1
0
mirror of https://github.com/php/php-src.git synced 2026-03-24 08:12:21 +01:00
Commit Graph

66440 Commits

Author SHA1 Message Date
Jakub Zelenka
201b358c01 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Update NEWS with info about curl 8.16 compat fixes
  Fix curl_setopt_ssl test for curl 8.16
  Fix more curl 8.16 issues
  Fix curl 8.16.0 compilation with zts
  Fix curl build failure on macOS+curl 8.16
2025-10-07 14:37:47 +02:00
Jakub Zelenka
810aed1141 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Update NEWS with info about curl 8.16 compat fixes
  Fix curl_setopt_ssl test for curl 8.16
  Fix more curl 8.16 issues
  Fix curl 8.16.0 compilation with zts
  Fix curl build failure on macOS+curl 8.16
2025-10-07 14:30:22 +02:00
Jakub Zelenka
36859ad977 Fix curl_setopt_ssl test for curl 8.16 2025-10-07 14:18:41 +02:00
Ilija Tovilo
b810a23587 Fix more curl 8.16 issues
The CURLOPT_FOLLOWLOCATION seems like a gcc bug, where the integer extension of
bool to long is lost, but I was unable to reproduce on godbolt.org.
2025-10-07 14:18:41 +02:00
Ilija Tovilo
da75e41a6f Fix curl 8.16.0 compilation with zts 2025-10-07 14:18:41 +02:00
Niels Dossche
1c8363d2bf Fix curl build failure on macOS+curl 8.16 2025-10-07 14:18:41 +02:00
Niels Dossche
b7aeb0a69f Fix GH-19570: unable to fseek in /dev/zero and /dev/null
On Linux, these two character devices are exceptions in that they can be
seeked. Check their major/minor device number.

Co-authored-by: divinity76 <hans@loltek.net>
2025-10-06 18:16:16 +02:00
Alexandre Daubois
64c1d43b68 Fix GH-19926: reset internal pointer earlier while splicing array while COW violation flag is still set (#19929) 2025-10-06 16:51:23 +02:00
Niels Dossche
66c833444c phar: Fix memory leaks when creating temp file fails when applying zip signature
Also fixes up the error propagation at the call site which jumped to the
wrong place in the error handling code.

Closes GH-20057.
2025-10-05 21:10:34 +02:00
Niels Dossche
4fed57e746 Fix GH-20043: array_unique assertion failure with RC1 array causing an exception on sort
The reason this happens is because the array_unique operation happens in-place
because the input array is RC1.
At one point during comparison an exception is thrown which will capture the
arguments in the backtrace, which will increment the refcount of the RC1 array
to 2. Then a modification happens after the throw on the RC2 array causing the
assertion failure.
We shouldn't try continue work after an exception happened during the sort.

Closes GH-20059.
2025-10-05 20:15:28 +02:00
Niels Dossche
eab2c2007b Fix GH-20011: Array of SoapVar of unknown type causes crash
We "guess" the type in this case, consistent with what a SoapVar would
do outside of an array.

Closes GH-20030.
2025-10-02 19:38:44 +02:00
David Carlier
175afc4085 Fix GH-19705: do not flush/write buffer on non writeable stream.
Co-authored-by: Jakub Zelenka <bukka@php.net>

close GH-19708
2025-10-02 12:28:36 +01:00
Niels Dossche
0ffa337a54 Fix GH-17345: Bug #35916 was not completely fixed
Change the reproducer code in `bug35916.phpt` from `stream_bucket_append` to
`stream_bucket_prepend` and you have the same bug.
Furthermore, even in the append case the check is incorrect because the bucket
can already be in the brigade at a position other than the tail.
To solve this properly, unlink the brigade first and also use that as a
condition to manage the refcount.

Closes GH-18973.
2025-10-01 11:49:28 +02:00
Alexandre Daubois
9fc14a90c6 Fix GH-16319: protect fiber backtrace with null filename from crashing (#19973) 2025-10-01 11:24:58 +02:00
Niels Dossche
7c859268c0 Fix memory leak and invalid continuation after tar header writing fails
Closes GH-20003.
2025-10-01 10:46:33 +02:00
Niels Dossche
c617afd6d6 Fix GH-20009: XMLReader leak on RelaxNG schema failure
Closes GH-20014.
2025-09-30 18:06:35 +02:00
Niels Dossche
6db12e7cd8 Fix bug #67563: mysqli compiled with mysqlnd does not take ipv6 adress as parameter
In the past, when libmysqlclient could be used, it accepted ipv6 addresses
as hostname without enclosing it first in brackets. However, in mysqlnd
this never worked. In the past this caused a discrepancy between the two
implementations.
Nowadays, mysqli only works with mysqlnd so we don't even have to cater
to libmysqlclient. However, a plain ipv6 address should still work as a
hostname. Also for people migrating to newer PHP versions it's nice if
this keeps working.

The solution is to check if we're dealing with an ipv6 address not yet
enclosed in brackets. In that case we add the brackets automatically.

Closes GH-19750.
2025-09-30 15:20:14 +02:00
Niels Dossche
21c2c07a24 Fix GH-19998: ext/standard/tests/file/bug46347.phpt sometimes fails: racy in parallel
The same test file name is already used in parse_ini_file.phpt.

Closes GH-20000.
2025-09-30 10:52:59 +02:00
David Carlier
e029f8f45b Fix GH-19955: imagefttext() memory leak
close GH-19968
2025-09-29 23:20:27 +01:00
David Carlier
93bac8cb1a Fix GH-19922: gzopen() double free
close GH-19924
2025-09-29 22:47:29 +01:00
David Carlier
3ee56f68ed Fix GH-19932: Zip::setEncryptionName()/setEncryptionIndex() memory leak.
On successive usage, the password is copied as much but the older
address is never freed. Thus, we are hinting a password reset to address
it.

close GH-19936
2025-09-29 22:10:17 +01:00
Niels Dossche
d94846c3b4 Fix GH-19988: zend_string_init with NULL pointer in simplexml (UB)
Normally, simplexml cannot import document nodes,
but xsl allows to circumvent this.
A document does not have a name, so we return the empty string
in that case.
While we could add an explicit check, we might as well switch
the macro to a form that would be more optimal anyway as many
tag names can be single characters.

The test was added in xsl because adding it in simplexml would
break out-of-tree builds of simplexml.

Closes GH-19990.
2025-09-29 16:07:34 +02:00
Jakub Zelenka
f9dc073b04 Add stream filter convert.* tests (#19976)
The convert.* filters are quite untested so this tries to improve it.

Closes GH-19976
2025-09-27 12:43:28 +02:00
Ilija Tovilo
a885372a08 Fix more curl 8.16 issues
The CURLOPT_FOLLOWLOCATION seems like a gcc bug, where the integer extension of
bool to long is lost, but I was unable to reproduce on godbolt.org.
2025-09-23 16:11:19 +02:00
Ilija Tovilo
266cb7d892 Fix curl 8.16.0 compilation with zts 2025-09-22 10:55:59 +02:00
David Carlier
933e087843 Fix GH-19885: dba_fetch() overflow on skip argument.
close GH-19887
2025-09-21 14:23:53 +01:00
Niels Dossche
7a1bb71127 Fix GH-19480: error_log php.ini cannot be unset when open_basedir is configured
Since the ini message handlers already check for basedir, we need to
drop the basedir check from ini_set. Then we also fix the exceptional
case for the empty string: it should bypass the basedir check.
Furthermore, there was a regression introduced with the error_log
"syslog" check in ddfe269a (inverted check), so we fix that as well.

Closes GH-19487
2025-09-19 14:14:53 +02:00
Alexandre Daubois
75217c16c8 Fix GH-19801: address leak when calling var_dump() with recursion in __debugInfo() (#19837) 2025-09-16 15:05:45 +02:00
Derick Rethans
be5784dfec Revert "Update timelib to 2022.14"
This reverts commits:
- a0329dbab0
- b42bd2a359
2025-09-15 14:17:32 +01:00
Derick Rethans
94dbdd03b7 Merge branch 'PHP-8.2' into PHP-8.3 2025-09-15 10:39:49 +01:00
Derick Rethans
a0329dbab0 Update timelib to 2022.14 2025-09-15 10:38:53 +01:00
Niels Dossche
b46681d686 Fix curl build failure on macOS+curl 8.16
Closes GH-19820.
2025-09-13 23:22:22 +02:00
Niels Dossche
d30dd1b47b Fix GH-19784: SoapServer memory leak
Closes GH-19818.
2025-09-13 10:15:22 +02:00
Tim Düsterhus
871fe600c2 curl: Fix cloning of POST fields (#19813) 2025-09-12 20:53:14 +02:00
Niels Dossche
4974d5ef49 Fix GH-19701: Serialize/deserialize loses some data
See GH-19701 for discussion.
This now restores the (correct) serialization output from versions
PHP 7.4.1 and below.

Closes GH-19762.
2025-09-11 21:01:34 +02:00
Niels Dossche
2ad0b5cf05 Fix GH-19792: SCCP causes UAF for return value if both warning and exception are triggered
If an exception _and_ a warning (or deprecation) is emitted, then the
result is destroyed twice. Use an `else if` to prevent this.
This is tested via zend_test because the deprecation that triggered the
original reproducer may disappear in the future.

Closes GH-19793.
2025-09-11 19:35:53 +02:00
Niels Dossche
901f71e6e3 Fix GH-19688: Remove pattern overflow in zip addGlob()
memcmp() can overread the filename if the filename is shorter than the
pattern.

Closes GH-19689.
2025-09-10 23:47:52 +02:00
Niels Dossche
f6f17484ab Fix GH-12265: Cloning an object breaks serialization recursion
Closes GH-12287.
2025-09-10 17:53:34 +02:00
Tim Düsterhus
215ebbb8d5 zend_API: Do not overwrite readonly properties in object_properties_load() (#19767)
Fixes php/php-src#19765.
2025-09-09 19:33:45 +02:00
Alexandre Daubois
9eedf00206 Fix intl tests naming (#19763) 2025-09-09 08:41:20 +02:00
Niels Dossche
f6878b6ccf Fix GH-19752: Phar decompression with invalid extension can cause UAF
The rename code can error out prior to the reassignment of the filename,
which is why the test causes a crash.
The rename code can also error out at a later point,
which means it will have already assigned the new filename.
We detect in which case we are in and act accordingly.

Closes GH-19761.
2025-09-08 23:10:33 +02:00
Niels Dossche
ff84cb08ef Fix OSS-Fuzz #385993744
PSFS_FEED_ME is supposed to be returned when the filter did not receive
enough data and did not generate buckets for the output brigade.
The test generates buckets anyway on the output brigade, and the stream
layer did not handle that case causing a memory leak.
To solve this, discard any such buckets as it would conflict with the
status code returned by the filter. This keeps BC and solves the leak.

Closes GH-18972.
2025-09-08 19:10:22 +02:00
Niels Dossche
98bb934685 Fix memory leak on failure in phar_convert_to_other()
Closes GH-19755.
2025-09-08 19:06:11 +02:00
Niels Dossche
c50b37d231 Fix metadata leak when phar convert logic fails
Closes GH-19756.
2025-09-08 19:05:47 +02:00
Alexandre Daubois
6a2adcd8a4 Fix GH-11952: better locale strings canonicalization for IntlDateFormatter and NumberFormatter (#19593) 2025-09-08 16:36:27 +02:00
David Carlier
93865a4086 Fix GH-19578: imagefilledellipse underflow on width argument.
close GH-19579
2025-09-07 18:18:17 +01:00
Niels Dossche
2f162214e8 Fix memory leak in phar tar temporary file error handling code
Closes GH-19740.
2025-09-07 13:04:19 +02:00
Niels Dossche
9d69ab91ab Fix GH-19720: Assertion failure when error handler throws when accessing a deprecated constant
When deprecation causes an exception, we should return NULL instead of
continuing.

Closes GH-19723.
2025-09-06 00:00:52 +02:00
Niels Dossche
216e87ad7e Fix memory leak in zip when encountering empty glob result
The case of returning 0 is inconsistent in when it returns an empty
array, furthermore the caller already returns an empty array.
Because the caller overwrites the return value in these cases, it can
cause a memory leak.

This is easier to trigger on master in some cases as different code paths
are taken with the new bundled glob. On some platforms it is also
triggerable on 8.3.

Closes GH-19715.
2025-09-05 18:56:27 +02:00
Alexandre Daubois
05133ac962 Fix GH-19577: avoid integer overflow when using a small offset and PHP_INT_MAX with LimitIterator (#19585) 2025-09-05 08:09:06 +02:00