1
0
mirror of https://github.com/php/php-src.git synced 2026-03-29 19:52:20 +02:00
Commit Graph

5523 Commits

Author SHA1 Message Date
Christoph M. Becker
e98a7a68b7 Fix bugtracker URL
The php-src bugtracker is now on Github.

Closes GH-8102.
2022-02-15 19:14:07 +01:00
Till Backhaus
29fe06fa59 Fix bug #76109: Implement fpm_scoreboard_copy
fpm_scoreboard_copy locks the scoreboard while copying the scoreboard and all
proc scoreboards. proc scoreboards are locked one by one while copying each
struct. The old implementation (inside fpm_handle_status_request) only briefly
locked the scoreboard while copying the scorebard.

Closes GH-7931

Co-authored-by: Jakub Zelenka <bukka@php.net>
2022-02-09 23:02:45 +00:00
David Carlier
c99a026c9c Fix memory leak on invalid port
Closes GH-7911.
2022-01-08 21:04:55 +01:00
David Carlier
cb3d858745 Fix buffer allocations in zlog_stream_set_msg_suffix()
If that code was used, there would be a UAF scenario.

Closes GH-7835.
2021-12-28 13:27:54 +01:00
Jakub Zelenka
81513e6285 Add skip for FPM process idle flaky test 2021-11-27 22:37:43 +00:00
Jakub Zelenka
2f8407f185 Increase read timeout in FPM process idle test 2021-11-20 20:42:19 +00:00
Jakub Zelenka
fc67967190 Increase script sleep in FPM process idle test 2021-11-20 20:42:19 +00:00
Nikita Popov
e81ad637f4 Update reflection test after stub change 2021-11-18 11:16:13 +01:00
Jakub Zelenka
ec3d4409a4 Merge branch 'PHP-7.4' into PHP-8.0 2021-11-14 20:10:42 +00:00
Jakub Zelenka
b2cf9b7ec7 Fix bug #81513 (Future possibility for heap overflow in FPM zlog)
This fixes currently unused code path in zlog that could lead to
the heap overflow in the future.
2021-11-14 20:08:57 +00:00
David Carlier
b1e6fdefd4 Fix leaks for AppArmor based distros in case the profile creation fails
Closes GH-7646.
2021-11-12 14:25:52 +01:00
Nikita Popov
b302bfabe7 Implement Stringable automatically for internal classes
Requiring all internal classes (including those from 3rd-party
extensions) to implement Stringable if they provide __toString()
is too error prone. Case in point, our _ZendTestClass test class
was not doing so, resulting in preloading test failures after
recent changes.

Instead we automatically implement Stringable, the same as we do
for userland classes. We still allow explicit implementations,
but ignore them (normally they would result in an error due to
duplicate interface implementation). Finally, we need to be
careful about not trying to implement Stringable on Stringable
itself.

In some cases this changes the interface order, in particular the
automatic Stringable implementation will now come first.
2021-11-05 10:22:04 +01:00
Jakub Zelenka
fadb1f8c1d Fix bug #81026 (PHP-FPM oob R/W in root process leading to priv escalation)
The main change is to store scoreboard procs directly to the variable sized
array rather than indirectly through the pointer.

Signed-off-by: Stanislav Malyshev <stas@php.net>
2021-10-18 15:06:36 -07:00
Jakub Zelenka
cb2021e5f6 Fix bug #81026 (PHP-FPM oob R/W in root process leading to priv escalation)
The main change is to store scoreboard procs directly to the variable sized
array rather than indirectly through the pointer.

Signed-off-by: Stanislav Malyshev <stas@php.net>
2021-10-17 20:16:10 -07:00
Christoph M. Becker
b7f3b67060 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #81518: Header injection via default_mimetype / default_charset
2021-10-14 12:21:35 +02:00
Christoph M. Becker
365769366b Fix #81518: Header injection via default_mimetype / default_charset
We forbid setting these INI options to values containing NUL bytes, CR
or LF.

Closes GH-7574.
2021-10-14 12:16:19 +02:00
Lauri Kenttä
cdcdb33080 Fix #81496: CLI server logs wrong request method 2021-10-05 08:42:38 +02:00
Nikita Popov
a00d933242 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Disable failing FPM test
2021-10-04 23:31:31 +02:00
Nikita Popov
4c01bd2ade Disable failing FPM test
Test fails intermittently, e.g.:

https://dev.azure.com/phpazuredevops/PHP/_build/results?buildId=20597&view=ms.vss-test-web.build-test-results-tab&runId=475324&resultId=115501&paneView=debug

Possibly this is because the two requests end up being processed
in sequence and no second process is spawned.
2021-10-04 23:30:14 +02:00
Jakub Zelenka
9ed95846a3 Merge branch 'PHP-7.4' into PHP-8.0 2021-10-04 21:55:21 +01:00
Jakub Zelenka
66a655fdf4 Add the actual test for FPM prod idle timeout test with 6s sleep 2021-10-04 21:54:32 +01:00
Jakub Zelenka
2cd69115d5 Merge branch 'PHP-7.4' into PHP-8.0 2021-10-04 21:53:34 +01:00
Jakub Zelenka
edfb347019 Add FPM prod idle timeout test with 6s sleep 2021-10-04 21:50:57 +01:00
Nikita Popov
987aee10a9 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Revert "Add FPM prod idle timeout test"
2021-10-04 10:16:53 +02:00
Nikita Popov
69514e6ffb Revert "Add FPM prod idle timeout test"
This reverts commit 08f52b1643.

The newly added test fails.
2021-10-04 10:16:20 +02:00
Jakub Zelenka
ca3f20209f Merge branch 'PHP-7.4' into PHP-8.0 2021-10-02 18:27:47 +01:00
Jakub Zelenka
08f52b1643 Add FPM prod idle timeout test 2021-10-02 18:26:18 +01:00
Christoph M. Becker
4645a9d10f Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #81305: Built-in Webserver Drops Requests With "Upgrade" Header
2021-07-29 13:28:52 +02:00
Christoph M. Becker
d1ccb5bd0c Fix #81305: Built-in Webserver Drops Requests With "Upgrade" Header
While our HTTP parser supports upgrade requests, the code using it does
not.  Since upgrade requests are only valid for HTTP/1.1 and we neither
support any higher version, nor HTTPS yet, we do not exit early in case
of such requests, i.e. we ignore them, what is allowed by the specs.

We keep the supporting code in case we can meaningfully support upgrade
requests in the future.

Closes GH-7316.
2021-07-29 13:16:15 +02:00
Christoph M. Becker
bb4dbbc150 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #80849: HTTP Status header truncation
2021-07-15 19:13:58 +02:00
Christoph M. Becker
a054ef2aad Fix #80849: HTTP Status header truncation
While truncating the contents of a header is okay, we must never omit
the trailing CRLF.

Closes GH-7238.
2021-07-15 19:10:53 +02:00
Christoph M. Becker
1631b96b4b exit_status is no longer a true global 2021-07-12 23:39:10 +02:00
Christoph M. Becker
0c0ecf0470 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #73226: --r[fcez] always return zero exit code
2021-07-12 23:12:19 +02:00
Christoph M. Becker
9db3eda2cb Fix #73226: --r[fcez] always return zero exit code
This makes the behavior consistent with `--ri`, and is likely useful
for scripting.

Closes GH-7221.
2021-07-12 23:09:28 +02:00
Christoph M. Becker
9b7b4c47d6 Fix new test for PHP 8 2021-06-30 16:48:31 +02:00
Christoph M. Becker
70b0330e53 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #73630: Built-in Weberver - overwrite $_SERVER['request_uri']
2021-06-30 16:15:50 +02:00
Christoph M. Becker
d7db5701a3 Fix #73630: Built-in Weberver - overwrite $_SERVER['request_uri']
The built-in Webserver's `on_path`, `on_query_string` and `on_url`
callbacks may be called multiple times from the parser; we must not
simply replace the old values, but need to concatenate the new values
instead.

This appears to be tricky for `on_path` due to the path normalization,
so we fail if the function is called again.

The built-in Webserver logs errors during request parsing to stderr,
but this is ignored by the php_cli_server framework, and apparently the
Webserver does not send a resonse at all in such cases (instead of an
4xx).  Thus we can only check that a request with an overly long path
fails.

Closes GH-7207.
2021-06-30 16:13:08 +02:00
Joe Watkins
33a93b5ed7 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  missing ;
2021-05-11 11:10:52 +02:00
Joe Watkins
ef3e0ee08a missing ; 2021-05-11 11:10:38 +02:00
Joe Watkins
6ccbaa12e0 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  php-fpm: fix Solaris port events.mechanism
2021-05-11 11:07:47 +02:00
Petr Sumbera
04078a597c php-fpm: fix Solaris port events.mechanism
Bug #65800
Fix by: rainer.jung@kippdata.de
2021-05-11 11:01:38 +02:00
Christoph M. Becker
23a192d12d Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #67792: HTTP Authorization schemes are treated as case-sensitive
2021-04-23 15:57:11 +02:00
Christoph M. Becker
39ddf6b89c Fix #67792: HTTP Authorization schemes are treated as case-sensitive
We use `zend_binary_strncasecmp()` to avoid any locale issues, and
refactor.  We also add a test case for Digest authentication.

Closes GH-6900.
2021-04-23 15:54:17 +02:00
Nikita Popov
b0f030509a Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  PHPDBG: fix bug parsing 3-word opcodes
2021-04-22 10:12:25 +02:00
David Rans
054fad6d63 PHPDBG: fix bug parsing 3-word opcodes
PHPDBG won't parse opcodes correctly if they are more than two words
separated by underscores (as many opcodes, like ZEND_POST_INC, are).

Now opcodes that have more than one underscore (e.g. ZEND_POST_INC) are
parsed correctly.

Closes GH-6895.
2021-04-22 10:11:26 +02:00
Christoph M. Becker
0f40426450 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix misleading error message
2021-04-20 15:43:04 +02:00
Christoph M. Becker
263f14ac60 Fix misleading error message
Closes GH-6889.
2021-04-20 15:41:42 +02:00
Nikita Popov
ec24f14820 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix return type of sparc atomic helper
2021-04-13 14:37:18 +02:00
David Carlier
5ccb5fd91e Fix return type of sparc atomic helper
Closes GH-6808.
2021-04-13 14:36:58 +02:00
Jakub Zelenka
713b82131b Merge branch 'PHP-7.4' into PHP-8.0 2021-03-21 19:00:38 +00:00