1
0
mirror of https://github.com/php/php-src.git synced 2026-04-12 10:33:11 +02:00
Commit Graph

1202 Commits

Author SHA1 Message Date
Christoph M. Becker
365769366b Fix #81518: Header injection via default_mimetype / default_charset
We forbid setting these INI options to values containing NUL bytes, CR
or LF.

Closes GH-7574.
2021-10-14 12:16:19 +02:00
Calvin Buckley
98a21d1dfb Fix bug #80728: Don't reset the timeout on ini deactivate
When the time limit for a script is changed, when the script ends,
its INI value will be reset. This calls the event handler for the
timeout change, which will unset then reset the timeout. However,
this is done even if the script is done executing, and say, the CGI
or CLI web server process is idle.

This is probably incorrect, but isn't a problem on most platforms,
because PHP uses a timer that only ticks when the process is active
(that is, executing code). Since when it's idle, it's blocking on
listen/read, it won't tick because nothing executes. However, on
platforms where only the real-time timer is supported, (Cygwin/PASE)
it ticks regardless of if PHP is even executing. This means that the
idle processes are subject to timeouts from the INI reset on script
end.

This makes it so the timer is never set if the state is deactivating.
Testing with the CLI web server indicates the timer no longer
spuriously activates under PASE.

Closes GH-6683.
2021-06-29 16:36:46 +02:00
Nikita Popov
d8165c2502 Fixed bug #81104
When the memory limit is restored during shutdown, we may still
be using a lot of memory. Ignore the failure at that point and
set it again after the MM is shut down, at which point memory
usage should be at its lowest point.
2021-06-08 14:31:55 +02:00
Peter van Dommelen
1b3b5c94e5 Fixed bug #81070
When the memory limit is reduced using an `ini_set("memory_limit", ..)`
below the currently allocated memory, the out-of-memory check overflowed.
Instead of implementing additional checks during allocation,
`zend_set_memory_limit()` now validates the new memory limit. When
below the current memory usage the ini_set call will fail and throw
a warning.

This is part of GH-7040.
2021-05-31 15:18:58 +02:00
Christoph M. Becker
39ddf6b89c Fix #67792: HTTP Authorization schemes are treated as case-sensitive
We use `zend_binary_strncasecmp()` to avoid any locale issues, and
refactor.  We also add a test case for Digest authentication.

Closes GH-6900.
2021-04-23 15:54:17 +02:00
Christoph M. Becker
ea3c992bff Fix #80960: opendir() warning wrong info when failed on Windows
Firstly, we must not forget to set appropriate error codes for "manual"
checks in `virtual_file_ex()`.

Secondly, we must not call `php_error_docref2()` for warnings regarding
unary functions; thus, we introduce `php_win32_docref1_from_error()`.

Closes GH-6872.
2021-04-19 16:12:22 +02:00
Christoph M. Becker
bfcee2c746 Check compatibility with proper runtime DLL
In practise, this likely does not matter, because usually these DLLs
are installed side by side, but still we should check the proper DLL.
2020-05-14 15:57:55 +02:00
Nikita Popov
d050d74477 Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
  Fix default sendmail path when not found during build
2020-05-11 10:46:00 +02:00
Indrek Ardel
517431892b Fix default sendmail path when not found during build
Closes GH-5548.
2020-05-11 10:45:23 +02:00
Nikita Popov
018251a7c4 Fixed bug #71876
This is a backport of fcdc0a6db0
to the PHP-7.3 branch. We need to make sure that OnUpdateString
is also called for a NULL value, otherwise the reset of the encoding
at the end of the request will not work.

I believe I already tried to land this before once, but it didn't
actually end up on the PHP-7.3 branch due to a push conflict that
I only noticed just now.
2020-01-17 09:47:31 +01:00
Nikita Popov
e45b613950 Free buffer in php_verror even if it is empty
vspprintf allocates a buffer even if the resulting string is empty.
2019-12-17 16:46:52 +01:00
Nikita Popov
fcdc0a6db0 Fix resetting of internal_encoding and friends
We need to update the value even if new_value is NULL. In particular,
it should be reset back to NULL after each request if the setting was
not specified on startup. Otherwise we leave dangling pointers.
2019-12-17 16:27:56 +01:00
Christoph M. Becker
973617cacd Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
  Fix #78656: Parse errors classified as highest log-level
2019-10-09 17:29:54 +02:00
Christoph M. Becker
bbd481c11d Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2:
  Fix #78656: Parse errors classified as highest log-level
2019-10-09 17:28:50 +02:00
Erik Lundin
3164186d53 Fix #78656: Parse errors classified as highest log-level 2019-10-09 17:27:32 +02:00
Nikita Popov
b01824e596 Fixed bug #78406 2019-08-13 10:22:32 +02:00
Nikita Popov
6df1665bb3 Merge branch 'PHP-7.3' into PHP-7.4 2019-07-29 17:14:40 +02:00
Nikita Popov
bbed5564eb Merge branch 'PHP-7.2' into PHP-7.3 2019-07-29 16:57:57 +02:00
Nikita Popov
38f1288b64 Fix Zend signals unblocking
There are a few parts here:
 * opcache should not be blocking signals while invoking compile_file,
   otherwise signals may remain blocked on a compile error. While at
   it, also protect SHM memory during compile_file.
 * We should deactivate Zend signals at the end of the request, to make
   sure that we gracefully recover from a missing unblock and signals
   don't remain blocked forever.
 * We don't use a critical section in deactivation, because it should
   not be necessary. Additionally we want to clean up the signal queue,
   if it is non-empty.
 * Enable SIGG(check) in debug builds so we notice issues in the future.
2019-07-29 15:17:32 +02:00
Nikita Popov
b3f74b0b7d Deprecate allow_url_include 2019-07-22 11:39:52 +02:00
Nikita Popov
856c5d2837 Revert "Avoid unused fstat() call"
This reverts commit 5a90dc77b8.

Let's try to go with the reverse direction here and actually trust
the reported size...
2019-07-17 11:49:10 +02:00
Nikita Popov
5a90dc77b8 Avoid unused fstat() call
If we're including a file via PHP streams, we're not going to trust
the reported file size anyway and populate in a loop -- so don't
bother determining the file size in the first place. Only do this
for non-tty HANDLE_FP now, which is the only case where this
information was used.
2019-07-17 11:22:31 +02:00
Nikita Popov
a986e70991 Avoid double buffering in Zend streams
Disable buffering in PHP streams, to avoid storing and copying the
file contents twice.

This will call stream_set_option() on custom stream wrapper as
well, so the method needs to be implemented to avoid a warning.
2019-07-17 10:40:04 +02:00
Nikita Popov
b317f0eb59 Remove ZEND_HANDLE_MAPPED
The buf/len members are now simply used in addition to the main
stream, without changing the handle kind.
2019-07-16 17:44:32 +02:00
Nikita Popov
e0eca26285 Drop free_filename field from zend_file_handle
free_filename was always zero.
2019-07-16 17:07:26 +02:00
Nikita Popov
49bac9b77b Introduce zend_stream_init_filename()
Avoid more ad-hoc initialization of zend_file_handle structures.
2019-07-16 16:44:37 +02:00
Nikita Popov
5161cebe28 Fix bug #52752 by not using mmap() to lex files
Using mmap() is unsafe under concurrent modification. If the file
is truncated, access past the end of the file may occur, which will
generate a SIGBUS error. Even if the length does not change, the
contents may, which is a situation that the lexer certainly is not
prepared to deal with either.

Reproduce with test.php:

    <?php
    file_put_contents(__DIR__ . '/test.tpl',
        'AAA<?php $string = "' .
        str_repeat('A', mt_rand(1, 256 * 1024)) .
        '"; ?>BBB' . "\r\n");
    require_once __DIR__ . '/test.tpl';

And:

    for ((n=0;n<100;n++)); do sapi/cli/php test.php & done
2019-07-16 15:47:10 +02:00
George Peter Banyard
548d1ec27c Small typo and proto name fix
Closes GH-4415
2019-07-15 18:15:17 +02:00
Nikita Popov
c5f1b384b5 Move shebang handling into the lexer
Instead of handling shebang lines by adjusting the file pointer in
individual SAPIs, move the handling into the lexer, where this is
both a lot simpler and more robust. Whether the shebang should be
skipped is controlled by CG(skip_shebang) -- we might want to do
that in more cases.

This fixed bugs #60677 and #78066.
2019-07-15 16:25:49 +02:00
George Peter Banyard
1c1de0c41a Convert all php_error_docref0 to php_error_docref
Closes GH-4394
2019-07-13 02:05:17 +02:00
Nikita Popov
b88ef3dc58 Remove unused (module|request)_shutdown_for_exec 2019-07-02 10:10:51 +02:00
Joe Watkins
68485f8ab4 implement tsrm_is_shutdown API 2019-06-28 10:27:19 +02:00
Nikita Popov
1b63528d38 Merge branch 'PHP-7.3' into PHP-7.4 2019-06-17 13:14:18 +02:00
Erik Lundin
9f0515c40c Add syslog.filter=raw
This passes through syslog message unchanged, without splitting
messages at newlines.
2019-06-17 13:13:25 +02:00
Peter Kokot
f45b61b898 [ci skip] Migrate Coding standards docs to Markdown 2019-05-18 21:41:38 +02:00
bugreportuser
d65f93f92b Remove duplicate zend_unset_timeout() 2019-04-23 12:44:20 +02:00
Nikita Popov
f73f190c3f Fix internal_encoding fallback in mbstring
By introducing a hook that is called whenever one of
internal_encoding / input_encoding / output_encoding changes, so
that mbstring can adjust it's internal state.

This also makes internal_encoding work with zend multibyte.
2019-04-17 14:05:53 +02:00
Peter Kokot
e06836a1a3 Remove checks for locale.h, setlocale, localeconv
The `<loccale.h>` header file, setlocale, and localeconv are part of the
standard C89 [1] and on current systems can be used unconditionally.

Since PHP 7.4 requires at least C89 or greater, the `HAVE_LOCALE_H`,
`HAVE_SETLOCALE`, and `HAVE_LOCALECONV` symbols defined by Autoconf in
configure.ac [2] can be ommitted and simplifed.

The bundled libmagic (file) has also been patched already in version
5.35 and up in upstream location so when it will be patched also in
php-src the check for locale.h header is still left in the configure.ac
and in windows headers definition file.

[1] https://port70.net/~nsz/c/c89/c89-draft.html#4.4
[2] https://git.savannah.gnu.org/cgit/autoconf.git/tree/lib/autoconf/headers.m4

Omit the bundled libmagic files
2019-04-07 18:32:54 +02:00
Peter Kokot
5f8915786f Remove HAVE_SIGNAL_H
The `<signal.h>` header file is part of the standard C89 headers [1] and
on current systems can be included unconditionally.

Since file requires at least C89 or greater, the `HAVE_SIGNAL_H` symbol
defined by Autoconf in Zend.m4 [2] can be ommitted and simplifed.

The bundled libmagic (file) also ommits the usage of HAVE_SIGNAL_H since
5.35 however current version in PHP is very modified 5.34 version and
will be refactored separately. Check for HAVE_SIGNAL_H is therefore
still done in the configure.ac.

Refs:
[1] https://port70.net/~nsz/c/c89/c89-draft.html#4.1.2
[2] https://git.savannah.gnu.org/cgit/autoconf.git/tree/lib/autoconf/headers.m4
2019-04-07 15:55:34 +02:00
Anatol Belski
dd0aca0c11 Implement stricter CRT check
This aligns with the recommendations about VS2015, VS2017 and VS2019
compatibility.

More info below
https://devblogs.microsoft.com/cppblog/cpp-binary-compatibility-and-pain-free-upgrades-to-visual-studio-2019/
2019-03-31 17:33:36 +02:00
Dmitry Stogov
9499484ed2 Implemented a faster way to access predefined TSRM resources - CG(), EG(), etc. 2019-03-14 03:01:01 +03:00
Joe Watkins
df6e9fae8f drop unused parameter from zend_startup 2019-03-11 10:10:14 +01:00
Peter Kokot
2957651c5c Move Makefile.global and Makefile.gcov to build directory
These files can be stored in the build directory instead of bloating the
project root directory.
2019-03-04 12:30:42 +01:00
Anatol Belski
12bfd9a5f5 Implement FR #77377 handle CTRL+C in Windows 2019-02-08 18:10:31 -08:00
Peter Kokot
92ac598aab Remove local variables
This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly used by Vim and Emacs editors
yet with recent changes the once working definitions don't work
anymore in Vim without custom plugins or additional configuration.
Neither are these settings synced across the PHP code base.

A simpler and better approach is EditorConfig and fixing code
using some code style fixing tools in the future instead.

This patch also removes the so called modelines for Vim. Modelines
allow Vim editor specifically to set some editor configuration such as
syntax highlighting, indentation style and tab width to be set in the
first line or the last 5 lines per file basis. Since the php test
files have syntax highlighting already set in most editors properly and
EditorConfig takes care of the indentation settings, this patch removes
these as well for the Vim 6.0 and newer versions.

With the removal of local variables for certain editors such as
Emacs and Vim, the footer is also probably not needed anymore when
creating extensions using ext_skel.php script.

Additionally, Vim modelines for setting php syntax and some editor
settings has been removed from some *.phpt files.  All these are
mostly not relevant for phpt files neither work properly in the
middle of the file.
2019-02-03 21:03:00 +01:00
Joe Watkins
25dc5f18e4 Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
  Fix bug 76596: phpdbg supports display_errors=stderr
2019-01-30 18:28:55 +01:00
Joe Watkins
7d1df603ad Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2:
  Fix bug 76596: phpdbg supports display_errors=stderr
2019-01-30 18:28:25 +01:00
Kevin Abel
3890c8bce5 Fix bug 76596: phpdbg supports display_errors=stderr 2019-01-30 18:27:57 +01:00
Zeev Suraski
0cf7de1c70 Remove yearly range from copyright notice 2019-01-30 11:03:12 +02:00
Dmitry Stogov
9882929bfa Removed transparent wrapper 2018-12-26 17:34:03 +03:00