1
0
mirror of https://github.com/php/php-src.git synced 2026-03-29 19:52:20 +02:00
Commit Graph

132203 Commits

Author SHA1 Message Date
Pierrick Charron
29bcd7b3e8 Update versions for PHP 8.2.26RC1 php-8.2.26RC1 2024-11-05 12:41:59 -05:00
Niels Dossche
5ddb75660d Fix various memory leaks on error conditions in openssl_x509_parse()
Closes GH-16690.
2024-11-04 20:03:53 +01:00
Ilija Tovilo
418f820f5d Add NEWS entry 2024-11-04 17:46:17 +01:00
Ilija Tovilo
f7222bd2de Also fix same issue in ArrayObject::exchangeArray() 2024-11-04 17:46:17 +01:00
Ilija Tovilo
8910ac800d Fix use-after-free in ArrayObject::unset() with destructor
Fixes GH-16646
Closes GH-16653
2024-11-04 17:45:56 +01:00
Ilija Tovilo
845cdbce67 Postpone zend_array_sort() in ext-intl
This function is not ZEND_API yet, so we cannot use it as it won't work for
dynamically linked extensions.
2024-11-04 16:01:00 +01:00
Ilija Tovilo
4b9e59b430 [skip ci] Use bool for zend_array_sort()
zend_bool is removed in higher branches.
2024-11-04 15:59:18 +01:00
Ilija Tovilo
2bdce61390 Fix array going away during sorting
Fixes GH-16648
Closes GH-16654
2024-11-04 15:50:35 +01:00
Ilija Tovilo
2985de72db [skip ci] Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [skip ci] Fix nightly workflow dispatch
2024-11-04 15:03:47 +01:00
Ilija Tovilo
e72854e8bc [skip ci] Fix nightly workflow dispatch
Closes GH-16662
2024-11-04 15:02:11 +01:00
David Carlier
90aac521fd Fix GH-16592 msg_send() crashes when the type does not serialize as expected.
It is assumed that the serialization always had initialised its buffer
zend_string, but in the case of a type not serialising, it is null.

close GH-16599
2024-11-03 13:39:24 +00:00
Niels Dossche
e643129bbb Fix GH-16628: FPM logs are getting corrupted with this log statement
zlog_buf_prefix() can return a larger length than what actually was
written due to its use of snprintf(). The code in
zlog_stream_prefix_ex() does not take this into account, other callers
do. What ends up happening then is that stream->length is set to the
length as if snprintf() was able to write all bytes, causing
stream->length to become larger than stream->buf.size, causing a
segfault.

In case the buffer was too small we try with a larger buffer up to a
limit of zlog_limit. This makes sure that the stream length will remain
bounded by the buffer size.

This also adds assertions to make the programmer intent clear and catch
this more easily in debug builds.

Closes GH-16680.
2024-11-02 19:36:20 +01:00
Niels Dossche
f0f666ba3f Fix GH-16601: Memory leak in Reflection constructors
Additionally fixes wrong behaviour in ReflectionParameter when you first
have a construction that uses an object and the subsequent doesn't.

Closes GH-16672.
2024-11-02 19:35:20 +01:00
Gina Peter Banyard
5253647500 ext/gmp: Fix segfault when null is encountered on an overloaded operator
And various other issues like inconsistent type errors

Closes GH-16015
2024-11-02 17:36:32 +00:00
Gina Peter Banyard
fe02fd5095 ext/gmp: Add behavioural tests for operator overloading 2024-11-02 17:32:43 +00:00
Christoph M. Becker
f9453a889d Fix GH-14732: date_sun_info() fails for non-finite values
`timelib_astro_rise_set_altitude()` is not prepared to deal with non-
finite values (`nan`, `inf` and `-inf`) for `lon` and `lat`; instead
these trigger undefined behavior.  Thus we catch non-finite values
before even calling that timelib function; for `date_sun_info()` we
trigger `ValueError`s; for `date_sunrise()` and `date_sunset()` we
silently return `false`, since these functions will be sunsetted
anyway.

Closes GH-16497.
2024-11-01 23:46:19 +01:00
Niels Dossche
886a5287ca Fix GH-16604: Memory leaks in SPL constructors
Closes GH-16673.
2024-11-01 20:42:28 +01:00
Christoph M. Becker
ec68d3c608 Properly initialize _override executor globals
These have been introduced a while ago[1], but their initialization has
been overlooked.  Since we cannot rely on TLS variables to be zeroed,
we catch up on this.

[1] <e3ef7bbbb8>

Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>

Closes GH-16658.
2024-10-31 23:38:01 +01:00
Christoph M. Becker
c9eafc1954 Fix GH-16450: PDO_ODBC can inject garbage into field values
A previous bug fix[1] relied on ODBC drivers to properly count down the
`StrLen_or_IndPtr` argument for consecutive calls to `SQLGetData()`.
Apparently, not all drivers handle this correctly, so we cannot assert
they do.  Instead we fall back to the old behavior for drivers which
would violate the assertion.

A test against SQLServer (which we currently use in CI) would not make
sense, since the respective drivers do not exhibit that behavior.
Instead we target the regression test especially to a MS Access
database.

Since there is apparently no way to easily create an MS Access database
programmatically, we commit a minimal empty DB which is used for the
regression test, and could also be used by other test cases.

[1] <bccca0b53aa60a62e2988c750fc73c02d109e642>

Closes GH-16587.
2024-10-31 16:15:17 +01:00
Ilija Tovilo
e5d63eb4b9 [skip ci] Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [skip ci] Properly disable -Werror for libmysqlclient + mysqli
  [skip ci] Revert "Remove -Werror for libmysql test on 8.1 only"
2024-10-31 13:47:23 +01:00
Ilija Tovilo
6c8a0d0163 [skip ci] Properly disable -Werror for libmysqlclient + mysqli 2024-10-31 13:43:39 +01:00
Ilija Tovilo
8a067cc221 [skip ci] Revert "Remove -Werror for libmysql test on 8.1 only"
This reverts commit 769947648e.

Nightly uses the file from master, so this change made no sense.
2024-10-31 13:40:26 +01:00
Ilija Tovilo
64fbd52cb4 [skip ci] Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [skip ci] Fix nightly job name for 8.1
2024-10-31 13:38:06 +01:00
Ilija Tovilo
490acdf5e9 [skip ci] Fix nightly job name for 8.1 2024-10-31 13:37:23 +01:00
Ilija Tovilo
9e5024d988 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [skip ci] Move nightly to workflow_call
2024-10-30 16:54:11 +01:00
Ilija Tovilo
08bbd7d167 [skip ci] Move nightly to workflow_call
This PR removes most of the logic of nightly_matrix.php by converting
nightly.yml to a workflow_call, and invoking it multiple times for each branch
in a new root.yml workflow. The naming of the files is intentionally kept to
make the diff readable. They may still be renamed afterward.

Closes GH-16642
2024-10-30 16:53:55 +01:00
Ilija Tovilo
d2b78a1466 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Remove -Werror for libmysql test on 8.1 only
2024-10-30 14:48:00 +01:00
Ilija Tovilo
769947648e Remove -Werror for libmysql test on 8.1 only 2024-10-30 14:47:15 +01:00
Ilija Tovilo
58a5fa7224 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Partial backport of e7462bf
2024-10-30 14:23:51 +01:00
Ilija Tovilo
ed041c3443 Partial backport of e7462bf
e7462bff19
2024-10-30 14:20:47 +01:00
Ilija Tovilo
cf4c0182b6 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [CI] Backport usage of db service for 8.1
2024-10-30 12:21:34 +01:00
Ilija Tovilo
560a585117 [CI] Backport usage of db service for 8.1
Nightly already uses them. We're running into port clashes otherwise.

Closes GH-16647
2024-10-30 12:20:42 +01:00
Ilija Tovilo
9ad99bb56d Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Backport nightly.yml and nightly_matrix.php to PHP-8.1
2024-10-29 15:33:27 +01:00
Ilija Tovilo
27e8860594 Backport nightly.yml and nightly_matrix.php to PHP-8.1
These files are usually only used on master, as the cron trigger runs on master.
However, workflow_dispatch does use the file from the triggered branch.
Furthermore, we're looking into migrating to a workflow_call trigger, which will
also run on the target branch. Backport these files now to make those changes
easier.
2024-10-29 15:30:34 +01:00
David Carlier
eeec0939e0 Fix GH-14687 segfault on debugging a freed SplObjectIterator instance.
close GH-14711
2024-10-28 21:21:44 +00:00
Niels Dossche
9d8983c061 Fix GH-16595: Another UAF in DOM -> cloneNode
We need to perform all sanity checks before doing any modification.
I don't have a reliable and easy test for this on 8.2, but I have one
for 8.4.

Closes GH-16598.
2024-10-28 19:37:08 +01:00
Niels Dossche
d89dd28d3b Fix GH-16593: Assertion failure in DOM->replaceChild
This is already forbidden by libxml, but this condition isn't properly
checked; so the return value and lack of error makes it seem like it
worked while it actually didn't. Furthermore, this can break assumptions
and assertions later on.

Closes GH-16596.
2024-10-28 19:36:29 +01:00
Ilija Tovilo
e3de1a1a21 Fix icu dependency for macos build
Closes GH-16627
2024-10-28 16:40:51 +01:00
Ilija Tovilo
8538ac2667 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Backport CI fixes to security branches
2024-10-28 15:58:58 +01:00
Ilija Tovilo
25c0993902 Backport CI fixes to security branches
Closes GH-16469

Working towards GH-16286

commit e0db221143b808d97bc3a44e9f0968c6308794b4
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Fri Oct 25 22:48:20 2024 +0200

    Move CFLAGS into ./configure command for consistency

commit 8ad67768250d181cd7fef30e0c866625bbd8ac94
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Fri Oct 25 22:47:03 2024 +0200

    Also upgrade nightly to macOS 13

commit 58a88ccb9f
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Wed Oct 23 19:07:59 2024 +0200

    Fix call to dc[n]gettext in tests with 0 $category

    This causes a segfault on PHP-8.1

commit 611af05c50
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Fri Dec 8 13:36:52 2023 +0100

    [skip ci] Skip intermittently failing curl test on macOS

    The test fails with "CURL ERROR: 56". I will create an issue for it shortly.

commit ec745178bb
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Wed Oct 23 19:05:32 2024 +0200

    Backport parts of 9999a0c for gettext

    See 9999a0cb75

commit 5ce703496f
Author: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date:   Sun Jul 28 14:34:26 2024 +0200

    Fix CI failure on macOS after Curl update

commit 714a3e7071
Author: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date:   Sat Jul 27 16:09:50 2024 +0200

    Fix CI failure after Curl update (#15124)

commit 4f2eb921b9
Author: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date:   Thu May 23 22:20:37 2024 +0200

    Fix GH-14307: Test curl_basic_024 fails with curl 8.8.0

    Curl changed the behaviour, from the changelog:
      - lib: make protocol handlers store scheme name lowercase curl/curl@c294f9c

    From the docs: "The returned scheme might be upper or lowercase. Do
    comparisons case insensitively."

    Closes GH-14312.

commit 251195b41b
Author: Ayesh Karunaratne <ayesh@aye.sh>
Date:   Thu Feb 1 02:03:55 2024 +0700

    ext/curl: Fix failing tests due to string changes in libcurl 8.6.0

    Upstream libcurl 8.6.0 contains a change[^1] that caused a test failure.
    This fixes it by updating the test's `EXPECTF` to use a regex to account for both string patterns.

    [^1]: https://github.com/curl/curl/commit/45cf4755e71f#diff-a8a54563608f8155973318f4ddb61d7328dab512b8ff2b5cc48cc76979d4204cL1683

    Closes GH-13293.

commit fc5d83f2b1
Author: Christoph M. Becker <cmbecker69@gmx.de>
Date:   Wed Oct 16 22:46:20 2024 +0200

    Prepare for necessary move to macOS 13

    GH will remove macOS 12 runner images as of December 3rd, so we prepare
    for that.

    Besides the obvious need to change the runner, we also suppress a
    couple of warnings, because otherwise the build would fail due to
    `-Werror`.
2024-10-28 15:57:16 +01:00
Niels Dossche
8f60309a78 Fix GH-16589: UAF in SplDoublyLinked->serialize()
Closes GH-16611.
2024-10-27 19:11:37 +01:00
Niels Dossche
992ac1c25a Fix GH-16591: Assertion error in shm_put_var
Closes GH-16610.

Suggested-by: "Christoph M. Becker" <cmbecker69@gmx.de>
2024-10-26 15:07:22 +02:00
Gina Peter Banyard
a19029fc8b Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed SplFileObject::__constructor)
Closes GH-16480
Closes GH-16604
2024-10-25 22:04:10 +01:00
Niels Dossche
144d2ee29a Fix GH-16588: UAF in Observer->serialize
Closes GH-16600.
2024-10-25 22:59:59 +02:00
David Carlier
e0a0e216a9 ext/gmp: gmp_pow fix FPE with large values.
even without sanitizers, it is reproducible but with the following

```
<?php
$g = gmp_init(256);
var_dump(gmp_pow($g, PHP_INT_MAX));
```

we get this

```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==286922==ERROR: AddressSanitizer: FPE on unknown address 0x03e8000460ca (pc 0x7faf6c69de5c bp 0x400000000000004 sp 0x7ffe9843c740 T0)
    #0 0x7faf6c69de5c in __pthread_kill_implementation nptl/pthread_kill.c:44
    #1 0x7faf6c649c81 in __GI_raise ../sysdeps/posix/raise.c:26
    #2 0x7faf6db9386c in __gmp_exception (/lib/x86_64-linux-gnu/libgmp.so.10+0xd86c) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
    #3 0x7faf6db938d3 in __gmp_overflow_in_mpz (/lib/x86_64-linux-gnu/libgmp.so.10+0xd8d3) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
    #4 0x7faf6dbac95c in __gmpz_realloc (/lib/x86_64-linux-gnu/libgmp.so.10+0x2695c) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
    #5 0x7faf6dba9038 in __gmpz_n_pow_ui (/lib/x86_64-linux-gnu/libgmp.so.10+0x23038) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
    #6 0x5565ae1ccd9f in zif_gmp_pow /home/dcarlier/Contribs/php-src/ext/gmp/gmp.c:1286
    #7 0x5565aee96ea9 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:1312
    #8 0x5565af144320 in execute_ex /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:56075
    #9 0x5565af160f07 in zend_execute /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:60439
    #10 0x5565aed6fafe in zend_execute_scripts /home/dcarlier/Contribs/php-src/Zend/zend.c:1842
    #11 0x5565aeae70a8 in php_execute_script /home/dcarlier/Contribs/php-src/main/main.c:2578
    #12 0x5565af532f4e in do_cli /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:964
    #13 0x5565af535877 in main /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:1334
    #14 0x7faf6c633d67 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #15 0x7faf6c633e24 in __libc_start_main_impl ../csu/libc-start.c:360
    #16 0x5565adc04040 in _start (/home/dcarlier/Contribs/php-src/sapi/cli/php+0x2604040) (BuildId: 949049955bdf8b7197390b1978a1dfc3ef6fdf38)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE nptl/pthread_kill.c:44 in __pthread_kill_implementation
==286922==ABORTING
```

close GH-16384
2024-10-25 14:04:47 +01:00
Niels Dossche
e1e1e64a32 Fix GH-16559: UBSan abort in ext/gd/libgd/gd_interpolation.c:1007
The `uchar_clamp` function was backported from old code, this backports
it from new code.

Closes GH-16562.
2024-10-23 20:09:12 +02:00
Ilija Tovilo
9b7c506218 [skip ci] Add unused asan param to configure-x64 action
This param is passed by nightly to all branches. Add a unused argument to older
branches to avoid a warning.
2024-10-23 19:14:58 +02:00
Niels Dossche
5c210428f3 [ci skip] Update EXTENSIONS and CODEOWNERS for ext/soap (#16542)
De facto, I do the maintenance. But since many bugs are blocked by not
having reproducers and there's some fundamental issues in the extension,
this should get the "odd fixes" status instead. The "odd fixes"
description should perhaps also be updated to include a statement about
"limited willpower to debug"...
2024-10-22 20:13:59 +02:00
Ilija Tovilo
c5c4c3be44 [skip ci] Fix overwritten observer ini setting for gh16514.phpt 2024-10-22 15:20:56 +02:00
Ilija Tovilo
2d068c4f47 Fix lineno for inheritance errors of early bound classes
Fixes GH-16508
Closes GH-16532
2024-10-22 15:16:43 +02:00