1
0
mirror of https://github.com/php/php-src.git synced 2026-04-03 14:12:38 +02:00
Commit Graph

14378 Commits

Author SHA1 Message Date
Jakub Zelenka
6a5c04d01d Fix bug GHSA-q6x7-frmf-grcw: password_verify can erroneously return true
Disallow null character in bcrypt password
2024-04-09 11:09:33 -07:00
Niels Dossche
f77e5794c4 Fix GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
The check happened too early as later code paths may perform more
mangling rules. Move the check downwards right before adding the actual
variable.
2024-04-09 11:09:06 -07:00
Jakub Zelenka
0d89b54759 Add proc_open escaping for cmd file execution 2024-04-09 11:08:35 -07:00
Niels Dossche
5fc3518426 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix nightly failure due to type in file_put_contents_5gb.phpt
2024-03-10 11:28:05 +01:00
Niels Dossche
65593e10ef Fix nightly failure due to type in file_put_contents_5gb.phpt 2024-03-10 11:27:47 +01:00
Jakub Zelenka
4612bb77fb Merge branch 'PHP-8.2' into PHP-8.3 2024-03-09 19:59:06 +00:00
divinity76
2343791aff Fix GH-13203: file_put_contents fail on strings over 4GB on Windows
Closes GH-13205
2024-03-09 19:58:28 +00:00
Saki Takamachi
04eeaa0bc7 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Added validation of `\n` in $additional_headers of mail()
2024-03-04 21:30:27 +09:00
Saki Takamachi
04e8e55f47 Added validation of \n in $additional_headers of mail()
When $additional_headers of mail() is an array, the same validation as
`\r\n` is now applied to `\n` alone too.
2024-03-04 21:30:07 +09:00
Niels Dossche
dfd37c7175 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-11808: Live filesystem modified by tests (security)
2024-03-01 18:46:30 +01:00
Niels Dossche
7c8a3e426e Fix GH-11808: Live filesystem modified by tests (security)
There's a test that tries to make /etc world-writable, and asserts that
it fails. Although this test is guarded by a root user check, there are
situations where you don't need to be root to be able to do this.
This may thus have unwanted effects on your live filesystem.

The simple solution is to remove that part of the test. It doesn't
really add value anyway: we're trying to test the chmod error path, but
that exact same error path can be reached with any failure condition
that the kernel gives. For example, trying to chmod a non-existent file
will trigger the same code path.

While at it, also prefix the test path for the non-existent file such
that we don't accidentally modify the filesystem.

The chroot now has a better root-user check, that will not modify the
filesystem.

Other root-modifying mkdir tests were removed because they added no
value either.

Closes GH-13566.
2024-03-01 18:45:54 +01:00
Jakub Zelenka
ae44ab47a7 Merge branch 'PHP-8.2' into PHP-8.3 2024-02-04 12:00:36 +00:00
Jakub Zelenka
bc30ae4f04 Fix bug #75712: getenv in php-fpm should not read $_ENV, $_SERVER
Closes GH-13195
2024-02-04 11:58:18 +00:00
David Carlier
e32821258e Merge branch 'PHP-8.2' into PHP-8.3 2024-02-03 13:22:58 +00:00
David Carlier
b06d6dba4f Forgotten piece of GH-13309/GH-13310 previous PR 2024-02-03 13:22:45 +00:00
David Carlier
6842d3c03a Merge branch 'PHP-8.2' into PHP-8.3 2024-02-03 13:07:51 +00:00
David Carlier
d91224cd2f Fix GH-13309 and GH-13310: array hashes comparison, wrong buffer len calculation.
php_array_key_compare_string_case_unstable_i has a typo for the second
operand resulting in a wrong buffer size calculation.

Issue reported by @AlexRudyuk

Close GH-13315
2024-02-03 13:07:15 +00:00
Ilija Tovilo
d65c395049 Fix instable array during in-place modification in uksort
The array isn't just observable if the array has RCn, but also if it is inside a
reference that is RCn. By-ref parameters are always RCn and as such always
observable.

Fixes GH-13279
Closes GH-13285
2024-01-31 19:25:30 +01:00
Niels Dossche
47454cb771 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-13071: Copying large files using mmap-able source streams may exhaust available memory and fail
2024-01-16 23:46:43 +01:00
Niels Dossche
5e9e9c9d51 Fix GH-13071: Copying large files using mmap-able source streams may exhaust available memory and fail
Commit 5cbe5a538c disabled chunking for all writes to streams. However,
user streams have a callback where code is executed on data that is
subject to the memory limit. Therefore, when using large writes or
stream_copy_to_stream/copy the memory limit can easily be hit with large
enough data.

To solve this, we reintroduce chunking for userspace streams.
Users have control over the chunk size, which is neat because
they can improve the performance by setting the chunk size if
that turns out to be a bottleneck.

In an ideal world, we add an option so we can "ask" the stream whether
it "prefers" chunked writes, similar to how we have
php_stream_mmap_supported & friends. However, that cannot be done on
stable branches.

Closes GH-13136.
2024-01-16 23:44:58 +01:00
Ilija Tovilo
ed64949d12 strtok is not comptime()
Fixes GH-13145
Closes GH-13148
2024-01-14 19:12:41 +01:00
Tim Düsterhus
00ea756c93 random/standard: Adjust #13138 for PHP 8.3 2024-01-14 13:05:44 +01:00
Tim Düsterhus
f2f070a897 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  random/standard: Correctly handle broken engines in php_array_pick_keys (#13138)
2024-01-14 13:03:33 +01:00
Tim Düsterhus
97c6da1dec random/standard: Correctly handle broken engines in php_array_pick_keys (#13138) 2024-01-14 13:01:29 +01:00
Niels Dossche
1d6f344bea Fix GH-13094: range(9.9, '0') causes segmentation fault
`start_type + end_type < 2*IS_STRING` is not right, in this test case
the types are start_type==5 (IS_DOUBLE), end_type==7 (IS_ARRAY).
The IS_ARRAY type is a sentinel to disambiguate single-byte strings.
The path must be taken when one of the types is not a string nor a
single-byte string. Therefore, use < IS_STRING with an OR condition.

Closes GH-13105.
2024-01-09 22:11:45 +01:00
Ilija Tovilo
aa52c29f28 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix clean for higher branches
2023-12-13 15:22:09 +01:00
Ilija Tovilo
23ea89404b Fix clean for higher branches 2023-12-13 15:21:19 +01:00
Ilija Tovilo
cb38d7b23f Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Disambiguate fileVar8 test folder
2023-12-13 14:31:56 +01:00
Ilija Tovilo
cda7718f51 Disambiguate fileVar8 test folder
Closes GH-12951
2023-12-13 14:31:40 +01:00
Niels Dossche
cd179171cc Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-12936: hash() function hangs endlessly if using sha512 on strings >= 4GiB
2023-12-12 19:57:47 +01:00
Niels Dossche
2b8c00850b Fix GH-12936: hash() function hangs endlessly if using sha512 on strings >= 4GiB
There's two problems:
- Some loops used `unsigned int` instead of `size_t`.
- The 2*N-bit addition that is emulated using 2 N bit numbers has a bug:
  it first truncated the number to 32/64 bit and only then shifted. This
  resulted in the wrong length info stored inside the resulting hash.

Closes GH-12937.
2023-12-12 19:57:06 +01:00
Niels Dossche
0e69329bb0 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Add missing NULL checks for spl autoload table
  Add missing NULL pointer checks related to the previous call frame
2023-12-01 09:09:58 +01:00
Niels Dossche
bedf1083f3 Add missing NULL pointer checks related to the previous call frame 2023-12-01 09:08:47 +01:00
Gina Peter Banyard
af155cf2dc Mention correct bug number
I'm tired
2023-11-22 04:14:37 +00:00
Gina Peter Banyard
37f67a9a98 ext/standard: Fix GH-9316
http_build_query() default null argument for  is implicitly coerced to string

Closes GH-9316
2023-11-22 04:09:40 +00:00
Ilija Tovilo
8828d6ac1d Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [skip ci] Fix more test tmp file conflicts
2023-11-16 16:28:40 +01:00
Ilija Tovilo
d5c6633bd1 [skip ci] Fix more test tmp file conflicts 2023-11-16 16:28:12 +01:00
Ilija Tovilo
3060edf6af Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix file test race condition
2023-11-16 15:40:41 +01:00
Ilija Tovilo
a742010a0a Fix file test race condition
005_variation2.phpt creates files with special names, and
filesize_variation5.phpt checks for filesize of inexistent files with special
names. Create the files in a separate directory to avoid these tests clashing.

Closes GH-12692
2023-11-16 15:40:16 +01:00
Jakub Zelenka
945c512a4e Merge branch 'PHP-8.2' into PHP-8.3 2023-11-16 14:37:10 +00:00
Jakub Zelenka
bf250e9f88 Merge branch 'PHP-8.1' into PHP-8.2 2023-11-16 14:36:16 +00:00
Jakub Zelenka
b4208c8f96 Initialize syslog device in GINIT
Closes GH-12663
2023-11-16 14:31:44 +00:00
Ilija Tovilo
aa452ed315 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [skip ci] Further increase allowable atime deviation
2023-11-14 18:37:17 +01:00
Ilija Tovilo
9b07b013fc [skip ci] Further increase allowable atime deviation
MSAN is slow in particular, leading to potentially higher deviations.
2023-11-14 18:36:07 +01:00
Niels Dossche
5c25742c26 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-12655: proc_open() does not take into account references in the descriptor array
2023-11-13 19:34:40 +01:00
Niels Dossche
86c7d3ed1f Fix GH-12655: proc_open() does not take into account references in the descriptor array
Closes GH-12658.
2023-11-13 19:29:44 +01:00
Ilija Tovilo
a687465c45 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix astat imperciseness excemption in test
2023-11-12 14:07:10 +01:00
Ilija Tovilo
d224faa10f Fix astat imperciseness excemption in test 2023-11-12 14:06:02 +01:00
Ilija Tovilo
85107c94d1 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix undeclared variable in stat tests
2023-11-11 21:01:19 +01:00
Ilija Tovilo
7440a1bd1f Fix undeclared variable in stat tests
Closes GH-12645
2023-11-11 21:00:50 +01:00