Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72692
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.169 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAHMUw2ERkK_9AfyMknH+x5=nP2oOBEbU=N7xhhQxONz=rr60jQ@mail.gmail.com>
References: <CAHMUw2ERkK_9AfyMknH+x5=nP2oOBEbU=N7xhhQxONz=rr60jQ@mail.gmail.com>
Date: Wed, 19 Feb 2014 01:46:24 +0100
Message-ID: <CAH-PCH68OLg+xwnqt7MgNyJizhSyAum=WtijQ-5FC7-JnvQNJw@mail.gmail.com>
To: Tjerk Meesters <tjerk.meesters@gmail.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7bf1651cdd55e804f2b7b700
Subject: Re: [PHP-DEV] Re: private bug reports
From: tyra3l@gmail.com (Ferenc Kovacs)

--047d7bf1651cdd55e804f2b7b700
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Tue, Feb 18, 2014 at 8:43 PM, Tjerk Meesters <tjerk.meesters@gmail.com>w=
rote:

> Hi,
>
> I was recently answering a question about null byte injection into PCRE a=
nd
> the OP claimed that a pattern such as "~.+~e\x00u" would be accepted; the=
y
> were using 5.3.
>
> The commit that fixed it was this:
>
> https://github.com/php/php-src/commit/8b3c1a380a182655113b94b0b96551e98d0=
5a8d3
>
> The corresponding (private) bug is: https://bugs.php.net/bug.php?id=3D558=
56
>
> My question is whether there's a defined "time out period" after which
> those kind of sensitive bug reports are opened to the public; is it done
> once we hit EOL for that branch?
>
>
> --
> --
> Tjerk
>

AFAIK it should be opened after we have a release with the fix announced,
as there is no point in having a reference to a private bug in the release
announcement/Changelog.

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--047d7bf1651cdd55e804f2b7b700--