1
0
mirror of https://github.com/php/php-src.git synced 2026-03-30 20:22:36 +02:00
Commit Graph

1318 Commits

Author SHA1 Message Date
Ilija Tovilo
c82cea0c34 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix uaf in SplFixedArray::unset()
2024-10-17 18:25:56 +02:00
Ilija Tovilo
0932b76d02 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix uaf in SplFixedArray::unset()
2024-10-17 18:25:33 +02:00
Ilija Tovilo
7fe168d855 Fix uaf in SplFixedArray::unset()
Fixes GH-16478
Closes GH-16481
2024-10-17 18:23:55 +02:00
Ilija Tovilo
6d6b20f561 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix use-after-free in SplObjectStorage::setInfo()
2024-10-17 18:21:51 +02:00
Ilija Tovilo
40e43ffd41 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix use-after-free in SplObjectStorage::setInfo()
2024-10-17 18:21:31 +02:00
Ilija Tovilo
12c987fae2 Fix use-after-free in SplObjectStorage::setInfo()
Fixes GH-16479
Closes GH-16482
2024-10-17 18:20:42 +02:00
Ilija Tovilo
d15e227750 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix uaf in SplDoublyLinkedList::offsetSet()
2024-10-16 23:05:36 +02:00
Ilija Tovilo
e5d837ca79 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix uaf in SplDoublyLinkedList::offsetSet()
2024-10-16 23:05:15 +02:00
Ilija Tovilo
8820a10360 Fix uaf in SplDoublyLinkedList::offsetSet()
Write to the new offset before calling the destructor of the previous value.

Fixes GH-16464
Closes GH-16466
2024-10-16 23:04:03 +02:00
Niels Dossche
c31eac7284 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Add missing hierarchy checks to replaceChild
  Fix GH-16337: Use-after-free in SplHeap
2024-10-12 13:39:06 +02:00
Niels Dossche
6902e196c3 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16337: Use-after-free in SplHeap
2024-10-12 13:31:50 +02:00
Niels Dossche
a56ff4fec7 Fix GH-16337: Use-after-free in SplHeap
We introduce a new flag to indicate when a heap or priority queue is
write-locked. In principle we could've used SPL_HEAP_CORRUPTED too, but
that won't be descriptive to users (and it's a lie too).

Closes GH-16346.
2024-10-12 13:31:23 +02:00
Niels Dossche
4b8a12d1e6 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16054: Segmentation fault when resizing hash table iterator list while adding
2024-09-25 21:08:36 +02:00
Niels Dossche
fdd6ba62bb Fix GH-16054: Segmentation fault when resizing hash table iterator list while adding
zend_array_dup_ht_iterators() loops over the hash table iterators and
can call zend_hash_iterator_add(). zend_hash_iterator_add() can resize
the array causing a crash in zend_array_dup_ht_iterators().

We solve this by refetching the iter pointer after an add happened.

Closes GH-16060.
2024-09-25 21:05:05 +02:00
DanielEScherzer
34325c5e3a zend_assert_valid_class_name(): use double quotes around names (#15990) 2024-09-23 00:44:16 +01:00
Daniel Scherzer
79d708cfca GH-15976: clarify error messages for enum/trait/interface/alias names
Instead of always saying that a name is reserved or deprecated and
cannot/should not be used as a class name, take the usage into account and say
the name cannot be used as an enum name, trait name, etc. In the process, for
class names add a missing "a".
2024-09-22 19:14:57 +01:00
Niels Dossche
1b171bb6b4 Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix GH-15918: Assertion failure in ext/spl/spl_fixedarray.c
2024-09-20 17:34:54 +02:00
Niels Dossche
9774cedb01 Fix GH-15918: Assertion failure in ext/spl/spl_fixedarray.c
SplFixedArray should've never get supported in ArrayObject because it's
overloaded, and so that breaks assumptions. This regressed in c4ecd82f.

Closes GH-15947.
2024-09-20 17:34:23 +02:00
Gina Peter Banyard
f756b96e06 Make CSV deprecation less annoying to deal with (#15569) 2024-09-13 15:07:26 +01:00
Christoph M. Becker
6d5962074f Dynamically xfail test cases which fail on CI (GH-15710)
This is a stop-gap measure for GH-15709 to keep CI green.
2024-09-02 18:23:52 +02:00
Gina Peter Bnayard
5853cdb73d Use "must not" instead of "cannot" wording 2024-08-21 21:12:17 +01:00
Gina Peter Banyard
c818d944cf ext/(standard|spl): Deprecate passing a non-empty string as the $enclosure parameter (#15362) 2024-08-12 16:09:56 +01:00
Gina Peter Banyard
efe4e6d38e ext/spl: Add ArrayObject test with property hooks (#15005)
As expected, ArrayObject is cursed
2024-07-18 13:10:00 +01:00
Niels Dossche
e2189beaca Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix GH-14639: Member access within null pointer in ext/spl/spl_observer.c
2024-07-06 23:58:37 +02:00
Niels Dossche
8ea3f154be Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-14639: Member access within null pointer in ext/spl/spl_observer.c
2024-07-06 23:58:20 +02:00
Niels Dossche
0d4e0c013e Fix GH-14639: Member access within null pointer in ext/spl/spl_observer.c
`spl_object_storage_attach_handle` creates an entry already, but only
fills it in at the end with `spl_object_storage_create_element` which
allocates memory. In this case the allocation fails and we're left with
a NULL slot. Doing the allocation first isn't an option because we want
to check whether the slot is occupied before allocating memory.
The simplest solution is to set the entry to NULL and check for a NULL
pointer upon destruction.

Closes GH-14849.
2024-07-06 23:57:46 +02:00
Niels Dossche
e16bc4b28e Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix GH-14290: Member access within null pointer in extension spl
2024-05-21 23:24:28 +02:00
Niels Dossche
88af09193d Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-14290: Member access within null pointer in extension spl
2024-05-21 23:24:15 +02:00
Niels Dossche
b3a56bd558 Fix GH-14290: Member access within null pointer in extension spl
php_pcre_replace_impl() can fail and return NULL. We should take that
error condition into account. Because other failures return false, we
return false here as well.

At first, I also thought there was a potential memory leak in the error
check of replacement_str, but found that the error condition can never
trigger, so replace that with an assertion.

Closes GH-14292.
2024-05-21 23:20:32 +02:00
Niels Dossche
f97bd071d5 Implement SeekableIterator for SplObjectStorage (#13665) 2024-05-05 13:26:54 +02:00
Tim Düsterhus
08b2ab22f4 Include the source location in Closure names (#13550)
* Include the source location in Closure names

This change makes stack traces involving Closures, especially multiple
different Closures, much more useful, because it's more easily visible *which*
closure was called for a given stack frame.

The implementation is similar to that of anonymous classes which already
include the file name and line number within their generated classname.

* Update scripts/dev/bless_tests.php for closure naming

* Adjust existing tests for closure naming

* Adjust tests for closure naming that were not caught locally

* Drop the namespace from closure names

This is redundant with the included filename.

* Include filename and line number as separate keys in Closure debug info

* Fix test

* Fix test

* Include the surrounding class and function name in closure names

* Fix test

* Relax test expecations

* Fix tests after merge

* NEWS / UPGRADING
2024-04-12 18:21:13 +02:00
Gina Peter Banyard
a648365fc0 ext/spl: Throw TypeError when overloaded SplObjectStorage::getHash() method does not return a string 2024-03-17 23:08:58 +00:00
Gina Peter Banyard
610c7a07b1 Move SplObjectStorage test to a folder 2024-03-17 23:08:47 +00:00
Niels Dossche
47b6eabe37 Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix GH-13685: Unexpected null pointer in zend_string.h
2024-03-17 18:38:44 +01:00
Niels Dossche
dab5f8c15c Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-13685: Unexpected null pointer in zend_string.h
2024-03-17 18:38:36 +01:00
Niels Dossche
aa34e0acb4 Fix GH-13685: Unexpected null pointer in zend_string.h
Regressed in 6fbf81c.

There is a missing error check on spl_filesystem_file_read_line(), which
means that if the line could not be read (e.g. because we're at the end
of the file), it will not set intern->u.file.current_line, which will
cause a NULL pointer deref later on.

Fix it by adding a check, and reintroducing the silent flag partially to
be able to throw an exception like it did in the past.

Closes GH-13692.
2024-03-17 18:37:52 +01:00
Máté Kocsis
330cc5cdb2 Deprecate implicit nullable parameter types (#12959)
RFC: https://wiki.php.net/rfc/deprecate-implicitly-nullable-types

Co-authored-by: Gina Peter Banyard <girgias@php.net>
2024-03-13 21:40:26 +01:00
Niels Dossche
1d20fc5fc5 Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix GH-13531: Unable to resize SplfixedArray after being unserialized in PHP 8.2.15
2024-02-27 23:05:34 +01:00
Niels Dossche
0285395126 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-13531: Unable to resize SplfixedArray after being unserialized in PHP 8.2.15
2024-02-27 23:05:26 +01:00
Niels Dossche
8494058a1f Fix GH-13531: Unable to resize SplfixedArray after being unserialized in PHP 8.2.15
When unserializing, the cached_resize field was not reset to -1
correctly, causing the setSize() method to think we were inside of a
resize operation.

Closes GH-13543.
2024-02-27 23:04:23 +01:00
Niels Dossche
f283f50f1a Merge branch 'PHP-8.3'
* PHP-8.3:
  Add missing NULL checks for spl autoload table
  Add missing NULL pointer checks related to the previous call frame
2023-12-01 09:11:32 +01:00
Niels Dossche
0e69329bb0 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Add missing NULL checks for spl autoload table
  Add missing NULL pointer checks related to the previous call frame
2023-12-01 09:09:58 +01:00
Niels Dossche
9a69bb2d58 Add missing NULL checks for spl autoload table
Closes GH-12840.
2023-12-01 09:09:17 +01:00
Niels Dossche
a963b1fbd9 Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix GH-12721: SplFileInfo::getFilename() segfault in combination with GlobIterator and no directory separator
2023-11-19 11:53:21 +01:00
Niels Dossche
0a3b891ba1 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-12721: SplFileInfo::getFilename() segfault in combination with GlobIterator and no directory separator
2023-11-19 11:52:58 +01:00
Niels Dossche
4d41dffb4f Fix GH-12721: SplFileInfo::getFilename() segfault in combination with GlobIterator and no directory separator
This broke in 7cd8879 and 9bae9ab. NULL is a perfectly valid return
value that should be handled.

Closes GH-12722.
2023-11-19 11:52:27 +01:00
Ilija Tovilo
f39b5c4c25 Close PHP tags in tests
Closes GH-12422
2023-10-18 17:34:10 +02:00
Niels Dossche
009d48da1c Convert bounds exception in SplFixedArray to OutOfBoundsException instead of RuntimeException (#12383) 2023-10-08 18:57:57 +02:00
Niels Dossche
dc72ceda90 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-11972: RecursiveCallbackFilterIterator regression in 8.1.18
2023-08-30 22:27:06 +02:00
Niels Dossche
262a22740c Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-11972: RecursiveCallbackFilterIterator regression in 8.1.18
2023-08-30 22:26:36 +02:00