From 50499fe6d7ae3fefed77c3548c163e827a03067b Mon Sep 17 00:00:00 2001 From: Sara Golemon Date: Thu, 14 Aug 2014 13:34:06 -0700 Subject: [PATCH 1/8] Add NEWS entry for log() improvements --- NEWS | 1 + 1 file changed, 1 insertion(+) diff --git a/NEWS b/NEWS index fc85b3e1a69..a5912f397d6 100644 --- a/NEWS +++ b/NEWS @@ -17,6 +17,7 @@ PHP NEWS . Removed call_user_method() and call_user_method_array() functions. (Kalle) . Fix user session handlers (See rfc:session.user.return-value). (Sara) . Added intdiv() function. (Andrea) + . Improved precision of log() function for base 2 and 10. (Marc Bennewitz) - XSL: . Fixed bug #64776 (The XSLT extension is not thread safe). (Mike) From 481c4715d4f4c77293d65216324215f671954660 Mon Sep 17 00:00:00 2001 From: Pierre Joye Date: Tue, 8 Jan 2013 15:02:04 +0100 Subject: [PATCH 2/8] - fix bug #47358, glob returns error, should be empty array() Conflicts: ext/standard/dir.c --- NEWS | 3 +++ ext/standard/dir.c | 4 +--- ext/standard/tests/file/glob_variation3.phpt | 3 ++- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/NEWS b/NEWS index 2429492cc60..a34ea04b3ae 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,9 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2014, PHP 5.4.33 +- Core: + . Fixed bug #47358 (glob returns error, should be empty array()). (Pierre) + - OpenSSL: . Fixed bug #41631 (socket timeouts not honored in blocking SSL reads) (Daniel Lowrey). diff --git a/ext/standard/dir.c b/ext/standard/dir.c index c6d6ddd2633..f39789a5c9b 100644 --- a/ext/standard/dir.c +++ b/ext/standard/dir.c @@ -492,9 +492,7 @@ PHP_FUNCTION(glob) if (!globbuf.gl_pathc || !globbuf.gl_pathv) { no_results: if (PG(open_basedir) && *PG(open_basedir)) { - struct stat s; - - if (0 != VCWD_STAT(pattern, &s) || S_IFDIR != (s.st_mode & S_IFMT)) { + if (php_check_open_basedir_ex(pattern, 0 TSRMLS_CC)) { RETURN_FALSE; } } diff --git a/ext/standard/tests/file/glob_variation3.phpt b/ext/standard/tests/file/glob_variation3.phpt index 9e1e28baf92..4f504e668c5 100644 --- a/ext/standard/tests/file/glob_variation3.phpt +++ b/ext/standard/tests/file/glob_variation3.phpt @@ -15,5 +15,6 @@ var_dump(glob("$path/*.none")); --EXPECT-- array(0) { } -bool(false) +array(0) { +} ==DONE== From ad492ca9327fc9f7f0ea7a0ddd32e62cdf0c9137 Mon Sep 17 00:00:00 2001 From: Anatol Belski Date: Mon, 19 Aug 2013 14:21:16 +0200 Subject: [PATCH 3/8] fixed glob() edge case on windows, ref bug #47358 --- ext/standard/dir.c | 7 +++ ext/standard/tests/file/glob_variation3.phpt | 50 ++++++++++++++++++++ 2 files changed, 57 insertions(+) diff --git a/ext/standard/dir.c b/ext/standard/dir.c index f39789a5c9b..c64f37c2d61 100644 --- a/ext/standard/dir.c +++ b/ext/standard/dir.c @@ -491,11 +491,18 @@ PHP_FUNCTION(glob) /* now catch the FreeBSD style of "no matches" */ if (!globbuf.gl_pathc || !globbuf.gl_pathv) { no_results: +#ifndef PHP_WIN32 + /* Paths containing '*', '?' and some other chars are + illegal on Windows but legit on other platforms. For + this reason the direct basedir check against the glob + query is senseless on windows. For instance while *.txt + is a pretty valid filename on EXT3, it's invalid on NTFS. */ if (PG(open_basedir) && *PG(open_basedir)) { if (php_check_open_basedir_ex(pattern, 0 TSRMLS_CC)) { RETURN_FALSE; } } +#endif array_init(return_value); return; } diff --git a/ext/standard/tests/file/glob_variation3.phpt b/ext/standard/tests/file/glob_variation3.phpt index 4f504e668c5..9c57ada3be2 100644 --- a/ext/standard/tests/file/glob_variation3.phpt +++ b/ext/standard/tests/file/glob_variation3.phpt @@ -6,9 +6,27 @@ $path = dirname(__FILE__); ini_set('open_basedir', NULL); var_dump(glob("$path/*.none")); +var_dump(glob("$path/?.none")); +var_dump(glob("$path/*{hello,world}.none")); +var_dump(glob("$path/*/nothere")); +var_dump(glob("$path/[aoeu]*.none")); +var_dump(glob("$path/directly_not_exists")); ini_set('open_basedir', $path); var_dump(glob("$path/*.none")); +var_dump(glob("$path/?.none")); +var_dump(glob("$path/*{hello,world}.none")); +var_dump(glob("$path/*/nothere")); +var_dump(glob("$path/[aoeu]*.none")); +var_dump(glob("$path/directly_not_exists")); + +ini_set('open_basedir', '/tmp'); +var_dump(glob("$path/*.none")); +var_dump(glob("$path/?.none")); +var_dump(glob("$path/*{hello,world}.none")); +var_dump(glob("$path/*/nothere")); +var_dump(glob("$path/[aoeu]*.none")); +var_dump(glob("$path/directly_not_exists")); ?> ==DONE== @@ -17,4 +35,36 @@ array(0) { } array(0) { } +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} ==DONE== From b7cd099ae04c926f8faedbf8c726984d9315ccb9 Mon Sep 17 00:00:00 2001 From: Anatol Belski Date: Tue, 20 Aug 2013 13:39:30 +0200 Subject: [PATCH 4/8] split the glob() test to test different basedir --- ext/standard/tests/file/glob_variation3.phpt | 41 +------------------- ext/standard/tests/file/glob_variation4.phpt | 33 ++++++++++++++++ ext/standard/tests/file/glob_variation5.phpt | 29 ++++++++++++++ ext/standard/tests/file/glob_variation6.phpt | 35 +++++++++++++++++ 4 files changed, 99 insertions(+), 39 deletions(-) create mode 100644 ext/standard/tests/file/glob_variation4.phpt create mode 100644 ext/standard/tests/file/glob_variation5.phpt create mode 100644 ext/standard/tests/file/glob_variation6.phpt diff --git a/ext/standard/tests/file/glob_variation3.phpt b/ext/standard/tests/file/glob_variation3.phpt index 9c57ada3be2..c50f8a81b80 100644 --- a/ext/standard/tests/file/glob_variation3.phpt +++ b/ext/standard/tests/file/glob_variation3.phpt @@ -5,22 +5,7 @@ Test glob() function: ensure no platform difference $path = dirname(__FILE__); ini_set('open_basedir', NULL); -var_dump(glob("$path/*.none")); -var_dump(glob("$path/?.none")); -var_dump(glob("$path/*{hello,world}.none")); -var_dump(glob("$path/*/nothere")); -var_dump(glob("$path/[aoeu]*.none")); -var_dump(glob("$path/directly_not_exists")); -ini_set('open_basedir', $path); -var_dump(glob("$path/*.none")); -var_dump(glob("$path/?.none")); -var_dump(glob("$path/*{hello,world}.none")); -var_dump(glob("$path/*/nothere")); -var_dump(glob("$path/[aoeu]*.none")); -var_dump(glob("$path/directly_not_exists")); - -ini_set('open_basedir', '/tmp'); var_dump(glob("$path/*.none")); var_dump(glob("$path/?.none")); var_dump(glob("$path/*{hello,world}.none")); @@ -28,6 +13,7 @@ var_dump(glob("$path/*/nothere")); var_dump(glob("$path/[aoeu]*.none")); var_dump(glob("$path/directly_not_exists")); +var_dump(empty(ini_get('open_basedir'))); ?> ==DONE== --EXPECT-- @@ -43,28 +29,5 @@ array(0) { } array(0) { } -array(0) { -} -array(0) { -} -array(0) { -} -array(0) { -} -array(0) { -} -array(0) { -} -array(0) { -} -array(0) { -} -array(0) { -} -array(0) { -} -array(0) { -} -array(0) { -} +bool(true) ==DONE== diff --git a/ext/standard/tests/file/glob_variation4.phpt b/ext/standard/tests/file/glob_variation4.phpt new file mode 100644 index 00000000000..00d8f648aad --- /dev/null +++ b/ext/standard/tests/file/glob_variation4.phpt @@ -0,0 +1,33 @@ +--TEST-- +Test glob() function: ensure no platform difference, variation 2 +--FILE-- + +==DONE== +--EXPECT-- +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +bool(true) +==DONE== diff --git a/ext/standard/tests/file/glob_variation5.phpt b/ext/standard/tests/file/glob_variation5.phpt new file mode 100644 index 00000000000..10db40099bc --- /dev/null +++ b/ext/standard/tests/file/glob_variation5.phpt @@ -0,0 +1,29 @@ +--TEST-- +Test glob() function: ensure no platform difference, variation 3 +--SKIPIF-- + +--FILE-- + +==DONE== +--EXPECT-- +bool(false) +bool(false) +bool(false) +bool(false) +bool(false) +bool(false) +bool(true) +==DONE== diff --git a/ext/standard/tests/file/glob_variation6.phpt b/ext/standard/tests/file/glob_variation6.phpt new file mode 100644 index 00000000000..9cd9c2b3538 --- /dev/null +++ b/ext/standard/tests/file/glob_variation6.phpt @@ -0,0 +1,35 @@ +--TEST-- +Test glob() function: ensure no platform difference, variation 4 +--SKIPIF-- + +--FILE-- + +==DONE== +--EXPECT-- +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +array(0) { +} +bool(true) +==DONE== From eab42649ab9c6d949dc8e1ba9e31124e9cfb3b1b Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Thu, 14 Aug 2014 17:07:28 -0700 Subject: [PATCH 5/8] fix test --- ext/standard/tests/file/glob_variation3.phpt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ext/standard/tests/file/glob_variation3.phpt b/ext/standard/tests/file/glob_variation3.phpt index c50f8a81b80..257b5c365e6 100644 --- a/ext/standard/tests/file/glob_variation3.phpt +++ b/ext/standard/tests/file/glob_variation3.phpt @@ -13,7 +13,8 @@ var_dump(glob("$path/*/nothere")); var_dump(glob("$path/[aoeu]*.none")); var_dump(glob("$path/directly_not_exists")); -var_dump(empty(ini_get('open_basedir'))); +$b = ini_get('open_basedir'); +var_dump(empty($b)); ?> ==DONE== --EXPECT-- From 49387b31cf8bda25a85b6932380001be03d6c8b0 Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Thu, 14 Aug 2014 17:19:03 -0700 Subject: [PATCH 6/8] Fix bug #67716 - Segfault in cdf.c --- NEWS | 11 ++++++----- ext/fileinfo/libmagic/cdf.c | 2 +- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/NEWS b/NEWS index a34ea04b3ae..1339ba8b42c 100644 --- a/NEWS +++ b/NEWS @@ -6,11 +6,11 @@ PHP NEWS . Fixed bug #47358 (glob returns error, should be empty array()). (Pierre) - OpenSSL: - . Fixed bug #41631 (socket timeouts not honored in blocking SSL reads) + . Fixed bug #41631 (socket timeouts not honored in blocking SSL reads). (Daniel Lowrey). - Date: - . Fixed bug #66091 (memory leaks in DateTime constructor) (Tjerk). + . Fixed bug #66091 (memory leaks in DateTime constructor). (Tjerk). ?? ??? 2014, PHP 5.4.32 @@ -21,11 +21,12 @@ PHP NEWS - Fileinfo: . Fixed bug #67705 (extensive backtracking in rule regular expression). - (CVE-2014-3538) (Remi) + (CVE-2014-3538). (Remi) + . Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587) (Remi) - GD: . Fixed bug #66901 (php-gd 'c_color' NULL pointer dereference). - (CVE-2014-2497) (Remi) + (CVE-2014-2497). (Remi) - Milter: . Fixed bug #67715 (php-milter does not build and crashes randomly). (Mike) @@ -40,7 +41,7 @@ PHP NEWS with control-c). (Dmitry Saprykin, Johannes) - Sessions: - . Fixed missing type checks in php_session_create_id (Yussuf Khalil, Stas). + . Fixed missing type checks in php_session_create_id. (Yussuf Khalil, Stas). - SPL: . Fixed bug #67539 (ArrayIterator use-after-free due to object change during diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c index 429f3b952f6..2c0a2d9dfcd 100644 --- a/ext/fileinfo/libmagic/cdf.c +++ b/ext/fileinfo/libmagic/cdf.c @@ -820,7 +820,7 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, q = (const uint8_t *)(const void *) ((const char *)(const void *)p + ofs - 2 * sizeof(uint32_t)); - if (q > e) { + if (q < p || q > e) { DPRINTF(("Ran of the end %p > %p\n", q, e)); goto out; } From 35f32637b08ca6397829138ed45a0768f592f262 Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Thu, 14 Aug 2014 17:19:03 -0700 Subject: [PATCH 7/8] Fix bug #67716 - Segfault in cdf.c --- NEWS | 9 +++++---- ext/fileinfo/libmagic/cdf.c | 2 +- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/NEWS b/NEWS index a34ea04b3ae..b771ce6fd55 100644 --- a/NEWS +++ b/NEWS @@ -6,11 +6,11 @@ PHP NEWS . Fixed bug #47358 (glob returns error, should be empty array()). (Pierre) - OpenSSL: - . Fixed bug #41631 (socket timeouts not honored in blocking SSL reads) + . Fixed bug #41631 (socket timeouts not honored in blocking SSL reads). (Daniel Lowrey). - Date: - . Fixed bug #66091 (memory leaks in DateTime constructor) (Tjerk). + . Fixed bug #66091 (memory leaks in DateTime constructor). (Tjerk). ?? ??? 2014, PHP 5.4.32 @@ -22,10 +22,11 @@ PHP NEWS - Fileinfo: . Fixed bug #67705 (extensive backtracking in rule regular expression). (CVE-2014-3538) (Remi) + . Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587) (Remi) - GD: . Fixed bug #66901 (php-gd 'c_color' NULL pointer dereference). - (CVE-2014-2497) (Remi) + (CVE-2014-2497). (Remi) - Milter: . Fixed bug #67715 (php-milter does not build and crashes randomly). (Mike) @@ -40,7 +41,7 @@ PHP NEWS with control-c). (Dmitry Saprykin, Johannes) - Sessions: - . Fixed missing type checks in php_session_create_id (Yussuf Khalil, Stas). + . Fixed missing type checks in php_session_create_id. (Yussuf Khalil, Stas). - SPL: . Fixed bug #67539 (ArrayIterator use-after-free due to object change during diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c index 429f3b952f6..2c0a2d9dfcd 100644 --- a/ext/fileinfo/libmagic/cdf.c +++ b/ext/fileinfo/libmagic/cdf.c @@ -820,7 +820,7 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, q = (const uint8_t *)(const void *) ((const char *)(const void *)p + ofs - 2 * sizeof(uint32_t)); - if (q > e) { + if (q < p || q > e) { DPRINTF(("Ran of the end %p > %p\n", q, e)); goto out; } From 3e6cfeed8f4c3410bbb67c45585510654e0c7425 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Thu, 14 Aug 2014 18:16:33 -0700 Subject: [PATCH 8/8] add NEWS for 5.6 too --- NEWS | 3 +++ 1 file changed, 3 insertions(+) diff --git a/NEWS b/NEWS index 3c4f90135f5..0906bc457ff 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,9 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2014, PHP 5.6.0 ??? +- Fileinfo: + . Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587) (Remi) + 14 Aug 2014, PHP 5.6.0 Release Candidate 4 - COM: