1
0
mirror of https://github.com/php/php-src.git synced 2026-04-19 22:11:12 +02:00
Commit Graph

58143 Commits

Author SHA1 Message Date
Dmitry Stogov
c9901aa594 Add missing "return" 2021-12-03 13:52:10 +03:00
Dmitry Stogov
4a5c05a49d ws 2021-12-03 13:40:01 +03:00
Dmitry Stogov
1d054b3fa7 Fix array object clobbering by user error handler
Fixes oss-fuss #41605 and #41610
2021-12-03 13:35:28 +03:00
Dmitry Stogov
2515e788bc JIT: Fix register clobbering
Fixes oss-fuzz #41621
2021-12-03 11:13:50 +03:00
Dmitry Stogov
c4ee66856e Tracing JIT: Fixed Zend/tests/str_offset_008.phpt failure 2021-12-02 23:47:36 +03:00
Dmitry Stogov
2fde308fc6 JIT: Fix ASSIGN_DIM_OP with undefined variable and index and user error handler, throwing an exception
Fixes oss-fuzz #39422
2021-12-02 22:19:48 +03:00
Dmitry Stogov
94286cd596 Fix yet another indirect string modification by error handler problem 2021-12-02 16:16:54 +03:00
Dmitry Stogov
37ac707cac Add missing zend_string_release_ex(tmp, 0) and cleanup
- use GC_DELREF() instead of zend_string_release_ex()
- add expectations for exceptional cases
- replace IS_ARRAY_IMMUTABLE by IS_STR_INTERNED
2021-12-02 11:18:08 +03:00
Dmitry Stogov
df16da3697 Fixed ext/bz2/tests/005.phpt test failure introduesed by 09547c64c2 2021-12-02 10:32:45 +03:00
Dmitry Stogov
4595a57e99 Fix clobering of operand by error handler in assignment to string offset (optimization and JIT support) 2021-12-02 01:20:17 +03:00
Dmitry Stogov
e7b31f57ec JIT: Fix incorrect code produced for BOOL_NOT and [double, undef] operand
Fixes oss-fuzz #41531
2021-11-30 20:36:52 +03:00
Dmitry Stogov
c1036194d6 JIT: Fix incorrect reference counting inference
Fixes oss-fuzz #40747
2021-11-30 12:58:54 +03:00
Dmitry Stogov
6e1fe96962 JIT: Fix uninitialized result of ASSIGN_DIM[_OP] after clobbering array by user error handler
Fixes oss-fuzz #41208
2021-11-30 11:40:18 +03:00
Dmitry Stogov
86430e8e01 Fixed type inference (it's safe to ignore reference counting narrowing) 2021-11-29 23:32:52 +03:00
Dmitry Stogov
aff115547f JIT: Fix exception handling when next array element is already occupied
Fixes oss-fuzz #41408
2021-11-29 21:44:00 +03:00
Christoph M. Becker
816aa20391 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #74604: Out of bounds in php_pcre_replace_impl
2021-11-29 19:15:20 +01:00
Christoph M. Becker
712fc54e85 Fix #74604: Out of bounds in php_pcre_replace_impl
Trying to allocate a `zend_string` with a length only slighty smaller
than `SIZE_MAX` causes an integer overflow; we make sure that this
doesn't happen by catering to the maximal overhead of a `zend_string`.

Closes GH-7597.
2021-11-29 19:12:55 +01:00
Dmitry Stogov
d955415114 JIT: Fix named arguments handling
Fixes oss-fuzz #41486
2021-11-29 18:39:50 +03:00
Dmitry Stogov
8f4cfe04eb JIT: Fix named arguments handling
Fixes oss-fuzz #41486
2021-11-29 18:37:49 +03:00
Christoph M. Becker
f3bd24a200 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #81659: stream_get_contents() may unnecessarily overallocate
2021-11-29 14:48:11 +01:00
Christoph M. Becker
31749aac62 Fix #81659: stream_get_contents() may unnecessarily overallocate
Since we're going to read from the current stream position anyway, the
`max_len` should be the size of the file minus the current position
(still catering to potentially filtered streams).  We must, however,
make sure to cater to the file position being beyond the actual file
size.

While we're at, we also fix the step size in the comment, which is 8K.

A further optimization could be done for unfiltered streams, thus
saving that step size, but 8K might not be worth it.

Closes GH-7693.
2021-11-29 14:46:09 +01:00
Dmitry Stogov
297117bbc5 Disable type narrowing optimization when we contruct SSA for JIT
This also revets incorrect fix introduced in f9518c3850
2021-11-29 15:51:54 +03:00
Dmitry Stogov
49f44e7ffc JIT: Fixed use-after-free caused by shift by negative number
Fixes oss-fuzz #41192
2021-11-25 22:21:44 +03:00
Christoph M. Becker
179030d167 Fix #81649: imap_(un)delete accept sequences, not single numbers
As such, the parameter name `$message_num` is utmost misleading; it
should be `$message_nums` as for other functions.

Closes GH-7686.
2021-11-25 18:29:43 +01:00
Dmitry Stogov
f9518c3850 Fixed incorrect narrowing to double
Fixes oss-fuzz #41223
2021-11-25 15:14:04 +03:00
Dmitry Stogov
3c53a9fd73 Fixed incorrect refcountion inference for BW_NOT
BW_NOT for emtpy string returns empty string

Fixes oss-fuzz #41280
2021-11-25 13:51:56 +03:00
Dmitry Stogov
f302430c72 Fixed incorrect DCE for ADD_ARRAY_ELEMENT instruction
DCE might remove INIT_ARRAY instruction but then keep the related
ADD_ARRAY_ELEMENT, becuse its both operands need to be freed.

Fixes oss-fuzz #41309
2021-11-25 13:33:26 +03:00
Remi Collet
f6621037a0 add missing cond. 2021-11-25 10:14:30 +01:00
Remi Collet
e713890d36 fix gdImagePngCtxEx call with system libgd 2021-11-25 08:27:07 +01:00
Christoph M. Becker
9237055141 "Export" relevant GD macros
For parity with non Windows systems, we should `AC_DEFINE` these macros
so that they are defined in config.w32.h instead of directly passed to
the compiler.  This allows extensions which have ext/gd as dependency
to check for these macros.  E.g. ext/ps does this[1], and fails to
build on Windows, because `HAVE_GD_BUNDLED` isn't defined.

[1] <https://github.com/steinm/ps/blob/RELEASE_1_4_4/ps.c#L34>

Closes GH-7680.
2021-11-24 18:23:28 +01:00
Nikita Popov
be271f277e Fix bug #81652
We need to check not only for defs but also for uses of the
variable.
2021-11-24 15:18:31 +01:00
Christoph M. Becker
b29e85a0da Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #75725: ./configure: detecting RAND_egd
2021-11-22 14:13:52 +01:00
Дилян Палаузов
60fe575ce3 Fix #75725: ./configure: detecting RAND_egd
Closes GH-7668.
2021-11-22 14:11:07 +01:00
Nikita Popov
bc6ec0a109 Clarify that preg_match_all() cannot return null 2021-11-18 10:36:35 +01:00
Dmitry Stogov
9dd3e8be8a JIT: Fixed memory leak in Zend/tests/concat_002.phpt introduced by fac78ee760 2021-11-17 18:43:39 +03:00
Dmitry Stogov
fac78ee760 JIT: Fixed memory leak 2021-11-17 13:59:35 +03:00
Dmitry Stogov
48a65fef6f JIT: Fixed memory lieak 2021-11-17 12:48:56 +03:00
David Carlier
fb3e646f6b OpenBSD ZTS build fix
Closes GH-7661.
2021-11-17 10:20:05 +01:00
Nikita Popov
18a0d46a1b Safely reassign array in usort()
Make sure to destroy the old value only after assigning the new
one. Otherwise we may try to double free, e.g. if GC runs during
this dtor.

This caused an assertion failure in phpro/grumphp and is likely
the cause for bug #81603 as well.

(cherry picked from commit 6f38acfaf9)

(I applied this to the wrong base branch at first...)
2021-11-16 10:15:47 +01:00
Nikita Popov
6f38acfaf9 Safely reassign array in usort()
Make sure to destroy the old value only after assigning the new
one. Otherwise we may try to double free, e.g. if GC runs during
this dtor.

This caused an assertion failure in phpro/grumphp and is likely
the cause for bug #81603 as well.
2021-11-16 10:13:46 +01:00
Dmitry Stogov
fc35a6b93c Tracing JIT: Fixed abstract stack consistency for [QM_]ASSIGN of CV to itself 2021-11-15 23:25:16 +03:00
Dmitry Stogov
85066fd88e Tracing JIT: Fixed failure on non-optimized op_arrays (op_array->T may be above ssa->vars_count) 2021-11-15 14:44:01 +03:00
Nikita Popov
4a2656327d Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix bug #81618: Correct dns_get_record on FreeBSD
2021-11-15 10:00:36 +01:00
Matt
45f52285f6 Fix bug #81618: Correct dns_get_record on FreeBSD
Modify dns_get_record to test for records result based on dns_errno to
accommodate modern FreeBSD, for which res_nsearch() does not update
h_errno directly. Add new php_dns_errno macro, and have it consult
statp->res_h_errno when OS has res_nsearch().

Closes GH-7655.
2021-11-15 10:00:07 +01:00
Dmitry Stogov
292d76d8a4 JIT: Fixed reference-counting inference 2021-11-15 10:39:58 +03:00
Stanislav Malyshev
0ef1dfc9f6 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #79971: special character is breaking the path in xml function
2021-11-14 23:29:27 -08:00
Stanislav Malyshev
ca87d46a3e Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
  Fix #79971: special character is breaking the path in xml function
2021-11-14 23:28:13 -08:00
Christoph M. Becker
f15f8fc573 Fix #79971: special character is breaking the path in xml function
The libxml based XML functions accepting a filename actually accept
URIs with possibly percent-encoded characters.  Percent-encoded NUL
bytes lead to truncation, like non-encoded NUL bytes would.  We catch
those, and let the functions fail with a respective warning.
2021-11-14 23:24:33 -08:00
Dmitry Stogov
64fde17042 Fixed test 2021-11-12 22:48:50 +03:00
Dmitry Stogov
12d02e6227 Fixed incorrect guard elimination 2021-11-12 21:00:08 +03:00