delta/php-git.git, branch php-7.3.1 git.php.net: repository/php-src.git Update version for PHP 7.3.1 2019-01-08T13:52:49+00:00 Christoph M. Becker cmb@php.net 2019-01-08T13:52:49+00:00 b51be55fe5488a090f6b12200987f4c7afe8cfd3 






Cumulative fix for bugs #77370, #77371, #77381, #77382, #77385 and #77394
2019-01-08T13:16:55+00:00

Christoph M. Becker
cmbecker69@gmx.de

2019-01-08T13:16:55+00:00

12583615da266b59f3cd28e9f81d6898645e30f8












Fix test
2019-01-07T13:59:04+00:00

Christoph M. Becker
cmbecker69@gmx.de

2019-01-07T13:59:04+00:00

059c720c4c934c6bce3cac6b3f25e2534ef43b77












Fix bug #77418 - Heap overflow in utf32be_mbc_to_code
2019-01-07T13:12:57+00:00

Stanislav Malyshev
stas@php.net

2019-01-07T07:34:46+00:00

b6fe458ef9ac1372b60c3d3810b0358e2e20840d

(cherry picked from commit aeec40cb50eca6a97975765e2bacc28a5950cfa9)





(cherry picked from commit aeec40cb50eca6a97975765e2bacc28a5950cfa9)







Fix #77367: Negative size parameter in mb_split
2019-01-07T12:46:49+00:00

Christoph M. Becker
cmbecker69@gmx.de

2018-12-29T13:17:23+00:00

11ce508ee3390d4e68542c9fdae1277e3e75a573

When adding the last element to the result value of `mb_split`, the
`chunk_pos` may point beyond the end of the string, in which case the
unsigned `n` would underflow.  Therefore, we check whether this is the
case in the first place, and only calculate `n` otherwise.  Since `n`
is no longer used outside the block, we move its declaration inside.

(cherry picked from commit e617f03066ce81d26f56c06d6bd7787c7de08703)





When adding the last element to the result value of `mb_split`, the
`chunk_pos` may point beyond the end of the string, in which case the
unsigned `n` would underflow.  Therefore, we check whether this is the
case in the first place, and only calculate `n` otherwise.  Since `n`
is no longer used outside the block, we move its declaration inside.

(cherry picked from commit e617f03066ce81d26f56c06d6bd7787c7de08703)







Fix #77270: imagecolormatch Out Of Bounds Write on Heap
2019-01-07T12:41:51+00:00

Christoph M. Becker
cmbecker69@gmx.de

2018-12-30T12:59:26+00:00

a15af81b5f0058e020eda0f109f51a3c863f5212

At least some of the image reading functions may return images which
use color indexes greater than or equal to im->colorsTotal.  We cater
to this by always using a buffer size which is sufficient for
`gdMaxColors` in `gdImageColorMatch()`.

(cherry picked from commit 7a12dad4dd6c370835b13afae214b240082c7538)





At least some of the image reading functions may return images which
use color indexes greater than or equal to im->colorsTotal.  We cater
to this by always using a buffer size which is sufficient for
`gdMaxColors` in `gdImageColorMatch()`.

(cherry picked from commit 7a12dad4dd6c370835b13afae214b240082c7538)







Fix bug #77380  (Global out of bounds read in xmlrpc base64 code)
2019-01-07T12:41:05+00:00

Stanislav Malyshev
stas@php.net

2019-01-02T01:15:20+00:00

027f68ff10a439c5c331bcbfdd6eb2a5fca0948a

(cherry picked from commit 1cc2182bcc81e185c14837e659d12b268cb99d63)





(cherry picked from commit 1cc2182bcc81e185c14837e659d12b268cb99d63)







Fix #77269: Potential unsigned underflow in gdImageScale
2019-01-07T12:26:24+00:00

Christoph M. Becker
cmbecker69@gmx.de

2018-12-12T15:00:59+00:00

c1edfc748b88ef025edd23553888536ed62dc38e

Belatedly, we're porting the respective upstream patch[1].

[1] <https://github.com/libgd/libgd/commit/60bfb401ad5a4a8ae995dcd36372fe15c71e1a35>

(cherry picked from commit a918020c03880e12ac9f38e11a4a3789491a5f85)





Belatedly, we're porting the respective upstream patch[1].

[1] <https://github.com/libgd/libgd/commit/60bfb401ad5a4a8ae995dcd36372fe15c71e1a35>

(cherry picked from commit a918020c03880e12ac9f38e11a4a3789491a5f85)







Fix bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext)
2019-01-07T12:22:23+00:00

Stanislav Malyshev
stas@php.net

2018-12-30T02:25:37+00:00

9d388b95c54ea053ce6f194defe1ff6673195747

(cherry picked from commit 428d8164ffcf6f75a6cc9d4056e54bfd450dac03)





(cherry picked from commit 428d8164ffcf6f75a6cc9d4056e54bfd450dac03)







Fix bug #77242 (heap out of bounds read in xmlrpc_decode())
2019-01-07T12:18:57+00:00

Stanislav Malyshev
stas@php.net

2018-12-30T01:56:36+00:00

ba3d1956ebc838a191bdc31ba66a89c94cb98441

(cherry picked from commit 4fc0bceb7c39be206c73f69993e3936ef329f656)





(cherry picked from commit 4fc0bceb7c39be206c73f69993e3936ef329f656)