1
0
mirror of https://github.com/php/php-src.git synced 2026-03-26 01:02:25 +01:00
Commit Graph

2898 Commits

Author SHA1 Message Date
Niels Dossche
a02648087a Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-17225: NULL deref in spl_directory.c
2024-12-21 12:47:48 +01:00
Niels Dossche
4bfe69bbc4 Fix GH-17225: NULL deref in spl_directory.c
NULL checks for the glob stream are inconsistently applied. To solve
this generally, factor it out to a helper function so it's less likely
to be forgotten in the future.

Closes GH-17231.
2024-12-21 12:46:05 +01:00
Niels Dossche
5f13c62c77 Fix GH-17198: SplFixedArray assertion failure with get_object_vars
Because the properties table contains both a numeric index and a string
index that map to 0 in a symbol table, this causes an assertion failure.
Looking at the manual page of get_object_vars(), it seems that only real
properties must be included. Given that SplFixedArray's elements are not
accessible like properties, they should be excluded. This restores PHP
8.3 behaviour. The reason that this didn't cause problems on 8.3 is
because it used a different handler (get_properties).

Closes GH-17206.
2024-12-17 23:22:33 +01:00
Dmitry Stogov
ccc6c0f78c Fix GH-15709: Crashing tests on Windows x64 (#17095)
This is a quick fix for the problem.
It'll work while all the JIT-ed functions have the same "fixed stack frame".
Unwinder uses hard-coded unwind data for this "fixed stack frame".

* Preallocate space for Win64 shadow args

* typo

* Setup unwinder for JIT functions

* Revert "Dynamically xfail test case which fails on CI"

This reverts commit 7cc327fd5a.

* Revert "Dynamically xfail test case which fails on CI"

This reverts commit bdde797159.

* Revert "Dynamically xfail test cases which fail on CI (GH-15710)"

This reverts commit 6d5962074f.

* Remove XFAIL sections

* Add hard-coded SEH unwind data for EXITCALL

* Fix unwind data

* Fix Windows multi-process support

* Typo
2024-12-13 02:05:45 +03:00
Ilija Tovilo
66ad4ce699 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Add NEWS entry
  Also fix same issue in ArrayObject::exchangeArray()
  Fix use-after-free in ArrayObject::unset() with destructor
2024-11-04 17:49:08 +01:00
Ilija Tovilo
dca438e6a3 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Add NEWS entry
  Also fix same issue in ArrayObject::exchangeArray()
  Fix use-after-free in ArrayObject::unset() with destructor
2024-11-04 17:47:49 +01:00
Ilija Tovilo
f7222bd2de Also fix same issue in ArrayObject::exchangeArray() 2024-11-04 17:46:17 +01:00
Ilija Tovilo
8910ac800d Fix use-after-free in ArrayObject::unset() with destructor
Fixes GH-16646
Closes GH-16653
2024-11-04 17:45:56 +01:00
Niels Dossche
7a78ffcbb2 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16604: Memory leaks in SPL constructors
2024-11-01 20:43:43 +01:00
Niels Dossche
eaa2b61acb Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16604: Memory leaks in SPL constructors
2024-11-01 20:43:28 +01:00
Niels Dossche
886a5287ca Fix GH-16604: Memory leaks in SPL constructors
Closes GH-16673.
2024-11-01 20:42:28 +01:00
David Carlier
6a0035b7f4 Merge branch 'PHP-8.3' into PHP-8.4 2024-10-28 21:25:39 +00:00
David Carlier
e039afffaf Merge branch 'PHP-8.2' into PHP-8.3 2024-10-28 21:22:17 +00:00
David Carlier
eeec0939e0 Fix GH-14687 segfault on debugging a freed SplObjectIterator instance.
close GH-14711
2024-10-28 21:21:44 +00:00
Niels Dossche
396b995d76 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16589: UAF in SplDoublyLinked->serialize()
2024-10-27 19:12:16 +01:00
Niels Dossche
d9947e8c42 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16589: UAF in SplDoublyLinked->serialize()
2024-10-27 19:12:02 +01:00
Niels Dossche
8f60309a78 Fix GH-16589: UAF in SplDoublyLinked->serialize()
Closes GH-16611.
2024-10-27 19:11:37 +01:00
Gina Peter Banyard
5d993e9641 Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed SplFileObject::__constructor)
Closes GH-16480
Closes GH-16604
2024-10-25 22:05:10 +01:00
Gina Peter Banyard
a19029fc8b Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed SplFileObject::__constructor)
Closes GH-16480
Closes GH-16604
2024-10-25 22:04:10 +01:00
Gina Peter Banyard
d353a89c49 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed SplFileObject::__constructor)
2024-10-25 22:03:29 +01:00
Gina Peter Banyard
9f5b5e34c3 Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed SplFileObject::__constructor)
Closes GH-16480
Closes GH-16604
2024-10-25 22:02:38 +01:00
Niels Dossche
3599fd0c51 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16588: UAF in Observer->serialize
2024-10-25 23:00:46 +02:00
Niels Dossche
cc88b1f824 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16588: UAF in Observer->serialize
2024-10-25 23:00:24 +02:00
Niels Dossche
144d2ee29a Fix GH-16588: UAF in Observer->serialize
Closes GH-16600.
2024-10-25 22:59:59 +02:00
Niels Dossche
e9283c0819 Fix GH-16574: Incorrect error "undefined method" messages
The `get_method` object handler may change the object pointer. SPL does
this in its iterator implementations. This causes the error message
to change to another class which is confusing to the user. JIT handles
this correctly. This patch aligns behaviour with JIT.

Closes GH-16576.
2024-10-25 18:33:24 +02:00
Ilija Tovilo
1c542af144 Revert undoing of partial spl_filesystem_object initialization
We're intentionally not initializing spl_filesystem_object.u.dir.entry, as it
will later be initialized, and we don't need to zero the entire buffer anyway.
2024-10-17 18:44:06 +02:00
Ilija Tovilo
c82cea0c34 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix uaf in SplFixedArray::unset()
2024-10-17 18:25:56 +02:00
Ilija Tovilo
0932b76d02 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix uaf in SplFixedArray::unset()
2024-10-17 18:25:33 +02:00
Ilija Tovilo
7fe168d855 Fix uaf in SplFixedArray::unset()
Fixes GH-16478
Closes GH-16481
2024-10-17 18:23:55 +02:00
Ilija Tovilo
6d6b20f561 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix use-after-free in SplObjectStorage::setInfo()
2024-10-17 18:21:51 +02:00
Ilija Tovilo
40e43ffd41 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix use-after-free in SplObjectStorage::setInfo()
2024-10-17 18:21:31 +02:00
Ilija Tovilo
12c987fae2 Fix use-after-free in SplObjectStorage::setInfo()
Fixes GH-16479
Closes GH-16482
2024-10-17 18:20:42 +02:00
Ilija Tovilo
d15e227750 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix uaf in SplDoublyLinkedList::offsetSet()
2024-10-16 23:05:36 +02:00
Ilija Tovilo
e5d837ca79 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix uaf in SplDoublyLinkedList::offsetSet()
2024-10-16 23:05:15 +02:00
Ilija Tovilo
8820a10360 Fix uaf in SplDoublyLinkedList::offsetSet()
Write to the new offset before calling the destructor of the previous value.

Fixes GH-16464
Closes GH-16466
2024-10-16 23:04:03 +02:00
Niels Dossche
c31eac7284 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Add missing hierarchy checks to replaceChild
  Fix GH-16337: Use-after-free in SplHeap
2024-10-12 13:39:06 +02:00
Niels Dossche
6902e196c3 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16337: Use-after-free in SplHeap
2024-10-12 13:31:50 +02:00
Niels Dossche
a56ff4fec7 Fix GH-16337: Use-after-free in SplHeap
We introduce a new flag to indicate when a heap or priority queue is
write-locked. In principle we could've used SPL_HEAP_CORRUPTED too, but
that won't be descriptive to users (and it's a lie too).

Closes GH-16346.
2024-10-12 13:31:23 +02:00
Niels Dossche
4b8a12d1e6 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16054: Segmentation fault when resizing hash table iterator list while adding
2024-09-25 21:08:36 +02:00
Niels Dossche
fdd6ba62bb Fix GH-16054: Segmentation fault when resizing hash table iterator list while adding
zend_array_dup_ht_iterators() loops over the hash table iterators and
can call zend_hash_iterator_add(). zend_hash_iterator_add() can resize
the array causing a crash in zend_array_dup_ht_iterators().

We solve this by refetching the iter pointer after an add happened.

Closes GH-16060.
2024-09-25 21:05:05 +02:00
DanielEScherzer
34325c5e3a zend_assert_valid_class_name(): use double quotes around names (#15990) 2024-09-23 00:44:16 +01:00
Daniel Scherzer
79d708cfca GH-15976: clarify error messages for enum/trait/interface/alias names
Instead of always saying that a name is reserved or deprecated and
cannot/should not be used as a class name, take the usage into account and say
the name cannot be used as an enum name, trait name, etc. In the process, for
class names add a missing "a".
2024-09-22 19:14:57 +01:00
Niels Dossche
1b171bb6b4 Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix GH-15918: Assertion failure in ext/spl/spl_fixedarray.c
2024-09-20 17:34:54 +02:00
Niels Dossche
9774cedb01 Fix GH-15918: Assertion failure in ext/spl/spl_fixedarray.c
SplFixedArray should've never get supported in ArrayObject because it's
overloaded, and so that breaks assumptions. This regressed in c4ecd82f.

Closes GH-15947.
2024-09-20 17:34:23 +02:00
Gina Peter Banyard
f756b96e06 Make CSV deprecation less annoying to deal with (#15569) 2024-09-13 15:07:26 +01:00
DanielEScherzer
db545767e5 Rename ZEND_STR_DEPRECATED to ZEND_STR_DEPRECATED_CAPITALIZED (#15831)
To match other capitalized strings like `ZEND_STR_UNKNOWN_CAPITALIZED` and
`ZEND_STR_ARRAY_CAPITALIZED`. Since this known string was only added in PHP
8.4, no backwards compatibility alias is needed.
2024-09-10 22:45:23 +01:00
DanielEScherzer
5dd0575698 Generated arginfo header files: combine preprocessor conditional blocks (#15736)
When functions' or class methods' availability is based on some preprocessor
condition, the generated arginfo header files wrap the declarations in the
preprocessor `#if` conditional blocks, one per declaration, even if they are in
the same conditional block based on comments in the stub file. Instead of
having multiple conditional blocks one after the other with the same condition,
combine them into a single conditional block.
2024-09-04 13:04:22 +02:00
DanielEScherzer
53cb89670c Generated arginfo header files: remove empty zend_function_entry arrays (#15705)
When a class (or enum) has no methods, rather than using an array that only
contains `ZEND_FE_END`, use `NULL` for the functions. The implementation of
class registration for internal classes, `do_register_internal_class()` in
zend_API.c, already skips classes where the functions are `NULL`. By removing
these unneeded arrays, we can reduce the size of the header files, while also
removing an unneeded call to zend_register_functions() for each internal class
with no extra methods.
2024-09-03 23:19:53 +02:00
Christoph M. Becker
6d5962074f Dynamically xfail test cases which fail on CI (GH-15710)
This is a stop-gap measure for GH-15709 to keep CI green.
2024-09-02 18:23:52 +02:00
Máté Kocsis
8d12f666ae Fix registration of internal readonly child classes (#15459)
Currently, internal classes are registered with the following code:

INIT_CLASS_ENTRY(ce, "InternalClass", class_InternalClass_methods);
class_entry = zend_register_internal_class_ex(&ce, NULL);
class_entry->ce_flags |= ...;

This has worked well so far, except if InternalClass is readonly. It is because some inheritance checks are run by zend_register_internal_class_ex before ZEND_ACC_READONLY_CLASS is added to ce_flags.

The issue is fixed by adding a zend_register_internal_class_with_flags() zend API function that stubs can use from now on. This function makes sure to add the flags before running any checks. Since the new API is not available in lower PHP versions, gen_stub.php has to keep support for the existing API for PHP 8.3 and below.
2024-08-24 12:36:54 +02:00