./lang/php56, PHP Hypertext Preprocessor version 5.6

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 5.6.30, Package name: php-5.6.30, Maintainer: pkgsrc-users

PHP is an HTML-embedded scripting language. It is modular, with
some object-oriented features. Much of its syntax is borrowed from
C, Java and Perl with a couple of unique PHP-specific features
thrown in. The language is designed to allow web developers to
write dynamically generated pages quickly.

This package provides PHP version 5.6.x.


Required to run:
[textproc/libxml2]

Required to build:
[pkgtools/cwrappers]

Package options: inet6, ssl

Master sites: (Expand)

SHA1: 9ac486b7f86c01a297375cae5728b424ac5790ce
RMD160: 445f7a88b802f88484671e2981f44147b13794fc
Filesize: 14659.977 KB

Version history: (Expand)


CVS history: (Expand)


   2017-02-20 10:35:18 by Thomas Klausner | Files touched by this commit (15)
Log message:
Fix build with tidy-5.x.
   2017-01-20 01:44:01 by Takahiro Kambe | Files touched by this commit (1) | Package updated
Log message:
Update php56 to 5.6.30.

PHP                                                                        NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
19 Jan 2017, PHP 5.6.30

- EXIF:
  . Fixed bug #73737 (FPE when parsing a tag format). (Stas)

- GD:
  . Fixed bug #73549 (Use after free when stream is passed to imagepng). (cmb)
  . Fixed bug #73868 (DOS vulnerability in gdImageCreateFromGd2Ctx()). (cmb)
  . Fixed bug #73869 (Signed Integer Overflow gd_io.c). (cmb)

- Intl:
  . Fixed bug #68447 (grapheme_extract take an extra trailing character).
    (SATŌ Kentarō)

- Phar:
  . Fixed bug #73764 (Crash while loading hostile phar archive). (Stas)
  . Fixed bug #73768 (Memory corruption when loading hostile phar). (Stas)
  . Fixed bug #73773 (Seg fault when loading hostile phar). (Stas)

- SQLite3:
  . Reverted fix for bug #73530	(Unsetting result set may reset other result
    set). (cmb)

- Standard:
  . Fixed bug #70213 (Unserialize context shared on double class lookup).
    (Taoguang Chen)
  . Fixed bug #73825 (Heap out of bounds read on unserialize in
    finish_nested_data()). (Stas)
   2016-12-10 08:08:39 by Takahiro Kambe | Files touched by this commit (1) | Package updated
Log message:
Update php56 to 5.6.29 (PHP 5.6.29).

08 Dec 2016, PHP 5.6.29

- Mysqlnd:
  . Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*). (cmb)

- Opcache:
  . Fixed bug #73402 (Opcache segfault when using class constant to call a
    method). (Laruence)
  . Fixed bug #69090 (check cached files permissions)

- OpenSSL
  . Fixed bug #72776 (Invalid parameter in memcpy function trough
    openssl_pbkdf2). (Jakub Zelenka)

- Postgres:
  . Fixed bug #73498 (Incorrect SQL generated for pg_copy_to()). (Craig Duncan)

- SOAP:
  . Fixed bug #73452 (Segfault (Regression for #69152)). (Dmitry)

- SQLite3:
  . Fixed bug #73530 (Unsetting result set may reset other result set). (cmb)

- Standard:
  . Fixed bug #73297 (HTTP stream wrapper should ignore HTTP 100 Continue).
    (rowan dot collins at gmail dot com)

- WDDX:
  . Fixed bug #73631 (Memory leak due to invalid wddx stack processing).
    (bughunter at fosec dot vn).
   2016-12-05 19:17:12 by Adam Ciarcinski | Files touched by this commit (2)
Log message:
On Darwin, allow native iconv when Command Line Tools are not installed.
   2016-11-12 16:34:00 by Takahiro Kambe | Files touched by this commit (1) | Package updated
Log message:
Update php56 to 5.6.28 (PHP 5.6.28), including security fix (as usual).

10 Nov 2016, PHP 5.6.28

- Core:
  . Fixed bug #73337 (try/catch not working with two exceptions inside a same
    operation). (Dmitry)

- Bz2:
  . Fixed bug #73356 (crash in bzcompress function). (Stas)

-GD:
  . Fixed bug #73213 (Integer overflow in imageline() with antialiasing). (cmb)
  . Fixed bug #73272 (imagescale() is not affected by, but affects
    imagesetinterpolation()). (cmb)
  . Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()). (cmb)
  . Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf). (cmb)
  . Fixed bug #72482 (Illegal write/read access caused by gdImageAALine overflow).
    (cmb)
  . Fixed bug #72696 (imagefilltoborder stackoverflow on truecolor images). (cmb)

- Imap:
  . Fixed bug #73418 (Integer Overflow in "_php_imap_mail" leads Heap \ 
Overflow).
    (Anatol)

- SPL:
  . Fixed bug #73144 (Use-after-free in ArrayObject Deserialization). (Stas)

- SOAP:
  . Fixed bug #73037 (SoapServer reports Bad Request when gzipped). (Anatol)

- SQLite3:
  . Fixed bug #73333 (2147483647 is fetched as string). (cmb)

- Standard:
  . Fixed bug #73203 (passing additional_parameters causes mail to fail). (cmb)
  . Fixed bug #73188 (use after free in userspace streams). (Sara)

- Wddx:
  . Fixed bug #73331 (NULL Pointer Dereference in WDDX Packet Deserialization
    with PDORow). (Stas)
   2016-10-16 13:58:42 by Takahiro Kambe | Files touched by this commit (1) | Package updated
Log message:
Update php56 to 5.6.27.

13 Oct 2016, PHP 5.6.27

- Core:
  . Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of
    zend_virtual_cwd.c). (cmb)
  . Fixed bug #73058 (crypt broken when salt is 'too' long). (Anatol)
  . Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by
    password_verify). (Anatol)
  . Fixed bug #73189 (Memcpy negative size parameter php_resolve_path). (Stas)
  . Fixed bug #73147 (Use After Free in unserialize()). (Stas)

- BCmath:
  . Fixed bug #73190 (memcpy negative parameter _bc_new_num_ex). (Stas)

- DOM:
  . Fixed bug #73150 (missing NULL check in dom_document_save_html). (Stas)

- Ereg:
  . Fixed bug #73284 (heap overflow in php_ereg_replace function). (Stas)

- Filter:
  . Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and
    FILTER_FLAG_NO_PRIV_RANGE). (julien)
  . Fixed bug #67167 (Wrong return value from FILTER_VALIDATE_BOOLEAN,
    FILTER_NULL_ON_FAILURE). (levim, cmb)
  . Fixed bug #73054 (default option ignored when object passed to int filter).
    (cmb)

- GD:
  . Fixed bug #67325 (imagetruecolortopalette: white is duplicated in palette).
    (cmb)
  . Fixed bug #50194 (imagettftext broken on transparent background w/o
    alphablending). (cmb)
  . Fixed bug #73003 (Integer Overflow in gdImageWebpCtx of gd_webp.c). (trylab,
    cmb)
  . Fixed bug #53504 (imagettfbbox gives incorrect values for bounding box).
    (Mark Plomer, cmb)
  . Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given). (cmb)
  . Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries). (cmb)
  . Fixed bug #73159 (imagegd2(): unrecognized formats may result in corrupted
    files). (cmb)
  . Fixed bug #73161 (imagecreatefromgd2() may leak memory). (cmb)

- Intl:
  . Fixed bug #73218 (add mitigation for ICU int overflow). (Stas)

- Imap:
  . Fixed bug #73208 (integer overflow in imap_8bit caused heap corruption).
    (Stas)

- Mbstring:
  . Fixed bug #72994 (mbc_to_code() out of bounds read). (Laruence, cmb)
  . Fixed bug #66964 (mb_convert_variables() cannot detect recursion). (Yasuo)
  . Fixed bug #72992 (mbstring.internal_encoding doesn't inherit default_charset).
    (Yasuo)
  . Fixed bug #73082 (string length overflow in mb_encode_* function). (Stas)

- PCRE:
  . Fixed bug #73174 (heap overflow in php_pcre_replace_impl). (Stas)

- Opcache:
  . Fixed bug #72590 (Opcache restart with kill_all_lockers does not work).
    (Keyur) (julien backport)

- OpenSSL:
  . Fixed bug #73072 (Invalid path SNI_server_certs causes segfault).
    (Jakub Zelenka)
  . Fixed bug #73275 (crash in openssl_encrypt function). (Stas)
  . Fixed bug #73276 (crash in openssl_random_pseudo_bytes function). (Stas)

- Session:
  . Fixed bug #68015 (Session does not report invalid uid for files save handler).
    (Yasuo)
  . Fixed bug #73100 (session_destroy null dereference in ps_files_path_create).
    (cmb)

- SimpleXML:
  . Fixed bug #73293 (NULL pointer dereference in SimpleXMLElement::asXML()).
    (Stas)

- SPL:
  . Fixed bug #73073 (CachingIterator null dereference when convert to string).
    (Stas)

- Standard:
  . Fixed bug #73240 (Write out of bounds at number_format). (Stas)
  . Fixed bug #73017 (memory corruption in wordwrap function). (Stas)

- Stream:
  . Fixed bug #73069 (readfile() mangles files larger than 2G). (Laruence)

- Zip:
  . Fixed bug #70752 (Depacking with wrong password leaves 0 length files).
    (cmb)
   2016-09-16 18:09:24 by Takahiro Kambe | Files touched by this commit (1) | Package updated
Log message:
Update php56 to 5.6.26 (PHP 5.6.26).

15 Sep 2016, PHP 5.6.26

- Core:
  . Fixed bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer
    (zend_gc.c:260)). (Laruence)

- Dba:
  . Fixed bug #71514 (Bad dba_replace condition because of wrong API usage).
    (cmb)
  . Fixed bug #70825 (Cannot fetch multiple values with group in ini file).
    (cmb)

- EXIF:
  . Fixed bug #72926 (Uninitialized Thumbail Data Leads To Memory Leakage in
    exif_process_IFD_in_TIFF). (Stas)

- FTP:
  . Fixed bug #70195 (Cannot upload file using ftp_put to FTPES with
    require_ssl_reuse). (Benedict Singer)

- GD:
  . Fixed bug #66005 (imagecopy does not support 1bit transparency on truecolor
    images). (cmb)
  . Fixed bug #72913 (imagecopy() loses single-color transparency on palette
    images). (cmb)
  . Fixed bug #68716 (possible resource leaks in _php_image_convert()). (cmb)

- Intl:
  . Fixed bug #73007 (add locale length check). (Stas)

- JSON:
  . Fixed bug #72787 (json_decode reads out of bounds). (Jakub Zelenka)

- mbstring:
  . Fixed bug #66797 (mb_substr only takes 32-bit signed integer). (cmb)
  . Fixed bug #72910 (Out of bounds heap read in mbc_to_code() / triggered by
    mb_ereg_match()). (Stas)

- MSSQL:
  . Fixed bug #72039 (Use of uninitialised value on mssql_guid_string). (Kalle)

- Mysqlnd:
  . Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields). (Stas)

- Phar:
  . Fixed bug #72928 (Out of bound when verify signature of zip phar in
    phar_parse_zipfile). (Stas)
  . Fixed bug #73035 (Out of bound when verify signature of tar phar in
    phar_parse_tarfile). (Stas)

- PDO:
  . Fixed bug #60665 (call to empty() on NULL result using PDO::FETCH_LAZY
    returns false). (cmb)

- PDO_pgsql:
  . Implemented FR #72633 (Postgres PDO lastInsertId() should work without
    specifying a sequence). (Pablo Santiago Sánchez, Matteo)
  . Fixed bug #72759 (Regression in pgo_pgsql). (Anatol)

- SPL:
  . Fixed bug #73029 (Missing type check when unserializing SplArray). (Stas)

- Standard:
  . Fixed bug #72823 (strtr out-of-bound access). (cmb)
  . Fixed bug #72278 (getimagesize returning FALSE on valid jpg). (cmb)
  . Fixed bug #65550 (get_browser() incorrectly parses entries with \ 
"+" sign).
    (cmb)
  . Fixed bug #71882 (Negative ftruncate() on php://memory exhausts memory).
    (cmb)
  . Fixed bug #73011 (integer overflow in fgets cause heap corruption). (Stas)
  . Fixed bug #73017 (memory corruption in wordwrap function). (Stas)
  . Fixed bug #73045 (integer overflow in fgetcsv caused heap corruption). (Stas)
  . Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)
    (Stas)

- Streams:
  . Fixed bug #72853 (stream_set_blocking doesn't work). (Laruence)

- Wddx:
  . Fixed bug #72860 (wddx_deserialize use-after-free). (Stas)
  . Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element). (Stas)

- XML:
  . Fixed bug #72085 (SEGV on unknown address zif_xml_parse). (cmb)
  . Fixed bug #72927 (integer overflow in xml_utf8_encode). (Stas)

- ZIP:
  . Fixed bug #68302 (impossible to compile php with zip support). (cmb)
   2016-08-19 05:29:00 by Takahiro Kambe | Files touched by this commit (1) | Package updated
Log message:
Update php56 to 5.6.25 (PHP 5.6.25).

18 Aug 2016, PHP 5.6.25

- Bz2:
  . Fixed bug #72837 (integer overflow in bzdecompress caused heap
    corruption). (Stas)

- Core:
  . Fixed bug #70436 (Use After Free Vulnerability in unserialize()).
    (Taoguang Chen)
  . Fixed bug #72024 (microtime() leaks memory). (maroszek at gmx dot net)
  . Fixed bug #72581 (previous property undefined in Exception after
    deserialization). (Laruence)
  . Implemented FR #72614 (Support "nmake test" on building extensions by
    phpize). (Yuji Uchiyama)
  . Fixed bug #72641 (phpize (on Windows) ignores PHP_PREFIX).
    (Yuji Uchiyama)
  . Fixed bug #72663 (Create an Unexpected Object and Don't Invoke
    __wakeup() in Deserialization). (Stas)
  . Fixed bug #72681 (PHP Session Data Injection Vulnerability). (Stas)

- Calendar:
  . Fixed bug #67976 (cal_days_month() fails for final month of the French
    calendar). (cmb)
  . Fixed bug #71894 (AddressSanitizer: global-buffer-overflow in
    zif_cal_from_jd). (cmb)

- Curl:
  . Fixed bug #71144 (Segmentation fault when using cURL with ZTS).
    (maroszek at gmx dot net)
  . Fixed bug #71929 (Certification information (CERTINFO) data parsing error).
    (Pierrick)
  . Fixed bug #72807 (integer overflow in curl_escape caused heap
    corruption). (Stas)

- DOM:
  . Fixed bug #66502 (DOM document dangling reference). (Sean Heelan, cmb)

- Ereg:
  . Fixed bug #72838 (Integer overflow lead to heap corruption in
    sql_regcase). (Stas)

- EXIF:
  . Fixed bug #72627 (Memory Leakage In exif_process_IFD_in_TIFF). (Stas)
  . Fixed bug #72735 (Samsung picture thumb not read (zero size)). (Kalle, Remi)

- Filter:
  . Fixed bug #71745 (FILTER_FLAG_NO_RES_RANGE does not cover whole 127.0.0.0/8
    range). (bugs dot php dot net at majkl578 dot cz)

- FPM:
  . Fixed bug #72575 (using --allow-to-run-as-root should ignore missing user).
    (gooh)

- GD:
  . Fixed bug #43828 (broken transparency of imagearc for truecolor in
    blendingmode). (cmb)
  . Fixed bug #66555 (Always false condition in ext/gd/libgd/gdkanji.c). (cmb)
  . Fixed bug #68712 (suspicious if-else statements). (cmb)
  . Fixed bug #70315 (500 Server Error but page is fully rendered). (cmb)
  . Fixed bug #72596 (imagetypes function won't advertise WEBP support). (cmb)
  . Fixed bug #72604 (imagearc() ignores thickness for full arcs). (cmb)
  . Fixed bug #72697 (select_colors write out-of-bounds). (Stas)
  . Fixed bug #72709 (imagesetstyle() causes OOB read for empty $styles). (cmb)
  . Fixed bug #72730 (imagegammacorrect allows arbitrary write access). (Stas)

- Intl:
  . Partially fixed #72506 (idn_to_ascii for UTS #46 incorrect for long domain
    names). (cmb)

- mbstring:
  . Fixed bug #72691 (mb_ereg_search raises a warning if a match zero-width).
    (cmb)
  . Fixed bug #72693 (mb_ereg_search increments search position when a match
    zero-width). (cmb)
  . Fixed bug #72694 (mb_ereg_search_setpos does not accept a string's last
    position). (cmb)
  . Fixed bug #72710 (`mb_ereg` causes buffer overflow on regexp compile error).
    (ju1ius)

- PCRE:
  . Fixed bug #72688 (preg_match missing group names in matches). (cmb)

- PDO_pgsql:
  . Fixed bug #70313 (PDO statement fails to throw exception). (Matteo)

- Reflection:
  . Fixed bug #72222 (ReflectionClass::export doesn't handle array constants).
    (Nikita Nefedov)

- SNMP:
  . Fixed bug #72708 (php_snmp_parse_oid integer overflow in memory
    allocation). (djodjo at gmail dot com)

- Standard:
  . Fixed bug #72330 (CSV fields incorrectly split if escape char followed by
    UTF chars). (cmb)
  . Fixed bug #72836 (integer overflow in base64_decode). (Stas)
  . Fixed bug #72848 (integer overflow in quoted_printable_encode). (Stas)
  . Fixed bug #72849 (integer overflow in urlencode). (Stas)
  . Fixed bug #72850 (integer overflow in php_uuencode). (Stas)
  . Fixed bug #72716 (initialize buffer before read). (Stas)

- Streams:
  . Fixed bug #41021 (Problems with the ftps wrapper). (vhuk)
  . Fixed bug #54431 (opendir() does not work with ftps:// wrapper). (vhuk)
  . Fixed bug #72667 (opendir() with ftp:// attempts to open data stream for
    non-existent directories). (vhuk)
  . Fixed bug #72764 (ftps:// opendir wrapper data channel encryption fails
    with IIS FTP 7.5, 8.5). (vhuk)
  . Fixed bug #72771 (ftps:// wrapper is vulnerable to protocol downgrade
    attack). (Stas)

- SPL:
  . Fixed bug #72122 (IteratorIterator breaks '@' error suppression). (kinglozzer)
  . Fixed bug #72646 (SplFileObject::getCsvControl does not return the escape
    character). (cmb)
  . Fixed bug #72684 (AppendIterator segfault with closed generator). (Pierrick)

- SQLite3:
  . Implemented FR #72653 (SQLite should allow opening with empty filename).
    (cmb)

- Wddx:
  . Fixed bug #72142 (WDDX Packet Injection Vulnerability in
    wddx_serialize_value()). (Taoguang Chen)
  . Fixed bug #72749 (wddx_deserialize allows illegal memory access) (Stas)
  . Fixed bug #72750 (wddx_deserialize null dereference). (Stas)
  . Fixed bug #72790 (wddx_deserialize null dereference with invalid xml).
    (Stas)
  . Fixed bug #72799 (wddx_deserialize null dereference in
    php_wddx_pop_element). (Stas)