delta/php-git.git/ext, branch php-5.6.13

Merge branch 'PHP-5.6'

2015-09-02T23:53:40+00:00

* PHP-5.6:
  Added missing skipif for phar+zlib test

Merge branch 'PHP-5.5' into PHP-5.6

2015-09-02T23:52:12+00:00

* PHP-5.5:
  More fixes for bug #70219

Merge branch 'PHP-5.5' into PHP-5.6

2015-09-02T23:51:57+00:00

* PHP-5.5:
  fix unit tests

Merge branch '70284' into PHP-5.6

2015-09-02T23:51:19+00:00

* 70284:
  Fix bug ##70284 (Use after free vulnerability in unserialize() with GMP)

Merge branch 'PHP-5.5' into PHP-5.6

2015-09-02T23:48:40+00:00

* PHP-5.5:
  update NEWS
  add NEWS for fixes
  Improve fix for #70172
  Fix bug #70312 - HAVAL gives wrong hashes in specific cases
  fix test
  add test
  Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
  Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage
  Fix bug #70172 - Use After Free Vulnerability in unserialize()
  Fix bug #70388 - SOAP serialize_function_call() type confusion
  Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories
  Improve fix for #70385
  Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)
  Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes)
  Fix bug #70219 (Use after free vulnerability in session deserializer)
  Fix for bug #69782
  Add CVE IDs asigned (post release) to PHP 5.4.43
  Add CVE IDs asigned to #69085 (PHP 5.4.39)
  5.4.45 next

Conflicts:
	ext/pcre/php_pcre.c
	ext/standard/var_unserializer.c
	ext/standard/var_unserializer.re
	ext/zip/php_zip.c

Fix #70303: Incorrect constructor reflection for ArrayObject

2015-08-19T14:23:16+00:00

The first parameter of ArrayObject::__construct() is optional. Reflection
should reflect this.

Fixed bug #70290 (Null pointer deref (segfault) in spl_autoload via ob_start)

2015-08-19T10:41:28+00:00

Patch from Rainer Jung to provide Solaris LDAP support

2015-08-18T14:52:44+00:00

Fix #70277: new DateTimeZone($foo) is ignoring text after null byte

2015-08-17T13:58:37+00:00

The DateTimeZone constructors are not binary safe. They're parsing the timezone
as string, but discard the length when calling timezone_initialize(). This
patch adds a tz_len parameter and a respective check to timezone_initialize().

Fixed sorting order

2015-08-16T20:27:07+00:00

It needs to match the strcasecmp in parse_tz.c.