crypt: Fix possible buffer overread in php_crypt()

Drop support for crypt() without explicit salt

crypt() without salt generates a weak $1$ MD5 hash. It has been
throwing a notice since 2013 and we provide a much better alternative
i

Drop support for crypt() without explicit salt

crypt() without salt generates a weak $1$ MD5 hash. It has been
throwing a notice since 2013 and we provide a much better alternative
in password_hash() (which can auto-generate salts for strong
password hashes), so keeping this is just a liability.

show more ...

Remove proto comments from C files

Closes GH-5758

Clean house in cryptographic hashing code

- Remove dead code from php_crypt_r.c

This code has been commented out since the file was added in 2008. It's safe to say
that no-o

Clean house in cryptographic hashing code

- Remove dead code from php_crypt_r.c

This code has been commented out since the file was added in 2008. It's safe to say
that no-one is ever going to use it.

- Fix typo in comment in php_crypt_r.c

- Remove redundant Windows-only implementation of php_md5_crypt_r

There is a portable implementation in the same file, which is selected if not
building for Windows. But why should Windows have its own special implementation
of this function at all? There doesn't seem to be any good reason.

Better to use the portable implementation on all platforms.

- Don't define useless __CONST macro in php_crypt_r.h

This preprocessor macro is not used anywhere.

- Add comment on functions for encoding data as Base64

- Remove dead code from crypt_blowfish.h

- Remove unneeded junk comments from crypt_freesec.c

- Remove dead code from crypt_blowfish.c

This function has been commented out since 2011.

show more ...

Fix potential use-after-scope if crypt_r is used

Remove deprecated DES fallback in crypt()

Handle *0 / *1 more consistently

Avoid throwing a DES salt deprecation warning if the libc crypt
implementation is used.

Remove mention of PHP major version in Copyright headers

Closes GH-4732.

Fix build warnings

- switch from strncpy to memcpy for -Wstringop-truncation

Use unsigned char in _crypt_extended_r

Avoid signed shift UB.

Remove local variables

This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly

Remove local variables

This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly used by Vim and Emacs editors
yet with recent changes the once working definitions don't work
anymore in Vim without custom plugins or additional configuration.
Neither are these settings synced across the PHP code base.

A simpler and better approach is EditorConfig and fixing code
using some code style fixing tools in the future instead.

This patch also removes the so called modelines for Vim. Modelines
allow Vim editor specifically to set some editor configuration such as
syntax highlighting, indentation style and tab width to be set in the
first line or the last 5 lines per file basis. Since the php test
files have syntax highlighting already set in most editors properly and
EditorConfig takes care of the indentation settings, this patch removes
these as well for the Vim 6.0 and newer versions.

With the removal of local variables for certain editors such as
Emacs and Vim, the footer is also probably not needed anymore when
creating extensions using ext_skel.php script.

Additionally, Vim modelines for setting php syntax and some editor
settings has been removed from some *.phpt files. All these are
mostly not relevant for phpt files neither work properly in the
middle of the file.

show more ...

Remove yearly range from copyright notice

Remove year range from copyright notice

Future-proof email addresses

Future-proof email addresses...

Remove HAVE_STRING_H

The C89 standard and later defines the `<string.h>` header as part of
the standard headers [1] and on current systems it is always present.

Code included al

Remove HAVE_STRING_H

The C89 standard and later defines the `<string.h>` header as part of
the standard headers [1] and on current systems it is always present.

Code included also `<strings.h>` header as an alterinative in some
files. This kind of check was relevant on some older systems where the
`<strings.h>` file included definitions for the C89 compliant
`<string.h>`. Today such alternative check is not required anymore. The
`<strings.h>` file is part of the POSIX definition these days.

Also Autoconf suggests doing this and relying on C89 or above [2] and [3].

This patch also cleans few unused `<strings.h>` inclusions in the libmbfl.

[1]: https://port70.net/~nsz/c/c89/c89-draft.html#4.1.2
[2]: http://git.savannah.gnu.org/cgit/autoconf.git/tree/lib/autoconf/headers.m4
[3]: https://www.gnu.org/software/autoconf/manual/autoconf-2.69/autoconf.html

show more ...

Remove AC_STRUCT_TM macro

Autoconf 2.59d (released in 2006) [1] started promoting several macros
as not relevant for newer systems anymore, including the `AC_STRUCT_TM`.

This ma

Remove AC_STRUCT_TM macro

Autoconf 2.59d (released in 2006) [1] started promoting several macros
as not relevant for newer systems anymore, including the `AC_STRUCT_TM`.

This macro checks if `struct tm` is defined in either `<sys/time.h>` or
`<time.h>` and defines the `TM_IN_SYS_TIME` symbol accordingly. This
check was relevant in times before the C89 for some embedded systems,
microcontrollers or very old systems. For newer systems it can be
avoided and the `<time.h>` should be included instead since current
systems should be well supported by now. [2]

Since PHP requires at least C89, this patch removes the obsolescent call
and time.h checks.

Refs:

- [1]: http://git.savannah.gnu.org/cgit/autoconf.git/tree/NEWS
- [2]: https://www.gnu.org/software/autoconf/manual/autoconf-2.69/html_node/Particular-Structures.html

show more ...

Remove unused Git attributes ident

The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
use

Remove unused Git attributes ident

The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
user who changed it.

In Git this functionality is different and can be done with Git attribute
ident. These need to be defined manually for each file in the
.gitattributes file and are afterwards replaced with 40-character
hexadecimal blob object name which is based only on the particular file
contents.

This patch simplifies handling of $Id$ keywords by removing them since
they are not used anymore.

show more ...

year++

year++

year++

Update copyright headers to 2017

Update copyright headers to 2017

Update copyright headers to 2017

Use new param API in standard