Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87999
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.180 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <55E610C1.1000203@gmail.com>
References: <55E610C1.1000203@gmail.com>
Date: Wed, 2 Sep 2015 07:17:51 +0900
Message-ID: <CAGa2bXa41Jsh4vfNF+r3Mj2mLqPjT-UcgNgGzQ2U-d6MhwoMNw@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Heads up: merging security patches to 7
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Stas,

There are many fixes regarding unserialize.
We also had many fixes regarding type mismatches.
I suppose many 3rd party modules have same issues.

How about have a doc for secure PHP internal coding?

--
Yasuo Ohgaki
yohgaki@ohgaki.net


On Wed, Sep 2, 2015 at 5:55 AM, Stanislav Malyshev <smalyshev@gmail.com> wrote:
> Hi!
>
> I've recently committed a number of fixes to 5.x branch. These fixes
> mainly concern (un)serialization scenarios, you can see the full list in
> 5.4/5.5 NEWS. These changes are not merged yet to master/7.0 since due
> to extensive differences between 5.x and 7 in zval handling, they
> basically must be rewritten for 7. I don't want to commit completely
> broken code to master, so I'll work on at least getting it to a state
> where there is no new breakage and then porting the fixes properly to 7,
> but that can take a couple of days. In the meantime, please be aware
> that 5.x and master may not be in full sync and exercise caution if you
> merge stuff from 5 to 7.
> --
> Stas Malyshev
> smalyshev@gmail.com
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>