📜 ⬆️ ⬇️

PHP 5.3.3 release

The PHP development team announced PHP 5.3.3. This release focuses on improving the stability and security of the PHP 5.3.x branch, fixing over 100 bugs, some of which are related to security. All users are encouraged to upgrade to this release.

Backward incompatible changes:


Methods with the same name as the last element of the class in the namespace will no longer be perceived as a constructor. This change will not affect classes outside the namespace.
Copy Source | Copy HTML <?php namespace Foo; class Bar { public function Bar() { // treated as constructor in PHP 5.3.0-5.3.2 // treated as regular method in PHP 5.3.3 } } ?>
  1. Copy Source | Copy HTML <?php namespace Foo; class Bar { public function Bar() { // treated as constructor in PHP 5.3.0-5.3.2 // treated as regular method in PHP 5.3.3 } } ?>
  2. Copy Source | Copy HTML <?php namespace Foo; class Bar { public function Bar() { // treated as constructor in PHP 5.3.0-5.3.2 // treated as regular method in PHP 5.3.3 } } ?>
  3. Copy Source | Copy HTML <?php namespace Foo; class Bar { public function Bar() { // treated as constructor in PHP 5.3.0-5.3.2 // treated as regular method in PHP 5.3.3 } } ?>
  4. Copy Source | Copy HTML <?php namespace Foo; class Bar { public function Bar() { // treated as constructor in PHP 5.3.0-5.3.2 // treated as regular method in PHP 5.3.3 } } ?>
  5. Copy Source | Copy HTML <?php namespace Foo; class Bar { public function Bar() { // treated as constructor in PHP 5.3.0-5.3.2 // treated as regular method in PHP 5.3.3 } } ?>
  6. Copy Source | Copy HTML <?php namespace Foo; class Bar { public function Bar() { // treated as constructor in PHP 5.3.0-5.3.2 // treated as regular method in PHP 5.3.3 } } ?>
  7. Copy Source | Copy HTML <?php namespace Foo; class Bar { public function Bar() { // treated as constructor in PHP 5.3.0-5.3.2 // treated as regular method in PHP 5.3.3 } } ?>
  8. Copy Source | Copy HTML <?php namespace Foo; class Bar { public function Bar() { // treated as constructor in PHP 5.3.0-5.3.2 // treated as regular method in PHP 5.3.3 } } ?>
  9. Copy Source | Copy HTML <?php namespace Foo; class Bar { public function Bar() { // treated as constructor in PHP 5.3.0-5.3.2 // treated as regular method in PHP 5.3.3 } } ?>

There is no stress on the transition from PHP 5.2 since namespaces were introduced only in PHP 5.3.

Security enhancements and fixes in PHP 5.3.3:


The var_export () function was rewritten using smart_str to bypass output buffering, in order to prevent data disclosure in the event of a fatal error. (CVE-2010-2531).
Fixed possible resource destruction issues in shm_put_var ().
Fixed possible information leakage due to the intervention of the operator XOR.
Fixed the possibility of memory damage due to the non-expected transmission of the argument by reference at the time of the call and subsequent mashing of the memory through callback functions.
The possibility of memory corruption in the ArrayObject :: uasort () method has been fixed.
The possibility of memory corruption in the parse_str () function has been fixed.
The possibility of memory corruption in the pack () function has been fixed.
The possibility of memory corruption in the substr_replace () function has been fixed.
Fixed the possibility of memory corruption in the addcslashes () function.
Fixed the possibility of stack overflow inside the fnmatch () function.
Fixed the possibility of buffer overflow dechunking filter.
Fixed the possibility of random access to the memory inside the sqlite extension.
Fixed the format of validation of strings inside the phar extension.
Fixed handling of serialization of session variables with certain prefix characters.
Fixed deletion of references to the null pointer when processing invalid XML-RPC requests.
Fixed problems with deserialization of the SplObjectStorage class.
Fixed possible buffer overflows in mysqlnd_list_fields, mysqlnd_change_user.
Fixed possible buffer overflows when processing packets with errors in mysqlnd.

Key improvements in PHP 5.3.3 include:


Updated to the sqlite installation package updated to version 3.6.23.1
Updated to PCRE installation package, to version 8.02
FastCGI Process Manager (FPM) added to SAPI.
Added mcrypt extension stream filters (ported from mcrypt_filter).
Added full_special_chars filter to ext / filter extension.
Fixed the possibility of error due to recursive activation of the garbage collector.
Fixed bug №52238 (crash when throwing an exception while the iterator_to_array function is running).
Fixed bug №52041 (Memory leak when writing to non-initialized when returning from a function).
Fixed bug №52060 (Memory leakage when transferring a circuit to the method_exists () function).
Fixed bug number 52001 (Error allocating memory after using variables).
Fixed bug №51723 (Content-length header is limited to 32-bit integer in Apache2 on the Windows platform).
Bug # 48930 (__COMPILER_HALT_OFFSET__ does not work correctly in PHP> = 5.3) has been fixed.
')

Full changelog:


- Updated included in the sqlite installation package, to version 3.6.23.1
- Updated included in the PCRE installation package, to version 8.02

- Added JSON_NUMERIC_CHECK option in json_encode () function, which translates numbers as strings into integers.
- Added stream_set_read_buffer function, which allows to set a buffer for read operations from a stream.
- Added filters streams extensions mcrypt (ported from mcrypt_filter).
- Added full_special_chars filter to ext / filter extension.
- Added an option for the number of unsolicited packets in the context of the socket for the stream_socket_server () function.
- Added fifth parameter in the openssl_encrypt () / openssl_decrypt () function
(string $ iv) to use a non-zero initialization vector.
With the implicit use of the zero initialization vector, a warning is sent.
- Added openssl_cipher_iv_length () function.
- FastCGI Process Manager (FPM) added to SAPI.
- Added common versions of Windows to the php_uname function and fixed support for unknown windows versions.
- Added support for Berkeley DB 5 to the DBA extension.
- Added support for copying to / from an array / file for the pdo_pgsql extension.
- Added inTransaction () method to PDO, with special support for Postgres.

- Changed classes in namespaces, so now the constructor can only be specified through __construct.
- Reset error state in PDO :: beginTransaction ().

- Implemented FR # 51295 (not existing SQLite3 :: busyTimeout)
- Implemented FR # 35638 (Adding date added to imap_fetch_overview function results).
- Rewritten var_export () function using smart_str to bypass output buffering, to prevent data disclosure in the event of a fatal error. (CVE-2010-2531).
- Fixed possible buffer overflows in mysqlnd_list_fields, mysqlnd_change_user.
- Fixed possible buffer overflows when processing packets with errors in mysqlnd.
- Fixed a very rare memory leak in mysqlnd, when attaching thousands of columns.
- Fixed a bug when calling a non-existent class method that inherits from PDOStatement and an instance of which was created directly, bypassing the creation of PDO methods.

- Fixed a memory leak by mistake in mcrypt_create_iv on the Windows platform.
- Fixed the possibility of error due to recursive activation of the garbage collector.
- Fixed possible problems with resource destruction in shm_put_var ().
- Fixed possible information leakage due to the intervention of the operator XOR.
- Fixed the possibility of memory damage due to the non-expected transmission of the argument by reference at the time of the call and subsequent mashing of the memory through callback functions.
- Fixed the possibility of memory corruption in the ArrayObject :: uasort () method.
- Fixed the possibility of memory corruption in the parse_str () function.
- Fixed the possibility of memory damage in the function pack ().
- Fixed the possibility of memory corruption in the function substr_replace ().
- Fixed the possibility of memory corruption in the addcslashes () function.
- Fixed the possibility of stack overflow inside the fnmatch () function.
- Fixed the possibility of buffer overflow dechunking filter.
- Fixed the possibility of random access to the memory inside the sqlite extension.
- Fixed the format for validating strings inside the phar extension.
- Fixed handling of serialization of session variables with certain prefix characters.
- Fixed deletion of references to the null pointer when processing non-valid XML-RPC requests.
- Fixed 64-bit integer overflow in the mhash_keygen_s2k () function.
- Fixed problems with deserialization of the SplObjectStorage class.
- Fixed ini setting mail.log when no file name was specified.

- Fixed bug №52317 (Segmentation error when using the mail () function on rhel 4.x (only 64 bits)).
- Fixed bug №52262 (json_decode () did not display errors when decoding invalid UTF-8).
- Fixed bug №52240 (the hash_copy () function did not copy the HMAC key, which caused incorrect results and PHP crashes).
- Fixed bug No. 52238 (crash when throwing an exception while the iterator_to_array function is running).
- Fixed error No. 52193 (the conversion of a circuit to an array resulted in an empty array).
- Fixed error # 52183 (the ReflectionFunction class displayed an incorrect number of arguments for function aliases).
- Fixed bug №52162 (removed the user defined variables of the request headers with numbers).
- Fixed bug №52160 (Incorrect E_STRICT level error when redefining the constructor).
- Fixed bug number 52138 (constants in the ini file as section names).
- Fixed bug number 52115 (mysqli_result :: fetch_all returns null, not an empty array).
- Fixed bug №52101 (garbage returned by dns_get_record () in the 'ipv6' field on the Windows platform).
- Fixed bug №52082 (reset character_set_client and character_set_connection after calling mysqli_change_user ())
- Fixed bug number 52043 (GD did not recognize the latest versions of the libJPEG library).
- Fixed bug №52041 (Memory leak when writing to non-initialized when returning from a function).
- Fixed bug №52060 (Memory leak when transferring a circuit to the method_exists () function).
- Fixed bug №52057 (ReflectionClass could not process class Closure).
- Fixed bug №52051 (case-sensitive handling of old-style constructors changed in 5.3+).
- Fixed bug №52037 (Error competitive assembly in installation programs).
- Fixed bug No. 52019 (lcov no longer supports the TESTS variable).
- Fixed bug №52010 (Restriction error open_basedir when the command vacuum).
- Fixed bug No. 52001 (Error allocating memory after using variables).
- Fixed bug №51991 (spl_autoload and support for * nix with namespaces).
- Fixed bug №51943 (AIX: several files were beyond the ANSI specification).
- Fixed bug №51911 (Memory leaks when calling ReflectionParameter :: getDefaultValue () of a constant array).
- Fixed bug №51905 (ReflectionParameter did not work if the default value array with access to self: :).
- Fixed error №51899 (parse error in the parse_ini_file () function when there is no newline character after the empty value).
- Fixed bug №51844 (checkdnsrr did not support any type of records except MX).
- Fixed bug №51827 (Wrong warning in the case when register_shutdown_function was called with an incorrect number of arguments).
- Fixed bug №51822 (Segmentation error with strange __destruct () for static class variables).
- Fixed error №51791 (the function constant () interrupted the execution after a failed attempt to check an unspecified constant).
- Fixed bug №51732 (__construct or open Fileinfo did not work with NULL).
- Fixed error №51725 (xmlrpc_get_type () returned true for incorrect dates).
- Fixed bug №51723 (Content-length header is limited to 32-bit integer in Apache2 on the Windows platform).
- Fixed bug №51721 (DOMNodeList and DOMNamedNodeMap are marked as Traversable).
- Fixed bug №51712 (checking mysql_mysqlnd_read_timeout_long should not work on MySQL4).
- Fixed bug №51697 (Unsafe operations in free_storage iterators SPL caused a crash during shutdown).
- Fixed bug №51690 (Phar :: setStub checked case-sensitive __HALT_COMPILER ()).
- Fixed bug №51688 (ini per dir fell if document root was specified incorrectly).
- Fixed bug №51671 (incorrect work of imagefill with small images).
- Fixed bug №51670 (getColumnMeta caused a segmentation error when re-executing the query after calling nextRowset).
- Fixed bug №51647 (Certificate file without a private key (private key in another file) did not work).
- Fixed bug №51629 (misleading error message CURLOPT_FOLLOWLOCATION).
- Fixed bug №51627 (script path was not correctly perceived).
- Fixed bug №51624 (crash when mysqli_options () was called).
- Fixed bug №51615 (PHP crashed when transferring incorrect HTML to SimpleXML).
- Fixed bug №51609 (pg_copy_to: incorrect results when using the fourth argument).
- Fixed bug №51608 (pg_copy_to: WARNING: non-standard use of \\ in string literal).
- Fixed error # 51607 (pg_copy_from did not allow specifying a schema in the table name argument).
- Fixed bug number 51605 (Mysqli - zombie links).
- Fixed error №51604 (line break at the end of the header was displayed at the beginning of the message).
- Fixed bug №51590 (uninstalled constant JSON_ERROR_UTF8).
- Fixed bug №51583 (Bus error due to incorrect location in mysqlnd).
- Fixed bug №51582 (Do not assume that UINT64_C will ever be available).
- Fixed bug №51577 (Uninitialized reference to memory in oci_bind_array_by_name).
- Fixed bug №51562 (The request timeout in mssql can not be changed under a separate request).
- Fixed bug №51552 (debug_backtrace () caused a segmentation error and / or memory problems).
- Fixed bug №51445 (incorrect / slow definition of * RECURSION * in var_dump ()).
- Fixed bug №51435 (Missing ifdef / logic errors in the encryption code can cause compilation errors).
- Fixed bug №51424 (the crypt () function hangs after the 3rd call).
- Fixed error №51394 (the error string is determined incorrectly if the error handler sends an exception).
- Fixed error №51393 (DateTime :: createFromFormat () did not work if the string with the format contains a time zone).
- Fixed bug №51347 (memory leak mysqli_close / connection).
- Fixed bug №51338 (substitution in the URL works even if the use_only_cookies parameter is set).
- Fixed error №51291 (oci_error did not report the last error, in the case when it was called twice).
- Fixed bug №51276 (php_load_extension () is absent when HAVE_LIBDL is not defined).
- Fixed bug №51273 (Faultstring property does not exist when faultstring is empty).
- Fixed bug №51269 (zlib.output_compression rewrote the Vary header).
- Fixed bug №51257 (CURL_VERSION_LARGEFILE incorrectly used after libcurl version 7.10.1).
- Fixed bug №51242 (Empty configuration setting mysql.default_port is no longer defined by default as 3306, but is defined as 0).
- Fixed bug №51237 (crash milter SAPI at startup).
- Fixed bug №51213 (pdo_mssql truncates the value of the money column).
- Fixed error №51190 (ftp_put () returns false upon successful transfer).
- Fixed bug №51183 (ext / date / php_date.c is not compiled using Sun Studio).
- Fixed bug №51176 (Static calls of non-static methods work like $ this->).
- Fixed bug №51171 (curl_setopt () does not display any errors or warnings in the case when a non-existent option is specified).
- Fixed bug №51128 (imagefill () does not work with large images).
- Fixed bug №51096 ('last day' and 'first day' are processed incorrectly when parsing lines with a date).
- Fixed bug №51086 (DBA DB4 does not work with Berkeley DB 4.8).
- Fixed bug №51062 (DBA DB4 uses erroneous headers and libraries).
- Fixed bug number 51026 (mysqli_ssl_set does not work).
- Fixed bug №51023 (filter does not support integer overflow in GCC 4.4).
- Fixed bug No. 50999 (access to neutral memory in dba_fetch ()).
- Fixed error # 50976 (Authorization for Soap headers is not allowed).
- Fixed error 50828 (DOMNotation is not a child class of DOMNode).
- Fixed error # 50810 (propert_exists does not work with private properties).
- Fixed error 50762 (in WSDL mode, the Soap header handler function is called only if specified in WSDL).
- Fixed bug # 50731 (Unmatched namespaces are sent to functions registered using spl_autoload_register).
- Fixed a bug number 50563 (Removed E_WARNING from the function parse_url).
- Fixed bug №50578 (incorrect thing (?) In phar.phar).
- Fixed error # 50555 (DateTime :: sub () allows relative time modifications).
- Fixed error # 50392 (date_create_from_format forces 6 numbers for the 'u' character formatting).
- Fixed error No. 50383 (Exceptions thrown in __call / __callStatic did not include the file and the line in the trace information).
- Fixed bug # 50358 (ext / phar / util.lo compilation error).
- Fixed bug №50101 (Intersection of local and global variable names).
- Fixed bug №51002 (fixed possible memory corruption with very long names).
- Fixed bug №49893 (crash when creating an instance of Zend_Mail_Storage_Pop3).
- Fixed error No. 49819 (STDOUT loses data with posix_isatty ()).
- Fixed bug №49778 (DateInterval :: format ("% a") is always zero in the case when the interval is created from a string in ISO format).
- Fixed bug №49700 (leaks in php_date.c memory with garbage collector enabled).
- Fixed a bug №49576 (FILTER_VALIDATE_EMAIL filter requires an update).
- Fixed bug №49490 (XPath namespace prefix conflict).
- Fixed bug №49429 (odbc_autocommit does not work).
- Fixed error No. 49320 (PDO returns null if SQLite connection fails).
- Fixed bug number 49234 (mysqli_ssl_set not found).
- Fixed bug №49216 (Reflection does not work correctly with the mysqli class).
- Fixed bug №49192 (PHP crashes in the case when the garbage collector is running on a COM object).
- Fixed error №49081 (Error DateTime :: diff () if the beginning is in January and the interval is more than 28 days).
- Fixed error №49059 (DateTime :: diff () repeats the previous sub ()) operation.
- Fixed bug №48983 (Incorrect DOMDocument encoding: saveHTMLFile).
- Fixed bug №48930 (__COMPILER_HALT_OFFSET__ does not work correctly in PHP> = 5.3).
- Fixed bug №48902 (Time Translation Database is outdated).
- Fixed bug No. 48781 (Circular garbage collector memory leak).
- Fixed error 48601 (xpath () returns FALSE for a legitimate request).
- Fixed error # 48361 (SplFileInfo :: getPathInfo should return the parent directory).
- Fixed error # 48289 (iconv_mime_encode () quoted-printable schema is broken).
- Fixed bug №47842 (sscanf () does not support 64-bit values).
- Fixed bug number 46111 (Some time zone identifiers can not be processed).
- Fixed bug №45808 (stream_socket_enable_crypto () blocks and eats processor resources).
- Fixed bug number 43233 (sasl support for ldap on the Windows platform).
- Fixed bug No. 35673 (formatOutput does not work with saveHTML).
- Fixed error number 333210 (getimagesize () cannot determine the width / height of some JPEG files).

Source: https://habr.com/ru/post/99858/


All Articles