1
0
mirror of https://github.com/php/php-src.git synced 2026-03-29 19:52:20 +02:00
Commit Graph

61815 Commits

Author SHA1 Message Date
Niels Dossche
0e715e71d9 Fix GHSA-wg4p-4hqh-c3g9 2025-03-11 21:50:17 +01:00
Tim Düsterhus
b6004a043c Fix GHSA-p3x9-6h7p-cgfc: libxml streams wrong content-type on redirect
libxml streams use wrong content-type header when requesting a
redirected resource.
2025-03-11 21:50:17 +01:00
Jakub Zelenka
41d49abbd9 Fix GHSA-hgf5-96fm-v528: http user header check of crlf 2025-03-11 21:50:16 +01:00
Jakub Zelenka
ac1a054bb3 Fix GHSA-52jp-hrpf-2jff: http redirect location truncation
It converts the allocation of location to be on heap instead of stack
and errors if the location length is greater than 8086 bytes.
2025-03-11 21:50:16 +01:00
Jakub Zelenka
0548c4c175 Fix GHSA-pcmh-g36c-qc44: http headers without colon
The header line must contain colon otherwise it is invalid and it needs
to fail.

Reviewed-by: Tim Düsterhus <tim@tideways-gmbh.com>
2025-03-11 21:50:16 +01:00
Jakub Zelenka
d20b4c97a9 Fix GHSA-ghsa-v8xr-gpvj-cx9g: http header folding
This adds HTTP header folding support for HTTP wrapper response
headers.

Reviewed-by: Tim Düsterhus <tim@tideways-gmbh.com>
2025-03-11 21:50:16 +01:00
Niels Dossche
f209eb448e Fix tests for libxml2 2.14
See GH-18009.
2025-03-10 20:22:11 +01:00
Ilija Tovilo
b0858427aa Suppress snmp lib memory leak, skip ASAN tests
I don't know enough about this library to fix those :(

Cherry-picked from:
be4db6b550
ba1d9d0ab2
2025-03-08 16:10:59 +01:00
Ilija Tovilo
5fcc8d4cd1 Upgrade security branches to Ubuntu 22.04
20.04 goes out of security support in 2 months. Backporting various
commits.

See d98963a071
See af721c9c36
See 378b79b90c

Closes GH-17963
2025-03-06 15:24:15 +01:00
Ilija Tovilo
8a699372f2 Fix flaky DatePeriod test
$start and $end use the H:i:s from the current time. If $end happens on
a second boundary, $start + 4 days will include $end, thus performing an
extra iteration. Fix this by setting H:i:s to 00:00:00.
2025-03-06 15:01:30 +01:00
Calvin Buckley
dc6586dd9d Skip mysqli/tests/bug73462 on PPC CI (#17971)
* Skip this test on PPC CI

Seems to be unfortunately flaky with persistent connections.

* use spaces in phpt file
2025-03-05 10:17:39 -04:00
Ilija Tovilo
726cf51236 Add CONFLICT all to random port test
If we're very unlucky, we can get the same port opened as an ephemeral
port by some other test.

Closes GH-17706
2025-02-06 15:25:16 +01:00
Christoph M. Becker
36d46a4732 Fix curl_basic_022.phpt for libcurl 8.12.0
Due to a deliberate change in libcurl, the expiration is now capped to
at most 400 days.  We could solve this by choosing another date roughly
a year in the future, but would need to update the test next year.
This would be especially annoying for security branches.

Another option would be to actually parse the cookie list lines, but
that might not be worth the trouble.  Instead we just ignore the exact
timestamp created by libcurl.

[1] <https://github.com/curl/curl/pull/15937>

Closes GH-17709.
2025-02-05 19:20:47 +01:00
Ilija Tovilo
d8aedb589c [skip ci] Another flaky phar macOS test 2025-02-04 14:52:03 +01:00
Christoph M. Becker
afe8e2cdff Relax timezone_IDforWindowsID_basic2.phpt expectations
Apparently, some ICU versions report "America/Los_Angeles" for the `ZZ`
case, what matches the behavior of ICU 76.1 (on Windows).  Possibly,
there has been some bug fix backport on some systems.  Anyhow, either
seems fine, so we're not picky about that.

Closes GH-17669.
2025-02-02 13:35:27 +01:00
Ilija Tovilo
d9744869e6 [skip ci] Another flaky macOS phar test 2025-01-28 12:58:30 +01:00
Ilija Tovilo
65b990a1e0 [skip ci] Another flaky macOS phar test 2025-01-28 12:44:24 +01:00
Ilija Tovilo
d17d58a982 Fix cve-2014-3538 test
Make sure we have a unique test file to work with, and increase the time
for the nojit version to match the default version.

Closes GH-17600
2025-01-27 20:01:13 +01:00
Jakub Zelenka
235d1b14a3 Fix GH-17499: mysqli flaky test: ghsa-h35g-vwh6-m678-stmt-row-string 2025-01-19 20:36:12 +01:00
Jakub Zelenka
9e1b58274e Test stream_context_tcp_nodelay_server on Windows
Closes GH-17308
2025-01-05 14:44:22 +01:00
Jakub Zelenka
b8731767d8 Fix GH-16955: Use empheral ports for OpenSSL server client tests
And refactor some client server tests.

Closes GH-17180
2024-12-31 14:25:19 +01:00
Ilija Tovilo
8a9d45b86f Backport flaky flag for phar tests
4e12189604
b6ca871396
062837aa13
2024-12-10 10:35:00 +01:00
Jakub Zelenka
39c292b1eb Use empheral port for mysqli fake server tests 2024-12-09 23:34:50 +01:00
Dmitry Stogov
b0b39cdc3e Backport JIT fix: set valid EX(opline) before calling gc_possible_root() (#16858)
This will finally make the COMMUNTIY build of the PHP 8.1 build green.

See https://github.com/php/php-src/pull/16858#issuecomment-2509010556
Closes GH-17091
2024-12-09 16:59:41 +01:00
Jakub Zelenka
eb951b3d11 Increase MySQLi fake server read timeout for ASAN job 2024-11-24 23:48:27 +01:00
Jakub Zelenka
51f5539914 Change port for mysqli fake server auth message test 2024-11-24 20:13:47 +01:00
Jakub Zelenka
c70b97d8eb Make MySQLnd protocol stmt test work on 32bit
Closes GH-16869.
2024-11-20 13:52:53 +01:00
Jakub Zelenka
32f905f1d6 Fix MySQLnd possible buffer over read in auth_protocol 2024-11-18 16:55:44 +01:00
Niels Dossche
81030c9bbb Fix GHSA-r977-prxv-hc43
Move the bound check upwards. Since this doesn't generate output we can
check the bound first.
2024-11-17 19:30:44 +01:00
Jakub Zelenka
2f5aa9f9d1 Fix GHSA-h35g-vwh6-m678: Mysqlnd - various heap buffer over-reads
This fixes issues causing buffer over-read that leak heap content:
- RESP packet field default left over for COM_LIST
- RESP packet upsert filename
- OK packet message
- RESP packet for stmt row data
  - ps_fetch_from_1_to_8_bytes
  - ps_fetch_float
  - ps_fetch_double
  - ps_fetch_time
  - ps_fetch_date
  - ps_fetch_datetime
  - ps_fetch_string
  - ps_fetch_bit
- RESP packet for query row data (just possible overflow on 32bit)

It also adds various protocol tests using a new fake server.
2024-11-17 19:30:13 +01:00
Niels Dossche
f9ecf90070 Fix GHSA-g665-fm4p-vhff: OOB access in ldap_escape 2024-11-17 19:29:56 +01:00
Jakub Zelenka
426a6d4539 Fix GHSA-c5f2-jwm7-mmq2: stream HTTP fulluri CRLF injection 2024-11-17 19:29:45 +01:00
Niels Dossche
69c5f68fdc Fix GHSA-5hqh-c84r-qjcv: Integer overflow in the firebird quoter causing OOB writes 2024-11-17 19:29:26 +01:00
Niels Dossche
d9baa9fed8 Fix GHSA-5hqh-c84r-qjcv: Integer overflow in the dblib quoter causing OOB writes 2024-11-17 19:29:16 +01:00
Christoph M. Becker
85e23dbbb2 Update FreeBSD CI
FreeBSD 13.2 is no longer supported[1], and apparently the respective
Cirrus CI image has been removed.  We update to FreeBSD 13.3.

This also requires to disable some compiler warnings now, and adapt a
test case.

[1] <https://www.freebsd.org/security/#sup>
[2] <https://github.com/php/php-src/runs/33044888209>

Co-authored-by: David Carlier <devnexen@gmail.com>

Closes GH-16817.
2024-11-15 18:20:48 +01:00
Ilija Tovilo
ed041c3443 Partial backport of e7462bf
e7462bff19
2024-10-30 14:20:47 +01:00
Ilija Tovilo
25c0993902 Backport CI fixes to security branches
Closes GH-16469

Working towards GH-16286

commit e0db221143b808d97bc3a44e9f0968c6308794b4
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Fri Oct 25 22:48:20 2024 +0200

    Move CFLAGS into ./configure command for consistency

commit 8ad67768250d181cd7fef30e0c866625bbd8ac94
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Fri Oct 25 22:47:03 2024 +0200

    Also upgrade nightly to macOS 13

commit 58a88ccb9f
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Wed Oct 23 19:07:59 2024 +0200

    Fix call to dc[n]gettext in tests with 0 $category

    This causes a segfault on PHP-8.1

commit 611af05c50
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Fri Dec 8 13:36:52 2023 +0100

    [skip ci] Skip intermittently failing curl test on macOS

    The test fails with "CURL ERROR: 56". I will create an issue for it shortly.

commit ec745178bb
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Wed Oct 23 19:05:32 2024 +0200

    Backport parts of 9999a0c for gettext

    See 9999a0cb75

commit 5ce703496f
Author: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date:   Sun Jul 28 14:34:26 2024 +0200

    Fix CI failure on macOS after Curl update

commit 714a3e7071
Author: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date:   Sat Jul 27 16:09:50 2024 +0200

    Fix CI failure after Curl update (#15124)

commit 4f2eb921b9
Author: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date:   Thu May 23 22:20:37 2024 +0200

    Fix GH-14307: Test curl_basic_024 fails with curl 8.8.0

    Curl changed the behaviour, from the changelog:
      - lib: make protocol handlers store scheme name lowercase curl/curl@c294f9c

    From the docs: "The returned scheme might be upper or lowercase. Do
    comparisons case insensitively."

    Closes GH-14312.

commit 251195b41b
Author: Ayesh Karunaratne <ayesh@aye.sh>
Date:   Thu Feb 1 02:03:55 2024 +0700

    ext/curl: Fix failing tests due to string changes in libcurl 8.6.0

    Upstream libcurl 8.6.0 contains a change[^1] that caused a test failure.
    This fixes it by updating the test's `EXPECTF` to use a regex to account for both string patterns.

    [^1]: https://github.com/curl/curl/commit/45cf4755e71f#diff-a8a54563608f8155973318f4ddb61d7328dab512b8ff2b5cc48cc76979d4204cL1683

    Closes GH-13293.

commit fc5d83f2b1
Author: Christoph M. Becker <cmbecker69@gmx.de>
Date:   Wed Oct 16 22:46:20 2024 +0200

    Prepare for necessary move to macOS 13

    GH will remove macOS 12 runner images as of December 3rd, so we prepare
    for that.

    Besides the obvious need to change the runner, we also suppress a
    couple of warnings, because otherwise the build would fail due to
    `-Werror`.
2024-10-28 15:57:16 +01:00
Niels Dossche
2c40762b4e Fix error message for newer libxml
Normally I would backport 3354cc6e, but this doesn't apply cleanly due
to observer changes.
2024-10-12 15:12:40 +02:00
Niels Dossche
14c107371c Backport 061058a9: Test fixes for libxml2 2.12.0 2024-10-12 15:12:40 +02:00
Niels Dossche
5bd04acfe9 Workaround deprecation warning in zend_test on 8.1 2024-10-12 15:12:40 +02:00
Niels Dossche
6199289b6e Backport 3ec5919e: Update error message for libxml 2.13
External entity loading got its error level decreased in upstream,
which means they now map to E_NOTICE. Also the error message format has
changed.
2024-10-12 15:12:40 +02:00
Niels Dossche
b78618750f Backport f74f9b07: Update libxml test for the directory field behaviour change
See https://gitlab.gnome.org/GNOME/libxml2/-/issues/753.
The base directory for the entity is no longer set, follow the upstream
behaviour.
2024-10-12 15:12:40 +02:00
Niels Dossche
bb46b4b799 Backport 4fe82131: Backport libxml2 2.13.2 fixes (#14816)
Backproted from https://github.com/php/php-src/pull/14789
2024-10-12 15:12:40 +02:00
Niels Dossche
dbde99d875 Backport e2d97314: Backport deprecation warning ignores to unbreak CI
In master I use ZEND_DIAGNOSTIC_IGNORED_START, but that doesn't exist on
8.2 or 8.3 (8.3 has a similar macro though).
So to unbreak CI I just made a variation of this directly in the
php_libxml.h header.

See 683e787860 (commitcomment-134301083)
2024-10-12 15:12:40 +02:00
Niels Dossche
fa6a0f80f6 Backport 0a39890c: Fix libxml2 2.12 build due to API breaks
See https://github.com/php/php-src/actions/runs/7062192818/job/19225478601
2024-10-12 15:12:40 +02:00
Jakub Zelenka
53cc92c85c Fix failing openssl_private_decrypt tests
We backport 11caf094f1af6b47ea2138c5fa907838911ebe01[1] as a step to
get back to a green CI.

[1] <11caf094f1>
2024-10-07 01:06:04 +02:00
Christoph M. Becker
5f3e6e346c Fix failing soap tests on Windows
These failures are caused by the fix for GHSA-p99j-rfp4-xqvq.  Since
the two bug*.phpt tests don't need the "wsdl" query string, and don't
even need php-cgi, we just remove the `--GET--` section.  The two
server*.phpt tests are harder to fix, since during evaluation of the
`--SKIPIF--` section, the soap extension can be loaded, but it may not
during evaluation of the `--FILE--` section.  So for now, we skip these
tests on Windows altogether.

Co-authored-by: Niels Dossche <7771979+nielsdos@users.noreply.github.com>

Closes GH-16084.
2024-09-27 19:56:19 +02:00
Niels Dossche
7e0e3cc820 Fix GHSA-w8qr-v226-r27w
We should not early-out with success status if we found an ipv6
hostname, we should keep checking the rest of the conditions.
Because integrating the if-check of the ipv6 hostname in the
"Validate domain" if-check made the code hard to read, I extracted the
condition out to a separate function. This also required to make
a few pointers const in order to have some clean code.
2024-06-05 00:31:17 -05:00
Niels Dossche
4b15f5d4ec Fix GHSA-9fcc-425m-g385: bypass CVE-2024-1874
The old code checked for suffixes but didn't take into account trailing
whitespace. Furthermore, there is peculiar behaviour with trailing dots
too. This all happens because of the special path-handling code inside
CreateProcessW.

By studying Wine's code, we can see that CreateProcessInternalW calls
get_file_name [1] in our case because we haven't provided an application
name. That code gets the first whitespace-delimited string into app_name
excluding the quotes. It's then passed to create_process_params [2]
where there is the path handling code that transforms the command line
argument to an image path [3]. Inside Wine, the extension check if
performed after these transformations [4]. By doing the same thing in
PHP we match the behaviour and can properly match the extension even in
the given edge cases.

[1] 166895ae3a/dlls/kernelbase/process.c (L542-L543)
[2] 166895ae3a/dlls/kernelbase/process.c (L565)
[3] 166895ae3a/dlls/kernelbase/process.c (L150-L151)
[4] 166895ae3a/dlls/kernelbase/process.c (L647-L654)
2024-06-05 00:26:14 -05:00
Jakub Zelenka
0ba5229a3f Fix bug GHSA-q6x7-frmf-grcw: password_verify can erroneously return true
Disallow null character in bcrypt password
2024-04-09 23:38:32 -05:00