1
0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Commit Graph

138731 Commits

Author SHA1 Message Date
Niels Dossche
7aeafe4bae Merge branch 'PHP-8.4'
* PHP-8.4:
  Fix GH-16406: Assertion failure in ext/phar/phar.c:2808
2024-10-17 21:24:13 +02:00
Niels Dossche
d8e516631f Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16406: Assertion failure in ext/phar/phar.c:2808
2024-10-17 21:24:08 +02:00
Niels Dossche
25817ad298 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16406: Assertion failure in ext/phar/phar.c:2808
2024-10-17 21:23:47 +02:00
Niels Dossche
6a8d0a054d Fix GH-16406: Assertion failure in ext/phar/phar.c:2808
When copying entries during conversion in phar_convert_to_other(), the
header offset is not reset. This didn't matter in the past as it wasn't
used anyway in the particular use-case, but since 1bb2a4f9 this is
actually used and sanity-checked.

Closes GH-16470.
2024-10-17 21:23:17 +02:00
Niels Dossche
a73754fece Merge branch 'PHP-8.4'
* PHP-8.4:
  Fix various document ref pointer mismanagements
2024-10-17 21:21:56 +02:00
Niels Dossche
81a2cd4dac Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix various document ref pointer mismanagements
2024-10-17 21:21:49 +02:00
Niels Dossche
5cb38e9d24 Fix various document ref pointer mismanagements
- Properly handle attributes
- Fix potential NULL dereference if the intern document pointer is NULL

Fixes GH-16336.
Fixes GH-16338.
Closes GH-16345.
2024-10-17 21:18:50 +02:00
Ilija Tovilo
ee41549263 Merge branch 'PHP-8.4'
* PHP-8.4:
  Revert undoing of partial spl_filesystem_object initialization
2024-10-17 18:44:50 +02:00
Ilija Tovilo
1c542af144 Revert undoing of partial spl_filesystem_object initialization
We're intentionally not initializing spl_filesystem_object.u.dir.entry, as it
will later be initialized, and we don't need to zero the entire buffer anyway.
2024-10-17 18:44:06 +02:00
Ilija Tovilo
76138d6f0f Merge branch 'PHP-8.4'
* PHP-8.4:
  Fix uaf in SplFixedArray::unset()
2024-10-17 18:26:01 +02:00
Ilija Tovilo
c82cea0c34 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix uaf in SplFixedArray::unset()
2024-10-17 18:25:56 +02:00
Ilija Tovilo
0932b76d02 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix uaf in SplFixedArray::unset()
2024-10-17 18:25:33 +02:00
Ilija Tovilo
7fe168d855 Fix uaf in SplFixedArray::unset()
Fixes GH-16478
Closes GH-16481
2024-10-17 18:23:55 +02:00
Ilija Tovilo
9cb0f03808 Merge branch 'PHP-8.4'
* PHP-8.4:
  Fix use-after-free in SplObjectStorage::setInfo()
2024-10-17 18:21:57 +02:00
Ilija Tovilo
6d6b20f561 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix use-after-free in SplObjectStorage::setInfo()
2024-10-17 18:21:51 +02:00
Ilija Tovilo
40e43ffd41 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix use-after-free in SplObjectStorage::setInfo()
2024-10-17 18:21:31 +02:00
Ilija Tovilo
12c987fae2 Fix use-after-free in SplObjectStorage::setInfo()
Fixes GH-16479
Closes GH-16482
2024-10-17 18:20:42 +02:00
Calvin Buckley
84d6cb8cf0 Unify headers already sent/session already started error handler (#16451)
* Unify headers already sent errors

Now whenever we need to check where headers were already sent in
ext/session, we call a single location that prints where, keeping it
consistent output wise.

* Unify session aready started errors

Similar to the one for headers.

* Also change session active checks too

This usually go hand in hand with the headers already sent checks, but
is in a separate commit because of the amount of tests it changes.
2024-10-17 13:13:56 -03:00
Dmitry Stogov
39fa9cfd1a Merge branch 'PHP-8.4'
* PHP-8.4:
  Add test for GH-16355 (fixed by previous commit)
  Update IR
  UPGRADING: Fix `IntlTimeZone::getIanaID` new method notice
2024-10-17 17:39:54 +03:00
Dmitry Stogov
c98c198623 Add test for GH-16355 (fixed by previous commit) 2024-10-17 17:37:52 +03:00
Dmitry Stogov
6896756929 Update IR
IR commit: abbdbf2ad7f66b02106f3b51602a21f10f508808
2024-10-17 17:31:47 +03:00
Ayesh Karunaratne
951dab74fa UPGRADING: Fix IntlTimeZone::getIanaID new method notice
This was previously written as `IntlDateFormatter::getIanaID()`, but
the new method is added to the `IntlTimeZone` class.

[skip ci]
2024-10-17 19:31:47 +07:00
Dmitry Stogov
95dbc33fb2 Merge branch 'PHP-8.4'
* PHP-8.4:
  Making zend_hash_str_find_ptr_lc && zend_hash_find_ptr_lc C++ friendly (#16476)
2024-10-17 15:18:44 +03:00
Kasey Jenkins
cf3ecfff25 Making zend_hash_str_find_ptr_lc && zend_hash_find_ptr_lc C++ friendly (#16476) 2024-10-17 15:18:14 +03:00
Christoph M. Becker
3351daee61 Merge branch 'PHP-8.4'
* PHP-8.4:
  Download enchant dict from downloads.php.net
2024-10-17 00:56:29 +02:00
Christoph M. Becker
89f10e6e92 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Download enchant dict from downloads.php.net
2024-10-17 00:55:59 +02:00
Christoph M. Becker
5dba6aebaa Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Download enchant dict from downloads.php.net
2024-10-17 00:55:20 +02:00
Christoph M. Becker
5ef3fe218c Download enchant dict from downloads.php.net
Since windows.php.net is in the progress to be migrated to
downloads.php.net anyway, we may as well fetch the dictionary from the
new site right away.

Closes GH-16310.
2024-10-17 00:55:04 +02:00
Ilija Tovilo
1a2b370ad6 Merge branch 'PHP-8.4'
* PHP-8.4:
  Fix uaf in SplDoublyLinkedList::offsetSet()
2024-10-16 23:05:55 +02:00
Ilija Tovilo
d15e227750 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix uaf in SplDoublyLinkedList::offsetSet()
2024-10-16 23:05:36 +02:00
Ilija Tovilo
e5d837ca79 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix uaf in SplDoublyLinkedList::offsetSet()
2024-10-16 23:05:15 +02:00
Ilija Tovilo
8820a10360 Fix uaf in SplDoublyLinkedList::offsetSet()
Write to the new offset before calling the destructor of the previous value.

Fixes GH-16464
Closes GH-16466
2024-10-16 23:04:03 +02:00
Ilija Tovilo
ec152105f2 Merge branch 'PHP-8.4'
* PHP-8.4:
  Disallow asymmetric visibility on static properties
2024-10-16 23:00:41 +02:00
Ilija Tovilo
a8bbc84551 Disallow asymmetric visibility on static properties
This check was forgotten in the original implementation. Relaxing this
restriction shouldn't be hard, but needs some work. We either need to prevent
merging of cache slots for R/RW/W, or we need to introduce an additional check
when writing to the property indirectly. This check is currently present only
for direct writes.

Closes GH-16462
2024-10-16 23:00:11 +02:00
Niels Dossche
1083872a08 Merge branch 'PHP-8.4'
* PHP-8.4:
  Fix GH-16465: Heap buffer overflow in DOMNode->getElementByTagName
2024-10-16 22:55:29 +02:00
Niels Dossche
d70f3ba9a5 Fix GH-16465: Heap buffer overflow in DOMNode->getElementByTagName
If the input contains NUL bytes then the length doesn't match the actual
duplicated string's length. Note that libxml can't handle this properly
anyway so we just reject NUL bytes and too long strings.

Closes GH-16467.
2024-10-16 22:55:18 +02:00
Tim Düsterhus
cb6025cdac curl: Add curl_multi_get_handles() (#16363)
see https://curl.se/libcurl/c/curl_multi_get_handles.html
2024-10-16 16:24:04 +02:00
Christoph M. Becker
b7fd773cc6 Refactor zlib dictionary processing (GH-16407)
Co-authored-by: Tim Düsterhus <tim@bastelstu.be>
2024-10-16 12:21:50 +02:00
Dmitry Stogov
6d9f040d29 Stop trace recording only on ENTER to FAKE_CLOSURE (continue on EXIT) (#16455) 2024-10-16 12:26:40 +03:00
Christoph M. Becker
99aa43a65a Merge branch 'PHP-8.4'
* PHP-8.4:
  Fix GH-16433: Large values for openssl_csr_sign() $days overflow
2024-10-16 11:10:43 +02:00
Christoph M. Becker
ef1c3b82ff Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16433: Large values for openssl_csr_sign() $days overflow
2024-10-16 11:10:12 +02:00
Christoph M. Becker
931762c626 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16433: Large values for openssl_csr_sign() $days overflow
2024-10-16 11:09:00 +02:00
Christoph M. Becker
2bdf2f9100 Fix GH-16433: Large values for openssl_csr_sign() $days overflow
The `offset_sec` parameter of `X509_gmtime_adj()` expects a `long`, but
the `$days` parameter of `openssl_csr_sign()` a `zend_long`.  We must
avoid signed integer overflow (UB), but also must not silently truncate.
Thus we check the given `$days` for the permissible range, and bail out
otherwise.

Closes GH-16437.
2024-10-16 11:08:02 +02:00
Dmitry Stogov
097edc86c8 Allow JIT for passing arguments to trampolines and "bad" functions (#16365)
* Better trace coverage (JIT trampoline calls)

* clenup trampoline by zend_jit_free_trampoline()

* Fix ZEND_JIT_TRACE_INIT_CALL/ZEND_JIT_TRACE_DO_ICALL num_args mismatch

It may be caused by SEND_UNPACK/SEND_ARRAY

* cleanup

* cleanup

* Don't record function that may be temporary

* cleanup

* Prevent invalid run_time_cache allocation for "bad" internal functions

* Update zend_jit_trace_record_fake_init_call_ex() accordingly

* Better handling of "bad" functions and fake closures
2024-10-15 22:31:05 +03:00
Gina Peter Banyard
2d9eb54732 Merge branch 'PHP-8.4'
* PHP-8.4:
  [skip ci] Group similar entries in UPGRADING (#16420)
2024-10-15 19:39:00 +01:00
Gina Peter Banyard
9a4ec4015a [skip ci] Group similar entries in UPGRADING (#16420)
* [skip ci] Group similar entries in UPGRADING

This groups together:
- Class constants being typed
- Resource to object conversions
- New warnings and exceptions

Drive-by wording improvements
---------

Co-authored-by: Christoph M. Becker <cmbecker69@gmx.de>
2024-10-15 19:38:19 +01:00
Niels Dossche
5e2e49af82 Merge branch 'PHP-8.4'
* PHP-8.4:
  [ci skip] Fix UPGRADING section
2024-10-15 19:24:04 +02:00
Niels Dossche
0be5dd129e [ci skip] Fix UPGRADING section 2024-10-15 19:23:55 +02:00
Christoph M. Becker
dbdcc95c9c Merge branch 'PHP-8.4'
* PHP-8.4:
  Fix GH-16411: gmp_export() can cause overflow
2024-10-15 16:00:26 +02:00
Christoph M. Becker
b1fbdd8a67 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16411: gmp_export() can cause overflow
2024-10-15 15:59:53 +02:00