Skip to content

Commit d4cfc15

Browse files
weltlingweltling
committed
Merge remote-tracking branch 'origin/PHP-5.6' into str_size_and_int64_56_backport
* origin/PHP-5.6: (24 commits) drop exec perm on doc files fix test for 5.4/5.5 add test for previous fix NEWS NEWS NEWS Fix regression introduce in fix for bug #67118 update news update NEWS Fix tests Fix possible segfault depending on memory location... fix gcov data with some locales (again) fix gcov data with some locales (again) Update NEWS Fixed startup segfault in non-debug builds Fixes issue php#87 Fixed regression introduced by patch for bug #67072 Fixed bug #67329 fileinfo: NULL pointer deference flaw by processing certain CDF files (re)add cve number in NEWS, from 5.4.29 NEWS NEWS ... Conflicts: ext/date/php_date.c
2 parents 4dc952b + 6a5d5d1 commit d4cfc15

File tree

16 files changed

+194
-66
lines changed

16 files changed

+194
-66
lines changed

‎Makefile.gcov

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ php_lcov.info: lcov-test
1414
@rm -rf lcov_data/
1515
@$(mkinstalldirs) lcov_data/
1616
@echo
17-
-@files=`find . -name \*.gcda -o -name \*.gcno -o -name \*.da -o -name \*.c -o -name \*.h | sed -e 's/^\.\///' | sed -e 's/\.gcda//g' -e 's/\.gcno//g' -e 's/\.da//g' | $(EGREP) $(LCOV_INCLUDE) | sed -e 's/.libs/ZZZZ/g' | sort -h | sed -e 's/ZZZZ/.libs/g' | uniq` ;\
17+
-@files=`find . -name \*.gcda -o -name \*.gcno -o -name \*.da -o -name \*.c -o -name \*.h | sed -e 's/^\.\///' | sed -e 's/\.gcda//g' -e 's/\.gcno//g' -e 's/\.da//g' | $(EGREP) $(LCOV_INCLUDE) | sed -e 's/.libs/zzzz/g' | sort | sed -e 's/zzzz/.libs/g' | uniq` ;\
1818
for x in $$files; do \
1919
echo -n . ;\
2020
y=`echo $$x | sed -e 's!\.libs/!!'`; \

‎NEWS

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,34 @@
11
PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
3-
?? ??? 2014, PHP 5.6.0 Beta 4
3+
?? ??? 2014, PHP 5.6.0 Release Candidate 1
4+
5+
05 Jun 2014, PHP 5.6.0 Beta 4
46

57
- Core:
68
. Fixed bug #67249 (printf out-of-bounds read). (Stas)
79

810
- Date:
911
. Fixed bug #67308 (Serialize of DateTime truncates fractions of second).
1012
(Adam)
13+
. Fixed regression in fix for bug #67118 (constructor can't be called twice).
14+
(Remi)
15+
1116

1217
- Fileinfo:
1318
. Fixed bug #67327 (fileinfo: CDF infinite loop in nelements DoS).
1419
. Fixed bug #67328 (fileinfo: fileinfo: numerous file_printf calls resulting in
1520
performance degradation).
21+
. Fixed bug #67326 (fileinfo: cdf_read_short_sector insufficient boundary check).
22+
. Fixed bug #67329 (fileinfo: NULL pointer deference flaw by processing certain
23+
CDF files).
1624

1725
- SPL:
1826
. Fixed bug #67359 (Segfault in recursiveDirectoryIterator). (Laruence)
1927

28+
- phpdbg:
29+
. Fixed bug which caused phpdbg to fail immediately on startup in non-debug
30+
builds. (Bob)
31+
2032
15 May 2014, PHP 5.6.0 Beta 3
2133

2234
- Core:

‎README.namespaces

100755100644
File mode changed.

‎UPGRADING

100755100644
File mode changed.

‎ext/date/php_date.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2569,6 +2569,8 @@ PHPAPI int php_date_initialize(php_date_obj *dateobj, /*const*/ char *time_str,
25692569
err->error_messages[0].position, err->error_messages[0].character, err->error_messages[0].message);
25702570
}
25712571
if (err && err->error_count) {
2572+
timelib_time_dtor(dateobj->time);
2573+
dateobj->time = 0;
25722574
return 0;
25732575
}
25742576

@@ -2716,9 +2718,7 @@ PHP_METHOD(DateTime, __construct)
27162718

27172719
zend_replace_error_handling(EH_THROW, NULL, &error_handling TSRMLS_CC);
27182720
if (SUCCESS == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|SO!", &time_str, &time_str_len, &timezone_object, date_ce_timezone)) {
2719-
if (!php_date_initialize(zend_object_store_get_object(getThis() TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 1 TSRMLS_CC)) {
2720-
ZVAL_NULL(getThis());
2721-
}
2721+
php_date_initialize(zend_object_store_get_object(getThis() TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 1 TSRMLS_CC);
27222722
}
27232723
zend_restore_error_handling(&error_handling TSRMLS_CC);
27242724
}

‎ext/date/tests/bug67118.phpt

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
--TEST--
2-
Bug #67118 php-cgi crashes regularly on IIS 7
2+
Bug #67118 crashes in DateTime when this used after failed __construct
33
--INI--
44
date.timezone=Europe/Berlin
55
--FILE--
@@ -11,17 +11,17 @@ class mydt extends datetime
1111
if (!empty($tz) && !is_object($tz)) {
1212
$tz = new DateTimeZone($tz);
1313
}
14-
15-
@parent::__construct($time, $tz);
14+
try {
15+
@parent::__construct($time, $tz);
16+
} catch (Exception $e) {
17+
echo "Bad date" . $this->format("Y") . "\n";
18+
}
1619
}
1720

1821
};
1922

2023
new mydt("Funktionsansvarig rådgivning och juridik", "UTC");
24+
?>
2125
--EXPECTF--
22-
Fatal error: Uncaught exception 'Exception' with message 'DateTime::__construct(): Failed to parse time string (Funktionsansvarig rådgivning och juridik) at position 0 (F): The timezone could not be found in the database' in %sbug67118.php:%d
23-
Stack trace:
24-
#0 %sbug67118.php(%d): DateTime->__construct('Funktionsansvar...', Object(DateTimeZone))
25-
#1 %sbug67118.php(%d): mydt->__construct('Funktionsansvar...', 'UTC')
26-
#2 {main}
27-
thrown in %sbug67118.php on line %d
26+
Warning: DateTime::format(): The DateTime object has not been correctly initialized by its constructor in %sbug67118.php on line %d
27+
Bad date

‎ext/date/tests/bug67118_2.phpt

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
--TEST--
2+
Regression introduce in fix for Bug #67118
3+
--INI--
4+
date.timezone=Europe/Paris
5+
--FILE--
6+
<?php
7+
class Foo extends DateTime {
8+
public function __construct($time = null) {
9+
$tz = new DateTimeZone('UTC');
10+
try {
11+
echo "First try\n";
12+
parent::__construct($time, $tz);
13+
return;
14+
} catch (Exception $e) {
15+
echo "Second try\n";
16+
parent::__construct($time.'C', $tz);
17+
}
18+
}
19+
}
20+
$date = '12 Sep 2007 15:49:12 UT';
21+
var_dump(new Foo($date));
22+
?>
23+
Done
24+
--EXPECTF--
25+
First try
26+
Second try
27+
object(Foo)#1 (3) {
28+
["date"]=>
29+
string(%d) "2007-09-12 15:49:%s"
30+
["timezone_type"]=>
31+
int(3)
32+
["timezone"]=>
33+
string(3) "UTC"
34+
}
35+
Done

‎ext/fileinfo/libmagic/cdf.c

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
#include "file.h"
3636

3737
#ifndef lint
38-
FILE_RCSID("@(#)$File: cdf.c,v 1.53 2013/02/26 16:20:42 christos Exp $")
38+
FILE_RCSID("@(#)$File: cdf.c,v 1.55 2014/02/27 23:26:17 christos Exp $")
3939
#endif
4040

4141
#include <assert.h>
@@ -365,10 +365,10 @@ cdf_read_short_sector(const cdf_stream_t *sst, void *buf, size_t offs,
365365
size_t ss = CDF_SHORT_SEC_SIZE(h);
366366
size_t pos = CDF_SHORT_SEC_POS(h, id);
367367
assert(ss == len);
368-
if (pos > CDF_SEC_SIZE(h) * sst->sst_len) {
368+
if (pos + len > CDF_SEC_SIZE(h) * sst->sst_len) {
369369
DPRINTF(("Out of bounds read %" SIZE_T_FORMAT "u > %"
370370
SIZE_T_FORMAT "u\n",
371-
pos, CDF_SEC_SIZE(h) * sst->sst_len));
371+
pos + len, CDF_SEC_SIZE(h) * sst->sst_len));
372372
return -1;
373373
}
374374
(void)memcpy(((char *)buf) + offs,
@@ -688,11 +688,13 @@ cdf_read_ssat(const cdf_info_t *info, const cdf_header_t *h,
688688

689689
int
690690
cdf_read_short_stream(const cdf_info_t *info, const cdf_header_t *h,
691-
const cdf_sat_t *sat, const cdf_dir_t *dir, cdf_stream_t *scn)
691+
const cdf_sat_t *sat, const cdf_dir_t *dir, cdf_stream_t *scn,
692+
const cdf_directory_t **root)
692693
{
693694
size_t i;
694695
const cdf_directory_t *d;
695696

697+
*root = NULL;
696698
for (i = 0; i < dir->dir_len; i++)
697699
if (dir->dir_tab[i].d_type == CDF_DIR_TYPE_ROOT_STORAGE)
698700
break;
@@ -701,6 +703,7 @@ cdf_read_short_stream(const cdf_info_t *info, const cdf_header_t *h,
701703
if (i == dir->dir_len)
702704
goto out;
703705
d = &dir->dir_tab[i];
706+
*root = d;
704707

705708
/* If the it is not there, just fake it; some docs don't have it */
706709
if (d->d_stream_first_sector < 0)

‎ext/fileinfo/libmagic/cdf.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,8 @@ int cdf_read_dir(const cdf_info_t *, const cdf_header_t *, const cdf_sat_t *,
300300
int cdf_read_ssat(const cdf_info_t *, const cdf_header_t *, const cdf_sat_t *,
301301
cdf_sat_t *);
302302
int cdf_read_short_stream(const cdf_info_t *, const cdf_header_t *,
303-
const cdf_sat_t *, const cdf_dir_t *, cdf_stream_t *);
303+
const cdf_sat_t *, const cdf_dir_t *, cdf_stream_t *,
304+
const cdf_directory_t **);
304305
int cdf_read_property_info(const cdf_stream_t *, const cdf_header_t *, uint32_t,
305306
cdf_property_info_t **, size_t *, size_t *);
306307
int cdf_read_summary_info(const cdf_info_t *, const cdf_header_t *,

‎ext/fileinfo/libmagic/readcdf.c

Lines changed: 61 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
#include "file.h"
2727

2828
#ifndef lint
29-
FILE_RCSID("@(#)$File: readcdf.c,v 1.37 2014/01/06 13:41:18 rrt Exp $")
29+
FILE_RCSID("@(#)$File: readcdf.c,v 1.40 2014/03/06 15:23:33 christos Exp $")
3030
#endif
3131

3232
#include <stdlib.h>
@@ -77,6 +77,40 @@ static const struct nv {
7777
# define strcasestr strstr
7878
#endif
7979

80+
static const struct cv {
81+
uint64_t clsid[2];
82+
const char *mime;
83+
} clsid2mime[] = {
84+
{
85+
#ifdef PHP_WIN32
86+
{ 0x00000000000c1084ui64, 0x46000000000000c0ui64 },
87+
#else
88+
{ 0x00000000000c1084LLU, 0x46000000000000c0LLU },
89+
#endif
90+
"x-msi",
91+
}
92+
}, clsid2desc[] = {
93+
{
94+
#ifdef PHP_WIN32
95+
{ 0x00000000000c1084ui64, 0x46000000000000c0ui64 },
96+
#else
97+
{ 0x00000000000c1084LLU, 0x46000000000000c0LLU },
98+
#endif
99+
"MSI Installer",
100+
},
101+
};
102+
103+
private const char *
104+
cdf_clsid_to_mime(const uint64_t clsid[2], const struct cv *cv)
105+
{
106+
size_t i;
107+
for (i = 0; cv[i].mime != NULL; i++) {
108+
if (clsid[0] == cv[i].clsid[0] && clsid[1] == cv[i].clsid[1])
109+
return cv[i].mime;
110+
}
111+
return NULL;
112+
}
113+
80114
private const char *
81115
cdf_app_to_mime(const char *vbuf, const struct nv *nv)
82116
{
@@ -95,7 +129,7 @@ cdf_app_to_mime(const char *vbuf, const struct nv *nv)
95129

96130
private int
97131
cdf_file_property_info(struct magic_set *ms, const cdf_property_info_t *info,
98-
size_t count)
132+
size_t count, const cdf_directory_t *root_storage)
99133
{
100134
size_t i;
101135
cdf_timestamp_t tp;
@@ -107,6 +141,9 @@ cdf_file_property_info(struct magic_set *ms, const cdf_property_info_t *info,
107141

108142
memset(&ts, 0, sizeof(ts));
109143

144+
if (!NOTMIME(ms) && root_storage)
145+
str = cdf_clsid_to_mime(root_storage->d_storage_uuid, clsid2mime);
146+
110147
for (i = 0; i < count; i++) {
111148
cdf_print_property_name(buf, sizeof(buf), info[i].pi_id);
112149
switch (info[i].pi_type) {
@@ -163,7 +200,7 @@ cdf_file_property_info(struct magic_set *ms, const cdf_property_info_t *info,
163200
buf, vbuf) == -1)
164201
return -1;
165202
}
166-
} else if (info[i].pi_id ==
203+
} else if (str == NULL && info[i].pi_id ==
167204
CDF_PROPERTY_NAME_OF_APPLICATION) {
168205
str = cdf_app_to_mime(vbuf, app2mime);
169206
}
@@ -217,7 +254,7 @@ cdf_file_property_info(struct magic_set *ms, const cdf_property_info_t *info,
217254

218255
private int
219256
cdf_file_summary_info(struct magic_set *ms, const cdf_header_t *h,
220-
const cdf_stream_t *sst)
257+
const cdf_stream_t *sst, const cdf_directory_t *root_storage)
221258
{
222259
cdf_summary_info_header_t si;
223260
cdf_property_info_t *info;
@@ -228,6 +265,8 @@ cdf_file_summary_info(struct magic_set *ms, const cdf_header_t *h,
228265
return -1;
229266

230267
if (NOTMIME(ms)) {
268+
const char *str;
269+
231270
if (file_printf(ms, "Composite Document File V2 Document")
232271
== -1)
233272
return -1;
@@ -255,9 +294,15 @@ cdf_file_summary_info(struct magic_set *ms, const cdf_header_t *h,
255294
return -2;
256295
break;
257296
}
258-
}
297+
if (root_storage) {
298+
str = cdf_clsid_to_mime(root_storage->d_storage_uuid, clsid2desc);
299+
if (str)
300+
if (file_printf(ms, ", %s", str) == -1)
301+
return -2;
302+
}
303+
}
259304

260-
m = cdf_file_property_info(ms, info, count);
305+
m = cdf_file_property_info(ms, info, count, root_storage);
261306
free(info);
262307

263308
return m == -1 ? -2 : m;
@@ -275,6 +320,7 @@ file_trycdf(struct magic_set *ms, int fd, const unsigned char *buf,
275320
int i;
276321
const char *expn = "";
277322
const char *corrupt = "corrupt: ";
323+
const cdf_directory_t *root_storage;
278324

279325
info.i_fd = fd;
280326
info.i_buf = buf;
@@ -308,7 +354,8 @@ file_trycdf(struct magic_set *ms, int fd, const unsigned char *buf,
308354
goto out2;
309355
}
310356

311-
if ((i = cdf_read_short_stream(&info, &h, &sat, &dir, &sst)) == -1) {
357+
if ((i = cdf_read_short_stream(&info, &h, &sat, &dir, &sst,
358+
&root_storage)) == -1) {
312359
expn = "Cannot read short stream";
313360
goto out3;
314361
}
@@ -329,23 +376,21 @@ file_trycdf(struct magic_set *ms, int fd, const unsigned char *buf,
329376
#ifdef CDF_DEBUG
330377
cdf_dump_summary_info(&h, &scn);
331378
#endif
332-
if ((i = cdf_file_summary_info(ms, &h, &scn)) < 0)
333-
expn = "Can't expand summary_info";
379+
if ((i = cdf_file_summary_info(ms, &h, &scn, root_storage)) < 0)
380+
expn = "Can't expand summary_info";
381+
334382
if (i == 0) {
335383
const char *str = NULL;
336384
cdf_directory_t *d;
337385
char name[__arraycount(d->d_name)];
338386
size_t j, k;
339-
for (j = 0; j < dir.dir_len; j++) {
387+
388+
for (j = 0; str == NULL && j < dir.dir_len; j++) {
340389
d = &dir.dir_tab[j];
341390
for (k = 0; k < sizeof(name); k++)
342391
name[k] = (char)cdf_tole2(d->d_name[k]);
343-
if (NOTMIME(ms))
344-
str = cdf_app_to_mime(name, name2desc);
345-
else
346-
str = cdf_app_to_mime(name, name2mime);
347-
if (str != NULL)
348-
break;
392+
str = cdf_app_to_mime(name,
393+
NOTMIME(ms) ? name2desc : name2mime);
349394
}
350395
if (NOTMIME(ms)) {
351396
if (str != NULL) {

0 commit comments

Comments
 (0)