1
0
mirror of https://github.com/php/php-src.git synced 2026-04-28 10:43:30 +02:00
Commit Graph

132232 Commits

Author SHA1 Message Date
Christoph M. Becker f725f504e8 Adapt ext/intl tests for ICU 75.1 and 76.1
Closes GH-16788.
2024-11-15 18:55:01 +01:00
Christoph M. Becker fe1925aaac Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Update FreeBSD CI
2024-11-15 18:21:59 +01:00
Christoph M. Becker 85e23dbbb2 Update FreeBSD CI
FreeBSD 13.2 is no longer supported[1], and apparently the respective
Cirrus CI image has been removed.  We update to FreeBSD 13.3.

This also requires to disable some compiler warnings now, and adapt a
test case.

[1] <https://www.freebsd.org/security/#sup>
[2] <https://github.com/php/php-src/runs/33044888209>

Co-authored-by: David Carlier <devnexen@gmail.com>

Closes GH-16817.
2024-11-15 18:20:48 +01:00
Christoph M. Becker 3abb031c3c Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Stick with icu4c 74.2 on macOS CI for PHP-8.1
2024-11-15 14:25:19 +01:00
Christoph M. Becker 9128fb8f1e Stick with icu4c 74.2 on macOS CI for PHP-8.1
PHP-8.1 is not ready for ICU >= 75.1 which requires C++17 support.
Thus we force the usage of icu4c@74, what is scheduled for removal in
May 2025, though.

Closes GH-16789.
2024-11-15 14:24:24 +01:00
Niels Dossche cbb3b9371d Fix GH-16770: Tracing JIT type mismatch when returning UNDEF
When returning an UNDEF value, it actually becomes NULL.
The following code took this into account:
https://github.com/php/php-src/blob/28344e0445bc2abae8dc5f1376aa0ff350e6d66d/ext/opcache/jit/zend_jit_trace.c#L2196-L2199

But the stack does not update the type to NULL, causing a mismatch.

Closes GH-16784.

Co-authored-by: Dmitry Stogov <dmitry@zend.com>
2024-11-14 22:33:06 +01:00
Christoph M. Becker c69fdef760 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Need to define BREW_OPT
2024-11-13 21:23:56 +01:00
Christoph M. Becker d6249b6e1f Need to define BREW_OPT
This is only defined as of PHP-8.4; alternatively we could also inline
the `brew --prefix` call, but that makes it harder for upward merges.

Closes GH-16785.
2024-11-13 21:23:27 +01:00
Christoph M. Becker 45487c6ec2 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Patch libcurl.pc for macOS builds
2024-11-13 19:38:07 +01:00
Christoph M. Becker 9196a72eb0 Patch libcurl.pc for macOS builds
cURL 8.11.0 added a couple of packages to `Requires.private`, but these
packages are irrelevant when building against a shared libcurl.  For
some reason, these private requirements are checked when we're doing
`pkg-config --cflags` (that happens with the preinstalled pkg-config
0.29.2, as well as with pkgconf 2.3.0).  To avoid further messing with
these packages, we just drop the `Requires.private` line from
libcurl.pc.

See GH-16741 for more details.

Closes GH-16783.
2024-11-13 19:36:58 +01:00
David Carlier 4124b04e34 Fix GH-16771: imagecreatefromstring overflow on invalid format.
close GH-16776
2024-11-13 12:48:37 +00:00
Dmitry Stogov 19809a526b Fix incorrect handling of ZEND_ACC_FINAL flag in JIT (#16778) 2024-11-13 14:38:54 +03:00
Niels Dossche 02ee521e20 Fix GH-16727: Opcache bad signal 139 crash in ZTS bookworm (frankenphp)
Reproducer: https://github.com/php/php-src/issues/16727#issuecomment-2466256317

The root cause is a data race between two different threads:

1) We allocate a lower cased name for an anonymous class here:
   https://github.com/php/php-src/blob/f97353f228e21dcc2db24d7edf08c1cb3678b0fd/Zend/zend_compile.c#L8109
2) This gets looked up as an interned string here:
   https://github.com/php/php-src/blob/f97353f228e21dcc2db24d7edf08c1cb3678b0fd/Zend/zend_compile.c#L8112
   Assuming that there are uppercase symbols in the string and therefore
   `lcname != name` and that `lcname` is not yet in the interned string table,
   the pointer value of `lcname` won't change.
3) Here we add the string into the interned string table:
   https://github.com/php/php-src/blob/f97353f228e21dcc2db24d7edf08c1cb3678b0fd/Zend/zend_compile.c#L8223
   However, in the meantime another thread could've added the string into the interned string table.
   This means that the following code will run, indirectly called via the `LITERAL_STR` macro,
   freeing `lcname`: https://github.com/php/php-src/blob/62e53e6f4965f37d379a3fd21f65a4210c5c86b5/ext/opcache/ZendAccelerator.c#L572-L575
4) In the reproducer we then access the freed `lcname` string here:
   https://github.com/php/php-src/blob/f97353f228e21dcc2db24d7edf08c1cb3678b0fd/Zend/zend_compile.c#L8229

This is solved in my patch by retrieving the interned string pointer
and putting it in `lcname`.

Closes GH-16748.
2024-11-11 16:20:05 +01:00
Gina Peter Banyard 1b379f5e55 ext/hash: Fix GH-16711: Segfault in mhash()
Closes GH-16713
2024-11-10 20:15:44 +00:00
Gina Peter Banyard fc8f30d312 ext/hash: Add failing tests for GH-16711 2024-11-10 20:14:21 +00:00
Niels Dossche d87f3ff662 [ci skip] Add credit for test 2024-11-09 17:09:35 +01:00
Niels Dossche 72c0222926 Fix GH-16695: phar:// tar parser and zero-length file header blocks
There are two issues:
1) There's an off-by-one in the check for the minimum file size for a
   tar (i.e. `>` instead of `>=`).
2) The loop in the tar parsing parses a header, and then unconditionally
   reads the next one. However, that doesn't necessarily exist.
   Instead, we remove the loop condition and check for the end of the
   file before reading the next header. Note that we can't use
   php_stream_eof as the flag may not be set yet when we're already at
   the end.

Closes GH-16700.
2024-11-09 17:07:53 +01:00
Hans Krentel (hakre) c075546320 Fail early in *nix configuration build script
Adding two exit early safeguards in the *nix configuration build script:

1) Given the initial cd into the build tree fails (the project root),
   the `buildconf` script exits with non-zero status (failure).
2) Given the grep command does not exist or `configure.ac` AC_INIT [1]
   expectations are unmet, the buildconf script exits non-zero.

Additionally quoting the pathname to cd into and the empty CD_PATH
parameter for portability, also for systems that are using a
non-portable pathname [2] for the build tree.

The initial CD safeguard has been applied to the `buildconf` and
four more scripts:

- build/genif.sh
- scripts/dev/credits
- scripts/dev/genfiles
- scripts/dev/makedist

Rationale:

Cd-ing into the project root should always prematurely exit w/ FAILURE
as a required precondition for its invocation has not been met. This
should never go unnoticed as it always requires user intervention.

Similar and more specifically to the PHP build on *nix systems, the
grep command is required early to obtain the `php_extra_version` from
configure.ac.  Previously, if the grep command is missing (or failing
due to not matching the line with the AC_INIT macro [1]), the internal
dev parameter would always be zero (0) which can easily result in the
situation that the configure script is not being rebuilt. This is
cumbersome as the rebuild of a configure script is more likely required
with checked-out dev versions under change rather than an already
properly set-up build environment on a dedicated build or release
system. Missing the fact that either the grep utility is missing or
the expectation of having the AC_INIT macro in configure.ac is unmet
should never go unnoticed as it always requires user intervention.

[1]: https://www.gnu.org/software/autoconf/manual/autoconf-2.67/html_node/Initializing-configure.html
[2]: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_271

Closes GH-16717.
2024-11-09 14:03:04 +01:00
Niels Dossche 994e866cf2 Fix memory leak in php_openssl_pkey_from_zval()
Closes GH-16691.
2024-11-09 10:58:44 +01:00
Niels Dossche 2f4f09f7e6 Fix various memory leaks related to openssl exports
Closes GH-16692.
2024-11-09 10:58:17 +01:00
Niels Dossche ac8d0e57d9 Prevent unexpected array entry conversion when reading key
When passing an array, the key entry can get converted to a string if it
is an object, but this actually modifies the original array entry.
The test originally outputted:

```
array(2) {
  [0]=>
  string(...) => ...
  [1]=>
  string(0) ""
}
```

This is unexpected. Use zval_try_get_string() to prevent this behaviour.

Closes GH-16693.
2024-11-09 10:57:50 +01:00
Jakub Zelenka 065bde1e13 Fix GH-16432: PHP-FPM 8.2 SIGSEGV in fpm_get_status 2024-11-08 16:44:05 +01:00
David Carlier 875a9dc4c4 Fix introduced leaks from GH-15715.
Choosing here to shrink the requested allocation to its max value.
2024-11-08 12:27:03 +00:00
Christoph M. Becker 03eeec16f0 Fix rename_variation12*.phpt parallel test conflicts
For rename_variation12.phpt this is actually not necessary, since there
is no rename_variation11.phpt, but we still fix it to be in sync with
rename_variation12-win32.phpt which actually is prone to parallel
conflicts.

(cherry picked from commit d4263ddc40)
2024-11-08 00:24:49 +01:00
David Carlier e74e66e3f7 Fix oss-fuzz report triggered by GH-15712 commit.
It triggered allocation overflow which, even fixed, in turn gives memory
leak on 32 bits but the allocator relies on signed integers.

close GH-15915
2024-11-07 22:51:05 +00:00
Christoph M. Becker d276ea54f4 Skip tests if ldap_set_rebind_proc() is not available
This is already done by ldap_set_rebind_proc_error.phpt, but not by the
other two affected tests.

Closes GH-16708.
2024-11-07 13:22:17 +01:00
David Carlier fde053bb92 Fix GH-16235 jdtogregorian overflow
close GH-16242
2024-11-06 12:52:32 +00:00
Saki Takamachi 4d14325b19 Added gc_handler to properly handle circular references. (#16703)
closes #16703

Co-authored-by: Christoph M. Becker <cmbecker69@gmx.de>
2024-11-06 20:30:08 +09:00
Niels Dossche 3f1ea1b663 Fix test with shared zend_test (#16705) 2024-11-05 21:35:47 +01:00
Pierrick Charron f5895792e7 PHP-8.2 is now for PHP 8.2.27-dev 2024-11-05 12:47:25 -05:00
Niels Dossche 5ddb75660d Fix various memory leaks on error conditions in openssl_x509_parse()
Closes GH-16690.
2024-11-04 20:03:53 +01:00
Ilija Tovilo 418f820f5d Add NEWS entry 2024-11-04 17:46:17 +01:00
Ilija Tovilo f7222bd2de Also fix same issue in ArrayObject::exchangeArray() 2024-11-04 17:46:17 +01:00
Ilija Tovilo 8910ac800d Fix use-after-free in ArrayObject::unset() with destructor
Fixes GH-16646
Closes GH-16653
2024-11-04 17:45:56 +01:00
Ilija Tovilo 845cdbce67 Postpone zend_array_sort() in ext-intl
This function is not ZEND_API yet, so we cannot use it as it won't work for
dynamically linked extensions.
2024-11-04 16:01:00 +01:00
Ilija Tovilo 4b9e59b430 [skip ci] Use bool for zend_array_sort()
zend_bool is removed in higher branches.
2024-11-04 15:59:18 +01:00
Ilija Tovilo 2bdce61390 Fix array going away during sorting
Fixes GH-16648
Closes GH-16654
2024-11-04 15:50:35 +01:00
Ilija Tovilo 2985de72db [skip ci] Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [skip ci] Fix nightly workflow dispatch
2024-11-04 15:03:47 +01:00
Ilija Tovilo e72854e8bc [skip ci] Fix nightly workflow dispatch
Closes GH-16662
2024-11-04 15:02:11 +01:00
David Carlier 90aac521fd Fix GH-16592 msg_send() crashes when the type does not serialize as expected.
It is assumed that the serialization always had initialised its buffer
zend_string, but in the case of a type not serialising, it is null.

close GH-16599
2024-11-03 13:39:24 +00:00
Niels Dossche e643129bbb Fix GH-16628: FPM logs are getting corrupted with this log statement
zlog_buf_prefix() can return a larger length than what actually was
written due to its use of snprintf(). The code in
zlog_stream_prefix_ex() does not take this into account, other callers
do. What ends up happening then is that stream->length is set to the
length as if snprintf() was able to write all bytes, causing
stream->length to become larger than stream->buf.size, causing a
segfault.

In case the buffer was too small we try with a larger buffer up to a
limit of zlog_limit. This makes sure that the stream length will remain
bounded by the buffer size.

This also adds assertions to make the programmer intent clear and catch
this more easily in debug builds.

Closes GH-16680.
2024-11-02 19:36:20 +01:00
Niels Dossche f0f666ba3f Fix GH-16601: Memory leak in Reflection constructors
Additionally fixes wrong behaviour in ReflectionParameter when you first
have a construction that uses an object and the subsequent doesn't.

Closes GH-16672.
2024-11-02 19:35:20 +01:00
Gina Peter Banyard 5253647500 ext/gmp: Fix segfault when null is encountered on an overloaded operator
And various other issues like inconsistent type errors

Closes GH-16015
2024-11-02 17:36:32 +00:00
Gina Peter Banyard fe02fd5095 ext/gmp: Add behavioural tests for operator overloading 2024-11-02 17:32:43 +00:00
Christoph M. Becker f9453a889d Fix GH-14732: date_sun_info() fails for non-finite values
`timelib_astro_rise_set_altitude()` is not prepared to deal with non-
finite values (`nan`, `inf` and `-inf`) for `lon` and `lat`; instead
these trigger undefined behavior.  Thus we catch non-finite values
before even calling that timelib function; for `date_sun_info()` we
trigger `ValueError`s; for `date_sunrise()` and `date_sunset()` we
silently return `false`, since these functions will be sunsetted
anyway.

Closes GH-16497.
2024-11-01 23:46:19 +01:00
Niels Dossche 886a5287ca Fix GH-16604: Memory leaks in SPL constructors
Closes GH-16673.
2024-11-01 20:42:28 +01:00
Christoph M. Becker ec68d3c608 Properly initialize _override executor globals
These have been introduced a while ago[1], but their initialization has
been overlooked.  Since we cannot rely on TLS variables to be zeroed,
we catch up on this.

[1] <https://github.com/php/php-src/commit/e3ef7bbbb87bcbf6154a0a4854127b9cea8f92ff>

Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>

Closes GH-16658.
2024-10-31 23:38:01 +01:00
Christoph M. Becker c9eafc1954 Fix GH-16450: PDO_ODBC can inject garbage into field values
A previous bug fix[1] relied on ODBC drivers to properly count down the
`StrLen_or_IndPtr` argument for consecutive calls to `SQLGetData()`.
Apparently, not all drivers handle this correctly, so we cannot assert
they do.  Instead we fall back to the old behavior for drivers which
would violate the assertion.

A test against SQLServer (which we currently use in CI) would not make
sense, since the respective drivers do not exhibit that behavior.
Instead we target the regression test especially to a MS Access
database.

Since there is apparently no way to easily create an MS Access database
programmatically, we commit a minimal empty DB which is used for the
regression test, and could also be used by other test cases.

[1] <bccca0b53aa60a62e2988c750fc73c02d109e642>

Closes GH-16587.
2024-10-31 16:15:17 +01:00
Ilija Tovilo e5d63eb4b9 [skip ci] Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [skip ci] Properly disable -Werror for libmysqlclient + mysqli
  [skip ci] Revert "Remove -Werror for libmysql test on 8.1 only"
2024-10-31 13:47:23 +01:00
Ilija Tovilo 6c8a0d0163 [skip ci] Properly disable -Werror for libmysqlclient + mysqli 2024-10-31 13:43:39 +01:00