1
0
mirror of https://github.com/php/php-src.git synced 2026-04-28 10:43:30 +02:00
Commit Graph

134345 Commits

Author SHA1 Message Date
Ben Ramsey e4453dcbd2 Merge branch 'PHP-8.2' into PHP-8.3 2024-06-05 01:11:30 -05:00
Ben Ramsey 8aff5b49c3 Merge branch 'PHP-8.1' into PHP-8.2 2024-06-05 01:10:47 -05:00
Ben Ramsey a87ccc7ca2 PHP-8.1 is now for PHP 8.1.30-dev 2024-06-05 00:48:17 -05:00
Ben Ramsey 557e09f678 Update NEWS
Co-authored-by: Eric Mann <ericmann@php.net>
2024-06-05 00:39:47 -05:00
Niels Dossche 7e0e3cc820 Fix GHSA-w8qr-v226-r27w
We should not early-out with success status if we found an ipv6
hostname, we should keep checking the rest of the conditions.
Because integrating the if-check of the ipv6 hostname in the
"Validate domain" if-check made the code hard to read, I extracted the
condition out to a separate function. This also required to make
a few pointers const in order to have some clean code.
2024-06-05 00:31:17 -05:00
Niels Dossche 9382673148 Fix GHSA-3qgc-jrrr-25jv
The original code is error-prone due to the "best fit mapping" that
happens with the argument parsing but not with the query string.
When we get a non-ASCII character, try to remap it and see if it becomes
a hyphen.

An alternative approach is to create a custom main `wmain` receiving
wide-character variations that does the ANSI transformation with the
best-fit mapping, but that's more error-prone and could cause unexpected
breakage.

Another alternative was just don't doing this check altogether and
always check for `cgi || fastcgi` instead, but that breaks real-world
use-cases.
2024-06-05 00:29:19 -05:00
Niels Dossche 4b15f5d4ec Fix GHSA-9fcc-425m-g385: bypass CVE-2024-1874
The old code checked for suffixes but didn't take into account trailing
whitespace. Furthermore, there is peculiar behaviour with trailing dots
too. This all happens because of the special path-handling code inside
CreateProcessW.

By studying Wine's code, we can see that CreateProcessInternalW calls
get_file_name [1] in our case because we haven't provided an application
name. That code gets the first whitespace-delimited string into app_name
excluding the quotes. It's then passed to create_process_params [2]
where there is the path handling code that transforms the command line
argument to an image path [3]. Inside Wine, the extension check if
performed after these transformations [4]. By doing the same thing in
PHP we match the behaviour and can properly match the extension even in
the given edge cases.

[1] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L542-L543
[2] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L565
[3] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L150-L151
[4] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L647-L654
2024-06-05 00:26:14 -05:00
Calvin Buckley b8a7cf9f19 [skip ci] update NEWS for GH-14457 2024-06-04 12:50:53 -03:00
Calvin Buckley 05fbea8513 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [skip ci] update NEWS for GH-14457
  Remove use of SDWORD and SWORD in ODBC extensions (GH-14457)
2024-06-04 12:49:36 -03:00
Calvin Buckley 3e3e3b33f8 [skip ci] update NEWS for GH-14457 2024-06-04 12:49:02 -03:00
Calvin Buckley c15f5a2a6f Remove use of SDWORD and SWORD in ODBC extensions (GH-14457)
* Remove usage of SDWORD, replace with SQLINTEGER

Some different driver managers disagree if this should be 4 or 8 bytes
in size. SQLGetDiagRec expects this to be an SQLINTEGER, so we should
just use that explicitly instead of hoping that it's the same size.

Fixes GH-14367

* Replace SWORD with SQLSMALLINT

While this hasn't caused issues like the SQLINTEGER/SDWORD confusion
has, we should use what SQLDescrimeParam calls for, which is
SQLSMALLINT.
2024-06-04 12:46:19 -03:00
Niels Dossche 3e8752169c Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-11188: Error when building TSRM in ARM64
2024-06-03 21:11:20 +02:00
nielsdos 644d3628e3 Fix GH-11188: Error when building TSRM in ARM64
Although the issue mentioned FreeBSD, this is a broader problem:
the current ARM64 code to load the TLS offset assumes a setup with
the non-default TLS model. This problem can also apply on some
configurations on other platforms.

Closes GH-11236.
2024-06-03 20:28:55 +02:00
Gina Peter Banyard e206b68403 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  ext/standard: Fix test conflict with I/O tests
2024-06-02 17:03:44 +01:00
Gina Peter Banyard 75f6132818 ext/standard: Fix test conflict with I/O tests
Closes GH-14428
2024-06-02 17:03:19 +01:00
Niels Dossche c87f29f685 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix reference handling in SpoofChecker
2024-06-01 20:40:17 +02:00
Niels Dossche 5ec26edfb6 Fix reference handling in SpoofChecker
Closes GH-14414.
2024-06-01 20:35:57 +02:00
Niels Dossche 98c8518b39 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix bug #76232: SoapClient Cookie Header Semicolon
2024-06-01 17:38:00 +02:00
Niels Dossche 1b1677a8f1 Fix bug #76232: SoapClient Cookie Header Semicolon
According to RFC 6265 [1] the cookies must be separated by "; " not ";",
and it must not end with ";".

[1] https://datatracker.ietf.org/doc/html/rfc6265

Closes GH-14406.
2024-06-01 17:37:30 +02:00
Niels Dossche d11a3c6579 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix bug #69280: SoapClient classmap doesn't support fully qualified class name (#14398)
2024-06-01 13:31:02 +02:00
Niels Dossche 476706165a Fix bug #69280: SoapClient classmap doesn't support fully qualified class name (#14398)
There's a hash table that maps type names to class name, but names with
a leading backslash are not supported. The engine has logic to strip
away the leading backslash that we should replicate here.

It works by checking if we need to make an actual copy in case an
unexpected (e.g. invalid data or leading backslash) situations are
detected. Upon making a copy we normalize the data in the table.

Furthermore, previously the code assumed that the key was always valid
and that the structure was a non-packed hash table. This isn't
necessarily the case. The new code fixes this as well.

Closes GH-14398.
2024-06-01 13:29:26 +02:00
Bob Weinand d98586b6ed Merge branch 'PHP-8.2' into PHP-8.3 2024-06-01 02:41:39 +02:00
Bob Weinand be7f3aa474 Fix GH-14387: Crash when stack walking in destructor of yielded from values during Generator->throw() 2024-06-01 02:38:55 +02:00
Niels Dossche cac4290fb6 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix memory leaks with string function name lookups
2024-05-31 21:23:13 +02:00
Niels Dossche 18233e0f2e Fix memory leaks with string function name lookups
There's a few leaks where the string is copied for lowercasing but not released.
Where possible, use the _lc functionality of zend_hash to do the lookup
to avoid the leaks that currently exist with the manual lowercasing.

Closes GH-14390.
2024-05-31 21:22:37 +02:00
Niels Dossche 2b1097a87d Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix reading zlib ini settings in ext-soap
  Fix memory leak if calling SoapServer::setClass() twice
  Fix memory leak if calling SoapServer::setObject() twice
  Fix missing error restore code in ext-soap (#14379)
  Fix GH-14368: Test failure in ext/session/tests/gh13856.phpt (#14378)
2024-05-31 18:26:22 +02:00
Niels Dossche 89c4db9c22 Fix reading zlib ini settings in ext-soap
zend_ini_long() actually expects the length without the NUL byte, but
we're passing the length *with* the NUL byte. This mess can actually be
avoided altogether by using INI_INT, so use that instead.

Closes GH-14382.
2024-05-31 18:21:34 +02:00
Niels Dossche 23912f55eb Fix memory leak if calling SoapServer::setClass() twice
Closes GH-14381.
2024-05-31 18:21:00 +02:00
Niels Dossche 51bb9c2c2a Fix memory leak if calling SoapServer::setObject() twice
Closes GH-14380.
2024-05-31 18:20:37 +02:00
Niels Dossche 6aa66e0806 Fix missing error restore code in ext-soap (#14379)
The begin and end macros should be paired, but some of the end macro
calls were missing.
2024-05-31 18:19:00 +02:00
Niels Dossche d7aa0be3a8 Fix GH-14368: Test failure in ext/session/tests/gh13856.phpt (#14378)
If the runner overrides session.save_path, the test fails.
Manually set it to a value known to trigger the issue.
2024-05-31 18:18:40 +02:00
Niels Dossche 7c947b57b7 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Partially backport GH-13782 to stable branches
2024-05-30 21:02:03 +02:00
Niels Dossche c815cdcfe7 Partially backport GH-13782 to stable branches
This partially backports that PR to stable branches as it has been in master
without reported problems so far.
It's only a partial backport because the stable branches don't have the
ZTS persistent resource fix that would fix shutdown crashes, i.e. the
code change in mysqlnd_vio's close_stream is not backported.

This is fully fixed on master.

Closes GH-14324.
Closes GH-10599.
2024-05-30 20:58:54 +02:00
Gina Peter Banyard ba7b305530 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  ext/bcmath: Fixed bug (bcpowmod() with mod = -1 returns 1 when it must be 0)
2024-05-30 15:51:05 +01:00
Gina Peter Banyard 709869c8bd ext/bcmath: Fixed bug (bcpowmod() with mod = -1 returns 1 when it must be 0) 2024-05-30 15:47:25 +01:00
Niels Dossche edc130910f Fix build 2024-05-29 18:50:07 +02:00
Niels Dossche fe0214bb55 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix bug #47925 again (#14348)
  Fix GH-14343: Memory leak in xml and dom (#14347)
2024-05-29 17:51:47 +02:00
Niels Dossche ce7ed6e040 Fix bug #47925 again (#14348)
The naming of the userland functions is terrible and confused me.
gzdecode() is actually the function to decompress a gzip stream, and
gzuncompress() is the one to decompress a deflate stream...
See zlib.c to see the internal function -> type mapping.
2024-05-29 17:50:20 +02:00
Niels Dossche 88ff32a25b Fix GH-14343: Memory leak in xml and dom (#14347)
If there is no root, the namespace cannot be attached to it,
so we have to attach it to the old list.

This isn't a problem in "new DOM" because namespaces are managed in a
separate structure there.
2024-05-29 17:49:07 +02:00
Ilija Tovilo 3250457242 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Attempt to fix mysql_native_password error for 32-bit build
2024-05-29 12:49:43 +02:00
Ilija Tovilo a05301e783 Attempt to fix mysql_native_password error for 32-bit build
Closes GH-14356
2024-05-29 12:48:47 +02:00
Ilija Tovilo 9f77c1f995 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Re-add 32-bit push build
2024-05-29 11:49:49 +02:00
Ilija Tovilo 69dbfadd1e Re-add 32-bit push build
32-bit fails more commonly that I had assumed.

Closes GH-14300
2024-05-29 11:47:24 +02:00
Arnaud Le Blanc 5e895dda15 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix TLS access in JIT on FreeBSD/amd64
2024-05-28 15:43:59 +02:00
Arnaud Le Blanc 79862f24da Fix TLS access in JIT on FreeBSD/amd64
DTV elements are 8 bytes in size a per ABI [1], and the index is offset by 1
on FreeBSD [2]

[1] http://people.redhat.com/drepper/tls.pdf
[2] https://github.com/freebsd/freebsd-src/blob/bf56e8b9c8639ac4447d223b83cdc128107cc3cd/libexec/rtld-elf/rtld.c#L5260

Closes GH-13928
2024-05-28 15:42:57 +02:00
Arnaud Le Blanc 3b2764bc76 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Use ITIMER_REAL for timeout handling on MacOS / Apple Silicon system
2024-05-28 15:26:53 +02:00
Manuel Kress 272da51bfd Use ITIMER_REAL for timeout handling on MacOS / Apple Silicon system
setitimer(ITIMER_PROF) fires too early on MacOS 14 when running on Apple
Silicon. See https://openradar.appspot.com/radar?id=5583058442911744.

Fixes GH-12814
Closes GH-13567
2024-05-28 15:25:46 +02:00
Dmitry Stogov 034bd85ad1 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix incorrect conditions
2024-05-28 08:37:48 +03:00
Dmitry Stogov 48ae025c33 Fix incorrect conditions 2024-05-28 08:37:20 +03:00
Máté Kocsis 9ac59d08e4 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix gen_stub.php errors (#14335)
2024-05-27 22:47:24 +02:00