com php-src: Merge branch 'PHP-5.5' into PHP-5.6: NEWS ext/curl/interface.c ext/dom/document.c ext/fileinfo/fileinfo.c
ext/fileinfo/libmagic/softmagic.c ext/gd/gd.c ext/hash/hash.c ext/pgsql/pgsql.c ext/phar/phar.c ext/phar/phar_internal.h
ext/standard/http_fopen_wrapper.c ext/standard/strea msfuncs.c

Commit: 5776fceb16597d9ce686a01c1b72eac155b9741b Author: Stanislav Malyshev <stas@php.net> Tue, 14 Apr 2015 00:51:14 -0700 Parents: dc0f2a5bad109ff356900def1a35385bd87ca54a 4782ceea8073b16101058636479e00cc4302d07e Branches: PHP-5.6 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=5776fceb16597d9ce686a01c1b72eac155b9741b Log: Merge branch 'PHP-5.5' into PHP-5.6 * PHP-5.5: (27 commits) fix non-standard C update NEWS 5.4.41 next fix CVE num update NEWS Fix bug #69441 (Buffer Overflow when parsing tar/zip/phar in phar_set_inode) fix test fix type in fix for #69085 fix memory leak & add test Fix tests fix CVE num Fix bug #69337 (php_stream_url_wrap_http_ex() type-confusion vulnerability) Fix test Additional fix for bug #69324 More fixes for bug #69152 Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions) Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar) Fixed bug #69316 (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER) Fix bug #68486 and bug #69218 (segfault in apache2handler with apache 2.4) Fix bug #68819 (Fileinfo on specific file causes spurious OOM and/or segfault) ... Conflicts: ext/standard/http_fopen_wrapper.c Bugs: https://bugs.php.net/69441 https://bugs.php.net/69085 https://bugs.php.net/69337 https://bugs.php.net/69324 https://bugs.php.net/69152 https://bugs.php.net/69353 https://bugs.php.net/69316 https://bugs.php.net/68486 https://bugs.php.net/69218 https://bugs.php.net/68819 Changed paths: MM NEWS MM ext/curl/interface.c MM ext/dom/document.c MM ext/fileinfo/fileinfo.c MM ext/fileinfo/libmagic/softmagic.c MM ext/gd/gd.c MM ext/hash/hash.c MM ext/pgsql/pgsql.c MM ext/phar/phar.c MM ext/phar/phar_internal.h MM ext/standard/http_fopen_wrapper.c MM ext/standard/streamsfuncs.c Diff: diff --cc NEWS index 58385cc,8003938..70e74d9 --- a/NEWS +++ b/NEWS @@@ -17,8 -23,16 +17,12 @@@ PH - Sqlite3: . Fixed bug #66550 (SQLite prepared statement use-after-free). (Sean Heelan) -?? ??? 2015, PHP 5.5.24 +16 Apr 2015, PHP 5.6.8 + - Apache2handler: + . Fixed bug #69218 (potential remote code execution with apache 2.4 + apache2handler). (Gerrit Venema) + - Core: . Fixed bug #66609 (php crashes with __get() and ++ operator in some cases). (Dmitry, Laruence) @@@ -27,29 -43,37 +31,41 @@@ . Fixed bug #68917 (parse_url fails on some partial urls). (Wei Dai) . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM configuration options). (Anatol Belski) + . Additional fix for bug #69152 (Type confusion vulnerability in + exception::getTraceAsString). (Stas) + . Fixed bug #69210 (serialize function return corrupted data when sleep has + non-string values). (Juan Basso) . Fixed bug #69212 (Leaking VIA_HANDLER func when exception thrown in __call/... arg passing). (Nikita) . Fixed bug #69221 (Segmentation fault when using a generator in combination with an Iterator). (Nikita) - . Fixed bug #69337 (php_stream_url_wrap_http_ex() type-confusion - vulnerability). (Stas) - . Fixed bug #69353 (Missing null byte checks for paths in various PHP - extensions). (Stas) - -- Date: - . Export date_get_immutable_ce so that it can be used by extensions. (Derick - Rethans) - . Fixed bug #69336 (Issues with "last day of <monthname>"). (Derick Rethans) ++ . Fixed bug #69337 (php_stream_url_wrap_http_ex() type-confusion ++ vulnerability). (Stas) ++ . Fixed bug #69353 (Missing null byte checks for paths in various PHP ++ extensions). (Stas) -- Curl: +- cURL: . Implemented FR#69278 (HTTP2 support). (Masaki Kagaya) - . Fixed bug #69316 (Use-after-free in php_curl related to - CURLOPT_FILE/_INFILE/_WRITEHEADER). (Laruence) + . Fixed bug #68739 (Missing break / control flow). (Laruence) ++ . Fixed bug #69316 (Use-after-free in php_curl related to ++ CURLOPT_FILE/_INFILE/_WRITEHEADER). (Laruence) + +- Date: + . Added DateTime::createFromImmutable(). (Trevor Suarez) - Enchant: . Fixed bug #65406 (Enchant broker plugins are in the wrong place in windows builds). (Anatol) +- Ereg: + . Fixed bug #68740 (NULL Pointer Dereference). (Laruence) + + - Fileinfo: + . Fixed bug #68819 (Fileinfo on specific file causes spurious OOM and/or + segfault). (Anatol Belski) + - Filter: - . Fixed bug #69202 (FILTER_FLAG_STRIP_BACKTICK ignored unless other + . Fixed bug #69202: (FILTER_FLAG_STRIP_BACKTICK ignored unless other flags are used). (Jeff Welch) . Fixed bug #69203 (FILTER_FLAG_STRIP_HIGH doesn't strip ASCII 127). (Jeff Welch) diff --cc ext/standard/http_fopen_wrapper.c index eb371c4,95f9cb5..25c83a8 --- a/ext/standard/http_fopen_wrapper.c +++ b/ext/standard/http_fopen_wrapper.c @@@ -498,17 -490,12 +498,17 @@@ finish *(s-1) == '\t' || *(s-1) == ' ')) { have_header |= HTTP_HEADER_TYPE; } + if ((s = strstr(tmp, "connection:")) && + (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || + *(s-1) == '\t' || *(s-1) == ' ')) { + have_header |= HTTP_HEADER_CONNECTION; + } /* remove Proxy-Authorization header */ if (use_proxy && use_ssl && (s = strstr(tmp, "proxy-authorization:")) && - (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || + (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || *(s-1) == '\t' || *(s-1) == ' ')) { char *p = s + sizeof("proxy-authorization:") - 1; - + while (s > tmp && (*(s-1) == ' ' || *(s-1) == '\t')) s--; while (*p != 0 && *p != '\r' && *p != '\n') p++; while (*p == '\r' || *p == '\n') p++; @@@ -576,17 -563,7 +576,17 @@@ } } + /* Send a Connection: close header when using HTTP 1.1 or later to avoid + * hanging when the server interprets the RFC literally and establishes a + * keep-alive connection, unless the user specifically requests something + * else by specifying a Connection header in the context options. */ + if (protocol_version && + ((have_header & HTTP_HEADER_CONNECTION) == 0) && + (strncmp(protocol_version, "1.0", MIN(protocol_version_len, 3)) > 0)) { + php_stream_write_string(stream, "Connection: close\r\n"); + } + - if (context && + if (context && php_stream_context_get_option(context, "http", "user_agent", &ua_zval) == SUCCESS && Z_TYPE_PP(ua_zval) == IS_STRING) { ua_str = Z_STRVAL_PP(ua_zval);