1
0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Commit Graph

135014 Commits

Author SHA1 Message Date
David Carlier
aa38bbed40 Merge branch 'PHP-8.2' into PHP-8.3 2024-10-25 14:05:07 +01:00
David Carlier
e0a0e216a9 ext/gmp: gmp_pow fix FPE with large values.
even without sanitizers, it is reproducible but with the following

```
<?php
$g = gmp_init(256);
var_dump(gmp_pow($g, PHP_INT_MAX));
```

we get this

```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==286922==ERROR: AddressSanitizer: FPE on unknown address 0x03e8000460ca (pc 0x7faf6c69de5c bp 0x400000000000004 sp 0x7ffe9843c740 T0)
    #0 0x7faf6c69de5c in __pthread_kill_implementation nptl/pthread_kill.c:44
    #1 0x7faf6c649c81 in __GI_raise ../sysdeps/posix/raise.c:26
    #2 0x7faf6db9386c in __gmp_exception (/lib/x86_64-linux-gnu/libgmp.so.10+0xd86c) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
    #3 0x7faf6db938d3 in __gmp_overflow_in_mpz (/lib/x86_64-linux-gnu/libgmp.so.10+0xd8d3) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
    #4 0x7faf6dbac95c in __gmpz_realloc (/lib/x86_64-linux-gnu/libgmp.so.10+0x2695c) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
    #5 0x7faf6dba9038 in __gmpz_n_pow_ui (/lib/x86_64-linux-gnu/libgmp.so.10+0x23038) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
    #6 0x5565ae1ccd9f in zif_gmp_pow /home/dcarlier/Contribs/php-src/ext/gmp/gmp.c:1286
    #7 0x5565aee96ea9 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:1312
    #8 0x5565af144320 in execute_ex /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:56075
    #9 0x5565af160f07 in zend_execute /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:60439
    #10 0x5565aed6fafe in zend_execute_scripts /home/dcarlier/Contribs/php-src/Zend/zend.c:1842
    #11 0x5565aeae70a8 in php_execute_script /home/dcarlier/Contribs/php-src/main/main.c:2578
    #12 0x5565af532f4e in do_cli /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:964
    #13 0x5565af535877 in main /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:1334
    #14 0x7faf6c633d67 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #15 0x7faf6c633e24 in __libc_start_main_impl ../csu/libc-start.c:360
    #16 0x5565adc04040 in _start (/home/dcarlier/Contribs/php-src/sapi/cli/php+0x2604040) (BuildId: 949049955bdf8b7197390b1978a1dfc3ef6fdf38)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE nptl/pthread_kill.c:44 in __pthread_kill_implementation
==286922==ABORTING
```

close GH-16384
2024-10-25 14:04:47 +01:00
Arnaud Le Blanc
f3e87e2a6d Fix tests: Prevent stack overflow during dtor
On s390x the stack is smaller and/or the object dtor code uses more stack,
which causes the destruction of deeply nested objects to crash in these
tests. Here I ensure that objects are released one by one at the end of the
tests to avoid recursive dtor.

Closes GH-16561
Fixes GH-16528
2024-10-24 15:56:25 +02:00
Niels Dossche
6d6afd9a83 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16559: UBSan abort in ext/gd/libgd/gd_interpolation.c:1007
2024-10-23 20:09:39 +02:00
Niels Dossche
e1e1e64a32 Fix GH-16559: UBSan abort in ext/gd/libgd/gd_interpolation.c:1007
The `uchar_clamp` function was backported from old code, this backports
it from new code.

Closes GH-16562.
2024-10-23 20:09:12 +02:00
Ilija Tovilo
301cda932b Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [skip ci] Add unused asan param to configure-x64 action
2024-10-23 19:16:19 +02:00
Ilija Tovilo
9b7c506218 [skip ci] Add unused asan param to configure-x64 action
This param is passed by nightly to all branches. Add a unused argument to older
branches to avoid a warning.
2024-10-23 19:14:58 +02:00
Niels Dossche
e4010fcf95 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [ci skip] Update EXTENSIONS and CODEOWNERS for ext/soap (#16542)
2024-10-22 20:14:51 +02:00
Niels Dossche
5c210428f3 [ci skip] Update EXTENSIONS and CODEOWNERS for ext/soap (#16542)
De facto, I do the maintenance. But since many bugs are blocked by not
having reproducers and there's some fundamental issues in the extension,
this should get the "odd fixes" status instead. The "odd fixes"
description should perhaps also be updated to include a statement about
"limited willpower to debug"...
2024-10-22 20:13:59 +02:00
Ilija Tovilo
a6bf2f591a Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [skip ci] Fix overwritten observer ini setting for gh16514.phpt
2024-10-22 15:21:20 +02:00
Ilija Tovilo
c5c4c3be44 [skip ci] Fix overwritten observer ini setting for gh16514.phpt 2024-10-22 15:20:56 +02:00
Ilija Tovilo
e02085359d Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix lineno for inheritance errors of early bound classes
2024-10-22 15:17:11 +02:00
Ilija Tovilo
2d068c4f47 Fix lineno for inheritance errors of early bound classes
Fixes GH-16508
Closes GH-16532
2024-10-22 15:16:43 +02:00
Ilija Tovilo
381e020edb Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix lineno in function redeclaration error
2024-10-22 15:05:29 +02:00
Ilija Tovilo
de7ef3fa66 Fix lineno in function redeclaration error
We were previously using the lineno of the first instruction, rather than the
start of the function itself.

Fixes GH-16509
Closes GH-16531
2024-10-22 15:04:20 +02:00
Ilija Tovilo
ce99adeb54 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix handling of nested generator in zend_test observer
2024-10-22 14:51:58 +02:00
Ilija Tovilo
69bcbdc3c5 Fix handling of nested generator in zend_test observer
This is the counterpart of GH-15952.

Fixes GH-16514
Closes GH-16530
2024-10-22 14:51:36 +02:00
Ilija Tovilo
5eddcb313e Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix propagation of ZEND_ACC_RETURN_REFERENCE for call trampoline
2024-10-22 14:48:58 +02:00
Ilija Tovilo
8720063c4e Fix propagation of ZEND_ACC_RETURN_REFERENCE for call trampoline
Fixes GH-16515
Closes GH-16529
2024-10-22 14:47:01 +02:00
Christoph M. Becker
7930867e28 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16523: FILTER_FLAG_HOSTNAME accepts ending hyphen
2024-10-21 21:21:02 +02:00
Christoph M. Becker
f9ce5e79da Fix GH-16523: FILTER_FLAG_HOSTNAME accepts ending hyphen
Domain name labels must not end with a hyphen, and that is also true
for the last label.  Apparently, this has been overlooked so far.

Closes GH-16540.
2024-10-21 21:19:54 +02:00
Niels Dossche
5a09e0105e Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16535: UAF when using document as a child
  Fix GH-16533: Segfault when adding attribute to parent that is not an element
2024-10-21 20:57:22 +02:00
Niels Dossche
51b642f2c9 Fix GH-16535: UAF when using document as a child
Documents can never be children of any node.

Closes GH-16539.
2024-10-21 20:56:14 +02:00
Niels Dossche
a0a7361b64 Fix GH-16533: Segfault when adding attribute to parent that is not an element
Attributes are only valid as children of elements. This bug goes back
all the way.

Closes GH-16537.
2024-10-21 20:55:42 +02:00
Christoph M. Becker
713c71adbd Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16266: _ZendTestClass::test() segfaults on named parameter
2024-10-21 19:44:34 +02:00
Christoph M. Becker
b73bcaa47c Fix GH-16266: _ZendTestClass::test() segfaults on named parameter
We need to assign the proper number of arguments.

Closes GH-16271.
2024-10-21 19:43:33 +02:00
Dmitry Stogov
920e3d6b70 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16499: [JIT] Undefined to null coercion issues for return
2024-10-21 14:51:31 +03:00
Dmitry Stogov
fe513655dc Fix GH-16499: [JIT] Undefined to null coercion issues for return 2024-10-21 14:50:50 +03:00
Christoph M. Becker
e635857f7d Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16390: dba_open() can segfault for "pathless" streams
2024-10-21 00:33:29 +02:00
Christoph M. Becker
d3b0efe9d7 Fix GH-16390: dba_open() can segfault for "pathless" streams
`dba_open()` accepts arbitrary stream wrapper paths, but unless no
locking (`-`) is specified, we try to determine the underlying file
path.  If that fails, we need to error out.

Closes GH-16498.
2024-10-21 00:21:34 +02:00
David Carlier
d6bac2f7e8 Merge branch 'PHP-8.2' into PHP-8.3 2024-10-20 21:43:51 +01:00
David Carlier
9ca68e037c Fix GH-16501: gmp_random_bits overflow.
we do the same calculation in advance as mpz_realloc overflow check to
avoid abort.

close GH-16503
2024-10-20 21:43:29 +01:00
Ilija Tovilo
ce44a7f95c Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [skip ci] Mark another phar test as flaky on macOS
2024-10-18 15:24:44 +02:00
Ilija Tovilo
062837aa13 [skip ci] Mark another phar test as flaky on macOS 2024-10-18 15:24:15 +02:00
Derick Rethans
8acdde5b10 Merge branch 'PHP-8.2' into PHP-8.3 2024-10-18 12:38:06 +01:00
Derick Rethans
b2b294a2b2 Fixed bug GH-16037 (Assertion failure in ext/date/php_date.c) 2024-10-18 12:37:03 +01:00
Christoph M. Becker
64f312f123 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16454: Unhandled INF in date_sunset() with tiny $utcOffset
2024-10-18 13:22:55 +02:00
Christoph M. Becker
9bc34182b6 Fix GH-16454: Unhandled INF in date_sunset() with tiny $utcOffset
After normalization, `N` is supposed to be in range [0, 24], but for
very large and very small `$utcOffset` this is not necessarily the
case, since the normalization might yied `-inf` or `inf`.  If that
happens, we let the function fail silently, since it is highly unlikely
that such `$utcOffset`s are passed in practice.

Closes GH-16483.
2024-10-18 13:21:57 +02:00
Niels Dossche
c26d5f20e8 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16473: dom_import_simplexml stub is wrong
2024-10-17 23:27:23 +02:00
Niels Dossche
41af9335b7 Fix GH-16473: dom_import_simplexml stub is wrong
It's been wrong since PHP 8.0 at least, and the signature was inherited
in 8.4-dev to the new DOM methods.

Closes GH-16489.
2024-10-17 23:26:50 +02:00
Niels Dossche
25817ad298 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16406: Assertion failure in ext/phar/phar.c:2808
2024-10-17 21:23:47 +02:00
Niels Dossche
6a8d0a054d Fix GH-16406: Assertion failure in ext/phar/phar.c:2808
When copying entries during conversion in phar_convert_to_other(), the
header offset is not reset. This didn't matter in the past as it wasn't
used anyway in the particular use-case, but since 1bb2a4f9 this is
actually used and sanity-checked.

Closes GH-16470.
2024-10-17 21:23:17 +02:00
Niels Dossche
5cb38e9d24 Fix various document ref pointer mismanagements
- Properly handle attributes
- Fix potential NULL dereference if the intern document pointer is NULL

Fixes GH-16336.
Fixes GH-16338.
Closes GH-16345.
2024-10-17 21:18:50 +02:00
Ilija Tovilo
0932b76d02 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix uaf in SplFixedArray::unset()
2024-10-17 18:25:33 +02:00
Ilija Tovilo
7fe168d855 Fix uaf in SplFixedArray::unset()
Fixes GH-16478
Closes GH-16481
2024-10-17 18:23:55 +02:00
Ilija Tovilo
40e43ffd41 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix use-after-free in SplObjectStorage::setInfo()
2024-10-17 18:21:31 +02:00
Ilija Tovilo
12c987fae2 Fix use-after-free in SplObjectStorage::setInfo()
Fixes GH-16479
Closes GH-16482
2024-10-17 18:20:42 +02:00
Christoph M. Becker
5dba6aebaa Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Download enchant dict from downloads.php.net
2024-10-17 00:55:20 +02:00
Christoph M. Becker
5ef3fe218c Download enchant dict from downloads.php.net
Since windows.php.net is in the progress to be migrated to
downloads.php.net anyway, we may as well fetch the dictionary from the
new site right away.

Closes GH-16310.
2024-10-17 00:55:04 +02:00
Ilija Tovilo
e5d837ca79 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix uaf in SplDoublyLinkedList::offsetSet()
2024-10-16 23:05:15 +02:00