php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-28 02:33:17 +02:00
Code Issues Packages Projects Releases Wiki Activity
134,386 Commits 549 Branches 1,485 Tags
php-8.3.9RC1
Commit Graph

5978 Commits

Author SHA1 Message Date
Derick Rethans 31798e4b6d Merge branch 'PHP-8.2' into PHP-8.3 2024-06-13 14:04:13 +01:00
Derick Rethans e0e9eb4053 Merge branch 'fix-anonymous-socket-at-length-boundary' into PHP-8.2 2024-06-13 14:03:46 +01:00
Ilija Tovilo 22ac07a886 Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Fix windows rename test directories clashing
 2024-06-13 14:03:26 +02:00
Ilija Tovilo 8d9f9755e8 Fix windows rename test directories clashing 
Closes GH-14554
 2024-06-13 14:02:57 +02:00
Derick Rethans ad56ec7bbf Fixed off-by-one error in checking length of abtract namespace Unix sockets 2024-06-13 12:46:22 +01:00
Ben Ramsey e4453dcbd2 Merge branch 'PHP-8.2' into PHP-8.3 2024-06-05 01:11:30 -05:00
Ben Ramsey 8aff5b49c3 Merge branch 'PHP-8.1' into PHP-8.2 2024-06-05 01:10:47 -05:00
Niels Dossche 4b15f5d4ec Fix GHSA-9fcc-425m-g385: bypass CVE-2024-1874 
The old code checked for suffixes but didn't take into account trailing
whitespace. Furthermore, there is peculiar behaviour with trailing dots
too. This all happens because of the special path-handling code inside
CreateProcessW.

By studying Wine's code, we can see that CreateProcessInternalW calls
get_file_name [1] in our case because we haven't provided an application
name. That code gets the first whitespace-delimited string into app_name
excluding the quotes. It's then passed to create_process_params [2]
where there is the path handling code that transforms the command line
argument to an image path [3]. Inside Wine, the extension check if
performed after these transformations [4]. By doing the same thing in
PHP we match the behaviour and can properly match the extension even in
the given edge cases.

[1] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L542-L543
[2] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L565
[3] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L150-L151
[4] https://github.com/wine-mirror/wine/blob/166895ae3ad3890ad946a309d0fd85e89ea3630e/dlls/kernelbase/process.c#L647-L654
 2024-06-05 00:26:14 -05:00
Gina Peter Banyard e206b68403 Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  ext/standard: Fix test conflict with I/O tests
 2024-06-02 17:03:44 +01:00
Gina Peter Banyard 75f6132818 ext/standard: Fix test conflict with I/O tests 
Closes GH-14428
 2024-06-02 17:03:19 +01:00
David Carlier 72e5ea0f49 Merge branch 'PHP-8.2' into PHP-8.3 2024-05-24 23:35:11 +01:00
David Carlier 19cb9c7b4a Fix GH-12104 attempt 
using stream_select to gives the chance to process the data.

close GH-14311
 2024-05-24 23:34:46 +01:00
Derick Rethans 9c9f49a1f4 Merge branch 'PHP-8.2' into PHP-8.3 2024-05-20 15:49:46 +01:00
Saki Takamachi 0a8fbef996 Added test 2024-05-20 15:13:53 +01:00
Niels Dossche cce922e49b Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Fix nightly test failure (#14251)
 2024-05-16 20:01:38 +02:00
Niels Dossche 02b7d70fa9 Fix nightly test failure (#14251) 
The created files have the same filename, creating conflicts. Fix this
by adding a unique suffix.
 2024-05-16 20:00:46 +02:00
Peter Kokot 49b5ab2057 Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Fix tests for glibc 2.39 (#14097)
 2024-05-01 20:43:42 +02:00
Peter Kokot b6b9eab68e Fix tests for glibc 2.39 (#14097) 
2.39 has fixed inconsistent (mon_)grouping formats in localedata:

* https://sourceware.org/git/?p=glibc.git;a=blob;f=NEWS;hb=refs/tags/glibc-2.39#l237
* https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/locales/en_AU;hb=refs/tags/glibc-2.39#l65

For en_AU locale now it returns array of 1 item instead of 2 for
grouping and mon_grouping.

Since this is upstream change depending on the system, this only syncs
tests for such case.
 2024-05-01 20:43:00 +02:00
Ilija Tovilo f06a755848 Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Fix clean section in test
 2024-04-15 14:15:09 +02:00
Ilija Tovilo a7a7e6d57c Fix clean section in test 2024-04-15 14:14:47 +02:00
Ilija Tovilo df4d59e43d Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Fix rename test file name collision
 2024-04-15 13:43:06 +02:00
Ilija Tovilo f2cd0d5752 Fix rename test file name collision 2024-04-15 13:42:40 +02:00
Jakub Zelenka 4dad74f250 Merge branch 'PHP-8.2' into PHP-8.3 2024-04-14 14:27:05 +01:00
Damian Wójcik 8421cfda61 Fix file_get_contents() on Windows fails with "errno=22 Invalid argument" 
Closes GH-13948
 2024-04-14 14:26:10 +01:00
Ben Ramsey 3d9941fd1e Merge branch 'PHP-8.2' into PHP-8.3 2024-04-09 23:49:53 -05:00
Ben Ramsey a9ffc447a4 Merge branch 'PHP-8.1' into PHP-8.2 2024-04-09 23:49:31 -05:00
Jakub Zelenka 0ba5229a3f Fix bug GHSA-q6x7-frmf-grcw: password_verify can erroneously return true 
Disallow null character in bcrypt password
 2024-04-09 23:38:32 -05:00
Niels Dossche 093c08af25 Fix GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix 
The check happened too early as later code paths may perform more
mangling rules. Move the check downwards right before adding the actual
variable.
 2024-04-09 23:37:06 -05:00
Jakub Zelenka e3c784f2bf Add proc_open escaping for cmd file execution 2024-04-09 23:29:28 -05:00
Jakub Zelenka caec2b6186 Merge branch 'PHP-8.2' into PHP-8.3 2024-03-29 16:09:09 +00:00
Jakub Zelenka c087398cc2 Fix GH-13264: Part 1 - Memory leak on filter failure 
Closes GH-13790
 2024-03-29 16:06:49 +00:00
Niels Dossche 5fc3518426 Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Fix nightly failure due to type in file_put_contents_5gb.phpt
 2024-03-10 11:28:05 +01:00
Niels Dossche 65593e10ef Fix nightly failure due to type in file_put_contents_5gb.phpt 2024-03-10 11:27:47 +01:00
Jakub Zelenka 4612bb77fb Merge branch 'PHP-8.2' into PHP-8.3 2024-03-09 19:59:06 +00:00
divinity76 2343791aff Fix GH-13203: file_put_contents fail on strings over 4GB on Windows 
Closes GH-13205
 2024-03-09 19:58:28 +00:00
Saki Takamachi 04eeaa0bc7 Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Added validation of `\n` in $additional_headers of mail()
 2024-03-04 21:30:27 +09:00
Saki Takamachi 04e8e55f47 Added validation of \n in $additional_headers of mail() 
When $additional_headers of mail() is an array, the same validation as
`\r\n` is now applied to `\n` alone too.
 2024-03-04 21:30:07 +09:00
Niels Dossche dfd37c7175 Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Fix GH-11808: Live filesystem modified by tests (security)
 2024-03-01 18:46:30 +01:00
Niels Dossche 7c8a3e426e Fix GH-11808: Live filesystem modified by tests (security) 
There's a test that tries to make /etc world-writable, and asserts that
it fails. Although this test is guarded by a root user check, there are
situations where you don't need to be root to be able to do this.
This may thus have unwanted effects on your live filesystem.

The simple solution is to remove that part of the test. It doesn't
really add value anyway: we're trying to test the chmod error path, but
that exact same error path can be reached with any failure condition
that the kernel gives. For example, trying to chmod a non-existent file
will trigger the same code path.

While at it, also prefix the test path for the non-existent file such
that we don't accidentally modify the filesystem.

The chroot now has a better root-user check, that will not modify the
filesystem.

Other root-modifying mkdir tests were removed because they added no
value either.

Closes GH-13566.
 2024-03-01 18:45:54 +01:00
Ilija Tovilo d65c395049 Fix instable array during in-place modification in uksort 
The array isn't just observable if the array has RCn, but also if it is inside a
reference that is RCn. By-ref parameters are always RCn and as such always
observable.

Fixes GH-13279
Closes GH-13285
 2024-01-31 19:25:30 +01:00
Niels Dossche 47454cb771 Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Fix GH-13071: Copying large files using mmap-able source streams may exhaust available memory and fail
 2024-01-16 23:46:43 +01:00
Niels Dossche 5e9e9c9d51 Fix GH-13071: Copying large files using mmap-able source streams may exhaust available memory and fail 
Commit 5cbe5a538c disabled chunking for all writes to streams. However,
user streams have a callback where code is executed on data that is
subject to the memory limit. Therefore, when using large writes or
stream_copy_to_stream/copy the memory limit can easily be hit with large
enough data.

To solve this, we reintroduce chunking for userspace streams.
Users have control over the chunk size, which is neat because
they can improve the performance by setting the chunk size if
that turns out to be a bottleneck.

In an ideal world, we add an option so we can "ask" the stream whether
it "prefers" chunked writes, similar to how we have
php_stream_mmap_supported & friends. However, that cannot be done on
stable branches.

Closes GH-13136.
 2024-01-16 23:44:58 +01:00
Niels Dossche 1d6f344bea Fix GH-13094: range(9.9, '0') causes segmentation fault 
`start_type + end_type < 2*IS_STRING` is not right, in this test case
the types are start_type==5 (IS_DOUBLE), end_type==7 (IS_ARRAY).
The IS_ARRAY type is a sentinel to disambiguate single-byte strings.
The path must be taken when one of the types is not a string nor a
single-byte string. Therefore, use < IS_STRING with an OR condition.

Closes GH-13105.
 2024-01-09 22:11:45 +01:00
Ilija Tovilo aa52c29f28 Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Fix clean for higher branches
 2023-12-13 15:22:09 +01:00
Ilija Tovilo 23ea89404b Fix clean for higher branches 2023-12-13 15:21:19 +01:00
Ilija Tovilo cb38d7b23f Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Disambiguate fileVar8 test folder
 2023-12-13 14:31:56 +01:00
Ilija Tovilo cda7718f51 Disambiguate fileVar8 test folder 
Closes GH-12951
 2023-12-13 14:31:40 +01:00
Niels Dossche 0e69329bb0 Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Add missing NULL checks for spl autoload table
  Add missing NULL pointer checks related to the previous call frame
 2023-12-01 09:09:58 +01:00
Niels Dossche bedf1083f3 Add missing NULL pointer checks related to the previous call frame 2023-12-01 09:08:47 +01:00
Ilija Tovilo 05ba461524 [skip ci] Fix more test tmp file conflicts 2023-11-22 20:39:29 -06:00