1
0
mirror of https://github.com/php/php-src.git synced 2026-03-29 11:42:17 +02:00
Commit Graph

128403 Commits

Author SHA1 Message Date
Ben Ramsey
aa4bed90d8 Prepare for PHP 8.1.32 php-8.1.32 2025-03-11 17:02:51 -05:00
Ben Ramsey
8aab89bc8d Update versions for PHP 8.1.32
[skip ci]
2025-03-11 16:58:26 -05:00
Ben Ramsey
e3a6c82e94 Revert "Update versions for PHP 8.1.32"
This reverts commit fe862bbf63.
2025-03-11 16:50:39 -05:00
Ben Ramsey
fe862bbf63 Update versions for PHP 8.1.32 2025-03-11 16:21:45 -05:00
Jakub Zelenka
74d548bf58 Update NEWS with entries for security fixes 2025-03-11 21:50:17 +01:00
Niels Dossche
0e715e71d9 Fix GHSA-wg4p-4hqh-c3g9 2025-03-11 21:50:17 +01:00
Tim Düsterhus
b6004a043c Fix GHSA-p3x9-6h7p-cgfc: libxml streams wrong content-type on redirect
libxml streams use wrong content-type header when requesting a
redirected resource.
2025-03-11 21:50:17 +01:00
Jakub Zelenka
41d49abbd9 Fix GHSA-hgf5-96fm-v528: http user header check of crlf 2025-03-11 21:50:16 +01:00
Jakub Zelenka
ac1a054bb3 Fix GHSA-52jp-hrpf-2jff: http redirect location truncation
It converts the allocation of location to be on heap instead of stack
and errors if the location length is greater than 8086 bytes.
2025-03-11 21:50:16 +01:00
Jakub Zelenka
0548c4c175 Fix GHSA-pcmh-g36c-qc44: http headers without colon
The header line must contain colon otherwise it is invalid and it needs
to fail.

Reviewed-by: Tim Düsterhus <tim@tideways-gmbh.com>
2025-03-11 21:50:16 +01:00
Jakub Zelenka
d20b4c97a9 Fix GHSA-ghsa-v8xr-gpvj-cx9g: http header folding
This adds HTTP header folding support for HTTP wrapper response
headers.

Reviewed-by: Tim Düsterhus <tim@tideways-gmbh.com>
2025-03-11 21:50:16 +01:00
Niels Dossche
f209eb448e Fix tests for libxml2 2.14
See GH-18009.
2025-03-10 20:22:11 +01:00
Ilija Tovilo
ee7fcf2a07 Increase CircleCI no_output_timeout
Closes GH-18002
2025-03-10 13:37:24 +01:00
Ilija Tovilo
b0858427aa Suppress snmp lib memory leak, skip ASAN tests
I don't know enough about this library to fix those :(

Cherry-picked from:
be4db6b550
ba1d9d0ab2
2025-03-08 16:10:59 +01:00
Calvin Buckley
5e8aff2c5f Remove "Notify Slack" on ppc nightly workflow (#17993)
We get weird failures at here, and Ilija was talking about possibly
removing it in general.
2025-03-07 10:39:14 -04:00
Ilija Tovilo
5fcc8d4cd1 Upgrade security branches to Ubuntu 22.04
20.04 goes out of security support in 2 months. Backporting various
commits.

See d98963a071
See af721c9c36
See 378b79b90c

Closes GH-17963
2025-03-06 15:24:15 +01:00
Ilija Tovilo
8a699372f2 Fix flaky DatePeriod test
$start and $end use the H:i:s from the current time. If $end happens on
a second boundary, $start + 4 days will include $end, thus performing an
extra iteration. Fix this by setting H:i:s to 00:00:00.
2025-03-06 15:01:30 +01:00
Calvin Buckley
dc6586dd9d Skip mysqli/tests/bug73462 on PPC CI (#17971)
* Skip this test on PPC CI

Seems to be unfortunately flaky with persistent connections.

* use spaces in phpt file
2025-03-05 10:17:39 -04:00
Calvin Buckley
4694c3e997 Attempt at ppc64 CI (#17945)
This assumes gentoo (which has best ppc64be support of mainstream
distributions).

(Rebased onto the new workflow_call approach)
2025-03-03 10:04:02 -04:00
Ilija Tovilo
e71b8cae7e [skip ci] Use laravel default branch in community build
See: https://github.com/laravel/framework/issues/54754#issuecomment-2678092563

According to this comment, the default branch more actively receives
changes throuought the year than master. Hence, it makes more sense to
test the default branch.
2025-02-24 15:58:04 +01:00
Shivam Mathur
f4aadb5537 ci: add workflow to trigger windows builds 2025-02-14 23:32:30 +00:00
Bob Weinand
7f6c05116e [skip ci] Fix phpize for Windows 11 (24H2)
It seems like n === undefined must have worked on older versions of
jscript, but currently it just causes the insertion to silently fail.
This sets n to an empty string, allowing phpize to include the local
config.w32 files.
2025-02-14 17:15:24 +01:00
Ilija Tovilo
726cf51236 Add CONFLICT all to random port test
If we're very unlucky, we can get the same port opened as an ephemeral
port by some other test.

Closes GH-17706
2025-02-06 15:25:16 +01:00
Christoph M. Becker
36d46a4732 Fix curl_basic_022.phpt for libcurl 8.12.0
Due to a deliberate change in libcurl, the expiration is now capped to
at most 400 days.  We could solve this by choosing another date roughly
a year in the future, but would need to update the test next year.
This would be especially annoying for security branches.

Another option would be to actually parse the cookie list lines, but
that might not be worth the trouble.  Instead we just ignore the exact
timestamp created by libcurl.

[1] <https://github.com/curl/curl/pull/15937>

Closes GH-17709.
2025-02-05 19:20:47 +01:00
Ilija Tovilo
d8aedb589c [skip ci] Another flaky phar macOS test 2025-02-04 14:52:03 +01:00
Christoph M. Becker
afe8e2cdff Relax timezone_IDforWindowsID_basic2.phpt expectations
Apparently, some ICU versions report "America/Los_Angeles" for the `ZZ`
case, what matches the behavior of ICU 76.1 (on Windows).  Possibly,
there has been some bug fix backport on some systems.  Anyhow, either
seems fine, so we're not picky about that.

Closes GH-17669.
2025-02-02 13:35:27 +01:00
Ilija Tovilo
d9744869e6 [skip ci] Another flaky macOS phar test 2025-01-28 12:58:30 +01:00
Ilija Tovilo
65b990a1e0 [skip ci] Another flaky macOS phar test 2025-01-28 12:44:24 +01:00
Ilija Tovilo
d17d58a982 Fix cve-2014-3538 test
Make sure we have a unique test file to work with, and increase the time
for the nojit version to match the default version.

Closes GH-17600
2025-01-27 20:01:13 +01:00
Ilija Tovilo
c99fb05929 Fix mysql mysql_native_password error on CircleCI
This is already fixed in higher branches. We'll need to fix this
properly when upgrading to MySQL 8.4, which we should do soon as 8.3 is
already EOL.

Closes GH-17560
2025-01-27 17:11:29 +01:00
Christoph M. Becker
a403b76e88 Use preinstalled MySQL for Windows CI
Recent hosted GH Windows runners already have MySQL preinstalled, so
there is no particular need to install it again via Chocolatey or other
means.

If we ever need to address more specific needs, we may want to have a
look at <https://github.com/ankane/setup-mysql>.

Closes GH-17561.
Closes GH-17570.
2025-01-25 17:40:00 +01:00
Ilija Tovilo
3e6f4702ba Fix GHA config yml error 2025-01-24 15:43:22 +01:00
Ilija Tovilo
5b32011fb5 [skip ci] Use !cancelled() over always() in GHA config
According to the documentation, !cancelled() should be used over
always() when the step should be executed regardless of success of
failure, but canceled when the workflow is canceled.

See https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/evaluate-expressions-in-workflows-and-actions#always
2025-01-24 14:27:15 +01:00
Ilija Tovilo
5b8c960c9f Skip Symfony/Wordpress in 8.1 build
There are two issues: The latest Symfony branches don't support 8.1
anymore. This could ber mitigated by switching to LTS for security
builds. However, there are also some JIT bugs that are hard to backport.
We'll skip these builds on 8.1 instead.
2025-01-24 14:11:55 +01:00
Ilija Tovilo
f26250c7c7 Backport nightly.yml
This file should stay up-to-date for consistent behavior across workflow
triggers.
2025-01-24 12:24:39 +01:00
Jakub Zelenka
235d1b14a3 Fix GH-17499: mysqli flaky test: ghsa-h35g-vwh6-m678-stmt-row-string 2025-01-19 20:36:12 +01:00
Jakub Zelenka
9e1b58274e Test stream_context_tcp_nodelay_server on Windows
Closes GH-17308
2025-01-05 14:44:22 +01:00
Jakub Zelenka
b8731767d8 Fix GH-16955: Use empheral ports for OpenSSL server client tests
And refactor some client server tests.

Closes GH-17180
2024-12-31 14:25:19 +01:00
Ilija Tovilo
8a9d45b86f Backport flaky flag for phar tests
4e12189604
b6ca871396
062837aa13
2024-12-10 10:35:00 +01:00
Jakub Zelenka
39c292b1eb Use empheral port for mysqli fake server tests 2024-12-09 23:34:50 +01:00
Niels Dossche
806d2e073c Backport GH-16348
Agreed by RM: https://github.com/php/php-src/issues/16168#issuecomment-2525433557

The inline assembly uses labels with the prefix `.L`. On Linux systems
this is the local label prefix. It appears that macOS uses `L` as a
local prefix, which means that the prefix used in the inline assembly is not
local for macOS systems [1].
When combined with inlining, this causes the compiler to get confused
and merge a part of the inline assembly between different functions,
causing control flow to jump from one function to another function.
This is avoided on PHP 8.2 and up by the fact that it
uses `zend_never_inline NOIPA`, but nothing guarantees that compiler
changes won't affect this as well.

To solve this issue, we instead use local labels. These will make the
compiler pick the correct prefix, preventing the issue.

Additionally, while here, we also change the computation of `delta`.
It is undefined behaviour to compute the pointer difference between
two different objects. To circumvent this, we cast first to `uintptr_t`.

This change is cleanly backportable to 8.1 for vendors to pick up.

[1] https://github.com/php/php-src/issues/16168#issuecomment-2404792553

With the help of investigation and testing of @ryandesign.

Closes GH-16348.
2024-12-09 21:00:05 +01:00
Dmitry Stogov
b0b39cdc3e Backport JIT fix: set valid EX(opline) before calling gc_possible_root() (#16858)
This will finally make the COMMUNTIY build of the PHP 8.1 build green.

See https://github.com/php/php-src/pull/16858#issuecomment-2509010556
Closes GH-17091
2024-12-09 16:59:41 +01:00
Ilija Tovilo
e675c1a467 Drop intl on macOS + PHP 8.1 build
Based on the discussion in GH-16286, drop the intl build from macOS + PHP 8.1,
since we cannot build with supported intl versions without too many changes.

Closes GH-17092
See GH-16286
2024-12-09 16:55:31 +01:00
Christoph M. Becker
2285d7083e Revert "Enable GHSA-9pqp-7h25-4f32.phpt on Windows"
This reverts commit 7685fb0e1c.

The test fails at least for PHP-8.2+ on CI. Needs closer investigation.
2024-12-04 20:43:49 +01:00
Christoph M. Becker
7685fb0e1c Enable GHSA-9pqp-7h25-4f32.phpt on Windows
Closes GH-16933.
2024-12-04 19:03:42 +01:00
Ayesh Karunaratne
b263f351c4 CI: FreeBSD on VM - set copyback: false
The `vmactions/freebsd-vm` GitHub action rsyncs the work dir to to the
VM. This adds a lot of log output due to `rsync -v` usage.

Once the tests are compelte, the action copies the files _back_ by
running `rsync` in reverse. However, we do not need these files back
because we do not run any other steps that need access to the post-test
files.

Setting `copyback: false` disables this, and cuts the log size by about
5,000 lines.

Closes Closes GH-16916.
2024-11-25 19:30:19 +07:00
Jakub Zelenka
eb951b3d11 Increase MySQLi fake server read timeout for ASAN job 2024-11-24 23:48:27 +01:00
Jakub Zelenka
51f5539914 Change port for mysqli fake server auth message test 2024-11-24 20:13:47 +01:00
Ilija Tovilo
aca88baf5f Move FreeBSD build to GitHub actions with QEMU
Closes GH-16822
2024-11-20 14:24:02 +01:00
Ilija Tovilo
e23ac8341a [skip ci] Don't test mysqli with libmysqlclient 8.4
There are compile errors with 8.4 that we are no longer fixing.
2024-11-20 14:19:02 +01:00