1
0
mirror of https://github.com/php/php-src.git synced 2026-04-03 06:02:23 +02:00
Commit Graph

14411 Commits

Author SHA1 Message Date
Niels Dossche
e6a82adace Fix GHSA-9fcc-425m-g385: bypass CVE-2024-1874
The old code checked for suffixes but didn't take into account trailing
whitespace. Furthermore, there is peculiar behaviour with trailing dots
too. This all happens because of the special path-handling code inside
CreateProcessW.

By studying Wine's code, we can see that CreateProcessInternalW calls
get_file_name [1] in our case because we haven't provided an application
name. That code gets the first whitespace-delimited string into app_name
excluding the quotes. It's then passed to create_process_params [2]
where there is the path handling code that transforms the command line
argument to an image path [3]. Inside Wine, the extension check if
performed after these transformations [4]. By doing the same thing in
PHP we match the behaviour and can properly match the extension even in
the given edge cases.

[1] 166895ae3a/dlls/kernelbase/process.c (L542-L543)
[2] 166895ae3a/dlls/kernelbase/process.c (L565)
[3] 166895ae3a/dlls/kernelbase/process.c (L150-L151)
[4] 166895ae3a/dlls/kernelbase/process.c (L647-L654)
2024-06-04 07:38:07 -07:00
Derick Rethans
9c9f49a1f4 Merge branch 'PHP-8.2' into PHP-8.3 2024-05-20 15:49:46 +01:00
Saki Takamachi
0a8fbef996 Added test 2024-05-20 15:13:53 +01:00
Niels Dossche
cce922e49b Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix nightly test failure (#14251)
2024-05-16 20:01:38 +02:00
Niels Dossche
02b7d70fa9 Fix nightly test failure (#14251)
The created files have the same filename, creating conflicts. Fix this
by adding a unique suffix.
2024-05-16 20:00:46 +02:00
Dmitry Stogov
48df7daf43 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix undefined behavior (left shift of negative number)
2024-05-06 09:52:39 +03:00
Dmitry Stogov
f0356612d9 Fix undefined behavior (left shift of negative number)
Fixes oss-fuzz #68722
2024-05-06 09:49:41 +03:00
Peter Kokot
49b5ab2057 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix tests for glibc 2.39 (#14097)
2024-05-01 20:43:42 +02:00
Peter Kokot
b6b9eab68e Fix tests for glibc 2.39 (#14097)
2.39 has fixed inconsistent (mon_)grouping formats in localedata:

* https://sourceware.org/git/?p=glibc.git;a=blob;f=NEWS;hb=refs/tags/glibc-2.39#l237
* https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/locales/en_AU;hb=refs/tags/glibc-2.39#l65

For en_AU locale now it returns array of 1 item instead of 2 for
grouping and mon_grouping.

Since this is upstream change depending on the system, this only syncs
tests for such case.
2024-05-01 20:43:00 +02:00
Ilija Tovilo
f06a755848 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix clean section in test
2024-04-15 14:15:09 +02:00
Ilija Tovilo
a7a7e6d57c Fix clean section in test 2024-04-15 14:14:47 +02:00
Ilija Tovilo
df4d59e43d Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix rename test file name collision
2024-04-15 13:43:06 +02:00
Ilija Tovilo
f2cd0d5752 Fix rename test file name collision 2024-04-15 13:42:40 +02:00
Jakub Zelenka
4dad74f250 Merge branch 'PHP-8.2' into PHP-8.3 2024-04-14 14:27:05 +01:00
Damian Wójcik
8421cfda61 Fix file_get_contents() on Windows fails with "errno=22 Invalid argument"
Closes GH-13948
2024-04-14 14:26:10 +01:00
Ben Ramsey
3d9941fd1e Merge branch 'PHP-8.2' into PHP-8.3 2024-04-09 23:49:53 -05:00
Ben Ramsey
a9ffc447a4 Merge branch 'PHP-8.1' into PHP-8.2 2024-04-09 23:49:31 -05:00
Jakub Zelenka
0ba5229a3f Fix bug GHSA-q6x7-frmf-grcw: password_verify can erroneously return true
Disallow null character in bcrypt password
2024-04-09 23:38:32 -05:00
Niels Dossche
093c08af25 Fix GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
The check happened too early as later code paths may perform more
mangling rules. Move the check downwards right before adding the actual
variable.
2024-04-09 23:37:06 -05:00
Jakub Zelenka
e3c784f2bf Add proc_open escaping for cmd file execution 2024-04-09 23:29:28 -05:00
Niels Dossche
6c7707e918 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix persistent local flag in session url updating (#13905)
2024-04-07 15:25:08 +02:00
Niels Dossche
4a14211739 Fix persistent local flag in session url updating (#13905)
Short-lived regression from 5ce9687cb2.
I forgot to add the persistent local flag, so that means that RC_DEBUG
will complain. These strings are local to the thread so we can just add
the flag to silence the debug checker in this case.
2024-04-07 15:24:29 +02:00
Niels Dossche
eb244fcb49 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [ci skip] NEWS
  Fix GH-13891: memleak and segfault when using ini_set with session.trans_sid_hosts (#13892)
2024-04-06 13:45:00 +02:00
Niels Dossche
5ce9687cb2 Fix GH-13891: memleak and segfault when using ini_set with session.trans_sid_hosts (#13892)
The hash tables used are allocated via the persistent allocator.
When using ini_set, the allocation happens via the non-persistent
allocator. When the table is then freed in GSHUTDOWN, we get a crash
because the allocators are mismatched.

As a side note, it is strange that this is designed this way, because it
means that ini_sets persist between requests...

Co-authored-by: Kamil Tekiela <tekiela246@gmail.com>
2024-04-06 13:43:26 +02:00
Niels Dossche
e34c86ce1a Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix gcc-14 Wcalloc-transposed-args warnings
2024-04-01 20:34:37 +02:00
Cristian Rodríguez
18d70db091 Fix gcc-14 Wcalloc-transposed-args warnings
gcc-14 and later warns of inverted arguments in calloc or
calloc-like __alloc_size__ annotated functions.

Closes GH-13818.
2024-04-01 20:34:14 +02:00
Jakub Zelenka
caec2b6186 Merge branch 'PHP-8.2' into PHP-8.3 2024-03-29 16:09:09 +00:00
Jakub Zelenka
c087398cc2 Fix GH-13264: Part 1 - Memory leak on filter failure
Closes GH-13790
2024-03-29 16:06:49 +00:00
David Carlier
868257a3de Fix GH-13727: macro generating invalid call test prototypes fixes.
autoconf/libtool generating code to test features missed `void` for
C calls prototypes w/o arguments.
Note that specific changes related to libtool have to be upstreamed.

Co-authored-by: Peter Kokot <petk@php.net>

close GH-13732
2024-03-18 06:53:39 +00:00
Niels Dossche
5fc3518426 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix nightly failure due to type in file_put_contents_5gb.phpt
2024-03-10 11:28:05 +01:00
Niels Dossche
65593e10ef Fix nightly failure due to type in file_put_contents_5gb.phpt 2024-03-10 11:27:47 +01:00
Jakub Zelenka
4612bb77fb Merge branch 'PHP-8.2' into PHP-8.3 2024-03-09 19:59:06 +00:00
divinity76
2343791aff Fix GH-13203: file_put_contents fail on strings over 4GB on Windows
Closes GH-13205
2024-03-09 19:58:28 +00:00
Saki Takamachi
04eeaa0bc7 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Added validation of `\n` in $additional_headers of mail()
2024-03-04 21:30:27 +09:00
Saki Takamachi
04e8e55f47 Added validation of \n in $additional_headers of mail()
When $additional_headers of mail() is an array, the same validation as
`\r\n` is now applied to `\n` alone too.
2024-03-04 21:30:07 +09:00
Niels Dossche
dfd37c7175 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-11808: Live filesystem modified by tests (security)
2024-03-01 18:46:30 +01:00
Niels Dossche
7c8a3e426e Fix GH-11808: Live filesystem modified by tests (security)
There's a test that tries to make /etc world-writable, and asserts that
it fails. Although this test is guarded by a root user check, there are
situations where you don't need to be root to be able to do this.
This may thus have unwanted effects on your live filesystem.

The simple solution is to remove that part of the test. It doesn't
really add value anyway: we're trying to test the chmod error path, but
that exact same error path can be reached with any failure condition
that the kernel gives. For example, trying to chmod a non-existent file
will trigger the same code path.

While at it, also prefix the test path for the non-existent file such
that we don't accidentally modify the filesystem.

The chroot now has a better root-user check, that will not modify the
filesystem.

Other root-modifying mkdir tests were removed because they added no
value either.

Closes GH-13566.
2024-03-01 18:45:54 +01:00
Jakub Zelenka
ae44ab47a7 Merge branch 'PHP-8.2' into PHP-8.3 2024-02-04 12:00:36 +00:00
Jakub Zelenka
bc30ae4f04 Fix bug #75712: getenv in php-fpm should not read $_ENV, $_SERVER
Closes GH-13195
2024-02-04 11:58:18 +00:00
David Carlier
e32821258e Merge branch 'PHP-8.2' into PHP-8.3 2024-02-03 13:22:58 +00:00
David Carlier
b06d6dba4f Forgotten piece of GH-13309/GH-13310 previous PR 2024-02-03 13:22:45 +00:00
David Carlier
6842d3c03a Merge branch 'PHP-8.2' into PHP-8.3 2024-02-03 13:07:51 +00:00
David Carlier
d91224cd2f Fix GH-13309 and GH-13310: array hashes comparison, wrong buffer len calculation.
php_array_key_compare_string_case_unstable_i has a typo for the second
operand resulting in a wrong buffer size calculation.

Issue reported by @AlexRudyuk

Close GH-13315
2024-02-03 13:07:15 +00:00
Ilija Tovilo
d65c395049 Fix instable array during in-place modification in uksort
The array isn't just observable if the array has RCn, but also if it is inside a
reference that is RCn. By-ref parameters are always RCn and as such always
observable.

Fixes GH-13279
Closes GH-13285
2024-01-31 19:25:30 +01:00
Niels Dossche
47454cb771 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-13071: Copying large files using mmap-able source streams may exhaust available memory and fail
2024-01-16 23:46:43 +01:00
Niels Dossche
5e9e9c9d51 Fix GH-13071: Copying large files using mmap-able source streams may exhaust available memory and fail
Commit 5cbe5a538c disabled chunking for all writes to streams. However,
user streams have a callback where code is executed on data that is
subject to the memory limit. Therefore, when using large writes or
stream_copy_to_stream/copy the memory limit can easily be hit with large
enough data.

To solve this, we reintroduce chunking for userspace streams.
Users have control over the chunk size, which is neat because
they can improve the performance by setting the chunk size if
that turns out to be a bottleneck.

In an ideal world, we add an option so we can "ask" the stream whether
it "prefers" chunked writes, similar to how we have
php_stream_mmap_supported & friends. However, that cannot be done on
stable branches.

Closes GH-13136.
2024-01-16 23:44:58 +01:00
Ilija Tovilo
ed64949d12 strtok is not comptime()
Fixes GH-13145
Closes GH-13148
2024-01-14 19:12:41 +01:00
Tim Düsterhus
00ea756c93 random/standard: Adjust #13138 for PHP 8.3 2024-01-14 13:05:44 +01:00
Tim Düsterhus
f2f070a897 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  random/standard: Correctly handle broken engines in php_array_pick_keys (#13138)
2024-01-14 13:03:33 +01:00
Tim Düsterhus
97c6da1dec random/standard: Correctly handle broken engines in php_array_pick_keys (#13138) 2024-01-14 13:01:29 +01:00