1
0
mirror of https://github.com/php/php-src.git synced 2026-03-29 19:52:20 +02:00
Commit Graph

16355 Commits

Author SHA1 Message Date
Saki Takamachi
1fd82aa13a PHP-8.4 is now for PHP 8.4.1-dev 2024-11-20 17:19:18 +09:00
Saki Takamachi
315fef2c72 Prepare NEWS for 8.4.0 2024-11-20 01:57:56 +09:00
Saki Takamachi
fa36346a6c [skip ci] NEWS for #16694 2024-11-20 00:42:40 +09:00
Christoph M. Becker
e44b7625c5 Fix GH-16839: Error on building Opcache JIT for Windows ARM64
OPcache JIT does not support Windows ARM64, so we should not allow
`--enable-opcache-jit` in the first place.

Due to the way `ARG_ENABLE()` is handled on Windows, we do not attempt
to suppress the configure option, but just do not enable JIT when the
user attempts to, and adapt the help text.

Closes GH-16841.
2024-11-18 23:27:54 +01:00
Ilija Tovilo
048fa7bacc Fix get_object_vars() for non-hooked props in hooked prop iter
The zend_hash_update_ind() variant unwraps indirects, rather than creating them.
Don't use _zend_hash_append_ind() because the property might already exist.

Fixes GH-16725
Closes GH-16805
2024-11-18 16:20:19 +01:00
David Carlier
f7a508ca10 Merge branch 'PHP-8.3' into PHP-8.4 2024-11-17 12:27:36 +00:00
David Carlier
3fd0e4c461 Merge branch 'PHP-8.2' into PHP-8.3 2024-11-17 12:27:26 +00:00
David Carlier
80894d87d5 Fix GH-16834: cal_from_jd overflow on julian_day argument.
close GH-16836
2024-11-17 12:27:02 +00:00
Gina Peter Banyard
5e360b6402 ext/pdo_pgsql: Remove new PDO class constant specific to PGSQL driver
Closes GH-16755
2024-11-16 16:30:19 +00:00
Niels Dossche
18b18f0ee0 Fix GH-16777: Calling the constructor again on a DOM object after it is in a document causes UAF
Closes GH-16824.
2024-11-16 13:42:01 +01:00
Niels Dossche
2ba18590bf Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16808: Segmentation fault in RecursiveIteratorIterator->current() with a xml element input
2024-11-16 13:41:29 +01:00
Niels Dossche
fbb0061993 Fix GH-16808: Segmentation fault in RecursiveIteratorIterator->current() with a xml element input
When the current data is invalid, NULL must be returned. At least that's
how the check in SPL works and how other extensions do this as well.
If we don't do this, an UNDEF value gets propagated to a return value
(misprinted as null); leading to issues.

Closes GH-16825.
2024-11-16 13:39:46 +01:00
Niels Dossche
179ca2bf2a Fix GH-16802: open_basedir bypass using curl extension
And fix a memleak while here.

Closes GH-16804.
2024-11-15 21:17:36 +01:00
Niels Dossche
ed59c00661 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16799: Assertion failure at Zend/zend_vm_execute.h:7469
2024-11-15 20:03:19 +01:00
Niels Dossche
553d79c709 Fix GH-16799: Assertion failure at Zend/zend_vm_execute.h:7469
zend_is_callable_ex() can unfortunately emit a deprecation, and then
a user error handler can throw an exception. This causes an assert
failure at ZEND_VM_NEXT_OPCODE(). We fix this by checking if there's an
exception after zend_is_callable_ex().

Closes GH-16803.
2024-11-15 20:02:26 +01:00
David Carlier
b8ba6f63a3 Fix GH-16812: UAF on readline_info() after readline_write_history() call.
close GH-16813
2024-11-15 16:50:24 +00:00
Niels Dossche
0bf74bf9d8 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16770: Tracing JIT type mismatch when returning UNDEF
2024-11-14 22:34:05 +01:00
Niels Dossche
cbb3b9371d Fix GH-16770: Tracing JIT type mismatch when returning UNDEF
When returning an UNDEF value, it actually becomes NULL.
The following code took this into account:
28344e0445/ext/opcache/jit/zend_jit_trace.c (L2196-L2199)

But the stack does not update the type to NULL, causing a mismatch.

Closes GH-16784.

Co-authored-by: Dmitry Stogov <dmitry@zend.com>
2024-11-14 22:33:06 +01:00
David Carlier
ec05cd559b Merge branch 'PHP-8.3' into PHP-8.4 2024-11-13 12:49:13 +00:00
David Carlier
6f1d8368d8 Merge branch 'PHP-8.2' into PHP-8.3 2024-11-13 12:49:00 +00:00
David Carlier
4124b04e34 Fix GH-16771: imagecreatefromstring overflow on invalid format.
close GH-16776
2024-11-13 12:48:37 +00:00
David Carlier
b8115d6c5e Fix GH-16769: php_pcntl_set_user_signal_infos aborts when a signal is a reference.
close GH-16772
2024-11-13 12:11:43 +00:00
Arnaud Le Blanc
a8151fc511 Fix the name of the initializer parameter of ReflectionClass::resetAsLazyGhost()
Closes GH-16758
2024-11-12 18:51:33 +01:00
Niels Dossche
fbf4cec63b Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16727: Opcache bad signal 139 crash in ZTS bookworm (frankenphp)
2024-11-11 16:20:30 +01:00
Niels Dossche
02ee521e20 Fix GH-16727: Opcache bad signal 139 crash in ZTS bookworm (frankenphp)
Reproducer: https://github.com/php/php-src/issues/16727#issuecomment-2466256317

The root cause is a data race between two different threads:

1) We allocate a lower cased name for an anonymous class here:
   f97353f228/Zend/zend_compile.c (L8109)
2) This gets looked up as an interned string here:
   f97353f228/Zend/zend_compile.c (L8112)
   Assuming that there are uppercase symbols in the string and therefore
   `lcname != name` and that `lcname` is not yet in the interned string table,
   the pointer value of `lcname` won't change.
3) Here we add the string into the interned string table:
   f97353f228/Zend/zend_compile.c (L8223)
   However, in the meantime another thread could've added the string into the interned string table.
   This means that the following code will run, indirectly called via the `LITERAL_STR` macro,
   freeing `lcname`: 62e53e6f49/ext/opcache/ZendAccelerator.c (L572-L575)
4) In the reproducer we then access the freed `lcname` string here:
   f97353f228/Zend/zend_compile.c (L8229)

This is solved in my patch by retrieving the interned string pointer
and putting it in `lcname`.

Closes GH-16748.
2024-11-11 16:20:05 +01:00
Gina Peter Banyard
e7891838a1 ext/standard: Sync parameter names for fpow() to be identical to pow()
Closes GH-16751
2024-11-11 13:04:46 +00:00
Gina Peter Banyard
c1d67c2415 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  ext/hash: Fix GH-16711: Segfault in mhash()
  ext/hash: Add failing tests for GH-16711
2024-11-10 20:17:09 +00:00
Gina Peter Banyard
f01bafc340 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  ext/hash: Fix GH-16711: Segfault in mhash()
  ext/hash: Add failing tests for GH-16711
2024-11-10 20:16:33 +00:00
Gina Peter Banyard
1b379f5e55 ext/hash: Fix GH-16711: Segfault in mhash()
Closes GH-16713
2024-11-10 20:15:44 +00:00
Niels Dossche
f97353f228 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [ci skip] Add credit for test
2024-11-09 17:09:51 +01:00
Niels Dossche
d87f3ff662 [ci skip] Add credit for test 2024-11-09 17:09:35 +01:00
Niels Dossche
58f4b45bca Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16695: phar:// tar parser and zero-length file header blocks
2024-11-09 17:08:19 +01:00
Niels Dossche
72c0222926 Fix GH-16695: phar:// tar parser and zero-length file header blocks
There are two issues:
1) There's an off-by-one in the check for the minimum file size for a
   tar (i.e. `>` instead of `>=`).
2) The loop in the tar parsing parses a header, and then unconditionally
   reads the next one. However, that doesn't necessarily exist.
   Instead, we remove the loop condition and check for the end of the
   file before reading the next header. Note that we can't use
   php_stream_eof as the flag may not be set yet when we're already at
   the end.

Closes GH-16700.
2024-11-09 17:07:53 +01:00
Christoph M. Becker
257387b9e5 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fail early in *nix configuration build script
2024-11-09 14:06:35 +01:00
Christoph M. Becker
11da498add Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fail early in *nix configuration build script
2024-11-09 14:05:38 +01:00
Hans Krentel (hakre)
c075546320 Fail early in *nix configuration build script
Adding two exit early safeguards in the *nix configuration build script:

1) Given the initial cd into the build tree fails (the project root),
   the `buildconf` script exits with non-zero status (failure).
2) Given the grep command does not exist or `configure.ac` AC_INIT [1]
   expectations are unmet, the buildconf script exits non-zero.

Additionally quoting the pathname to cd into and the empty CD_PATH
parameter for portability, also for systems that are using a
non-portable pathname [2] for the build tree.

The initial CD safeguard has been applied to the `buildconf` and
four more scripts:

- build/genif.sh
- scripts/dev/credits
- scripts/dev/genfiles
- scripts/dev/makedist

Rationale:

Cd-ing into the project root should always prematurely exit w/ FAILURE
as a required precondition for its invocation has not been met. This
should never go unnoticed as it always requires user intervention.

Similar and more specifically to the PHP build on *nix systems, the
grep command is required early to obtain the `php_extra_version` from
configure.ac.  Previously, if the grep command is missing (or failing
due to not matching the line with the AC_INIT macro [1]), the internal
dev parameter would always be zero (0) which can easily result in the
situation that the configure script is not being rebuilt. This is
cumbersome as the rebuild of a configure script is more likely required
with checked-out dev versions under change rather than an already
properly set-up build environment on a dedicated build or release
system. Missing the fact that either the grep utility is missing or
the expectation of having the AC_INIT macro in configure.ac is unmet
should never go unnoticed as it always requires user intervention.

[1]: https://www.gnu.org/software/autoconf/manual/autoconf-2.67/html_node/Initializing-configure.html
[2]: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_271

Closes GH-16717.
2024-11-09 14:03:04 +01:00
Christoph M. Becker
3a1a205f2a Fix GH-16723: CURLMOPT_PUSHFUNCTION issues
We copy the source handler's FCCs to those of the destination.

We also fix the erroneous test assumption that the trampoline wouldn't
be called.

Closes GH-16732.
2024-11-09 12:43:29 +01:00
Niels Dossche
591fe92724 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix memory leak in php_openssl_pkey_from_zval()
  Fix various memory leaks related to openssl exports
  Prevent unexpected array entry conversion when reading key
2024-11-09 11:01:21 +01:00
Niels Dossche
994e866cf2 Fix memory leak in php_openssl_pkey_from_zval()
Closes GH-16691.
2024-11-09 10:58:44 +01:00
Niels Dossche
2f4f09f7e6 Fix various memory leaks related to openssl exports
Closes GH-16692.
2024-11-09 10:58:17 +01:00
Niels Dossche
ac8d0e57d9 Prevent unexpected array entry conversion when reading key
When passing an array, the key entry can get converted to a string if it
is an object, but this actually modifies the original array entry.
The test originally outputted:

```
array(2) {
  [0]=>
  string(...) => ...
  [1]=>
  string(0) ""
}
```

This is unexpected. Use zval_try_get_string() to prevent this behaviour.

Closes GH-16693.
2024-11-09 10:57:50 +01:00
Maximilian Bosch
73c4fa0ea4 ext/soap: fix make check being invoked in ext/soap
On NixOS we run `make` & `make check` inside `ext/soap` which broke the test
like this:

    001+ Fatal error: Uncaught SoapFault exception: [WSDL] SOAP-ERROR: Parsing WSDL: Couldn't load from 'ext/soap/tests/gh15711.wsdl' : failed to load "ext/soap/tests/gh15711.wsdl": No such file or directory
    002+  in /build/php-8.3.13/ext/soap/tests/gh15711.php:29
    003+ Stack trace:
    004+ #0 /build/php-8.3.13/ext/soap/tests/gh15711.php(29): SoapClient->__construct('ext/soap/tests/...', Array)
    005+ #1 {main}
    006+   thrown in /build/php-8.3.13/ext/soap/tests/gh15711.php on line 29

Fix is to make the path dependant on `__DIR__` as it's the case in other
testcases including WSDLs.

Closes GH-16733.
2024-11-08 20:47:28 +01:00
Jakub Zelenka
27b4df4247 Fix 8.4 NEWS file 2024-11-08 17:01:02 +01:00
Jakub Zelenka
af8ebb12ca Merge branch 'PHP-8.2' into PHP-8.3 2024-11-08 16:48:25 +01:00
Jakub Zelenka
065bde1e13 Fix GH-16432: PHP-FPM 8.2 SIGSEGV in fpm_get_status 2024-11-08 16:44:05 +01:00
David Carlier
7477c1b4ab Merge branch 'PHP-8.3' into PHP-8.4 2024-11-07 22:52:57 +00:00
David Carlier
3f28644fff Merge branch 'PHP-8.2' into PHP-8.3 2024-11-07 22:52:19 +00:00
David Carlier
e74e66e3f7 Fix oss-fuzz report triggered by GH-15712 commit.
It triggered allocation overflow which, even fixed, in turn gives memory
leak on 32 bits but the allocator relies on signed integers.

close GH-15915
2024-11-07 22:51:05 +00:00
David Carlier
a0c7550886 Merge branch 'PHP-8.3' into PHP-8.4 2024-11-06 12:53:07 +00:00
David Carlier
d59b07f9bd Merge branch 'PHP-8.2' into PHP-8.3 2024-11-06 12:52:56 +00:00