From 14c422a32fc13284cbbc6a9ae9b65cc6081dda1f Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Mon, 16 Jan 2017 12:11:50 -0800 Subject: [PATCH 1/3] Fix bug #73648 - integer overflow in substr --- ext/standard/string.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/ext/standard/string.c b/ext/standard/string.c index 8fd2c55e20e..a8b39ee6155 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -165,7 +165,7 @@ static zend_string *php_hex2bin(const unsigned char *old, const size_t oldlen) int is_letter = ((unsigned int) ((l - 'A') ^ (l - 'F' - 1))) >> (8 * sizeof(unsigned int) - 1); unsigned char d; - /* basically (c >= '0' && c <= '9') || (l >= 'A' && l <= 'F') */ + /* basically (c >= '0' && c <= '9') || (l >= 'A' && l <= 'F') */ if (EXPECTED((((c ^ '0') - 10) >> (8 * sizeof(unsigned int) - 1)) | is_letter)) { d = (l - 0x10 - 0x27 * is_letter) << 4; } else { @@ -2371,7 +2371,7 @@ PHP_FUNCTION(substr) RETURN_FALSE; } - if ((f + l) > (zend_long)ZSTR_LEN(str)) { + if ((size_t)l > ZSTR_LEN(str) - (size_t)f) { l = ZSTR_LEN(str) - f; } @@ -2842,7 +2842,7 @@ PHPAPI char *php_strtr(char *str, size_t len, char *str_from, char *str_to, size for (i = 0; i < trlen; i++) { xlat[(size_t)(unsigned char) str_from[i]] = str_to[i]; } - + for (i = 0; i < len; i++) { str[i] = xlat[(size_t)(unsigned char) str[i]]; } @@ -3235,7 +3235,7 @@ static zend_string *php_str_to_str_i_ex(zend_string *haystack, char *lc_haystack zend_string_release(lc_needle); goto nothing_todo; } - + if (str_len > ZSTR_LEN(lc_needle)) { new_str = zend_string_safe_alloc(count, str_len - ZSTR_LEN(lc_needle), ZSTR_LEN(haystack), 0); } else { @@ -3398,7 +3398,7 @@ PHP_FUNCTION(strtr) ZVAL_LONG(&tmp, num_key); convert_to_string(&tmp); str_key = Z_STR(tmp); - } + } replace = zval_get_string(entry); if (ZSTR_LEN(str_key) < 1) { RETVAL_STR_COPY(str); @@ -3961,7 +3961,7 @@ static zend_long php_str_replace_in_subject(zval *search, zval *replace, zval *s zend_string_release(lc_subject_str); lc_subject_str = NULL; } - } + } } zend_string_release(search_str); From 18b6de7a91859df736781a3ea0bd248b94a9a6df Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Mon, 16 Jan 2017 01:18:16 -0800 Subject: [PATCH 2/3] Fix bug #73634 - grapheme_strpos illegal memory access --- ext/intl/grapheme/grapheme_string.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ext/intl/grapheme/grapheme_string.c b/ext/intl/grapheme/grapheme_string.c index f69500429d7..ad75b3580bd 100644 --- a/ext/intl/grapheme/grapheme_string.c +++ b/ext/intl/grapheme/grapheme_string.c @@ -110,7 +110,8 @@ PHP_FUNCTION(grapheme_strpos) size_t haystack_len, needle_len; const char *found; zend_long loffset = 0; - int32_t offset = 0, noffset = 0; + int32_t offset = 0; + size_t noffset = 0; zend_long ret_pos; if (zend_parse_parameters(ZEND_NUM_ARGS(), "ss|l", &haystack, &haystack_len, &needle, &needle_len, &loffset) == FAILURE) { From 1bdc290017f6257e3fb1306cb8b826174bd3fe98 Mon Sep 17 00:00:00 2001 From: Christopher Jones Date: Wed, 21 Jun 2017 14:29:30 +1000 Subject: [PATCH 3/3] Update OCI8 version test and package.xml --- ext/oci8/package.xml | 12 ++++++------ ext/oci8/tests/driver_name.phpt | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/ext/oci8/package.xml b/ext/oci8/package.xml index f863b5d44d2..0522e353315 100644 --- a/ext/oci8/package.xml +++ b/ext/oci8/package.xml @@ -50,8 +50,8 @@ Interoperability Support" (ID 207303.1) for details. - 2.1.4 - 2.1.4 + 2.1.5 + 2.1.5 stable @@ -60,7 +60,7 @@ Interoperability Support" (ID 207303.1) for details. PHP This version is for PHP 7 only. -Fixed uninitialized data causing random crash +Added TAF callback support (PR #2459, KoenigsKind) @@ -471,8 +471,8 @@ Fixed uninitialized data causing random crash - 2.1.5 - 2.1.5 + 2.1.4 + 2.1.4 stable @@ -481,7 +481,7 @@ Fixed uninitialized data causing random crash PHP This version is for PHP 7 only. -Added TAF callback support (PR #2459, KoenigsKind) +Fixed uninitialized data causing random crash diff --git a/ext/oci8/tests/driver_name.phpt b/ext/oci8/tests/driver_name.phpt index d24044e68e9..a707e88de8d 100644 --- a/ext/oci8/tests/driver_name.phpt +++ b/ext/oci8/tests/driver_name.phpt @@ -57,11 +57,11 @@ function get_attr($conn) ?> --EXPECT-- **Test 1.1 - Default values for the attribute ************** -The value of DRIVER_NAME is PHP OCI8 : 2.1.3 +The value of DRIVER_NAME is PHP OCI8 : 2.1.5 ***Test 1.2 - Get the values from different connections ************** Testing with oci_pconnect() -The value of DRIVER_NAME is PHP OCI8 : 2.1.3 +The value of DRIVER_NAME is PHP OCI8 : 2.1.5 Testing with oci_new_connect() -The value of DRIVER_NAME is PHP OCI8 : 2.1.3 +The value of DRIVER_NAME is PHP OCI8 : 2.1.5 Done