Browse Source
Merge branch 'PHP-5.5' into PHP-5.6
Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5: Fix bug #67248 (imageaffinematrixget missing check of parameters) Fix bug #67247 spl_fixedarray_resize integer overflow fix news add tests stuff to README Updated NEWS Fix Linux specific fail in error traces (cherry-picked and fix for bug #67245) Linux apparently does not like memcpy in overlapping regions...pull/675/head
6 changed files with 85 additions and 23 deletions
-
5NEWS
-
53README.RELEASE_PROCESS
-
8ext/gd/gd.c
-
27ext/gd/tests/bug67248.phpt
-
2ext/spl/spl_fixedarray.c
-
13ext/spl/tests/bug67247.phpt
@ -0,0 +1,27 @@ |
|||
--TEST-- |
|||
Bug #67248 (imageaffinematrixget missing check of parameters) |
|||
--SKIPIF-- |
|||
<?php |
|||
if(!extension_loaded('gd')){ die('skip gd extension not available')} |
|||
if(!function_exists('imageaffinematrixget')) die('skip imageaffinematrixget() not available'); |
|||
?> |
|||
--FILE-- |
|||
<?php |
|||
for($i=0;$i<7;$i++) { |
|||
imageaffinematrixget($i); |
|||
} |
|||
?> |
|||
--EXPECTF-- |
|||
Warning: imageaffinematrixget(): Array expected as options in %s on line %d |
|||
|
|||
Warning: imageaffinematrixget(): Array expected as options in %s on line %d |
|||
|
|||
Warning: imageaffinematrixget(): Number is expected as option in %s on line %d |
|||
|
|||
Warning: imageaffinematrixget(): Number is expected as option in %s on line %d |
|||
|
|||
Warning: imageaffinematrixget(): Number is expected as option in %s on line %d |
|||
|
|||
Warning: imageaffinematrixget(): Invalid type for element 5 in %s on line %d |
|||
|
|||
Warning: imageaffinematrixget(): Invalid type for element 6 in %s on line %d |
|||
@ -0,0 +1,13 @@ |
|||
--TEST-- |
|||
Bug #67247 (spl_fixedarray_resize integer overflow) |
|||
--FILE-- |
|||
<?php |
|||
$ar = new SplFixedArray(1); |
|||
echo "size: ".$ar->getSize()."\n"; |
|||
$ar->setSize((PHP_INT_SIZE==8)?0x2000000000000001:0x40000001); |
|||
echo "size: ".$ar->getSize()."\n"; |
|||
?> |
|||
--EXPECTF-- |
|||
size: 1 |
|||
|
|||
Fatal error: Possible integer overflow in memory allocation (%d * %d + 0) in %s on line %d |
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue