1
0
mirror of https://github.com/php/php-src.git synced 2026-03-29 11:42:17 +02:00
Commit Graph

139368 Commits

Author SHA1 Message Date
Saki Takamachi
23e05bdcf2 Update versions for PHP 8.4.5 php-8.4.5 2025-03-12 10:55:56 +09:00
Jakub Zelenka
689c019f54 Update NEWS with entries for security fixes 2025-03-07 13:47:38 +01:00
Ilija Tovilo
115a918790 Fix varying pgsql error message 2025-03-05 22:05:09 +01:00
Niels Dossche
3377d4fb4c Fix GHSA-wg4p-4hqh-c3g9 2025-03-05 20:48:59 +01:00
Jakub Zelenka
789132c74f Fix incorrectly ported tests for http 2025-03-05 19:01:14 +01:00
Ilija Tovilo
29dd6eb307 Use-after-free for ??= due to incorrect live-range calculation
Fixes GHSA-rwp7-7vc6-8477
2025-03-05 14:24:30 +01:00
Tim Düsterhus
e22b3a3708 Fix GHSA-p3x9-6h7p-cgfc: libxml streams wrong content-type on redirect
libxml streams use wrong content-type header when requesting a
redirected resource.
2025-03-05 14:16:10 +01:00
Jakub Zelenka
963551715a Fix GHSA-hgf5-96fm-v528: http user header check of crlf 2025-03-05 13:42:52 +01:00
Jakub Zelenka
2488e73d1f Fix GHSA-52jp-hrpf-2jff: http redirect location truncation
It converts the allocation of location to be on heap instead of stack
and errors if the location length is greater than 8086 bytes.
2025-03-05 13:42:11 +01:00
Jakub Zelenka
61bb8ef240 Fix GHSA-pcmh-g36c-qc44: http headers without colon
The header line must contain colon otherwise it is invalid and it needs
to fail.

Reviewed-by: Tim Düsterhus <tim@tideways-gmbh.com>
2025-03-05 13:41:22 +01:00
Jakub Zelenka
9fe496696d Fix GHSA-ghsa-v8xr-gpvj-cx9g: http header folding
This adds HTTP header folding support for HTTP wrapper response
headers.

Reviewed-by: Tim Düsterhus <tim@tideways-gmbh.com>
2025-03-05 12:43:37 +01:00
Daniel Scherzer
81f143e71f Reflection: indicate final and abstract properties in string output
Add "final" and "abstract" to the result of `_property_string()` when
outputting the string representation of a `ReflectionClass` or
`ReflectionProperty` instance

Closes GH-17827
2025-02-25 12:21:15 +01:00
Dmitry Stogov
819b1988a0 Update IR
IR commit: ca93e781eaf6b0949690d3df272ecf44528ff4a8
2025-02-25 02:23:05 +03:00
Jakub Zelenka
ed00c1d74b Merge branch 'PHP-8.3' into PHP-8.4 2025-02-24 23:22:47 +01:00
Jakub Zelenka
930624899b Fix bug #72666: stat cache not cleared for plain paths
This adds more aggressive clearing of stat cache. It is added to the
filestat as well as plain wrapper operations which covers stream file
accessing as well as exec functions (using pipes). It should hopefully
fix the most visible issues with the stat cache.

Closes GH-17681
2025-02-24 23:21:45 +01:00
Niels Dossche
fa4ae80928 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Backport GH-17869 to PHP 8.3 JIT
2025-02-24 21:46:00 +01:00
Niels Dossche
3b4a58da44 Backport GH-17869 to PHP 8.3 JIT
Closes GH-17918.
2025-02-24 21:45:03 +01:00
Niels Dossche
2542357b6d Fix GH-17866: zend_mm_heap corrupted error after upgrading from 8.4.3 to 8.4.4
This regressed in GH-17592.
The function is with its attributes HashTable* is copied in
zend_get_closure_invoke_method() but its refcount is not increased.
This caused a crash in the Symfony demo page.

Closes GH-17880.
2025-02-24 21:39:55 +01:00
Daniel Scherzer
c0857e0d8a Fix GH-17916: Final abstract properties should error
Closes GH-17917.
2025-02-24 20:17:41 +01:00
Niels Dossche
5ede5415e1 Fix GH-17868: Cannot allocate memory with tracing JIT on 8.4.4
The generated code tries to initialize the run time cache for even
internal closures, but it should only initialize the run time cache for
user closures. We fix this by adding a check for the function type.
If `func` is known, then we can check the type at code generation time.

Closes GH-17869.
2025-02-24 19:36:13 +01:00
Ilija Tovilo
ca75ebf3a1 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  [skip ci] Use laravel default branch in community build
2025-02-24 15:58:40 +01:00
Ilija Tovilo
a93ad360cb Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [skip ci] Use laravel default branch in community build
2025-02-24 15:58:31 +01:00
Ilija Tovilo
09d7f69793 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [skip ci] Use laravel default branch in community build
2025-02-24 15:58:23 +01:00
Ilija Tovilo
e71b8cae7e [skip ci] Use laravel default branch in community build
See: https://github.com/laravel/framework/issues/54754#issuecomment-2678092563

According to this comment, the default branch more actively receives
changes throuought the year than master. Hence, it makes more sense to
test the default branch.
2025-02-24 15:58:04 +01:00
Bob Weinand
53fa98ecd3 Fix GH-17715: Handle preloaded internal function runtime cache (#17835)
This solely affects the builtin enum functions currently.

Given that these are stored in SHM, we cannot simply hardwire a pointer into the internal function runtime cache on NTS too, but have to use a MAP_PTR (like on ZTS).
Now, by design, the runtime cache of internal functions no longer is reset between requests, hence we need to store them explicitly as static runtime cache.

On NTS builds we cannot trivially move the pointers into CG(internal_run_time_cache) as they're directly stored on the individual functions (on ZTS we could simply iterate the static map_ptrs).
Hence, we have the choice between having opcache managing the internal run_time_cache for its preloaded functions itself or realloc CG(internal_run_time_cache) and iterate through all functions to assign the new address. We choose the latter for simplicity and initial speed.
2025-02-24 14:35:47 +01:00
David Carlier
fc73da57f4 Merge branch 'PHP-8.3' into PHP-8.4 2025-02-24 07:14:56 +00:00
Michael Orlitzky
174a7fe6f9 Fix GH-17891 gh17373.phpt test issue without freetype support
skip if imagefttext() is not available

This test calls imagefttext(), which may not be available if libgd
was built without freetype support.

Closes GH-17910
2025-02-24 07:13:11 +00:00
David Carlier
34d0e4f31f Merge branch 'PHP-8.3' into PHP-8.4 2025-02-23 16:02:35 +00:00
Michael Orlitzky
065b4ec125 ext/gd/tests: backport optional PNG support
- Three of our gd tests could be skipped with a message about requiring
bundled GD, but those tests don't actually require bundled GD. We
update the messages to mention the specific functions that are
required.

- add SKIPIF stanzas for missing PNG support

The bundled libgd always has PNG support, but an external one may not.

- imagerotate() is always available

Following 59ec80c5, the imagerotate() function is always available. We
may therefore remove its function_exists() checks without harm.

close GH-17894
2025-02-23 16:01:30 +00:00
Niels Dossche
635fe263ac Fix memory leaks in pdo_sqlite callback registration
* We need to clean the trampoline if the construction check fails
* Checking for an exception and then returning causes a leak on
  `collation`. Returning early is pointless anyway.

Closes GH-17904.
2025-02-23 16:35:55 +01:00
Niels Dossche
76035090b6 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix cycle leak in sqlite3 setAuthorizer()
2025-02-23 16:35:25 +01:00
Niels Dossche
353f21487f Fix cycle leak in sqlite3 setAuthorizer()
Closes GH-17903.
2025-02-23 16:34:41 +01:00
David Carlier
96340e9eed Merge branch 'PHP-8.3' into PHP-8.4 2025-02-23 13:23:38 +00:00
David Carlier
2c251f945c [skip ci] zend_test adding closing tags to newer tests 2025-02-23 13:23:26 +00:00
David Carlier
e8dda54dd5 Merge branch 'PHP-8.3' into PHP-8.4 2025-02-23 10:45:46 +00:00
David Carlier
cefdf00e7e Fix GH-17899: zend_test_compile_string crash on invalid script path.
when opcache is enabled.

close GH-17901
2025-02-23 10:45:10 +00:00
Niels Dossche
7974c62873 Fix using Dom\Node with Dom\XPath callbacks
This code was introduced when the Dom\Node and DOMNode classes were
still aliases, so the type check was never updated.
We fix this by checking if the doc pointer follows the spec and pick the
right node CE based on that.

Closes GH-17888.
2025-02-22 16:00:39 +01:00
Christoph M. Becker
2c911e400a Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-17879: readfile_variation8-win32.phpt test conflict
2025-02-22 00:10:51 +01:00
Christoph M. Becker
769f292a7a Fix GH-17879: readfile_variation8-win32.phpt test conflict
Apparently a copy and paste issue.

Closes GH-17881.
2025-02-22 00:09:53 +01:00
Niels Dossche
be3d128632 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-17847: xinclude destroys live node
2025-02-21 22:27:53 +01:00
Niels Dossche
9becccef17 Fix GH-17847: xinclude destroys live node
dom_xinclude_strip_fallback_references() now also takes into account
xi:include nodes children. This now subsumes all work done normally by
the old start/end node removal, so we can remove that code and start
using XML_PARSE_NOXINCNODE.

Closes GH-17878.
2025-02-21 22:24:44 +01:00
Christoph M. Becker
1eb67515be Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-17855: CURL_STATICLIB flag set even if linked with shared lib
2025-02-21 13:08:29 +01:00
Christoph M. Becker
200f16fcf7 Fix GH-17855: CURL_STATICLIB flag set even if linked with shared lib
We must define `CURL_STATICLIB` only when building against a static
libcurl.  The detection relies on our usual naming conventions, what
should be revised in the future (possibly using pkg-config, or
switching to CMake).

Closes GH-17857.
2025-02-21 13:08:01 +01:00
Christoph M. Becker
07a3719bc7 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-17855: CURL_STATICLIB flag set even if linked with shared lib
2025-02-21 12:49:08 +01:00
Christoph M. Becker
29c39a3d91 Fix GH-17855: CURL_STATICLIB flag set even if linked with shared lib
We must define `CURL_STATICLIB` only when building against a static
libcurl.  The detection relies on our usual naming conventions, what
should be revised in the future (possibly using pkg-config, or
switching to CMake).

Closes GH-17857.
2025-02-21 12:46:20 +01:00
Niels Dossche
77847b02b9 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Reflection: show the type of object constants used as default properties
2025-02-21 09:36:01 +01:00
Daniel Scherzer
ca0414e64d Reflection: show the type of object constants used as default properties
When a property default is based on a global constant, show the type of the
default. Previously, `format_default_value()` assumed that non-scalar and
non-array defaults were always going to be `IS_CONSTANT_AST` pointers, and when
the AST expression had been evaluated and produced an object, depending on when
the `ReflectionClass` or `ReflectionProperty` instance had been created, the
default was shown as one of `callable` or `__CLASS__`.

Instead, if the default value is an object (`IS_OBJECT`), show the type of that
object.

Add test cases for both of the `callable` and `__CLASS__` cases to confirm that
they now properly show the type of the constant.

Closes GH-15902.
Closes GH-17781.
2025-02-21 09:32:10 +01:00
Dmitry Stogov
dd404dc419 Update IR
IR commit: 1499748be439e7f786c0ee2c4f738c126af57df8
2025-02-20 23:58:08 +03:00
Remi Collet
04a33a1122 zip version is now 1.22.5 2025-02-20 11:47:51 +01:00
Dmitry Stogov
352aca1ee1 Update IR
IR commit: 7f920cb660a1ef615a3059eab77b86ca1a43121e
2025-02-18 21:32:17 +03:00