1
0
mirror of https://github.com/php/php-src.git synced 2026-04-22 23:48:14 +02:00
Commit Graph

5859 Commits

Author SHA1 Message Date
Arnaud Le Blanc 545bef8ae6 Fix array_merge_recursive(): convert_to_array() may need separation (#16061) 2024-10-02 12:37:04 +02:00
David Carlier 332b067c5e Fix GH-15937: stream timeout option overflow.
close GH-15942
2024-09-30 18:10:33 +01:00
Christoph M. Becker f5649556ea Fix potential parallel test conflicts
Both tests call `create_files()` with the same `$name_prefix` what
might clash.

Co-authored-by: Gina Peter Banyard <girgias@php.net>

Closes GH-16103.
2024-09-29 02:05:14 +02:00
Ilija Tovilo c4c45da4b9 Reduce regex backtracking in phpinfo.phpt
On NixOS, the output of phpinfo() can get very large, causing us to run into the
backtracking limit. Lazy matching for .*/.+ can help reduce backtracking.
2024-09-27 15:02:21 +02:00
Christoph M. Becker 81916758ec Fix GH-15980: Signed integer overflow in main/streams/streams.c
We need to avoid signed integer overflows which are undefined behavior.
We catch that, and set `offset` to `ZEND_LONG_MAX` (which is also the
largest value of `zend_off_t` on all platforms).  Of course, that seek
may fail, but even if it succeeds, the stream is no longer readable,
but that matches the current behavior for offsets near `ZEND_LONG_MAX`.

Closes GH-15989.
2024-09-24 12:32:00 +02:00
Christoph M. Becker ee95ee7216 Revert "Fix GH-15980: Signed integer overflow in main/streams/streams.c"
This reverts commit 6a04c79e41, since the
new test case apparently fails on 64bit Linux, so this needs closer
investigation.
2024-09-23 01:31:05 +02:00
Christoph M. Becker 6a04c79e41 Fix GH-15980: Signed integer overflow in main/streams/streams.c
We need to avoid signed integer overflows which are undefined behavior.
We catch that, and set `offset` to `ZEND_LONG_MAX` (which is also the
largest value of `zend_off_t` on all platforms).  Of course, after such
a seek a stream is no longer readable, but that matches the current
behavior for offsets near `ZEND_LONG_MAX`.

Closes GH-15989.
2024-09-23 00:28:09 +02:00
Niels Dossche 018c0b3d14 Fix GH-15908 and GH-15026: leak / assertion failure in streams.c
This was first reported as a leak in GH-15026, but was mistakingly
believed to be a false positive. Then an assertion was added and it got
triggered in GH-15908. This fixes the leak. Upon merging into master the
assertion should be removed as well.

Closes GH-15924.
2024-09-22 16:07:12 +02:00
David Carlier 791a6ef19c Fix GH-15613: unpack on format hex strings repeater value.
close GH-15615
2024-09-11 21:14:27 +01:00
Christoph M. Becker 08841bf79c Fix GH-15552: Signed integer overflow in ext/standard/scanf.c
We ensure that the argnum `value` is in the allowed range, *before*
mapping it to the `objIndex`, not *afterwards*.

Closes GH-15581.
2024-09-01 17:24:17 +02:00
David Carlier 7db1a5843f Fix GH-15653: fgetcsv overflow on length parameter.
close GH-15655
2024-08-30 17:16:57 +01:00
Niels Dossche fdae7c23f0 Fix CI failure on macOS after Curl update 2024-07-28 14:34:26 +02:00
Niels Dossche 404bd30810 Fix CI failure after Curl update (#15124) 2024-07-27 16:09:50 +02:00
David Carlier ba909d7c43 Fix GH-14780: p(f)sockopen overflow on timeout argument.
close GH-14785
2024-07-22 22:57:59 +01:00
Niels Dossche fdcfd62b9b Fix passing non-finite timeout values in stream functions
Closes GH-15061.
2024-07-22 17:52:21 +02:00
Niels Dossche cfcc2a3fda Fix GH-15034: Integer overflow on stream_notification_callback byte_max parameter with files bigger than 2GB
We were using atoi, which is only for integers. When the size does not
fit in an integer this breaks. Use ZEND_STRTOUL instead. Also make sure
invalid data isn't accidentally parsed into a file size.

Closes GH-15035.
2024-07-21 22:02:11 +02:00
David Carlier 237518763f Fix GH-14774 time_sleep_until overflow. 2024-07-06 20:43:59 +01:00
Michael Orlitzky 27dd393be9 ext/standard/tests: strings/wordwrap_memory_limit_32bit.phpt has two outputs
It turns out that on a 32-bit system, this test can produce either the
"usual" expected output from the 64-bit test, OR the 32-bit-only
integer overflow message. We copy the dual expected outputs from
chunk_split_variation1_32bit.phpt to handle both cases.

This fixes an earlier commit that split the two tests based only on
the size of an int (32-bit versus 64-bit). The CI reveals that, at
least on a debug/zts build, the "64-bit" memory limit error (and not
the integer overflow error) is still produced.
2024-07-04 15:55:05 +02:00
Michael Orlitzky 68a0efedeb ext/standard/tests: 32bit wordwrap tests aren't just for Windows
The test in strings/wordwrap_memory_limit.phpt has a counterpart in
strings/wordwrap_memory_limit_win32.phpt. The two are conditional on
both the OS name and the size of an int (32- versus 64-bits).

A Gentoo Linux user has however reported that the 64-bit test fails on
a 32-bit system, with precisely the error message that the "win32"
test is expecting. I don't have any 32-bit hardware to test myself,
but I think it's reasonable to conclude that the OS name is not an
essential part of the test: it's simply 32- versus 64-bit.

This commit drops the conditionals for the OS name. Now one test will
be run on 32-bit systems, and the other on 64-bit systems, regardless
of the OS name.

Bug: https://bugs.gentoo.org/935382
2024-07-04 15:55:04 +02:00
Michael Orlitzky a8d1955348 ext/standard/tests: use %d instead of bytes in an overflow message
In strings/chunk_split_variation1_32bit.phpt, we have a test that is
expected to fail on x32 with a possible integer overflow error. The
message reports the exact number of bytes -- a number big enough to
overflow an int on x32 -- stemming from a memory allocation in
chunk_split().

This number appears unpredictable, and is not the point of the test.
We replace it with %d to make the test independent of the allocation
details.
2024-07-04 00:48:01 +02:00
Derick Rethans e0e9eb4053 Merge branch 'fix-anonymous-socket-at-length-boundary' into PHP-8.2 2024-06-13 14:03:46 +01:00
Ilija Tovilo 8d9f9755e8 Fix windows rename test directories clashing
Closes GH-14554
2024-06-13 14:02:57 +02:00
Derick Rethans ad56ec7bbf Fixed off-by-one error in checking length of abtract namespace Unix sockets 2024-06-13 12:46:22 +01:00
Ben Ramsey 8aff5b49c3 Merge branch 'PHP-8.1' into PHP-8.2 2024-06-05 01:10:47 -05:00
Niels Dossche 4b15f5d4ec Fix GHSA-9fcc-425m-g385: bypass CVE-2024-1874
The old code checked for suffixes but didn't take into account trailing
whitespace. Furthermore, there is peculiar behaviour with trailing dots
too. This all happens because of the special path-handling code inside
CreateProcessW.

By studying Wine's code, we can see that CreateProcessInternalW calls
get_file_name [1] in our case because we haven't provided an application
name. That code gets the first whitespace-delimited string into app_name
excluding the quotes. It's then passed to create_process_params [2]
where there is the path handling code that transforms the command line
argument to an image path [3]. Inside Wine, the extension check if
performed after these transformations [4]. By doing the same thing in
PHP we match the behaviour and can properly match the extension even in
the given edge cases.

[1] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L542-L543
[2] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L565
[3] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L150-L151
[4] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L647-L654
2024-06-05 00:26:14 -05:00
Gina Peter Banyard 75f6132818 ext/standard: Fix test conflict with I/O tests
Closes GH-14428
2024-06-02 17:03:19 +01:00
David Carlier 19cb9c7b4a Fix GH-12104 attempt
using stream_select to gives the chance to process the data.

close GH-14311
2024-05-24 23:34:46 +01:00
Saki Takamachi 0a8fbef996 Added test 2024-05-20 15:13:53 +01:00
Niels Dossche 02b7d70fa9 Fix nightly test failure (#14251)
The created files have the same filename, creating conflicts. Fix this
by adding a unique suffix.
2024-05-16 20:00:46 +02:00
Peter Kokot b6b9eab68e Fix tests for glibc 2.39 (#14097)
2.39 has fixed inconsistent (mon_)grouping formats in localedata:

* https://sourceware.org/git/?p=glibc.git;a=blob;f=NEWS;hb=refs/tags/glibc-2.39#l237
* https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/locales/en_AU;hb=refs/tags/glibc-2.39#l65

For en_AU locale now it returns array of 1 item instead of 2 for
grouping and mon_grouping.

Since this is upstream change depending on the system, this only syncs
tests for such case.
2024-05-01 20:43:00 +02:00
Ilija Tovilo a7a7e6d57c Fix clean section in test 2024-04-15 14:14:47 +02:00
Ilija Tovilo f2cd0d5752 Fix rename test file name collision 2024-04-15 13:42:40 +02:00
Damian Wójcik 8421cfda61 Fix file_get_contents() on Windows fails with "errno=22 Invalid argument"
Closes GH-13948
2024-04-14 14:26:10 +01:00
Ben Ramsey a9ffc447a4 Merge branch 'PHP-8.1' into PHP-8.2 2024-04-09 23:49:31 -05:00
Jakub Zelenka 0ba5229a3f Fix bug GHSA-q6x7-frmf-grcw: password_verify can erroneously return true
Disallow null character in bcrypt password
2024-04-09 23:38:32 -05:00
Niels Dossche 093c08af25 Fix GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
The check happened too early as later code paths may perform more
mangling rules. Move the check downwards right before adding the actual
variable.
2024-04-09 23:37:06 -05:00
Jakub Zelenka e3c784f2bf Add proc_open escaping for cmd file execution 2024-04-09 23:29:28 -05:00
Jakub Zelenka c087398cc2 Fix GH-13264: Part 1 - Memory leak on filter failure
Closes GH-13790
2024-03-29 16:06:49 +00:00
Niels Dossche 65593e10ef Fix nightly failure due to type in file_put_contents_5gb.phpt 2024-03-10 11:27:47 +01:00
divinity76 2343791aff Fix GH-13203: file_put_contents fail on strings over 4GB on Windows
Closes GH-13205
2024-03-09 19:58:28 +00:00
Saki Takamachi 04e8e55f47 Added validation of \n in $additional_headers of mail()
When $additional_headers of mail() is an array, the same validation as
`\r\n` is now applied to `\n` alone too.
2024-03-04 21:30:07 +09:00
Niels Dossche 7c8a3e426e Fix GH-11808: Live filesystem modified by tests (security)
There's a test that tries to make /etc world-writable, and asserts that
it fails. Although this test is guarded by a root user check, there are
situations where you don't need to be root to be able to do this.
This may thus have unwanted effects on your live filesystem.

The simple solution is to remove that part of the test. It doesn't
really add value anyway: we're trying to test the chmod error path, but
that exact same error path can be reached with any failure condition
that the kernel gives. For example, trying to chmod a non-existent file
will trigger the same code path.

While at it, also prefix the test path for the non-existent file such
that we don't accidentally modify the filesystem.

The chroot now has a better root-user check, that will not modify the
filesystem.

Other root-modifying mkdir tests were removed because they added no
value either.

Closes GH-13566.
2024-03-01 18:45:54 +01:00
Niels Dossche 5e9e9c9d51 Fix GH-13071: Copying large files using mmap-able source streams may exhaust available memory and fail
Commit 5cbe5a538c disabled chunking for all writes to streams. However,
user streams have a callback where code is executed on data that is
subject to the memory limit. Therefore, when using large writes or
stream_copy_to_stream/copy the memory limit can easily be hit with large
enough data.

To solve this, we reintroduce chunking for userspace streams.
Users have control over the chunk size, which is neat because
they can improve the performance by setting the chunk size if
that turns out to be a bottleneck.

In an ideal world, we add an option so we can "ask" the stream whether
it "prefers" chunked writes, similar to how we have
php_stream_mmap_supported & friends. However, that cannot be done on
stable branches.

Closes GH-13136.
2024-01-16 23:44:58 +01:00
Ilija Tovilo 23ea89404b Fix clean for higher branches 2023-12-13 15:21:19 +01:00
Ilija Tovilo cda7718f51 Disambiguate fileVar8 test folder
Closes GH-12951
2023-12-13 14:31:40 +01:00
Niels Dossche bedf1083f3 Add missing NULL pointer checks related to the previous call frame 2023-12-01 09:08:47 +01:00
Ilija Tovilo 05ba461524 [skip ci] Fix more test tmp file conflicts 2023-11-22 20:39:29 -06:00
Ilija Tovilo e1e140f2f2 Fix file test race condition
005_variation2.phpt creates files with special names, and
filesize_variation5.phpt checks for filesize of inexistent files with special
names. Create the files in a separate directory to avoid these tests clashing.

Closes GH-12692
2023-11-22 20:39:29 -06:00
Ilija Tovilo 28c312c994 [skip ci] Further increase allowable atime deviation
MSAN is slow in particular, leading to potentially higher deviations.
2023-11-22 20:39:29 -06:00
Niels Dossche c376f9943f Fix GH-12655: proc_open() does not take into account references in the descriptor array
Closes GH-12658.
2023-11-22 20:39:28 -06:00