PHP 5 ChangeLog

Version 5.3.9

10-Jan-2012

Core: +

Added max_input_vars directive to prevent attacks based on hash collisions + (Dmitry).
(possible integer overflow in content_length). (Laruence)
(Anonymous functions create cycles not detected by the + GC). (Dmitry)
(GC crash with referenced array in RecursiveArrayIterator) + (Dmitry).
(proc_open's streams may hang with stdin/out/err when + the data exceeds or is equal to 2048 bytes). (Pierre, Pascal Borreli)
(__halt_compiler() works in braced namespaces). (Felipe)
(Function time_nanosleep() is undefined on OS X). (Ilia)
(GCC does not provide __sync_fetch_and_add on some archs). + (klightspeed at netspace dot net dot au)
(serialize followed by unserialize with numeric object + prop. gives integer prop). (Gustavo)
(TOCTOU issue in getenv() on Windows builds). (Pierre)
(undefined reference to `__sync_fetch_and_add_4' on Linux + parisc). (Felipe)
(fgetcsv & str_getcsv skip empty fields in some + tab-separated records). (Laruence)
(Undefined function Bug()). (Laruence)
(memory corruption in parse_ini_string). (Pierre)
(Cannot conditionally move uploaded file without race + condition). (Gustavo)
: $_FILES 'name' missing first character after upload. + (Arpad)
(segfault on x86_64 using more than 2G memory). (Laruence)
(Content-Type header is not parsed correctly on + HTTP POST request). (Hannes)
(is_a() triggers autoloader, new optional 3rd argument to + is_a and is_subclass_of). (alan_k)
(Incomplete doctype and missing xmlns). + (virsacer at web dot de, Pierre)
(keys lost when using substr_replace an array). (Arpad)
(base64_decode() with strict rejects whitespace after + pad). (Ilia)
(tempnam() by-pass open_basedir with nonnexistent + directory). (Felipe)
(incorrect assumption of PAGE_SIZE size). (Dmitry)
Fixed invalid free in call_user_method() function. (Felipe)
(Interface implementation / inheritence not possible in + abstract classes). (Felipe)

BCmath: +

(bcscale related crashes on 64bits platforms). (shm)

Calendar: +

(Integer overflow in SdnToGregorian leads to segfault (in + optimized builds). (Gustavo)

cURL: +

(curl_copy_handle segfault when used with + CURLOPT_PROGRESSFUNCTION). (Pierrick)
(Segfault when CURLOPT_STDERR file pointer is closed + before calling curl_exec). (Hannes)
Fixed issues were curl_copy_handle() would sometimes lose copied + preferences. (Hannes)

DateTime: +

(Startup errors with log_errors on cause segfault). + (Derick)
(TLA timezone dates are not converted properly from + timestamp). (Derick)
(DateTime::add() and sub() result -1 hour on objects with + time zone type 2). (Derick)
(DateTime::createFromFormat() doesn't interpret "D"). + (Derick)
(strtotime with timezone memory leak). (Derick)
(large timestamps with DateTime::getTimestamp and + DateTime::setTimestamp). (Derick)
(date_parse_from_format is parsing invalid date using 'yz' + format). (Derick)
(Seg fault while creating (by unserialization) + DatePeriod). (Derick)
(cloning extended DateTime class without calling + parent::__constr crashed PHP). (Hannes)

EXIF: +

(Integer overflow during the parsing of invalid exif + header). (Stas, flolechaud at gmail dot com)

Fileinfo: +

(C++ comment fails in c89). (Laruence)
Fixed possible memory leak in finfo_open(). (Felipe)
Fixed memory leak when calling the Finfo constructor twice. (Felipe)

Filter: +

Fixed Bug #55478 (FILTER_VALIDATE_EMAIL fails with internationalized + domain name addresses containing >1 -). (Ilia)

FTP: +

(out of sync ftp responses). (bram at ebskamp dot me, + rasmus)

Gd: +

(imagefill() doesn't work correctly + for small images). (Florian)

Intl: +

(SegFault when Collator not constructed + properly). (Florian)
Fixed memory leak in several Intl locale functions. (Felipe)

JSON: +

(json_encode() with JSON_NUMERIC_CHECK fails on objects + with numeric string properties). (Ilia, dchurch at sciencelogic dot com)

mbstring: +

Fixed possible crash in mb_ereg_search_init() using empty pattern. (Felipe)

MS SQL: +

(Compile failure with freetds 0.91). (Felipe)

MySQL: +

(mysql.trace_mode miscounts result sets). (Johannes)

MySQLi extension: +

(mysqli->stat property access gives error). (Andrey)
(mysqli_num_rows() returns always 0 for unbuffered, when + mysqlnd is used). (Andrey)
(PHP crash when calling mysqli_fetch_fields). + (eran at zend dot com, Laruence)

mysqlnd: +

(mysqlnd cannot be built shared). (Johannes)
(MySQL doesn't support compression - wrong config option). + (Andrey)

NSAPI SAPI: +

Don't set $_SERVER['HTTPS'] on unsecure connection (bug #55403). (Uwe + Schindler)

OpenSSL: +

(Fixed NULL pointer dereference in + stream_socket_enable_crypto, case when ssl_handle of session_stream is not + initialized.) (shm)
Fix segfault with older versions of OpenSSL. (Scott)

Oracle Database extension (OCI8): +

(show normal warning text for OCI_NO_DATA). + (Chris Jones)
Increased maximum Oracle error message buffer length for new 11.2.0.3 size. + (Chris Jones)
Improve internal initalization failure error messages. (Chris Jones)

PDO +

(PDORow to session bug). (Johannes)

PDO Firebird: +

("bindValue" and "bindParam" do not work for PDO Firebird). + (Mariuz)
(PDO_Firebird segfaults when passing lowercased column name to bindColumn).
(PDO_Firebird segfaults if query column count less than param count). + (Mariuz)

PDO MySQL driver: +

(pdo_mysql.default_socket ignored). (Johannes)
(PDO ignores all SSL parameters when used with mysql + native driver). (Pierre)
(MYSQLND+PDO MySQL requires #define + MYSQL_OPT_LOCAL_INFILE). (Andrey)

PDO OCI driver: +

(PDO_OCI can't resume Oracle session after it's been + killed). (mikhail dot v dot gavrilov at gmail dot com, Chris Jones, Tony)

Phar: +

(NULL pointer dereference in phar). (Felipe)
(Stubs of a specific length break phar_open_from_fp
(internal corruption of phar). (Hannes)
(Unable to decompress files in a compressed phar). (Hannes)

PHP-FPM SAPI: +

(FPM does not clear auth_user on request accept). + (bonbons at linux-vserver dot org)
(memory corruption when web server closed the fcgi fd). + (fat)
(php_flag and php_value does not work properly). (fat)
(Heartbeat causes a lot of unnecessary events). (fat)
(The -d parameter doesn't work). (fat)
Implemented FR (Add the "ondemand" process-manager + to allow zero children). (fat)
(status show BIG processes number). (fat)
(status.html does not install). (fat)
Backported from 5.4 branch (Dropped restriction of not setting the same + value multiple times, the last one holds). + (giovanni at giacobbi dot net, fat)
Backported FR from 5.4 branch (Added process.max to control + the number of process FPM can fork). (fat)
Backported FR from 5.4 branch (Enhance security by limiting access + to user defined extensions). (fat)
Backported FR from 5.4 branch (Lowered process manager + default value). (fat)
Backported FR from 5.4 branch (Added partial syslog support). (fat)
Implemented FR (Enhanced status page with full status and details + about each processes. Also provide a web page (status.html) for + real-time FPM status. (fat)
Enhance error log when the primary script can't be open. FR . (fat)
Added .phar to default authorized extensions. (fat)

Postgres: +

(pg_fetch_* functions do not validate that row param + is >0). (Ilia)

Reflection: +

(Reflection and Late Static Binding). (Laruence)

Session: +

(session_regenerate_id fails after header sent). (Hannes)

SimpleXML: +

Reverted the SimpleXML->query() behaviour to returning empty arrays + instead of false when no nodes are found as it was since 5.3.3 + (bug #48601). (chregu, rrichards)

SOAP +

(Access to a undefined member in inherit SoapClient may + cause Segmentation Fault). (Dmitry)
(PHP Fatal error: SOAP-ERROR: Parsing WSDL: + Extra content at the end of the doc, when server uses chunked transfer + encoding with spaces after chunk size). (Dmitry)
(SOAP-ERROR: Parsing WSDL with references). (Dmitry)

Sockets: +

(sa_len a #define on IRIX). (china at thewrittenword dot + com)

SPL: +

(Crash in ArrayObject() when using recursive references). + (Tony)
(Wrong value for splFileObject::SKIP_EMPTY). + (jgotti at modedemploi dot fr, Hannes)
(RegexIterator::accept() doesn't work with scalar values). + (Hannes)

Streams: +

(stream_get_line misbehaves if EOF is not detected together + with the last read). (Gustavo)

Tidy: +

(Tidy::diagnose() NULL pointer dereference). + (Maksymilian Arciemowicz, Felipe)

XSL: +

Added xsl.security_prefs ini option to define forbidden operations within + XSLT stylesheets, default is not to enable write operations. This option + won't be in 5.4, since there's a new method. Fixes Bug . (Chregu, + Nicolas Gregoire)

Version 5.3.8

23-Aug-2011

http://php.net/contact

php-webmaster@lists.php.net

Added: web/php/trunk/archive/entries/2012-01-10-1.xml =================================================================== --- web/php/trunk/archive/entries/2012-01-10-1.xml (rev 0) +++ web/php/trunk/archive/entries/2012-01-10-1.xml 2012-01-11 00:36:54 UTC (rev 322042) @@ -0,0 +1,39 @@ + + + PHP 5.3.9 Released! + http://www.php.net/archive/2012.php#id2012-01-10-1 + 2012-01-10T22:29:58+01:00 + 2012-01-10T22:29:58+01:00 + + + + + +

The PHP development team would like to announce the immediate + availability of PHP 5.3.9. This release focuses on improving the + stability of the PHP 5.3.x branch with over 90 bug fixes, some of + which are security related.

+ +

Security Enhancements and Fixes in PHP 5.3.9:

+ +

Added max_input_vars directive to prevent attacks based on hash collisions. (CVE-2011-4885)
Fixed bug #60150 (Integer overflow during the parsing of invalid exif + header). (CVE-2011-4566)

+ +

Key enhancements in PHP 5.3.9 include:

+ +

Fixed bug #55475 (is_a() triggers autoloader, new optional 3rd argument to + is_a and is_subclass_of).
Fixed bug #55609 (mysqlnd cannot be built shared)
Many changes to the FPM SAPI module

+ +

All users are strongly encouraged to upgrade to PHP 5.3.9.

+ +

+ + Modified: web/php/trunk/include/releases.inc =================================================================== --- web/php/trunk/include/releases.inc 2012-01-10 22:49:58 UTC (rev 322041) +++ web/php/trunk/include/releases.inc 2012-01-11 00:36:54 UTC (rev 322042) @@ -2,6 +2,32 @@ $OLDRELEASES = array ( 5 => array ( + '5.3.8' => + array ( + 'announcement' => + array ( + 'English' => '/releases/5_3_8.php', + ), + 'source' => + array ( + 0 => + array ( + 'filename' => 'php-5.3.8.tar.bz2', + 'name' => 'PHP 5.3.8 (tar.bz2)', + 'md5' => '704cd414a0565d905e1074ffdc1fadfb', + 'date' => '23 August 2011', + ), + 1 => + array ( + 'filename' => 'php-5.3.8.tar.gz', + 'name' => 'PHP 5.3.8 (tar.gz)', + 'md5' => 'f4ce40d5d156ca66a996dbb8a0e7666a', + 'date' => '23 August 2011', + ), + ), + 'date' => NULL, + 'museum' => false, + ), '5.3.7' => array ( 'announcement' => Modified: web/php/trunk/include/version.inc =================================================================== --- web/php/trunk/include/version.inc 2012-01-10 22:49:58 UTC (rev 322041) +++ web/php/trunk/include/version.inc 2012-01-11 00:36:54 UTC (rev 322042) @@ -21,15 +21,15 @@ $PHP_5_4_RC_DATE = "5 January 2012"; /* PHP 5.3 Release */ -$PHP_5_3_RC = '5.3.9RC4'; +$PHP_5_3_RC = false; // '5.3.9RC4'; $PHP_5_3_RC_DATE = '23 December 2011'; -$PHP_5_3_VERSION = "5.3.8"; -$PHP_5_3_DATE = "23 August 2011"; +$PHP_5_3_VERSION = "5.3.9"; +$PHP_5_3_DATE = "10 January 2012"; $PHP_5_3_MD5 = array( - "tar.bz2" => "704cd414a0565d905e1074ffdc1fadfb", - "tar.gz" => "f4ce40d5d156ca66a996dbb8a0e7666a", + "tar.bz2" => "dd3288ed5c08cd61ac5bf619cb357521", + "tar.gz" => "c79e374c61423beb64a69da1eb5526b7", ); $PHP_5_2_VERSION = "5.2.17"; Added: web/php/trunk/releases/5_3_9.php =================================================================== --- web/php/trunk/releases/5_3_9.php (rev 0) +++ web/php/trunk/releases/5_3_9.php 2012-01-11 00:36:54 UTC (rev 322042) @@ -0,0 +1,34 @@ + + +

PHP 5.3.9 Release Announcement

+ +

The PHP development team would like to announce the immediate +availability of PHP 5.3.9. This release focuses on improving the +stability of the PHP 5.3.x branch with over 90 bug fixes, some of +which are security related.

+ +

Security Enhancements and Fixes in PHP 5.3.9:

+ +

Added max_input_vars directive to prevent attacks based on hash collisions. (CVE-2011-4885)
Fixed bug #60150 (Integer overflow during the parsing of invalid exif + header). (CVE-2011-4566)

+ +

Key enhancements in PHP 5.3.9 include:

+ +

Fixed bug #55475 (is_a() triggers autoloader, new optional 3rd argument to + is_a and is_subclass_of).
Fixed bug #55609 (mysqlnd cannot be built shared)
Many changes to the FPM SAPI module

+ +

All users are strongly encouraged to upgrade to PHP 5.3.9.

+ + Property changes on: web/php/trunk/releases/5_3_9.php ___________________________________________________________________ Added: svn:keywords + Id Rev Revision Added: svn:eol-style + native