1
0
mirror of https://github.com/php/php-src.git synced 2026-04-10 01:23:53 +02:00
Commit Graph

13881 Commits

Author SHA1 Message Date
Ben Ramsey
c6c83c0462 Update versions for PHP 8.1.14 2023-01-04 00:17:57 -06:00
Ben Ramsey
047c97841d Update NEWS 2023-01-04 00:09:26 -06:00
Christoph M. Becker
2f6b9e6c63 Fix #81742: open_basedir bypass in SQLite3 by using file URI
A previous fix[1] was not sufficient to catch all potential file URIs,
because the patch did not cater to URL encoding.  Properly parsing and
decoding the URI may yield a different result than the handling of
SQLite3, so we play it safe, and reject any file URIs if open_basedir
is configured.

[1] <https://bugs.php.net/bug.php?id=77967>

Closes GH-10018.
2022-12-06 15:59:52 +01:00
George Peter Banyard
608ddb0321 Fix GH-10011 (Trampoline autoloader will get reregistered and cannot be unregistered)
There are two issues to resolve:
 1. The FCC is not refetch when trying to unregister a trampoline
 2. Comparing the function pointer of trampolines is meaningless as they are reallocated, thus we need to compare the name of the function

Found while working on GH-8294

Closes GH-10033
2022-12-02 12:47:25 +00:00
蝦米
93592ea743 Fix GH-9769: Misleading error message for unpacking of objects
Only arrays can be unpacked in constant expressions.

Closes GH-9776.
2022-12-02 13:10:59 +01:00
Derick Rethans
d021851171 Fixed GH-9699, GH-9866, and GH-9880 (problems with diff); and GH-9700 (greedy tzid parsing) 2022-11-30 15:47:43 +00:00
Christoph M. Becker
44377c3c70 Fix GH-9971: Incorrect NUMERIC value returned from PDO_Firebird
Dialect 1 databases store and transfer `NUMERIC(15,2)` values as
doubles, which we need to cater to in `firebird_stmt_get_col()` to
avoid `ZEND_ASSUME(0)` to ever be triggered, since that may result
in undefined behavior.

Since adding a regression test would require to create a dialect 1
database, we go without it.

Closes GH-10021.
2022-11-30 12:11:42 +01:00
Jakub Zelenka
500b28ad04 Fix GH-10000: Test failures when OpenSSL compiled with no-dsa 2022-11-25 14:02:03 +00:00
Arnaud Le Blanc
4987e65a70 [ci skip] NEWS 2022-11-25 14:07:30 +01:00
Jakub Zelenka
ce57221376 Fix GH-9064: PHP fails to build if openssl was built with no-ec 2022-11-25 12:49:12 +00:00
Jakub Zelenka
c9c1934ff0 Fix GH-8517: FPM child pointer can be potentially uninitialized
There might be a moment when the child log event is executed after
freeing a child. That could possibly happen if the child output is
triggered at the same as the terminating of the child. Then the output
event could be potentially processed after the terminating event which
would cause this kind of issue.

The issue might got more visible after introducing the log_stream on
a child because it is more likely that this cannot be dereferenced
after free. However it is very hard to reproduce this issue so there
is no test for this.

The fix basically prevents passing a child pointer and instead passes
the child PID and then looks the child up by the PID when it is being
processed. This is obviously slower but it is a safe way to do it and
the slow down should not be hopefully visible in a way that it would
overload a master process.
2022-11-23 11:25:51 +00:00
Jakub Zelenka
1767f32cb6 [ci skip] Fix NEWS FPM entries 2022-11-22 18:47:24 +00:00
Jakub Zelenka
5a4520bc2b Fix bug #68207: Setting fastcgi.error_header can result in a WARNING 2022-11-22 18:17:16 +00:00
Jakub Zelenka
31b20f1737 Merge branch 'PHP-8.0' into PHP-8.1 2022-11-22 18:02:11 +00:00
Petr Sumbera
72da2b02e2 php-fpm: fix Solaris port events.mechanism
Closes GH-9959.
2022-11-22 18:01:15 +00:00
George Peter Banyard
6fbf81c674 Fix GH-9883 SplFileObject::__toString() reads next line
We need to overwrite the __toString magic method for SplFileObject, similarly to how DirectoryIterator overwrites it
Moreover, the custom cast handler is useless as we define __toString methods, so use the standard one instead.

Closes GH-9912
2022-11-22 12:21:14 +00:00
Christoph M. Becker
2d94ee5f20 Avoid undefined behavior in Windows ftok(3) emulation
`.nFileIndexHigh` is a unsigned 32bit number.  Casting that to `__int64`
and shifting left by 32bits triggers undefined behavior if the most
significant bit of `.nFileIndexHigh` is set.  We could avoid that by
casting to `(__uint64)`, but in that case the whole clause doesn't have
an effect anymore, so we drop it altogether.

Closes GH-9958.
2022-11-18 14:37:00 +01:00
Michael Voříšek
8d65c2fee5 Fix GH-9650: Can't initialize heap: [0x000001e7]
Closes GH-9721.
2022-11-17 14:16:10 +01:00
David Carlier
a4298c14c1 Fix GH-9932: Discards further characters for session name.
As those are converted, it s better to make aware of the code caller of the naming inadequacy.
Closes GH-9940.
2022-11-15 12:27:44 +00:00
Alex Dowad
1562ba5b71 [ci skip] NEWS 2022-11-13 14:40:45 +02:00
Arnaud Le Blanc
73583bb8c0 [ci skip] NEWS 2022-11-13 11:05:12 +01:00
Akama Hitoshi
af68beb16a [ci skip] Fix GH-9918: License information for xxHash is not included in README.REDIST.BINS file
Closes GH-9919.
2022-11-10 12:37:08 +01:00
Christoph M. Becker
b2186ca7c4 Fix GH-9905: constant() behaves inconsistent when class is undefined
Directly referring to a constant of an undefined throws an exception;
there is not much point in `constant()` raising a fatal error in this
case.

Closes GH-9907.
2022-11-09 15:21:50 +01:00
Sara Golemon
ac508301c9 Bump for 8.0.27 2022-11-08 22:10:29 +00:00
Patrick Allaert
540488c74e PHP-8.1 is now for PHP 8.1.14-dev 2022-11-08 17:57:34 +01:00
Arnaud Le Blanc
1cd217038e [ci skip] NEWS 2022-11-04 16:01:52 +01:00
Arnaud Le Blanc
1d67e34c49 [ci skip] NEWS 2022-11-04 15:58:07 +01:00
Christoph M. Becker
8bf6266e65 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix potential NULL pointer dereference Windows shm*() functions
2022-11-02 14:53:30 +01:00
Christoph M. Becker
d1c9ff5642 Fix potential NULL pointer dereference Windows shm*() functions
`shm_get()` (not to be confused with `shmget()`) returns `NULL` if
reallocation fails; we need to cater to that when calling the function.

Closes GH-9872.
2022-11-02 14:51:59 +01:00
Jakub Zelenka
29f7c4613e Merge branch 'PHP-8.0' into PHP-8.1 2022-10-30 11:43:11 +00:00
Jakub Zelenka
1c5844aa3e Fix GH-9754: SaltStack hangs when running php-fpm 8.1.11
SaltStack uses Python subprocess and redirects stderr to stdout which is
then piped to the returned output. If php-fpm starts in daemonized mode,
it should close stderr. However a fix introduced in GH-8913 keeps stderr
around so it can be later restored. That causes the issue reported in
GH-9754. The solution is to keep stderr around only when php-fpm runs in
foreground as the issue is most likely visible only there. Basically
there is no need to restore stderr when php-fpm is daemonized.
2022-10-30 11:41:33 +00:00
Kamil Tekiela
bce12f4e57 Add NEWS entry for #9841 2022-10-28 11:23:37 +01:00
Kamil Tekiela
96049867d8 Add NEWS entry for #9841
Closes GH-9841
2022-10-27 18:29:17 +01:00
Remi Collet
c84d7cc27e move CVEs in 8.1.12 changelog 2022-10-26 17:10:29 +02:00
Remi Collet
db28ee8fd0 move CVEs in 8.0.25 changelog 2022-10-26 15:27:23 +02:00
Stanislav Malyshev
2caa79e963 Merge branch 'PHP-8.0' into PHP-8.1 2022-10-23 18:53:26 -06:00
Stanislav Malyshev
80ccaa3e36 Merge branch 'PHP-7.4' into PHP-8.0 2022-10-23 18:52:56 -06:00
Stanislav Malyshev
2669ed7d77 Update NEWS 2022-10-23 18:50:53 -06:00
David Carlier
fe06c5ef60 Merge branch 'PHP-8.0' into PHP-8.1 2022-10-23 00:46:25 +01:00
Adam Saponara
45e224cf51 Fix GH-9709: Guard against current_execute_data==NULL in is_handle_exception_set 2022-10-23 00:46:05 +01:00
Jakub Zelenka
ec844ccc3f Merge branch 'PHP-8.0' into PHP-8.1 2022-10-22 22:12:05 +01:00
Jakub Zelenka
fa1b6ab5db Fix GH-8430: OpenSSL compiled with old disgests does not build
Specifically no-md2, no-md4 or no-rmd160 were not supported
2022-10-22 22:11:05 +01:00
Arnaud Le Blanc
386bbf4655 [ci skip] NEWS 2022-10-22 10:44:37 +02:00
Arnaud Le Blanc
845c6b3b3b [ci skip] NEWS 2022-10-22 10:43:11 +02:00
Stanislav Malyshev
248f647724 Fix bug #81738 (buffer overflow in hash_update() on long parameter) 2022-10-20 23:57:35 -06:00
Derick Rethans
41a6a298d9 Update NEWS 2022-10-17 18:22:29 +01:00
Arnaud Le Blanc
e3c40c6829 [ci skip] NEWS 2022-10-16 12:44:05 +02:00
Arnaud Le Blanc
f702f87f70 [ci skip] NEWS 2022-10-16 12:43:21 +02:00
Christoph M. Becker
24c297086d Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix GH-9720: Null pointer dereference while serializing the response
2022-10-13 16:00:36 +02:00
Christoph M. Becker
e440e37fa8 Fix GH-9720: Null pointer dereference while serializing the response
When traversing the result array, we need to cater to `param_name`
possibly being `NULL`.  Prior to PHP 7.0.0, this was implicitly done
because `param_name` was of type `char*`.

Closes GH-9739.
2022-10-13 15:56:08 +02:00