Makes it like ext/standard/tests/file/filetype_variation.phpt; it's not
just Windows that can have a missing posix_mkfifo, but also a minimal
build, like the ones suggested that RMs test with (using --disable-all).
(cherry picked from commit bd484ed65f)
Static analysis reports that the bounds check comes after reading the
byte from the buffer.
In practice, this is tagged data that loops until the end tag is found
and therefore there isn't really a bug. The extra length check is only
there for extra hardening.
So we simply silence the static analysers and improve the hardening.
See also https://docwiki.embarcadero.com/InterBase/15/en/Isc_dsql_sql_info()
If you can extend the file between the file size gathering (resulting in
a buffer allocation), and reading / writing to the file you can trigger a
TOC-TOU where you write out of bounds.
To solve this, add extra bound checks and make sure that write actions
always fail when going out of bounds.
The easiest way to trigger this is via a pipe, which is used in the
test, but it should be possible with a regular file and a quick race
condition as well.
Closes GH-20591.
With macos Tahoe and clang "17.0.0" (Xcode) the ext/posix/tests/posix_getgrgid_macosx.phpt test crashes as follow:
ext/posix/posix.c:681:19: runtime error: load of misaligned address 0x60800000e972 for type 'char **', which requires 8 byte alignment
0x60800000e972: note: pointer points here
70 00 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
seems memcpy had been translated to a load instruction ?
anyhow, we force to copy a "proper" char * source.
close GH-20744
PHP 8.5 defines constant ZEND_VM_KIND since GH-19574, but this name is also
used by zend_vm_gen.php. This causes zend_vm_gen.php to generate invalid
code when executed with PHP 8.5 in an older branch.
Here I rename the constant in zend_vm_gen.php.
This stopped working after e735d2bc3b because fp_refcount is increased,
making phar think that the file has open read pointers.
To fix this, the refcount shouldn't be increased but that would
re-introduce the previous bug.
Instead, we need to add a field that "locks" the existence of the
internal entry separate from the refcount.
Closes GH-20473.
The size of `got` was incorrect: it being unsigned means that the error
return codes are converted from -1 to SIZE_MAX. We should use ssize_t
instead.
Closes GH-20735.
The problem is that the code is doing `php_output_handler_free` in a loop on the output stack,
but prior to freeing the pointer on the stack in `php_output_handler_free` it calls
`php_output_handler_dtor` which can run user code that reallocates the stack,
resulting in a dangling pointer freed by php_output_handler_free.
Furthermore, OG(active) is set when creating a new output handler, but
the loop is supposed to clean up all handlers, so OG(active) must be
reset as well.
Closes GH-20356.
Keep this up to date in all nonbranches, because the node.js runtime for older
versions might get deprecated in the future and fixing this for all branches at
once is easier.
see 2650248a92
Keep this up to date in all nonbranches, because the node.js runtime for older
versions might get deprecated in the future and fixing this for all branches at
once is easier.
see 2650248a92
This procedure may be called during i_free_compiled_variables(), when
EG(current_execute_data) is unfortunately already reset to the parent frame.
EG(opline_before_exception) does not actually belong to this frame. Furthermore,
setting opline to EG(exception_op) early will miss a later
zend_rethrow_exception(), which will also miss installation of the correct
EG(opline_before_exception).
Fixes GH-20714
Closes GH-20716
* PHP-8.2:
Update NEWS with info about security issues
Fix GHSA-www2-q4fc-65wf
Fix GHSA-h96m-rvf9-jgm2
Fix GHSA-8xr5-qppj-gvwj: PDO quoting result null deref
Fix GH-20584: Information Leak of Memory
* PHP-8.1:
Update NEWS with info about security issues
Fix GHSA-www2-q4fc-65wf
Fix GHSA-h96m-rvf9-jgm2
Fix GHSA-8xr5-qppj-gvwj: PDO quoting result null deref
Fix GH-20584: Information Leak of Memory
The string added had uninitialized memory due to
php_read_stream_all_chunks() not moving the buffer position, resulting
in the same data always being overwritten instead of new data being
added to the end of the buffer.
This is backport as there is a security impact as described in
GHSA-3237-qqm7-mfv7 .
According to @cmb69, PHP does not require VLA support
(https://github.com/php/php-src/pull/10304#discussion_r1069343092).
VLAs are a bad idea for several reasons, so let's get rid of them.
Two of the VLAs were probably unintended; unlike C++, C doesn't have
the concept of "constant expressions", so an array with a "const"
length is technically still a VLA. This is fixed by removing the
"const" variable, and using sizeof() instead.
(cherry picked from commit ff2a211d55)
