--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/components/php/php56/patches/CVE-2015-7803.patch Sun Dec 13 13:51:42 2015 -0800
@@ -0,0 +1,25 @@
+# Source: upstream
+# https://bugs.php.net/bug.php?id=69720
+# http://git.php.net/?p=php-src.git;a=commit;h=d698f0ae51f67c9cce870b09c59df3d6ba959244
+# Patch adapted: using only source change, not binary test case.
+
+X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fphar%2Futil.c;h=69da7b9b89db376e46c1f4abfb107ea7ee155447;hp=2c41adf92a7eac5b20f6d33a9f6cccce5826e3bd;hb=d698f0ae51f67c9cce870b09c59df3d6ba959244;hpb=bb98ed600ab6787d9d367927d49439be9a83441e
+
+diff --git a/ext/phar/util.c b/ext/phar/util.c
+index 2c41adf..69da7b9 100644
+--- a/ext/phar/util.c
++++ b/ext/phar/util.c
+@@ -494,7 +494,11 @@ really_get_entry:
+ (*ret)->is_tar = entry->is_tar;
+ (*ret)->fp = phar_get_efp(entry, 1 TSRMLS_CC);
+ if (entry->link) {
+- (*ret)->zero = phar_get_fp_offset(phar_get_link_source(entry TSRMLS_CC) TSRMLS_CC);
++ phar_entry_info *link = phar_get_link_source(entry TSRMLS_CC);
++ if(!link) {
++ return FAILURE;
++ }
++ (*ret)->zero = phar_get_fp_offset(link TSRMLS_CC);
+ } else {
+ (*ret)->zero = phar_get_fp_offset(entry TSRMLS_CC);
+ }
+
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/components/php/php56/patches/CVE-2015-7804.patch Sun Dec 13 13:51:42 2015 -0800
@@ -0,0 +1,36 @@
+# Source: upstream
+# https://bugs.php.net/bug.php?id=70433
+# The initial patch mentioned in the bug report was undone and replaced with:
+# http://git.php.net/?p=php-src.git;a=commit;h=1ddf72180a52d247db88ea42a3e35f824a8fbda1
+# which is the source for this patch (adapted because we don't need to undo the
+# initial fix).
+
+diff --git a/ext/phar/util.c b/ext/phar/util.c
+index e7decda..303daed 100644
+--- a/ext/phar/util.c
++++ b/ext/phar/util.c
+@@ -1977,7 +1977,7 @@ void phar_add_virtual_dirs(phar_archive_data *phar, char *filename, int filename
+
+ while ((s = zend_memrchr(filename, '/', filename_len))) {
+ filename_len = s - filename;
+- if (FAILURE == zend_hash_add_empty_element(&phar->virtual_dirs, filename, filename_len)) {
++ if (!filename_len || FAILURE == zend_hash_add_empty_element(&phar->virtual_dirs, filename, filename_len)) {
+ break;
+ }
+ }
+diff --git a/ext/phar/zip.c b/ext/phar/zip.c
+index 142165c..e4883d3 100644
+--- a/ext/phar/zip.c
++++ b/ext/phar/zip.c
+@@ -396,7 +396,9 @@ foundit:
+
+ if (entry.filename[entry.filename_len - 1] == '/') {
+ entry.is_dir = 1;
+- entry.filename_len--;
++ if(entry.filename_len > 1) {
++ entry.filename_len--;
++ }
+ entry.flags |= PHAR_ENT_PERM_DEF_DIR;
+ } else {
+ entry.is_dir = 0;
+