The 'result' argument of fast_add_function() may alias with either
of its operands (or both). Take care not to write to 'result' before
reading op1 and op2.
The timeout argument to select() is modified to reflect the time
remaining when the function returns on a non-timeout condition.
Passing a pointer to const data and casting away the const-ness is
asking for trouble, but for some reason, this trouble manifests
itself only on non-x86 architectures [whose implementation of select()
in glibc is different from the one supplied for x86]
Fix this by passing a stack copy of the timeout argument to select()
if a mode like "rn" was passed to fopen(), then
php_stream_parse_fopen_modes() would assign O_WRONLY to
flags, because O_NONBLOCK tainted flags for the r/w/+ check
Dereferencing addition_modules within php_module_startup would
point to a vector entirely on the stack (which is of course, wrong).
Use a specialized helper to keep BC with the current php_module_startup()
calling semantics.
Fixes 63159
Thanks to @a-j-k
These were returned to the general allocation pool by RFC 3330, and hence
shouldn't cause an IP address validation failure due to being reserved. At
least 128.0.0.0/16 is in use on the public Internet today.
Fixes bug #66229 (128.0.0.0/16 isn't reserved any longer).
Passing DOMDocumentFragment to DOMDocument::saveHTML()
produces invalid markup, because a DocumentFragment is just a container
for child nodes and not a real node itself.
I'm not exactly sure whether this is the right way to fix it. The
question is whether Generator::throw() on a newborn generator (i.e.
a generator that is not yet at yield expression) should first advance to
the first yield and throw the exception there or whether it should
instead throw the exception in the caller's context.
The old behavior was to throw it at the start of the function (i.e.
the very first opcode), which causes issues like the one in #65764.
Effectively it's impossible to properly handle the exceptions in this
case.
For now I choose the variant where the generator advances to the
first yield before throwing, as that's consistent with how all other
methods on the Generator object currently behave. This does not
necessarily match the behavior in other languages, e.g. Python would throw
the exception in the caller's context. But then our send() method already
has this kind of deviation, so it stays internally consistent at least.
Ard Biesheuvel