Skip to content

Commit 3eaf40c

Browse files
weltlingweltling
committed
Merge remote-tracking branch 'origin/PHP-5.6' into str_size_and_int64_56_backport
* origin/PHP-5.6: updated libs versions added some notes about the win build system UPGRADING note about bug #67072 UPGRADING note about bug #67072 UPGRADING note about bug #67072 refixed the test related to bug #67072 Improved the fix for bug #67072, thanks Nikita Fixed test case for 5328d42 These links to ~helly don't work anymore. updated NEWS updated NEWS Fixed bug #67072 Echoing unserialized "SplFileObject" crash updated UPGRADING updated UPGRADING correct the bug #67081 fix updated NEWS updated NEWS Fixed bug #67081 DOMDocumentType->internalSubset returns entire DOCTYPE tag, not only the subset
2 parents 6162a99 + 1bca3ec commit 3eaf40c

File tree

17 files changed

+206
-62
lines changed

17 files changed

+206
-62
lines changed

‎NEWS

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ PHP NEWS
2727
. Fixed bug #66721 (__wakeup of DateTime segfaults when invalid object data is
2828
supplied). (Boro Sitnikovski)
2929

30+
- DOM:
31+
. Fixed bug #67081 (DOMDocumentType->internalSubset returns entire DOCTYPE tag,
32+
not only the subset). (Anatol)
33+
3034
- Fileinfo:
3135
. Fixed bug #66907 (Solaris 10 is missing strcasestr and needs substitute).
3236
(Anatol)
@@ -55,6 +59,9 @@ PHP NEWS
5559
- SQLite:
5660
. Fixed bug #66967 (Updated bundled libsqlite to 3.8.4.3). (Anatol)
5761

62+
- Standard:
63+
. Fixed bug #67072 (Echoing unserialized "SplFileObject" crash). (Anatol)
64+
5865
- Apache2 Handler SAPI:
5966
. Fixed Apache log issue caused by APR's lack of support for %zu
6067
(APR issue https://issues.apache.org/bugzilla/show_bug.cgi?id=56120).

‎UPGRADING

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,10 @@ PHP 5.6 UPGRADE NOTES
161161
- Support for FPM workers changing the apparmor profile through the pool configuration.
162162
(https://wiki.php.net/rfc/fpm_change_hat)
163163

164+
- Support for several XML MIME types in the built-in CLI server. For static
165+
files with extensions .xml, .xsl, .xsd the Content-Type header
166+
application/xml is now sent automatically.
167+
164168
========================================
165169
3. Deprecated Functionality
166170
========================================
@@ -231,6 +235,10 @@ PHP 5.6 UPGRADE NOTES
231235
. pg_send_query()
232236
. pg_send_query_params()
233237

238+
- unserialize:
239+
Manipulated serialization strings for objects implementing Serializable by
240+
replacing "C:" with "O:" at the start will now produce an error.
241+
234242
========================================
235243
5. New Functions
236244
========================================

‎UPGRADING.INTERNALS

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ UPGRADE NOTES - PHP X.Y
1212
g. Additional str_* APIs
1313
h. Addition of zend_hash_reindex
1414
i. Addition of zend_hash_splice
15+
j. An additional parameter is sent to Countable::count()
16+
k. Unserialization of manipulated object strings
1517

1618
2. Build system changes
1719
a. Unix build system changes
@@ -189,6 +191,21 @@ UPGRADE NOTES - PHP X.Y
189191
fail. Extensions which implement Countable internally, need to accept one
190192
optional long as parameter.
191193

194+
k. Unserialization of manipulated object strings
195+
196+
Strings requiring unserialization of objects are now explicitly checked
197+
whether the object they contain implements the Serializable interface.
198+
This solves the situation where manipulated strings could be passed for
199+
objects using Serializable to disallow serialization. An object
200+
implementing Serializable will always start with "C:" in the serialized
201+
string, all other objects are represented with starting "O:". Objects
202+
implementing Serializable to disable serialization using
203+
zend_class_unserialize_deny and zend_class_serialize_deny, when
204+
instantiated from the serializer with a manipulated "O:" string at the
205+
start, will most likely be defectively initialized. This is now
206+
fixed at the appropriate place by checking for the presence of the
207+
serialize callback in the class entry.
208+
192209
========================
193210
2. Build system changes
194211
========================
@@ -199,5 +216,8 @@ UPGRADE NOTES - PHP X.Y
199216
variable. Previously `bison` was assumed to be in $PATH.
200217

201218
b. Windows build system changes
202-
-
203-
219+
- The configure option --enable-static-analyze isn't available anymore.
220+
The new option was introduced --with-analyzer.
221+
- It is possible to disable PGO for single extensions, to do that
222+
define a global variable PHP_MYMODULE_PGO evaluating to false
223+
inside config.w32

‎Zend/tests/generators/errors/serialize_unserialize_error.phpt

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,11 @@ Stack trace:
3232
#0 %s(%d): serialize(Object(Generator))
3333
#1 {main}
3434

35-
exception 'Exception' with message 'Unserialization of 'Generator' is not allowed' in %s:%d
36-
Stack trace:
37-
#0 [internal function]: Generator->__wakeup()
38-
#1 %s(%d): unserialize('O:9:"Generator"...')
39-
#2 {main}
4035

36+
Warning: Erroneous data format for unserializing 'Generator' in %sserialize_unserialize_error.php on line %d
37+
38+
Notice: unserialize(): Error at offset 19 of 20 bytes in %sserialize_unserialize_error.php on line %s
39+
bool(false)
4140
exception 'Exception' with message 'Unserialization of 'Generator' is not allowed' in %s:%d
4241
Stack trace:
4342
#0 %s(%d): unserialize('C:9:"Generator"...')

‎ext/dom/documenttype.c

Lines changed: 25 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -188,8 +188,7 @@ int dom_documenttype_internal_subset_read(dom_object *obj, zval **retval TSRMLS_
188188
{
189189

190190
xmlDtdPtr dtdptr;
191-
xmlDtd *intsubset;
192-
xmlOutputBuffer *buff = NULL;
191+
xmlDtdPtr intsubset;
193192

194193
dtdptr = (xmlDtdPtr) dom_object_get_node(obj);
195194

@@ -200,22 +199,37 @@ int dom_documenttype_internal_subset_read(dom_object *obj, zval **retval TSRMLS_
200199

201200
ALLOC_ZVAL(*retval);
202201

203-
if (dtdptr->doc != NULL && ((intsubset = dtdptr->doc->intSubset) != NULL)) {
204-
buff = xmlAllocOutputBuffer(NULL);
205-
if (buff != NULL) {
206-
xmlNodeDumpOutput (buff, NULL, (xmlNodePtr) intsubset, 0, 0, NULL);
207-
xmlOutputBufferFlush(buff);
202+
if (dtdptr->doc != NULL && ((intsubset = xmlGetIntSubset(dtdptr->doc)) != NULL) && intsubset->children != NULL) {
203+
smart_str ret_buf = {0};
204+
xmlNodePtr cur = intsubset->children;
205+
206+
while (cur != NULL) {
207+
xmlOutputBuffer *buff = xmlAllocOutputBuffer(NULL);
208+
209+
if (buff != NULL) {
210+
xmlNodeDumpOutput (buff, NULL, cur, 0, 0, NULL);
211+
xmlOutputBufferFlush(buff);
212+
208213
#ifdef LIBXML2_NEW_BUFFER
209-
ZVAL_STRINGL(*retval, xmlOutputBufferGetContent(buff), xmlOutputBufferGetSize(buff), 1);
214+
smart_str_appendl(&ret_buf, xmlOutputBufferGetContent(buff), xmlOutputBufferGetSize(buff));
210215
#else
211-
ZVAL_STRINGL(*retval, buff->buffer->content, buff->buffer->use, 1);
216+
smart_str_appendl(&ret_buf, buff->buffer->content, buff->buffer->use);
212217
#endif
213-
(void)xmlOutputBufferClose(buff);
218+
219+
(void)xmlOutputBufferClose(buff);
220+
}
221+
222+
cur = cur->next;
223+
}
224+
225+
if (ret_buf.len) {
226+
ZVAL_STRINGL(*retval, ret_buf.c, ret_buf.len, 1);
227+
smart_str_free(&ret_buf);
214228
return SUCCESS;
215229
}
216230
}
217231

218-
ZVAL_EMPTY_STRING(*retval);
232+
ZVAL_NULL(*retval);
219233

220234
return SUCCESS;
221235

‎ext/dom/tests/DOMDocumentType_basic_001.phpt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,6 @@ print 'notation: '.$notation->nodeName."\n";
4343
publicId: -//OASIS//DTD DocBook XML//EN
4444
systemId: docbookx.dtd
4545
name: chapter
46-
internalSubset: <!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML//EN" "docbookx.dtd">
46+
internalSubset:
4747
entity: logo
48-
notation: gif
48+
notation: gif

‎ext/dom/tests/bug67081.phpt

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
--TEST--
2+
Bug #67081 DOMDocumentType->internalSubset returns entire DOCTYPE tag, not only the subset
3+
--SKIPIF--
4+
<?php
5+
require_once('skipif.inc');
6+
?>
7+
--FILE--
8+
<?php
9+
$domDocument = new DOMDocument();
10+
$domDocument->load(dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug67081_0.xml");
11+
var_dump($domDocument->doctype->internalSubset);
12+
13+
$domDocument = new DOMDocument();
14+
$domDocument->load(dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug67081_1.xml");
15+
var_dump($domDocument->doctype->internalSubset);
16+
17+
$domDocument = new DOMDocument();
18+
$domDocument->load(dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug67081_2.xml");
19+
var_dump($domDocument->doctype->internalSubset);
20+
21+
$domDocument = new DOMDocument();
22+
$domDocument->load(dirname(__FILE__) . DIRECTORY_SEPARATOR . "dom.xml");
23+
var_dump($domDocument->doctype->internalSubset);
24+
?>
25+
===DONE===
26+
--EXPECT--
27+
string(19) "<!ELEMENT a EMPTY>
28+
"
29+
string(38) "<!ELEMENT a EMPTY>
30+
<!ELEMENT b EMPTY>
31+
"
32+
NULL
33+
string(277) "<!ENTITY % incent SYSTEM "dom.ent">
34+
<!ENTITY amp "&#38;#38;">
35+
<!ENTITY gt "&#62;">
36+
<!ENTITY % coreattrs "title CDATA #IMPLIED">
37+
<!ENTITY % attrs "%coreattrs;">
38+
<!ATTLIST foo bar CDATA #IMPLIED>
39+
<!ELEMENT foo (#PCDATA)>
40+
<!ELEMENT root (foo)+>
41+
<!ATTLIST th title CDATA #IMPLIED>
42+
"
43+
===DONE===

‎ext/dom/tests/bug67081_0.xml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0"?>
2+
<!DOCTYPE a [
3+
<!ELEMENT a EMPTY>
4+
]>
5+
<a></a>
6+

‎ext/dom/tests/bug67081_1.xml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0"?>
2+
<!DOCTYPE a [
3+
<!ELEMENT a EMPTY>
4+
<!ELEMENT b EMPTY>
5+
]>
6+
<a></a>
7+

‎ext/dom/tests/bug67081_2.xml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<?xml version="1.0"?>
2+
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
3+
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4+
<a></a>
5+

‎ext/spl/README

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@ code in the file spl.php or in the corresponding .inc file in the examples
44
subdirectory. Based on the internal implementations or the files in the
55
examples subdirectory there are also some .php files to experiment with.
66

7-
For more information look at: http://php.net/~helly/php/ext/spl
7+
For more information look at: http://php.net/manual/en/book.spl.php

‎ext/spl/spl.php

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,9 +145,6 @@
145145
* - Debug session 2 <a href="http://talks.somabo.de/200509_toronto_iterator_debug_session_1.pps">[pps]</a>, <a href="http://talks.somabo.de/200509_toronto_iterator_debug_session_1.pdf">[pdf]</a>, <a href="http://taks.somabo.de/200411_php_conference_frankfrurt_iterator_debug_session.swf">[swf]</a>
146146
* - Debug session 3 <a href="http://talks.somabo.de/200509_toronto_iterator_debug_session_2.pps">[pps]</a>, <a href="http://talks.somabo.de/200509_toronto_iterator_debug_session_2.pdf">[pdf]</a>
147147
*
148-
* You can download this documentation as a chm file
149-
* <a href="http://php.net/~helly/php/ext/spl/spl.chm">here</a>.
150-
*
151148
* (c) Marcus Boerger, 2003 - 2007
152149
*/
153150

‎ext/standard/tests/serialize/005.phpt

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -156,9 +156,11 @@ object(TestNAOld)#%d (0) {
156156
}
157157
===NANew===
158158
unserializer(TestNANew)
159-
TestNew::__wakeup()
160-
object(TestNANew)#%d (0) {
161-
}
159+
160+
Warning: Erroneous data format for unserializing 'TestNANew' in %s005.php on line %d
161+
162+
Notice: unserialize(): Error at offset 19 of 20 bytes in %s005.php on line %d
163+
bool(false)
162164
===NANew2===
163165
unserializer(TestNANew2)
164166
TestNew::unserialize()

‎ext/standard/tests/serialize/bug67072.phpt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
--TEST--
2+
Bug #67072 Echoing unserialized "SplFileObject" crash
3+
--FILE--
4+
<?php
5+
echo unserialize('O:13:"SplFileObject":1:{s:9:"*filename";s:15:"/home/flag/flag";}');
6+
?>
7+
===DONE==
8+
--EXPECTF--
9+
Warning: Erroneous data format for unserializing 'SplFileObject' in %sbug67072.php on line %d
10+
11+
Notice: unserialize(): Error at offset 24 of 64 bytes in %sbug67072.php on line %d
12+
===DONE==

0 commit comments

Comments
 (0)