X-Git-Url: https://git.tld-linux.org/?p=packages%2Fphp.git;a=blobdiff_plain;f=suhosin.patch;h=378a4e45e429458180c8b8927b02ea7bc2618c78;hp=2a22f75a6497fd68f5081b14e976468053d188f0;hb=712278527b67351baf8b4b873b489c19d491b6ab;hpb=aef9a98d7828aeb48703ab2429a6968173d1addf diff --git a/suhosin.patch b/suhosin.patch index 2a22f75..378a4e4 100644 --- a/suhosin.patch +++ b/suhosin.patch @@ -1,19 +1,30 @@ -diff -Nura php-5.3.9/Zend/Makefile.am suhosin-patch-5.3.9-0.9.10/Zend/Makefile.am ---- php-5.3.9/Zend/Makefile.am 2009-03-18 11:18:10.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/Makefile.am 2012-01-11 19:29:07.000000000 +0100 -@@ -17,7 +17,7 @@ - zend_objects_API.c zend_ts_hash.c zend_stream.c \ +suhosin hardening patch + +this patch was downloaded from: + + http://download.suhosin.org/suhosin-patch-5.3.4-0.9.10.patch.gz + +the following modifications have been made: + + * removed changes to ./configure & ./main/php_config.h.in since those + files are autogenerated + * "quilt refresh" has been run to clean up the offsets, etc + * logo patch disabled (needs porting to DATA_URIs) + * expose php disabled (unref symbols) +--- php-5.5.0alpha1/Zend/Makefile.am~ 2012-11-13 22:00:16.000000000 +0200 ++++ php-5.5.0alpha1/Zend/Makefile.am 2012-11-17 13:37:04.263279745 +0200 +@@ -18,7 +18,7 @@ zend_default_classes.c \ zend_iterators.c zend_interfaces.c zend_exceptions.c \ -- zend_strtod.c zend_closures.c zend_float.c -+ zend_strtod.c zend_closures.c zend_float.c zend_canary.c zend_alloc_canary.c + zend_strtod.c zend_closures.c zend_float.c zend_string.c zend_signal.c \ +- zend_generators.c ++ zend_generators.c zend_canary.c zend_alloc_canary.c libZend_la_LDFLAGS = libZend_la_LIBADD = @ZEND_EXTRA_LIBS@ -diff -Nura php-5.3.9/Zend/Zend.dsp suhosin-patch-5.3.9-0.9.10/Zend/Zend.dsp ---- php-5.3.9/Zend/Zend.dsp 2009-03-18 11:18:10.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/Zend.dsp 2012-01-11 19:29:07.000000000 +0100 -@@ -247,6 +247,14 @@ +--- a/Zend/Zend.dsp ++++ b/Zend/Zend.dsp +@@ -251,6 +251,14 @@ SOURCE=.\zend_strtod.c # End Source File # Begin Source File @@ -28,10 +39,9 @@ diff -Nura php-5.3.9/Zend/Zend.dsp suhosin-patch-5.3.9-0.9.10/Zend/Zend.dsp SOURCE=.\zend_ts_hash.c # End Source File # Begin Source File -diff -Nura php-5.3.9/Zend/ZendTS.dsp suhosin-patch-5.3.9-0.9.10/Zend/ZendTS.dsp ---- php-5.3.9/Zend/ZendTS.dsp 2008-07-14 11:49:03.000000000 +0200 -+++ suhosin-patch-5.3.9-0.9.10/Zend/ZendTS.dsp 2012-01-11 19:29:07.000000000 +0100 -@@ -277,6 +277,14 @@ +--- a/Zend/ZendTS.dsp ++++ b/Zend/ZendTS.dsp +@@ -281,6 +281,14 @@ SOURCE=.\zend_strtod.c # End Source File # Begin Source File @@ -46,10 +56,9 @@ diff -Nura php-5.3.9/Zend/ZendTS.dsp suhosin-patch-5.3.9-0.9.10/Zend/ZendTS.dsp SOURCE=.\zend_ts_hash.c # End Source File # Begin Source File -diff -Nura php-5.3.9/Zend/zend.c suhosin-patch-5.3.9-0.9.10/Zend/zend.c ---- php-5.3.9/Zend/zend.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/zend.c 2012-01-11 19:29:07.000000000 +0100 -@@ -60,6 +60,10 @@ +--- a/Zend/zend.c ++++ b/Zend/zend.c +@@ -61,6 +61,10 @@ int (*zend_vspprintf)(char **pbuf, size_ ZEND_API char *(*zend_getenv)(char *name, size_t name_len TSRMLS_DC); ZEND_API char *(*zend_resolve_path)(const char *filename, int filename_len TSRMLS_DC); @@ -59,11 +68,11 @@ diff -Nura php-5.3.9/Zend/zend.c suhosin-patch-5.3.9-0.9.10/Zend/zend.c + void (*zend_on_timeout)(int seconds TSRMLS_DC); - static void (*zend_message_dispatcher_p)(long message, void *data TSRMLS_DC); -@@ -88,6 +92,74 @@ - } + static void (*zend_message_dispatcher_p)(long message, const void *data TSRMLS_DC); +@@ -102,6 +106,74 @@ static ZEND_INI_MH(OnUpdateScriptEncodin /* }}} */ + +#if SUHOSIN_PATCH +static ZEND_INI_MH(OnUpdateSuhosin_log_syslog) +{ @@ -135,10 +144,9 @@ diff -Nura php-5.3.9/Zend/zend.c suhosin-patch-5.3.9-0.9.10/Zend/zend.c ZEND_INI_BEGIN() ZEND_INI_ENTRY("error_reporting", NULL, ZEND_INI_ALL, OnUpdateErrorReporting) STD_ZEND_INI_BOOLEAN("zend.enable_gc", "1", ZEND_INI_ALL, OnUpdateGCEnabled, gc_enabled, zend_gc_globals, gc_globals) -diff -Nura php-5.3.9/Zend/zend.h suhosin-patch-5.3.9-0.9.10/Zend/zend.h ---- php-5.3.9/Zend/zend.h 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/zend.h 2012-01-11 19:29:07.000000000 +0100 -@@ -627,6 +627,9 @@ +--- a/Zend/zend.h ++++ b/Zend/zend.h +@@ -688,6 +688,9 @@ extern ZEND_API int (*zend_stream_open_f extern int (*zend_vspprintf)(char **pbuf, size_t max_len, const char *format, va_list ap); extern ZEND_API char *(*zend_getenv)(char *name, size_t name_len TSRMLS_DC); extern ZEND_API char *(*zend_resolve_path)(const char *filename, int filename_len TSRMLS_DC); @@ -148,7 +156,7 @@ diff -Nura php-5.3.9/Zend/zend.h suhosin-patch-5.3.9-0.9.10/Zend/zend.h ZEND_API void zend_error(int type, const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 2, 3); -@@ -774,6 +777,16 @@ +@@ -849,6 +852,16 @@ ZEND_API void zend_restore_error_handlin #define DEBUG_BACKTRACE_PROVIDE_OBJECT (1<<0) #define DEBUG_BACKTRACE_IGNORE_ARGS (1<<1) @@ -165,9 +173,8 @@ diff -Nura php-5.3.9/Zend/zend.h suhosin-patch-5.3.9-0.9.10/Zend/zend.h #endif /* ZEND_H */ /* -diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_alloc.c ---- php-5.3.9/Zend/zend_alloc.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/zend_alloc.c 2012-01-11 19:29:07.000000000 +0100 +--- a/Zend/zend_alloc.c ++++ b/Zend/zend_alloc.c @@ -32,6 +32,10 @@ # include #endif @@ -187,7 +194,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo #if ZEND_DEBUG void zend_debug_alloc_output(char *format, ...) { -@@ -76,6 +81,7 @@ +@@ -76,6 +81,7 @@ void zend_debug_alloc_output(char *forma #endif } #endif @@ -195,7 +202,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo #if (defined (__GNUC__) && __GNUC__ > 2 ) && !defined(__INTEL_COMPILER) && !defined(DARWIN) && !defined(__hpux) && !defined(_AIX) static void zend_mm_panic(const char *message) __attribute__ ((noreturn)); -@@ -134,6 +140,8 @@ +@@ -134,6 +140,8 @@ static void zend_mm_panic(const char *me # endif #endif @@ -204,7 +211,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo static zend_mm_storage* zend_mm_mem_dummy_init(void *params) { return malloc(sizeof(zend_mm_storage)); -@@ -332,13 +340,28 @@ +@@ -332,13 +340,28 @@ static const zend_mm_mem_handlers mem_ha #define MEM_BLOCK_GUARD 0x2A8FCC84 #define MEM_BLOCK_LEAK 0x6C5E8F2D @@ -235,7 +242,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo } zend_mm_block_info; #if ZEND_DEBUG -@@ -412,7 +435,7 @@ +@@ -412,7 +435,7 @@ typedef struct _zend_mm_free_block { # define ZEND_MM_CACHE_STAT 0 #endif @@ -244,7 +251,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo int use_zend_alloc; void *(*_malloc)(size_t); void (*_free)(void*); -@@ -447,6 +470,9 @@ +@@ -448,6 +471,9 @@ struct _zend_mm_heap { int miss; } cache_stat[ZEND_MM_NUM_BUCKETS+1]; #endif @@ -254,7 +261,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo }; #define ZEND_MM_SMALL_FREE_BUCKET(heap, index) \ -@@ -520,18 +546,31 @@ +@@ -525,18 +551,31 @@ static unsigned int _zend_mm_cookie = 0; /* optimized access */ #define ZEND_MM_FREE_BLOCK_SIZE(b) (b)->info._size @@ -289,7 +296,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo #define ZEND_MM_BUCKET_INDEX(true_size) ((true_size>>ZEND_MM_ALIGNMENT_LOG2)-(ZEND_MM_ALIGNED_MIN_HEADER_SIZE>>ZEND_MM_ALIGNMENT_LOG2)) -@@ -593,6 +632,44 @@ +@@ -598,6 +637,44 @@ static unsigned int _zend_mm_cookie = 0; #endif @@ -334,37 +341,16 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo #if ZEND_MM_HEAP_PROTECTION -@@ -715,7 +792,7 @@ +@@ -720,7 +797,7 @@ static inline unsigned int zend_mm_low_b #endif } --static inline void zend_mm_add_to_rest_list(zend_mm_heap *heap, zend_mm_free_block *mm_block) -+static void zend_mm_add_to_rest_list(zend_mm_heap *heap, zend_mm_free_block *mm_block) - { - zend_mm_free_block *prev, *next; - -@@ -725,14 +802,14 @@ - mm_block->parent = NULL; - } - -- prev = heap->rest_buckets[0]; -- next = prev->next_free_block; -- mm_block->prev_free_block = prev; -- mm_block->next_free_block = next; -- prev->next_free_block = next->prev_free_block = mm_block; -+ prev = SUHOSIN_MANGLE_PTR(heap->rest_buckets[0]); -+ next = SUHOSIN_MANGLE_PTR(prev->next_free_block); -+ mm_block->prev_free_block = SUHOSIN_MANGLE_PTR(prev); -+ mm_block->next_free_block = SUHOSIN_MANGLE_PTR(next); -+ prev->next_free_block = next->prev_free_block = SUHOSIN_MANGLE_PTR(mm_block); - } - -static inline void zend_mm_add_to_free_list(zend_mm_heap *heap, zend_mm_free_block *mm_block) +static void zend_mm_add_to_free_list(zend_mm_heap *heap, zend_mm_free_block *mm_block) { size_t size; size_t index; -@@ -749,7 +826,7 @@ +@@ -737,7 +814,7 @@ static inline void zend_mm_add_to_free_l if (!*p) { *p = mm_block; mm_block->parent = p; @@ -373,7 +359,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo heap->large_free_bitmap |= (ZEND_MM_LONG_CONST(1) << index); } else { size_t m; -@@ -762,15 +839,15 @@ +@@ -750,15 +827,15 @@ static inline void zend_mm_add_to_free_l if (!*p) { *p = mm_block; mm_block->parent = p; @@ -394,7 +380,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo mm_block->parent = NULL; break; } -@@ -782,27 +859,33 @@ +@@ -770,14 +847,14 @@ static inline void zend_mm_add_to_free_l index = ZEND_MM_BUCKET_INDEX(size); prev = ZEND_MM_SMALL_FREE_BUCKET(heap, index); @@ -414,38 +400,29 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo } } --static inline void zend_mm_remove_from_free_list(zend_mm_heap *heap, zend_mm_free_block *mm_block) -+static void zend_mm_remove_from_free_list(zend_mm_heap *heap, zend_mm_free_block *mm_block) - { -- zend_mm_free_block *prev = mm_block->prev_free_block; -- zend_mm_free_block *next = mm_block->next_free_block; -+ zend_mm_free_block *prev = SUHOSIN_MANGLE_PTR(mm_block->prev_free_block); -+ zend_mm_free_block *next = SUHOSIN_MANGLE_PTR(mm_block->next_free_block); - - ZEND_MM_CHECK_MAGIC(mm_block, MEM_BLOCK_FREED); - +@@ -791,6 +868,12 @@ static inline void zend_mm_remove_from_f if (EXPECTED(prev == mm_block)) { zend_mm_free_block **rp, **cp; +#if SUHOSIN_PATCH -+ if (next != mm_block) { -+ zend_suhosin_log(S_MEMORY, "zend_mm_heap corrupted at %p", mm_block); -+ _exit(1); -+ } ++ if (next != mm_block) { ++ zend_suhosin_log(S_MEMORY, "zend_mm_heap corrupted at %p", mm_block); ++ _exit(1); ++ } +#endif #if ZEND_MM_SAFE_UNLINKING if (UNEXPECTED(next != mm_block)) { zend_mm_panic("zend_mm_heap corrupted"); -@@ -841,14 +924,21 @@ +@@ -829,14 +912,21 @@ subst_block: } } else { +#if SUHOSIN_PATCH -+ if (SUHOSIN_MANGLE_PTR(prev->next_free_block) != mm_block || SUHOSIN_MANGLE_PTR(next->prev_free_block) != mm_block) { -+ zend_suhosin_log(S_MEMORY, "zend_mm_head corrupted at %p", mm_block); -+ _exit(1); -+ } -+#endif ++ if (SUHOSIN_MANGLE_PTR(prev->next_free_block) != mm_block || SUHOSIN_MANGLE_PTR(next->prev_free_block) != mm_block) { ++ zend_suhosin_log(S_MEMORY, "zend_mm_head corrupted at %p", mm_block); ++ _exit(1); ++ } ++#endif + #if ZEND_MM_SAFE_UNLINKING - if (UNEXPECTED(prev->next_free_block != mm_block) || UNEXPECTED(next->prev_free_block != mm_block)) { @@ -461,16 +438,37 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo if (EXPECTED(ZEND_MM_SMALL_SIZE(ZEND_MM_FREE_BLOCK_SIZE(mm_block)))) { if (EXPECTED(prev == next)) { -@@ -864,7 +954,7 @@ +@@ -854,7 +944,7 @@ subst_block: } } +-static inline void zend_mm_add_to_rest_list(zend_mm_heap *heap, zend_mm_free_block *mm_block) ++static void zend_mm_add_to_rest_list(zend_mm_heap *heap, zend_mm_free_block *mm_block) + { + zend_mm_free_block *prev, *next; + +@@ -878,14 +968,14 @@ static inline void zend_mm_add_to_rest_l + + ZEND_MM_SET_MAGIC(mm_block, MEM_BLOCK_FREED); + +- prev = heap->rest_buckets[0]; +- next = prev->next_free_block; +- mm_block->prev_free_block = prev; +- mm_block->next_free_block = next; +- prev->next_free_block = next->prev_free_block = mm_block; ++ prev = SUHOSIN_MANGLE_PTR(heap->rest_buckets[0]); ++ next = SUHOSIN_MANGLE_PTR(prev->next_free_block); ++ mm_block->prev_free_block = SUHOSIN_MANGLE_PTR(prev); ++ mm_block->next_free_block = SUHOSIN_MANGLE_PTR(next); ++ prev->next_free_block = next->prev_free_block = SUHOSIN_MANGLE_PTR(mm_block); + } + -static inline void zend_mm_init(zend_mm_heap *heap) +static void zend_mm_init(zend_mm_heap *heap) { zend_mm_free_block* p; int i; -@@ -882,12 +972,19 @@ +@@ -903,13 +993,21 @@ static inline void zend_mm_init(zend_mm_ #endif p = ZEND_MM_SMALL_FREE_BUCKET(heap, 0); for (i = 0; i < ZEND_MM_NUM_BUCKETS; i++) { @@ -483,17 +481,19 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo } - heap->rest_buckets[0] = heap->rest_buckets[1] = ZEND_MM_REST_BUCKET(heap); + heap->rest_buckets[0] = heap->rest_buckets[1] = SUHOSIN_MANGLE_PTR(ZEND_MM_REST_BUCKET(heap)); + heap->rest_count = 0; ++ +#if SUHOSIN_PATCH -+ if (SUHOSIN_CONFIG(SUHOSIN_MM_USE_CANARY_PROTECTION)) { -+ zend_canary(&heap->canary_1, sizeof(heap->canary_1)); -+ zend_canary(&heap->canary_2, sizeof(heap->canary_2)); -+ zend_canary(&heap->canary_3, sizeof(heap->canary_3)); ++ if (SUHOSIN_CONFIG(SUHOSIN_MM_USE_CANARY_PROTECTION)) { ++ zend_canary(&heap->canary_1, sizeof(heap->canary_1)); ++ zend_canary(&heap->canary_2, sizeof(heap->canary_2)); ++ zend_canary(&heap->canary_3, sizeof(heap->canary_3)); + } +#endif } static void zend_mm_del_segment(zend_mm_heap *heap, zend_mm_segment *segment) -@@ -908,12 +1005,13 @@ +@@ -930,12 +1028,13 @@ static void zend_mm_free_cache(zend_mm_h int i; for (i = 0; i < ZEND_MM_NUM_BUCKETS; i++) { @@ -509,7 +509,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo zend_mm_block *next_block = ZEND_MM_NEXT_BLOCK(mm_block); heap->cached -= size; -@@ -1009,14 +1107,20 @@ +@@ -1031,14 +1130,20 @@ static void zend_mm_random(unsigned char /* }}} */ #endif @@ -531,7 +531,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo #if 0 int i; -@@ -1050,6 +1154,12 @@ +@@ -1072,6 +1177,12 @@ ZEND_API zend_mm_heap *zend_mm_startup_e } #endif @@ -544,15 +544,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo if (zend_mm_low_bit(block_size) != zend_mm_high_bit(block_size)) { fprintf(stderr, "'block_size' must be a power of two\n"); /* See http://support.microsoft.com/kb/190351 */ -@@ -1077,6 +1187,7 @@ - #endif - exit(255); - } -+ - heap->storage = storage; - heap->block_size = block_size; - heap->compact_size = 0; -@@ -1097,12 +1208,12 @@ +@@ -1119,12 +1230,12 @@ ZEND_API zend_mm_heap *zend_mm_startup_e heap->reserve = NULL; heap->reserve_size = reserve_size; if (reserve_size > 0) { @@ -567,7 +559,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo *mm_heap = *heap; -@@ -1110,22 +1221,22 @@ +@@ -1132,22 +1243,22 @@ ZEND_API zend_mm_heap *zend_mm_startup_e orig = ZEND_MM_SMALL_FREE_BUCKET(heap, 0); for (i = 0; i < ZEND_MM_NUM_BUCKETS; i++) { q = p; @@ -594,10 +586,10 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo } - mm_heap->rest_buckets[0] = mm_heap->rest_buckets[1] = ZEND_MM_REST_BUCKET(mm_heap); + mm_heap->rest_buckets[0] = mm_heap->rest_buckets[1] = SUHOSIN_MANGLE_PTR(ZEND_MM_REST_BUCKET(mm_heap)); + mm_heap->rest_count = 0; free(heap); - heap = mm_heap; -@@ -1133,7 +1244,11 @@ +@@ -1156,7 +1267,11 @@ ZEND_API zend_mm_heap *zend_mm_startup_e return heap; } @@ -610,7 +602,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo { int i; size_t seg_size; -@@ -1203,6 +1318,27 @@ +@@ -1226,6 +1341,27 @@ ZEND_API zend_mm_heap *zend_mm_startup(v return heap; } @@ -638,7 +630,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo #if ZEND_DEBUG static long zend_mm_find_leaks(zend_mm_segment *segment, zend_mm_block *b) { -@@ -1571,7 +1707,11 @@ +@@ -1594,7 +1730,11 @@ static int zend_mm_check_heap(zend_mm_he } #endif @@ -651,7 +643,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo { zend_mm_storage *storage; zend_mm_segment *segment; -@@ -1581,7 +1721,7 @@ +@@ -1611,7 +1751,7 @@ ZEND_API void zend_mm_shutdown(zend_mm_h if (heap->reserve) { #if ZEND_DEBUG if (!silent) { @@ -660,9 +652,9 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo } #endif heap->reserve = NULL; -@@ -1664,12 +1804,23 @@ - heap->size = 0; - heap->peak = 0; +@@ -1730,12 +1870,23 @@ ZEND_API void zend_mm_shutdown(zend_mm_h + zend_mm_add_to_free_list(heap, b); + } if (heap->reserve_size) { - heap->reserve = _zend_mm_alloc_int(heap, heap->reserve_size ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC); + heap->reserve = _zend_mm_alloc(heap, heap->reserve_size ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC); @@ -685,7 +677,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo static void zend_mm_safe_error(zend_mm_heap *heap, const char *format, size_t limit, -@@ -1680,7 +1831,11 @@ +@@ -1746,7 +1897,11 @@ static void zend_mm_safe_error(zend_mm_h size_t size) { if (heap->reserve) { @@ -697,7 +689,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo heap->reserve = NULL; } if (heap->overflow == 0) { -@@ -1755,7 +1910,7 @@ +@@ -1821,7 +1976,7 @@ static zend_mm_free_block *zend_mm_searc p = heap->large_free_buckets[index]; for (m = true_size << (ZEND_MM_NUM_BUCKETS - index); ; m <<= 1) { if (UNEXPECTED(ZEND_MM_FREE_BLOCK_SIZE(p) == true_size)) { @@ -706,7 +698,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo } else if (ZEND_MM_FREE_BLOCK_SIZE(p) >= true_size && ZEND_MM_FREE_BLOCK_SIZE(p) < best_size) { best_size = ZEND_MM_FREE_BLOCK_SIZE(p); -@@ -1779,7 +1934,7 @@ +@@ -1845,7 +2000,7 @@ static zend_mm_free_block *zend_mm_searc for (p = rst; p; p = p->child[p->child[0] != NULL]) { if (UNEXPECTED(ZEND_MM_FREE_BLOCK_SIZE(p) == true_size)) { @@ -715,7 +707,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo } else if (ZEND_MM_FREE_BLOCK_SIZE(p) > true_size && ZEND_MM_FREE_BLOCK_SIZE(p) < best_size) { best_size = ZEND_MM_FREE_BLOCK_SIZE(p); -@@ -1788,7 +1943,7 @@ +@@ -1854,7 +2009,7 @@ static zend_mm_free_block *zend_mm_searc } if (best_fit) { @@ -724,7 +716,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo } bitmap = bitmap >> 1; if (!bitmap) { -@@ -1804,9 +1959,12 @@ +@@ -1870,9 +2025,12 @@ static zend_mm_free_block *zend_mm_searc best_fit = p; } } @@ -738,16 +730,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo static void *_zend_mm_alloc_int(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) { zend_mm_free_block *best_fit; -@@ -1816,7 +1974,7 @@ - size_t segment_size; - zend_mm_segment *segment; - int keep_rest = 0; -- -+ - if (EXPECTED(ZEND_MM_SMALL_SIZE(true_size))) { - size_t index = ZEND_MM_BUCKET_INDEX(true_size); - size_t bitmap; -@@ -1831,9 +1989,14 @@ +@@ -1902,9 +2060,14 @@ static void *_zend_mm_alloc_int(zend_mm_ heap->cache_stat[index].count--; heap->cache_stat[index].hit++; #endif @@ -762,8 +745,8 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo +#endif ZEND_MM_CHECK_MAGIC(best_fit, MEM_BLOCK_CACHED); ZEND_MM_SET_DEBUG_INFO(best_fit, size, 1, 0); - return ZEND_MM_DATA_OF(best_fit); -@@ -1847,7 +2010,7 @@ + HANDLE_UNBLOCK_INTERRUPTIONS(); +@@ -1919,7 +2082,7 @@ static void *_zend_mm_alloc_int(zend_mm_ if (bitmap) { /* Found some "small" free block that can be used */ index += zend_mm_low_bit(bitmap); @@ -772,7 +755,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo #if ZEND_MM_CACHE_STAT heap->cache_stat[ZEND_MM_NUM_BUCKETS].hit++; #endif -@@ -1862,7 +2025,7 @@ +@@ -1934,7 +2097,7 @@ static void *_zend_mm_alloc_int(zend_mm_ best_fit = zend_mm_search_large_block(heap, true_size); if (!best_fit && heap->real_size >= heap->limit - heap->block_size) { @@ -781,7 +764,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo size_t best_size = -1; while (p != ZEND_MM_REST_BUCKET(heap)) { -@@ -1874,7 +2037,7 @@ +@@ -1946,7 +2109,7 @@ static void *_zend_mm_alloc_int(zend_mm_ best_size = ZEND_MM_FREE_BLOCK_SIZE(p); best_fit = p; } @@ -790,7 +773,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo } } -@@ -1973,13 +2136,19 @@ +@@ -2042,13 +2205,19 @@ zend_mm_finished_searching_for_block: ZEND_MM_SET_DEBUG_INFO(best_fit, size, 1, 1); @@ -811,7 +794,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo return ZEND_MM_DATA_OF(best_fit); } -@@ -1996,19 +2165,26 @@ +@@ -2069,19 +2238,26 @@ static void _zend_mm_free_int(zend_mm_he mm_block = ZEND_MM_HEADER_OF(p); size = ZEND_MM_BLOCK_SIZE(mm_block); @@ -840,7 +823,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo heap->cached += size; ZEND_MM_SET_MAGIC(mm_block, MEM_BLOCK_CACHED); #if ZEND_MM_CACHE_STAT -@@ -2044,6 +2220,9 @@ +@@ -2116,6 +2292,9 @@ static void _zend_mm_free_int(zend_mm_he HANDLE_UNBLOCK_INTERRUPTIONS(); } @@ -850,9 +833,9 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo static void *_zend_mm_realloc_int(zend_mm_heap *heap, void *p, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) { zend_mm_block *mm_block = ZEND_MM_HEADER_OF(p); -@@ -2053,11 +2232,18 @@ - void *ptr; - +@@ -2127,7 +2306,11 @@ static void *_zend_mm_realloc_int(zend_m + TSRMLS_FETCH(); + #endif if (UNEXPECTED(!p) || !ZEND_MM_VALID_PTR(p)) { +#ifdef SUHOSIN_MM_WITH_CANARY_PROTECTION + return _zend_mm_alloc_canary_int(heap, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); @@ -860,28 +843,31 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo return _zend_mm_alloc_int(heap, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); +#endif } + + HANDLE_BLOCK_INTERRUPTIONS(); +@@ -2135,6 +2318,9 @@ static void *_zend_mm_realloc_int(zend_m mm_block = ZEND_MM_HEADER_OF(p); true_size = ZEND_MM_TRUE_SIZE(size); orig_size = ZEND_MM_BLOCK_SIZE(mm_block); +#if SUHOSIN_PATCH -+ SUHOSIN_MM_CHECK_CANARIES(mm_block, "erealloc()"); ++ SUHOSIN_MM_CHECK_CANARIES(mm_block, "erealloc()"); +#endif ZEND_MM_CHECK_PROTECTION(mm_block); if (UNEXPECTED(true_size < size)) { -@@ -2089,6 +2275,11 @@ - HANDLE_UNBLOCK_INTERRUPTIONS(); +@@ -2165,6 +2351,11 @@ static void *_zend_mm_realloc_int(zend_m } ZEND_MM_SET_DEBUG_INFO(mm_block, size, 0, 0); + HANDLE_UNBLOCK_INTERRUPTIONS(); +#if SUHOSIN_PATCH -+ SUHOSIN_MM_SET_CANARIES(mm_block); -+ ((zend_mm_block*)mm_block)->info.size = size; -+ SUHOSIN_MM_SET_END_CANARY(mm_block); ++ SUHOSIN_MM_SET_CANARIES(mm_block); ++ ((zend_mm_block*)mm_block)->info.size = size; ++ SUHOSIN_MM_SET_END_CANARY(mm_block); +#endif return p; } -@@ -2104,17 +2295,22 @@ +@@ -2180,17 +2371,22 @@ static void *_zend_mm_realloc_int(zend_m heap->cache_stat[index].count--; heap->cache_stat[index].hit++; #endif @@ -908,7 +894,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo #endif heap->cached -= true_size - orig_size; -@@ -2123,14 +2319,13 @@ +@@ -2199,7 +2395,7 @@ static void *_zend_mm_realloc_int(zend_m cache = &heap->cache[index]; ((zend_mm_free_block*)mm_block)->prev_free_block = *cache; @@ -917,33 +903,26 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo ZEND_MM_SET_MAGIC(mm_block, MEM_BLOCK_CACHED); #if ZEND_MM_CACHE_STAT if (++heap->cache_stat[index].count > heap->cache_stat[index].max_count) { - heap->cache_stat[index].max_count = heap->cache_stat[index].count; - } - #endif -- - return ptr; - } - } -@@ -2173,6 +2368,11 @@ +@@ -2249,6 +2445,11 @@ static void *_zend_mm_realloc_int(zend_m heap->peak = heap->size; } HANDLE_UNBLOCK_INTERRUPTIONS(); +#if SUHOSIN_PATCH -+ SUHOSIN_MM_SET_CANARIES(mm_block); -+ ((zend_mm_block*)mm_block)->info.size = size; -+ SUHOSIN_MM_SET_END_CANARY(mm_block); ++ SUHOSIN_MM_SET_CANARIES(mm_block); ++ ((zend_mm_block*)mm_block)->info.size = size; ++ SUHOSIN_MM_SET_END_CANARY(mm_block); +#endif return p; } else if (ZEND_MM_IS_FIRST_BLOCK(mm_block) && ZEND_MM_IS_GUARD_BLOCK(ZEND_MM_BLOCK_AT(next_block, ZEND_MM_FREE_BLOCK_SIZE(next_block)))) { -@@ -2275,38 +2475,74 @@ +@@ -2349,39 +2550,75 @@ out_of_memory: } HANDLE_UNBLOCK_INTERRUPTIONS(); +#if SUHOSIN_PATCH -+ SUHOSIN_MM_SET_CANARIES(mm_block); -+ ((zend_mm_block*)mm_block)->info.size = size; -+ SUHOSIN_MM_SET_END_CANARY(mm_block); ++ SUHOSIN_MM_SET_CANARIES(mm_block); ++ ((zend_mm_block*)mm_block)->info.size = size; ++ SUHOSIN_MM_SET_END_CANARY(mm_block); +#endif return ZEND_MM_DATA_OF(mm_block); } @@ -958,12 +937,14 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo #else - memcpy(ptr, p, orig_size - ZEND_MM_ALIGNED_HEADER_SIZE); + memcpy(ptr, p, orig_size - ZEND_MM_ALIGNED_HEADER_SIZE - CANARY_SIZE); - #endif ++#endif +#ifdef SUHOSIN_MM_WITH_CANARY_PROTECTION + _zend_mm_free_canary_int(heap, p ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); +#else - _zend_mm_free_int(heap, p ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); -+#endif ++ _zend_mm_free_int(heap, p ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); + #endif +- _zend_mm_free_int(heap, p ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); + HANDLE_UNBLOCK_INTERRUPTIONS(); return ptr; } @@ -974,9 +955,9 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo +#if SUHOSIN_PATCH + if (UNEXPECTED(SUHOSIN_CONFIG(SUHOSIN_MM_USE_CANARY_PROTECTION) == 0)) +#endif -+ return _zend_mm_alloc_int(heap, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); ++ return _zend_mm_alloc_int(heap, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); +#if SUHOSIN_PATCH -+ return _zend_mm_alloc_canary_int((zend_mm_heap_canary *)heap, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); ++ return _zend_mm_alloc_canary_int((zend_mm_heap_canary *)heap, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); +#endif } @@ -986,9 +967,9 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo +#if SUHOSIN_PATCH + if (UNEXPECTED(SUHOSIN_CONFIG(SUHOSIN_MM_USE_CANARY_PROTECTION) == 0)) +#endif -+ { _zend_mm_free_int(heap, p ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); return; } ++ { _zend_mm_free_int(heap, p ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); return; } +#if SUHOSIN_PATCH -+ _zend_mm_free_canary_int((zend_mm_heap_canary *)heap, p ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); ++ _zend_mm_free_canary_int((zend_mm_heap_canary *)heap, p ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); +#endif } @@ -998,7 +979,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo +#if SUHOSIN_PATCH + if (UNEXPECTED(SUHOSIN_CONFIG(SUHOSIN_MM_USE_CANARY_PROTECTION) == 0)) +#endif -+ return _zend_mm_realloc_int(heap, ptr, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); ++ return _zend_mm_realloc_int(heap, ptr, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); +#if SUHOSIN_PATCH + return _zend_mm_realloc_canary_int((zend_mm_heap_canary *)heap, ptr, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); +#endif @@ -1009,13 +990,13 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo zend_mm_block *mm_block; + if (SUHOSIN_CONFIG(SUHOSIN_MM_USE_CANARY_PROTECTION) != 0) { -+ return _zend_mm_block_size_canary((zend_mm_heap_canary *)heap, p ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); ++ return _zend_mm_block_size_canary((zend_mm_heap_canary *)heap, p ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); + } + if (!ZEND_MM_VALID_PTR(p)) { return 0; } -@@ -2318,6 +2554,24 @@ +@@ -2393,6 +2630,24 @@ ZEND_API size_t _zend_mm_block_size(zend return ZEND_MM_BLOCK_SIZE(mm_block); #endif } @@ -1040,7 +1021,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo /**********************/ /* Allocation Manager */ -@@ -2335,6 +2589,7 @@ +@@ -2410,6 +2665,7 @@ static int alloc_globals_id; static zend_alloc_globals alloc_globals; #endif @@ -1048,7 +1029,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo ZEND_API int is_zend_mm(TSRMLS_D) { return AG(mm_heap)->use_zend_alloc; -@@ -2347,7 +2602,13 @@ +@@ -2422,7 +2678,13 @@ ZEND_API void *_emalloc(size_t size ZEND if (UNEXPECTED(!AG(mm_heap)->use_zend_alloc)) { return AG(mm_heap)->_malloc(size); } @@ -1062,7 +1043,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo } ZEND_API void _efree(void *ptr ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) -@@ -2358,7 +2619,13 @@ +@@ -2433,7 +2695,13 @@ ZEND_API void _efree(void *ptr ZEND_FILE AG(mm_heap)->_free(ptr); return; } @@ -1077,7 +1058,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo } ZEND_API void *_erealloc(void *ptr, size_t size, int allow_failure ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) -@@ -2368,7 +2635,13 @@ +@@ -2443,7 +2711,13 @@ ZEND_API void *_erealloc(void *ptr, size if (UNEXPECTED(!AG(mm_heap)->use_zend_alloc)) { return AG(mm_heap)->_realloc(ptr, size); } @@ -1091,7 +1072,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo } ZEND_API size_t _zend_mem_block_size(void *ptr TSRMLS_DC ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) -@@ -2376,8 +2649,15 @@ +@@ -2451,8 +2725,15 @@ ZEND_API size_t _zend_mem_block_size(voi if (UNEXPECTED(!AG(mm_heap)->use_zend_alloc)) { return 0; } @@ -1108,7 +1089,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo #if defined(__GNUC__) && defined(i386) -@@ -2448,7 +2728,7 @@ +@@ -2523,7 +2804,7 @@ static inline size_t safe_address(size_t } #endif @@ -1117,7 +1098,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo ZEND_API void *_safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) { return emalloc_rel(safe_address(nmemb, size, offset)); -@@ -2561,6 +2841,7 @@ +@@ -2663,6 +2944,7 @@ ZEND_API void shutdown_memory_manager(in { zend_mm_shutdown(AG(mm_heap), full_shutdown, silent TSRMLS_CC); } @@ -1125,7 +1106,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo static void alloc_globals_ctor(zend_alloc_globals *alloc_globals TSRMLS_DC) { -@@ -2585,6 +2866,7 @@ +@@ -2687,6 +2969,7 @@ static void alloc_globals_dtor(zend_allo } #endif @@ -1133,7 +1114,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo ZEND_API void start_memory_manager(TSRMLS_D) { #ifdef ZTS -@@ -2649,6 +2931,7 @@ +@@ -2751,6 +3034,7 @@ ZEND_API void _full_mem_check(int silent zend_debug_alloc_output("------------------------------------------------\n"); } #endif @@ -1141,10 +1122,9 @@ diff -Nura php-5.3.9/Zend/zend_alloc.c suhosin-patch-5.3.9-0.9.10/Zend/zend_allo /* * Local variables: -diff -Nura php-5.3.9/Zend/zend_alloc.h suhosin-patch-5.3.9-0.9.10/Zend/zend_alloc.h ---- php-5.3.9/Zend/zend_alloc.h 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/zend_alloc.h 2012-01-11 19:29:07.000000000 +0100 -@@ -203,6 +203,8 @@ +--- a/Zend/zend_alloc.h ++++ b/Zend/zend_alloc.h +@@ -189,6 +189,8 @@ END_EXTERN_C() /* Heap functions */ typedef struct _zend_mm_heap zend_mm_heap; @@ -1153,15 +1133,14 @@ diff -Nura php-5.3.9/Zend/zend_alloc.h suhosin-patch-5.3.9-0.9.10/Zend/zend_allo ZEND_API zend_mm_heap *zend_mm_startup(void); ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, int full_shutdown, int silent TSRMLS_DC); -diff -Nura php-5.3.9/Zend/zend_alloc_canary.c suhosin-patch-5.3.9-0.9.10/Zend/zend_alloc_canary.c ---- php-5.3.9/Zend/zend_alloc_canary.c 1970-01-01 01:00:00.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/zend_alloc_canary.c 2012-01-11 19:30:47.000000000 +0100 -@@ -0,0 +1,2509 @@ +--- /dev/null ++++ b/Zend/zend_alloc_canary.c +@@ -0,0 +1,2498 @@ +/* + +----------------------------------------------------------------------+ + | Suhosin-Patch for PHP | + +----------------------------------------------------------------------+ -+ | Copyright (c) 2004-2011 Stefan Esser | ++ | Copyright (c) 2004-2010 Stefan Esser | + +----------------------------------------------------------------------+ + | This source file is subject to version 2.02 of the PHP license, | + | that is bundled with this package in the file LICENSE, and is | @@ -1387,10 +1366,6 @@ diff -Nura php-5.3.9/Zend/zend_alloc_canary.c suhosin-patch-5.3.9-0.9.10/Zend/ze + return NULL; + } + storage = (zend_mm_storage*)malloc(sizeof(zend_mm_storage)); -+ if (storage == NULL) { -+ HeapDestroy(heap); -+ return NULL; -+ } + storage->data = (void*) heap; + return storage; +} @@ -1674,7 +1649,7 @@ diff -Nura php-5.3.9/Zend/zend_alloc_canary.c suhosin-patch-5.3.9-0.9.10/Zend/ze +#define ZEND_MM_IS_GUARD_BLOCK(b) (((b)->info._size & ZEND_MM_TYPE_MASK) == ZEND_MM_GUARD_BLOCK) + +#define ZEND_MM_NEXT_BLOCK(b) ZEND_MM_BLOCK_AT(b, ZEND_MM_BLOCK_SIZE(b)) -+#define ZEND_MM_PREV_BLOCK(b) ZEND_MM_BLOCK_AT(b, -(ssize_t)((b)->info._prev & ~ZEND_MM_TYPE_MASK)) ++#define ZEND_MM_PREV_BLOCK(b) ZEND_MM_BLOCK_AT(b, -(int)((b)->info._prev & ~ZEND_MM_TYPE_MASK)) + +#define ZEND_MM_PREV_BLOCK_IS_FREE(b) (!((b)->info._prev & ZEND_MM_USED_BLOCK)) + @@ -2315,13 +2290,6 @@ diff -Nura php-5.3.9/Zend/zend_alloc_canary.c suhosin-patch-5.3.9-0.9.10/Zend/ze + storage->handlers = handlers; + + heap = malloc(sizeof(struct _zend_mm_heap_canary)); -+ if (heap == NULL) { -+ fprintf(stderr, "Cannot allocate heap for zend_mm storage [%s]\n", handlers->name); -+#ifdef PHP_WIN32 -+ fflush(stderr); -+#endif -+ exit(255); -+ } + + heap->storage = storage; + heap->block_size = block_size; @@ -3666,9 +3634,8 @@ diff -Nura php-5.3.9/Zend/zend_alloc_canary.c suhosin-patch-5.3.9-0.9.10/Zend/ze + * End: + */ + -diff -Nura php-5.3.9/Zend/zend_canary.c suhosin-patch-5.3.9-0.9.10/Zend/zend_canary.c ---- php-5.3.9/Zend/zend_canary.c 1970-01-01 01:00:00.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/zend_canary.c 2012-01-11 19:29:07.000000000 +0100 +--- /dev/null ++++ b/Zend/zend_canary.c @@ -0,0 +1,66 @@ +/* + +----------------------------------------------------------------------+ @@ -3736,10 +3703,9 @@ diff -Nura php-5.3.9/Zend/zend_canary.c suhosin-patch-5.3.9-0.9.10/Zend/zend_can + * vim600: sw=4 ts=4 fdm=marker + * vim<600: sw=4 ts=4 + */ -diff -Nura php-5.3.9/Zend/zend_compile.c suhosin-patch-5.3.9-0.9.10/Zend/zend_compile.c ---- php-5.3.9/Zend/zend_compile.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/zend_compile.c 2012-01-11 19:29:07.000000000 +0100 -@@ -73,6 +73,11 @@ +--- a/Zend/zend_compile.c ++++ b/Zend/zend_compile.c +@@ -141,6 +141,11 @@ static void zend_destroy_property_info_i } /* }}} */ @@ -3751,11 +3717,10 @@ diff -Nura php-5.3.9/Zend/zend_compile.c suhosin-patch-5.3.9-0.9.10/Zend/zend_co static void build_runtime_defined_function_key(zval *result, const char *name, int name_length TSRMLS_DC) /* {{{ */ { char char_pos_buf[32]; -diff -Nura php-5.3.9/Zend/zend_compile.h suhosin-patch-5.3.9-0.9.10/Zend/zend_compile.h ---- php-5.3.9/Zend/zend_compile.h 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/zend_compile.h 2012-01-11 19:29:07.000000000 +0100 -@@ -607,6 +607,11 @@ - ZEND_API int zend_auto_global_disable_jit(const char *varname, zend_uint varname_length TSRMLS_DC); +--- a/Zend/zend_compile.h ++++ b/Zend/zend_compile.h +@@ -685,6 +685,11 @@ ZEND_API zend_bool zend_is_auto_global(c + ZEND_API zend_bool zend_is_auto_global_quick(const char *name, uint name_len, ulong hashval TSRMLS_DC); ZEND_API size_t zend_dirname(char *path, size_t len); +#if SUHOSIN_PATCH @@ -3765,14 +3730,13 @@ diff -Nura php-5.3.9/Zend/zend_compile.h suhosin-patch-5.3.9-0.9.10/Zend/zend_co + int zendlex(znode *zendlval TSRMLS_DC); - /* BEGIN: OPCODES */ -diff -Nura php-5.3.9/Zend/zend_constants.c suhosin-patch-5.3.9-0.9.10/Zend/zend_constants.c ---- php-5.3.9/Zend/zend_constants.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/zend_constants.c 2012-01-11 19:29:07.000000000 +0100 -@@ -113,6 +113,76 @@ - - REGISTER_MAIN_LONG_CONSTANT("E_ALL", E_ALL, CONST_PERSISTENT | CONST_CS); + int zend_add_literal(zend_op_array *op_array, const zval *zv TSRMLS_DC); +--- a/Zend/zend_constants.c ++++ b/Zend/zend_constants.c +@@ -117,6 +117,76 @@ void zend_register_standard_constants(TS + REGISTER_MAIN_LONG_CONSTANT("DEBUG_BACKTRACE_PROVIDE_OBJECT", DEBUG_BACKTRACE_PROVIDE_OBJECT, CONST_PERSISTENT | CONST_CS); + REGISTER_MAIN_LONG_CONSTANT("DEBUG_BACKTRACE_IGNORE_ARGS", DEBUG_BACKTRACE_IGNORE_ARGS, CONST_PERSISTENT | CONST_CS); +#if SUHOSIN_PATCH + REGISTER_MAIN_LONG_CONSTANT("S_MEMORY", S_MEMORY, CONST_PERSISTENT | CONST_CS); + REGISTER_MAIN_LONG_CONSTANT("S_VARS", S_VARS, CONST_PERSISTENT | CONST_CS); @@ -3843,14 +3807,13 @@ diff -Nura php-5.3.9/Zend/zend_constants.c suhosin-patch-5.3.9-0.9.10/Zend/zend_ +#endif +#endif + - REGISTER_MAIN_LONG_CONSTANT("DEBUG_BACKTRACE_PROVIDE_OBJECT", DEBUG_BACKTRACE_PROVIDE_OBJECT, CONST_PERSISTENT | CONST_CS); - REGISTER_MAIN_LONG_CONSTANT("DEBUG_BACKTRACE_IGNORE_ARGS", DEBUG_BACKTRACE_IGNORE_ARGS, CONST_PERSISTENT | CONST_CS); /* true/false constants */ -diff -Nura php-5.3.9/Zend/zend_errors.h suhosin-patch-5.3.9-0.9.10/Zend/zend_errors.h ---- php-5.3.9/Zend/zend_errors.h 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/zend_errors.h 2012-01-11 19:29:07.000000000 +0100 + { + zend_constant c; +--- a/Zend/zend_errors.h ++++ b/Zend/zend_errors.h @@ -41,6 +41,20 @@ - #define E_ALL (E_ERROR | E_WARNING | E_PARSE | E_NOTICE | E_CORE_ERROR | E_CORE_WARNING | E_COMPILE_ERROR | E_COMPILE_WARNING | E_USER_ERROR | E_USER_WARNING | E_USER_NOTICE | E_RECOVERABLE_ERROR | E_DEPRECATED | E_USER_DEPRECATED) + #define E_ALL (E_ERROR | E_WARNING | E_PARSE | E_NOTICE | E_CORE_ERROR | E_CORE_WARNING | E_COMPILE_ERROR | E_COMPILE_WARNING | E_USER_ERROR | E_USER_WARNING | E_USER_NOTICE | E_RECOVERABLE_ERROR | E_DEPRECATED | E_USER_DEPRECATED | E_STRICT) #define E_CORE (E_CORE_ERROR | E_CORE_WARNING) +#if SUHOSIN_PATCH @@ -3870,20 +3833,19 @@ diff -Nura php-5.3.9/Zend/zend_errors.h suhosin-patch-5.3.9-0.9.10/Zend/zend_err #endif /* ZEND_ERRORS_H */ /* -diff -Nura php-5.3.9/Zend/zend_hash.c suhosin-patch-5.3.9-0.9.10/Zend/zend_hash.c ---- php-5.3.9/Zend/zend_hash.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/zend_hash.c 2012-01-11 19:29:07.000000000 +0100 -@@ -20,6 +20,7 @@ - /* $Id: zend_hash.c 321634 2012-01-01 13:15:04Z felipe $ */ +--- php-5.5.0/Zend/zend_hash.c~ 2013-06-20 23:57:44.000000000 +0300 ++++ php-5.5.0/Zend/zend_hash.c 2013-06-20 23:58:38.383348644 +0300 +@@ -21,6 +21,7 @@ #include "zend.h" + #include "zend_globals.h" +#include "zend_compile.h" #define CONNECT_TO_BUCKET_DLLIST(element, list_head) \ (element)->pNext = (list_head); \ -@@ -136,6 +137,199 @@ - } - +@@ -103,6 +104,199 @@ ZEND_API ulong zend_hash_func(const char + return zend_inline_hash_func(arKey, nKeyLength); + } +#if SUHOSIN_PATCH +#ifdef ZTS @@ -4079,17 +4041,17 @@ diff -Nura php-5.3.9/Zend/zend_hash.c suhosin-patch-5.3.9-0.9.10/Zend/zend_hash. +#define zend_hash_check_destructor(pDestructor) do {} while(0) +#endif - ZEND_API int _zend_hash_init(HashTable *ht, uint nSize, hash_func_t pHashFunction, dtor_func_t pDestructor, zend_bool persistent ZEND_FILE_LINE_DC) - { -@@ -156,6 +350,7 @@ + #define UPDATE_DATA(ht, p, pData, nDataSize) \ + if (nDataSize == sizeof(void*)) { \ +@@ -163,6 +357,7 @@ ZEND_API int _zend_hash_init(HashTable * - ht->nTableMask = ht->nTableSize - 1; + ht->nTableMask = 0; /* 0 means that ht->arBuckets is uninitialized */ ht->pDestructor = pDestructor; + zend_hash_add_destructor(pDestructor); - ht->arBuckets = NULL; + ht->arBuckets = (Bucket**)&uninitialized_bucket; ht->pListHead = NULL; ht->pListTail = NULL; -@@ -233,6 +428,7 @@ +@@ -230,6 +425,7 @@ ZEND_API int _zend_hash_add_or_update(Ha return FAILURE; } #endif @@ -4097,31 +4059,31 @@ diff -Nura php-5.3.9/Zend/zend_hash.c suhosin-patch-5.3.9-0.9.10/Zend/zend_hash. if (ht->pDestructor) { ht->pDestructor(p->pData); } -@@ -298,6 +494,7 @@ +@@ -307,6 +503,7 @@ ZEND_API int _zend_hash_quick_add_or_upd return FAILURE; } #endif -+ zend_hash_check_destructor(ht->pDestructor); ++ zend_hash_check_destructor(ht->pDestructor); if (ht->pDestructor) { ht->pDestructor(p->pData); } -@@ -373,6 +570,7 @@ +@@ -394,6 +591,7 @@ ZEND_API int _zend_hash_index_update_or_ return FAILURE; } #endif -+ zend_hash_check_destructor(ht->pDestructor); ++ zend_hash_check_destructor(ht->pDestructor); if (ht->pDestructor) { ht->pDestructor(p->pData); } -@@ -496,6 +694,7 @@ - if (ht->pInternalPointer == p) { +@@ -726,6 +726,7 @@ ht->pInternalPointer = p->pListNext; } + ht->nNumOfElements--; + zend_hash_check_destructor(ht->pDestructor); if (ht->pDestructor) { ht->pDestructor(p->pData); } -@@ -522,6 +721,7 @@ +@@ -553,6 +752,7 @@ ZEND_API void zend_hash_destroy(HashTabl SET_INCONSISTENT(HT_IS_DESTROYING); p = ht->pListHead; @@ -4129,23 +4091,15 @@ diff -Nura php-5.3.9/Zend/zend_hash.c suhosin-patch-5.3.9-0.9.10/Zend/zend_hash. while (p != NULL) { q = p; p = p->pListNext; -@@ -554,6 +754,7 @@ - ht->nNextFreeElement = 0; - ht->pInternalPointer = NULL; - -+ zend_hash_check_destructor(ht->pDestructor); - while (p != NULL) { - q = p; - p = p->pListNext; -@@ -608,6 +809,7 @@ +@@ -646,6 +846,7 @@ static Bucket *zend_hash_apply_deleter(H ht->nNumOfElements--; HANDLE_UNBLOCK_INTERRUPTIONS(); -+ zend_hash_check_destructor(ht->pDestructor); ++ zend_hash_check_destructor(ht->pDestructor); if (ht->pDestructor) { ht->pDestructor(p->pData); } -@@ -628,6 +830,7 @@ +@@ -666,6 +867,7 @@ ZEND_API void zend_hash_graceful_destroy IS_CONSISTENT(ht); p = ht->pListHead; @@ -4153,17 +4107,8 @@ diff -Nura php-5.3.9/Zend/zend_hash.c suhosin-patch-5.3.9-0.9.10/Zend/zend_hash. while (p != NULL) { p = zend_hash_apply_deleter(ht, p); } -@@ -1180,6 +1383,7 @@ - - IS_CONSISTENT(ht); - -+ zend_hash_check_destructor(ht->pDestructor); - if (p) { - if (key_type == HASH_KEY_IS_LONG) { - str_length = 0; -diff -Nura php-5.3.9/Zend/zend_llist.c suhosin-patch-5.3.9-0.9.10/Zend/zend_llist.c ---- php-5.3.9/Zend/zend_llist.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/zend_llist.c 2012-01-11 19:29:07.000000000 +0100 +--- a/Zend/zend_llist.c ++++ b/Zend/zend_llist.c @@ -23,6 +23,194 @@ #include "zend_llist.h" #include "zend_qsort.h" @@ -4359,7 +4304,7 @@ diff -Nura php-5.3.9/Zend/zend_llist.c suhosin-patch-5.3.9-0.9.10/Zend/zend_llis ZEND_API void zend_llist_init(zend_llist *l, size_t size, llist_dtor_func_t dtor, unsigned char persistent) { l->head = NULL; -@@ -30,6 +218,7 @@ +@@ -30,6 +218,7 @@ ZEND_API void zend_llist_init(zend_llist l->count = 0; l->size = size; l->dtor = dtor; @@ -4367,7 +4312,7 @@ diff -Nura php-5.3.9/Zend/zend_llist.c suhosin-patch-5.3.9-0.9.10/Zend/zend_llis l->persistent = persistent; } -@@ -81,6 +270,7 @@ +@@ -81,6 +270,7 @@ ZEND_API void zend_llist_prepend_element } else {\ (l)->tail = (current)->prev;\ }\ @@ -4375,7 +4320,7 @@ diff -Nura php-5.3.9/Zend/zend_llist.c suhosin-patch-5.3.9-0.9.10/Zend/zend_llis if ((l)->dtor) {\ (l)->dtor((current)->data);\ }\ -@@ -108,6 +298,7 @@ +@@ -108,6 +298,7 @@ ZEND_API void zend_llist_destroy(zend_ll { zend_llist_element *current=l->head, *next; @@ -4383,7 +4328,7 @@ diff -Nura php-5.3.9/Zend/zend_llist.c suhosin-patch-5.3.9-0.9.10/Zend/zend_llis while (current) { next = current->next; if (l->dtor) { -@@ -133,6 +324,7 @@ +@@ -133,6 +324,7 @@ ZEND_API void *zend_llist_remove_tail(ze zend_llist_element *old_tail; void *data; @@ -4391,10 +4336,9 @@ diff -Nura php-5.3.9/Zend/zend_llist.c suhosin-patch-5.3.9-0.9.10/Zend/zend_llis if ((old_tail = l->tail)) { if (old_tail->prev) { old_tail->prev->next = NULL; -diff -Nura php-5.3.9/Zend/zend_operators.c suhosin-patch-5.3.9-0.9.10/Zend/zend_operators.c ---- php-5.3.9/Zend/zend_operators.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/zend_operators.c 2012-01-11 19:29:07.000000000 +0100 -@@ -153,9 +153,14 @@ +--- a/Zend/zend_operators.c ++++ b/Zend/zend_operators.c +@@ -150,9 +150,14 @@ ZEND_API void convert_scalar_to_number(z case IS_STRING: { char *strval; @@ -4410,7 +4354,7 @@ diff -Nura php-5.3.9/Zend/zend_operators.c suhosin-patch-5.3.9-0.9.10/Zend/zend_ ZVAL_LONG(op, 0); } STR_FREE(strval); -@@ -187,7 +192,8 @@ +@@ -184,7 +189,8 @@ ZEND_API void convert_scalar_to_number(z } else { \ switch (Z_TYPE_P(op)) { \ case IS_STRING: \ @@ -4420,7 +4364,7 @@ diff -Nura php-5.3.9/Zend/zend_operators.c suhosin-patch-5.3.9-0.9.10/Zend/zend_ if ((Z_TYPE(holder)=is_numeric_string(Z_STRVAL_P(op), Z_STRLEN_P(op), &Z_LVAL(holder), &Z_DVAL(holder), 1)) == 0) { \ ZVAL_LONG(&(holder), 0); \ } \ -@@ -229,6 +235,7 @@ +@@ -226,6 +232,7 @@ ZEND_API void convert_scalar_to_number(z Z_LVAL(holder) = zend_dval_to_lval(Z_DVAL_P(op)); \ break; \ case IS_STRING: \ @@ -4428,7 +4372,7 @@ diff -Nura php-5.3.9/Zend/zend_operators.c suhosin-patch-5.3.9-0.9.10/Zend/zend_ Z_LVAL(holder) = strtol(Z_STRVAL_P(op), NULL, 10); \ break; \ case IS_ARRAY: \ -@@ -271,6 +278,7 @@ +@@ -268,6 +275,7 @@ ZEND_API void convert_scalar_to_number(z Z_LVAL(holder) = (Z_DVAL_P(op) ? 1 : 0); \ break; \ case IS_STRING: \ @@ -4436,7 +4380,7 @@ diff -Nura php-5.3.9/Zend/zend_operators.c suhosin-patch-5.3.9-0.9.10/Zend/zend_ if (Z_STRLEN_P(op) == 0 \ || (Z_STRLEN_P(op)==1 && Z_STRVAL_P(op)[0]=='0')) { \ Z_LVAL(holder) = 0; \ -@@ -356,6 +364,9 @@ +@@ -353,6 +361,9 @@ ZEND_API void convert_to_long_base(zval { char *strval = Z_STRVAL_P(op); @@ -4446,7 +4390,7 @@ diff -Nura php-5.3.9/Zend/zend_operators.c suhosin-patch-5.3.9-0.9.10/Zend/zend_ Z_LVAL_P(op) = strtol(strval, NULL, base); STR_FREE(strval); } -@@ -416,6 +427,9 @@ +@@ -413,6 +424,9 @@ ZEND_API void convert_to_double(zval *op { char *strval = Z_STRVAL_P(op); @@ -4456,7 +4400,7 @@ diff -Nura php-5.3.9/Zend/zend_operators.c suhosin-patch-5.3.9-0.9.10/Zend/zend_ Z_DVAL_P(op) = zend_strtod(strval, NULL); STR_FREE(strval); } -@@ -502,8 +516,14 @@ +@@ -499,8 +513,14 @@ ZEND_API void convert_to_boolean(zval *o if (Z_STRLEN_P(op) == 0 || (Z_STRLEN_P(op)==1 && Z_STRVAL_P(op)[0]=='0')) { @@ -4471,7 +4415,7 @@ diff -Nura php-5.3.9/Zend/zend_operators.c suhosin-patch-5.3.9-0.9.10/Zend/zend_ Z_LVAL_P(op) = 1; } STR_FREE(strval); -@@ -617,6 +637,9 @@ +@@ -614,6 +634,9 @@ static void convert_scalar_to_array(zval *entry = *op; INIT_PZVAL(entry); @@ -4481,10 +4425,9 @@ diff -Nura php-5.3.9/Zend/zend_operators.c suhosin-patch-5.3.9-0.9.10/Zend/zend_ switch (type) { case IS_ARRAY: ALLOC_HASHTABLE(Z_ARRVAL_P(op)); -diff -Nura php-5.3.9/Zend/zend_variables.c suhosin-patch-5.3.9-0.9.10/Zend/zend_variables.c ---- php-5.3.9/Zend/zend_variables.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/Zend/zend_variables.c 2012-01-11 19:29:07.000000000 +0100 -@@ -34,6 +34,9 @@ +--- a/Zend/zend_variables.c ++++ b/Zend/zend_variables.c +@@ -34,6 +34,9 @@ ZEND_API void _zval_dtor_func(zval *zval case IS_CONSTANT: CHECK_ZVAL_STRING_REL(zvalue); STR_FREE_REL(zvalue->value.str.val); @@ -4494,49 +4437,48 @@ diff -Nura php-5.3.9/Zend/zend_variables.c suhosin-patch-5.3.9-0.9.10/Zend/zend_ break; case IS_ARRAY: case IS_CONSTANT_ARRAY: { -@@ -78,6 +81,9 @@ +@@ -78,6 +81,9 @@ ZEND_API void _zval_internal_dtor(zval * case IS_CONSTANT: CHECK_ZVAL_STRING_REL(zvalue); - free(zvalue->value.str.val); + str_free(zvalue->value.str.val); +#if SUHOSIN_PATCH -+ zvalue->value.str.len = 0; ++ zvalue->value.str.len = 0; +#endif break; case IS_ARRAY: case IS_CONSTANT_ARRAY: -diff -Nura php-5.3.9/configure.in suhosin-patch-5.3.9-0.9.10/configure.in ---- php-5.3.9/configure.in 2012-01-10 12:21:57.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/configure.in 2012-01-11 19:29:07.000000000 +0100 -@@ -289,6 +289,7 @@ - sinclude(TSRM/threads.m4) - sinclude(TSRM/tsrm.m4) +--- php-5.5.0alpha1/configure.in~ 2012-11-17 13:36:25.000000000 +0200 ++++ php-5.5.0alpha1/configure.in 2012-11-17 13:37:55.705648875 +0200 +@@ -359,6 +359,7 @@ case $host_alias in + ;; + esac +sinclude(main/suhosin_patch.m4) - divert(2) - -@@ -1406,7 +1407,7 @@ + dnl Include Zend and TSRM configurations. + dnl ------------------------------------------------------------------------- +@@ -1439,7 +1439,7 @@ php_ini.c SAPI.c rfc1867.c php_content_types.c strlcpy.c \ strlcat.c mergesort.c reentrancy.c php_variables.c php_ticks.c \ - network.c php_open_temporary_file.c php_logos.c \ + network.c php_open_temporary_file.c \ - output.c getopt.c) -+ output.c getopt.c suhosin_patch.c ) ++ output.c getopt.c suhosin_patch.c) PHP_ADD_SOURCES(main/streams, streams.c cast.c memory.c filter.c \ plain_wrapper.c userspace.c transports.c xp_socket.c mmap.c \ -@@ -1434,7 +1435,7 @@ +@@ -1467,7 +1467,8 @@ zend_list.c zend_indent.c zend_builtin_functions.c zend_sprintf.c \ zend_ini.c zend_qsort.c zend_multibyte.c zend_ts_hash.c zend_stream.c \ zend_iterators.c zend_interfaces.c zend_exceptions.c zend_strtod.c zend_gc.c \ -- zend_closures.c zend_float.c) -+ zend_closures.c zend_float.c zend_canary.c zend_alloc_canary.c ) +- zend_closures.c zend_float.c zend_string.c zend_signal.c zend_generators.c) ++ zend_closures.c zend_float.c zend_string.c zend_signal.c zend_generators.c \ ++ zend_canary.c zend_alloc_canary.c) if test -r "$abs_srcdir/Zend/zend_objects.c"; then PHP_ADD_SOURCES(Zend, zend_objects.c zend_object_handlers.c zend_objects_API.c zend_default_classes.c) -diff -Nura php-5.3.9/ext/standard/dl.c suhosin-patch-5.3.9-0.9.10/ext/standard/dl.c ---- php-5.3.9/ext/standard/dl.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/ext/standard/dl.c 2012-01-11 19:29:07.000000000 +0100 -@@ -254,6 +254,23 @@ +--- a/ext/standard/dl.c ++++ b/ext/standard/dl.c +@@ -246,6 +246,23 @@ PHPAPI int php_load_extension(char *file return FAILURE; } } @@ -4560,47 +4502,45 @@ diff -Nura php-5.3.9/ext/standard/dl.c suhosin-patch-5.3.9-0.9.10/ext/standard/d return SUCCESS; } /* }}} */ -diff -Nura php-5.3.9/ext/standard/info.c suhosin-patch-5.3.9-0.9.10/ext/standard/info.c ---- php-5.3.9/ext/standard/info.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/ext/standard/info.c 2012-01-11 22:54:58.000000000 +0100 -@@ -878,6 +878,33 @@ - - php_info_print_table_end(); - -+ /* Suhosin Patch */ -+ php_info_print_box_start(0); -+ if (expose_php && !sapi_module.phpinfo_as_text) { -+ PUTS("\"Suhosin\n"); -+ } -+ PUTS("This server is protected with the Suhosin Patch "); -+ if (sapi_module.phpinfo_as_text) { -+ PUTS(SUHOSIN_PATCH_VERSION); -+ } else { -+ zend_html_puts(SUHOSIN_PATCH_VERSION, strlen(SUHOSIN_PATCH_VERSION) TSRMLS_CC); -+ } -+ PUTS(!sapi_module.phpinfo_as_text?"
":"\n"); -+ if (sapi_module.phpinfo_as_text) { -+ PUTS("Copyright (c) 2006-2007 Hardened-PHP Project\n"); -+ PUTS("Copyright (c) 2007-2012 SektionEins GmbH\n"); -+ } else { -+ PUTS("Copyright (c) 2006-2007 Hardened-PHP Project\n"); -+ PUTS("Copyright (c) 2007-2012 SektionEins GmbH\n"); -+ } -+ php_info_print_box_end(); -+ - /* Zend Engine */ - php_info_print_box_start(0); - if (expose_php && !sapi_module.phpinfo_as_text) { -diff -Nura php-5.3.9/ext/standard/syslog.c suhosin-patch-5.3.9-0.9.10/ext/standard/syslog.c ---- php-5.3.9/ext/standard/syslog.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/ext/standard/syslog.c 2012-01-11 19:29:07.000000000 +0100 -@@ -42,6 +42,7 @@ +#--- a/ext/standard/info.c +#+++ b/ext/standard/info.c +#@@ -785,6 +785,33 @@ PHPAPI void php_print_info(int flag TSRM +# +# php_info_print_table_end(); +# +#+ /* Suhosin Patch */ +#+ php_info_print_box_start(0); +#+ if (expose_php && !sapi_module.phpinfo_as_text) { +#+ PUTS("\"Suhosin\n"); +#+ } +#+ PUTS("This server is protected with the Suhosin Patch "); +#+ if (sapi_module.phpinfo_as_text) { +#+ PUTS(SUHOSIN_PATCH_VERSION); +#+ } else { +#+ zend_html_puts(SUHOSIN_PATCH_VERSION, strlen(SUHOSIN_PATCH_VERSION) TSRMLS_CC); +#+ } +#+ PUTS(!sapi_module.phpinfo_as_text?"
":"\n"); +#+ if (sapi_module.phpinfo_as_text) { +#+ PUTS("Copyright (c) 2006-2007 Hardened-PHP Project\n"); +#+ PUTS("Copyright (c) 2007-2009 SektionEins GmbH\n"); +#+ } else { +#+ PUTS("Copyright (c) 2006-2007 Hardened-PHP Project\n"); +#+ PUTS("Copyright (c) 2007-2009 SektionEins GmbH\n"); +#+ } +#+ php_info_print_box_end(); +#+ +# /* Zend Engine */ +# php_info_print_box_start(0); +# if (expose_php && !sapi_module.phpinfo_as_text) { +--- a/ext/standard/syslog.c ++++ b/ext/standard/syslog.c +@@ -40,6 +40,7 @@ */ PHP_MINIT_FUNCTION(syslog) { @@ -4608,7 +4548,7 @@ diff -Nura php-5.3.9/ext/standard/syslog.c suhosin-patch-5.3.9-0.9.10/ext/standa /* error levels */ REGISTER_LONG_CONSTANT("LOG_EMERG", LOG_EMERG, CONST_CS | CONST_PERSISTENT); /* system unusable */ REGISTER_LONG_CONSTANT("LOG_ALERT", LOG_ALERT, CONST_CS | CONST_PERSISTENT); /* immediate action required */ -@@ -97,6 +98,7 @@ +@@ -95,6 +96,7 @@ PHP_MINIT_FUNCTION(syslog) /* AIX doesn't have LOG_PERROR */ REGISTER_LONG_CONSTANT("LOG_PERROR", LOG_PERROR, CONST_CS | CONST_PERSISTENT); /*log to stderr*/ #endif @@ -4616,10 +4556,9 @@ diff -Nura php-5.3.9/ext/standard/syslog.c suhosin-patch-5.3.9-0.9.10/ext/standa BG(syslog_device)=NULL; return SUCCESS; -diff -Nura php-5.3.9/main/fopen_wrappers.c suhosin-patch-5.3.9-0.9.10/main/fopen_wrappers.c ---- php-5.3.9/main/fopen_wrappers.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/main/fopen_wrappers.c 2012-01-11 19:29:07.000000000 +0100 -@@ -85,13 +85,8 @@ +--- a/main/fopen_wrappers.c ++++ b/main/fopen_wrappers.c +@@ -84,13 +84,8 @@ or a tightening during activation/runtim PHPAPI ZEND_INI_MH(OnUpdateBaseDir) { char **p, *pathbuf, *ptr, *end; @@ -4634,10 +4573,9 @@ diff -Nura php-5.3.9/main/fopen_wrappers.c suhosin-patch-5.3.9-0.9.10/main/fopen if (stage == PHP_INI_STAGE_STARTUP || stage == PHP_INI_STAGE_SHUTDOWN || stage == PHP_INI_STAGE_ACTIVATE || stage == PHP_INI_STAGE_DEACTIVATE) { /* We're in a PHP_INI_SYSTEM context, no restrictions */ -diff -Nura php-5.3.9/main/main.c suhosin-patch-5.3.9-0.9.10/main/main.c ---- php-5.3.9/main/main.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/main/main.c 2012-01-11 19:29:07.000000000 +0100 -@@ -91,6 +91,9 @@ +--- a/main/main.c ++++ b/main/main.c +@@ -92,6 +92,9 @@ #include "SAPI.h" #include "rfc1867.h" @@ -4647,16 +4585,16 @@ diff -Nura php-5.3.9/main/main.c suhosin-patch-5.3.9-0.9.10/main/main.c #if HAVE_MMAP # if HAVE_UNISTD_H -@@ -504,7 +507,7 @@ +@@ -473,7 +476,7 @@ PHP_INI_BEGIN() STD_PHP_INI_ENTRY("extension_dir", PHP_EXTENSION_DIR, PHP_INI_SYSTEM, OnUpdateStringUnempty, extension_dir, php_core_globals, core_globals) STD_PHP_INI_ENTRY("include_path", PHP_INCLUDE_PATH, PHP_INI_ALL, OnUpdateStringUnempty, include_path, php_core_globals, core_globals) PHP_INI_ENTRY("max_execution_time", "30", PHP_INI_ALL, OnUpdateTimeout) - STD_PHP_INI_ENTRY("open_basedir", NULL, PHP_INI_ALL, OnUpdateBaseDir, open_basedir, php_core_globals, core_globals) + PHP_INI_ENTRY("open_basedir", NULL, PHP_INI_ALL, OnUpdateBaseDir) - STD_PHP_INI_ENTRY("safe_mode_exec_dir", PHP_SAFE_MODE_EXEC_DIR, PHP_INI_SYSTEM, OnUpdateString, safe_mode_exec_dir, php_core_globals, core_globals) STD_PHP_INI_BOOLEAN("file_uploads", "1", PHP_INI_SYSTEM, OnUpdateBool, file_uploads, php_core_globals, core_globals) -@@ -1810,6 +1813,10 @@ + STD_PHP_INI_ENTRY("upload_max_filesize", "2M", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateLong, upload_max_filesize, php_core_globals, core_globals) +@@ -1884,6 +1887,10 @@ void dummy_invalid_parameter_handler( } #endif @@ -4667,7 +4605,7 @@ diff -Nura php-5.3.9/main/main.c suhosin-patch-5.3.9-0.9.10/main/main.c /* {{{ php_module_startup */ int php_module_startup(sapi_module_struct *sf, zend_module_entry *additional_modules, uint num_additional_modules) -@@ -1858,6 +1865,10 @@ +@@ -1927,6 +1934,10 @@ int php_module_startup(sapi_module_struc php_win32_init_rng_lock(); #endif @@ -4678,7 +4616,7 @@ diff -Nura php-5.3.9/main/main.c suhosin-patch-5.3.9-0.9.10/main/main.c module_shutdown = 0; module_startup = 1; sapi_initialize_empty_request(TSRMLS_C); -@@ -1980,7 +1991,11 @@ +@@ -2051,7 +2062,11 @@ int php_module_startup(sapi_module_struc REGISTER_MAIN_STRINGL_CONSTANT("PHP_CONFIG_FILE_SCAN_DIR", PHP_CONFIG_FILE_SCAN_DIR, sizeof(PHP_CONFIG_FILE_SCAN_DIR)-1, CONST_PERSISTENT | CONST_CS); REGISTER_MAIN_STRINGL_CONSTANT("PHP_SHLIB_SUFFIX", PHP_SHLIB_SUFFIX, sizeof(PHP_SHLIB_SUFFIX)-1, CONST_PERSISTENT | CONST_CS); REGISTER_MAIN_STRINGL_CONSTANT("PHP_EOL", PHP_EOL, sizeof(PHP_EOL)-1, CONST_PERSISTENT | CONST_CS); @@ -4690,11 +4628,10 @@ diff -Nura php-5.3.9/main/main.c suhosin-patch-5.3.9-0.9.10/main/main.c + REGISTER_MAIN_LONG_CONSTANT("PHP_MAXPATHLEN", MAXPATHLEN, CONST_PERSISTENT | CONST_CS); REGISTER_MAIN_LONG_CONSTANT("PHP_INT_MAX", LONG_MAX, CONST_PERSISTENT | CONST_CS); REGISTER_MAIN_LONG_CONSTANT("PHP_INT_SIZE", sizeof(long), CONST_PERSISTENT | CONST_CS); - #ifdef ZEND_MULTIBYTE -diff -Nura php-5.3.9/main/php.h suhosin-patch-5.3.9-0.9.10/main/php.h ---- php-5.3.9/main/php.h 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/main/php.h 2012-01-11 19:29:07.000000000 +0100 -@@ -454,6 +454,10 @@ + +--- a/main/php.h ++++ b/main/php.h +@@ -453,6 +453,10 @@ END_EXTERN_C() #endif #endif /* !XtOffsetOf */ @@ -4705,47 +4642,33 @@ diff -Nura php-5.3.9/main/php.h suhosin-patch-5.3.9-0.9.10/main/php.h #endif /* -diff -Nura php-5.3.9/main/php_config.h.in suhosin-patch-5.3.9-0.9.10/main/php_config.h.in ---- php-5.3.9/main/php_config.h.in 2012-01-10 14:37:07.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/main/php_config.h.in 2012-01-11 19:29:07.000000000 +0100 -@@ -405,6 +405,9 @@ - /* Define to 1 if you have the `alphasort' function. */ - #undef HAVE_ALPHASORT - -+/* Suhosin-Patch for PHP */ -+#undef SUHOSIN_PATCH -+ - /* Whether you have AOLserver */ - #undef HAVE_AOLSERVER - ---- php-5.3.21/main/php_logos.c~ 2013-01-22 23:40:21.000000000 +0200 -+++ php-5.3.21/main/php_logos.c 2013-01-22 23:41:14.071814355 +0200 -@@ -50,6 +50,10 @@ - return zend_hash_del(&phpinfo_logo_hash, logo_string, strlen(logo_string)); - } - -+#if SUHOSIN_PATCH -+#include "suhosin_logo.h" -+#endif -+ - int php_init_info_logos(void) - { - if(zend_hash_init(&phpinfo_logo_hash, 0, NULL, NULL, 1)==FAILURE) -@@ -64,6 +64,10 @@ - php_register_info_logo(ZEND_LOGO_GUID , "image/gif", zend_logo , sizeof(zend_logo)); - php_register_info_logo(PLD_LOGO_GUID , "image/png", pld_logo , sizeof(pld_logo)); - -+#if SUHOSIN_PATCH -+ php_register_info_logo(SUHOSIN_LOGO_GUID, "image/jpeg", suhosin_logo , sizeof(suhosin_logo)); -+#endif -+ - return SUCCESS; - } - -diff -Nura php-5.3.9/main/snprintf.c suhosin-patch-5.3.9-0.9.10/main/snprintf.c ---- php-5.3.9/main/snprintf.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/main/snprintf.c 2012-01-11 19:29:07.000000000 +0100 -@@ -782,6 +782,10 @@ +#--- php-5.4.6/main/php_logos.c~ 2012-08-23 12:04:01.000000000 +0300 +#+++ php-5.4.6/main/php_logos.c 2012-08-23 12:04:39.401608052 +0300 +#@@ -50,6 +50,10 @@ PHPAPI int php_unregister_info_logo(char +# return zend_hash_del(&phpinfo_logo_hash, logo_string, strlen(logo_string)); +# } +# +#+#if SUHOSIN_PATCH +#+#include "suhosin_logo.h" +#+#endif +#+ +# int php_init_info_logos(void) +# { +# if(zend_hash_init(&phpinfo_logo_hash, 0, NULL, NULL, 1)==FAILURE) +#@@ -64,6 +64,10 @@ +# php_register_info_logo(ZEND_LOGO_GUID , "image/gif", zend_logo , sizeof(zend_logo)); +# php_register_info_logo(PLD_LOGO_GUID , "image/png", pld_logo , sizeof(pld_logo)); +# +#+#if SUHOSIN_PATCH +#+ php_register_info_logo(SUHOSIN_LOGO_GUID, "image/jpeg", suhosin_logo , sizeof(suhosin_logo)); +#+#endif +#+ +# return SUCCESS; +# } +# +--- a/main/snprintf.c ++++ b/main/snprintf.c +@@ -782,6 +782,10 @@ static int format_converter(register buf */ switch (*fmt) { case 'Z': @@ -4756,7 +4679,7 @@ diff -Nura php-5.3.9/main/snprintf.c suhosin-patch-5.3.9-0.9.10/main/snprintf.c zvp = (zval*) va_arg(ap, zval*); zend_make_printable_zval(zvp, &zcopy, &free_zcopy); if (free_zcopy) { -@@ -792,6 +796,7 @@ +@@ -792,6 +796,7 @@ static int format_converter(register buf if (adjust_precision && precision < s_len) { s_len = precision; } @@ -4764,7 +4687,7 @@ diff -Nura php-5.3.9/main/snprintf.c suhosin-patch-5.3.9-0.9.10/main/snprintf.c break; case 'u': switch(modifier) { -@@ -1093,7 +1098,11 @@ +@@ -1093,7 +1098,11 @@ static int format_converter(register buf case 'n': @@ -4776,10 +4699,9 @@ diff -Nura php-5.3.9/main/snprintf.c suhosin-patch-5.3.9-0.9.10/main/snprintf.c goto skip_output; /* -diff -Nura php-5.3.9/main/spprintf.c suhosin-patch-5.3.9-0.9.10/main/spprintf.c ---- php-5.3.9/main/spprintf.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/main/spprintf.c 2012-01-11 19:29:08.000000000 +0100 -@@ -390,6 +390,10 @@ +--- a/main/spprintf.c ++++ b/main/spprintf.c +@@ -390,6 +390,10 @@ static void xbuf_format_converter(smart_ */ switch (*fmt) { case 'Z': @@ -4790,7 +4712,7 @@ diff -Nura php-5.3.9/main/spprintf.c suhosin-patch-5.3.9-0.9.10/main/spprintf.c zvp = (zval*) va_arg(ap, zval*); zend_make_printable_zval(zvp, &zcopy, &free_zcopy); if (free_zcopy) { -@@ -400,6 +404,7 @@ +@@ -400,6 +404,7 @@ static void xbuf_format_converter(smart_ if (adjust_precision && precision < s_len) { s_len = precision; } @@ -4798,7 +4720,7 @@ diff -Nura php-5.3.9/main/spprintf.c suhosin-patch-5.3.9-0.9.10/main/spprintf.c break; case 'u': switch(modifier) { -@@ -700,7 +705,11 @@ +@@ -700,7 +705,11 @@ static void xbuf_format_converter(smart_ case 'n': @@ -4810,9 +4732,8 @@ diff -Nura php-5.3.9/main/spprintf.c suhosin-patch-5.3.9-0.9.10/main/spprintf.c goto skip_output; /* -diff -Nura php-5.3.9/main/suhosin_globals.h suhosin-patch-5.3.9-0.9.10/main/suhosin_globals.h ---- php-5.3.9/main/suhosin_globals.h 1970-01-01 01:00:00.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/main/suhosin_globals.h 2012-01-11 19:29:08.000000000 +0100 +--- /dev/null ++++ b/main/suhosin_globals.h @@ -0,0 +1,61 @@ +/* + +----------------------------------------------------------------------+ @@ -4875,9 +4796,8 @@ diff -Nura php-5.3.9/main/suhosin_globals.h suhosin-patch-5.3.9-0.9.10/main/suho + * c-basic-offset: 4 + * End: + */ -diff -Nura php-5.3.9/main/suhosin_logo.h suhosin-patch-5.3.9-0.9.10/main/suhosin_logo.h ---- php-5.3.9/main/suhosin_logo.h 1970-01-01 01:00:00.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/main/suhosin_logo.h 2012-01-11 19:29:08.000000000 +0100 +--- /dev/null ++++ b/main/suhosin_logo.h @@ -0,0 +1,178 @@ +static unsigned char suhosin_logo[] = + "\xff\xd8\xff\xe0\x00\x10\x4a\x46\x49\x46\x00\x01\x01\x01\x00\x48" @@ -5057,9 +4977,8 @@ diff -Nura php-5.3.9/main/suhosin_logo.h suhosin-patch-5.3.9-0.9.10/main/suhosin + "\x21\xb6\x99\x69\xbc\x25\xb6\xdb\x6d\x18\xc2\x10\xda\x12\x94\xa1" + "\x38\xc2\x53\x8c\x63\x18\xc7\x9d\xbe\x7f\xff\xd9" + ; -diff -Nura php-5.3.9/main/suhosin_patch.c suhosin-patch-5.3.9-0.9.10/main/suhosin_patch.c ---- php-5.3.9/main/suhosin_patch.c 1970-01-01 01:00:00.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/main/suhosin_patch.c 2012-01-11 19:29:08.000000000 +0100 +--- /dev/null ++++ b/main/suhosin_patch.c @@ -0,0 +1,470 @@ +/* + +----------------------------------------------------------------------+ @@ -5446,7 +5365,7 @@ diff -Nura php-5.3.9/main/suhosin_patch.c suhosin-patch-5.3.9-0.9.10/main/suhosi + zval *result = NULL; + + /*long orig_execution_depth = SPG(execution_depth);*/ -+ zend_bool orig_safe_mode = PG(safe_mode); ++ /*zend_bool orig_safe_mode = PG(safe_mode);*/ + char *orig_basedir = PG(open_basedir); + + char *phpscript = SPG(log_phpscriptname); @@ -5483,14 +5402,14 @@ diff -Nura php-5.3.9/main/suhosin_patch.c suhosin-patch-5.3.9-0.9.10/main/suhosi + + /*SPG(execution_depth) = 0;*/ + if (SPG(log_phpscript_is_safe)) { -+ PG(safe_mode) = 0; ++ /*PG(safe_mode) = 0;*/ + PG(open_basedir) = NULL; + } + + zend_execute(new_op_array TSRMLS_CC); + + /*SPG(execution_depth) = orig_execution_depth;*/ -+ PG(safe_mode) = orig_safe_mode; ++ /*PG(safe_mode) = orig_safe_mode;*/ + PG(open_basedir) = orig_basedir; + +#ifdef ZEND_ENGINE_2 @@ -5531,9 +5450,8 @@ diff -Nura php-5.3.9/main/suhosin_patch.c suhosin-patch-5.3.9-0.9.10/main/suhosi + * vim600: sw=4 ts=4 fdm=marker + * vim<600: sw=4 ts=4 + */ -diff -Nura php-5.3.9/main/suhosin_patch.h suhosin-patch-5.3.9-0.9.10/main/suhosin_patch.h ---- php-5.3.9/main/suhosin_patch.h 1970-01-01 01:00:00.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/main/suhosin_patch.h 2012-01-11 19:29:08.000000000 +0100 +--- /dev/null ++++ b/main/suhosin_patch.h @@ -0,0 +1,59 @@ +/* + +----------------------------------------------------------------------+ @@ -5594,9 +5512,8 @@ diff -Nura php-5.3.9/main/suhosin_patch.h suhosin-patch-5.3.9-0.9.10/main/suhosi + * c-basic-offset: 4 + * End: + */ -diff -Nura php-5.3.9/main/suhosin_patch.m4 suhosin-patch-5.3.9-0.9.10/main/suhosin_patch.m4 ---- php-5.3.9/main/suhosin_patch.m4 1970-01-01 01:00:00.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/main/suhosin_patch.m4 2012-01-11 19:29:08.000000000 +0100 +--- /dev/null ++++ b/main/suhosin_patch.m4 @@ -0,0 +1,8 @@ +dnl +dnl $Id: suhosin_patch.m4,v 1.1 2004/11/14 13:24:24 ionic Exp $ @@ -5606,10 +5523,9 @@ diff -Nura php-5.3.9/main/suhosin_patch.m4 suhosin-patch-5.3.9-0.9.10/main/suhos + +AC_DEFINE(SUHOSIN_PATCH, 1, [Suhosin Patch]) + -diff -Nura php-5.3.9/sapi/apache/mod_php5.c suhosin-patch-5.3.9-0.9.10/sapi/apache/mod_php5.c ---- php-5.3.9/sapi/apache/mod_php5.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/sapi/apache/mod_php5.c 2012-01-11 19:29:08.000000000 +0100 -@@ -969,7 +969,11 @@ +--- a/sapi/apache/mod_php5.c ++++ b/sapi/apache/mod_php5.c +@@ -965,7 +965,11 @@ static void php_init_handler(server_rec { TSRMLS_FETCH(); if (PG(expose_php)) { @@ -5621,10 +5537,9 @@ diff -Nura php-5.3.9/sapi/apache/mod_php5.c suhosin-patch-5.3.9-0.9.10/sapi/apac } } #endif -diff -Nura php-5.3.9/sapi/apache2filter/sapi_apache2.c suhosin-patch-5.3.9-0.9.10/sapi/apache2filter/sapi_apache2.c ---- php-5.3.9/sapi/apache2filter/sapi_apache2.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/sapi/apache2filter/sapi_apache2.c 2012-01-11 19:29:08.000000000 +0100 -@@ -583,7 +583,11 @@ +--- a/sapi/apache2filter/sapi_apache2.c ++++ b/sapi/apache2filter/sapi_apache2.c +@@ -581,7 +581,11 @@ static void php_apache_add_version(apr_p { TSRMLS_FETCH(); if (PG(expose_php)) { @@ -5636,10 +5551,9 @@ diff -Nura php-5.3.9/sapi/apache2filter/sapi_apache2.c suhosin-patch-5.3.9-0.9.1 } } -diff -Nura php-5.3.9/sapi/apache2handler/sapi_apache2.c suhosin-patch-5.3.9-0.9.10/sapi/apache2handler/sapi_apache2.c ---- php-5.3.9/sapi/apache2handler/sapi_apache2.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/sapi/apache2handler/sapi_apache2.c 2012-01-11 19:29:08.000000000 +0100 -@@ -407,7 +407,11 @@ +--- a/sapi/apache2handler/sapi_apache2.c ++++ b/sapi/apache2handler/sapi_apache2.c +@@ -406,7 +406,11 @@ static void php_apache_add_version(apr_p { TSRMLS_FETCH(); if (PG(expose_php)) { @@ -5651,10 +5565,9 @@ diff -Nura php-5.3.9/sapi/apache2handler/sapi_apache2.c suhosin-patch-5.3.9-0.9. } } -diff -Nura php-5.3.9/sapi/apache_hooks/mod_php5.c suhosin-patch-5.3.9-0.9.10/sapi/apache_hooks/mod_php5.c ---- php-5.3.9/sapi/apache_hooks/mod_php5.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/sapi/apache_hooks/mod_php5.c 2012-01-11 19:29:08.000000000 +0100 -@@ -1256,7 +1256,11 @@ +--- a/sapi/apache_hooks/mod_php5.c ++++ b/sapi/apache_hooks/mod_php5.c +@@ -1251,7 +1251,11 @@ static void php_init_handler(server_rec { TSRMLS_FETCH(); if (PG(expose_php)) { @@ -5666,107 +5579,101 @@ diff -Nura php-5.3.9/sapi/apache_hooks/mod_php5.c suhosin-patch-5.3.9-0.9.10/sap } } #endif -diff -Nura php-5.3.9/sapi/cgi/cgi_main.c suhosin-patch-5.3.9-0.9.10/sapi/cgi/cgi_main.c ---- php-5.3.9/sapi/cgi/cgi_main.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/sapi/cgi/cgi_main.c 2012-01-11 19:36:52.000000000 +0100 -@@ -1932,11 +1932,19 @@ +--- a/sapi/cgi/cgi_main.c ++++ b/sapi/cgi/cgi_main.c +@@ -2188,10 +2188,18 @@ consult the installation file that came SG(headers_sent) = 1; SG(request_info).no_headers = 1; } +#if SUHOSIN_PATCH -+#if ZEND_DEBUG -+ php_printf("PHP %s with Suhosin-Patch (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); -+#else -+ php_printf("PHP %s with Suhosin-Patch (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); -+#endif -+#else #if ZEND_DEBUG - php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); +- php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); ++ php_printf("PHP %s with Suhosin-Patch (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); #else - php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); - #endif +- php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); ++ php_printf("PHP %s with Suhosin-Patch (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); +#endif ++#else ++ #if ZEND_DEBUG ++ php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); ++ #else ++ php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); ++ #endif + #endif php_request_shutdown((void *) 0); fcgi_shutdown(); - exit_status = 0; -diff -Nura php-5.3.9/sapi/cli/php_cli.c suhosin-patch-5.3.9-0.9.10/sapi/cli/php_cli.c ---- php-5.3.9/sapi/cli/php_cli.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/sapi/cli/php_cli.c 2012-01-11 19:35:06.000000000 +0100 -@@ -826,7 +826,11 @@ - } +--- a/sapi/cli/php_cli.c ++++ b/sapi/cli/php_cli.c +@@ -687,7 +687,11 @@ static int do_cli(int argc, char **argv + goto out; - request_started = 1; -- php_printf("PHP %s (%s) (built: %s %s) %s\nCopyright (c) 1997-2013 The PHP Group\n%s", -+ php_printf("PHP %s " + case 'v': /* show php version & quit */ +#if SUHOSIN_PATCH -+ "with Suhosin-Patch " ++ php_printf("PHP %s with Suhosin-Patch (%s) (built: %s %s) %s\nCopyright (c) 1997-2014 The PHP Group\n%s", ++#else + php_printf("PHP %s (%s) (built: %s %s) %s\nCopyright (c) 1997-2014 The PHP Group\n%s", +#endif -+ "(%s) (built: %s %s) %s\nCopyright (c) 1997-2013 The PHP Group\n%s", - PHP_VERSION, sapi_module.name, __DATE__, __TIME__, + PHP_VERSION, cli_sapi_module.name, __DATE__, __TIME__, #if ZEND_DEBUG && defined(HAVE_GCOV) "(DEBUG GCOV)", -diff -Nura php-5.3.9/sapi/litespeed/lsapi_main.c suhosin-patch-5.3.9-0.9.10/sapi/litespeed/lsapi_main.c ---- php-5.3.9/sapi/litespeed/lsapi_main.c 2011-12-31 19:15:06.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/sapi/litespeed/lsapi_main.c 2012-01-11 19:29:08.000000000 +0100 -@@ -718,11 +718,19 @@ - break; +--- php-5.5.15/sapi/litespeed/lsapi_main.c 2014-08-21 11:45:02.000000000 +0300 ++++ php-5.5.15/sapi/litespeed/lsapi_main.c 2014-08-25 11:50:36.603155796 +0300 +@@ -734,11 +546,19 @@ case 'v': if (php_request_startup(TSRMLS_C) != FAILURE) { +#if SUHOSIN_PATCH -+ #if ZEND_DEBUG -+ php_printf("PHP %s with Suhosin-Patch (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); -+ #else -+ php_printf("PHP %s with Suhosin-Patch (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); -+ #endif -+#else ++#if ZEND_DEBUG ++ php_printf("PHP %s with Suhosin-Patch (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); ++#else ++ php_printf("PHP %s with Suhosin-Patch (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); ++#endif ++#else #if ZEND_DEBUG - php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); + php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); #else - php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); + php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); #endif +#endif #ifdef PHP_OUTPUT_NEWAPI php_output_end_all(TSRMLS_C); #else -diff -Nura php-5.3.9/sapi/milter/php_milter.c suhosin-patch-5.3.9-0.9.10/sapi/milter/php_milter.c ---- php-5.3.9/sapi/milter/php_milter.c 2012-01-01 14:15:04.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/sapi/milter/php_milter.c 2012-01-11 19:33:42.000000000 +0100 -@@ -1111,7 +1111,11 @@ + php_end_ob_buffers(1 TSRMLS_CC); +--- a/sapi/milter/php_milter.c ++++ b/sapi/milter/php_milter.c +@@ -1109,7 +1109,11 @@ int main(int argc, char *argv[]) } SG(headers_sent) = 1; SG(request_info).no_headers = 1; +#if SUHOSIN_PATCH -+ php_printf("PHP %s with Suhosin-Patch (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); ++ php_printf("PHP with Suhosin-Patch %s (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); +#else - php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); + php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); +#endif - php_end_ob_buffers(1 TSRMLS_CC); + php_output_teardown(); exit(1); break; -diff -Nura php-5.3.9/win32/build/config.w32 suhosin-patch-5.3.9-0.9.10/win32/build/config.w32 ---- php-5.3.9/win32/build/config.w32 2011-03-28 12:55:34.000000000 +0200 -+++ suhosin-patch-5.3.9-0.9.10/win32/build/config.w32 2012-01-11 19:29:08.000000000 +0100 -@@ -328,7 +328,7 @@ +--- php-5.5.0alpha1/win32/build/config.w32~ 2012-11-17 13:39:12.000000000 +0200 ++++ php-5.5.0alpha1/win32/build/config.w32 2012-11-17 13:48:11.720739542 +0200 +@@ -364,7 +364,7 @@ zend_stream.c zend_iterators.c zend_interfaces.c zend_objects.c \ zend_object_handlers.c zend_objects_API.c \ zend_default_classes.c zend_execute.c zend_strtod.c zend_gc.c zend_closures.c \ -- zend_float.c"); -+ zend_float.c zend_canary.c zend_alloc_canary.c"); +- zend_float.c zend_string.c zend_generators.c"); ++ zend_float.c zend_string.c zend_generators.c zend_canary.c zend_alloc_canary.c"); if (VCVERS == 1200) { AC_DEFINE('ZEND_DVAL_TO_LVAL_CAST_OK', 1); -@@ -385,6 +385,7 @@ - +@@ -385,6 +385,7 @@ ADD_FLAG("CFLAGS", "/D FD_SETSIZE=" + pa + AC_DEFINE('HAVE_USLEEP', 1); AC_DEFINE('HAVE_STRCOLL', 1); +AC_DEFINE('SUHOSIN_PATCH', 1); /* For snapshot builders, where can we find the additional * files that make up the snapshot template? */ -diff -Nura php-5.3.9/win32/build/config.w32.h.in suhosin-patch-5.3.9-0.9.10/win32/build/config.w32.h.in ---- php-5.3.9/win32/build/config.w32.h.in 2010-11-26 19:25:13.000000000 +0100 -+++ suhosin-patch-5.3.9-0.9.10/win32/build/config.w32.h.in 2012-01-11 19:29:08.000000000 +0100 -@@ -152,6 +152,9 @@ +--- a/win32/build/config.w32.h.in ++++ b/win32/build/config.w32.h.in +@@ -150,6 +150,9 @@ /* Win32 supports strcoll */ #define HAVE_STRCOLL 1