From 5bf6a093ad9072865c6b1b52e39144b16dfe5300 Mon Sep 17 00:00:00 2001 From: Bob Weinand Date: Sun, 11 May 2014 15:11:03 +0200 Subject: [PATCH 1/6] Fix Linux specific fail in error traces (cherry-picked and fix for bug #67245) Linux apparently does not like memcpy in overlapping regions... --- Zend/zend_exceptions.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Zend/zend_exceptions.c b/Zend/zend_exceptions.c index ced1ebf6397..bf90ae7be39 100644 --- a/Zend/zend_exceptions.c +++ b/Zend/zend_exceptions.c @@ -363,7 +363,7 @@ ZEND_METHOD(error_exception, getSeverity) #define TRACE_ARG_APPEND(vallen) \ *str = (char*)erealloc(*str, *len + 1 + vallen); \ - memcpy((*str) + *len - l_added + 1 + vallen, (*str) + *len - l_added + 1, l_added); + memmove((*str) + *len - l_added + 1 + vallen, (*str) + *len - l_added + 1, l_added); /* }}} */ From 62b2eb666d8d418e1c4672bc81d00111f18049bd Mon Sep 17 00:00:00 2001 From: Bob Weinand Date: Sun, 11 May 2014 15:13:40 +0200 Subject: [PATCH 2/6] Updated NEWS --- NEWS | 3 +++ 1 file changed, 3 insertions(+) diff --git a/NEWS b/NEWS index 848029fcdc3..2c5fb894e10 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,9 @@ PHP NEWS . Fixed bug #65701 (copy() doesn't work when destination filename is created by tempnam()). (Boro Sitnikovski) . Fixed bug #67072 (Echoing unserialized "SplFileObject" crash). (Anatol) + . Fixed bug #67245 (usage of memcpy() with overlapping src and dst in + zend_exceptions.c) (backported fix from PHP 5.6; initially committed + to wrong branch). (Bob) - Date: . Fixed bug #67118 (DateTime constructor crash with invalid data). (Anatol) From cdd1c1122e1075cc45925ace7b2cd42559366a63 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Fri, 9 May 2014 13:28:39 -0700 Subject: [PATCH 3/6] add tests stuff to README --- README.RELEASE_PROCESS | 53 ++++++++++++++++++++++++++---------------- 1 file changed, 33 insertions(+), 20 deletions(-) diff --git a/README.RELEASE_PROCESS b/README.RELEASE_PROCESS index 21305f29934..7a82a5c6145 100644 --- a/README.RELEASE_PROCESS +++ b/README.RELEASE_PROCESS @@ -11,17 +11,27 @@ because the sysadmins can not upgrade stuff then. 2. Package two days before a release. So if the release is to be on Thursday, package on Tuesday. Think about timezones as well. -3. Ensure that Windows builds will work before packaging - -4. Follow all steps to the letter. When unclear ask previous RM's (David/Julien/ +3. Ensure that the tests on Travis CI are green. +See: https://travis-ci.org/php/php-src/builds +It is recommended to do so a couple of days before the packaging day, to +have enough time to investigate failures, communicate with the authors and +commit the fixes. +The RM for the branch is also responsible for keeping the CI green on +ongoing bases between the releases. Check the CI status for your branch +periodically and resolve the failures ASAP. See more in: +https://wiki.php.net/rfc/travis_ci + +4. Ensure that Windows builds will work before packaging + +5. Follow all steps to the letter. When unclear ask previous RM's (David/Julien/ Johannes/Stas/Derick/Ilia) before proceeding. Ideally make sure that for the first releases one of the previous RM's is around to answer questions. For the steps related to the php/QA/bug websites try to have someone from the webmaster team (Bjori) on hand. -5. Verify the tags to be extra sure everything was tagged properly. +6. Verify the tags to be extra sure everything was tagged properly. -6. Moving extensions from/to PECL requires write acces to the destination. +7. Moving extensions from/to PECL requires write acces to the destination. Most developers should have this. Moving extensions from php-src to PECL @@ -48,47 +58,49 @@ Rolling a non stable release (alpha/beta/RC) 1. Check windows snapshot builder logs (http://windows.php.net/downloads/snaps/ the last revision) -2. run the "scripts/dev/credits" script in php-src and commit the changes in the +2. Check the tests at https://travis-ci.org/php/php-src/builds + +3. run the "scripts/dev/credits" script in php-src and commit the changes in the credits files in ext/standard. -3. Checkout the release branch for this release (e.g., PHP-5.4.2) from the main branch. +4. Checkout the release branch for this release (e.g., PHP-5.4.2) from the main branch. -4. Bump the version numbers in ``main/php_version.h``, ``configure.in`` and possibly ``NEWS``. +5. Bump the version numbers in ``main/php_version.h``, ``configure.in`` and possibly ``NEWS``. Do not use abbreviations for alpha and beta. Do not use dashes, you should ``#define PHP_VERSION "5.4.22RC1"`` and not ``#define PHP_VERSION "5.4.22-RC1"`` -5. Compile and make test, with and without ZTS, using the right Bison version +6. Compile and make test, with and without ZTS, using the right Bison version (for example, for 5.5, Bison 2.4.1 is used) -6. Check ./sapi/cli/php -v output for version matching. +7. Check ./sapi/cli/php -v output for version matching. -7. If all is right, commit the changes to the release branch with ``git commit -a``. +8. If all is right, commit the changes to the release branch with ``git commit -a``. -8. Tag the repository release branch with the version, e.g.: +9. Tag the repository release branch with the version, e.g.: ``git tag -u YOURKEYID php-5.4.2RC2`` -9. Bump the version numbers in ``main/php_version.h``, ``configure.in`` and ``NEWS`` +10. Bump the version numbers in ``main/php_version.h``, ``configure.in`` and ``NEWS`` in the *main* branch (PHP-5.4 for example) to prepare for the **next** version. F.e. if the RC is "5.4.1RC1" then the new one should be "5.4.2-dev" - regardless if we get a new RC or not. This is to make sure ``version_compare()`` can correctly work. Commit the changes to the main branch. -10. Push the changes to the main repo, the tag, the main branch and the release branch : +11. Push the changes to the main repo, the tag, the main branch and the release branch : ``git push --tags origin HEAD`` ``git push origin {main branch}`` ``git push origin {release branch}`` -11. run: ``PHPROOT=. ./makedist 5.4.2RC2``, this will export the tree, create configure +12. run: ``PHPROOT=. ./makedist 5.4.2RC2``, this will export the tree, create configure and build three tarballs (gz, bz2 and xz). -12. Copy those tarballs (scp, rsync) to downloads.php.net, in your homedir there should be a +13. Copy those tarballs (scp, rsync) to downloads.php.net, in your homedir there should be a directory "downloads/". Copy them into there, so that the system can generate MD5 sums. If you do not have this directory, talk to Derick or Dan. -13. Now the RC can be found on http://downloads.php.net/yourname, +14. Now the RC can be found on http://downloads.php.net/yourname, f.e. http://downloads.php.net/derick/ -14. Once the release has been tagged, contact the PHP Windows development team +15. Once the release has been tagged, contact the PHP Windows development team (internals-win@lists.php.net) so that Windows binaries can be created. Once those are made, they should be placed into the same directory as the source snapshots. @@ -144,7 +156,8 @@ the base branches and merged upwards as usual (f.e commit the CVE fix to 5.3, merge to 5.4, 5.5 etc...). Then you can cherry-pick it in your release branch. Don't forget to update NEWS manually in an extra commit then. -3. Commit those changes +3. Commit those changes. Ensure the tests at https://travis-ci.org/php/php-src/builds are +still passing. 4. run the "scripts/dev/credits" script in php-src and commit the changes in the credits files in ext/standard. @@ -154,7 +167,7 @@ credits files in ext/standard. 6. Check ./sapi/cli/php -v output for version matching. -7. tag the repository with the version f.e. "``git tag -s php-5.4.1``" +7. tag the repository with the version f.e. "``git tag -u YOURKEYID -s php-5.4.1``" 8. Push the tag f.e. "``git push origin php-5.4.1``" From 14dd6c2d548c8e7793694aaa5183ab83ecef784c Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sun, 11 May 2014 17:43:28 -0700 Subject: [PATCH 4/6] fix news --- NEWS | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/NEWS b/NEWS index 2c5fb894e10..73531dd6240 100644 --- a/NEWS +++ b/NEWS @@ -10,8 +10,7 @@ PHP NEWS by tempnam()). (Boro Sitnikovski) . Fixed bug #67072 (Echoing unserialized "SplFileObject" crash). (Anatol) . Fixed bug #67245 (usage of memcpy() with overlapping src and dst in - zend_exceptions.c) (backported fix from PHP 5.6; initially committed - to wrong branch). (Bob) + zend_exceptions.c). (Bob) - Date: . Fixed bug #67118 (DateTime constructor crash with invalid data). (Anatol) From 2b475eebbea85779989e98e87753d6b023a1d131 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sun, 11 May 2014 17:54:27 -0700 Subject: [PATCH 5/6] Fix bug #67247 spl_fixedarray_resize integer overflow --- NEWS | 1 + ext/spl/spl_fixedarray.c | 2 +- ext/spl/tests/bug67247.phpt | 13 +++++++++++++ 3 files changed, 15 insertions(+), 1 deletion(-) create mode 100644 ext/spl/tests/bug67247.phpt diff --git a/NEWS b/NEWS index 73531dd6240..03f8b87daf9 100644 --- a/NEWS +++ b/NEWS @@ -11,6 +11,7 @@ PHP NEWS . Fixed bug #67072 (Echoing unserialized "SplFileObject" crash). (Anatol) . Fixed bug #67245 (usage of memcpy() with overlapping src and dst in zend_exceptions.c). (Bob) + . Fixed bug #67247 (spl_fixedarray_resize integer overflow). (Stas) - Date: . Fixed bug #67118 (DateTime constructor crash with invalid data). (Anatol) diff --git a/ext/spl/spl_fixedarray.c b/ext/spl/spl_fixedarray.c index 2f5e8c670bf..22f766f67dd 100644 --- a/ext/spl/spl_fixedarray.c +++ b/ext/spl/spl_fixedarray.c @@ -116,7 +116,7 @@ static void spl_fixedarray_resize(spl_fixedarray *array, long size TSRMLS_DC) /* array->elements = NULL; } } else if (size > array->size) { - array->elements = erealloc(array->elements, sizeof(zval *) * size); + array->elements = safe_erealloc(array->elements, size, sizeof(zval *), 0); memset(array->elements + array->size, '\0', sizeof(zval *) * (size - array->size)); } else { /* size < array->size */ long i; diff --git a/ext/spl/tests/bug67247.phpt b/ext/spl/tests/bug67247.phpt new file mode 100644 index 00000000000..cb71445d7b7 --- /dev/null +++ b/ext/spl/tests/bug67247.phpt @@ -0,0 +1,13 @@ +--TEST-- +Bug #67247 (spl_fixedarray_resize integer overflow) +--FILE-- +getSize()."\n"; +$ar->setSize((PHP_INT_SIZE==8)?0x2000000000000001:0x40000001); +echo "size: ".$ar->getSize()."\n"; +?> +--EXPECTF-- +size: 1 + +Fatal error: Possible integer overflow in memory allocation (%d * %d + 0) in %s on line %d From 291b45afb5d5716ff0d340bd2bcb34731b806eed Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sun, 11 May 2014 18:14:57 -0700 Subject: [PATCH 6/6] Fix bug #67248 (imageaffinematrixget missing check of parameters) --- NEWS | 3 +++ ext/gd/gd.c | 8 ++++++-- ext/gd/tests/bug67248.phpt | 27 +++++++++++++++++++++++++++ 3 files changed, 36 insertions(+), 2 deletions(-) create mode 100644 ext/gd/tests/bug67248.phpt diff --git a/NEWS b/NEWS index c5757ccef95..5ee5c567a66 100644 --- a/NEWS +++ b/NEWS @@ -33,6 +33,9 @@ PHP NEWS . Fixed bug #66908 (php-fpm reload leaks epoll_create() file descriptor). (Julio Pintos) +- GD: + . Fixed bug #67248 (imageaffinematrixget missing check of parameters). (Stas) + - PCRE: . Fixed bug #67238 (Ungreedy and min/max quantifier bug, applied patch from the upstream). (Anatol) diff --git a/ext/gd/gd.c b/ext/gd/gd.c index 90a053535aa..cbc7219e37c 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -5268,7 +5268,7 @@ PHP_FUNCTION(imageaffinematrixget) { double affine[6]; long type; - zval *options; + zval *options = NULL; zval **tmp; int res = GD_FALSE, i; @@ -5280,7 +5280,7 @@ PHP_FUNCTION(imageaffinematrixget) case GD_AFFINE_TRANSLATE: case GD_AFFINE_SCALE: { double x, y; - if (Z_TYPE_P(options) != IS_ARRAY) { + if (!options || Z_TYPE_P(options) != IS_ARRAY) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Array expected as options"); RETURN_FALSE; } @@ -5327,6 +5327,10 @@ PHP_FUNCTION(imageaffinematrixget) case GD_AFFINE_SHEAR_VERTICAL: { double angle; + if (!options) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number is expected as option"); + RETURN_FALSE; + } convert_to_double_ex(&options); angle = Z_DVAL_P(options); diff --git a/ext/gd/tests/bug67248.phpt b/ext/gd/tests/bug67248.phpt new file mode 100644 index 00000000000..9c83966a60a --- /dev/null +++ b/ext/gd/tests/bug67248.phpt @@ -0,0 +1,27 @@ +--TEST-- +Bug #67248 (imageaffinematrixget missing check of parameters) +--SKIPIF-- + +--FILE-- + +--EXPECTF-- +Warning: imageaffinematrixget(): Array expected as options in %s on line %d + +Warning: imageaffinematrixget(): Array expected as options in %s on line %d + +Warning: imageaffinematrixget(): Number is expected as option in %s on line %d + +Warning: imageaffinematrixget(): Number is expected as option in %s on line %d + +Warning: imageaffinematrixget(): Number is expected as option in %s on line %d + +Warning: imageaffinematrixget(): Invalid type for element 5 in %s on line %d + +Warning: imageaffinematrixget(): Invalid type for element 6 in %s on line %d