1
0
mirror of https://github.com/php/php-src.git synced 2026-04-26 17:38:14 +02:00
Commit Graph

1198 Commits

Author SHA1 Message Date
Christoph M. Becker a53d67ceac Fix #77322: PharData::addEmptyDir('/') Possible integer overflow
`phar_path_check()` already strips a leading slash, so we must not
attempt to strip the trailing slash from an now empty directory name.

Closes GH-6508.
2020-12-15 11:44:53 +01:00
Christoph M. Becker 8588ae7215 Fix #75102: PharData says invalid checksum for valid tar
Apparently, there are broken tarballs out there which are actually in
ustar format, but did not write the `ustar` marker.  Since popular tar
tools like GNU tar and 7zip have no issues dealing with such tarballs,
Phar should also be more resilient.

Thus, when the first checksum check of a tarball in (presumed) in old-
style format fails, we check whether the checksum would be suitable for
ustar format; if so, we treat the tarball as being in ustar format.

Closes GH-6479.
2020-12-04 13:02:29 +01:00
Christoph M. Becker c283f53b24 Fix #73809: Phar Zip parse crash - mmap fail
Phar signatures practically are of limited size; for the MD5 and SHA
hashes the size is fixed (at most 64 bytes for SHA512); for OpenSSL
public keys there is no size limit in theory, but "64 KiB ought to be
good enough for anybody".  So we check for that limit, to avoid fatal
errors due to out of memory conditions.

Since it is neither possible to have the signature compressed in the
ZIP archive, nor is it possible to manually add a signature via Phar,
we use ZipArchive to create a suitable archive for the test on the fly.

Closes GH-6474.
2020-12-01 16:58:19 +01:00
Christoph M. Becker 658ad4d046 Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
  Skip test if A: drive exists
2020-09-03 10:30:39 +02:00
Christoph M. Becker c70a938f28 Skip test if A: drive exists
Otherwise the test case will fail for a very different reason.
2020-09-03 10:29:38 +02:00
Christoph M. Becker 9c3171f019 Fix #79797: Use of freed hash key in the phar_parse_zipfile function
We must not use heap memory after we freed it.
2020-08-03 01:09:44 -07:00
Stanislav Malyshev 5b29af5c78 Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2:
  Fix #79877: getimagesize function silently truncates after a null byte
  Fix #79797: Use of freed hash key in the phar_parse_zipfile function
2020-08-02 23:56:37 -07:00
Christoph M. Becker 7355ab8176 Fix #79797: Use of freed hash key in the phar_parse_zipfile function
We must not use heap memory after we freed it.
2020-08-02 15:31:29 -07:00
Nikita Popov 4902b1c554 Remove unnecessary "poo" rmdirs
"poo" was only used in the opendir_edgecases test, but rmdir'ed
in some other tests as well.

I've also taken the liberty of renaming this directory...
2020-06-05 16:26:09 +02:00
Nathan Porter ca7dcb88f3 Respect --program-prefix/suffix when installing phar
Currently ./configure --enable-phar --program-suffix=7.4 will
result in binaries named php7.4 and phar but should instead
result in php7.4 and phar7.4

Closes GH-5650.
2020-06-05 10:10:40 +02:00
Christoph M. Becker c705079b12 Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
  Fix #79503: Memory leak on duplicate metadata
2020-04-22 15:08:50 +02:00
Christoph M. Becker ccca2c448d Fix #79503: Memory leak on duplicate metadata
Duplicate metadata can only happen if someone tampers with the phar, so
we can and should treat that as error.
2020-04-22 15:07:46 +02:00
Christoph M. Becker b01b1f65e7 Fix # 79171: heap-buffer-overflow in phar_extract_file
We must not access memory outside of the allocated buffer.
2020-02-17 00:20:17 -08:00
Stanislav Malyshev bbcb8cab8c Fix bug #79082 - Files added to tar with Phar::buildFromIterator have all-access permissions 2020-02-17 00:20:17 -08:00
Christoph M. Becker 7df594b943 Fix # 79171: heap-buffer-overflow in phar_extract_file
We must not access memory outside of the allocated buffer.
2020-02-17 00:20:04 -08:00
Stanislav Malyshev 6facfa59a5 Fix bug #79082 - Files added to tar with Phar::buildFromIterator have all-access permissions 2020-02-17 00:19:30 -08:00
Stanislav Malyshev e5c95234d8 Fix bug #79082 - Files added to tar with Phar::buildFromIterator have all-access permissions 2020-02-16 22:38:38 -08:00
Nikita Popov 58b17906f5 Apply tidy formatting
Mostly reindent PHP scripts to spaces.
2020-02-03 13:41:31 +01:00
Christoph M. Becker e197f65b35 Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
  Fix #76584: PharFileInfo::decompress not working
2020-01-28 10:33:10 +01:00
Christoph M. Becker 136f51f1e1 Fix #76584: PharFileInfo::decompress not working
We actually have to decompress, when told to do so.
2020-01-28 10:31:36 +01:00
Dmitry Stogov 92c23e1fd3 Call zend_unregister_ini_entries() when unload extension loaded through dl() without MSHUTDOWN callback.
Extensions with MSHUTDOWN should use UNREGISTER_INI_ENTRIES().
2019-12-09 15:05:24 +03:00
Sara Golemon 15d7cd9e18 Silence undefined index warning when openssl not available. 2019-10-15 15:37:56 -04:00
Nikita Popov e4aac082a2 Merge branch 'PHP-7.3' into PHP-7.4 2019-10-10 16:14:52 +02:00
Nikita Popov 74ac3dd6e2 Merge branch 'PHP-7.2' into PHP-7.3 2019-10-10 16:14:37 +02:00
Nikita Popov 46561dab6a Fix leak in phar open 2019-10-10 16:14:21 +02:00
Stanislav Malyshev 4adf3dc109 Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
  Fix #77919: Potential UAF in Phar RSHUTDOWN
  Update NEWS
  Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
2019-07-29 13:20:52 -07:00
Stanislav Malyshev d69894734d Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2:
  Fix #77919: Potential UAF in Phar RSHUTDOWN
  Update NEWS
  Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
2019-07-29 13:20:44 -07:00
Stanislav Malyshev 284fb08fdc Merge branch 'PHP-7.1' into PHP-7.2
* PHP-7.1:
  Fix #77919: Potential UAF in Phar RSHUTDOWN
  Update NEWS
  Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
2019-07-29 13:19:16 -07:00
Christoph M. Becker cd1101e8c8 Fix #77919: Potential UAF in Phar RSHUTDOWN
We have to properly clean up in case phar_flush() is failing.

We also make the expectation of the respective test case less liberal
to avoid missing such bugs in the future.
2019-07-29 13:18:27 -07:00
Remi Collet 946a1e4314 Fix build warnings
- switch from strncpy to memcpy for -Wstringop-truncation
2019-07-25 11:50:44 +02:00
Nikita Popov d9680272c7 Revert "Drop free_filename field from zend_file_handle"
This reverts commit e0eca26285.

free_filename is used by the wincache extension, restore this
field for PHP 7.4.
2019-07-24 10:43:37 +02:00
George Peter Banyard 6d6d954d0d Cleanup of remaining E_STRICT in tests 2019-07-23 11:27:23 +02:00
Nikita Popov 5664035ffe Also report errors from Zend stream reader operation 2019-07-22 17:49:08 +02:00
Nikita Popov d59aac58b3 Report errors from stream read and write operations
The php_stream_read() and php_stream_write() functions now return
an ssize_t value, with negative results indicating failure. Functions
like fread() and fwrite() will return false in that case.

As a special case, EWOULDBLOCK and EAGAIN on non-blocking streams
should not be regarded as error conditions, and be reported as
successful zero-length reads/writes instead. The handling of EINTR
remains unclear and is internally inconsistent (e.g. some code-paths
will automatically retry on EINTR, while some won't).

I'm landing this now to make sure the stream wrapper ops API changes
make it into 7.4 -- however, if the user-facing changes turn out to
be problematic we have the option of clamping negative returns to
zero in php_stream_read() and php_stream_write() to restore the
old behavior in a relatively non-intrusive manner.
2019-07-22 17:17:28 +02:00
Peter Kokot b1643e166d Fix failed tests for phar
- when $status is boolean, E_NOTICE appears and tests fail
- opcache is never enabled on these tests anyway.
- Add opcache.revalidate_freq=0 to testing script

  Instead of checking this in the tests files it can be used directly in
  the main testing script. Also this fixes failed tests.

- Use opcache_invalidate() instead of sleep() delay in some tests. Some
  delays are still used since the opcache_invalidate seems to be buggy
  and not working as expected.

Closes GH-4392
2019-07-21 00:49:35 +02:00
Peter Kokot 7cbc6b6546 Remove safe_mode directive when installing ext/phar
Closes GH-4436
2019-07-19 00:02:12 +02:00
Nikita Popov 856c5d2837 Revert "Avoid unused fstat() call"
This reverts commit 5a90dc77b8.

Let's try to go with the reverse direction here and actually trust
the reported size...
2019-07-17 11:49:10 +02:00
Nikita Popov 5a90dc77b8 Avoid unused fstat() call
If we're including a file via PHP streams, we're not going to trust
the reported file size anyway and populate in a loop -- so don't
bother determining the file size in the first place. Only do this
for non-tty HANDLE_FP now, which is the only case where this
information was used.
2019-07-17 11:22:31 +02:00
Nikita Popov b317f0eb59 Remove ZEND_HANDLE_MAPPED
The buf/len members are now simply used in addition to the main
stream, without changing the handle kind.
2019-07-16 17:44:32 +02:00
Nikita Popov e0eca26285 Drop free_filename field from zend_file_handle
free_filename was always zero.
2019-07-16 17:07:26 +02:00
Nikita Popov 49bac9b77b Introduce zend_stream_init_filename()
Avoid more ad-hoc initialization of zend_file_handle structures.
2019-07-16 16:44:37 +02:00
Nikita Popov e08cc4d921 Remove ZEND_HANDLE_FD
This handle type was unused.
2019-07-16 15:47:10 +02:00
Nikita Popov 290e520c03 Use ZEND_HASH_FOREACH APIs in a few more places 2019-07-16 12:20:16 +02:00
Nikita Popov 709897c2a5 Remove unused tsrm_strtok_r() function
There is also a php_strtok_r() function, which is actually used,
but nothing uses the tsrm_strtok_r() variant...
2019-07-12 13:14:24 +02:00
Nikita Popov 07bbc54658 Fix file collisions in phar tests 2019-07-10 12:55:40 +02:00
Peter Kokot 839ff378bc Fix phar tests with hash extension
- The hash extension is now always available.

- Remove unfinished test
  The Phar::PGP currently doesn't exist yet.
2019-06-30 23:51:56 +02:00
Peter Kokot 033cafacbd Sync HAVE_HASH, HAVE_HASH_EXT, PHAR_HASH_OK symbols
The hash extension is always available since PHP-7.4. The symbol
HAVE_HASH_EXT is kept for BC reasons and removed in PHP-8.0.

This patch also removes the PHAR_HASH_OK since it is no longer
relevant.
2019-06-27 23:25:33 +02:00
Nikita Popov c7962207d7 Fix stream leak in phar cache_list 2019-06-25 14:28:58 +02:00
Nikita Popov 43dd1ac570 Avoid confusing gotos in phar_split_cache_list 2019-06-25 10:25:44 +02:00
Nikita Popov 31123de0c8 Fix EVP_PKEY leak in phar 2019-06-25 10:25:44 +02:00