1
0
mirror of https://github.com/php/php-src.git synced 2026-04-12 10:33:11 +02:00
Commit Graph

5863 Commits

Author SHA1 Message Date
Sergey Panteleev
743c741114 Update versions for PHP 8.2.0RC2 2022-09-14 12:40:19 +03:00
Dmitry Stogov
d64aa6f646 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Reset FG(user_stream_current_filename) at the end of request
2022-09-12 11:39:27 +03:00
Dmitry Stogov
f4afa9adc6 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Reset FG(user_stream_current_filename) at the end of request
2022-09-12 11:39:18 +03:00
Dmitry Stogov
d0b3096ff0 Reset FG(user_stream_current_filename) at the end of request
Attempt to fix oss-fuzz #51047
2022-09-12 11:38:31 +03:00
Pierrick Charron
58a92772ab Prepare PHP 8.2.0 RC1 2022-08-30 11:57:05 -04:00
Sara Golemon
3d6ed8c852 Catch up dev version numbers 2022-08-30 12:15:27 +00:00
Jakub Zelenka
f3c357c446 Merge branch 'PHP-8.1' 2022-08-29 22:34:48 +01:00
Jakub Zelenka
bf97b3649d Merge branch 'PHP-8.0' into PHP-8.1 2022-08-29 22:33:02 +01:00
Jakub Zelenka
3503b1daa2 Fix bug #77780: "Headers already sent" when previous connection was aborted
This change primarily splits SAPI deactivation to module and destroy
parts. The reason is that currently some SAPIs might bail out
on deactivation. One of those SAPI is PHP-FPM that can bail out on
request end if for example the connection is closed by the client
(web sever). The problem is that in such case the resources are not
freed and some values reset. The most visible impact can have not
resetting the PG(headers_sent) which can cause erorrs in the next
request. One such issue is described in #77780 bug which this fixes
and is also cover by a test in this commit. It seems reasonable
to separate deactivation and destroying of the resource which means
that the bail out will not impact it.
2022-08-29 22:25:53 +01:00
Ben Ramsey
7f26661993 PHP-8.1 is now for PHP 8.1.11-dev 2022-08-16 10:45:29 -05:00
twosee
ef39adb638 Merge branch 'PHP-8.1'
* PHP-8.1:
  Re-fix GH-8409: SSL handshake timeout persistent connections hanging
  Revert "Fix GH-8409: SSL handshake timeout persistent connections hanging"
2022-08-14 20:15:35 +08:00
twosee
14d71957ca Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Re-fix GH-8409: SSL handshake timeout persistent connections hanging
2022-08-14 20:14:57 +08:00
twosee
b8d07451d4 Re-fix GH-8409: SSL handshake timeout persistent connections hanging
This fix is another solution to replace d0527427be, use zend_try and zend_catch to make sure persistent stream will be released when error occurred.

Closes GH-9332.
2022-08-14 20:13:36 +08:00
Jakub Zelenka
897ca85d33 Revert "Fix GH-8409: SSL handshake timeout persistent connections hanging"
This reverts commit d0527427be.

This patch makes Swoole/Swow can not work anymore, because Coroutine will yield to another one during socket operation, EG(record_errors) assertion will always fail, and zend_begin_record_errors() was only used during compile time before.
Note: zend_emit_recorded_errors() and the typo fix are reserved.
2022-08-14 19:41:06 +08:00
Jakub Zelenka
438f692e92 Merge branch 'PHP-8.1' 2022-08-12 17:12:28 +01:00
Jakub Zelenka
d0527427be Fix GH-8409: SSL handshake timeout persistent connections hanging
This is not actually related to SSL handshake but stream socket creation
which does not clean errors if the error handler is set. This fix
prevents emitting errors until the stream is freed.
2022-08-12 17:09:24 +01:00
David CARLIER
393577ced9 reallocarray using proper inline facility to check overflow on windows. (#9300) 2022-08-12 12:08:03 +01:00
Jakub Zelenka
80197c59ec Merge branch 'PHP-8.1' 2022-08-07 14:22:33 +01:00
Jakub Zelenka
c9fa98a174 Merge branch 'PHP-8.0' into PHP-8.1 2022-08-07 14:21:39 +01:00
Jakub Zelenka
d9ff5e079f Fix GH-8472: stream_socket_accept result may have incorrect metadata 2022-08-07 14:17:38 +01:00
Jakub Zelenka
1a9e6895f1 Fix #65069: GlobIterator incorrect handling of open_basedir check
This PR changes the glob stream wrapper so it impacts "glob://"
streamsas well. The idea is to do a check for each found path instead
of the pattern which was not working correctly.
2022-07-28 11:42:42 +01:00
Patrick Allaert
9af3327176 PHP-8.1 is now for PHP 8.1.10-dev 2022-07-20 06:48:52 +02:00
Javier Eguiluz
37cf7f6d3c [ci skip] Fix minor typos
Closes GH-9047.
2022-07-19 16:43:44 +02:00
Go Kudo
4d8dd8d258 Implement Random Extension
https://wiki.php.net/rfc/rng_extension
https://wiki.php.net/rfc/random_extension_improvement
2022-07-19 10:27:38 +01:00
Eric Norris
09237f6126 Update request startup error messages 2022-07-18 23:19:59 +01:00
Jakub Zelenka
922371f3b1 Do not send X-Powered-By if headers sent (#9039)
Co-authored-by: Eric Norris <erictnorris@gmail.com>
2022-07-18 18:01:05 +01:00
Mikhail Galanin
ffdf25a270 Add "error_log_mode" setting 2022-07-18 15:41:28 +01:00
Jakub Zelenka
0a4a55fd44 Allow to not close stream on rscr dtor in php cli sapi 2022-07-18 10:58:50 +01:00
Rowan Tommins
af15923bc3 Extend deprecation notices to is_callable($foo) and callable $foo
Implements https://wiki.php.net/rfc/partially-supported-callables-expand-deprecation-notices
so that uses of "self" and "parent" in is_callable() and callable
type constraints now raise a deprecation notice, independent of the
one raised when and if the callable is actually invoked.

A new flag is added to the existing check_flags parameter of
zend_is_callable / zend_is_callable_ex, for use in internal calls
that would otherwise repeat the notice multiple times. In particular,
arguments to internal function calls are checked first based on
arginfo, and then again during ZPP, so the former suppresses the
deprecation notice.

Some existing tests which raised this deprecation have been updated
to avoid the syntax, but the existing version retained for maximum
regression coverage until it is made an error.

With thanks to Juliette Reinders Folmer for the RFC and initial
investigation.

Closes GH-8823.
2022-07-14 17:07:42 +02:00
Christoph M. Becker
31b02a13ab Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix GH-8923: error_log on Windows can hold the file write lock
2022-07-12 13:39:55 +02:00
Christoph M. Becker
5a459f6783 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix GH-8923: error_log on Windows can hold the file write lock
2022-07-12 13:38:35 +02:00
Christoph M. Becker
77e954afaa Fix GH-8923: error_log on Windows can hold the file write lock
On Windows, closing a file which is locked may not immediately remove
the lock.  The `LockFileEx()` documentation states:

| Therefore, it is recommended that your process explicitly unlock all
| files it has locked when it terminates.

We comply, and also use the macro `LOCK_EX` instead of the magic number
`2`.

Closes GH-8925.
2022-07-12 13:36:20 +02:00
George Peter Banyard
55908db007 Add php_register_known_variable() for know var names 2022-07-01 21:18:26 +01:00
David Carlier
7ceae66182 streams/xp_socket: fix clang build error with enum usage on bool condition.
Fix targeted for oses defining those flags as enums (like Linux/glibc).

`error: converting the enum constant to a boolean [-Werror,-Wint-in-bool-context]
                                } else if ((!sslsock->ssl_active && value == 0 && (MSG_DONTWAIT || !sslsock->s.is_blocked)) ||`

Closes #8895.
2022-06-30 05:45:33 +01:00
Max Kellermann
e2bd3b1e99 main/streams/plain_wrapper: skip lseek(SEEK_CUR) for newly opened files
A file that has just been opened is known to be at offset zero, and
the lseek(SEEK_CUR) system call to determine the current offset can be
skipped.

Closes #8540.
2022-06-29 18:11:01 +01:00
David CARLIER
bf29ee6917 Add reallocarray implementation.
In a similar model as _safe_*alloc api but for the `userland` it guards
against overflow before (re)allocation, usage concealed in fpm for now.
Modern Linux and most of BSD already have it.
Closes #8871.
2022-06-26 13:10:13 +01:00
Ben Ramsey
f3b45e74f5 PHP-8.1 is now for PHP 8.1.9-dev 2022-06-21 11:03:50 -05:00
Heiko Weber
84e4d2a0e8 Refactor sapi_getenv() (#8786) 2022-06-20 17:32:13 +01:00
David Carlier
bfe6f9e66a Introduction of timing attack safe bcmp implementation.
Nothing new but to refactor usage b/w hash and password
extensions but using volatile pointers to be a bit safer,
allowing to expand its usage eventually.
2022-06-20 16:30:30 +01:00
Christoph M. Becker
640c1c3a09 Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix potential use after free in php_binary_init()
2022-06-20 12:03:47 +02:00
Christoph M. Becker
5f24b85fd2 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix potential use after free in php_binary_init()
2022-06-20 12:02:31 +02:00
Heiko Weber
93a44f8c50 Fix potential use after free in php_binary_init()
Closes GH-8791.
2022-06-20 12:00:50 +02:00
Jakub Zelenka
3f836641d5 Merge branch 'PHP-8.1' 2022-06-19 22:57:26 +01:00
Jakub Zelenka
d9cca443ad Fix strict prototype for php_closelog 2022-06-19 22:56:44 +01:00
Jakub Zelenka
305d5e12df Merge branch 'PHP-8.1' 2022-06-19 20:12:43 +01:00
Jakub Zelenka
b3e6faed48 Merge branch 'PHP-8.0' into PHP-8.1 2022-06-19 20:09:37 +01:00
Jakub Zelenka
e330f443c9 Fix bug #67764: fpm: syslog.ident does not work 2022-06-19 20:05:49 +01:00
Max Kellermann
2d986310f1 streams/xp_socket: eliminate poll() when MSG_DONTWAIT is available
If there is a zero timeout and MSG_DONTWAIT is available (or the
socket is non-blocking), the poll() call is not necessary, and we can
just call recv() right away.

Before this change:

 poll([{fd=4, events=POLLIN|POLLPRI|POLLERR|POLLHUP}], 1, 0) = 0 (Timeout)
 poll([{fd=4, events=POLLIN|POLLERR|POLLHUP}], 1, 60000) = 1 ([{fd=4, revents=POLLIN}])
 recvfrom(4, "HTTP/1.1 301 Moved Permanently\r\n"..., 8192, MSG_DONTWAIT, NULL, NULL) = 348
 poll([{fd=4, events=POLLIN|POLLPRI|POLLERR|POLLHUP}], 1, 0) = 1 ([{fd=4, revents=POLLIN}])
 recvfrom(4, "", 1, MSG_PEEK, NULL, NULL) = 0

After this change:

 recvfrom(4, 0x7ffe0cc719a0, 1, MSG_PEEK|MSG_DONTWAIT, NULL, NULL) = -1 EAGAIN (Resource temporarily unavailable)
 poll([{fd=4, events=POLLIN|POLLERR|POLLHUP}], 1, 60000) = 1 ([{fd=4, revents=POLLIN}])
 recvfrom(4, "HTTP/1.1 301 Moved Permanently\r\n"..., 8192, MSG_DONTWAIT, NULL, NULL) = 348
 recvfrom(4, "", 1, MSG_PEEK|MSG_DONTWAIT, NULL, NULL) = 0

The first poll() is replaced by recvfrom(), and the third poll() is
omitted completely.

ext/openssl/xp_ssl: eliminate poll() when MSG_DONTWAIT is available

If there is a zero timeout and MSG_DONTWAIT is available (or the
socket is non-blocking), the poll() call is not necessary, and we can
just call recv() right away.

Closes GH-8092.
2022-06-18 19:44:32 +01:00
Arnaud Le Blanc
efc8f0ebf8 Deprecate zend_atol() / add zend_ini_parse_quantity() (#7951)
Add zend_ini_parse_quantity() and deprecate zend_atol(), zend_atoi()

zend_atol() and zend_atoi() don't just do number parsing.
They also check for a 'K', 'M', or 'G' at the end of the string,
and multiply the parsed value out accordingly.

Unfortunately, they ignore any other non-numerics between the
numeric component and the last character in the string.
This means that numbers such as the following are both valid
and non-intuitive in their final output.

* "123KMG" is interpreted as "123G" -> 132070244352
* "123G " is interpreted as "123 " -> 123
* "123GB" is interpreted as "123B" -> 123
* "123 I like tacos." is also interpreted as "123." -> 123

Currently, in php-src these functions are used only for parsing ini values.

In this change we deprecate zend_atol(), zend_atoi(), and introduce a new
function with the same behavior, but with the ability to report invalid inputs
to the caller. The function's name also makes the behavior less unexpected:
zend_ini_parse_quantity().

Co-authored-by: Sara Golemon <pollita@php.net>
2022-06-17 14:12:53 +02:00
Dmitry Stogov
2df805da7e Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix use after free
2022-06-14 12:50:16 +03:00