# changelog

author: JoungKyun.Kim <http://oops.org> 1:5.4.8-1.an2
changelog:
  - update 5.4.8
  - Fixed official bug
    Fixed bug #63297 (Phar fails to write an openssl based signature).
    Fixed bug #63284 (Upgrade PCRE to 8.31).
    Fixed bug #63055 (Segfault in zend_gc with SF2 testsuite).
    Fixed bug #63180 (Corruption of hash tables).
    Fixed bug #63265 (Add ORA-00028 to the PHP_OCI_HANDLE_ERROR macro)
    Fixed bug #63389 (Missing context check on libxml_set_streams_context() causes memleak).
    Fixed bug #63248 (Load multiple magic files from a directory under Windows).
    Fixed bug #63363 (Curl silently accepts boolean true for SSL_VERIFYHOST).
    Fixed bug #63369 ((un)serialize() leaves dangling pointers, causes crashes).
    Fixed bug #63305 (zend_mm_heap corrupted with traits). (Dmitry, Laruence)
    Fixed bug #62593 (Emulate prepares behave strangely with PARAM_BOOL).
    Fixed bug #63399 (ReflectionClass::getTraitAliases() incorrectly resolves traitnames).
  - add sqlite (sqlite2) extension


author: JoungKyun.Kim <http://oops.org> 1:5.4.8-2.an2
changelog:
  - fixed missing #63399
  - fixed bug #63241 PHP fails to open Windows deduplicated files.
  - fixed bug #63447 max_input_vars doesn't filter variables when
    mbstring.encoding_translation = On
  - set realpath_cache_force to enable, force enable realpath_cache_size
    and realpath_cache_ttl although safe_mode or open_basedir set enabled.


author: JoungKyun.Kim <http://oops.org> 10:5.4.12-1.an2
changelog:
  - update 5.4.12
  - add fpm server api
  - Fixed bug #64124 (IPv6 malformed)
  - Fixed bug #64106 (Segfault on SplFixedArray[][x] = y when extended)
  - Fixed bug #60840 (undefined symbol: mysqlnd_debug_std_no_trace_funcs)
  - Fixed bug #61930 (openssl corrupts ssl key resource when using
    openssl_get_publickey())
  - New SSL stream context option to prevent CRIME attack vector.
  - Fixed bug #63530 (mysqlnd_stmt::bind_one_parameter crashes, uses
    wrong alloc for stmt->param_bind).
  - mb_split() can now handle empty matches like preg_split() does
  - Fixed bug #64128 (buit-in web server is broken on ppc64)
  - Fixed bug #64142 (dval to lval different behavior on ppc64)
  - Fixed bug #64354 (Unserialize array of objects whose class can't
    be autoloaded fail)
  - Implemented FR #64175 (Added HTTP codes as of RFC 6585)
  - Fixed bug #64197 (_Offsetof() macro used but not defined on ARM/Clang)
  - Fixed bug #64070 (Inheritance with Traits failed with error)
  - Fixed bug #64235 (Insteadof not work for class method in 5.4.11)
  - security issues
    . CVE-2013-1643
      The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.13 allows
      remote attackers to read arbitrary files via a SOAP WSDL file
      containing an XML external entity declaration in conjunction with an
      entity reference, related to an XML External Entity (XXE) issue in the
      soap_xmlParseFile and soap_xmlParseMemory functions.
    . CVE-2013-1635
      ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not
      validate the relationship between the soap.wsdl_cache_dir directive
      and the open_basedir directive, which allows remote attackers to bypass
      intended access restrictions by triggering the creation of cached SOAP
      WSDL files in an arbitrary directory.


author: JoungKyun.Kim <http://oops.org> 10:5.4.16-1.an2
changelog:
  - update 5.4.16
  - update pecl libevent 0.1.0
  - update sqlite extension 5.3.26

  - fixed official bugs
    . #64915 error_log ignored when daemonize=0
    . #64949 Buffer overflow in _pdo_pgsql_error
    . #64609 pg_convert enum type support
    . #64960 Segfault in gc_zval_possible_root
    . #64934 Apache2 TS crash with get_browser()
    . #64966 segfault in zend_do_fcall_common_helper_SPEC
    . #64997 Segfault while using RecursiveIteratorIterator on 64-bits systems
    . #64988 Class loading order affects E_STRICT warning
    . #53437 Crash when using unserialized DatePeriod instance
    . #63176 Segmentation fault when instantiate 2 persistent PDO to the same db server
    . #64936 doc comments picked up from previous scanner run
    . #64166 quoted-printable-encode stream filter incorrectly discarding whitespace
    . #64764 add support for FPM init.d script
    . #65066 Cli server not responsive when responding with 422 http status code
    . #64338 pdo_dblib can't connect to Azure SQL
    . #64808 FreeTDS PDO getColumnMeta on a prepared but not executed statement crashes
    . #63638 Cannot connect to SQL Server 2008 with PDO dblib
    . #48724 getColumnMeta() doesn't return native_type for BIT, TINYINT and YEAR

  - security issues
    . CVE-2013-2110 Heap based buffer overflow in quoted_printable_encode (#64879)


author: JoungKyun.Kim <http://oops.org> 10:5.4.16-2.an2
changelog:
  - revoke allow-call_time_pass_reference directive
  - no warning creative default object
    allow object declear as '$k->data = 3' without stdClsss declear

  - fixed official bugs
    . #55694 Expose attempted_completion_over variable from readline library


author: JoungKyun.Kim <http://oops.org> 10:5.4.16-3.an2
changelog:
  - fixed official bugs
    . #65108 is_callable() triggers Fatal Error
    . #62672 Error on serialize of ArrayObject
    . #60732 php_error_docref links to invalid pages
    . #65228 FTPs memory leak
    . #65227 Memory leak in gmp_cmp second parameter
    . #64467 Segmentation fault after imap_reopen failure
    . #35703 when session_name("123") consist only digits, should warning
    . #49175 mod_files.sh does not support hash bits
    . #62535 $_SESSION[$key]["cancel_upload"] doesn't work as documented
    . #64802 openssl_x509_parse fails to parse subject properly in some cases
    . #62964 Possible XSS on "Registered stream filters" info

  - security issues
    . CVE-2013-4113 heap corruption in xml parser (#65236)
    . CVE-2013-4248 Fixed handling null bytes in subjectAltName


author: JoungKyun.Kim <http://oops.org> 10:5.4.23-1.an2
changelog:
  - update 5.4.23

  - security issues
    . CVE-2013-6420 Fixed memory corruption in openssl_x509_parse()

  - fixed offcial bugs
    . #49634 Segfault throwing an exception in a XSL registered function
    . #66321 ZipArchive::open() ze_obj->filename_len not real
    . #64405 Use freetype-config for determining freetype2 dir(s)
    . #66229 128.0.0.0/16 isn't reserved any longer
    . #65873 Integer overflow in exif_read_data()
    . #65196 Passing DOMDocumentFragment to DOMDocument::saveHTML() Produces invalid Markup
    . #63391 Incorrect/inconsistent day of week prior to the year 1600
    . #65199 Wrong Day of Week
    . #66060 Heap buffer over-read in DateInterval
    . #61645 fopen and O_NONBLOCK
    . #31131 Fixed invalid C code in zend_strtod


author: JoungKyun.Kim <http://oops.org> 10:5.4.23-2.an2
changelog:
  - php 5.3 호환 모드 제공: php53_compatible ini 옵션 추가
    . On 설정시, 다음의 기능이 php 5.3 호환모드로 동작
    . allow_call_time_pass_reference 지시자 사용 가능 (Default: Off)
    . magic_quotes_gpc, magic_quotes_runtime, magic_quotes_sybase 지시자
      및 magic_quotes 관련 함수 사용 가능 (기본값: Off)
    . NULL, false, 빈문자열의 값을 가진 변수에 object property를 추가할
      경우에도 E_WARNING 에러 메시지 발생 하지 않음
    . TZ 환경 변수로 timezone 지정 가능
    . array_combine() 함수에서 key array가 비었을 경우 false 반환
    . 5.4에서 제거된 다음의 함수 사용 가능 (E_DEPRECATED level 에러 처리)
      session_is_registered(), session_register(), session_unregister()
      mysqli_bind_param(), mysqli_bind_result(), mysqli_client_encoding(),
      mysqli_fetch(), mysqli_param_count(), mysqli_get_metadata(),
      mysqli_send_long_data(), mysqli::client_encoding()

  - fixed official bugs
    . Fixed SNMP_ERR_TOOBIG handling for bulk walk operations.


author: JoungKyun.Kim <http://oops.org> 10:5.4.24-1.an2
changelog:
  - update 5.4.24

  - fixed official bugs
    . #66286 Incorrect object comparison with inheritance
    . #66509 copy() arginfo has changed starting from 5.4
    . #66481 Calls to session_name() segfault when session.name


