# private bug reports

- Thread: https://externals.io/message/72691
- Original archive: https://news-web.php.net/php.internals/72691
- Started by Tjerk Meesters on 2014-02-18T19:43:29+00:00
- Messages: 6
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #72691 — Tjerk Meesters — 2014-02-18T19:43:29+00:00

URL: https://externals.io/message/72691#72691

Hi,

I was recently answering a question about null byte injection into PCRE and
the OP claimed that a pattern such as "~.+~e\x00u" would be accepted; they
were using 5.3.

The commit that fixed it was this:
https://github.com/php/php-src/commit/8b3c1a380a182655113b94b0b96551e98d05a8d3

The corresponding (private) bug is: https://bugs.php.net/bug.php?id=55856

My question is whether there's a defined "time out period" after which
those kind of sensitive bug reports are opened to the public; is it done
once we hit EOL for that branch?


-- 
--
Tjerk

---

## #72692 — Ferenc Kovacs — 2014-02-19T00:46:24+00:00

URL: https://externals.io/message/72691#72692 · In reply to: #72691

On Tue, Feb 18, 2014 at 8:43 PM, Tjerk Meesters <tjerk.meesters@gmail.com>wrote:

> Hi,
>
> I was recently answering a question about null byte injection into PCRE and
> the OP claimed that a pattern such as "~.+~e\x00u" would be accepted; they
> were using 5.3.
>
> The commit that fixed it was this:
>
> https://github.com/php/php-src/commit/8b3c1a380a182655113b94b0b96551e98d05a8d3
>
> The corresponding (private) bug is: https://bugs.php.net/bug.php?id=55856
>
> My question is whether there's a defined "time out period" after which
> those kind of sensitive bug reports are opened to the public; is it done
> once we hit EOL for that branch?
>
>
> --
> --
> Tjerk
>

AFAIK it should be opened after we have a release with the fix announced,
as there is no point in having a reference to a private bug in the release
announcement/Changelog.

-- 
Ferenc Kovács
@Tyr43l - http://tyrael.hu

---

## #72696 — Tjerk Meesters — 2014-02-20T01:40:29+00:00

URL: https://externals.io/message/72691#72696 · In reply to: #72692

>
>
>
> On Tue, Feb 18, 2014 at 8:43 PM, Tjerk Meesters <tjerk.meesters@gmail.com>wrote:
>
> > […]
>
> AFAIK it should be opened after we have a release with the fix announced,
> as there is no point in having a reference to a private bug in the release
> announcement/Changelog.
>

Thanks. If that's indeed the case, could someone please open the bug
report? :)


>
> --
> Ferenc Kovács
> @Tyr43l - http://tyrael.hu
>



-- 
--
Tjerk

---

## #72700 — Ferenc Kovacs — 2014-02-20T10:04:13+00:00

URL: https://externals.io/message/72691#72700 · In reply to: #72696

On Thu, Feb 20, 2014 at 2:40 AM, Tjerk Meesters <tjerk.meesters@gmail.com>wrote:

>
>
>
> 
>
> > […]
>
> Thanks. If that's indeed the case, could someone please open the bug
> report? :)
>
>
I've opened it up, thanks for spotting it.

-- 
Ferenc Kovács
@Tyr43l - http://tyrael.hu

---

## #72723 — Christoph Becker — 2014-02-20T21:18:31+00:00

URL: https://externals.io/message/72691#72723 · In reply to: #72700

Ferenc Kovacs wrote:

> > […]
>
> I've opened it up, thanks for spotting it.

Shouldn't the status be set to "closed"?

-- 
Christoph M. Becker

---

## #72726 — Yasuo Ohgaki — 2014-02-20T22:23:54+00:00

URL: https://externals.io/message/72691#72726 · In reply to: #72723

> > […]
> tjerk.meesters@gmail.com>
> > […]
>
> Shouldn't the status be set to "closed"?


Closed.

--
Yasuo Ohgaki
yohgaki@ohgaki.net