1
0
mirror of https://github.com/php/php-src.git synced 2026-04-25 08:58:28 +02:00
Commit Graph

13891 Commits

Author SHA1 Message Date
Niels Dossche 81030c9bbb Fix GHSA-r977-prxv-hc43
Move the bound check upwards. Since this doesn't generate output we can
check the bound first.
2024-11-17 19:30:44 +01:00
Jakub Zelenka 426a6d4539 Fix GHSA-c5f2-jwm7-mmq2: stream HTTP fulluri CRLF injection 2024-11-17 19:29:45 +01:00
Ilija Tovilo 25c0993902 Backport CI fixes to security branches
Closes GH-16469

Working towards GH-16286

commit e0db221143b808d97bc3a44e9f0968c6308794b4
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Fri Oct 25 22:48:20 2024 +0200

    Move CFLAGS into ./configure command for consistency

commit 8ad67768250d181cd7fef30e0c866625bbd8ac94
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Fri Oct 25 22:47:03 2024 +0200

    Also upgrade nightly to macOS 13

commit 58a88ccb9f
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Wed Oct 23 19:07:59 2024 +0200

    Fix call to dc[n]gettext in tests with 0 $category

    This causes a segfault on PHP-8.1

commit 611af05c50
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Fri Dec 8 13:36:52 2023 +0100

    [skip ci] Skip intermittently failing curl test on macOS

    The test fails with "CURL ERROR: 56". I will create an issue for it shortly.

commit ec745178bb
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Wed Oct 23 19:05:32 2024 +0200

    Backport parts of 9999a0c for gettext

    See 9999a0cb75

commit 5ce703496f
Author: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date:   Sun Jul 28 14:34:26 2024 +0200

    Fix CI failure on macOS after Curl update

commit 714a3e7071
Author: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date:   Sat Jul 27 16:09:50 2024 +0200

    Fix CI failure after Curl update (#15124)

commit 4f2eb921b9
Author: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date:   Thu May 23 22:20:37 2024 +0200

    Fix GH-14307: Test curl_basic_024 fails with curl 8.8.0

    Curl changed the behaviour, from the changelog:
      - lib: make protocol handlers store scheme name lowercase curl/curl@c294f9c

    From the docs: "The returned scheme might be upper or lowercase. Do
    comparisons case insensitively."

    Closes GH-14312.

commit 251195b41b
Author: Ayesh Karunaratne <ayesh@aye.sh>
Date:   Thu Feb 1 02:03:55 2024 +0700

    ext/curl: Fix failing tests due to string changes in libcurl 8.6.0

    Upstream libcurl 8.6.0 contains a change[^1] that caused a test failure.
    This fixes it by updating the test's `EXPECTF` to use a regex to account for both string patterns.

    [^1]: https://github.com/curl/curl/commit/45cf4755e71f#diff-a8a54563608f8155973318f4ddb61d7328dab512b8ff2b5cc48cc76979d4204cL1683

    Closes GH-13293.

commit fc5d83f2b1
Author: Christoph M. Becker <cmbecker69@gmx.de>
Date:   Wed Oct 16 22:46:20 2024 +0200

    Prepare for necessary move to macOS 13

    GH will remove macOS 12 runner images as of December 3rd, so we prepare
    for that.

    Besides the obvious need to change the runner, we also suppress a
    couple of warnings, because otherwise the build would fail due to
    `-Werror`.
2024-10-28 15:57:16 +01:00
Niels Dossche 4b15f5d4ec Fix GHSA-9fcc-425m-g385: bypass CVE-2024-1874
The old code checked for suffixes but didn't take into account trailing
whitespace. Furthermore, there is peculiar behaviour with trailing dots
too. This all happens because of the special path-handling code inside
CreateProcessW.

By studying Wine's code, we can see that CreateProcessInternalW calls
get_file_name [1] in our case because we haven't provided an application
name. That code gets the first whitespace-delimited string into app_name
excluding the quotes. It's then passed to create_process_params [2]
where there is the path handling code that transforms the command line
argument to an image path [3]. Inside Wine, the extension check if
performed after these transformations [4]. By doing the same thing in
PHP we match the behaviour and can properly match the extension even in
the given edge cases.

[1] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L542-L543
[2] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L565
[3] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L150-L151
[4] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L647-L654
2024-06-05 00:26:14 -05:00
Jakub Zelenka 0ba5229a3f Fix bug GHSA-q6x7-frmf-grcw: password_verify can erroneously return true
Disallow null character in bcrypt password
2024-04-09 23:38:32 -05:00
Niels Dossche 093c08af25 Fix GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
The check happened too early as later code paths may perform more
mangling rules. Move the check downwards right before adding the actual
variable.
2024-04-09 23:37:06 -05:00
Jakub Zelenka e3c784f2bf Add proc_open escaping for cmd file execution 2024-04-09 23:29:28 -05:00
Ilija Tovilo 05ba461524 [skip ci] Fix more test tmp file conflicts 2023-11-22 20:39:29 -06:00
Ilija Tovilo e1e140f2f2 Fix file test race condition
005_variation2.phpt creates files with special names, and
filesize_variation5.phpt checks for filesize of inexistent files with special
names. Create the files in a separate directory to avoid these tests clashing.

Closes GH-12692
2023-11-22 20:39:29 -06:00
Ilija Tovilo 28c312c994 [skip ci] Further increase allowable atime deviation
MSAN is slow in particular, leading to potentially higher deviations.
2023-11-22 20:39:29 -06:00
Niels Dossche c376f9943f Fix GH-12655: proc_open() does not take into account references in the descriptor array
Closes GH-12658.
2023-11-22 20:39:28 -06:00
Ilija Tovilo fe34dd1b49 Fix astat imperciseness excemption in test 2023-11-22 20:39:28 -06:00
Ilija Tovilo db8c91ae9f Fix undeclared variable in stat tests
Closes GH-12645
2023-11-22 20:39:28 -06:00
Niels Dossche e1c6a7c4de Fix GH-12621: browscap segmentation fault when configured in the vhost
The temporary HashTable has a destructor that releases the string held
by the entry's value. However, browscap_intern_str(_ci) only incremented
the refcount for the reference created by the return value. As the
HashTable is only used during parsing, we don't need to manage the
reference count of the value anyway, so get rid of the destructor.

This is triggerable in two cases:
 - When using php_admin_value to set the ini at the activation stage
 - When running out of space for the opcache-interned strings

Closes GH-12634.
2023-11-22 20:39:28 -06:00
Jakub Zelenka b4208c8f96 Initialize syslog device in GINIT
Closes GH-12663
2023-11-16 14:31:44 +00:00
Daniil Gentili 10b2b4a52c Fix memory leak in standard syslog device handling
The BG(syslog_device) is leaked in RINIT.

Closes GH-12501
2023-11-09 13:29:09 +00:00
Jakub Zelenka 52aa0d9ecc Fix bug #75708: getimagesize with "&$imageinfo" fails on StreamWrappers
Closes GH-12444
2023-10-22 13:26:18 +01:00
Ilija Tovilo 4332546bbf Move ARM build to CircleCI
Closes GH-12415
2023-10-12 13:11:38 +02:00
David Carlier d65c80031a Fix GH-12190: stream_context_create with address and port at 0.
Prior to the 8.1 rewrite, inet_aton was used for ipv4 addresses
therefore addresses like `0` passed.
For the bindto's case where both ip and port are set as such, we discard
the address binding.

Close GH-12195
2023-09-24 15:17:53 +01:00
divinity76 4f044e9238 support running testsuite with negative niceness (#11481)
* support running testsuite with negative niceness

a bug in the regex would break getNice() if the current niceness was negative, which would make the whole test fail.

Previously:
this would fail:
time sudo nice --adjustment=-19 ./php run-tests.php -j$(nproc) -x --offline ext/standard/tests/general_functions/proc_nice_basic.phpt --color --show-all

and this would work: 
time sudo ./php run-tests.php -j$(nproc) -x --offline ext/standard/tests/general_functions/proc_nice_basic.phpt --color --show-all

* Update ext/standard/tests/general_functions/proc_nice_basic.phpt

Co-authored-by: Michael Voříšek <mvorisek@mvorisek.cz>

---------

Co-authored-by: Michael Voříšek <mvorisek@mvorisek.cz>
2023-09-22 11:33:25 +02:00
Niels Dossche da6097ffc8 Fix GH-12215: Module entry being overwritten causes type errors in ext/dom (<= PHP 8.3)
When we try to load an extension multiple times, we still overwrite the
type, module number, and handle. If the module number is used to
indicate module boundaries (e.g. in reflection and in dom, see e.g.
dom_objects_set_class_ex), then all sorts of error can happen.

In the case of ext/dom, OP's error happens because the following
happens:
- The property handler is set up incorrectly in
  dom_objects_set_class_ex() because the wrong module number is
  specified. The class highest in the hierarchy is DOMNode, so the
  property handler is incorrectly set to that of DOMNode instead of
  DOMDocument.
- The documentElement property doesn't exist on DOMNode, it only exists
  on DOMDocument, so it tries to read using zend_std_read_property().
  As there is no user property called documentElement, that read
  operation returns an undef value.
  However, the type is still checked, resulting in the strange exception.

Closes GH-12219.
2023-09-20 20:57:04 +02:00
Ilija Tovilo b21df69848 [skip ci] Fix borked xleak skip on <PHP-8.3
xleak in skipif was only added in PHP 8.3.
2023-09-01 12:39:03 +02:00
Ilija Tovilo fb0f4215de Skip dl() tests on ASAN 2023-08-30 22:20:51 +02:00
Jakub Zelenka e1396a314d Fix flaky file stat tests due to changing nature of atime 2023-08-28 12:14:55 +01:00
Kamil Tekiela b1ce1d1f21 Fix param name in implode() error message 2023-08-24 21:05:26 +01:00
Ilija Tovilo 0e843c5d82 Fix EXPECT for bug52820.phpt on newer curl versions
New curl versions have a "processing: url" line. The connection number in
"Closing connection" is apparently also dropped.
2023-08-10 15:51:53 +02:00
George Peter Banyard 4cbc66d5e6 Fix skipif condition on new test
I'm an idiot, messed up the condition when tweaking the test manually before committing.
2023-08-08 12:42:16 +01:00
Athos Ribeiro cbfd73765a Fix off-by-one bug when truncating tempnam prefix
The tempnam documentation currently states that "Only the first 63
characters of the prefix are used, the rest are ignored". However when
the prefix is 64 characters-long, the current implementation fails to
strip the last character, diverging from the documented behavior. This
patch fixes the implementation so it matches the documented behavior for
that specific case where the prefix is 64 characters long.

Closes GH-11870

Signed-off-by: George Peter Banyard <girgias@php.net>
2023-08-08 09:46:27 +01:00
Marc Bennewitz 429f20e981 Prevent int overflow on $decimals in number_format
Closes GH-11714.
Closes GH-11649.
2023-07-21 13:50:18 +02:00
Niels Dossche 6b87e08b82 Fix tests for stat rdev
If HAVE_STRUCT_STAT_ST_RDEV is not set, rdev will be -1. %d only matches
a natural number, we should let it match negative numbers too.
2023-07-11 13:57:17 +02:00
Niels Dossche c408a8b604 Fix GH-11630: proc_nice_basic.phpt only works at certain nice levels
Closes GH-11635.
2023-07-10 13:30:00 +02:00
Ilija Tovilo 849fdcae7d Implement flaky test section
This re-uses the already used for automatic retesting. That's certainly better
than XFAIL.

Closes GH-11325
2023-07-06 09:45:35 +02:00
Ilija Tovilo f47dc259aa Retire AppVeyor
Closes GH-11566
2023-07-05 15:14:20 +02:00
Ilija Tovilo d7d36692fd Fix serialization of RC1 objects appearing in object graph twice
Previously, if an object had RC1 it would never be recorded in
php_serialize_data.ht because it was assumed that it could not be encountered
again. This assumption is incorrect though as the object itself may be saved
inside an array with RCn. This results in a new instance of the object, instead
of a second reference to the same object.

This is solved by tracking these objects in php_serialize_data.ht. To retain
performance, track if the current object resides in a potentially nested RCn
array. If not, and if the object is RC1 itself it may be omitted from
php_serialize_data.ht.

Additionally, we may treat the array root itself as RC1 because it may not
appear in the object graph again without recursion. Recursive arrays are still
somewhat broken even with this change, as the tracking of the array only happens
when the reference is encountered, thus resulting in a -> a' -> a' for a self
recursive array a -> a. Recursive arrays have limited support in serialize
anyway, so we ignore this case for now.

Co-authored-by: Dmitry Stogov <dmitry@zend.com>
Co-authored-by: Martin Hoch <martin@littlerobot.de>

Closes GH-11349
Closes GH-11305
2023-06-28 21:15:03 +02:00
Jonas 1d369a871d Fix context option check for "overwrite" in FTP
Use zend_is_true() to read value of FTP context option "overwrite".

Closes GH-11332.
2023-06-27 17:53:45 +02:00
Ilija Tovilo b2ec6c24f8 Fix exception handling in array_multisort()
Closes GH-11302
2023-05-24 13:55:25 +02:00
Ilija Tovilo f5c54fd88b Fix access on NULL pointer in array_merge_recursive()
Closes GH-11303
2023-05-24 13:36:52 +02:00
Niels Dossche 1ede3137c9 Fix GH-11274: POST/PATCH request via file_get_contents + stream_context_create switches to GET after a HTTP 308 redirect
RFC 7231 states that status code 307 should keep the POST method upon
redirect. RFC 7538 does the same for code 308. Although it's not
mandated by the RFCs that PATCH is also kept (we can choose), it seems
like keeping PATCH will be the most consistent and understandable behaviour.

This patch also changes an existing test because it was testing for the
wrong behaviour.

Closes GH-11275.
2023-05-19 23:37:20 +02:00
Niels Dossche b33fbbfe3d Fix GH-10031: [Stream] STREAM_NOTIFY_PROGRESS over HTTP emitted irregularly for last chunk of data
It's possible that the server already sent in more data than just the headers.
Since the stream only accepts progress increments after the headers are
processed, the already read data is never added to the process.
We account for this by adjusting the progress counter by the difference of
already read header data and the body.

For the test:
Co-authored-by: aetonsi <18366087+aetonsi@users.noreply.github.com>

Closes GH-10492.
2023-05-05 19:26:44 +02:00
nielsdos d75c1d00a9 Fix GH-11175 and GH-11177: Stream socket timeout undefined behaviour
A negative value like -1 may overflow and cause incorrect results in the
timeout variable, which causes an immediate timeout. As this is caused
by undefined behaviour the exact behaviour depends on the compiler, its
version, and the platform.

A large overflow is also possible, if an extremely large timeout value
is passed we also set an indefinite timeout. This is because the timeout
value is at least a 64-bit number and waiting for UINT64_MAX/1000000
seconds is waiting about 584K years.

Closes GH-11183.
2023-05-03 19:40:52 +02:00
Ilija Tovilo 8bf2d587d7 Propagate STREAM_DISABLE_OPEN_BASEDIR src flag to php_stream_stat_path_ex
Otherwise we can get open_basedir warnings from the stat call while still
performing the actual copy.

Fixes GH-11138
Closes GH-11156
2023-04-30 13:36:15 +02:00
Ilija Tovilo e8b8341d3d Support enums in array_unique
Fixes GH-9775
Closes GH-11015
2023-04-16 15:34:56 +02:00
Ilija Tovilo dd44a9330e Fix test bug60120.phpt
The process cmd was broken. We're now also checking that the process output is
actually what we expect.

Closes GH-11064
2023-04-13 12:56:18 +02:00
Niels Dossche 79c5b32d15 Fix GH-10990: mail() throws TypeError after iterating over $additional_headers array by reference
We should dereference the values, otherwise references don't work.

Closes GH-10991.
2023-04-01 19:44:43 +02:00
Niels Dossche 87862835e2 Fix undefined behaviour in unpack()
atoi()'s return value is actually undefined when an underflow or
overflow occurs. For example on 32-bit on my system the overflow test
which inputs "h2147483648" results in repetitions==2147483647 and on
64-bit this gives repetitions==-2147483648. The reason the test works on
32-bit is because there's a second undefined behaviour problem:
in case 'h' when repetitions==2147483647, we add 1 and divide by 2.
This is signed-wrap undefined behaviour and accidentally triggers the
overflow check like we wanted to.

Avoid all this trouble and use strtol with explicit error checking.

This also fixes a semantic bug where repetitions==INT_MAX would result
in the overflow check to trigger, even though there is no overflow.

Closes GH-10943.
2023-03-28 22:43:27 +02:00
Ilija Tovilo e1ec67acd6 Unparallelize IO heavy tests
Alternative to GH-10892. This is somewhat unfortunate since these are also the
slow tests. I'm also not sure if this actually helps.

Closes GH-10953
2023-03-27 16:33:36 +02:00
Niels Dossche 6f56c00498 Fix undefined behaviour in GENERATE_SEED()
Signed multiply overflow is undefined behaviour.
If you run the CI tests with UBSAN enabled on a 32-bit platform, this is
quite easy to hit. On 64-bit it's more difficult to hit though, but not
impossible.

Closes GH-10942.
2023-03-26 16:07:39 +02:00
Niels Dossche 93e0f6b424 Fix undefined behaviour in string uppercasing and lowercasing
At least on 32-bit, the address computations overflow in running the
test on CI with UBSAN enabled. Fix it by reordering the arithmetic.
Since a part of the expression is already used in the code above the
computation, this should not negatively affect performance.

Closes GH-10936.
2023-03-25 21:17:15 +01:00
Ilija Tovilo 57029ce92e Fix buffer-overflow in php_fgetcsv() with \0 delimiter and enclosure
Fixes oss-fuzz #57392
Closes GH-10923
2023-03-25 17:42:39 +01:00
Niels Dossche c407243712 Fix GH-10052: Browscap crashes PHP 8.1.12 on request shutdown (apache2)
get_browser() implements a lazy parse system for the browscap
INI configuration. There are two possible moments when a browscap
configuration can be loaded: during module startup or during request.
In case of module startup, the strings are persistent strings, while for
the request they are not.

The INI parser must therefore know whether to create persistent or
non-persistent strings. It does this by looking at
CG(ini_parser_unbuffered_errors). If that value is 1 it's persistent,
otherwise non-persistent. Note that this also controls how the errors
are reported: if it's 1 then the errors are sent to stderr, otherwise we
get E_WARNINGs.

Currently, a hardcoded value of 1 is always used for that CG value in
browscap_read_file(). This means we'll always create persistent strings
*and* we'll not report parse errors correctly as E_WARNINGs.
We fix both the crash and the lack of warnings by passing the value of
persistent instead of a hardcoded 1.

This is also in line with how other INI parsing code is called in
ext/standard: they also make sure that during request a value of 0 is
passed.

Closes GH-10883.
2023-03-20 20:49:21 +01:00