1
0
mirror of https://github.com/php/php-src.git synced 2026-03-28 18:22:42 +01:00
Commit Graph

66228 Commits

Author SHA1 Message Date
Derick Rethans
0c8a7a77a8 Updated to version 2025.2 (2025b) 2025-03-24 10:06:32 +00:00
Niels Dossche
071f707a6d [ci skip] Make sure opcache can output in these tests 2025-03-21 16:35:47 +01:00
Niels Dossche
8823f89a32 Fix intl tests for icu 77 (#18125) 2025-03-21 14:23:03 +01:00
Niels Dossche
2ec8d37eb4 Fix GH-18107: Opcache CFG jmp optimization with try-finally breaks the exception table
If there's a try-finally where the try_op starts on a basic block with a
single JMP, and the JMP optimization causes that basic block to become
unreachable, then we update try_op.
In this case, there is no catch_op, so try_op is erroneously set to 0,
we should instead set it to `b->start`.

Closes GH-18110.
2025-03-21 13:56:31 +01:00
Remi Collet
209f4c296e Fix #66049 Typemap can break parsing in parse_packet_soap leading to a segfault 2025-03-21 08:23:12 +01:00
Niels Dossche
2dde07af55 Fix memory leak when destroying PDORow
This should call zend_object_std_dtor() to clean the property table etc.
This also has a semantic influence because previously weak refs were not
notified for example.

This fixes the final issue in GH-18114 (the crash was master-only and
fixed already).

Closes GH-18114.
Closes GH-18123.
2025-03-20 23:13:42 +01:00
Niels Dossche
e9c0296240 Fix GH-18112: NULL access with preloading and INI option
Preloading shutdown calls request shutdown which will deactivate the
virtual cwd state. However, further startup code still assumes the state
that was set by virtual_cwd_startup(). So we need to reactivate it
manually.

Creating a test was a bit difficult because the INI setting I wanted to
test this with is overridden by the test runner apparently.
To reproduce the issue, create an empty file test.php and execute this
in a ZTS build:
`php -d opcache.preload=./ext/opcache/tests/preload_class_alias_2.inc -d "error_log=" -d "allow_url_include=1" test.php`

Closes GH-18117.
2025-03-20 19:12:06 +01:00
Niels Dossche
d9329b1522 Fix xinclude destruction of live attributes
Follow-up for GH-17847 but now for attributes.

Closes GH-18100.
2025-03-18 22:01:56 +01:00
Jakub Zelenka
bd7d3c38ad Get rid of atime change testing in bug72666_variation3.phpt 2025-03-17 14:49:22 +01:00
David Carlier
005c7b5797 ext/intl: Fix Uconverter::transcode with substitutes as references.
close GH-18059
2025-03-15 11:37:08 +00:00
David Carlier
f34859cb90 ext/intl: Fix dateformat_format when the time is an array of references. 2025-03-15 11:33:17 +00:00
Arnaud Le Blanc
1c182674b0 Destroy temporary module classes in reverse order
We destroy classes of dl()'ed modules in clean_module_classes(), during
shutdown. Child classes of a module use structures of the parent class (such as
inherited properties), which are destroyed earlier, so we have a use-after-free
when destroying a child class.

Here I destroy classes in reverse order, as it is done in zend_shutdown() for
persistent classes.

Fixes GH-17961
Fixes GH-15367
2025-03-14 10:45:17 +01:00
Niels Dossche
a7d2703246 Correct check for maximum string length in JIT helpers
This is a bit of a theoretical issue, but the maximum string length is
actually ZSTR_MAX_LEN instead of SIZE_MAX. The resulting check is a bit
slower but should still be relatively cheap.

Closes GH-18049.
2025-03-13 23:47:45 +01:00
Niels Dossche
27affd8da1 Fix GH-18018: RC1 data returned from offsetGet causes UAF in ArrayObject
We should first check truthiness and only after that destroy the value.

Closes GH-18034.
2025-03-13 19:10:34 +01:00
Ilija Tovilo
276c2a67ef Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix flaky connection count in mysqli test
2025-03-13 16:47:20 +01:00
Ilija Tovilo
f390425db3 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix flaky connection count in mysqli test
2025-03-13 16:46:03 +01:00
Ilija Tovilo
00ebd2d7f2 Fix flaky connection count in mysqli test
Use connection ID instead of count to check whether we're using a
persistent connection. This allows the test to be run in parallel with
the other tests, but also protects against the possibility that some
other service connects to the mysql server.

Closes GH-18040
2025-03-13 16:40:33 +01:00
Remi Collet
69480be12a Relax test expectation for pcre2lib 10.45 Using e92848789a
Co-authored-by: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
2025-03-13 07:46:18 +01:00
David Carlier
c3fc94c4b8 ext/intl: fix locale_compose/locale_lookup to be able to deal with references.
close GH-18035
2025-03-12 22:18:34 +00:00
Jakub Zelenka
acf2f4988a Merge branch 'PHP-8.2' into PHP-8.3 2025-03-11 22:09:00 +01:00
Jakub Zelenka
4af1830356 Merge branch 'PHP-8.1' into PHP-8.2 2025-03-11 21:57:33 +01:00
Niels Dossche
0e715e71d9 Fix GHSA-wg4p-4hqh-c3g9 2025-03-11 21:50:17 +01:00
Tim Düsterhus
b6004a043c Fix GHSA-p3x9-6h7p-cgfc: libxml streams wrong content-type on redirect
libxml streams use wrong content-type header when requesting a
redirected resource.
2025-03-11 21:50:17 +01:00
Jakub Zelenka
41d49abbd9 Fix GHSA-hgf5-96fm-v528: http user header check of crlf 2025-03-11 21:50:16 +01:00
Jakub Zelenka
ac1a054bb3 Fix GHSA-52jp-hrpf-2jff: http redirect location truncation
It converts the allocation of location to be on heap instead of stack
and errors if the location length is greater than 8086 bytes.
2025-03-11 21:50:16 +01:00
Jakub Zelenka
0548c4c175 Fix GHSA-pcmh-g36c-qc44: http headers without colon
The header line must contain colon otherwise it is invalid and it needs
to fail.

Reviewed-by: Tim Düsterhus <tim@tideways-gmbh.com>
2025-03-11 21:50:16 +01:00
Jakub Zelenka
d20b4c97a9 Fix GHSA-ghsa-v8xr-gpvj-cx9g: http header folding
This adds HTTP header folding support for HTTP wrapper response
headers.

Reviewed-by: Tim Düsterhus <tim@tideways-gmbh.com>
2025-03-11 21:50:16 +01:00
Niels Dossche
1befdce0e6 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix test GH-16535 for libxml2 2.14
  Fix tests for libxml2 2.14
2025-03-10 20:23:36 +01:00
Niels Dossche
b5471300d2 Fix test GH-16535 for libxml2 2.14 2025-03-10 20:23:23 +01:00
Niels Dossche
239b01db7c Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix tests for libxml2 2.14
2025-03-10 20:22:27 +01:00
Niels Dossche
f209eb448e Fix tests for libxml2 2.14
See GH-18009.
2025-03-10 20:22:11 +01:00
Ilija Tovilo
33c75d98c9 Merge branch 'PHP-8.2' into PHP-8.3 2025-03-10 11:28:29 +01:00
Ilija Tovilo
d6172ce37a [skip ci] Ignore snmp test on asan that frequently times out
Not sure why this happens only on master.

Cherry-picked from becf207d0c
No longer happens just on master. ;)
2025-03-10 11:24:27 +01:00
Niels Dossche
9be9f70caa Fix weird unpack behaviour in DOM
Engine pitfall: the iter index is only updated by foreach opcodes, so
the existing code that used it as an index for the nodes w.r.t. the
start did not work properly. Fix it by using our own counter.

Closes GH-18004.
2025-03-09 11:17:03 +01:00
Niels Dossche
c7d3dc6fab Fix GH-17989: mb_output_handler crash with unset http_output_conv_mimetypes
The INI option can be NULL or invalid, resulting in a NULL global.
So we have to add a NULL check.

Closes GH-17996.
2025-03-09 11:16:33 +01:00
Ilija Tovilo
084446418f Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Suppress snmp lib memory leak, skip ASAN tests
2025-03-08 16:11:33 +01:00
Ilija Tovilo
b0858427aa Suppress snmp lib memory leak, skip ASAN tests
I don't know enough about this library to fix those :(

Cherry-picked from:
be4db6b550
ba1d9d0ab2
2025-03-08 16:10:59 +01:00
Niels Dossche
2634622d3d Fix uninitialized memory accesses in DOM iterator 2025-03-08 11:12:24 +01:00
David Carlier
07ceadf7d9 Fix GH-17984: gd calls with array arguments.
close GH-17985
2025-03-07 18:07:14 +00:00
Ilija Tovilo
1009ff65cc Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Upgrade security branches to Ubuntu 22.04
2025-03-06 15:24:35 +01:00
Ilija Tovilo
5fcc8d4cd1 Upgrade security branches to Ubuntu 22.04
20.04 goes out of security support in 2 months. Backporting various
commits.

See d98963a071
See af721c9c36
See 378b79b90c

Closes GH-17963
2025-03-06 15:24:15 +01:00
Ilija Tovilo
a840a54fbc Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix flaky DatePeriod test
2025-03-06 15:04:18 +01:00
Ilija Tovilo
9256ee7b1b Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix flaky DatePeriod test
2025-03-06 15:04:08 +01:00
Ilija Tovilo
8a699372f2 Fix flaky DatePeriod test
$start and $end use the H:i:s from the current time. If $end happens on
a second boundary, $start + 4 days will include $end, thus performing an
extra iteration. Fix this by setting H:i:s to 00:00:00.
2025-03-06 15:01:30 +01:00
Calvin Buckley
a30a41af78 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Skip mysqli/tests/bug73462 on PPC CI (#17971)
2025-03-05 10:19:52 -04:00
Calvin Buckley
1afbaaa804 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Skip mysqli/tests/bug73462 on PPC CI (#17971)
2025-03-05 10:18:41 -04:00
Calvin Buckley
dc6586dd9d Skip mysqli/tests/bug73462 on PPC CI (#17971)
* Skip this test on PPC CI

Seems to be unfortunately flaky with persistent connections.

* use spaces in phpt file
2025-03-05 10:17:39 -04:00
Niels Dossche
504056888c Fix GH-17938: UAF with zend_test opline observer and magic_quotes_gpc=1 (#17958) 2025-03-03 08:20:48 +01:00
Niels Dossche
ce8ab5f16a Fix GH-17736: Assertion failure zend_reference_destroy()
The cache slot for FETCH_OBJ_W in function `test` is primed with the
class for C. The next call uses a simplexml instance and reuses the same
cache slot. simplexml's get_property_ptr handler does not use the cache
slot, so the old values remain in the cache slot. When
`zend_handle_fetch_obj_flags` is called this is not guarded by a check
for the class entry. So we end up using the prop_info from the property
C::$a instead of the simplexml property.

This patch adds a reset to the cache slots in the property address fetch
code and also in the extensions with a non-standard reference handler.
This keeps the run time cache consistent and avoids the issue without
complicating the fast paths.

Closes GH-17739.
2025-03-02 22:33:32 +01:00
Jakub Zelenka
6bb56fe0cf Change openssl_x509_verify test to use cert generator (#17882)
This also prevents verifying cert with SHA1 signature
2025-02-28 14:51:12 +01:00