWtOan2UcT1caErDH2PkZN2UVb2oRnvGjaHBG9S7EnjnFEWmxqDlijoAQ
-mjzEzT9i8c+jf7H8hpkvTnLx89CMyo9ZnwNi4dM59knvjuDIg5JNz0PYFavzwnld
-BpdL0uLQ7+jP0kXIK+pix0WW6nms+FZy1zrizMnkNljyPGC+aN+13PQs7HZ7j0Kd
-bVSf1dbJJY37bTdrFu6RhN1bc7K8WcuhEOz2Zco7QlDhBjdrYrzqr8KtdkqUmdzS
-knP6iWE9RARG3id9ME+fyagUa7fHkdG7M27Kc34n+4WNGrVk+p+/MpjmTlGQ5TAR
-abkBDQRS1QuyAQgAtGyvTTATvwtIiOMfkt2oDGfWJ/D8Tii3XfL7dokBsDpepCpU
-FSDySIv9knuOJbqfxkVGdWqmaxcCtwssfWUYzNnmfoEmvvW4+MIfgRM4N1sS3hT+
-KAo+K3hnX+hgqRcbmlriJSaS8gVqS92bHwQBzKVPIE/ZndZrkH/cTCeXmovaKfKA
-h2AC1ZBum5ICao0ODmrOzRto9ULslJenoRuq4on6eRaDMxwnhlLdLV934v0zxt0L
-xgSD42j9x8s7sGkDROim3uJy7pbaIX+YQtq/6W1501v1sxmTusoLMmz0cWkrog0n
-meOTo4dzSzzZI1o67Oa0maAI/3phBhOsDstKSQARAQABiQElBBgBAgAPBQJS1Quy
-AhsMBQkLRzUAAAoJEMK/C8Qzz8izyGQIAM00QuGxbiznYKLgxmKPf5WyTEa+P9Wx
-at7+h1O4px1ZYWo0V2odMXRLRVm3JSMYhbFi6ed636BUpIPzB43WKjve+4S+Sg64
-ABFKzvGvJXHyPrdGZ5INvO39o2iPzIWGynaZ1hYEI5gQ73gHxGhTpT/EwDS+vFl8
-AJha9v3T67lOYpvUKqbdgnx4UQ1JlKjRB3GRYUkhccqPMsnYvE7qx7fm/sfaK1+V
-oyt61t3OYimCuEn8+kK6YMsj1nSjjdcTVy++xPkCrwl9/bNfpD+V4ANfDqbvATxy
-W9+9L/Fxlv4N43qpp9vhUtNnodrFtPdqck2742+FAVJN8F/CkKGx4J8=
-=qFlp
------END PGP PUBLIC KEY BLOCK-----

Changes of Revision 10