1
0
mirror of https://github.com/php/php-src.git synced 2026-04-25 08:58:28 +02:00
Commit Graph

14920 Commits

Author SHA1 Message Date
Niels Dossche 89f2805905 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix OSS-Fuzz #385993744
2025-09-08 19:10:41 +02:00
Niels Dossche ff84cb08ef Fix OSS-Fuzz #385993744
PSFS_FEED_ME is supposed to be returned when the filter did not receive
enough data and did not generate buckets for the output brigade.
The test generates buckets anyway on the output brigade, and the stream
layer did not handle that case causing a memory leak.
To solve this, discard any such buckets as it would conflict with the
status code returned by the filter. This keeps BC and solves the leak.

Closes GH-18972.
2025-09-08 19:10:22 +02:00
Ilija Tovilo 7e01cf59bb Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16649: Avoid UAF when using array_splice
2025-08-13 14:16:12 +02:00
Alexandre Daubois c8774f9e61 Fix GH-16649: Avoid UAF when using array_splice
Closes GH-19399
2025-08-13 14:15:34 +02:00
Niels Dossche b82c8ba7fe Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-19300: Nested array_multisort invocation with error breaks
2025-07-31 19:01:13 +02:00
Niels Dossche a96b05e63f Fix GH-19300: Nested array_multisort invocation with error breaks
There are 2 issues:
1. When a MULTISORT_ABORT happens, it frees func, but func may point to
   ARRAYG(multisort_func), which would be a problem with nested
   invocations as it can destroy that of the "parent" invocation.
   To solve this, delay assigning to the globals.
2. The old globals were not restored which means that nested invocations
   with different flags will cause a wrong sorting function to be used.

Closes GH-19319.
2025-07-31 19:00:45 +02:00
Niels Dossche 802e348b49 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  NEWS for hrtime in FTP and standard
  Handle broken hrtime in ftp
  Fix arginfo/zpp violation if zend_hrtime is not available
2025-07-25 12:05:12 +02:00
Niels Dossche ad2143f3b0 Fix arginfo/zpp violation if zend_hrtime is not available
Part of GH-19210.

Closes GH-19218.
2025-07-25 11:56:17 +02:00
Ilija Tovilo f0baf3dc11 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Leak in failed unserialize() with opcache
2025-07-22 15:44:16 +02:00
Ilija Tovilo 5d1636e40b Leak in failed unserialize() with opcache
With opcache, zend_string_init_interned() will allocate non-interned strings at
runtime because shm is locked. Hence, we need to make sure to actually free this
string.

Fixes OSS-Fuzz #433303828
Closes GH-19211
2025-07-22 15:43:31 +02:00
Niels Dossche e572e899bd Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix test conflict between chmod_variation2 and file_variation5
2025-07-21 23:57:49 +02:00
Niels Dossche 7ab37e81e0 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix test conflict between chmod_variation2 and file_variation5
2025-07-21 23:57:42 +02:00
Niels Dossche 27f24bd9bc Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix test conflict between chmod_variation2 and file_variation5
2025-07-21 23:57:34 +02:00
Niels Dossche 605ee05491 Fix test conflict between chmod_variation2 and file_variation5
Both used "somelink".
See https://github.com/php/php-src/actions/runs/16427526464/job/46421461376

Closes GH-19208.
2025-07-21 23:57:21 +02:00
Jakub Zelenka 27e67cc371 Fix GHSA-3cr5-j632-f35r: Null byte in hostnames
This fixes stream_socket_client() and fsockopen().

Specifically it adds a check to parse_ip_address_ex and it also makes
sure that the \0 is not ignored in fsockopen() hostname formatting.
2025-07-01 19:46:42 +03:00
Jakub Zelenka cf0c39723e Fix GHSA-3cr5-j632-f35r: Null byte in hostnames
This fixes stream_socket_client() and fsockopen().

Specifically it adds a check to parse_ip_address_ex and it also makes
sure that the \0 is not ignored in fsockopen() hostname formatting.
2025-07-01 09:34:23 -07:00
Jakub Zelenka 5ef0dc7666 Fix GHSA-3cr5-j632-f35r: Null byte in hostnames
This fixes stream_socket_client() and fsockopen().

Specifically it adds a check to parse_ip_address_ex and it also makes
sure that the \0 is not ignored in fsockopen() hostname formatting.
2025-07-01 23:01:16 +09:00
David Carlier ef08bce645 Merge branch 'PHP-8.3' into PHP-8.4 2025-06-29 16:58:05 +01:00
David Carlier 865739e5b1 Fix GH-18976: pack with h or H format string overflow.
adding with its own remainder, INT_MAX overflows here (negative values are
discarded).

close GH-18977
2025-06-29 16:57:10 +01:00
Niels Dossche f77c04d007 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix RCN violations in array functions
2025-06-24 23:29:50 +02:00
Niels Dossche 359a21f102 Fix RCN violations in array functions
When the array functions perform their operation in-place, the
`@refcount 1` annotation is wrong and causes a failure under
`ZEND_VERIFY_FUNC_INFO`.
The test file tests all functions that have the in-place optimization,
even those that didn't have the refcount annotation, just to prevent
future regressions.

Closes GH-18929.
2025-06-24 23:29:00 +02:00
Jakub Zelenka cac8f7f1cf Fix GHSA-3cr5-j632-f35r: Null byte in hostnames
This fixes stream_socket_client() and fsockopen().

Specifically it adds a check to parse_ip_address_ex and it also makes
sure that the \0 is not ignored in fsockopen() hostname formatting.
2025-06-23 23:00:30 +02:00
Niels Dossche eb78a0b53f Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix misleading errors in printf()
  Unbreak PRINTF_DEBUG macro usages
2025-06-23 19:59:16 +02:00
Niels Dossche 799ec7b8c5 Fix misleading errors in printf()
The precision and width _can_ be zero.

Closes GH-18911.
2025-06-23 19:58:49 +02:00
Niels Dossche b50898894d Unbreak PRINTF_DEBUG macro usages
Clearly nobody has used this in a while given the compile errors and
warnings.
This patch fixes them so there are no errors nor warnings anymore.

Closes GH-18910.
2025-06-23 19:58:19 +02:00
Jakub Zelenka bbac59148c Merge branch 'PHP-8.3' into PHP-8.4 2025-06-21 20:16:13 +02:00
Jakub Zelenka a36b8fdc94 Fix GH-13264: fgets() and stream_get_line() do not return false on filter fatal error
This happens because there are no checks in php_stream_fill_read_buffer
calls. This should not fail always but only on fatal error so special
flag is needed for that.

Closes GH-18778
2025-06-21 20:13:09 +02:00
Ilija Tovilo a68f1e7adb Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Remove bug61371 test
2025-06-20 22:44:10 +02:00
Ilija Tovilo 64bc12c154 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Remove bug61371 test
2025-06-20 22:43:25 +02:00
Ilija Tovilo 2ecdde0045 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Remove bug61371 test
2025-06-20 22:43:18 +02:00
Ilija Tovilo 391bd2a48f Remove bug61371 test
These tests attempt to test that no memory is leaked for stream calls. However,
it is incorrect to assume the memory will not increase for other reasons, e.g.
when growing resource buffers, for the output buffer, etc. This was discovered
through 9cacc57350 with USE_TRACKED_ALLOC=1, but
this can also fail with USE_ZEND_ALLOC=1 when increasing loop iterations.
2025-06-20 22:42:03 +02:00
Niels Dossche d6258d60d6 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix test conflict between copy_variation2-win32-mb.phpt and copy_variation2-win32.phpt
2025-06-09 14:16:32 +02:00
Niels Dossche 186a8116be Fix test conflict between copy_variation2-win32-mb.phpt and copy_variation2-win32.phpt
Closes GH-18809.
2025-06-09 14:16:18 +02:00
Jakub Zelenka 086a470208 Merge branch 'PHP-8.3' into PHP-8.4 2025-06-05 14:10:57 +02:00
Jakub Zelenka 42f6c15186 Fix bug #74796: Requests through http proxy set peer name
This issue happens because http wrapper sets peer_name but then does not
remove so it stays in the context. The fix removes the peer name from
the context after enabling crypto.

In addition to bug #74796, this also fixes bug #76196.

In addition it should be a final fix for those SOAP bugs:

bug #69783
bug #52913
bug #61463
2025-06-05 14:08:28 +02:00
Gina Peter Banyard f47a7e8056 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  tests: Fix expectations
2025-05-31 14:46:13 +01:00
Gina Peter Banyard 7f2299c8eb tests: Fix expectations
Closes GH-18712
2025-05-31 14:45:41 +01:00
Niels Dossche d5515577d5 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Backport fix for GH-17687
2025-05-27 20:42:12 +02:00
Niels Dossche fab0a6d75c Backport fix for GH-17687
Introducing a new attribute macro in lower branches is an ABI break and
not allowed. However, we still need to fix the warnings such that
-Werror builds don't break. So we copy the macro from the master branch
to the C files in the appropriate places.
2025-05-27 20:40:35 +02:00
Tim Düsterhus 40edd58d36 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  standard: Take `zend.assertions` into account for dynamic calls to `assert()` (#18521)
2025-05-12 08:45:26 +02:00
Tim Düsterhus 8d2682fc50 standard: Take zend.assertions into account for dynamic calls to assert() (#18521)
Fixes php/php-src#18509.
2025-05-12 08:44:46 +02:00
David Carlier 2e2077172d Merge branch 'PHP-8.3' into PHP-8.4 2025-05-04 14:15:05 +01:00
David Carlier 8a585856d1 Fix GH-18480: array_splice overflow on array length with offset.
close GH-18483
2025-05-04 14:14:22 +01:00
Niels Dossche 7a2bef02c0 Fix GH-18400: http_build_query type error is inaccurate
Objects are also accepted still, so the error message is misleading.

Closes GH-18434.
2025-04-26 14:17:24 +02:00
Niels Dossche c6ed104e91 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-17403: Potential deadlock when putenv fails
2025-04-24 20:22:30 +02:00
Niels Dossche 32e091260a Fix GH-17403: Potential deadlock when putenv fails
Closes GH-18368.
2025-04-24 20:22:04 +02:00
haszi 701f3a1af6 Mark ob_start callback parameter nullable 2025-04-14 22:35:06 +02:00
Niels Dossche f4c594bfc6 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix resource leak in iptcembed() on error
2025-04-02 21:06:28 +02:00
Niels Dossche 8a1f6711bf Fix resource leak in iptcembed() on error
Closes GH-18225.
2025-04-02 21:05:48 +02:00
David Carlier dc93f28381 Merge branch 'PHP-8.3' into PHP-8.4 2025-04-02 12:36:08 +01:00