1
0
mirror of https://github.com/php/php-src.git synced 2026-03-29 19:52:20 +02:00
Commit Graph

68241 Commits

Author SHA1 Message Date
Máté Kocsis
a5f137821a Fix GH-16314 "Pdo\Mysql object is uninitialized" when opening a persistent connection (#16369) 2024-11-05 08:32:44 +01:00
Saki Takamachi
fd1dff988e Fixed a bug where size_t underflows (#16696)
fixes #16262
closes #16696
2024-11-05 08:41:09 +09:00
Saki Takamachi
2fe7719a44 Added early return case when result is 0 (#16697)
fixes #16265
closes #16697
2024-11-05 08:38:38 +09:00
Niels Dossche
cc39bc21e3 Fix GH-16590: UAF in session_encode()
The `PS_ENCODE_LOOP` does not protect the session hash table that it
iterates over. Change it by temporarily creating a copy.

Closes GH-16640.
2024-11-04 20:05:32 +01:00
Niels Dossche
faef0dfb49 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix various memory leaks on error conditions in openssl_x509_parse()
2024-11-04 20:04:51 +01:00
Niels Dossche
673e8d1011 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix various memory leaks on error conditions in openssl_x509_parse()
2024-11-04 20:04:18 +01:00
Niels Dossche
5ddb75660d Fix various memory leaks on error conditions in openssl_x509_parse()
Closes GH-16690.
2024-11-04 20:03:53 +01:00
Ilija Tovilo
66ad4ce699 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Add NEWS entry
  Also fix same issue in ArrayObject::exchangeArray()
  Fix use-after-free in ArrayObject::unset() with destructor
2024-11-04 17:49:08 +01:00
Ilija Tovilo
dca438e6a3 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Add NEWS entry
  Also fix same issue in ArrayObject::exchangeArray()
  Fix use-after-free in ArrayObject::unset() with destructor
2024-11-04 17:47:49 +01:00
Ilija Tovilo
f7222bd2de Also fix same issue in ArrayObject::exchangeArray() 2024-11-04 17:46:17 +01:00
Ilija Tovilo
8910ac800d Fix use-after-free in ArrayObject::unset() with destructor
Fixes GH-16646
Closes GH-16653
2024-11-04 17:45:56 +01:00
Ilija Tovilo
085c151481 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Postpone zend_array_sort() in ext-intl
  Use bool for zend_array_sort()
2024-11-04 16:02:31 +01:00
Ilija Tovilo
745684290e Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Postpone zend_array_sort() in ext-intl
  Use bool for zend_array_sort()
2024-11-04 16:02:16 +01:00
Ilija Tovilo
845cdbce67 Postpone zend_array_sort() in ext-intl
This function is not ZEND_API yet, so we cannot use it as it won't work for
dynamically linked extensions.
2024-11-04 16:01:00 +01:00
Ilija Tovilo
230defc198 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix array going away during sorting
2024-11-04 15:51:24 +01:00
Ilija Tovilo
f033cf75e4 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix array going away during sorting
2024-11-04 15:51:03 +01:00
Ilija Tovilo
2bdce61390 Fix array going away during sorting
Fixes GH-16648
Closes GH-16654
2024-11-04 15:50:35 +01:00
David Carlier
f5b0a9ad19 Merge branch 'PHP-8.3' into PHP-8.4 2024-11-03 13:40:25 +00:00
David Carlier
b28ded42eb Merge branch 'PHP-8.2' into PHP-8.3 2024-11-03 13:39:41 +00:00
David Carlier
90aac521fd Fix GH-16592 msg_send() crashes when the type does not serialize as expected.
It is assumed that the serialization always had initialised its buffer
zend_string, but in the case of a type not serialising, it is null.

close GH-16599
2024-11-03 13:39:24 +00:00
Niels Dossche
bfd9e0cca3 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16628: FPM logs are getting corrupted with this log statement
  Fix GH-16601: Memory leak in Reflection constructors
2024-11-02 19:38:54 +01:00
Niels Dossche
16cda10650 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16628: FPM logs are getting corrupted with this log statement
  Fix GH-16601: Memory leak in Reflection constructors
2024-11-02 19:37:28 +01:00
Niels Dossche
e643129bbb Fix GH-16628: FPM logs are getting corrupted with this log statement
zlog_buf_prefix() can return a larger length than what actually was
written due to its use of snprintf(). The code in
zlog_stream_prefix_ex() does not take this into account, other callers
do. What ends up happening then is that stream->length is set to the
length as if snprintf() was able to write all bytes, causing
stream->length to become larger than stream->buf.size, causing a
segfault.

In case the buffer was too small we try with a larger buffer up to a
limit of zlog_limit. This makes sure that the stream length will remain
bounded by the buffer size.

This also adds assertions to make the programmer intent clear and catch
this more easily in debug builds.

Closes GH-16680.
2024-11-02 19:36:20 +01:00
Niels Dossche
f0f666ba3f Fix GH-16601: Memory leak in Reflection constructors
Additionally fixes wrong behaviour in ReflectionParameter when you first
have a construction that uses an object and the subsequent doesn't.

Closes GH-16672.
2024-11-02 19:35:20 +01:00
Gina Peter Banyard
9e2367f29f Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  ext/gmp: Fix segfault when null is encountered on an overloaded operator
  ext/gmp: Add behavioural tests for operator overloading
2024-11-02 17:41:27 +00:00
Gina Peter Banyard
65d42342a1 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  ext/gmp: Fix segfault when null is encountered on an overloaded operator
  ext/gmp: Add behavioural tests for operator overloading
2024-11-02 17:40:41 +00:00
Gina Peter Banyard
5253647500 ext/gmp: Fix segfault when null is encountered on an overloaded operator
And various other issues like inconsistent type errors

Closes GH-16015
2024-11-02 17:36:32 +00:00
Gina Peter Banyard
fe02fd5095 ext/gmp: Add behavioural tests for operator overloading 2024-11-02 17:32:43 +00:00
Christoph M. Becker
68d3000902 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-14732: date_sun_info() fails for non-finite values
2024-11-01 23:50:40 +01:00
Christoph M. Becker
8df513336a Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-14732: date_sun_info() fails for non-finite values
2024-11-01 23:47:21 +01:00
Christoph M. Becker
f9453a889d Fix GH-14732: date_sun_info() fails for non-finite values
`timelib_astro_rise_set_altitude()` is not prepared to deal with non-
finite values (`nan`, `inf` and `-inf`) for `lon` and `lat`; instead
these trigger undefined behavior.  Thus we catch non-finite values
before even calling that timelib function; for `date_sun_info()` we
trigger `ValueError`s; for `date_sunrise()` and `date_sunset()` we
silently return `false`, since these functions will be sunsetted
anyway.

Closes GH-16497.
2024-11-01 23:46:19 +01:00
Christoph M. Becker
3245a65034 Adapt ext/intl tests for ICU 76.1
Regarding the test names, see PR #9800.

Closes GH-16660.
2024-11-01 22:21:23 +01:00
Niels Dossche
7a78ffcbb2 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16604: Memory leaks in SPL constructors
2024-11-01 20:43:43 +01:00
Niels Dossche
eaa2b61acb Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16604: Memory leaks in SPL constructors
2024-11-01 20:43:28 +01:00
Niels Dossche
886a5287ca Fix GH-16604: Memory leaks in SPL constructors
Closes GH-16673.
2024-11-01 20:42:28 +01:00
Christoph M. Becker
331bd9571a Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16450: PDO_ODBC can inject garbage into field values
2024-10-31 16:17:50 +01:00
Christoph M. Becker
03bd17bb48 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16450: PDO_ODBC can inject garbage into field values
2024-10-31 16:16:29 +01:00
Christoph M. Becker
c9eafc1954 Fix GH-16450: PDO_ODBC can inject garbage into field values
A previous bug fix[1] relied on ODBC drivers to properly count down the
`StrLen_or_IndPtr` argument for consecutive calls to `SQLGetData()`.
Apparently, not all drivers handle this correctly, so we cannot assert
they do.  Instead we fall back to the old behavior for drivers which
would violate the assertion.

A test against SQLServer (which we currently use in CI) would not make
sense, since the respective drivers do not exhibit that behavior.
Instead we target the regression test especially to a MS Access
database.

Since there is apparently no way to easily create an MS Access database
programmatically, we commit a minimal empty DB which is used for the
regression test, and could also be used by other test cases.

[1] <bccca0b53aa60a62e2988c750fc73c02d109e642>

Closes GH-16587.
2024-10-31 16:15:17 +01:00
Arnaud Le Blanc
54a40f3bde Add ReflectionProperty::isLazy()
Closes GH-16342
2024-10-31 14:14:20 +01:00
Niels Dossche
d5e6dd8f2b Add missing cache invalidation for innerHTML (#16652)
* Add test with wrong output

* Add missing cache invalidation for innerHTML
2024-10-30 22:14:20 +01:00
Niels Dossche
65fbf47472 Fix static analysis warning
The condition is already checked at the start of the function, mark this
code properly as unreachable.
2024-10-30 20:55:50 +01:00
David Carlier
6a0035b7f4 Merge branch 'PHP-8.3' into PHP-8.4 2024-10-28 21:25:39 +00:00
David Carlier
e039afffaf Merge branch 'PHP-8.2' into PHP-8.3 2024-10-28 21:22:17 +00:00
David Carlier
eeec0939e0 Fix GH-14687 segfault on debugging a freed SplObjectIterator instance.
close GH-14711
2024-10-28 21:21:44 +00:00
Niels Dossche
6e82ae9990 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16595: Another UAF in DOM -> cloneNode
  Fix GH-16593: Assertion failure in DOM->replaceChild
2024-10-28 19:45:22 +01:00
Niels Dossche
ed21ebd8aa Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16595: Another UAF in DOM -> cloneNode
  Fix GH-16593: Assertion failure in DOM->replaceChild
2024-10-28 19:39:24 +01:00
Niels Dossche
9d8983c061 Fix GH-16595: Another UAF in DOM -> cloneNode
We need to perform all sanity checks before doing any modification.
I don't have a reliable and easy test for this on 8.2, but I have one
for 8.4.

Closes GH-16598.
2024-10-28 19:37:08 +01:00
Niels Dossche
d89dd28d3b Fix GH-16593: Assertion failure in DOM->replaceChild
This is already forbidden by libxml, but this condition isn't properly
checked; so the return value and lack of error makes it seem like it
worked while it actually didn't. Furthermore, this can break assumptions
and assertions later on.

Closes GH-16596.
2024-10-28 19:36:29 +01:00
Niels Dossche
947e319b76 Fix GH-16594: Assertion failure in DOM -> before
The invalid parent condition can actually happen because PHP's DOM is
allows to get children of e.g. attributes; something normally not
possible.

Closes GH-16597.
2024-10-28 19:32:20 +01:00
Niels Dossche
38e1b0ac8c Fix GH-16572: Incorrect result with reflection in low-trigger JIT
When a recursive call happens with invalid arguments, the maximum valid
arguments are computed and stored in `num_args`, but the RECV entry
block we jump to is `call_num_args` instead. This can skip argument
validation checks. Fix this by using `num_args` instead.

Closes GH-16575.
2024-10-28 19:31:52 +01:00