1
0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Commit Graph

68854 Commits

Author SHA1 Message Date
Niels Dossche
d689ff63e8 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix memory leak in openssl_sign() when passing invalid algorithm
2025-04-02 20:18:57 +02:00
Niels Dossche
74720a22f3 Fix memory leak in openssl_sign() when passing invalid algorithm
Closes GH-18185.
2025-04-02 20:15:53 +02:00
Dmitry Stogov
79dc7a2d26 Update IR
IR commit: 8d17022fb61ebfed9f6be81a8182ea31202697ed
2025-04-02 16:20:09 +03:00
David Carlier
dc93f28381 Merge branch 'PHP-8.3' into PHP-8.4 2025-04-02 12:36:08 +01:00
David Carlier
2e47442a6b Fix GH-18212: fseek with SEEK_CUR and negative offset crash on debug
Triggers the assertion as with SEEK_CUR the stream position is set to a
negative value so we force the failure without affecting its position
instead.

close GH-18224
2025-04-02 12:34:50 +01:00
Ilija Tovilo
3ffb310fbd Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Use-after-free in extract() with EXTR_REFS
2025-04-01 16:34:33 +02:00
Ilija Tovilo
a21065e6eb Use-after-free in extract() with EXTR_REFS
Fixes GH-18209
Closes GH-18211
2025-04-01 16:33:30 +02:00
Niels Dossche
93826d9556 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Add missing EXTENSIONS section to intl test
2025-03-31 23:05:23 +02:00
Niels Dossche
13d51f895b Add missing EXTENSIONS section to intl test
[ci skip]
2025-03-31 23:05:15 +02:00
David Carlier
3a5c87f964 Merge branch 'PHP-8.3' into PHP-8.4 2025-03-28 17:31:13 +00:00
David Carlier
a1620048fb ext/gd: imagecrop rect argument overflow fixes.
```
ext/gd/libgd/gd.c:2275:14: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
    #0 0x5d6a2103e1db in php_gd_gdImageCopy /home/dcarlier/Contribs/php-src/ext/gd/libgd/gd.c:2275
    #1 0x5d6a210a2b63 in gdImageCrop /home/dcarlier/Contribs/php-src/ext/gd/libgd/gd_crop.c:57
    #2 0x5d6a21018ca4 in zif_imagecrop /home/dcarlier/Contribs/php-src/ext/gd/gd.c:3575
    #3 0x5d6a21e46e7a in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:1337
    #4 0x5d6a221188da in execute_ex /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:57246
    #5 0x5d6a221366bd in zend_execute /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:61634
    #6 0x5d6a21d107a6 in zend_execute_scripts /home/dcarlier/Contribs/php-src/Zend/zend.c:1895
    #7 0x5d6a21a63409 in php_execute_script /home/dcarlier/Contribs/php-src/main/main.c:2529
    #8 0x5d6a22516d5e in do_cli /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:966
    #9 0x5d6a2251981d in main /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:1341
    #10 0x7f10d002a3b7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #11 0x7f10d002a47a in __libc_start_main_impl ../csu/libc-start.c:360
    #12 0x5d6a20a06da4 in _start (/home/dcarlier/Contribs/php-src/sapi/cli/php+0x2806da4) (BuildId: d9a79c7e0e4872311439d7313cb3a81fe04190a2)
```

close GH-18006
2025-03-28 17:30:25 +00:00
Dmitry Stogov
2b9840894d Update IR
IR commit: dd228777b67334d8ed51de44f427d66d4ac99c08
2025-03-27 22:24:46 +03:00
Jakub Zelenka
6cf24cd47c Merge branch 'PHP-8.3' into PHP-8.4 2025-03-27 11:37:12 +01:00
Jakub Zelenka
2197a490f7 Fix GH-18145: basic_globals_ctor initialization
This resets all basic globals during ctor and just modifies the ones
with a special value. It also switches to using basic_globals_p which
what should be used in this context.

Closes GH-18156
2025-03-27 11:35:55 +01:00
Ilija Tovilo
272f7f75e2 Fix infinite recursion on deprecated attribute evaluation
Fixes GH-17711
Fixes GH-18022
Closes GH-17712
2025-03-26 23:39:38 +01:00
David Carlier
9c6fe6b0ff Fix GH-18148: pg_copy_from() wrong \n offset check.
Close GH-18149
2025-03-26 17:44:01 +00:00
Derick Rethans
22b2a579ba Updated to version 2025.2 (2025b) 2025-03-24 10:06:34 +00:00
Derick Rethans
0c8a7a77a8 Updated to version 2025.2 (2025b) 2025-03-24 10:06:32 +00:00
Ilija Tovilo
d5bdf8f508 Fix segfault when evaluating const expr default value of child prop with added hooks
Introduced by GH-17870. Not adding a NEWS entry since this is fixed in
the same version.

Fixes oss-fuzz #403816122
Closes GH-18098
2025-03-23 16:35:04 +01:00
Niels Dossche
7d1a2d03e4 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  [ci skip] Make sure opcache can output in these tests
2025-03-21 16:35:57 +01:00
Niels Dossche
071f707a6d [ci skip] Make sure opcache can output in these tests 2025-03-21 16:35:47 +01:00
Niels Dossche
fe7f9571d2 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix intl tests for icu 77 (#18125)
2025-03-21 14:25:18 +01:00
Niels Dossche
8823f89a32 Fix intl tests for icu 77 (#18125) 2025-03-21 14:23:03 +01:00
Niels Dossche
d765b60778 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-18107: Opcache CFG jmp optimization with try-finally breaks the exception table
2025-03-21 13:57:16 +01:00
Niels Dossche
2ec8d37eb4 Fix GH-18107: Opcache CFG jmp optimization with try-finally breaks the exception table
If there's a try-finally where the try_op starts on a basic block with a
single JMP, and the JMP optimization causes that basic block to become
unreachable, then we update try_op.
In this case, there is no catch_op, so try_op is erroneously set to 0,
we should instead set it to `b->start`.

Closes GH-18110.
2025-03-21 13:56:31 +01:00
Remi Collet
1c230c27ec Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  NEWS for #66049
  Fix #66049 Typemap can break parsing in parse_packet_soap leading to a segfault
2025-03-21 08:25:23 +01:00
Remi Collet
209f4c296e Fix #66049 Typemap can break parsing in parse_packet_soap leading to a segfault 2025-03-21 08:23:12 +01:00
Niels Dossche
0ef57501d9 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix memory leak when destroying PDORow
2025-03-20 23:14:14 +01:00
Niels Dossche
2dde07af55 Fix memory leak when destroying PDORow
This should call zend_object_std_dtor() to clean the property table etc.
This also has a semantic influence because previously weak refs were not
notified for example.

This fixes the final issue in GH-18114 (the crash was master-only and
fixed already).

Closes GH-18114.
Closes GH-18123.
2025-03-20 23:13:42 +01:00
Niels Dossche
66498152f1 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-18112: NULL access with preloading and INI option
2025-03-20 19:12:47 +01:00
Niels Dossche
e9c0296240 Fix GH-18112: NULL access with preloading and INI option
Preloading shutdown calls request shutdown which will deactivate the
virtual cwd state. However, further startup code still assumes the state
that was set by virtual_cwd_startup(). So we need to reactivate it
manually.

Creating a test was a bit difficult because the INI setting I wanted to
test this with is overridden by the test runner apparently.
To reproduce the issue, create an empty file test.php and execute this
in a ZTS build:
`php -d opcache.preload=./ext/opcache/tests/preload_class_alias_2.inc -d "error_log=" -d "allow_url_include=1" test.php`

Closes GH-18117.
2025-03-20 19:12:06 +01:00
Niels Dossche
9488684703 Add test for GH-18113
Fixed in https://github.com/dstogov/ir/pull/110 and merged via b932c267.

Closes GH-18113.
2025-03-19 23:49:43 +01:00
Dmitry Stogov
b932c267f8 Update IR
IR commit: 3d0124a06ee4321e1305f893b74840033d939e88
2025-03-20 01:10:56 +03:00
Niels Dossche
2c45d67ad3 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix xinclude destruction of live attributes
2025-03-18 22:04:13 +01:00
Niels Dossche
d9329b1522 Fix xinclude destruction of live attributes
Follow-up for GH-17847 but now for attributes.

Closes GH-18100.
2025-03-18 22:01:56 +01:00
Ilija Tovilo
56841998de Fix IN_ARRAY optimization
in_array() calls are compiled to frameless calls. Adjust the
optimization appropriately. Luckily, frameless opcodes simplify the
optimization quite a bit.

Fixes GH-18050
Closes GH-18066
2025-03-18 13:42:53 +01:00
Niels Dossche
647baec5a4 Fix GH-18090: DOM: Svg attributes and tag names are being lowercased
Closes GH-18091.
2025-03-17 19:45:50 +01:00
Jakub Zelenka
d4eb6a41b7 Merge branch 'PHP-8.3' into PHP-8.4 2025-03-17 14:52:04 +01:00
Jakub Zelenka
bd7d3c38ad Get rid of atime change testing in bug72666_variation3.phpt 2025-03-17 14:49:22 +01:00
Ilija Tovilo
45fc03c190 Fix mysql test date flakiness
Separate date() calls can lead to diverging results.

Closes GH-18080
2025-03-16 14:26:04 +01:00
David Carlier
3bb3db5314 Merge branch 'PHP-8.3' into PHP-8.4 2025-03-15 11:37:56 +00:00
David Carlier
005c7b5797 ext/intl: Fix Uconverter::transcode with substitutes as references.
close GH-18059
2025-03-15 11:37:08 +00:00
David Carlier
946408251f Merge branch 'PHP-8.3' into PHP-8.4 2025-03-15 11:34:30 +00:00
David Carlier
f34859cb90 ext/intl: Fix dateformat_format when the time is an array of references. 2025-03-15 11:33:17 +00:00
Saki Takamachi
e96a35b9a8 Fixed pdo_firebird_handle_factory to check ret when starting a transaction (#17632)
Changed to not execute php_firebird_begin_transaction
if transaction cannot be started successfully

Closes #17632
2025-03-15 08:51:49 +09:00
Niels Dossche
6717947ffe Fix GH-18015: Error messages for ldap_mod_replace are confusing
Closes GH-18053.
2025-03-15 00:42:07 +01:00
Arnaud Le Blanc
4b9c72f329 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Destroy temporary module classes in reverse order
2025-03-14 10:49:10 +01:00
Arnaud Le Blanc
1c182674b0 Destroy temporary module classes in reverse order
We destroy classes of dl()'ed modules in clean_module_classes(), during
shutdown. Child classes of a module use structures of the parent class (such as
inherited properties), which are destroyed earlier, so we have a use-after-free
when destroying a child class.

Here I destroy classes in reverse order, as it is done in zend_shutdown() for
persistent classes.

Fixes GH-17961
Fixes GH-15367
2025-03-14 10:45:17 +01:00
Saki Takamachi
7c9872e255 Fixed pointer subtraction for scale (#17986)
Closes #17986
2025-03-14 09:00:00 +09:00
Niels Dossche
f4ba3564f5 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Correct check for maximum string length in JIT helpers
2025-03-13 23:49:42 +01:00