[packages/php/PHP_5_4] Rel 54. Security backports for EOL 5.4: shivammathur's PHP-5.4 branch (Patch200+) plus Remi, PLD 5.5
arekm
arekm at pld-linux.org
Thu Oct 22 11:26:25 CEST 2026
commit 579eeaf61d18c4a6de7000819578528a237e1e90
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Thu Oct 22 11:15:19 2026 +0200
Rel 54. Security backports for EOL 5.4: shivammathur's PHP-5.4 branch (Patch200+) plus Remi, PLD 5.5/5.6 and php-src ports (Patch500+); full session upload progress fix for CVE-2026-109618; re2c regenerates parsers in %prep.
Fix PLD patches: openssl_pkey_new() bn lookup and pkey_get_details() stack zvals (openssl.patch), uninitialised ibase timestamp (types.patch), unescaped REQUEST_URI in phpinfo() (php-pldlogo.patch), TZif check (php-systzdata.patch).
openssl.patch | 85 +-
php-bug47925.patch | 37 +
php-bug64938.patch | 31 +
php-bug65729.patch | 168 +++
php-bug66387.patch | 48 +
php-bug66502.patch | 52 +
php-bug69720.patch | 69 +
php-bug69975.patch | 78 ++
php-bug70002.patch | 26 +
php-bug70213.patch | 60 +
php-bug70433.patch | 61 +
php-bug70436.patch | 88 ++
php-bug70480.patch | 18 +
php-bug70661.patch | 95 ++
php-bug70728.patch | 74 ++
php-bug70741.patch | 52 +
php-bug70755.patch | 21 +
php-bug70979.patch | 25 +
php-bug71039.patch | 61 +
php-bug71323.patch | 1175 ++++++++++++++++
php-bug71331.patch | 60 +
php-bug71335.patch | 19 +
php-bug71354.patch | 36 +
php-bug71391.patch | 43 +
php-bug71459.patch | 46 +
php-bug71488.patch | 89 ++
php-bug71498.patch | 42 +
php-bug71527.patch | 21 +
php-bug71587.patch | 106 ++
php-bug71704.patch | 21 +
php-bug71798.patch | 18 +
php-bug71860.patch | 302 +++++
php-bug71882.patch | 47 +
php-bug71906.patch | 44 +
php-bug71912.patch | 43 +
php-bug72061.patch | 86 ++
php-bug72085.patch | 101 ++
php-bug72093.patch | 112 ++
php-bug72094.patch | 124 ++
php-bug72099.patch | 41 +
php-bug72114.patch | 41 +
php-bug72135.patch | 21 +
php-bug72142.patch | 47 +
php-bug72241.patch | 37 +
php-bug72275.patch | 19 +
php-bug72293.patch | 32 +
php-bug72298.patch | 18 +
php-bug72321.patch | 26 +
php-bug72339.patch | 65 +
php-bug72340.patch | 56 +
php-bug72400.patch | 111 ++
php-bug72402.patch | 56 +
php-bug72433.patch | 81 ++
php-bug72434.patch | 70 +
php-bug72446.patch | 20 +
php-bug72455.patch | 31 +
php-bug72479.patch | 73 +
php-bug72482.patch | 229 ++++
php-bug72512.patch | 33 +
php-bug72513.patch | 18 +
php-bug72519.patch | 51 +
php-bug72520.patch | 43 +
php-bug72533.patch | 70 +
php-bug72535.patch | 46 +
php-bug72562.patch | 66 +
php-bug72603.patch | 81 ++
php-bug72606.patch | 74 ++
php-bug72613.patch | 64 +
php-bug72618.patch | 101 ++
php-bug72627.patch | 99 ++
php-bug72663.patch | 80 ++
php-bug72681.patch | 120 ++
php-bug72682.patch | 40 +
php-bug72696.patch | 43 +
php-bug72697.patch | 70 +
php-bug72708.patch | 18 +
php-bug72709.patch | 62 +
php-bug72710.patch | 39 +
php-bug72714.patch | 133 ++
php-bug72716.patch | 19 +
php-bug72730.patch | 42 +
php-bug72749.patch | 81 ++
php-bug72750.patch | 63 +
php-bug72771.patch | 19 +
php-bug72787.patch | 42 +
php-bug72790.patch | 122 ++
php-bug72807.patch | 19 +
php-bug72823.patch | 51 +
php-bug72836.patch | 29 +
php-bug72837.patch | 38 +
php-bug72838.patch | 21 +
php-bug72848.patch | 21 +
php-bug72849.patch | 23 +
php-bug72850.patch | 31 +
php-bug72860.patch | 52 +
php-bug72907.patch | 148 +++
php-bug72910.patch | 28 +
php-bug72926.patch | 22 +
php-bug72928.patch | 102 ++
php-bug72994.patch | 53 +
php-bug73003.patch | 27 +
php-bug73007.patch | 18 +
php-bug73017.patch | 53 +
php-bug73029.patch | 69 +
php-bug73035.patch | 18 +
php-bug73052.patch | 52 +
php-bug73065.patch | 185 +++
php-bug73073.patch | 71 +
php-bug73082.patch | 36 +
php-bug73100.patch | 45 +
php-bug73144.patch | 56 +
php-bug73150.patch | 31 +
php-bug73174.patch | 66 +
php-bug73188.patch | 62 +
php-bug73189.patch | 42 +
php-bug73190.patch | 166 +++
php-bug73192.patch | 333 +++++
php-bug73208.patch | 18 +
php-bug73213.patch | 110 ++
php-bug73218.patch | 79 ++
php-bug73240.patch | 96 ++
php-bug73275.patch | 39 +
php-bug73276.patch | 35 +
php-bug73280.patch | 23 +
php-bug73284.patch | 91 ++
php-bug73293.patch | 62 +
php-bug73331.patch | 191 +++
php-bug73342.patch | 36 +
php-bug73356.patch | 241 ++++
php-bug73418.patch | 20 +
php-bug73473.patch | 17 +
php-bug73549.patch | 85 ++
php-bug73631.patch | 53 +
php-bug73737.patch | 36 +
php-bug73764.patch | 50 +
php-bug73768.patch | 48 +
php-bug73773.patch | 27 +
php-bug73809.patch | 71 +
php-bug73825.patch | 78 ++
php-bug73868.patch | 57 +
php-bug73869.patch | 55 +
php-bug74111.patch | 40 +
php-bug74145.patch | 72 +
php-bug74435.patch | 55 +
php-bug74603.patch | 57 +
php-bug74651.patch | 84 ++
php-bug74782.patch | 396 ++++++
php-bug75055.patch | 75 ++
php-bug75571.patch | 66 +
php-bug75981.patch | 58 +
php-bug76129.patch | 171 +++
php-bug76130.patch | 47 +
php-bug76248.patch | 22 +
php-bug76249.patch | 39 +
php-bug76423.patch | 45 +
php-bug76448.patch | 68 +
php-bug76452.patch | 99 ++
php-bug76557.patch | 63 +
php-bug76582.patch | 20 +
php-bug77020.patch | 41 +
php-bug77022.patch | 97 ++
php-bug77143.patch | 125 ++
php-bug77153.patch | 87 ++
php-bug77231.patch | 18 +
php-bug77242.patch | 35 +
php-bug77247.patch | 38 +
php-bug77270.patch | 48 +
php-bug77367.patch | 35 +
php-bug77369.patch | 20 +
php-bug77370.patch | 41 +
php-bug77371.patch | 110 ++
php-bug77380.patch | 49 +
php-bug77396.patch | 39 +
php-bug77418.patch | 81 ++
php-bug77423.patch | 160 +++
php-bug77431.patch | 36 +
php-bug77540.patch | 63 +
php-bug77563.patch | 47 +
php-bug77586.patch | 68 +
php-bug77630.patch | 83 ++
php-bug77753.patch | 20 +
php-bug77831.patch | 167 +++
php-bug77919.patch | 46 +
php-bug77950.patch | 22 +
php-bug77967.patch | 25 +
php-bug77973.patch | 56 +
php-bug77988.patch | 18 +
php-bug78069.patch | 20 +
php-bug78222.patch | 18 +
php-bug78256.patch | 50 +
php-bug78559.patch | 19 +
php-bug78599.patch | 20 +
php-bug78793.patch | 38 +
php-bug78863.patch | 74 ++
php-bug78875.patch | 26 +
php-bug78876.patch | 45 +
php-bug78878.patch | 42 +
php-bug78910.patch | 41 +
php-bug79037.patch | 55 +
php-bug79082.patch | 34 +
php-bug79099.patch | 83 ++
php-bug79221.patch | 74 ++
php-bug79265.patch | 278 ++++
php-bug79282.patch | 30 +
php-bug79329.patch | 18 +
php-bug79330.patch | 25 +
php-bug79465.patch | 27 +
php-bug79797.patch | 20 +
php-bug79877.patch | 23 +
php-bug79971.patch | 109 ++
php-bug80672.patch | 180 +++
php-bug80710.patch | 339 +++++
php-bug81026.patch | 392 ++++++
php-bug81122.patch | 50 +
php-bug81211.patch | 96 ++
php-bug81719.patch | 19 +
php-bug81720.patch | 123 ++
php-bug81726.patch | 79 ++
php-bug81727.patch | 50 +
php-bug81740.patch | 44 +
php-cve-2016-5385.patch | 100 ++
php-cve-2016-7479.patch | 169 +++
php-cve-2017-11145.patch | 38 +
php-cve-2017-7272.patch | 110 ++
php-cve-2018-10545.patch | 65 +
php-cve-2019-13224.patch | 38 +
php-cve-2020-7070.patch | 105 ++
php-cve-2023-0567.patch | 141 ++
php-cve-2023-0568.patch | 55 +
php-cve-2023-0662.patch | 68 +
php-cve-2023-3247.patch | 75 ++
php-cve-2023-3823.patch | 345 +++++
php-cve-2023-3824.patch | 83 ++
php-cve-2024-11233.patch | 116 ++
php-cve-2024-11234.patch | 92 ++
php-cve-2024-11236.patch | 101 ++
php-cve-2024-2756.patch | 148 +++
php-cve-2024-8925.patch | 152 +++
php-cve-2024-8927.patch | 48 +
php-cve-2024-8929.patch | 2205 +++++++++++++++++++++++++++++++
php-cve-2025-1217.patch | 1453 ++++++++++++++++++++
php-cve-2025-1220.patch | 137 ++
php-cve-2025-14177.patch | 120 ++
php-cve-2025-14181.patch | 98 ++
php-cve-2025-1735.patch | 312 +++++
php-cve-2025-6491.patch | 92 ++
php-cve-2026-109618-post_max_size.patch | 34 +
php-cve-2026-109618-session.patch | 782 +++++++++++
php-cve-2026-109618.patch | 564 ++++++++
php-cve-2026-14355.patch | 50 +
php-cve-2026-17543.patch | 152 +++
php-cve-2026-6103.patch | 380 ++++++
php-cve-2026-6722.patch | 189 +++
php-cve-2026-6735.patch | 65 +
php-cve-2026-7258.patch | 37 +
php-cve-2026-7260.patch | 95 ++
php-cve-2026-7261.patch | 118 ++
php-cve-2026-7262.patch | 65 +
php-cve-2026-91765.patch | 414 ++++++
php-cve-2026-91766.patch | 406 ++++++
php-cve-2026-92842.patch | 77 ++
php-cve-2026-9672.patch | 38 +
php-escapeshell-hardening.patch | 157 +++
php-exif-32bit-overflows.patch | 41 +
php-gh22761.patch | 38 +
php-ghsa-4w77-75f9-2c8w.patch | 99 ++
php-ghsa-ch8v-r6jh-4vvr.patch | 40 +
php-ghsa-www2-q4fc-65wf.patch | 300 +++++
php-glob-open-basedir.patch | 77 ++
php-http-empty-location.patch | 121 ++
php-libmagic-cve-2019-18218.patch | 43 +
php-mssql-dbconvert.patch | 43 +
php-onig-cve-2017-9224.patch | 24 +
php-onig-cve-2017-9226.patch | 39 +
php-onig-cve-2017-9227.patch | 18 +
php-onig-cve-2017-9228.patch | 20 +
php-onig-cve-2017-9229.patch | 32 +
php-onig-cve-2019-19204.patch | 19 +
php-onig-encoding-length.patch | 81 ++
php-openssl-pubkey-open-basedir.patch | 24 +
php-pldlogo.patch | 6 +-
php-soap-props-inplace.patch | 81 ++
php-sqlite3-defensive.patch | 137 ++
php-string-add-overflow.patch | 30 +
php-systzdata.patch | 2 +-
php-zpp-path-checks.patch | 31 +
php.spec | 581 +++++++-
types.patch | 5 +-
288 files changed, 27747 insertions(+), 50 deletions(-)
---
diff --git a/php.spec b/php.spec
index fd589e9..ac02b85 100644
--- a/php.spec
+++ b/php.spec
@@ -138,7 +138,7 @@ ERROR: You need to select at least one Apache SAPI to build shared modules.
%undefine with_filter
%endif
-%define rel 53
+%define rel 54
%define orgname php
%define ver_suffix 54
%define php_suffix %{!?with_default_php:%{ver_suffix}}
@@ -233,6 +233,296 @@ Patch76: libxml2.patch
Patch77: configure.patch
Patch78: types.patch
Patch79: includes.patch
+# Patch200+: security backports for EOL 5.4 from
+# https://github.com/shivammathur/php-src-backports/commits/PHP-5.4-security-backports
+# one patch per fix, the branch's later fix-ups folded into the patch they fix;
+# "PLD:" header lines name changes against the branch; binary test fixtures are
+# left out (GNU patch cannot apply them), so those tests fail
+Patch200: php-bug69720.patch
+Patch201: php-bug70433.patch
+Patch202: php-bug70728.patch
+Patch203: php-bug70661.patch
+Patch204: php-bug70741.patch
+Patch205: php-bug70755.patch
+Patch206: php-bug71459.patch
+Patch207: php-bug71039.patch
+Patch208: php-bug71354.patch
+Patch209: php-bug71391.patch
+Patch210: php-bug71488.patch
+Patch211: php-bug71323.patch
+Patch212: php-bug71498.patch
+Patch213: php-bug71587.patch
+Patch214: php-bug71860.patch
+Patch215: php-bug71704.patch
+Patch216: php-bug71798.patch
+Patch217: php-bug72099.patch
+Patch218: php-bug72061.patch
+Patch219: php-bug71912.patch
+Patch220: php-bug72094.patch
+Patch221: php-bug72093.patch
+Patch222: php-bug71331.patch
+Patch223: php-bug72241.patch
+Patch224: php-bug72135.patch
+Patch225: php-bug72114.patch
+Patch226: php-bug72339.patch
+Patch227: php-bug72402.patch
+Patch228: php-bug72433.patch
+Patch229: php-bug72340.patch
+Patch230: php-bug72434.patch
+Patch231: php-bug66387.patch
+Patch232: php-bug72613.patch
+Patch233: php-bug70480.patch
+Patch234: php-bug72513.patch
+Patch235: php-bug72562.patch
+Patch236: php-bug72603.patch
+Patch237: php-bug72618.patch
+Patch238: php-bug72533.patch
+Patch239: php-bug69975.patch
+Patch240: php-bug72479.patch
+Patch241: php-bug72606.patch
+Patch242: php-bug72520.patch
+Patch243: php-bug72837.patch
+Patch244: php-bug72663.patch
+Patch245: php-bug72681.patch
+Patch246: php-bug72807.patch
+Patch247: php-bug72838.patch
+Patch248: php-bug72697.patch
+Patch249: php-bug72730.patch
+Patch250: php-bug72708.patch
+Patch251: php-bug72848.patch
+Patch252: php-bug72849.patch
+Patch253: php-bug72850.patch
+Patch254: php-bug72771.patch
+Patch255: php-bug72749.patch
+Patch256: php-bug72750.patch
+Patch257: php-bug72790.patch
+Patch258: php-bug72293.patch
+Patch259: php-bug72860.patch
+Patch260: php-bug72928.patch
+Patch261: php-bug73007.patch
+Patch262: php-bug73029.patch
+Patch263: php-bug73065.patch
+Patch264: php-bug72455.patch
+Patch265: php-bug73189.patch
+Patch266: php-bug73190.patch
+Patch267: php-bug73150.patch
+Patch268: php-bug73284.patch
+Patch269: php-bug73218.patch
+Patch270: php-bug73208.patch
+Patch271: php-bug73082.patch
+Patch272: php-bug73174.patch
+Patch273: php-bug73276.patch
+Patch274: php-bug73275.patch
+Patch275: php-bug73017.patch
+Patch276: php-bug73240.patch
+Patch277: php-bug73073.patch
+Patch278: php-bug73293.patch
+Patch279: php-bug73280.patch
+Patch280: php-bug72482.patch
+Patch281: php-bug72696.patch
+Patch282: php-bug73418.patch
+Patch283: php-bug73144.patch
+Patch284: php-bug73192.patch
+Patch285: php-bug73331.patch
+Patch286: php-soap-props-inplace.patch
+Patch287: php-bug73631.patch
+Patch288: php-bug73737.patch
+Patch289: php-bug73868.patch
+Patch290: php-bug73869.patch
+Patch291: php-bug73764.patch
+Patch292: php-bug73768.patch
+Patch293: php-bug73773.patch
+Patch294: php-bug73825.patch
+Patch295: php-bug72627.patch
+Patch296: php-bug71906.patch
+Patch297: php-bug74145.patch
+Patch298: php-bug74651.patch
+Patch299: php-bug70436.patch
+Patch300: php-cve-2017-11145.patch
+Patch301: php-bug74435.patch
+Patch302: php-onig-cve-2017-9226.patch
+Patch303: php-onig-cve-2017-9224.patch
+Patch304: php-onig-cve-2017-9227.patch
+Patch305: php-onig-cve-2017-9228.patch
+Patch306: php-onig-cve-2017-9229.patch
+Patch307: php-bug74603.patch
+Patch308: php-bug75055.patch
+Patch309: php-bug72535.patch
+Patch310: php-bug75571.patch
+Patch311: php-bug74782.patch
+Patch312: php-bug71335.patch
+Patch313: php-cve-2018-10545.patch
+Patch314: php-bug76130.patch
+Patch315: php-bug76249.patch
+Patch316: php-bug76248.patch
+Patch317: php-bug76129.patch
+Patch318: php-bug75981.patch
+Patch319: php-bug77242.patch
+Patch320: php-bug77247.patch
+Patch321: php-bug77270.patch
+Patch322: php-bug77371.patch
+Patch323: php-bug77380.patch
+Patch324: php-bug77418.patch
+Patch325: php-bug77630.patch
+Patch326: php-bug77431.patch
+Patch327: php-bug77396.patch
+Patch328: php-bug77540.patch
+Patch329: php-bug77586.patch
+Patch330: php-bug77563.patch
+Patch331: php-bug76557.patch
+Patch332: php-bug78069.patch
+Patch333: php-bug77967.patch
+Patch334: php-bug77973.patch
+Patch335: php-bug77988.patch
+Patch336: php-bug78256.patch
+Patch337: php-bug78222.patch
+Patch338: php-cve-2019-13224.patch
+Patch339: php-bug78599.patch
+Patch340: php-bug78910.patch
+Patch341: php-bug78878.patch
+Patch342: php-bug78793.patch
+Patch343: php-bug78863.patch
+Patch344: php-bug79037.patch
+Patch345: php-bug79099.patch
+Patch346: php-bug79082.patch
+Patch347: php-bug79221.patch
+Patch348: php-bug79329.patch
+Patch349: php-bug79282.patch
+Patch350: php-bug79330.patch
+Patch351: php-bug79465.patch
+Patch352: php-bug78875.patch
+Patch353: php-bug78876.patch
+Patch354: php-bug79877.patch
+Patch355: php-cve-2020-7070.patch
+Patch356: php-bug73809.patch
+Patch357: php-bug80672.patch
+Patch358: php-bug76448.patch
+Patch359: php-bug79971.patch
+Patch360: php-bug81026.patch
+Patch361: php-bug81720.patch
+Patch362: php-bug81719.patch
+Patch363: php-bug81122.patch
+Patch364: php-bug76452.patch
+Patch365: php-bug81726.patch
+Patch366: php-bug81727.patch
+Patch367: php-bug81740.patch
+Patch368: php-cve-2023-0568.patch
+Patch369: php-cve-2023-0567.patch
+Patch370: php-cve-2023-0662.patch
+Patch371: php-cve-2023-3824.patch
+Patch372: php-cve-2023-3823.patch
+Patch373: php-cve-2023-3247.patch
+Patch374: php-cve-2024-2756.patch
+Patch375: php-cve-2024-8925.patch
+Patch376: php-cve-2024-8927.patch
+Patch377: php-cve-2024-11233.patch
+Patch378: php-cve-2024-11234.patch
+Patch379: php-cve-2024-11236.patch
+Patch380: php-cve-2024-8929.patch
+Patch381: php-bug79797.patch
+Patch382: php-bug77423.patch
+Patch383: php-bug77143.patch
+Patch384: php-bug77020.patch
+Patch385: php-bug76423.patch
+Patch386: php-bug76582.patch
+Patch387: php-bug77153.patch
+Patch388: php-bug77753.patch
+Patch389: php-bug77367.patch
+Patch390: php-bug77831.patch
+Patch391: php-bug77950.patch
+Patch392: php-bug77369.patch
+Patch393: php-cve-2025-1217.patch
+Patch394: php-cve-2025-6491.patch
+Patch395: php-cve-2025-1220.patch
+Patch396: php-bug78559.patch
+Patch397: php-cve-2026-6722.patch
+Patch398: php-cve-2026-7262.patch
+Patch399: php-cve-2026-7261.patch
+Patch400: php-cve-2026-6735.patch
+Patch401: php-cve-2016-5385.patch
+Patch402: php-cve-2026-14355.patch
+Patch403: php-cve-2026-7260.patch
+Patch404: php-cve-2026-9672.patch
+Patch405: php-cve-2026-17543.patch
+Patch406: php-bug77370.patch
+Patch407: php-onig-encoding-length.patch
+Patch408: php-exif-32bit-overflows.patch
+Patch409: php-bug72446.patch
+Patch410: php-bug79265.patch
+Patch411: php-cve-2025-1735.patch
+Patch412: php-cve-2026-92842.patch
+Patch413: php-cve-2025-14181.patch
+Patch414: php-cve-2026-91765.patch
+Patch415: php-cve-2026-91766.patch
+Patch416: php-http-empty-location.patch
+Patch417: php-cve-2026-6103.patch
+Patch418: php-bug71527.patch
+Patch419: php-bug64938.patch
+Patch420: php-string-add-overflow.patch
+Patch421: php-bug72275.patch
+Patch422: php-bug72400.patch
+Patch423: php-bug72298.patch
+Patch424: php-bug72519.patch
+Patch425: php-bug72926.patch
+Patch426: php-bug73035.patch
+Patch427: php-bug77231.patch
+Patch428: php-bug72512.patch
+Patch429: php-bug70002.patch
+Patch430: php-bug72321.patch
+Patch431: php-bug74111.patch
+Patch432: php-bug73342.patch
+Patch433: php-cve-2016-7479.patch
+Patch434: php-cve-2017-7272.patch
+Patch435: php-escapeshell-hardening.patch
+Patch436: php-cve-2026-109618.patch
+# Patch500+: fixes that branch lacks, from Remi Collet's scl-php55, PLD's PHP_5_5
+# and PHP_5_6 branches and php-src/oniguruma commits; each patch header names its source
+Patch500: php-bug72714.patch
+Patch501: php-bug65729.patch
+Patch502: php-bug72716.patch
+Patch503: php-bug72836.patch
+Patch504: php-bug73549.patch
+Patch505: php-bug47925.patch
+Patch506: php-bug80710.patch
+Patch507: php-cve-2025-14177.patch
+Patch508: php-gh22761.patch
+Patch509: php-ghsa-4w77-75f9-2c8w.patch
+Patch510: php-ghsa-ch8v-r6jh-4vvr.patch
+Patch511: php-ghsa-www2-q4fc-65wf.patch
+Patch512: php-libmagic-cve-2019-18218.patch
+Patch513: php-sqlite3-defensive.patch
+Patch514: php-glob-open-basedir.patch
+Patch515: php-bug72142.patch
+Patch516: php-bug72710.patch
+Patch517: php-bug66502.patch
+Patch518: php-bug72709.patch
+Patch519: php-bug72823.patch
+Patch520: php-bug72085.patch
+Patch521: php-bug72787.patch
+Patch522: php-bug73188.patch
+Patch523: php-bug73100.patch
+Patch524: php-bug70213.patch
+Patch525: php-bug72907.patch
+Patch526: php-bug71882.patch
+Patch527: php-bug73213.patch
+Patch528: php-mssql-dbconvert.patch
+Patch529: php-bug72682.patch
+Patch530: php-bug73003.patch
+Patch531: php-bug73052.patch
+Patch532: php-bug73473.patch
+Patch533: php-bug81211.patch
+Patch534: php-openssl-pubkey-open-basedir.patch
+Patch535: php-bug72910.patch
+Patch536: php-bug73356.patch
+Patch537: php-bug77919.patch
+Patch538: php-cve-2026-7258.patch
+Patch539: php-zpp-path-checks.patch
+Patch540: php-bug72994.patch
+Patch541: php-onig-cve-2019-19204.patch
+Patch542: php-bug77022.patch
+Patch543: php-bug70979.patch
+Patch544: php-cve-2026-109618-session.patch
+Patch545: php-cve-2026-109618-post_max_size.patch
URL: https://www.php.net/
%{?with_interbase:%{!?with_interbase_inst:BuildRequires: Firebird-devel >= 1.0.2.908-2}}
%{?with_pspell:BuildRequires: aspell-devel >= 2:0.50.0}
@@ -293,6 +583,7 @@ BuildRequires: pam-devel
BuildRequires: pkgconfig
%{?with_pgsql:BuildRequires: postgresql-backend-devel >= 7.2}
%{?with_pgsql:BuildRequires: postgresql-devel}
+BuildRequires: re2c >= 0.13.4
BuildRequires: readline-devel
%{?with_recode:BuildRequires: recode-devel >= 3.5d-3}
BuildRequires: rpm >= 4.4.9-56
@@ -2078,6 +2369,294 @@ cp -p php.ini-production php.ini
%patch -P77 -p1
%patch -P78 -p1
%patch -P79 -p1
+%patch -P200 -p1
+%patch -P201 -p1
+%patch -P202 -p1
+%patch -P203 -p1
+%patch -P204 -p1
+%patch -P205 -p1
+%patch -P206 -p1
+%patch -P207 -p1
+%patch -P208 -p1
+%patch -P209 -p1
+%patch -P210 -p1
+%patch -P211 -p1
+%patch -P212 -p1
+%patch -P213 -p1
+%patch -P214 -p1
+%patch -P215 -p1
+%patch -P216 -p1
+%patch -P217 -p1
+%patch -P218 -p1
+%patch -P219 -p1
+%patch -P220 -p1
+%patch -P221 -p1
+%patch -P222 -p1
+%patch -P223 -p1
+%patch -P224 -p1
+%patch -P225 -p1
+%patch -P226 -p1
+%patch -P227 -p1
+%patch -P228 -p1
+%patch -P229 -p1
+%patch -P230 -p1
+%patch -P231 -p1
+%patch -P232 -p1
+%patch -P233 -p1
+%patch -P234 -p1
+%patch -P235 -p1
+%patch -P236 -p1
+%patch -P237 -p1
+%patch -P238 -p1
+%patch -P239 -p1
+%patch -P240 -p1
+%patch -P241 -p1
+%patch -P242 -p1
+%patch -P243 -p1
+%patch -P244 -p1
+%patch -P245 -p1
+%patch -P246 -p1
+%patch -P247 -p1
+%patch -P248 -p1
+%patch -P249 -p1
+%patch -P250 -p1
+%patch -P251 -p1
+%patch -P252 -p1
+%patch -P253 -p1
+%patch -P254 -p1
+%patch -P255 -p1
+%patch -P256 -p1
+%patch -P257 -p1
+%patch -P258 -p1
+%patch -P259 -p1
+%patch -P260 -p1
+%patch -P261 -p1
+%patch -P262 -p1
+%patch -P263 -p1
+%patch -P264 -p1
+%patch -P265 -p1
+%patch -P266 -p1
+%patch -P267 -p1
+%patch -P268 -p1
+%patch -P269 -p1
+%patch -P270 -p1
+%patch -P271 -p1
+%patch -P272 -p1
+%patch -P273 -p1
+%patch -P274 -p1
+%patch -P275 -p1
+%patch -P276 -p1
+%patch -P277 -p1
+%patch -P278 -p1
+%patch -P279 -p1
+%patch -P280 -p1
+%patch -P281 -p1
+%patch -P282 -p1
+%patch -P283 -p1
+%patch -P284 -p1
+%patch -P285 -p1
+%patch -P286 -p1
+%patch -P287 -p1
+%patch -P288 -p1
+%patch -P289 -p1
+%patch -P290 -p1
+%patch -P291 -p1
+%patch -P292 -p1
+%patch -P293 -p1
+%patch -P294 -p1
+%patch -P295 -p1
+%patch -P296 -p1
+%patch -P297 -p1
+%patch -P298 -p1
+%patch -P299 -p1
+%patch -P300 -p1
+%patch -P301 -p1
+%patch -P302 -p1
+%patch -P303 -p1
+%patch -P304 -p1
+%patch -P305 -p1
+%patch -P306 -p1
+%patch -P307 -p1
+%patch -P308 -p1
+%patch -P309 -p1
+%patch -P310 -p1
+%patch -P311 -p1
+%patch -P312 -p1
+%patch -P313 -p1
+%patch -P314 -p1
+%patch -P315 -p1
+%patch -P316 -p1
+%patch -P317 -p1
+%patch -P318 -p1
+%patch -P319 -p1
+%patch -P320 -p1
+%patch -P321 -p1
+%patch -P322 -p1
+%patch -P323 -p1
+%patch -P324 -p1
+%patch -P325 -p1
+%patch -P326 -p1
+%patch -P327 -p1
+%patch -P328 -p1
+%patch -P329 -p1
+%patch -P330 -p1
+%patch -P331 -p1
+%patch -P332 -p1
+%patch -P333 -p1
+%patch -P334 -p1
+%patch -P335 -p1
+%patch -P336 -p1
+%patch -P337 -p1
+%patch -P338 -p1
+%patch -P339 -p1
+%patch -P340 -p1
+%patch -P341 -p1
+%patch -P342 -p1
+%patch -P343 -p1
+%patch -P344 -p1
+%patch -P345 -p1
+%patch -P346 -p1
+%patch -P347 -p1
+%patch -P348 -p1
+%patch -P349 -p1
+%patch -P350 -p1
+%patch -P351 -p1
+%patch -P352 -p1
+%patch -P353 -p1
+%patch -P354 -p1
+%patch -P355 -p1
+%patch -P356 -p1
+%patch -P357 -p1
+%patch -P358 -p1
+%patch -P359 -p1
+%patch -P360 -p1
+%patch -P361 -p1
+%patch -P362 -p1
+%patch -P363 -p1
+%patch -P364 -p1
+%patch -P365 -p1
+%patch -P366 -p1
+%patch -P367 -p1
+%patch -P368 -p1
+%patch -P369 -p1
+%patch -P370 -p1
+%patch -P371 -p1
+%patch -P372 -p1
+%patch -P373 -p1
+%patch -P374 -p1
+%patch -P375 -p1
+%patch -P376 -p1
+%patch -P377 -p1
+%patch -P378 -p1
+%patch -P379 -p1
+%patch -P380 -p1
+%patch -P381 -p1
+%patch -P382 -p1
+%patch -P383 -p1
+%patch -P384 -p1
+%patch -P385 -p1
+%patch -P386 -p1
+%patch -P387 -p1
+%patch -P388 -p1
+%patch -P389 -p1
+%patch -P390 -p1
+%patch -P391 -p1
+%patch -P392 -p1
+%patch -P393 -p1
+%patch -P394 -p1
+%patch -P395 -p1
+%patch -P396 -p1
+%patch -P397 -p1
+%patch -P398 -p1
+%patch -P399 -p1
+%patch -P400 -p1
+%patch -P401 -p1
+%patch -P402 -p1
+%patch -P403 -p1
+%patch -P404 -p1
+%patch -P405 -p1
+%patch -P406 -p1
+%patch -P407 -p1
+%patch -P408 -p1
+%patch -P409 -p1
+%patch -P410 -p1
+%patch -P411 -p1
+%patch -P412 -p1
+%patch -P413 -p1
+%patch -P414 -p1
+%patch -P415 -p1
+%patch -P416 -p1
+%patch -P417 -p1
+%patch -P418 -p1
+%patch -P419 -p1
+%patch -P420 -p1
+%patch -P421 -p1
+%patch -P422 -p1
+%patch -P423 -p1
+%patch -P424 -p1
+%patch -P425 -p1
+%patch -P426 -p1
+%patch -P427 -p1
+%patch -P428 -p1
+%patch -P429 -p1
+%patch -P430 -p1
+%patch -P431 -p1
+%patch -P432 -p1
+%patch -P433 -p1
+%patch -P434 -p1
+%patch -P435 -p1
+%patch -P436 -p1
+%patch -P500 -p1
+%patch -P501 -p1
+%patch -P502 -p1
+%patch -P503 -p1
+%patch -P504 -p1
+%patch -P505 -p1
+%patch -P506 -p1
+%patch -P507 -p1
+%patch -P508 -p1
+%patch -P509 -p1
+%patch -P510 -p1
+%patch -P511 -p1
+%patch -P512 -p1
+%patch -P513 -p1
+%patch -P514 -p1
+%patch -P515 -p1
+%patch -P516 -p1
+%patch -P517 -p1
+%patch -P518 -p1
+%patch -P519 -p1
+%patch -P520 -p1
+%patch -P521 -p1
+%patch -P522 -p1
+%patch -P523 -p1
+%patch -P524 -p1
+%patch -P525 -p1
+%patch -P526 -p1
+%patch -P527 -p1
+%patch -P528 -p1
+%patch -P529 -p1
+%patch -P530 -p1
+%patch -P531 -p1
+%patch -P532 -p1
+%patch -P533 -p1
+%patch -P534 -p1
+%patch -P535 -p1
+%patch -P536 -p1
+%patch -P537 -p1
+%patch -P538 -p1
+%patch -P539 -p1
+%patch -P540 -p1
+%patch -P541 -p1
+%patch -P542 -p1
+%patch -P543 -p1
+%patch -P544 -p1
+%patch -P545 -p1
+
+# backports patch only the .re sources; date has no make rule and the
+# unserializer one is skipped silently when configure finds no re2c
+re2c --no-generation-date -b -o ext/standard/var_unserializer.c ext/standard/var_unserializer.re
+re2c --no-generation-date -d -b -o ext/date/lib/parse_date.c ext/date/lib/parse_date.re
sed -E -i -e '1s,#!\s*/usr/bin/env\s+(.*),#!%{__bindir}\1,' \
run-tests.php
diff --git a/openssl.patch b/openssl.patch
index 6088228..ba528e4 100644
--- a/openssl.patch
+++ b/openssl.patch
@@ -234,7 +234,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
+ char *str = emalloc(len + 1); \
+ BN_bn2bin(_bn, (unsigned char*)str); \
+ str[len] = 0; \
-+ add_assoc_stringl(&_array, #_name, str, len, 0); \
++ add_assoc_stringl(_array, #_name, str, len, 0); \
+ } \
+} while (0);
+
@@ -242,7 +242,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
+
+#define OPENSSL_PKEY_SET_BN(_data, _name) do { \
+ zval **bn; \
-+ if (zend_hash_find(Z_ARRVAL_PP(_data), #_name, sizeof(#_name), (void**)bn) == SUCCESS && \
++ if (zend_hash_find(Z_ARRVAL_PP(_data), #_name, sizeof(#_name), (void**)&bn) == SUCCESS && \
+ Z_TYPE_PP(bn) == IS_STRING) { \
+ _name = BN_bin2bn( \
+ (unsigned char*)Z_STRVAL_PP(bn), \
@@ -445,7 +445,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
if (EVP_PKEY_assign_DH(pkey, dh)) {
RETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC));
}
-@@ -3382,25 +3547,32 @@
+@@ -3382,25 +3547,33 @@
/*TODO: Use the real values once the openssl constants are used
* See the enum at the top of this file
*/
@@ -474,14 +474,15 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
+ ktype = OPENSSL_KEYTYPE_RSA;
+
+ if (rsa != NULL) {
-+ zval z_rsa;
++ zval *z_rsa;
+ const BIGNUM *n, *e, *d, *p, *q, *dmp1, *dmq1, *iqmp;
+
+ RSA_get0_key(rsa, &n, &e, &d);
+ RSA_get0_factors(rsa, &p, &q);
+ RSA_get0_crt_params(rsa, &dmp1, &dmq1, &iqmp);
+
-+ array_init(&z_rsa);
++ ALLOC_INIT_ZVAL(z_rsa);
++ array_init(z_rsa);
+ OPENSSL_PKEY_GET_BN(z_rsa, n);
+ OPENSSL_PKEY_GET_BN(z_rsa, e);
+ OPENSSL_PKEY_GET_BN(z_rsa, d);
@@ -490,12 +491,12 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
+ OPENSSL_PKEY_GET_BN(z_rsa, dmp1);
+ OPENSSL_PKEY_GET_BN(z_rsa, dmq1);
+ OPENSSL_PKEY_GET_BN(z_rsa, iqmp);
-+ add_assoc_zval(return_value, "rsa", &z_rsa);
++ add_assoc_zval(return_value, "rsa", z_rsa);
+ }
}
break;
-@@ -3408,37 +3580,47 @@
+@@ -3408,37 +3581,49 @@
case EVP_PKEY_DSA2:
case EVP_PKEY_DSA3:
case EVP_PKEY_DSA4:
@@ -517,19 +518,20 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
+ ktype = OPENSSL_KEYTYPE_DSA;
+
+ if (dsa != NULL) {
-+ zval z_dsa;
++ zval *z_dsa;
+ const BIGNUM *p, *q, *g, *priv_key, *pub_key;
+
+ DSA_get0_pqg(dsa, &p, &q, &g);
+ DSA_get0_key(dsa, &pub_key, &priv_key);
+
-+ array_init(&z_dsa);
++ ALLOC_INIT_ZVAL(z_dsa);
++ array_init(z_dsa);
+ OPENSSL_PKEY_GET_BN(z_dsa, p);
+ OPENSSL_PKEY_GET_BN(z_dsa, q);
+ OPENSSL_PKEY_GET_BN(z_dsa, g);
+ OPENSSL_PKEY_GET_BN(z_dsa, priv_key);
+ OPENSSL_PKEY_GET_BN(z_dsa, pub_key);
-+ add_assoc_zval(return_value, "dsa", &z_dsa);
++ add_assoc_zval(return_value, "dsa", z_dsa);
+ }
}
break;
@@ -552,25 +554,26 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
+ ktype = OPENSSL_KEYTYPE_DH;
+
+ if (dh != NULL) {
-+ zval z_dh;
++ zval *z_dh;
+ const BIGNUM *p, *q, *g, *priv_key, *pub_key;
+
+ DH_get0_pqg(dh, &p, &q, &g);
+ DH_get0_key(dh, &pub_key, &priv_key);
+
-+ array_init(&z_dh);
++ ALLOC_INIT_ZVAL(z_dh);
++ array_init(z_dh);
+ OPENSSL_PKEY_GET_BN(z_dh, p);
+ OPENSSL_PKEY_GET_BN(z_dh, g);
+ OPENSSL_PKEY_GET_BN(z_dh, priv_key);
+ OPENSSL_PKEY_GET_BN(z_dh, pub_key);
-+ add_assoc_zval(return_value, "dh", &z_dh);
++ add_assoc_zval(return_value, "dh", z_dh);
+ }
}
-
break;
#ifdef HAVE_EVP_PKEY_EC
case EVP_PKEY_EC:
-@@ -3915,13 +4097,13 @@
+@@ -3915,13 +4100,13 @@
cryptedlen = EVP_PKEY_size(pkey);
cryptedbuf = emalloc(cryptedlen + 1);
@@ -586,7 +589,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
padding) == cryptedlen);
break;
default:
-@@ -3973,13 +4155,13 @@
+@@ -3973,13 +4158,13 @@
cryptedlen = EVP_PKEY_size(pkey);
crypttemp = emalloc(cryptedlen + 1);
@@ -602,7 +605,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
padding);
if (cryptedlen != -1) {
cryptedbuf = emalloc(cryptedlen + 1);
-@@ -4038,13 +4220,13 @@
+@@ -4038,13 +4223,13 @@
cryptedlen = EVP_PKEY_size(pkey);
cryptedbuf = emalloc(cryptedlen + 1);
@@ -618,7 +621,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
padding) == cryptedlen);
break;
default:
-@@ -4097,13 +4279,13 @@
+@@ -4097,13 +4282,13 @@
cryptedlen = EVP_PKEY_size(pkey);
crypttemp = emalloc(cryptedlen + 1);
@@ -634,7 +637,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
padding);
if (cryptedlen != -1) {
cryptedbuf = emalloc(cryptedlen + 1);
-@@ -4167,7 +4349,7 @@
+@@ -4167,7 +4352,7 @@
long keyresource = -1;
char * data;
int data_len;
@@ -643,7 +646,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
zval *method = NULL;
long signature_algo = OPENSSL_ALGO_SHA1;
const EVP_MD *mdtype;
-@@ -4200,9 +4382,11 @@
+@@ -4200,9 +4385,11 @@
siglen = EVP_PKEY_size(pkey);
sigbuf = emalloc(siglen + 1);
@@ -658,7 +661,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
zval_dtor(signature);
sigbuf[siglen] = '\0';
ZVAL_STRINGL(signature, (char *)sigbuf, siglen, 0);
-@@ -4211,7 +4395,7 @@
+@@ -4211,7 +4398,7 @@
efree(sigbuf);
RETVAL_FALSE;
}
@@ -667,7 +670,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
if (keyresource == -1) {
EVP_PKEY_free(pkey);
}
-@@ -4224,8 +4408,8 @@
+@@ -4224,8 +4411,8 @@
{
zval **key;
EVP_PKEY *pkey;
@@ -678,7 +681,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
const EVP_MD *mdtype;
long keyresource = -1;
char * data; int data_len;
-@@ -4259,10 +4443,13 @@
+@@ -4259,10 +4446,13 @@
RETURN_FALSE;
}
@@ -696,7 +699,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
if (keyresource == -1) {
EVP_PKEY_free(pkey);
-@@ -4286,7 +4473,7 @@
+@@ -4286,7 +4476,7 @@
char *method =NULL;
int method_len = 0;
const EVP_CIPHER *cipher;
@@ -705,7 +708,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "szza/|s", &data, &data_len, &sealdata, &ekeys, &pubkeys, &method, &method_len) == FAILURE) {
return;
-@@ -4333,9 +4520,10 @@
+@@ -4333,9 +4523,10 @@
i++;
}
@@ -718,7 +721,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
goto clean_exit;
}
-@@ -4345,17 +4533,17 @@
+@@ -4345,17 +4536,17 @@
iv = ivlen ? emalloc(ivlen + 1) : NULL;
#endif
/* allocate one byte extra to make room for \0 */
@@ -741,7 +744,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
if (len1 + len2 > 0) {
zval_dtor(sealdata);
-@@ -4384,7 +4572,7 @@
+@@ -4384,7 +4575,7 @@
efree(buf);
}
RETVAL_LONG(len1 + len2);
@@ -750,7 +753,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
clean_exit:
for (i=0; i<nkeys; i++) {
-@@ -4411,7 +4599,7 @@
+@@ -4411,7 +4602,7 @@
int len1, len2;
unsigned char *buf;
long keyresource = -1;
@@ -759,7 +762,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
char * data; int data_len;
char * ekey; int ekey_len;
char *method =NULL;
-@@ -4440,24 +4628,23 @@
+@@ -4440,24 +4631,23 @@
buf = emalloc(data_len + 1);
@@ -795,7 +798,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
}
/* }}} */
-@@ -4765,7 +4952,7 @@
+@@ -4765,7 +4955,7 @@
char *data, *method;
int data_len, method_len;
const EVP_MD *mdtype;
@@ -804,7 +807,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
int siglen;
unsigned char *sigbuf;
-@@ -4781,9 +4968,10 @@
+@@ -4781,9 +4971,10 @@
siglen = EVP_MD_size(mdtype);
sigbuf = emalloc(siglen + 1);
@@ -818,7 +821,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
if (raw_output) {
sigbuf[siglen] = '\0';
RETVAL_STRINGL((char *)sigbuf, siglen, 0);
-@@ -4799,6 +4987,8 @@
+@@ -4799,6 +4990,8 @@
efree(sigbuf);
RETVAL_FALSE;
}
@@ -827,7 +830,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
}
/* }}} */
-@@ -4844,7 +5034,7 @@
+@@ -4844,7 +5037,7 @@
char *data, *method, *password, *iv = "";
int data_len, method_len, password_len, iv_len = 0, max_iv_len;
const EVP_CIPHER *cipher_type;
@@ -836,7 +839,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
int i=0, outlen, keylen;
unsigned char *outbuf, *key;
zend_bool free_iv;
-@@ -4858,6 +5048,12 @@
+@@ -4858,6 +5051,12 @@
RETURN_FALSE;
}
@@ -849,7 +852,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
keylen = EVP_CIPHER_key_length(cipher_type);
if (keylen > password_len) {
key = emalloc(keylen);
-@@ -4876,19 +5072,19 @@
+@@ -4876,19 +5075,19 @@
outlen = data_len + EVP_CIPHER_block_size(cipher_type);
outbuf = emalloc(outlen + 1);
@@ -875,7 +878,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
outlen += i;
if (options & OPENSSL_RAW_DATA) {
outbuf[outlen] = '\0';
-@@ -4911,7 +5107,7 @@
+@@ -4911,7 +5110,7 @@
if (free_iv) {
efree(iv);
}
@@ -884,7 +887,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
}
/* }}} */
-@@ -4923,7 +5119,7 @@
+@@ -4923,7 +5122,7 @@
char *data, *method, *password, *iv = "";
int data_len, method_len, password_len, iv_len = 0;
const EVP_CIPHER *cipher_type;
@@ -893,7 +896,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
int i, outlen, keylen;
unsigned char *outbuf, *key;
int base64_str_len;
-@@ -4945,10 +5141,17 @@
+@@ -4945,10 +5144,17 @@
RETURN_FALSE;
}
@@ -911,7 +914,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
RETURN_FALSE;
}
data_len = base64_str_len;
-@@ -4969,17 +5172,17 @@
+@@ -4969,17 +5175,17 @@
outlen = data_len + EVP_CIPHER_block_size(cipher_type);
outbuf = emalloc(outlen + 1);
@@ -935,7 +938,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
outlen += i;
outbuf[outlen] = '\0';
RETVAL_STRINGL((char *)outbuf, outlen, 0);
-@@ -4996,7 +5199,7 @@
+@@ -4996,7 +5202,7 @@
if (base64_str) {
efree(base64_str);
}
@@ -944,7 +947,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
}
/* }}} */
-@@ -5034,6 +5237,7 @@
+@@ -5034,6 +5240,7 @@
zval *key;
char *pub_str;
int pub_len;
@@ -952,7 +955,7 @@ diff -ur php-5.4.45/ext/openssl.org/openssl.c php-5.4.45/ext/openssl/openssl.c
EVP_PKEY *pkey;
BIGNUM *pub;
char *data;
-@@ -5043,14 +5247,18 @@
+@@ -5043,14 +5250,18 @@
return;
}
ZEND_FETCH_RESOURCE(pkey, EVP_PKEY *, &key, -1, "OpenSSL key", le_key);
diff --git a/php-bug47925.patch b/php-bug47925.patch
new file mode 100644
index 0000000..4afc2ee
--- /dev/null
+++ b/php-bug47925.patch
@@ -0,0 +1,37 @@
+From: Niels Dossche <7771979+nielsdos at users.noreply.github.com>
+Date: Sat May 25 16:11:43 2024 +0200
+Subject: [PATCH] Fix bug #47925: PHPClient can't decompress response
+
+Backport of https://github.com/php/php-src/commit/35e62e9b590690f24fe78e3097d5bddcfb913e61
+and https://github.com/php/php-src/commit/ce7ed6e040f4c57604a19e6a7d2ed5e401f6f02d
+(net effect: gzip bodies go to gzdecode() whole, deflate unchanged)
+
+5.6: the old code passed http_body+10 with length http_body_size-10 without
+copying, so a gzip response shorter than 10 bytes gave gzinflate() a
+negative length and inflate() read past the heap buffer. Not an upstream
+advisory; the test needs pcntl and the 8.x server.inc API and is not
+included.
+
+Source: PLD php PHP_5_6 branch, https://git.pld-linux.org/?p=packages/php.git;a=blob_plain;hb=refs/heads/PHP_5_6;f=php-bug47925.patch
+---
+diff --git a/ext/soap/php_http.c b/ext/soap/php_http.c
+--- a/ext/soap/php_http.c
++++ b/ext/soap/php_http.c
+@@ -1194,12 +1194,14 @@ try_again:
+ zval param;
+ zval *params[1];
+
++ /* Warning: the zlib function names are chosen in an unfortunate manner.
++ * Check zlib.c to see how a function corresponds with a particular format. */
+ if ((strcmp(content_encoding,"gzip") == 0 ||
+ strcmp(content_encoding,"x-gzip") == 0) &&
+- zend_hash_exists(EG(function_table), "gzinflate", sizeof("gzinflate"))) {
+- ZVAL_STRING(&func, "gzinflate", 0);
++ zend_hash_exists(EG(function_table), "gzdecode", sizeof("gzdecode"))) {
++ ZVAL_STRING(&func, "gzdecode", 0);
+ params[0] = ¶m;
+- ZVAL_STRINGL(params[0], http_body+10, http_body_size-10, 0);
++ ZVAL_STRINGL(params[0], http_body, http_body_size, 0);
+ INIT_PZVAL(params[0]);
+ } else if (strcmp(content_encoding,"deflate") == 0 &&
+ zend_hash_exists(EG(function_table), "gzuncompress", sizeof("gzuncompress"))) {
diff --git a/php-bug64938.patch b/php-bug64938.patch
new file mode 100644
index 0000000..a776dab
--- /dev/null
+++ b/php-bug64938.patch
@@ -0,0 +1,31 @@
+From: Martin Jansen <martin at divbyzero.net>
+Date: Thu Jan 22 20:58:15 2015 +0100
+Subject: [PATCH] Fix bug #64938: libxml_disable_entity_loader setting is shared between threads
+
+The availability of entity loading is stored in a module global which
+previously was only initialized in the GINIT constructor. This had the
+effect that disabling the entity loader in one request caused
+subsequent requests hitting the same Apache child process to also have
+the loader disabled.
+
+With this change the loader is explicitely enabled in the request init
+phase.
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/052ba62e14eeb303271674b9eb5b4a42352d5111
+---
+diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
+--- a/ext/libxml/libxml.c
++++ b/ext/libxml/libxml.c
+@@ -868,6 +868,12 @@ static PHP_RINIT_FUNCTION(libxml)
+ xmlSetGenericErrorFunc(NULL, php_libxml_error_handler);
+ xmlParserInputBufferCreateFilenameDefault(php_libxml_input_buffer_create_filename);
+ xmlOutputBufferCreateFilenameDefault(php_libxml_output_buffer_create_filename);
++
++ /* Enable the entity loader by default. This ensure that
++ * other threads/requests that might have disable the loader
++ * do not affect the current request.
++ */
++ LIBXML(entity_loader_disabled) = 0;
+ }
+ return SUCCESS;
+ }
diff --git a/php-bug65729.patch b/php-bug65729.patch
new file mode 100644
index 0000000..a40a93a
--- /dev/null
+++ b/php-bug65729.patch
@@ -0,0 +1,168 @@
+From: Tjerk Meesters <tjerk at muvee.com>
+Date: Sat Sep 21 16:45:20 2013 +0800
+Subject: [PATCH] Fix #65729: CN_match gives false positive when wildcard is used
+
+The wildcard check took any certificate CN "*.<x>" as a match when ".<x>"
+occurred at the first dot of the expected name, so "*.bank.co" matched
+"www.bank.com" and "*.test.com" matched "foo.test.com.sg".
+
+Source: upstream https://github.com/php/php-src/pull/465 (5.6.0), squashed:
+8915c3fb4f, 8e847b5845, a820c3d6ba, 674dd73f8c, 39c0daeb71, 6106896440
+PLD: matches_wildcard_name() as in 5.6.40 xp_ssl.c, with the GHSA-xr7j-rvgx-xq5p
+(CVE-2026-91767) length fix from https://github.com/php/php-src/commit/78cc82b37a
+and a const wildcard pointer; test kept in its pcntl/CN_match form
+---
+diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c
+--- a/ext/openssl/openssl.c
++++ b/ext/openssl/openssl.c
+@@ -4694,6 +4694,40 @@ static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx) /* {{{ */
+ }
+ /* }}} */
+
++static zend_bool matches_wildcard_name(const char *subjectname, const char *certname) /* {{{ */
++{
++ const char *wildcard = NULL;
++ size_t prefix_len, suffix_len, subject_len;
++
++ if (strcasecmp(subjectname, certname) == 0) {
++ return 1;
++ }
++
++ /* wildcard, if present, must only be present in the left-most component */
++ if (!(wildcard = strchr(certname, '*')) || memchr(certname, '.', wildcard - certname)) {
++ return 0;
++ }
++
++ /* 1) prefix, if not empty, must match subject */
++ prefix_len = wildcard - certname;
++ if (prefix_len && strncasecmp(subjectname, certname, prefix_len) != 0) {
++ return 0;
++ }
++
++ suffix_len = strlen(wildcard + 1);
++ subject_len = strlen(subjectname);
++ if (suffix_len + prefix_len <= subject_len) {
++ /* 2) suffix must match
++ * 3) no . between prefix and suffix
++ **/
++ return strcasecmp(wildcard + 1, subjectname + subject_len - suffix_len) == 0 &&
++ memchr(subjectname + prefix_len, '.', subject_len - suffix_len - prefix_len) == NULL;
++ }
++
++ return 0;
++}
++/* }}} */
++
+ int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stream TSRMLS_DC) /* {{{ */
+ {
+ zval **val = NULL;
+@@ -4746,16 +4780,7 @@ int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stre
+ return FAILURE;
+ }
+
+- match = strcasecmp(cnmatch, buf) == 0;
+- if (!match && strlen(buf) > 3 && buf[0] == '*' && buf[1] == '.') {
+- /* Try wildcard */
+-
+- if (strchr(buf+2, '.')) {
+- char *tmp = strstr(cnmatch, buf+1);
+-
+- match = tmp && strcasecmp(tmp, buf+2) && tmp == strchr(cnmatch, '.');
+- }
+- }
++ match = matches_wildcard_name(cnmatch, buf);
+
+ if (!match) {
+ /* didn't match */
+diff --git a/ext/openssl/tests/bug65729.pem b/ext/openssl/tests/bug65729.pem
+new file mode 100644
+--- /dev/null
++++ b/ext/openssl/tests/bug65729.pem
+@@ -0,0 +1,28 @@
++-----BEGIN CERTIFICATE-----
++MIICCTCCAXICCQDNMI29sowT7TANBgkqhkiG9w0BAQUFADBJMQswCQYDVQQGEwJT
++RzESMBAGA1UECBMJVGVzdHZpbGxlMREwDwYDVQQKEwhkYXRpYmJhdzETMBEGA1UE
++AxQKKi50ZXN0LmNvbTAeFw0xMzA5MjEwNzUyMjRaFw0xNDA5MjEwNzUyMjRaMEkx
++CzAJBgNVBAYTAlNHMRIwEAYDVQQIEwlUZXN0dmlsbGUxETAPBgNVBAoTCGRhdGli
++YmF3MRMwEQYDVQQDFAoqLnRlc3QuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
++iQKBgQCdzVnic8K5W4SVbwVuqezcTjeqVLoQ91vVNZB0Jnsuz6q3DoK03oAd1jTe
++Vd0k+MQDbXpHoc37lA4+8z/g5Bs0UXxNx+nkbFTE7Ba2/G24caI9/cOXZPG3UViD
++rtqXKL6h5/umqRG9Dt5liF2MVP9XFAesVC7B8+Ca+PbPlQoYzwIDAQABMA0GCSqG
++SIb3DQEBBQUAA4GBAAS07u/Ke+EhEHidz6CG3Qcr+zg483JKRgZFyGz+YUKyyKKy
++fmLs7JieGJxYQjOmIpj/6X9Gnb2HjIPDnI6A+MV1emXDTnnmsgf2/lZGcthhpZn2
++rMbj9bI0iH6HwOVGtp4ZJA5fB7nj3J+gWNTCQzDDOxwX36d2LL9ua+UMnk/g
++-----END CERTIFICATE-----
++-----BEGIN RSA PRIVATE KEY-----
++MIICXQIBAAKBgQCdzVnic8K5W4SVbwVuqezcTjeqVLoQ91vVNZB0Jnsuz6q3DoK0
++3oAd1jTeVd0k+MQDbXpHoc37lA4+8z/g5Bs0UXxNx+nkbFTE7Ba2/G24caI9/cOX
++ZPG3UViDrtqXKL6h5/umqRG9Dt5liF2MVP9XFAesVC7B8+Ca+PbPlQoYzwIDAQAB
++AoGAeyzTwKPDl5QMRejHQL57GOwlH1vLcXrjv+VzwHZZKQ0IoKM++5fCQYf29KXp
++XPahaluGW2u9sWa8R/7wGcd0Q4RtquGzsgT3+AQsIc5KfIamyOyDaRVM/ymX3fWg
++gHIU7OOzB+ihOU8sHyRIwfbk01/kmrBXLRj8E31sy3i3PIECQQDQQYE+aN7Acrdt
++yN5CaqvbkiCGjRvASlemiTzPosgOtndyp21w1gakJwKYhYDk1N6A6Qb8REMZqM/U
++wFypldV/AkEAwfq6NFuhpGL6hDA7MvlyY1KiZ0cHetPUX+PgdNqy2DA+1Sv4i7gm
++Wd/uA651K7aPXuUaf9dKtPCmZwI4M6SEsQJBALW89HTqP7niYoDEEnITdPaghxHk
++gptERUln6lGo1L1CLus3gSI/JHyMLo+7scgAnEwTD62GRKhX0Ubwt+ymfTECQAY5
++fHYnppU20+EgBxZIqOIFCc8UmWnYmE0Ha/Fz/x8u1SVUBuK84wYpSGL32yyu7ATY
++hzQo/W229zABAzqtAdECQQCUdB7IBFpPnsfv/EUBFX7X/7zAc9JpACmu9It5ju8C
++KIsMuz/02D+TQoJNjdAngBM+4AJDIaGFgTMIfaDMh5L7
++-----END RSA PRIVATE KEY-----
+diff --git a/ext/openssl/tests/bug65729.phpt b/ext/openssl/tests/bug65729.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/openssl/tests/bug65729.phpt
+@@ -0,0 +1,54 @@
++--TEST--
++Bug #65729: CN_match gives false positive when wildcard is used
++--SKIPIF--
++<?php
++if (!extension_loaded("openssl")) die("skip");
++if (!function_exists('pcntl_fork')) die("skip no fork");
++--FILE--
++<?php
++$context = stream_context_create();
++
++stream_context_set_option($context, 'ssl', 'local_cert', __DIR__ . "/bug65729.pem");
++stream_context_set_option($context, 'ssl', 'allow_self_signed', true);
++$server = stream_socket_server('ssl://127.0.0.1:64321', $errno, $errstr,
++ STREAM_SERVER_BIND|STREAM_SERVER_LISTEN, $context);
++
++$expected_names = array('foo.test.com.sg', 'foo.test.com', 'FOO.TEST.COM', 'foo.bar.test.com');
++
++$pid = pcntl_fork();
++if ($pid == -1) {
++ die('could not fork');
++} else if ($pid) {
++ foreach ($expected_names as $expected_name) {
++ $contextC = stream_context_create(array(
++ 'ssl' => array(
++ 'verify_peer' => true,
++ 'allow_self_signed' => true,
++ 'CN_match' => $expected_name,
++ )
++ ));
++ var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1,
++ STREAM_CLIENT_CONNECT, $contextC));
++ }
++} else {
++ @pcntl_wait($status);
++ foreach ($expected_names as $name) {
++ @stream_socket_accept($server, 1);
++ }
++}
++--EXPECTF--
++Warning: stream_socket_client(): Peer certificate CN=`*.test.com' did not match expected CN=`foo.test.com.sg' in %s on line %d
++
++Warning: stream_socket_client(): Failed to enable crypto in %s on line %d
++
++Warning: stream_socket_client(): unable to connect to ssl://127.0.0.1:64321 (Unknown error) in %s on line %d
++bool(false)
++resource(%d) of type (stream)
++resource(%d) of type (stream)
++
++Warning: stream_socket_client(): Peer certificate CN=`*.test.com' did not match expected CN=`foo.bar.test.com' in %s on line %d
++
++Warning: stream_socket_client(): Failed to enable crypto in %s on line %d
++
++Warning: stream_socket_client(): unable to connect to ssl://127.0.0.1:64321 (Unknown error) in %s on line %d
++bool(false)
diff --git a/php-bug66387.patch b/php-bug66387.patch
new file mode 100644
index 0000000..f0145a0
--- /dev/null
+++ b/php-bug66387.patch
@@ -0,0 +1,48 @@
+From: Christoph M. Becker <cmb at php.net>
+Date: Mon Jul 20 23:24:55 2015 +0200
+Subject: [PATCH] Fix #66387: Stack overflow with imagefilltoborder
+
+The stack overflow is caused by the recursive algorithm in combination with a
+very large negative coordinate passed to gdImageFillToBorder(). As there is
+already a clipping for large positive coordinates to the width and height of
+the image, it seems to be consequent to clip to zero also.
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/bbd1dd5c820685d1d1203e57ca45d4b3dad1bdf2
+---
+diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
+--- a/ext/gd/libgd/gd.c
++++ b/ext/gd/libgd/gd.c
+@@ -1770,9 +1770,13 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
+
+ if (x >= im->sx) {
+ x = im->sx - 1;
++ } else if (x < 0) {
++ x = 0;
+ }
+ if (y >= im->sy) {
+ y = im->sy - 1;
++ } else if (y < 0) {
++ y = 0;
+ }
+
+ for (i = x; i >= 0; i--) {
+diff --git a/ext/gd/tests/bug66387.phpt b/ext/gd/tests/bug66387.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/gd/tests/bug66387.phpt
+@@ -0,0 +1,15 @@
++--TEST--
++Bug #66387 (Stack overflow with imagefilltoborder)
++--SKIPIF--
++<?php
++if (!extension_loaded('gd')) die('skip gd extension not available!');
++?>
++--FILE--
++<?php
++$im = imagecreatetruecolor(20, 20);
++$c = imagecolorallocate($im, 255, 0, 0);
++imagefilltoborder($im, 0, -999355, $c, $c);
++echo "ready\n";
++?>
++--EXPECT--
++ready
diff --git a/php-bug66502.patch b/php-bug66502.patch
new file mode 100644
index 0000000..5f19160
--- /dev/null
+++ b/php-bug66502.patch
@@ -0,0 +1,52 @@
+From: Christoph M. Becker <cmb at php.net>
+Date: Fri Jul 15 00:57:36 2016 +0200
+Subject: [PATCH] Fix bug #66502: DOM document dangling reference
+
+When we decrement the refcount of a node's document, we state that we
+won't need it anymore. Therefore we can *always* set the pointer to the
+document to NULL, what avoids invalid memory accesses for some edge cases
+as demonstrated with the PHPT.
+
+Original patch provided by Sean Heelan.
+
+Source: upstream https://github.com/php/php-src/commit/a4aa4f9772 (5.6.25)
+---
+diff --git a/ext/dom/tests/bug66502.phpt b/ext/dom/tests/bug66502.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/dom/tests/bug66502.phpt
+@@ -0,0 +1,20 @@
++--TEST--
++Bug #66502 (DOM document dangling reference)
++--SKIPIF--
++<?php
++if (!extension_loaded('dom')) die('skip requires ext/dom');
++?>
++--FILE--
++<?php
++$dom = new DOMDocument('1.0', 'UTF-8');
++$element = $dom->appendChild(new DOMElement('root'));
++$comment = new DOMComment("Comment 0");
++$comment = $element->appendChild($comment);
++
++$comment->__construct("Comment 1");
++$comment->__construct("Comment 2");
++$comment->__construct("Comment 3");
++echo 'DONE', PHP_EOL;
++?>
++--EXPECT--
++DONE
+\ No newline at end of file
+diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
+--- a/ext/libxml/libxml.c
++++ b/ext/libxml/libxml.c
+@@ -1265,8 +1265,8 @@ PHP_LIBXML_API int php_libxml_decrement_doc_ref(php_libxml_node_object *object T
+ efree(object->document->doc_props);
+ }
+ efree(object->document);
+- object->document = NULL;
+ }
++ object->document = NULL;
+ }
+
+ return ret_refcount;
diff --git a/php-bug69720.patch b/php-bug69720.patch
new file mode 100644
index 0000000..92f4805
--- /dev/null
+++ b/php-bug69720.patch
@@ -0,0 +1,69 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon Sep 28 15:51:59 2015 -0700
+Subject: [PATCH] Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/5fb8fe0a7eff6c7fb4d7aee5abbd030a400295d1
+Binary test fixtures not included: ext/phar/tests/bug69720.phar
+---
+diff --git a/ext/phar/tests/bug69720.phpt b/ext/phar/tests/bug69720.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/phar/tests/bug69720.phpt
+@@ -0,0 +1,40 @@
++--TEST--
++Phar - bug #69720 - Null pointer dereference in phar_get_fp_offset()
++--SKIPIF--
++<?php if (!extension_loaded("phar")) die("skip"); ?>
++--FILE--
++<?php
++try {
++ // open an existing phar
++ $p = new Phar(__DIR__."/bug69720.phar",0);
++ // Phar extends SPL's DirectoryIterator class
++ echo $p->getMetadata();
++ foreach (new RecursiveIteratorIterator($p) as $file) {
++ // $file is a PharFileInfo class, and inherits from SplFileInfo
++ $temp="";
++ $temp= $file->getFileName() . "\n";
++ $temp.=file_get_contents($file->getPathName()) . "\n"; // display contents
++ var_dump($file->getMetadata());
++ }
++}
++ catch (Exception $e) {
++ echo 'Could not open Phar: ', $e;
++}
++?>
++--EXPECTF--
++
++MY_METADATA_NULL
++
++Warning: file_get_contents(phar:///%s): failed to open stream: phar error: "test.php" is not a file in phar "%s.phar" in %s.php on line %d
++array(1) {
++ ["whatever"]=>
++ int(123)
++}
++object(DateTime)#2 (3) {
++ ["date"]=>
++ string(26) "2000-01-01 00:00:00.000000"
++ ["timezone_type"]=>
++ int(3)
++ ["timezone"]=>
++ string(3) "UTC"
++}
+diff --git a/ext/phar/util.c b/ext/phar/util.c
+--- a/ext/phar/util.c
++++ b/ext/phar/util.c
+@@ -716,7 +716,12 @@ really_get_entry:
+ (*ret)->is_tar = entry->is_tar;
+ (*ret)->fp = phar_get_efp(entry, 1 TSRMLS_CC);
+ if (entry->link) {
+- (*ret)->zero = phar_get_fp_offset(phar_get_link_source(entry TSRMLS_CC) TSRMLS_CC);
++ phar_entry_info *link = phar_get_link_source(entry TSRMLS_CC);
++ if(!link) {
++ efree(*ret);
++ return FAILURE;
++ }
++ (*ret)->zero = phar_get_fp_offset(link TSRMLS_CC);
+ } else {
+ (*ret)->zero = phar_get_fp_offset(entry TSRMLS_CC);
+ }
diff --git a/php-bug69975.patch b/php-bug69975.patch
new file mode 100644
index 0000000..c40861b
--- /dev/null
+++ b/php-bug69975.patch
@@ -0,0 +1,78 @@
+From: Christoph M. Becker <cmb at php.net>
+Date: Fri Jul 3 00:04:50 2015 +0200
+Subject: [PATCH] Fix #69975: PHP segfaults when accessing nvarchar(max) defined columns
+
+The SQL Server Native Client 11.0 and maybe other ODBC drivers report
+NVARCHAR(MAX) columns as SQL_WVARCHAR with size 0. This causes too small a
+buffer to be emalloc'd, likely causing a segfault in the following. As we don't
+know the real size of the column data, we treat such colums as
+SQL_WLONGVARCHAR.
+
+The related bug #67437 suggests that some drivers report a size of ~4GB. It is
+not certain that this is really the case (there might be some integer overflow
+involved, and anyway, there has been no feedback), so we do not cater for this
+now. However, it would not be hard to treat all sizes above a certain threshold
+in a similar way, i.e. as SQL_WLONGVARCHAR.
+
+Upstream: https://github.com/php/php-src/commit/16db4d1462bf3eacb93c0cd940f799160a284b24
+
+Upstream: https://github.com/php/php-src/commit/344ff5dd4c538eaebea075f7705321f8b86d0b47
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/fa7f74476497d05c5f3ad3033aebe4f16a12adb6
+---
+diff --git a/ext/odbc/php_odbc.c b/ext/odbc/php_odbc.c
+--- a/ext/odbc/php_odbc.c
++++ b/ext/odbc/php_odbc.c
+@@ -998,6 +998,15 @@ int odbc_bindcols(odbc_result *result TSRMLS_DC)
+ default:
+ rc = SQLColAttributes(result->stmt, (SQLUSMALLINT)(i+1), colfieldid,
+ NULL, 0, NULL, &displaysize);
++#if defined(ODBCVER) && (ODBCVER >= 0x0300)
++ /* Workaround for drivers that report NVARCHAR(MAX) columns as SQL_WVARCHAR with size 0 (bug #69975) */
++ if (result->values[i].coltype == SQL_WVARCHAR && displaysize == 0) {
++ result->values[i].coltype = SQL_WLONGVARCHAR;
++ result->values[i].value = NULL;
++ break;
++ }
++#endif
++
+ /* Workaround for Oracle ODBC Driver bug (#50162) when fetching TIMESTAMP column */
+ if (result->values[i].coltype == SQL_TIMESTAMP) {
+ displaysize += 3;
+diff --git a/ext/odbc/tests/bug69975.phpt b/ext/odbc/tests/bug69975.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/odbc/tests/bug69975.phpt
+@@ -0,0 +1,32 @@
++--TEST--
++Bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns)
++--SKIPIF--
++<?php include 'skipif.inc'; ?>
++--FILE--
++<?php
++include 'config.inc';
++
++$conn = odbc_connect($dsn, $user, $pass);
++ at odbc_exec($conn, 'CREATE DATABASE odbcTEST');
++odbc_exec($conn, 'CREATE TABLE FOO (ID INT, VARCHAR_COL NVARCHAR(MAX))');
++odbc_exec($conn, "INSERT INTO FOO VALUES (1, 'foo')");
++
++$result = odbc_exec($conn, "SELECT VARCHAR_COL FROM FOO");
++var_dump(odbc_fetch_array($result));
++
++echo "ready";
++?>
++--EXPECT--
++array(1) {
++ ["VARCHAR_COL"]=>
++ string(3) "foo"
++}
++ready
++--CLEAN--
++<?php
++include 'config.inc';
++
++$conn = odbc_connect($dsn, $user, $pass);
++odbc_exec($conn, 'DROP TABLE FOO');
++odbc_exec($conn, 'DROP DATABASE odbcTEST');
++?>
diff --git a/php-bug70002.patch b/php-bug70002.patch
new file mode 100644
index 0000000..9a6e4da
--- /dev/null
+++ b/php-bug70002.patch
@@ -0,0 +1,26 @@
+From: Anatol Belski <ab at php.net>
+Date: Tue Jul 28 17:41:38 2015 +0200
+Subject: [PATCH] Fixed bug #70002 TS issues with temporary dir handling
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/8cd09e8a5ac6781a985600414e816bda45c852ab
+---
+diff --git a/main/php_open_temporary_file.c b/main/php_open_temporary_file.c
+--- a/main/php_open_temporary_file.c
++++ b/main/php_open_temporary_file.c
+@@ -176,7 +176,15 @@ static int php_do_open_temporary_file(const char *path, const char *pfx, char **
+ /* }}} */
+
+ /* Cache the chosen temporary directory. */
+-static char* temporary_directory;
++static
++#ifdef ZTS
++#ifdef PHP_WIN32
++__declspec(thread)
++#elif defined(__GNUC__)
++__thread
++#endif
++#endif
++char* temporary_directory;
+
+ PHPAPI void php_shutdown_temporary_directory(void)
+ {
diff --git a/php-bug70213.patch b/php-bug70213.patch
new file mode 100644
index 0000000..3e0d4a3
--- /dev/null
+++ b/php-bug70213.patch
@@ -0,0 +1,60 @@
+From: Nikita Popov <nikic at php.net>
+Date: Sun Jan 1 14:10:49 2017 +0100
+Subject: [PATCH] FIx bug #70213
+
+Source: upstream https://github.com/php/php-src/commit/a65ad951ad (5.6.30); generated var_unserializer.c left out, %prep regenerates it
+---
+diff --git a/ext/standard/tests/serialize/bug70213.phpt b/ext/standard/tests/serialize/bug70213.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/standard/tests/serialize/bug70213.phpt
+@@ -0,0 +1,30 @@
++--TEST--
++Bug #70213: Unserialize context shared on double class lookup
++--FILE--
++<?php
++
++ini_set('unserialize_callback_func', 'evil');
++
++function evil() {
++ function __autoload($arg) {
++ var_dump(unserialize('R:1;'));
++ }
++}
++
++var_dump(unserialize('a:2:{i:0;i:42;i:1;O:4:"evil":0:{}}'));
++
++?>
++--EXPECTF--
++Notice: unserialize(): Error at offset 4 of 4 bytes in %s on line %d
++bool(false)
++
++Warning: unserialize(): Function evil() hasn't defined the class it was called for in %s on line %d
++array(2) {
++ [0]=>
++ int(42)
++ [1]=>
++ object(__PHP_Incomplete_Class)#1 (1) {
++ ["__PHP_Incomplete_Class_Name"]=>
++ string(4) "evil"
++ }
++}
+diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
+--- a/ext/standard/var_unserializer.re
++++ b/ext/standard/var_unserializer.re
+@@ -840,6 +840,7 @@ object ":" uiv ":" ["] {
+ }
+
+ /* The callback function may have defined the class */
++ BG(serialize_lock)++;
+ if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) {
+ ce = *pce;
+ } else {
+@@ -847,6 +848,7 @@ object ":" uiv ":" ["] {
+ incomplete_class = 1;
+ ce = PHP_IC_ENTRY;
+ }
++ BG(serialize_lock)--;
+
+ zval_ptr_dtor(&user_func);
+ zval_ptr_dtor(&arg_func_name);
diff --git a/php-bug70433.patch b/php-bug70433.patch
new file mode 100644
index 0000000..ca8a702
--- /dev/null
+++ b/php-bug70433.patch
@@ -0,0 +1,61 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon Sep 28 17:12:35 2015 -0700
+Subject: [PATCH] FIx bug #70433 - Uninitialized pointer in phar_make_dirstream when zip entry filename is "/"
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/16f6c66b816e3a506f3c5ddb812e1557f8742593
+Binary test fixtures not included: ext/phar/tests/bug70433.zip
+---
+diff --git a/ext/phar/tests/bug70433.phpt b/ext/phar/tests/bug70433.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/phar/tests/bug70433.phpt
+@@ -0,0 +1,23 @@
++--TEST--
++Phar - bug #70433 - Uninitialized pointer in phar_make_dirstream when zip entry filename is "/"
++--SKIPIF--
++<?php if (!extension_loaded("phar") || !extension_loaded("zlib")) die("skip"); ?>
++--FILE--
++<?php
++$phar = new PharData(__DIR__."/bug70433.zip");
++var_dump($phar);
++$meta = $phar->getMetadata();
++var_dump($meta);
++?>
++DONE
++--EXPECTF--
++object(PharData)#1 (3) {
++ ["pathName":"SplFileInfo":private]=>
++ string(0) ""
++ ["glob":"DirectoryIterator":private]=>
++ bool(false)
++ ["subPathName":"RecursiveDirectoryIterator":private]=>
++ string(0) ""
++}
++NULL
++DONE
+diff --git a/ext/phar/util.c b/ext/phar/util.c
+--- a/ext/phar/util.c
++++ b/ext/phar/util.c
+@@ -2248,7 +2248,7 @@ void phar_add_virtual_dirs(phar_archive_data *phar, char *filename, int filename
+
+ while ((s = zend_memrchr(filename, '/', filename_len))) {
+ filename_len = s - filename;
+- if (FAILURE == zend_hash_add_empty_element(&phar->virtual_dirs, filename, filename_len)) {
++ if (!filename_len || FAILURE == zend_hash_add_empty_element(&phar->virtual_dirs, filename, filename_len)) {
+ break;
+ }
+ }
+diff --git a/ext/phar/zip.c b/ext/phar/zip.c
+--- a/ext/phar/zip.c
++++ b/ext/phar/zip.c
+@@ -396,7 +396,9 @@ foundit:
+
+ if (entry.filename[entry.filename_len - 1] == '/') {
+ entry.is_dir = 1;
+- entry.filename_len--;
++ if(entry.filename_len > 1) {
++ entry.filename_len--;
++ }
+ entry.flags |= PHAR_ENT_PERM_DEF_DIR;
+ } else {
+ entry.is_dir = 0;
diff --git a/php-bug70436.patch b/php-bug70436.patch
new file mode 100644
index 0000000..d7a427d
--- /dev/null
+++ b/php-bug70436.patch
@@ -0,0 +1,88 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun Aug 7 15:16:28 2016 -0700
+Subject: [PATCH] Fix bug #70436: Use After Free Vulnerability in unserialize()
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/885fc4c4e30488b088481b0609bf194f38c303fb
+---
+diff --git a/ext/standard/tests/strings/bug70436.phpt b/ext/standard/tests/strings/bug70436.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/standard/tests/strings/bug70436.phpt
+@@ -0,0 +1,65 @@
++--TEST--
++Bug #70436: Use After Free Vulnerability in unserialize()
++--FILE--
++<?php
++
++class obj implements Serializable
++{
++ var $data;
++
++ function serialize()
++ {
++ return serialize($this->data);
++ }
++
++ function unserialize($data)
++ {
++ $this->data = unserialize($data);
++ }
++}
++
++$fakezval = ptr2str(1122334455);
++$fakezval .= ptr2str(0);
++$fakezval .= "\x00\x00\x00\x00";
++$fakezval .= "\x01";
++$fakezval .= "\x00";
++$fakezval .= "\x00\x00";
++
++$inner = 'C:3:"obj":3:{ryat';
++$exploit = 'a:4:{i:0;i:1;i:1;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:2;s:'.strlen($fakezval).':"'.$fakezval.'";i:3;R:5;}';
++
++$data = unserialize($exploit);
++
++var_dump($data);
++
++function ptr2str($ptr)
++{
++ $out = '';
++
++ for ($i = 0; $i < 8; $i++) {
++ $out .= chr($ptr & 0xff);
++ $ptr >>= 8;
++ }
++
++ return $out;
++}
++?>
++DONE
++--EXPECTF--
++Notice: unserialize(): Error at offset 0 of 3 bytes in %sbug70436.php on line %d
++
++Notice: unserialize(): Error at offset 16 of 17 bytes in %sbug70436.php on line %d
++array(4) {
++ [0]=>
++ int(1)
++ [1]=>
++ object(obj)#%d (1) {
++ ["data"]=>
++ bool(false)
++ }
++ [2]=>
++ string(24) "%s"
++ [3]=>
++ bool(false)
++}
++DONE
+\ No newline at end of file
+diff --git a/ext/standard/var.c b/ext/standard/var.c
+--- a/ext/standard/var.c
++++ b/ext/standard/var.c
+@@ -965,6 +965,7 @@ PHP_FUNCTION(unserialize)
+ p = (const unsigned char*) buf;
+ PHP_VAR_UNSERIALIZE_INIT(var_hash);
+ if (!php_var_unserialize(&return_value, &p, p + buf_len, &var_hash TSRMLS_CC)) {
++ var_push_dtor(&var_hash, &return_value);
+ PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
+ zval_dtor(return_value);
+ if (!EG(exception)) {
diff --git a/php-bug70480.patch b/php-bug70480.patch
new file mode 100644
index 0000000..9eff58d
--- /dev/null
+++ b/php-bug70480.patch
@@ -0,0 +1,18 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon Sep 28 11:31:14 2015 -0700
+Subject: [PATCH] Fix bug #70480 (php_url_parse_ex() buffer overflow read)
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/e82a01ee787fc22fdf8b2116aa7bd0d67df27587
+---
+diff --git a/ext/standard/url.c b/ext/standard/url.c
+--- a/ext/standard/url.c
++++ b/ext/standard/url.c
+@@ -321,7 +321,7 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
+ nohost:
+
+ if ((p = memchr(s, '?', (ue - s)))) {
+- pp = strchr(s, '#');
++ pp = memchr(s, '#', (ue - s));
+
+ if (pp && pp < p) {
+ if (pp - s) {
diff --git a/php-bug70661.patch b/php-bug70661.patch
new file mode 100644
index 0000000..b748fc0
--- /dev/null
+++ b/php-bug70661.patch
@@ -0,0 +1,95 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon Dec 28 14:46:35 2015 -0800
+Subject: [PATCH] Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization)
+
+Conflicts:
+ ext/wddx/wddx.c
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/465e1dd6a82d133d1dfaf6339ff1954cfbd1d96b
+---
+diff --git a/ext/wddx/tests/bug70661.phpt b/ext/wddx/tests/bug70661.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/wddx/tests/bug70661.phpt
+@@ -0,0 +1,69 @@
++--TEST--
++Bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization)
++--SKIPIF--
++<?php
++if (!extension_loaded("wddx")) print "skip";
++?>
++--FILE--
++<?php
++$fakezval = ptr2str(1122334455);
++$fakezval .= ptr2str(0);
++$fakezval .= "\x00\x00\x00\x00";
++$fakezval .= "\x01";
++$fakezval .= "\x00";
++$fakezval .= "\x00\x00";
++
++$x = <<<EOT
++<?xml version='1.0'?>
++<wddxPacket version='1.0'>
++<header/>
++ <data>
++ <struct>
++ <recordset rowCount='1' fieldNames='ryat'>
++ <field name='ryat'>
++ <var name='php_class_name'>
++ <string>stdClass</string>
++ </var>
++ <null/>
++ </field>
++ </recordset>
++ </struct>
++ </data>
++</wddxPacket>
++EOT;
++
++$y = wddx_deserialize($x);
++
++for ($i = 0; $i < 5; $i++) {
++ $v[$i] = $fakezval.$i;
++}
++
++var_dump($y);
++
++function ptr2str($ptr)
++{
++ $out = '';
++
++ for ($i = 0; $i < 8; $i++) {
++ $out .= chr($ptr & 0xff);
++ $ptr >>= 8;
++ }
++
++ return $out;
++}
++?>
++DONE
++--EXPECTF--
++array(1) {
++ [0]=>
++ array(1) {
++ ["ryat"]=>
++ array(2) {
++ ["php_class_name"]=>
++ string(8) "stdClass"
++ [0]=>
++ NULL
++ }
++ }
++}
++DONE
+diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
+--- a/ext/wddx/wddx.c
++++ b/ext/wddx/wddx.c
+@@ -975,7 +975,7 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
+
+ if (ent1->varname) {
+ if (!strcmp(ent1->varname, PHP_CLASS_NAME_VAR) &&
+- Z_TYPE_P(ent1->data) == IS_STRING && Z_STRLEN_P(ent1->data)) {
++ Z_TYPE_P(ent1->data) == IS_STRING && Z_STRLEN_P(ent1->data) && ent2->type == ST_STRUCT) {
+ zend_bool incomplete_class = 0;
+
+ zend_str_tolower(Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data));
diff --git a/php-bug70728.patch b/php-bug70728.patch
new file mode 100644
index 0000000..c808af9
--- /dev/null
+++ b/php-bug70728.patch
@@ -0,0 +1,74 @@
+From: Julien Pauli <jpauli at php.net>
+Date: Tue Dec 22 14:28:19 2015 +0100
+Subject: [PATCH] Fixed #70728
+
+Conflicts:
+ ext/xmlrpc/xmlrpc-epi-php.c
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/1baf494e21d684c189175d663bdb269a46ef4021
+---
+diff --git a/ext/xmlrpc/tests/bug70728.phpt b/ext/xmlrpc/tests/bug70728.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/xmlrpc/tests/bug70728.phpt
+@@ -0,0 +1,30 @@
++--TEST--
++Bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker)
++--SKIPIF--
++<?php
++if (!extension_loaded("xmlrpc")) print "skip";
++?>
++--FILE--
++<?php
++$obj = new stdClass;
++$obj->xmlrpc_type = 'base64';
++$obj->scalar = 0x1122334455;
++var_dump(xmlrpc_encode($obj));
++var_dump($obj);
++?>
++--EXPECTF--
++string(135) "<?xml version="1.0" encoding="utf-8"?>
++<params>
++<param>
++ <value>
++ <base64>NzM1ODgyMjkyMDU=
</base64>
++ </value>
++</param>
++</params>
++"
++object(stdClass)#1 (2) {
++ ["xmlrpc_type"]=>
++ string(6) "base64"
++ ["scalar"]=>
++ %s(73588229205)
++}
+diff --git a/ext/xmlrpc/xmlrpc-epi-php.c b/ext/xmlrpc/xmlrpc-epi-php.c
+--- a/ext/xmlrpc/xmlrpc-epi-php.c
++++ b/ext/xmlrpc/xmlrpc-epi-php.c
+@@ -532,7 +532,16 @@ static XMLRPC_VALUE PHP_to_XMLRPC_worker (const char* key, zval* in_val, int dep
+ xReturn = XMLRPC_CreateValueEmpty();
+ XMLRPC_SetValueID(xReturn, key, 0);
+ } else {
+- xReturn = XMLRPC_CreateValueBase64(key, Z_STRVAL_P(val), Z_STRLEN_P(val));
++ if (Z_TYPE_P(val) != IS_STRING) {
++ zval *newvalue;
++ ALLOC_INIT_ZVAL(newvalue);
++ MAKE_COPY_ZVAL(&val, newvalue);
++ convert_to_string(newvalue);
++ xReturn = XMLRPC_CreateValueBase64(key, Z_STRVAL_P(newvalue), Z_STRLEN_P(newvalue));
++ zval_ptr_dtor(&newvalue);
++ } else {
++ xReturn = XMLRPC_CreateValueBase64(key, Z_STRVAL_P(val), Z_STRLEN_P(val));
++ }
+ }
+ break;
+ case xmlrpc_datetime:
+@@ -1452,7 +1461,7 @@ XMLRPC_VALUE_TYPE get_zval_xmlrpc_type(zval* value, zval** newvalue) /* {{{ */
+ if (newvalue) {
+ zval** val;
+
+- if ((type == xmlrpc_base64 && Z_TYPE_P(value) != IS_NULL) || type == xmlrpc_datetime) {
++ if ((type == xmlrpc_base64 && Z_TYPE_P(value) == IS_OBJECT) || type == xmlrpc_datetime) {
+ if (zend_hash_find(Z_OBJPROP_P(value), OBJECT_VALUE_ATTR, sizeof(OBJECT_VALUE_ATTR), (void**) &val) == SUCCESS) {
+ *newvalue = *val;
+ }
diff --git a/php-bug70741.patch b/php-bug70741.patch
new file mode 100644
index 0000000..7c578fe
--- /dev/null
+++ b/php-bug70741.patch
@@ -0,0 +1,52 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon Dec 28 12:42:44 2015 -0800
+Subject: [PATCH] Fixed bug #70741: Session WDDX Packet Deserialization Type Confusion Vulnerability
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/01de5ba6f98ee4a8d6d15271ced36b849d319bed
+---
+diff --git a/ext/wddx/tests/bug70741.phpt b/ext/wddx/tests/bug70741.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/wddx/tests/bug70741.phpt
+@@ -0,0 +1,26 @@
++--TEST--
++Bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability)
++--SKIPIF--
++<?php
++if (!extension_loaded("wddx")) print "skip";
++?>
++--FILE--
++<?php
++ini_set('session.serialize_handler', 'wddx');
++session_start();
++
++$hashtable = str_repeat('A', 66);
++$wddx = "<?xml version='1.0'?>
++<wddxPacket version='1.0'>
++<header/>
++ <data>
++ <string>$hashtable</string>
++ </data>
++</wddxPacket>";
++session_decode($wddx);
++?>
++DONE
++--EXPECTF--
++
++Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s on line %d
++DONE
+diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
+--- a/ext/wddx/wddx.c
++++ b/ext/wddx/wddx.c
+@@ -308,7 +308,10 @@ PS_SERIALIZER_DECODE_FUNC(wddx)
+ MAKE_STD_ZVAL(retval);
+
+ if ((ret = php_wddx_deserialize_ex((char *)val, vallen, retval)) == SUCCESS) {
+-
++ if (Z_TYPE_P(retval) != IS_ARRAY) {
++ zval_ptr_dtor(&retval);
++ return FAILURE;
++ }
+ for (zend_hash_internal_pointer_reset(Z_ARRVAL_P(retval));
+ zend_hash_get_current_data(Z_ARRVAL_P(retval), (void **) &ent) == SUCCESS;
+ zend_hash_move_forward(Z_ARRVAL_P(retval))) {
diff --git a/php-bug70755.patch b/php-bug70755.patch
new file mode 100644
index 0000000..f4e61ec
--- /dev/null
+++ b/php-bug70755.patch
@@ -0,0 +1,21 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Tue Dec 8 00:10:07 2015 -0800
+Subject: [PATCH] Fixed bug #70755: fpm_log.c memory leak and buffer overflow
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/f4521b3631b5910003febea386bfdcbf47d031b6
+---
+diff --git a/sapi/fpm/fpm/fpm_log.c b/sapi/fpm/fpm/fpm_log.c
+--- a/sapi/fpm/fpm/fpm_log.c
++++ b/sapi/fpm/fpm/fpm_log.c
+@@ -446,6 +446,11 @@ int fpm_log_write(char *log_format TSRMLS_DC) /* {{{ */
+ b += len2;
+ len += len2;
+ }
++ if (len >= FPM_LOG_BUFFER) {
++ zlog(ZLOG_NOTICE, "the log buffer is full (%d). The access log request has been truncated.", FPM_LOG_BUFFER);
++ len = FPM_LOG_BUFFER;
++ break;
++ }
+ continue;
+ }
+
diff --git a/php-bug70979.patch b/php-bug70979.patch
new file mode 100644
index 0000000..a4bd2df
--- /dev/null
+++ b/php-bug70979.patch
@@ -0,0 +1,25 @@
+From: Anatol Belski <ab at php.net>
+Date: Thu Jan 14 17:42:28 2016 +0100
+Subject: [PATCH] Fixed bug #70979 crash with bad soap request
+
+The error handler is overloaded with the SOAP one. However the SOAP
+handler eventually wants to access some of its globals. This won't
+work as long as the SOAP globals aren't initialized. The use case
+is when an error is thrown before RINIT went through. As the call
+order is arbitrary, the safest is to wait when all the modules
+called their RINIT.
+
+Source: upstream https://github.com/php/php-src/commit/4308c868f9 (5.6.18)
+---
+diff --git a/ext/soap/soap.c b/ext/soap/soap.c
+--- a/ext/soap/soap.c
++++ b/ext/soap/soap.c
+@@ -2173,7 +2173,7 @@ static void soap_error_handler(int error_num, const char *error_filename, const
+ _old_http_response_code = SG(sapi_headers).http_response_code;
+ _old_http_status_line = SG(sapi_headers).http_status_line;
+
+- if (!SOAP_GLOBAL(use_soap_error_handler) || !EG(objects_store).object_buckets) {
++ if (!PG(modules_activated) || !SOAP_GLOBAL(use_soap_error_handler) || !EG(objects_store).object_buckets) {
+ call_old_error_handler(error_num, error_filename, error_lineno, format, args);
+ return;
+ }
diff --git a/php-bug71039.patch b/php-bug71039.patch
new file mode 100644
index 0000000..a108ee1
--- /dev/null
+++ b/php-bug71039.patch
@@ -0,0 +1,61 @@
+From: Anatol Belski <ab at php.net>
+Date: Tue Jan 12 14:57:22 2016 +0100
+Subject: [PATCH] Fixed bug #71039 exec functions ignore length but look for NULL termination
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/ff901aa6b00fcc89cc13f7bcc323b0fff67393ec
+---
+diff --git a/ext/standard/exec.c b/ext/standard/exec.c
+--- a/ext/standard/exec.c
++++ b/ext/standard/exec.c
+@@ -418,6 +418,10 @@ PHP_FUNCTION(escapeshellcmd)
+ }
+
+ if (command_len) {
++ if (command_len != strlen(command)) {
++ php_error_docref(NULL TSRMLS_CC, E_ERROR, "Input string contains NULL bytes");
++ return;
++ }
+ cmd = php_escape_shell_cmd(command);
+ RETVAL_STRING(cmd, 0);
+ } else {
+@@ -439,6 +443,10 @@ PHP_FUNCTION(escapeshellarg)
+ }
+
+ if (argument) {
++ if (argument_len != strlen(argument)) {
++ php_error_docref(NULL TSRMLS_CC, E_ERROR, "Input string contains NULL bytes");
++ return;
++ }
+ cmd = php_escape_shell_arg(argument);
+ RETVAL_STRING(cmd, 0);
+ }
+diff --git a/ext/standard/tests/general_functions/escapeshellarg_bug71039.phpt b/ext/standard/tests/general_functions/escapeshellarg_bug71039.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/standard/tests/general_functions/escapeshellarg_bug71039.phpt
+@@ -0,0 +1,10 @@
++--TEST--
++Test escapeshellarg() string with \0 bytes
++--FILE--
++<?php
++escapeshellarg("hello\0world");
++
++?>
++===DONE===
++--EXPECTF--
++Fatal error: escapeshellarg(): Input string contains NULL bytes in %s on line %d
+diff --git a/ext/standard/tests/general_functions/escapeshellcmd_bug71039.phpt b/ext/standard/tests/general_functions/escapeshellcmd_bug71039.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/standard/tests/general_functions/escapeshellcmd_bug71039.phpt
+@@ -0,0 +1,10 @@
++--TEST--
++Test escapeshellcmd() string with \0 bytes
++--FILE--
++<?php
++escapeshellcmd("hello\0world");
++
++?>
++===DONE===
++--EXPECTF--
++Fatal error: escapeshellcmd(): Input string contains NULL bytes in %s on line %d
diff --git a/php-bug71323.patch b/php-bug71323.patch
new file mode 100644
index 0000000..d1df87f
--- /dev/null
+++ b/php-bug71323.patch
@@ -0,0 +1,1175 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Sat Jan 16 22:10:54 2016 -0800
+Subject: [PATCH] Fixed bug #71323 - Output of stream_get_meta_data can be falsified by its input
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/3819c2a668ea34c7ae6ac8f01f50ba3843df7c8d
+---
+diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c
+--- a/ext/standard/streamsfuncs.c
++++ b/ext/standard/streamsfuncs.c
+@@ -496,6 +496,12 @@ PHP_FUNCTION(stream_get_meta_data)
+
+ array_init(return_value);
+
++ if (!php_stream_populate_meta_data(stream, return_value)) {
++ add_assoc_bool(return_value, "timed_out", 0);
++ add_assoc_bool(return_value, "blocked", 1);
++ add_assoc_bool(return_value, "eof", php_stream_eof(stream));
++ }
++
+ if (stream->wrapperdata) {
+ MAKE_STD_ZVAL(newval);
+ MAKE_COPY_ZVAL(&stream->wrapperdata, newval);
+@@ -531,12 +537,6 @@ PHP_FUNCTION(stream_get_meta_data)
+ add_assoc_string(return_value, "uri", stream->orig_path, 1);
+ }
+
+- if (!php_stream_populate_meta_data(stream, return_value)) {
+- add_assoc_bool(return_value, "timed_out", 0);
+- add_assoc_bool(return_value, "blocked", 1);
+- add_assoc_bool(return_value, "eof", php_stream_eof(stream));
+- }
+-
+ }
+ /* }}} */
+
+diff --git a/ext/standard/tests/streams/bug71323.phpt b/ext/standard/tests/streams/bug71323.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/standard/tests/streams/bug71323.phpt
+@@ -0,0 +1,31 @@
++--TEST--
++Bug #71323: Output of stream_get_meta_data can be falsified by its input
++--FILE--
++<?php
++$file = 'data:text/plain;z=y;uri=eviluri;mediatype=wut?;mediatype2=hello,somedata';
++$meta = stream_get_meta_data(fopen($file, "r"));
++var_dump($meta);
++?>
++--EXPECTF--
++array(10) {
++ ["mediatype"]=>
++ string(10) "text/plain"
++ ["z"]=>
++ string(1) "y"
++ ["uri"]=>
++ string(72) "data:text/plain;z=y;uri=eviluri;mediatype=wut?;mediatype2=hello,somedata"
++ ["mediatype2"]=>
++ string(5) "hello"
++ ["base64"]=>
++ bool(false)
++ ["wrapper_type"]=>
++ string(7) "RFC2397"
++ ["stream_type"]=>
++ string(7) "RFC2397"
++ ["mode"]=>
++ string(1) "r"
++ ["unread_bytes"]=>
++ int(0)
++ ["seekable"]=>
++ bool(true)
++}
+diff --git a/ext/standard/tests/streams/stream_get_meta_data_dir_basic.phpt b/ext/standard/tests/streams/stream_get_meta_data_dir_basic.phpt
+--- a/ext/standard/tests/streams/stream_get_meta_data_dir_basic.phpt
++++ b/ext/standard/tests/streams/stream_get_meta_data_dir_basic.phpt
+@@ -13,6 +13,12 @@ var_dump(stream_get_meta_data($dirObject->handle));
+ ?>
+ --EXPECT--
+ array(8) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(false)
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -23,14 +29,14 @@ array(8) {
+ int(0)
+ ["seekable"]=>
+ bool(true)
++}
++array(8) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(8) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -41,10 +47,4 @@ array(8) {
+ int(0)
+ ["seekable"]=>
+ bool(true)
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(false)
+ }
+diff --git a/ext/standard/tests/streams/stream_get_meta_data_file_basic.phpt b/ext/standard/tests/streams/stream_get_meta_data_file_basic.phpt
+--- a/ext/standard/tests/streams/stream_get_meta_data_file_basic.phpt
++++ b/ext/standard/tests/streams/stream_get_meta_data_file_basic.phpt
+@@ -12,6 +12,12 @@ fclose($fp);
+ ?>
+ --EXPECTF--
+ array(9) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(false)
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -24,10 +30,4 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%sstream_get_meta_data_file_basic.php"
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(false)
+ }
+diff --git a/ext/standard/tests/streams/stream_get_meta_data_file_variation1.phpt b/ext/standard/tests/streams/stream_get_meta_data_file_variation1.phpt
+--- a/ext/standard/tests/streams/stream_get_meta_data_file_variation1.phpt
++++ b/ext/standard/tests/streams/stream_get_meta_data_file_variation1.phpt
+@@ -29,6 +29,12 @@ unlink($filename);
+ ?>
+ --EXPECTF--
+ array(9) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(false)
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -41,14 +47,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -61,14 +67,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -81,14 +87,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -101,14 +107,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -121,14 +127,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -141,14 +147,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -161,14 +167,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -181,14 +187,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -201,14 +207,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -221,14 +227,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -241,14 +247,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -261,14 +267,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -281,14 +287,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -301,14 +307,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -321,14 +327,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -341,14 +347,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -361,14 +367,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -381,14 +387,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -401,14 +407,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -421,14 +427,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -441,14 +447,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -461,14 +467,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -481,14 +487,14 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -501,10 +507,4 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(false)
+ }
+diff --git a/ext/standard/tests/streams/stream_get_meta_data_file_variation2.phpt b/ext/standard/tests/streams/stream_get_meta_data_file_variation2.phpt
+--- a/ext/standard/tests/streams/stream_get_meta_data_file_variation2.phpt
++++ b/ext/standard/tests/streams/stream_get_meta_data_file_variation2.phpt
+@@ -43,6 +43,12 @@ unlink($filename);
+ --EXPECTF--
+ Write some data to the file:
+ array(9) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(false)
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -55,12 +61,6 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(false)
+ }
+
+
+@@ -68,6 +68,12 @@ Read a line of the file, causing data to be buffered:
+ string(15) "a line of data
+ "
+ array(9) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(false)
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -80,17 +86,17 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
++}
++
++
++Read 20 bytes from the file:
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-
+-
+-Read 20 bytes from the file:
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -103,17 +109,17 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(false)
+ }
+
+
+ Read entire file:
+ array(9) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(true)
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -126,10 +132,4 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s.tmp"
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(true)
+ }
+diff --git a/ext/standard/tests/streams/stream_get_meta_data_file_variation4.phpt b/ext/standard/tests/streams/stream_get_meta_data_file_variation4.phpt
+--- a/ext/standard/tests/streams/stream_get_meta_data_file_variation4.phpt
++++ b/ext/standard/tests/streams/stream_get_meta_data_file_variation4.phpt
+@@ -28,6 +28,12 @@ unlink($filename);
+ --EXPECTF--
+ Create a file:
+ array(9) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(false)
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -40,16 +46,16 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "File://%sstream_get_meta_data_file_variation4.php.tmp"
++}
++
++Change to file's directory and open with a relative path:
++array(9) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-
+-Change to file's directory and open with a relative path:
+-array(9) {
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -62,10 +68,4 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "stream_get_meta_data_file_variation4.php.tmp"
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(false)
+ }
+diff --git a/ext/standard/tests/streams/stream_get_meta_data_file_variation5.phpt b/ext/standard/tests/streams/stream_get_meta_data_file_variation5.phpt
+--- a/ext/standard/tests/streams/stream_get_meta_data_file_variation5.phpt
++++ b/ext/standard/tests/streams/stream_get_meta_data_file_variation5.phpt
+@@ -33,6 +33,12 @@ unlink($filename);
+ --EXPECTF--
+ Write some data to the file:
+ array(9) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(false)
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -45,17 +51,17 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s"
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(false)
+ }
+
+
+ Read entire file:
+ array(9) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(true)
+ ["wrapper_type"]=>
+ string(9) "plainfile"
+ ["stream_type"]=>
+@@ -68,10 +74,4 @@ array(9) {
+ bool(true)
+ ["uri"]=>
+ string(%i) "%s"
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(true)
+ }
+diff --git a/ext/standard/tests/streams/stream_get_meta_data_process_basic.phpt b/ext/standard/tests/streams/stream_get_meta_data_process_basic.phpt
+--- a/ext/standard/tests/streams/stream_get_meta_data_process_basic.phpt
++++ b/ext/standard/tests/streams/stream_get_meta_data_process_basic.phpt
+@@ -18,6 +18,12 @@ echo "Done";
+ ?>
+ --EXPECT--
+ array(7) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(false)
+ ["stream_type"]=>
+ string(5) "STDIO"
+ ["mode"]=>
+@@ -26,11 +32,5 @@ array(7) {
+ int(0)
+ ["seekable"]=>
+ bool(false)
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(false)
+ }
+ Done
+diff --git a/ext/standard/tests/streams/stream_get_meta_data_socket_basic.phpt b/ext/standard/tests/streams/stream_get_meta_data_socket_basic.phpt
+--- a/ext/standard/tests/streams/stream_get_meta_data_socket_basic.phpt
++++ b/ext/standard/tests/streams/stream_get_meta_data_socket_basic.phpt
+@@ -10,6 +10,12 @@ fclose($tcp_socket);
+ ?>
+ --EXPECTF--
+ array(7) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(false)
+ ["stream_type"]=>
+ string(%d) "tcp_socke%s"
+ ["mode"]=>
+@@ -18,10 +24,4 @@ array(7) {
+ int(0)
+ ["seekable"]=>
+ bool(false)
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(false)
+ }
+diff --git a/ext/standard/tests/streams/stream_get_meta_data_socket_variation1.phpt b/ext/standard/tests/streams/stream_get_meta_data_socket_variation1.phpt
+--- a/ext/standard/tests/streams/stream_get_meta_data_socket_variation1.phpt
++++ b/ext/standard/tests/streams/stream_get_meta_data_socket_variation1.phpt
+@@ -39,6 +39,12 @@ var_dump(stream_get_meta_data($client));
+ --EXPECTF--
+ Write some data:
+ array(7) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(false)
+ ["stream_type"]=>
+ string(%d) "tcp_socke%s"
+ ["mode"]=>
+@@ -47,17 +53,17 @@ array(7) {
+ int(0)
+ ["seekable"]=>
+ bool(false)
++}
++
++
++Read a line from the client, causing data to be buffered:
++array(7) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-
+-
+-Read a line from the client, causing data to be buffered:
+-array(7) {
+ ["stream_type"]=>
+ string(%d) "tcp_socke%s"
+ ["mode"]=>
+@@ -66,17 +72,17 @@ array(7) {
+ int(15)
+ ["seekable"]=>
+ bool(false)
++}
++
++
++Read 3 bytes of data from the client:
++array(7) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-
+-
+-Read 3 bytes of data from the client:
+-array(7) {
+ ["stream_type"]=>
+ string(%d) "tcp_socke%s"
+ ["mode"]=>
+@@ -85,17 +91,17 @@ array(7) {
+ int(12)
+ ["seekable"]=>
+ bool(false)
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(false)
+ }
+
+
+ Close the server side socket and read the remaining data from the client:
+ array(7) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(true)
+ ["stream_type"]=>
+ string(%d) "tcp_socke%s"
+ ["mode"]=>
+@@ -104,10 +110,4 @@ array(7) {
+ int(0)
+ ["seekable"]=>
+ bool(false)
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(true)
+ }
+diff --git a/ext/standard/tests/streams/stream_get_meta_data_socket_variation2.phpt b/ext/standard/tests/streams/stream_get_meta_data_socket_variation2.phpt
+--- a/ext/standard/tests/streams/stream_get_meta_data_socket_variation2.phpt
++++ b/ext/standard/tests/streams/stream_get_meta_data_socket_variation2.phpt
+@@ -37,25 +37,12 @@ fclose($server);
+ ?>
+ --EXPECTF--
+ array(7) {
+- ["stream_type"]=>
+- string(%d) "tcp_socke%s"
+- ["mode"]=>
+- string(2) "r+"
+- ["unread_bytes"]=>
+- int(0)
+- ["seekable"]=>
+- bool(false)
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-
+-
+-Set a timeout on the client and attempt a read:
+-array(7) {
+ ["stream_type"]=>
+ string(%d) "tcp_socke%s"
+ ["mode"]=>
+@@ -64,17 +51,17 @@ array(7) {
+ int(0)
+ ["seekable"]=>
+ bool(false)
++}
++
++
++Set a timeout on the client and attempt a read:
++array(7) {
+ ["timed_out"]=>
+ bool(true)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-
+-
+-Write some data from the server:
+-array(7) {
+ ["stream_type"]=>
+ string(%d) "tcp_socke%s"
+ ["mode"]=>
+@@ -83,17 +70,17 @@ array(7) {
+ int(0)
+ ["seekable"]=>
+ bool(false)
++}
++
++
++Write some data from the server:
++array(7) {
+ ["timed_out"]=>
+ bool(true)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-
+-
+-Read some data from the client:
+-array(7) {
+ ["stream_type"]=>
+ string(%d) "tcp_socke%s"
+ ["mode"]=>
+@@ -102,10 +89,23 @@ array(7) {
+ int(0)
+ ["seekable"]=>
+ bool(false)
++}
++
++
++Read some data from the client:
++array(7) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
++ ["stream_type"]=>
++ string(%d) "tcp_socke%s"
++ ["mode"]=>
++ string(2) "r+"
++ ["unread_bytes"]=>
++ int(0)
++ ["seekable"]=>
++ bool(false)
+ }
+diff --git a/ext/standard/tests/streams/stream_get_meta_data_socket_variation3.phpt b/ext/standard/tests/streams/stream_get_meta_data_socket_variation3.phpt
+--- a/ext/standard/tests/streams/stream_get_meta_data_socket_variation3.phpt
++++ b/ext/standard/tests/streams/stream_get_meta_data_socket_variation3.phpt
+@@ -32,6 +32,12 @@ fclose($server);
+ ?>
+ --EXPECTF--
+ array(7) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(false)
+ ["stream_type"]=>
+ string(%d) "tcp_socke%s"
+ ["mode"]=>
+@@ -40,18 +46,18 @@ array(7) {
+ int(0)
+ ["seekable"]=>
+ bool(false)
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(false)
+ }
+
+
+ Set blocking to false:
+ bool(true)
+ array(7) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(false)
++ ["eof"]=>
++ bool(false)
+ ["stream_type"]=>
+ string(%d) "tcp_socke%s"
+ ["mode"]=>
+@@ -60,18 +66,18 @@ array(7) {
+ int(0)
+ ["seekable"]=>
+ bool(false)
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(false)
+- ["eof"]=>
+- bool(false)
+ }
+
+
+ Set blocking to true:
+ bool(true)
+ array(7) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(false)
+ ["stream_type"]=>
+ string(%d) "tcp_socke%s"
+ ["mode"]=>
+@@ -80,10 +86,4 @@ array(7) {
+ int(0)
+ ["seekable"]=>
+ bool(false)
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(false)
+ }
+diff --git a/ext/standard/tests/streams/stream_get_meta_data_socket_variation4.phpt b/ext/standard/tests/streams/stream_get_meta_data_socket_variation4.phpt
+--- a/ext/standard/tests/streams/stream_get_meta_data_socket_variation4.phpt
++++ b/ext/standard/tests/streams/stream_get_meta_data_socket_variation4.phpt
+@@ -37,6 +37,12 @@ fclose($client);
+ --EXPECTF--
+ Write some data:
+ array(7) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(false)
+ ["stream_type"]=>
+ string(%d) "tcp_socke%s"
+ ["mode"]=>
+@@ -45,17 +51,17 @@ array(7) {
+ int(%i)
+ ["seekable"]=>
+ bool(false)
++}
++
++
++Read a line from the client:
++array(7) {
+ ["timed_out"]=>
+ bool(false)
+ ["blocked"]=>
+ bool(true)
+ ["eof"]=>
+ bool(false)
+-}
+-
+-
+-Read a line from the client:
+-array(7) {
+ ["stream_type"]=>
+ string(%d) "tcp_socke%s"
+ ["mode"]=>
+@@ -64,17 +70,17 @@ array(7) {
+ int(%i)
+ ["seekable"]=>
+ bool(false)
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(false)
+ }
+
+
+ Close the server side socket and read the remaining data from the client:
+ array(7) {
++ ["timed_out"]=>
++ bool(false)
++ ["blocked"]=>
++ bool(true)
++ ["eof"]=>
++ bool(true)
+ ["stream_type"]=>
+ string(%d) "tcp_socke%s"
+ ["mode"]=>
+@@ -83,10 +89,4 @@ array(7) {
+ int(%i)
+ ["seekable"]=>
+ bool(false)
+- ["timed_out"]=>
+- bool(false)
+- ["blocked"]=>
+- bool(true)
+- ["eof"]=>
+- bool(true)
+ }
+diff --git a/main/streams/memory.c b/main/streams/memory.c
+--- a/main/streams/memory.c
++++ b/main/streams/memory.c
+@@ -674,7 +674,9 @@ static php_stream * php_stream_url_wrap_rfc2397(php_stream_wrapper *wrapper, cha
+ plen = sep - path;
+ vlen = (semi ? semi - sep : mlen - plen) - 1 /* '=' */;
+ key = estrndup(path, plen);
+- add_assoc_stringl_ex(meta, key, plen + 1, sep + 1, vlen, 1);
++ if (plen != sizeof("mediatype")-1 || memcmp(key, "mediatype", sizeof("mediatype")-1)) {
++ add_assoc_stringl_ex(meta, key, plen + 1, sep + 1, vlen, 1);
++ }
+ efree(key);
+ plen += vlen + 1;
+ mlen -= plen;
diff --git a/php-bug71331.patch b/php-bug71331.patch
new file mode 100644
index 0000000..7ba768e
--- /dev/null
+++ b/php-bug71331.patch
@@ -0,0 +1,60 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Thu Jan 14 22:58:40 2016 -0800
+Subject: [PATCH] Fixed bug #71331 - Uninitialized pointer in phar_make_dirstream()
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/adb286ca9377a9811278b0766114b6d93c50703a
+Binary test fixtures not included: ext/phar/tests/bug71331.tar
+---
+diff --git a/ext/phar/dirstream.c b/ext/phar/dirstream.c
+--- a/ext/phar/dirstream.c
++++ b/ext/phar/dirstream.c
+@@ -207,6 +207,7 @@ static php_stream *phar_make_dirstream(char *dir, HashTable *manifest TSRMLS_DC)
+ zend_hash_internal_pointer_reset(manifest);
+
+ while (FAILURE != zend_hash_has_more_elements(manifest)) {
++ keylen = 0;
+ if (HASH_KEY_NON_EXISTANT == zend_hash_get_current_key_ex(manifest, &key, &keylen, &unused, 0, NULL)) {
+ break;
+ }
+@@ -214,7 +215,7 @@ static php_stream *phar_make_dirstream(char *dir, HashTable *manifest TSRMLS_DC)
+ PHAR_STR(key, str_key);
+
+ if (keylen <= (uint)dirlen) {
+- if (keylen < (uint)dirlen || !strncmp(str_key, dir, dirlen)) {
++ if (keylen == 0 || keylen < (uint)dirlen || !strncmp(str_key, dir, dirlen)) {
+ PHAR_STR_FREE(str_key);
+ if (SUCCESS != zend_hash_move_forward(manifest)) {
+ break;
+diff --git a/ext/phar/tar.c b/ext/phar/tar.c
+--- a/ext/phar/tar.c
++++ b/ext/phar/tar.c
+@@ -347,7 +347,7 @@ bail:
+ entry.filename_len = entry.uncompressed_filesize;
+
+ /* Check for overflow - bug 61065 */
+- if (entry.filename_len == UINT_MAX) {
++ if (entry.filename_len == UINT_MAX || entry.filename_len == 0) {
+ if (error) {
+ spprintf(error, 4096, "phar error: \"%s\" is a corrupted tar file (invalid entry size)", fname);
+ }
+diff --git a/ext/phar/tests/bug71331.phpt b/ext/phar/tests/bug71331.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/phar/tests/bug71331.phpt
+@@ -0,0 +1,15 @@
++--TEST--
++Bug #71331 (Uninitialized pointer in phar_make_dirstream())
++--SKIPIF--
++<?php if (!extension_loaded("phar")) die("skip"); ?>
++--FILE--
++<?php
++$p = new PharData(__DIR__."/bug71331.tar");
++?>
++DONE
++--EXPECTF--
++Fatal error: Uncaught exception 'UnexpectedValueException' with message 'phar error: "%s/bug71331.tar" is a corrupted tar file (invalid entry size)' in %s/bug71331.php:2
++Stack trace:
++#0 %s/bug71331.php(2): PharData->__construct('%s')
++#1 {main}
++ thrown in %s/bug71331.php on line 2
+\ No newline at end of file
diff --git a/php-bug71335.patch b/php-bug71335.patch
new file mode 100644
index 0000000..00f2126
--- /dev/null
+++ b/php-bug71335.patch
@@ -0,0 +1,19 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Wed Jan 13 16:43:04 2016 -0800
+Subject: [PATCH] Fix bug #71335: Type Confusion in WDDX Packet Deserialization
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/09b81bd99341b3b3ec0ac1192ed2b409a32c958b
+---
+diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
+--- a/ext/wddx/wddx.c
++++ b/ext/wddx/wddx.c
+@@ -1000,7 +1000,8 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
+
+ if (ent1->varname) {
+ if (!strcmp(ent1->varname, PHP_CLASS_NAME_VAR) &&
+- Z_TYPE_P(ent1->data) == IS_STRING && Z_STRLEN_P(ent1->data) && ent2->type == ST_STRUCT) {
++ Z_TYPE_P(ent1->data) == IS_STRING && Z_STRLEN_P(ent1->data) &&
++ ent2->type == ST_STRUCT && Z_TYPE_P(ent2->data) == IS_ARRAY) {
+ zend_bool incomplete_class = 0;
+
+ zend_str_tolower(Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data));
diff --git a/php-bug71354.patch b/php-bug71354.patch
new file mode 100644
index 0000000..cec1776
--- /dev/null
+++ b/php-bug71354.patch
@@ -0,0 +1,36 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Wed Jan 13 16:32:29 2016 -0800
+Subject: [PATCH] Fix bug #71354 - remove UMR when size is 0
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/32d59bee3a41f1c6a7f99be7a53a014058684fe5
+Binary test fixtures not included: ext/phar/tests/bug71354.tar
+---
+diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
+--- a/ext/phar/phar_object.c
++++ b/ext/phar/phar_object.c
+@@ -4977,6 +4977,7 @@ PHP_METHOD(PharFileInfo, getContent)
+
+ phar_seek_efp(link, 0, SEEK_SET, 0, 0 TSRMLS_CC);
+ Z_TYPE_P(return_value) = IS_STRING;
++ Z_STRVAL_P(return_value) = NULL;
+ Z_STRLEN_P(return_value) = php_stream_copy_to_mem(fp, &(Z_STRVAL_P(return_value)), link->uncompressed_filesize, 0);
+
+ if (!Z_STRVAL_P(return_value)) {
+diff --git a/ext/phar/tests/bug71354.phpt b/ext/phar/tests/bug71354.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/phar/tests/bug71354.phpt
+@@ -0,0 +1,13 @@
++--TEST--
++Phar: bug #71354: Heap corruption in tar/zip/phar parser.
++--SKIPIF--
++<?php if (!extension_loaded("phar")) die("skip"); ?>
++--FILE--
++<?php
++$p = new PharData(__DIR__."/bug71354.tar");
++var_dump($p['aaaa']->getContent());
++?>
++DONE
++--EXPECT--
++string(0) ""
++DONE
diff --git a/php-bug71391.patch b/php-bug71391.patch
new file mode 100644
index 0000000..f18f353
--- /dev/null
+++ b/php-bug71391.patch
@@ -0,0 +1,43 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Sat Jan 16 20:43:43 2016 -0800
+Subject: [PATCH] Fix bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/7010274c63daee68ddabe41e5e9e1dabc5c55217
+Binary test fixtures not included: ext/phar/tests/bug71391.tar
+---
+diff --git a/ext/phar/tar.c b/ext/phar/tar.c
+--- a/ext/phar/tar.c
++++ b/ext/phar/tar.c
+@@ -870,6 +870,9 @@ static int phar_tar_setupmetadata(void *pDest, void *argument TSRMLS_DC) /* {{{
+
+ if (entry->filename_len >= sizeof(".phar/.metadata") && !memcmp(entry->filename, ".phar/.metadata", sizeof(".phar/.metadata")-1)) {
+ if (entry->filename_len == sizeof(".phar/.metadata.bin")-1 && !memcmp(entry->filename, ".phar/.metadata.bin", sizeof(".phar/.metadata.bin")-1)) {
++ if (entry->phar->metadata == NULL) {
++ return ZEND_HASH_APPLY_REMOVE;
++ }
+ return phar_tar_setmetadata(entry->phar->metadata, entry, error TSRMLS_CC);
+ }
+ /* search for the file this metadata entry references */
+diff --git a/ext/phar/tests/bug71391.phpt b/ext/phar/tests/bug71391.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/phar/tests/bug71391.phpt
+@@ -0,0 +1,18 @@
++--TEST--
++Phar: bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()
++--SKIPIF--
++<?php if (!extension_loaded("phar")) die("skip"); ?>
++--FILE--
++<?php
++// duplicate since the tar will change
++copy(__DIR__."/bug71391.tar", __DIR__."/bug71391.test.tar");
++$p = new PharData(__DIR__."/bug71391.test.tar");
++$p->delMetaData();
++?>
++DONE
++--CLEAN--
++<?php
++unlink(__DIR__."/bug71391.test.tar");
++?>
++--EXPECT--
++DONE
diff --git a/php-bug71459.patch b/php-bug71459.patch
new file mode 100644
index 0000000..3174f78
--- /dev/null
+++ b/php-bug71459.patch
@@ -0,0 +1,46 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Tue Jan 26 17:26:52 2016 -0800
+Subject: [PATCH] Fix bug #71459 - Integer overflow in iptcembed()
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/886d11818e234c8e4623b5aed798aaf8a301518f
+---
+diff --git a/ext/standard/iptc.c b/ext/standard/iptc.c
+--- a/ext/standard/iptc.c
++++ b/ext/standard/iptc.c
+@@ -38,6 +38,15 @@
+
+ #include <sys/stat.h>
+
++#ifdef PHP_WIN32
++# include "win32/php_stdint.h"
++#else
++# if HAVE_INTTYPES_H
++# include <inttypes.h>
++# elif HAVE_STDINT_H
++# include <stdint.h>
++# endif
++#endif
+
+ /* some defines for the different JPEG block types */
+ #define M_SOF0 0xC0 /* Start Of Frame N */
+@@ -195,6 +204,11 @@ PHP_FUNCTION(iptcembed)
+ RETURN_FALSE;
+ }
+
++ if ((size_t)iptcdata_len >= SIZE_MAX - sizeof(psheader) - 1025) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "IPTC data too large");
++ RETURN_FALSE;
++ }
++
+ if ((fp = VCWD_FOPEN(jpeg_file, "rb")) == 0) {
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to open %s", jpeg_file);
+ RETURN_FALSE;
+@@ -203,7 +217,7 @@ PHP_FUNCTION(iptcembed)
+ if (spool < 2) {
+ fstat(fileno(fp), &sb);
+
+- poi = spoolbuf = safe_emalloc(1, iptcdata_len + sizeof(psheader) + sb.st_size + 1024, 1);
++ poi = spoolbuf = safe_emalloc(1, (size_t)iptcdata_len + sizeof(psheader) + 1024 + 1, sb.st_size);
+ memset(poi, 0, iptcdata_len + sizeof(psheader) + sb.st_size + 1024 + 1);
+ }
+
diff --git a/php-bug71488.patch b/php-bug71488.patch
new file mode 100644
index 0000000..c81b767
--- /dev/null
+++ b/php-bug71488.patch
@@ -0,0 +1,89 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun Jan 31 19:37:56 2016 -0800
+Subject: [PATCH] Fixed bug #71488: Stack overflow when decompressing tar archives
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/a5ff6c5e273799785d5ed29d6484cce2f51ec813
+Binary test fixtures not included: ext/phar/tests/bug71488.tar
+---
+diff --git a/ext/phar/tar.c b/ext/phar/tar.c
+--- a/ext/phar/tar.c
++++ b/ext/phar/tar.c
+@@ -192,6 +192,13 @@ static int phar_tar_process_metadata(phar_entry_info *entry, php_stream *fp TSRM
+ }
+ /* }}} */
+
++#if !HAVE_STRNLEN
++static size_t strnlen(const char *s, size_t maxlen) {
++ char *r = (char *)memchr(s, '\0', maxlen);
++ return r ? r-s : maxlen;
++}
++#endif
++
+ int phar_parse_tarfile(php_stream* fp, char *fname, int fname_len, char *alias, int alias_len, phar_archive_data** pphar, int is_data, php_uint32 compression, char **error TSRMLS_DC) /* {{{ */
+ {
+ char buf[512], *actual_alias = NULL, *p;
+@@ -201,6 +208,7 @@ int phar_parse_tarfile(php_stream* fp, char *fname, int fname_len, char *alias,
+ php_uint32 sum1, sum2, size, old;
+ phar_archive_data *myphar, **actual;
+ int last_was_longlink = 0;
++ int linkname_len;
+
+ if (error) {
+ *error = NULL;
+@@ -255,7 +263,7 @@ int phar_parse_tarfile(php_stream* fp, char *fname, int fname_len, char *alias,
+ size = entry.uncompressed_filesize = entry.compressed_filesize =
+ phar_tar_number(hdr->size, sizeof(hdr->size));
+
+- if (((!old && hdr->prefix[0] == 0) || old) && strlen(hdr->name) == sizeof(".phar/signature.bin")-1 && !strncmp(hdr->name, ".phar/signature.bin", sizeof(".phar/signature.bin")-1)) {
++ if (((!old && hdr->prefix[0] == 0) || old) && strnlen(hdr->name, 100) == sizeof(".phar/signature.bin")-1 && !strncmp(hdr->name, ".phar/signature.bin", sizeof(".phar/signature.bin")-1)) {
+ off_t curloc;
+
+ if (size > 511) {
+@@ -466,19 +474,22 @@ bail:
+
+ entry.link = NULL;
+
++ /* link field is null-terminated unless it has 100 non-null chars.
++ * Thus we can not use strlen. */
++ linkname_len = strnlen(hdr->linkname, 100);
+ if (entry.tar_type == TAR_LINK) {
+- if (!zend_hash_exists(&myphar->manifest, hdr->linkname, strlen(hdr->linkname))) {
++ if (!zend_hash_exists(&myphar->manifest, hdr->linkname, linkname_len)) {
+ if (error) {
+- spprintf(error, 4096, "phar error: \"%s\" is a corrupted tar file - hard link to non-existent file \"%s\"", fname, hdr->linkname);
++ spprintf(error, 4096, "phar error: \"%s\" is a corrupted tar file - hard link to non-existent file \"%.*s\"", fname, linkname_len, hdr->linkname);
+ }
+ pefree(entry.filename, entry.is_persistent);
+ php_stream_close(fp);
+ phar_destroy_phar_data(myphar TSRMLS_CC);
+ return FAILURE;
+ }
+- entry.link = estrdup(hdr->linkname);
++ entry.link = estrndup(hdr->linkname, linkname_len);
+ } else if (entry.tar_type == TAR_SYMLINK) {
+- entry.link = estrdup(hdr->linkname);
++ entry.link = estrndup(hdr->linkname, linkname_len);
+ }
+ phar_set_inode(&entry TSRMLS_CC);
+ zend_hash_add(&myphar->manifest, entry.filename, entry.filename_len, (void*)&entry, sizeof(phar_entry_info), (void **) &newentry);
+diff --git a/ext/phar/tests/bug71488.phpt b/ext/phar/tests/bug71488.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/phar/tests/bug71488.phpt
+@@ -0,0 +1,16 @@
++--TEST--
++Phar: bug #71488: Stack overflow when decompressing tar archives
++--SKIPIF--
++<?php if (!extension_loaded("phar")) die("skip"); ?>
++--FILE--
++<?php
++$p = new PharData(__DIR__."/bug71488.tar");
++$newp = $p->decompress("test");
++?>
++DONE
++--CLEAN--
++<?php
++ at unlink(__DIR__."/bug71488.test");
++?>
++--EXPECT--
++DONE
diff --git a/php-bug71498.patch b/php-bug71498.patch
new file mode 100644
index 0000000..e154aee
--- /dev/null
+++ b/php-bug71498.patch
@@ -0,0 +1,42 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun Feb 21 16:51:05 2016 -0800
+Subject: [PATCH] Fix bug #71498: Out-of-Bound Read in phar_parse_zipfile()
+
+5.4 backport: https://github.com/shivammathur/php-src-backports/commit/fcecc5125ac6bb009479071c656ab4a1b5e37bf9
+Binary test fixtures not included: ext/phar/tests/bug71498.zip
+---
+diff --git a/ext/phar/tests/bug71498.phpt b/ext/phar/tests/bug71498.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/phar/tests/bug71498.phpt
+@@ -0,0 +1,17 @@
++--TEST--
++Phar: bug #71498: Out-of-Bound Read in phar_parse_zipfile()
++--SKIPIF--
++<?php if (!extension_loaded("phar")) die("skip"); ?>
++--FILE--
++<?php
++try {
++$p = new PharData(__DIR__."/bug71498.zip");
++} catch(UnexpectedValueException $e) {
++ echo $e->getMessage();
++}
<Skipped 26164 lines>
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/php.git/commitdiff/579eeaf61d18c4a6de7000819578528a237e1e90
More information about the pld-cvs-commit
mailing list