[PHP-BUG] Bug #51719 [NEW]: typo in function prototype

2010-05-01 Thread geiss...@php.net
From: geissert
Operating system: 
PHP version:  5.3SVN-2010-05-01 (SVN)
Package:  Scripting Engine problem
Bug Type: Bug
Bug description:typo in function prototype

Description:

Zend/zend_builtin_functions.c reads:



ZEND_BEGIN_ARG_INFO_EX(arginfo_trigger_error, 0, 0, 1)

ZEND_ARG_INFO(0, messsage)

ZEND_ARG_INFO(0, error_type)

ZEND_END_ARG_INFO()



and 



/* {{{ proto void trigger_error(string messsage [, int error_type])

   Generates a user-level error/warning/notice message */

ZEND_FUNCTION(trigger_error)





There's a typo in both: s/messsage/message



I can't fix it because of EPERM


-- 
Edit bug report at http://bugs.php.net/bug.php?id=51719&edit=1
-- 
Try a snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=51719&r=trysnapshot52
Try a snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=51719&r=trysnapshot53
Try a snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=51719&r=trysnapshot60
Fixed in SVN:
http://bugs.php.net/fix.php?id=51719&r=fixed
Fixed in SVN and need be documented: 
http://bugs.php.net/fix.php?id=51719&r=needdocs
Fixed in release:
http://bugs.php.net/fix.php?id=51719&r=alreadyfixed
Need backtrace:  
http://bugs.php.net/fix.php?id=51719&r=needtrace
Need Reproduce Script:   
http://bugs.php.net/fix.php?id=51719&r=needscript
Try newer version:   
http://bugs.php.net/fix.php?id=51719&r=oldversion
Not developer issue: 
http://bugs.php.net/fix.php?id=51719&r=support
Expected behavior:   
http://bugs.php.net/fix.php?id=51719&r=notwrong
Not enough info: 
http://bugs.php.net/fix.php?id=51719&r=notenoughinfo
Submitted twice: 
http://bugs.php.net/fix.php?id=51719&r=submittedtwice
register_globals:
http://bugs.php.net/fix.php?id=51719&r=globals
PHP 4 support discontinued:  http://bugs.php.net/fix.php?id=51719&r=php4
Daylight Savings:http://bugs.php.net/fix.php?id=51719&r=dst
IIS Stability:   
http://bugs.php.net/fix.php?id=51719&r=isapi
Install GNU Sed: 
http://bugs.php.net/fix.php?id=51719&r=gnused
Floating point limitations:  
http://bugs.php.net/fix.php?id=51719&r=float
No Zend Extensions:  
http://bugs.php.net/fix.php?id=51719&r=nozend
MySQL Configuration Error:   
http://bugs.php.net/fix.php?id=51719&r=mysqlcfg



[PHP-BUG] Bug #51725 [NEW]: xmlrpc_get_type() returns true on invalid dates

2010-05-02 Thread geiss...@php.net
From: geissert
Operating system: linux/kfreebsd ia64/x86_64
PHP version:  5.3.2
Package:  XMLRPC-EPI related
Bug Type: Bug
Bug description:xmlrpc_get_type() returns true on invalid dates

Description:

ext/xmlrpc/tests/bug42189.phpt fails consistently on 64 bits architectures
such as ia64 and x86_64.



I modified the test a bit to show what's going on. From a quick look at the
code it appears to be a bug in the XMLRPC-EPI lib and not in the module
itself.



Test script:
---


Expected result:

bool(false)

Done



Actual result:
--
bool(true)







 

  ~~

 





Done



-- 
Edit bug report at http://bugs.php.net/bug.php?id=51725&edit=1
-- 
Try a snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=51725&r=trysnapshot52
Try a snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=51725&r=trysnapshot53
Try a snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=51725&r=trysnapshot60
Fixed in SVN:
http://bugs.php.net/fix.php?id=51725&r=fixed
Fixed in SVN and need be documented: 
http://bugs.php.net/fix.php?id=51725&r=needdocs
Fixed in release:
http://bugs.php.net/fix.php?id=51725&r=alreadyfixed
Need backtrace:  
http://bugs.php.net/fix.php?id=51725&r=needtrace
Need Reproduce Script:   
http://bugs.php.net/fix.php?id=51725&r=needscript
Try newer version:   
http://bugs.php.net/fix.php?id=51725&r=oldversion
Not developer issue: 
http://bugs.php.net/fix.php?id=51725&r=support
Expected behavior:   
http://bugs.php.net/fix.php?id=51725&r=notwrong
Not enough info: 
http://bugs.php.net/fix.php?id=51725&r=notenoughinfo
Submitted twice: 
http://bugs.php.net/fix.php?id=51725&r=submittedtwice
register_globals:
http://bugs.php.net/fix.php?id=51725&r=globals
PHP 4 support discontinued:  http://bugs.php.net/fix.php?id=51725&r=php4
Daylight Savings:http://bugs.php.net/fix.php?id=51725&r=dst
IIS Stability:   
http://bugs.php.net/fix.php?id=51725&r=isapi
Install GNU Sed: 
http://bugs.php.net/fix.php?id=51725&r=gnused
Floating point limitations:  
http://bugs.php.net/fix.php?id=51725&r=float
No Zend Extensions:  
http://bugs.php.net/fix.php?id=51725&r=nozend
MySQL Configuration Error:   
http://bugs.php.net/fix.php?id=51725&r=mysqlcfg



[PHP-BUG] Bug #51729 [NEW]: bitwiseShift* tests fail

2010-05-03 Thread geiss...@php.net
From: geissert
Operating system: Linux ia64
PHP version:  5.3.2
Package:  Scripting Engine problem
Bug Type: Bug
Bug description:bitwiseShift* tests fail

Description:

On ia64 the following tests (test names relative t tests/lang/operators/)
fail:



bitwiseShiftLeft_basiclong_64bit.phpt

bitwiseShiftLeft_variationStr_64bit.phpt

bitwiseShiftRight_basiclong_64bit.phpt

bitwiseShiftRight_variationStr.phpt



The contents of the .log files can be found at (first is run-tests.php's
output, later followed by the content of each .log file):

http://alioth.debian.org/~geissert/php/5.3.2-1_ia64.tests.log.gz



gcc's version and optimisation level are irrelevant.

Actual result:
--
For example, the diff of bitwiseShiftRight_variationStr.phpt:



032+ string(2) "30"

032- string(4) "3332"

060+ string(4) "2d31"

060- string(6) "2d3232"

116+ string(4) "2d31"

116- string(4) "2d34"

172+ string(2) "30"

172- string(4) "3631"

200+ string(2) "30"

200- string(4) "3631"

228+ string(2) "30"

228- string(4) "3631"

256+ string(2) "30"

256- string(4) "3631"

284+ string(2) "30"

284- string(4) "3631"

312+ string(2) "30"

312- string(4) "3631"

340+ string(2) "30"

340- string(2) "31"

-- 
Edit bug report at http://bugs.php.net/bug.php?id=51729&edit=1
-- 
Try a snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=51729&r=trysnapshot52
Try a snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=51729&r=trysnapshot53
Try a snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=51729&r=trysnapshot60
Fixed in SVN:
http://bugs.php.net/fix.php?id=51729&r=fixed
Fixed in SVN and need be documented: 
http://bugs.php.net/fix.php?id=51729&r=needdocs
Fixed in release:
http://bugs.php.net/fix.php?id=51729&r=alreadyfixed
Need backtrace:  
http://bugs.php.net/fix.php?id=51729&r=needtrace
Need Reproduce Script:   
http://bugs.php.net/fix.php?id=51729&r=needscript
Try newer version:   
http://bugs.php.net/fix.php?id=51729&r=oldversion
Not developer issue: 
http://bugs.php.net/fix.php?id=51729&r=support
Expected behavior:   
http://bugs.php.net/fix.php?id=51729&r=notwrong
Not enough info: 
http://bugs.php.net/fix.php?id=51729&r=notenoughinfo
Submitted twice: 
http://bugs.php.net/fix.php?id=51729&r=submittedtwice
register_globals:
http://bugs.php.net/fix.php?id=51729&r=globals
PHP 4 support discontinued:  http://bugs.php.net/fix.php?id=51729&r=php4
Daylight Savings:http://bugs.php.net/fix.php?id=51729&r=dst
IIS Stability:   
http://bugs.php.net/fix.php?id=51729&r=isapi
Install GNU Sed: 
http://bugs.php.net/fix.php?id=51729&r=gnused
Floating point limitations:  
http://bugs.php.net/fix.php?id=51729&r=float
No Zend Extensions:  
http://bugs.php.net/fix.php?id=51729&r=nozend
MySQL Configuration Error:   
http://bugs.php.net/fix.php?id=51729&r=mysqlcfg



[PHP-BUG] Bug #51730 [NEW]: bitwiseShiftLeft_variationStr test fails

2010-05-03 Thread geiss...@php.net
From: geissert
Operating system: Linux armel/powerpc/s390
PHP version:  5.3.2
Package:  Scripting Engine problem
Bug Type: Bug
Bug description:bitwiseShiftLeft_variationStr test fails

Description:

On armel (ARM EABI), powerpc, and s390 the
tests/lang/operators/bitwiseShiftLeft_variationStr.phpt test fails.



The contents of the .log files can be grepped on the following files:

http://alioth.debian.org/~geissert/php/5.3.2-1_{armel,powerpc,s390}.tests.log.gz

(first is run-tests.php's output, later followed by the content of each
.log file):



On armel the bitwiseShiftRight_variationStr.phpt test fails too.




-- 
Edit bug report at http://bugs.php.net/bug.php?id=51730&edit=1
-- 
Try a snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=51730&r=trysnapshot52
Try a snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=51730&r=trysnapshot53
Try a snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=51730&r=trysnapshot60
Fixed in SVN:
http://bugs.php.net/fix.php?id=51730&r=fixed
Fixed in SVN and need be documented: 
http://bugs.php.net/fix.php?id=51730&r=needdocs
Fixed in release:
http://bugs.php.net/fix.php?id=51730&r=alreadyfixed
Need backtrace:  
http://bugs.php.net/fix.php?id=51730&r=needtrace
Need Reproduce Script:   
http://bugs.php.net/fix.php?id=51730&r=needscript
Try newer version:   
http://bugs.php.net/fix.php?id=51730&r=oldversion
Not developer issue: 
http://bugs.php.net/fix.php?id=51730&r=support
Expected behavior:   
http://bugs.php.net/fix.php?id=51730&r=notwrong
Not enough info: 
http://bugs.php.net/fix.php?id=51730&r=notenoughinfo
Submitted twice: 
http://bugs.php.net/fix.php?id=51730&r=submittedtwice
register_globals:
http://bugs.php.net/fix.php?id=51730&r=globals
PHP 4 support discontinued:  http://bugs.php.net/fix.php?id=51730&r=php4
Daylight Savings:http://bugs.php.net/fix.php?id=51730&r=dst
IIS Stability:   
http://bugs.php.net/fix.php?id=51730&r=isapi
Install GNU Sed: 
http://bugs.php.net/fix.php?id=51730&r=gnused
Floating point limitations:  
http://bugs.php.net/fix.php?id=51730&r=float
No Zend Extensions:  
http://bugs.php.net/fix.php?id=51730&r=nozend
MySQL Configuration Error:   
http://bugs.php.net/fix.php?id=51730&r=mysqlcfg



Bug #52407 [Com]: FPM module compilation fails on ARM architecture

2010-07-23 Thread geiss...@php.net
Edit report at http://bugs.php.net/bug.php?id=52407&edit=1

 ID:   52407
 Comment by:   geiss...@php.net
 Reported by:  eugenesan at gmail dot com
 Summary:  FPM module compilation fails on ARM architecture
 Status:   Assigned
 Type: Bug
 Package:  Compile Failure
 Operating System: Linux
 PHP Version:  5.3.3
 Assigned To:  fat

 New Comment:

As a matter of fact, why aren't the gcc atomic builtins used in all
architectures 

if gcc > 4.1 is used? Otherwise it is going to be a pain to port the
atomic code 

to many architectures.

I've read that icc supports them too, but I don't know since when or
anything 

else.



For the Debian packages I'm going to do that, but I'd prefer to see the
change 

happen here too (included a cleanup of the unused atomic_*_t types --
only 

atomic_t needs to be defined.)


Previous Comments:

[2010-07-22 17:30:10] eugenesan at gmail dot com

Patch passed heavy load test.


[2010-07-22 17:21:20] der...@php.net

Never mind, it's there now :-)


[2010-07-22 17:20:49] der...@php.net

I see no attachment.


[2010-07-22 17:16:27] eugenesan at gmail dot com

Description:

FPM module compilation fails on ARM architecture.

Fix attached while approved by original code author (W-Mark Kubacki)

Test script:
---
configure with --enable-fpm and build on ARM machine







Expected result:

Compilation should pass and binary work.







-- 
Edit this bug report at http://bugs.php.net/bug.php?id=52407&edit=1


Bug #52407 [PATCH]: FPM module compilation fails on ARM architecture

2010-07-28 Thread geiss...@php.net
Edit report at http://bugs.php.net/bug.php?id=52407&edit=1

 ID: 52407
 Patch added by: geiss...@php.net
 Reported by:eugenesan at gmail dot com
 Summary:FPM module compilation fails on ARM architecture
 Status: Assigned
 Type:   Bug
 Package:Compile Failure
 Operating System:   Linux
 PHP Version:5.3.3
 Assigned To:fat
 Block user comment: N

 New Comment:

The following patch has been added/updated:

Patch Name: fpm-gcc-atomics.patch
Revision:   1280352665
URL:   
http://bugs.php.net/patch-display.php?bug=52407&patch=fpm-gcc-atomics.patch&revision=1280352665


Previous Comments:

[2010-07-24 14:37:24] f...@php.net

Can you please test & validate this patch on ARM arch ?



I've added an #error if ARM && gcc <= 4.2


[2010-07-24 14:36:05] f...@php.net

The following patch has been added/updated:

Patch Name: fpm_atomic_h_fix.patch
Revision:   1279974965
URL:   
http://bugs.php.net/patch-display.php?bug=52407&patch=fpm_atomic_h_fix.patch&revision=1279974965


[2010-07-24 10:38:29] eugenesan at gmail dot com

I wasn't aware of atomic functionality in libgcc.

In older version of FPM (before W-Mark Kubacki provided current
solution),

I was copying atomic functions available in libc :-)



Also, W-Mark Kubacki tried to propose libatomic as generic 

solution for all platforms, but due to stability reasons solution was
declined.



Anyways, provided patch is only for urgent fixing of FPM on ARM in PHP
5.3.3.

Later, I would expect more serious treatment of the issue by
maintainers.

--------
[2010-07-24 02:00:20] geiss...@php.net

As a matter of fact, why aren't the gcc atomic builtins used in all
architectures 

if gcc > 4.1 is used? Otherwise it is going to be a pain to port the
atomic code 

to many architectures.

I've read that icc supports them too, but I don't know since when or
anything 

else.



For the Debian packages I'm going to do that, but I'd prefer to see the
change 

happen here too (included a cleanup of the unused atomic_*_t types --
only 

atomic_t needs to be defined.)


[2010-07-22 17:30:10] eugenesan at gmail dot com

Patch passed heavy load test.




The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

http://bugs.php.net/bug.php?id=52407


-- 
Edit this bug report at http://bugs.php.net/bug.php?id=52407&edit=1


[PHP-BUG] Bug #52476 [NEW]: php-fpm is installed in /usr/sbin

2010-07-28 Thread geiss...@php.net
From: geissert
Operating system: Irrelevant
PHP version:  5.3.3
Package:  FPM related
Bug Type: Bug
Bug description:php-fpm is installed in /usr/sbin

Description:

The php-fpm binary is installed in /usr/sbin when the man page is section
1.

I don't see any reason (other than multi-user support and the like) that
makes it 

fit better in sbin instead of just bin.




-- 
Edit bug report at http://bugs.php.net/bug.php?id=52476&edit=1
-- 
Try a snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=52476&r=trysnapshot52
Try a snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=52476&r=trysnapshot53
Try a snapshot (trunk):  
http://bugs.php.net/fix.php?id=52476&r=trysnapshottrunk
Fixed in SVN:
http://bugs.php.net/fix.php?id=52476&r=fixed
Fixed in SVN and need be documented: 
http://bugs.php.net/fix.php?id=52476&r=needdocs
Fixed in release:
http://bugs.php.net/fix.php?id=52476&r=alreadyfixed
Need backtrace:  
http://bugs.php.net/fix.php?id=52476&r=needtrace
Need Reproduce Script:   
http://bugs.php.net/fix.php?id=52476&r=needscript
Try newer version:   
http://bugs.php.net/fix.php?id=52476&r=oldversion
Not developer issue: 
http://bugs.php.net/fix.php?id=52476&r=support
Expected behavior:   
http://bugs.php.net/fix.php?id=52476&r=notwrong
Not enough info: 
http://bugs.php.net/fix.php?id=52476&r=notenoughinfo
Submitted twice: 
http://bugs.php.net/fix.php?id=52476&r=submittedtwice
register_globals:
http://bugs.php.net/fix.php?id=52476&r=globals
PHP 4 support discontinued:  http://bugs.php.net/fix.php?id=52476&r=php4
Daylight Savings:http://bugs.php.net/fix.php?id=52476&r=dst
IIS Stability:   
http://bugs.php.net/fix.php?id=52476&r=isapi
Install GNU Sed: 
http://bugs.php.net/fix.php?id=52476&r=gnused
Floating point limitations:  
http://bugs.php.net/fix.php?id=52476&r=float
No Zend Extensions:  
http://bugs.php.net/fix.php?id=52476&r=nozend
MySQL Configuration Error:   
http://bugs.php.net/fix.php?id=52476&r=mysqlcfg



Bug #50987 [Com]: unaligned memory access in phar.c

2010-03-05 Thread geiss...@php.net
Edit report at http://bugs.php.net/bug.php?id=50987&edit=1

 ID:   50987
 Comment by:   geiss...@php.net
 Reported by:  geissert at debian dot org
 Summary:  unaligned memory access in phar.c
 Status:   Open
 Type: Bug
 Package:  PHAR related
 Operating System: linux ia64
 PHP Version:  5.3.1

 New Comment:

Any reason for not applying the patch? cheers


Previous Comments:

[2010-02-10 20:32:10] geissert at debian dot org

The phar one was found while building the extension itself (the call to
php in ext/phar/Makefile.frag to generate phar.php.)



There are probably more, but still have to process them. In the
meanwhile, here's another (found while unpacking pear):



@@ -512,7 +512,7 @@ void phar_entry_remove(phar_entry_data *

(buffer) += 2

 #else

 # define PHAR_GET_32(buffer, var) \

-   var = *(php_uint32*)(buffer); \

+   memcpy(&var, buffer, sizeof(var)); \

buffer += 4

 # define PHAR_GET_16(buffer, var) \

var = *(php_uint16*)(buffer); \



As for CFLAGS: -O2 -Wall -fsigned-char -fno-strict-aliasing -g
-D_FORTIFY_SOURCE=2 -Wformat -Wformat-security



Should be easy for you to find them by running the test suite under
prctl --unaligned=signal (all the phar tests will fail.) That's how I
found them all (I can provide the name of the tests that failed in a
moment, I'm rebuilding with the patches I already provided.)


[2010-02-10 20:05:21] paj...@php.net

hi,



Can you provide test cases for these crashes please? As well as your
settings (CFLAGS&co) as I can't see crashes on IA64 here (or other 64bit
platforms). Same applies for your other reports :)



Thanks for your feedback!


[2010-02-10 07:27:23] geissert at debian dot org

Description:

There's an unaligned memory access in ext/phar/phar.c's phar_set_32
function.



The following patch fixes it:



--- php.orig/ext/phar/phar.c

+++ php/ext/phar/phar.c

@@ -2491,7 +2491,7 @@ static inline void phar_set_32(char *buf

*((buffer) + 1) = (unsigned char) (((var) >> 8) & 0xFF);

*((buffer) + 0) = (unsigned char) ((var) & 0xFF);

 #else

-   *(php_uint32 *)(buffer) = (php_uint32)(var);

+   memcpy(buffer, &var, sizeof(var));

 #endif

 } /* }}} */









-- 
Edit this bug report at http://bugs.php.net/bug.php?id=50987&edit=1


[PHP-BUG] Bug #51288 [NEW]: null pointer deref when is not set

2010-03-12 Thread geiss...@php.net
From: geissert
Operating system: *
PHP version:  Irrelevant
Package:  XMLRPC-EPI related
Bug Type: Bug
Bug description:null pointer deref when  is not set

Description:

This is CVE-2010-0397, originally reported by Auke van Slooten at
http://bugs.debian.org/573573



When processing an invalid (one without a , required by the
specs) XML-RPC request, the extension doesn't check for the NULL value
returned by the xmlrpc library. This NULL is then passed to estrdup which
dereferences the pointer, leading to a segmentation fault. This can easily
be used to perform DoS attacks by crashing the server.



I've already notified secur...@php.net, but since the issue is public
there's no point in hiding it or the patch. The attached patch fixes the
problem, which can also be found at:



http://git.debian.org/?p=pkg-php/php.git;a=blob;f=debian/patches/CVE-2010-0397.patch;h=186b2166644c066f28f1ffb9195ffa9f5744a604;hb=HEAD



Test script:
---
';

var_dump(xmlrpc_decode_request($req, $method));

var_dump($method);

echo "Done\n";

?>

Expected result:

NULL

NULL

Done

Actual result:
--
Segmentation fault

-- 
Edit bug report at http://bugs.php.net/bug.php?id=51288&edit=1
-- 
Try a snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=51288&r=trysnapshot52
Try a snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=51288&r=trysnapshot53
Try a snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=51288&r=trysnapshot60
Fixed in SVN:
http://bugs.php.net/fix.php?id=51288&r=fixed
Fixed in SVN and need be documented: 
http://bugs.php.net/fix.php?id=51288&r=needdocs
Fixed in release:
http://bugs.php.net/fix.php?id=51288&r=alreadyfixed
Need backtrace:  
http://bugs.php.net/fix.php?id=51288&r=needtrace
Need Reproduce Script:   
http://bugs.php.net/fix.php?id=51288&r=needscript
Try newer version:   
http://bugs.php.net/fix.php?id=51288&r=oldversion
Not developer issue: 
http://bugs.php.net/fix.php?id=51288&r=support
Expected behavior:   
http://bugs.php.net/fix.php?id=51288&r=notwrong
Not enough info: 
http://bugs.php.net/fix.php?id=51288&r=notenoughinfo
Submitted twice: 
http://bugs.php.net/fix.php?id=51288&r=submittedtwice
register_globals:
http://bugs.php.net/fix.php?id=51288&r=globals
PHP 4 support discontinued:  http://bugs.php.net/fix.php?id=51288&r=php4
Daylight Savings:http://bugs.php.net/fix.php?id=51288&r=dst
IIS Stability:   
http://bugs.php.net/fix.php?id=51288&r=isapi
Install GNU Sed: 
http://bugs.php.net/fix.php?id=51288&r=gnused
Floating point limitations:  
http://bugs.php.net/fix.php?id=51288&r=float
No Zend Extensions:  
http://bugs.php.net/fix.php?id=51288&r=nozend
MySQL Configuration Error:   
http://bugs.php.net/fix.php?id=51288&r=mysqlcfg



Bug #51288 [PATCH]: null pointer deref when is not set

2010-03-12 Thread geiss...@php.net
Edit report at http://bugs.php.net/bug.php?id=51288&edit=1

 ID:   51288
 Patch added by:   geiss...@php.net
 Reported by:  geiss...@php.net
 Summary:  null pointer deref when  is not set
 Status:   Open
 Type: Bug
 Package:  XMLRPC-EPI related
 Operating System: *
 PHP Version:  Irrelevant

 New Comment:

The following patch has been added/updated:

Patch Name: CVE-2009-3765
Revision:   1268446854
URL:   
http://bugs.php.net/patch-display.php?bug=51288&patch=CVE-2009-3765&revision=1268446854


Previous Comments:

[2010-03-13 03:20:02] geiss...@php.net

Description:

This is CVE-2010-0397, originally reported by Auke van Slooten at
http://bugs.debian.org/573573



When processing an invalid (one without a , required by the
specs) XML-RPC request, the extension doesn't check for the NULL value
returned by the xmlrpc library. This NULL is then passed to estrdup
which dereferences the pointer, leading to a segmentation fault. This
can easily be used to perform DoS attacks by crashing the server.



I've already notified secur...@php.net, but since the issue is public
there's no point in hiding it or the patch. The attached patch fixes the
problem, which can also be found at:



http://git.debian.org/?p=pkg-php/php.git;a=blob;f=debian/patches/CVE-2010-0397.patch;h=186b2166644c066f28f1ffb9195ffa9f5744a604;hb=HEAD



Test script:
---
';

var_dump(xmlrpc_decode_request($req, $method));

var_dump($method);

echo "Done\n";

?>

Expected result:

NULL

NULL

Done

Actual result:
--
Segmentation fault






-- 
Edit this bug report at http://bugs.php.net/bug.php?id=51288&edit=1


[PHP-BUG] Bug #51289 [NEW]: unaligned memory access in enchant.c

2010-03-12 Thread geiss...@php.net
From: geissert
Operating system: linux ia64
PHP version:  5.3.2
Package:  *Spelling functions
Bug Type: Bug
Bug description:unaligned memory access in enchant.c

Description:

ext/enchant/tests/bug13181.php triggers an unaligned memory access in
enchant.c's enchant_dict_suggest().



enchant_dict_quick_check() is also affected, so adding a test case (the one
from the documentation but simply count()ing the returned array for >0, for
example) is a good idea.



Attached patch fixes the first case.



Expected result:

resource(5) of type (enchant_dict)

resource(5) of type (enchant_dict)

resource(6) of type (enchant_broker)

resource(6) of type (enchant_broker)

resource(7) of type (enchant_dict)

resource(7) of type (enchant_dict)

Actual result:
--
resource(5) of type (enchant_dict)

resource(5) of type (enchant_dict)

Bus error

-- 
Edit bug report at http://bugs.php.net/bug.php?id=51289&edit=1
-- 
Try a snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=51289&r=trysnapshot52
Try a snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=51289&r=trysnapshot53
Try a snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=51289&r=trysnapshot60
Fixed in SVN:
http://bugs.php.net/fix.php?id=51289&r=fixed
Fixed in SVN and need be documented: 
http://bugs.php.net/fix.php?id=51289&r=needdocs
Fixed in release:
http://bugs.php.net/fix.php?id=51289&r=alreadyfixed
Need backtrace:  
http://bugs.php.net/fix.php?id=51289&r=needtrace
Need Reproduce Script:   
http://bugs.php.net/fix.php?id=51289&r=needscript
Try newer version:   
http://bugs.php.net/fix.php?id=51289&r=oldversion
Not developer issue: 
http://bugs.php.net/fix.php?id=51289&r=support
Expected behavior:   
http://bugs.php.net/fix.php?id=51289&r=notwrong
Not enough info: 
http://bugs.php.net/fix.php?id=51289&r=notenoughinfo
Submitted twice: 
http://bugs.php.net/fix.php?id=51289&r=submittedtwice
register_globals:
http://bugs.php.net/fix.php?id=51289&r=globals
PHP 4 support discontinued:  http://bugs.php.net/fix.php?id=51289&r=php4
Daylight Savings:http://bugs.php.net/fix.php?id=51289&r=dst
IIS Stability:   
http://bugs.php.net/fix.php?id=51289&r=isapi
Install GNU Sed: 
http://bugs.php.net/fix.php?id=51289&r=gnused
Floating point limitations:  
http://bugs.php.net/fix.php?id=51289&r=float
No Zend Extensions:  
http://bugs.php.net/fix.php?id=51289&r=nozend
MySQL Configuration Error:   
http://bugs.php.net/fix.php?id=51289&r=mysqlcfg



Bug #51289 [PATCH]: unaligned memory access in enchant.c

2010-03-12 Thread geiss...@php.net
Edit report at http://bugs.php.net/bug.php?id=51289&edit=1

 ID:   51289
 Patch added by:   geiss...@php.net
 Reported by:  geiss...@php.net
 Summary:  unaligned memory access in enchant.c
 Status:   Open
 Type: Bug
 Package:  *Spelling functions
 Operating System: linux ia64
 PHP Version:  5.3.2

 New Comment:

The following patch has been added/updated:

Patch Name: enchant_unaligned_memory_access.patch
Revision:   1268451320
URL:   
http://bugs.php.net/patch-display.php?bug=51289&patch=enchant_unaligned_memory_access.patch&revision=1268451320


Previous Comments:

[2010-03-13 04:26:14] geiss...@php.net

Description:

ext/enchant/tests/bug13181.php triggers an unaligned memory access in
enchant.c's enchant_dict_suggest().



enchant_dict_quick_check() is also affected, so adding a test case (the
one from the documentation but simply count()ing the returned array for
>0, for example) is a good idea.



Attached patch fixes the first case.



Expected result:

resource(5) of type (enchant_dict)

resource(5) of type (enchant_dict)

resource(6) of type (enchant_broker)

resource(6) of type (enchant_broker)

resource(7) of type (enchant_dict)

resource(7) of type (enchant_dict)

Actual result:
--
resource(5) of type (enchant_dict)

resource(5) of type (enchant_dict)

Bus error






-- 
Edit this bug report at http://bugs.php.net/bug.php?id=51289&edit=1


Bug #52102 [Com]: PHP5 under Apache2 on 64 bit system is not completely 64 bit

2011-03-18 Thread geiss...@php.net
Edit report at http://bugs.php.net/bug.php?id=52102&edit=1

 ID: 52102
 Comment by: geiss...@php.net
 Reported by:peter at ubuntu dot com
 Summary:PHP5 under Apache2 on 64 bit system is not
 completely 64 bit
 Status: Duplicate
 Type:   Bug
 Package:Apache related
 Operating System:   Ubuntu 10.04
 PHP Version:5.3.2
 Block user comment: N
 Private report: N

 New Comment:

Adam, this bug report is related to sending files to the client and
doesn't seem 

to be related to variable types. I don't think this is a dup of #44522.

The interesting stuff can be found at 

https://bugs.launchpad.net/ubuntu/+source/php5/+bug/564920 (message #18
and 

followups)


Previous Comments:

[2010-06-17 04:44:11] ahar...@php.net

Dupe of bug #44522.


[2010-06-16 19:39:56] peter at ubuntu dot com

Description:

Something in PHP5 running under apache2 under Ubuntu 9.10 is not fully
64 bit 

aware on a 64 bit system. PHP scripts run under Apache correctly under
Ubuntu 

8.04 (PHP 5.2.4). Under Ubuntu 9.10 (PHP 5.2.10) and 10.04 (PHP 5.3.2),
some 

place a value is being treated as 32 bits on a 64 bit system and is
wrapping 

instead of using full 64 bits. Related to sending large data (> 4G) in
response 

to an HTTP post request.



Did not test with Ubuntu 8.10 or 9.04 - both PHP 5.2.6.



What happens: Data aborts based on wrap. Calculated number of bytes to
be served 

are correct (>4G) as listed in the HTTP length header. Actual bytes
served are 

(size) && 0x instead of (size) && 0x on 64 bit
system.



Most of data is being transfered via fpassthru($openFileHandle) call,
providing 

>4G bytes of data.

Test script:
---
http://cdimage.debian.org/debian-cd/5.0.4/amd64/iso-dvd/debian-504-amd64-DVD-1.iso


$name = "/var/www/test.txt";

$fs = filesize($name);

$fp = fopen($name,'rb');

$httpByteLen = $fs;

header("Connection: close");

header("Content-Type: application/octet-stream");

header("Content-Length: " . $httpByteLen);

header("HTTP/1.1 200 OK");

set_time_limit(0);

fpassthru($fp);

exit;

?>

Expected result:

The entire ISO file to be downloaded.

Actual result:
--
Tested using the test script (attached), and using the suggested debian
dvd .iso 

image as the input file.  The ISO is 4,697,126,912 bytes. Download
socket is 

closed after 402,159,616 bytes, which again is the file size &
0x.






-- 
Edit this bug report at http://bugs.php.net/bug.php?id=52102&edit=1


[PHP-BUG] Bug #63352 [NEW]: Can't enable hostname validation when using curl stream wrappers

2012-10-24 Thread geiss...@php.net
From: geissert
Operating system: 
PHP version:  5.4.8
Package:  cURL related
Bug Type: Bug
Bug description:Can't enable hostname validation when using curl stream wrappers

Description:

When PHP is built with --with-curlwrappers, the context option 
"curl_verify_ssl_host" sets curl's CURLOPT_SSL_VERIFYHOST option to 1, but
there 
is no way to set it to 2.

Given that the option is a boolean, it should probably be setting the
VERIFYHOST 
value to 2. There is no way to validate that the certificate belongs to the
host 
otherwise.

This applies to the ftps and https stream wrappers.


-- 
Edit bug report at https://bugs.php.net/bug.php?id=63352&edit=1
-- 
Try a snapshot (PHP 5.4):   
https://bugs.php.net/fix.php?id=63352&r=trysnapshot54
Try a snapshot (PHP 5.3):   
https://bugs.php.net/fix.php?id=63352&r=trysnapshot53
Try a snapshot (trunk): 
https://bugs.php.net/fix.php?id=63352&r=trysnapshottrunk
Fixed in SVN:   https://bugs.php.net/fix.php?id=63352&r=fixed
Fixed in release:   https://bugs.php.net/fix.php?id=63352&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=63352&r=needtrace
Need Reproduce Script:  https://bugs.php.net/fix.php?id=63352&r=needscript
Try newer version:  https://bugs.php.net/fix.php?id=63352&r=oldversion
Not developer issue:https://bugs.php.net/fix.php?id=63352&r=support
Expected behavior:  https://bugs.php.net/fix.php?id=63352&r=notwrong
Not enough info:
https://bugs.php.net/fix.php?id=63352&r=notenoughinfo
Submitted twice:
https://bugs.php.net/fix.php?id=63352&r=submittedtwice
register_globals:   https://bugs.php.net/fix.php?id=63352&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=63352&r=php4
Daylight Savings:   https://bugs.php.net/fix.php?id=63352&r=dst
IIS Stability:  https://bugs.php.net/fix.php?id=63352&r=isapi
Install GNU Sed:https://bugs.php.net/fix.php?id=63352&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=63352&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=63352&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=63352&r=mysqlcfg



Bug #63352 [Com]: Can't enable hostname validation when using curl stream wrappers

2012-10-24 Thread geiss...@php.net
Edit report at https://bugs.php.net/bug.php?id=63352&edit=1

 ID: 63352
 Comment by: geiss...@php.net
 Reported by:geiss...@php.net
 Summary:Can't enable hostname validation when using curl
 stream wrappers
 Status: Open
 Type:   Bug
 Package:cURL related
 PHP Version:5.4.8
 Block user comment: N
 Private report: N

 New Comment:

Of course this is a minor issue as the certificates store can't even be set, so 
this is just for the record.


Previous Comments:

[2012-10-25 00:54:16] geiss...@php.net

Description:

When PHP is built with --with-curlwrappers, the context option 
"curl_verify_ssl_host" sets curl's CURLOPT_SSL_VERIFYHOST option to 1, but 
there 
is no way to set it to 2.

Given that the option is a boolean, it should probably be setting the 
VERIFYHOST 
value to 2. There is no way to validate that the certificate belongs to the 
host 
otherwise.

This applies to the ftps and https stream wrappers.







-- 
Edit this bug report at https://bugs.php.net/bug.php?id=63352&edit=1