Fix bug #71659

Fixed bug #71537 (PCRE segfault from Opcache)

Merge branch 'PHP-5.6' into PHP-7.0

* PHP-5.6:
Happy new year (Update copyright to 2016)

Happy new year (Update copyright to 2016)

Fixed bug #71178 (preg_replace with arrays creates [0] in replace array if not already set)

Removed or simplified incorrect SEPARATE_*() macros usage.

Merge branch 'PHP-5.6'

* PHP-5.6: (21 commits)
fix unit tests
update NEWS
add NEWS for fixes
Improve fix for #70172
Fix bug #70312 - HAVAL gives wrong hashes in

Merge branch 'PHP-5.6'

* PHP-5.6: (21 commits)
fix unit tests
update NEWS
add NEWS for fixes
Improve fix for #70172
Fix bug #70312 - HAVAL gives wrong hashes in specific cases
fix test
add test
Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage
Fix bug #70172 - Use After Free Vulnerability in unserialize()
Fix bug #70388 - SOAP serialize_function_call() type confusion
Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories
Improve fix for #70385
Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)
Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes)
Fix bug #70219 (Use after free vulnerability in session deserializer)
Fix bug ##70284 (Use after free vulnerability in unserialize() with GMP)
Fix for bug #69782
Add CVE IDs asigned (post release) to PHP 5.4.43
Add CVE IDs asigned to #69085 (PHP 5.4.39)
...

Conflicts:
ext/exif/exif.c
ext/gmp/gmp.c
ext/pcre/php_pcre.c
ext/session/session.c
ext/session/tests/session_decode_variation3.phpt
ext/soap/soap.c
ext/spl/spl_observer.c
ext/standard/var.c
ext/standard/var_unserializer.c
ext/standard/var_unserializer.re
ext/xsl/xsltprocessor.c

show more ...

Merge branch 'PHP-5.5' into PHP-5.6

* PHP-5.5:
More fixes for bug #70219

Merge branch 'PHP-5.5' into PHP-5.6

* PHP-5.5:
update NEWS
add NEWS for fixes
Improve fix for #70172
Fix bug #70312 - HAVAL gives wrong hashes in specific cases

Merge branch 'PHP-5.5' into PHP-5.6

* PHP-5.5:
update NEWS
add NEWS for fixes
Improve fix for #70172
Fix bug #70312 - HAVAL gives wrong hashes in specific cases
fix test
add test
Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage
Fix bug #70172 - Use After Free Vulnerability in unserialize()
Fix bug #70388 - SOAP serialize_function_call() type confusion
Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories
Improve fix for #70385
Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)
Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes)
Fix bug #70219 (Use after free vulnerability in session deserializer)
Fix for bug #69782
Add CVE IDs asigned (post release) to PHP 5.4.43
Add CVE IDs asigned to #69085 (PHP 5.4.39)
5.4.45 next

Conflicts:
ext/pcre/php_pcre.c
ext/standard/var_unserializer.c
ext/standard/var_unserializer.re
ext/zip/php_zip.c

show more ...

Merge branch 'PHP-5.4' into PHP-5.5

* PHP-5.4:
Improve fix for #70172
Fix bug #70312 - HAVAL gives wrong hashes in specific cases
fix test
add test
Fix bug #703

Merge branch 'PHP-5.4' into PHP-5.5

* PHP-5.4:
Improve fix for #70172
Fix bug #70312 - HAVAL gives wrong hashes in specific cases
fix test
add test
Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage
Fix bug #70172 - Use After Free Vulnerability in unserialize()
Fix bug #70388 - SOAP serialize_function_call() type confusion
Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories
Improve fix for #70385
Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)
Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes)
Fix bug #70219 (Use after free vulnerability in session deserializer)
Fix for bug #69782
Add CVE IDs asigned (post release) to PHP 5.4.43
Add CVE IDs asigned to #69085 (PHP 5.4.39)
5.4.45 next

Conflicts:
configure.in
ext/pcre/php_pcre.c
ext/standard/var_unserializer.c
ext/standard/var_unserializer.re
main/php_version.h

show more ...

Merge branch 'PHP-5.4.45' into PHP-5.5.29

* PHP-5.4.45:
add test
Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
Fix bug #70365 - us

Merge branch 'PHP-5.4.45' into PHP-5.5.29

* PHP-5.4.45:
add test
Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage
Fix bug #70172 - Use After Free Vulnerability in unserialize()
Fix bug #70388 - SOAP serialize_function_call() type confusion
Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories
Improve fix for #70385
Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)
Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes)

Conflicts:
ext/pcre/php_pcre.c
ext/standard/var_unserializer.c

show more ...

Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)

add some range checks to pcre

Merge branch 'PHP-5.6'

* PHP-5.6:
Fix #70232: Incorrect bump-along behavior with \K and empty string match

Resolved conflicts:
ext/pcre/php_pcre.c

Fix #70232: Incorrect bump-along behavior with \K and empty string match

To do global matching (/g), for every empty match we have to do a second match
with PCRE_NOTEMPTY turned on. That

Fix #70232: Incorrect bump-along behavior with \K and empty string match

To do global matching (/g), for every empty match we have to do a second match
with PCRE_NOTEMPTY turned on. That may fail, however, when the \K escape
sequence is involved. For this purpose libpcre 8.0 introduced the
PCRE_NOTEMPTY_ATSTART flag, which we will use if available, and otherwise fall
back to the old (possibly buggy) behavior.

show more ...

add new error constant PREG_JIT_STACKLIMIT_ERROR

Use ZSTR_ API to access zend_string elements (this is just renaming without semantick changes).

Improved zend_string API (Francois Laupretre)

Squashed commit of the following:

commit d96eab8d79b75ac83d49d49ae4665f948d15a804
Author: Francois Laupretre <francois@tekwire.net>

Improved zend_string API (Francois Laupretre)

Squashed commit of the following:

commit d96eab8d79b75ac83d49d49ae4665f948d15a804
Author: Francois Laupretre <francois@tekwire.net>
Date: Fri Jun 26 01:23:31 2015 +0200

Use the new 'ZSTR' macros in the rest of the code.

Does not change anything to the generated code (thanks to compat macros) but cleaner.

commit b3526439104ac7a89a8e0c79dbebf33b22bd01b8
Author: Francois Laupretre <francois@tekwire.net>
Date: Thu Jun 25 13:45:06 2015 +0200

Improve zend_string API

Add missing methods

show more ...

Merge branch 'PHP-5.6'

* PHP-5.6:
updated NEWS
Fixed Bug #53823 (preg_replace: * qualifier on unicode replace garbles the string)

Merge branch 'PHP-5.5' into PHP-5.6

* PHP-5.5:
updated NEWS
Fixed Bug #53823 (preg_replace: * qualifier on unicode replace garbles the string)

Fixed Bug #53823 (preg_replace: * qualifier on unicode replace garbles the string)

When advancing after empty matches, php_pcre_match_impl() as well as
php_pcre_replace_impl() always hav

Fixed Bug #53823 (preg_replace: * qualifier on unicode replace garbles the string)

When advancing after empty matches, php_pcre_match_impl() as well as
php_pcre_replace_impl() always have to advance to the next code point when the
u modifier is given, instead of to the next byte.

show more ...

Merge branch 'PHP-5.6'

* PHP-5.6:
Fixed bug #69864 (Segfault in preg_replace_callback)

Merge branch 'PHP-5.5' into PHP-5.6

* PHP-5.5:
updated NEWS
Fixed bug #69864 (Segfault in preg_replace_callback)

Fixed bug #69864 (Segfault in preg_replace_callback)

When preg_replace_callback() is used, cache entries which are in use must not
be removed. We ensure that by deploying a simple refcou

Fixed bug #69864 (Segfault in preg_replace_callback)

When preg_replace_callback() is used, cache entries which are in use must not
be removed. We ensure that by deploying a simple refcounting mechanism.

show more ...

Fixed Bug #69883 (Compilation failed on PCRE)