Update http->https in license (#6945)

1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as

Update http->https in license (#6945)

1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |

show more ...

hash: Support custom algo parameters

The concrete need on this change is to support passing an initial seed
to the murmur hash. Passing a custom seed is important in terms of
randomi

hash: Support custom algo parameters

The concrete need on this change is to support passing an initial seed
to the murmur hash. Passing a custom seed is important in terms of
randomizing the hash function.

The suggested implementation adds a HashTable parameter to all the
init callbacks. Further on, an array with custom arguments is accepted
from `hash` or `hash_init` from the user land. Currently several things
like `hash_hkdf` are not touched, as they don't need passing custom
args.

Some convenience macros have been added to the SHA/MD families of
functions, so the consuming code doesn't have to be changed widely.

Another way to implement this is to add another type of the init that
would accept a HT with arguments. However, that would still require
touching all the context structs in all the algos. That would also
increase the size of those structs. As an init function is called just
once, the way of modifying the existing init callback has been seen
as more preferrable.

Closes GH-6400.

Signed-off-by: Anatol Belski <ab@php.net>
Co-Developed-by: Nikita Popov <nikita.ppv@googlemail.com>
Signed-off-by: Nikita Popov <nikita.ppv@googlemail.com>
Acked-by: Michael Wallner <mike@php.net>
Reviewed-by: Máté Kocsis <kocsismate@woohoolabs.com>
Reviewed-by: Eddie Kohler <ekohler@gmail.com>

show more ...

Make HashContexts serializable.

* Modify php_hash_ops to contain the algorithm name and
serialize and unserialize methods.

* Implement __serialize and __unserialize magic meth

Make HashContexts serializable.

* Modify php_hash_ops to contain the algorithm name and
serialize and unserialize methods.

* Implement __serialize and __unserialize magic methods on
HashContext.

Note that serialized HashContexts are not necessarily portable
between PHP versions or from architecture to architecture.
(Most are, though Keccak and slow SHA3s are not.)

An exception is thrown when an unsupported serialization is
attempted.

Because of security concerns, HASH_HMAC contexts are not
currently serializable; attempting to serialize one throws
an exception.

Serialization exposes the state of HashContext memory, so ensure
that memory is zeroed before use by allocating it with a new
php_hash_alloc_context function. Performance impact is
negligible.

Some hash internal states have logical pointers into a buffer,
or sponge, that absorbs input provided in bytes rather than
chunks. The unserialize functions for these hash functions
must validate that the logical pointers are all within bounds,
lest future hash operations cause out-of-bounds memory accesses.

* Adler32, CRC32, FNV, joaat: simple state, no buffer positions
* Gost, MD2, SHA3, Snefru, Tiger, Whirlpool: buffer positions
must be validated
* MD4, MD5, SHA1, SHA2, haval, ripemd: buffer positions encoded
bitwise, forced to within bounds on use; no need to validate

show more ...

SHA-3 Keccak_Hash: Store Keccak_HashInstance in the main context.

Previously, the Keccak_HashInstance was separately allocated.
This could cause memory leaks on errors. For instance,

SHA-3 Keccak_Hash: Store Keccak_HashInstance in the main context.

Previously, the Keccak_HashInstance was separately allocated.
This could cause memory leaks on errors. For instance,
in php_hash_do_hash_hmac, the following code cleans up after
a file read error:

if (n < 0) {
efree(context);
efree(K);
zend_string_release(digest);
RETURN_FALSE;
}

This does not call the context's hash_final operation, which
was the only way to free the separately-allocated Keccak state.

The simplest fix is simply to place the Keccak_HashInstance state
inside the context object. Then it doesn't need to be freed.

As a result, there is no need to call hash_final in the
HashContext destructor: HashContexts cannot contain internally
allocated resources.

show more ...

Fix [-Wchar-subscripts] in Hash extension

Use size_t type instead of char for string index.
Char may be unsigned on some platforms.

partial fix to bug 79431

Remove mention of PHP major version in Copyright headers

Closes GH-4732.

Merge branch 'PHP-7.3' into PHP-7.4

* PHP-7.3:
Always use ZEND_SECURE_ZERO() when cleaning up data
bump versions after release

Merge branch 'PHP-7.1' into PHP-7.2

* PHP-7.1:
Always use ZEND_SECURE_ZERO() when cleaning up data
bump versions after release

Always use ZEND_SECURE_ZERO() when cleaning up data

Optimizing compilers have an annoying tendency to throw out
memsets over data that they think aren't used anymore. Apply secure
ze

Always use ZEND_SECURE_ZERO() when cleaning up data

Optimizing compilers have an annoying tendency to throw out
memsets over data that they think aren't used anymore. Apply secure
zero-out in cases where this has potential to happen.

show more ...

Remove local variables

This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly

Remove local variables

This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly used by Vim and Emacs editors
yet with recent changes the once working definitions don't work
anymore in Vim without custom plugins or additional configuration.
Neither are these settings synced across the PHP code base.

A simpler and better approach is EditorConfig and fixing code
using some code style fixing tools in the future instead.

This patch also removes the so called modelines for Vim. Modelines
allow Vim editor specifically to set some editor configuration such as
syntax highlighting, indentation style and tab width to be set in the
first line or the last 5 lines per file basis. Since the php test
files have syntax highlighting already set in most editors properly and
EditorConfig takes care of the indentation settings, this patch removes
these as well for the Vim 6.0 and newer versions.

With the removal of local variables for certain editors such as
Emacs and Vim, the footer is also probably not needed anymore when
creating extensions using ext_skel.php script.

Additionally, Vim modelines for setting php syntax and some editor
settings has been removed from some *.phpt files. All these are
mostly not relevant for phpt files neither work properly in the
middle of the file.

show more ...

Remove yearly range from copyright notice

Hopefully last round of size_t fixes, this makes the remaining php_hash_ops use size_t over an int

Second round of fixing compiler warnings in ext/hash. Lots of the signatures that previously was unsigned int is now size_t, there was a fair bit of inconsistency there already and this commit should

Second round of fixing compiler warnings in ext/hash. Lots of the signatures that previously was unsigned int is now size_t, there was a fair bit of inconsistency there already and this commit should make it all sync nicely

show more ...

year++

year++

year++

Fix Bug #75284 sha3 is not supported on bigendian machine

Fixed bug #75303 sha3 hangs on bigendian

Replace slow generic sha3 implementation by https://github.com/gvanas/KeccakCodePackage

Fix hash_copy() tests by using correct size for sha3 context

sync config.w32 with with new sh

Replace slow generic sha3 implementation by https://github.com/gvanas/KeccakCodePackage

Fix hash_copy() tests by using correct size for sha3 context

sync config.w32 with with new sha3 files

Move dependency on KeccakHash.h to hash_sha3.c so we do not rely on it to install php_hash_sha3.h

Allocate memory for KeccacInstance in hash_sha3.c so header files do not need to know about implementation details while keeping API backward compatible to original sha3 implementation

Fix memory leak because hash_copy is called after init which already allocates the hashinstance

show more ...

Merge branch 'PHP-7.1'

* PHP-7.1:
Fix bug #73961 environmental build dependency in hash sha3 source

Fix bug #73961 environmental build dependency in hash sha3 source

Disallow non-crypto hashes in HMAC and PBKDF2

For this purpose add is_crypto flag to php_hash_ops.

Update copyright headers to 2017

Update copyright headers to 2017

Change Big Endian backup implementations to use signed indexes

load64() counted down from 7..0, but the decrement turned 0 into 255.
This means the loop would never terminate on Big Endi

Change Big Endian backup implementations to use signed indexes

load64() counted down from 7..0, but the decrement turned 0 into 255.
This means the loop would never terminate on Big Endian systems.

Just use signed char integers since we're only dealing with values from 0..7 anyway.

Closes https://bugs.php.net/bug.php?id=73282

show more ...