1
0
mirror of https://github.com/php/php-src.git synced 2026-03-29 11:42:17 +02:00
Commit Graph

19485 Commits

Author SHA1 Message Date
Saki Takamachi
23e05bdcf2 Update versions for PHP 8.4.5 2025-03-12 10:55:56 +09:00
Ilija Tovilo
29dd6eb307 Use-after-free for ??= due to incorrect live-range calculation
Fixes GHSA-rwp7-7vc6-8477
2025-03-05 14:24:30 +01:00
Niels Dossche
2542357b6d Fix GH-17866: zend_mm_heap corrupted error after upgrading from 8.4.3 to 8.4.4
This regressed in GH-17592.
The function is with its attributes HashTable* is copied in
zend_get_closure_invoke_method() but its refcount is not increased.
This caused a crash in the Symfony demo page.

Closes GH-17880.
2025-02-24 21:39:55 +01:00
Daniel Scherzer
c0857e0d8a Fix GH-17916: Final abstract properties should error
Closes GH-17917.
2025-02-24 20:17:41 +01:00
Bob Weinand
53fa98ecd3 Fix GH-17715: Handle preloaded internal function runtime cache (#17835)
This solely affects the builtin enum functions currently.

Given that these are stored in SHM, we cannot simply hardwire a pointer into the internal function runtime cache on NTS too, but have to use a MAP_PTR (like on ZTS).
Now, by design, the runtime cache of internal functions no longer is reset between requests, hence we need to store them explicitly as static runtime cache.

On NTS builds we cannot trivially move the pointers into CG(internal_run_time_cache) as they're directly stored on the individual functions (on ZTS we could simply iterate the static map_ptrs).
Hence, we have the choice between having opcache managing the internal run_time_cache for its preloaded functions itself or realloc CG(internal_run_time_cache) and iterate through all functions to assign the new address. We choose the latter for simplicity and initial speed.
2025-02-24 14:35:47 +01:00
Tim Düsterhus
041036960c Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Free the trampoline when deprecation on materializing `__callStatic()` of trait throws (#17729)
2025-02-07 10:53:31 +01:00
Tim Düsterhus
00d4390ea1 Free the trampoline when deprecation on materializing __callStatic() of trait throws (#17729)
Fixes php/php-src#17728
2025-02-07 10:53:14 +01:00
Arnaud Le Blanc
24b191a4de Fix ReflectionProperty::getRawValue() and related methods for properties overridden with hooks
`new Reflectionproperty($scope, $propName)` keeps a reference to the
zend_property_info of $propName declared in $scope. In getRawValue() and
related methods, we use this reference to check whether the property is hooked.

Calling `new ReflectionProperty($scope, $propName)->getRawValue($object)` is
equivalent to the expression $object->$propName from scope $scope (except that
it bypasses hooks), and thus may access an overridden property (unless the
original is private). This property may have hooks and different flags.

Here I fetch the effective property info before checking for hooks and
property flags.

Fixes GH-17713
Closes GH-17714
2025-02-07 10:49:02 +01:00
Tim Düsterhus
e13d25eb84 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Disallow calls to abstract `__call()` / `__callStatic()` (#17719)
2025-02-07 09:37:28 +01:00
Tim Düsterhus
0607b663d3 Disallow calls to abstract __call() / __callStatic() (#17719)
Fixes php/php-src#17718
2025-02-07 09:36:33 +01:00
Ilija Tovilo
ab6977d36c Fix segfault when assigning to backing value by-ref from hook
Fixes oss-fuzz #391975641
Closes GH-17620
2025-02-05 18:06:05 +01:00
Niels Dossche
c7d3c5fcb1 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix fallback paths in fast_long_{add,sub}_function
2025-02-03 22:40:41 +01:00
Niels Dossche
7e06a81bbd Fix fallback paths in fast_long_{add,sub}_function
This was asked to be checked in https://github.com/php/php-src/pull/17472#issuecomment-2591325036

There are 2 issues:
1) The UB in the if can overflow, and can be fixed by using zend_ulong
   for the sum/sub.
2) fast_long_sub_function() has a problem when result aliases.
   This is fixed in the same way as fast_long_add_function() works.

Closes GH-17666.
2025-02-03 22:38:00 +01:00
Tim Düsterhus
7eaa9f0478 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  zend_execute: Suppress values in `UnhandledMatchError` for `zend.exception_ignore_args=1` (#17619)
2025-01-31 10:21:32 +01:00
Tim Düsterhus
f8b57ff1bf zend_execute: Suppress values in UnhandledMatchError for zend.exception_ignore_args=1 (#17619)
Fixes php/php-src#17618.
2025-01-31 10:19:49 +01:00
Ilija Tovilo
4f91af38cc Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix stack overflow detection for variable compilation
2025-01-29 23:28:16 +01:00
Ilija Tovilo
333f5dd848 Fix stack overflow detection for variable compilation
Closes GH-17623
2025-01-29 23:27:27 +01:00
Jakub Zelenka
c4b678fa70 PHP-8.3 is now for PHP 8.3.18-dev 2025-01-28 19:45:52 +01:00
Calvin Buckley
ef2c371f13 PHP-8.4 is now for PHP 8.4.5-dev 2025-01-28 13:27:39 -04:00
Tim Düsterhus
f37b165403 Fix #[\Deprecated] for __call() and __callStatic() (#17592)
* Fix `#[\Deprecated]` for `__call()` and `__callStatic()`

Fixes php/php-src#17597.

* Do not duplicate the `attributes` table in `zend_get_call_trampoline_func()`
2025-01-27 13:41:41 +01:00
Niels Dossche
0b12db6afa Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix may_have_extra_named_args flag for ZEND_AST_UNPACK
2025-01-21 19:27:19 +01:00
Niels Dossche
0b3e637aec Fix may_have_extra_named_args flag for ZEND_AST_UNPACK
The check for `!fbc || (fbc->common.fn_flags & ZEND_ACC_VARIADIC)` is
performed after `fbc` is set to NULL, so this always returns true.
This results in `ZEND_FCALL_MAY_HAVE_EXTRA_NAMED_PARAMS` always being
set for unpack sends. Fix it by moving the flag updates to the point
before setting `fbc` to NULL.

Closes GH-17534.
2025-01-21 19:26:49 +01:00
Niels Dossche
25543b4566 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-17408: Assertion failure Zend/zend_exceptions.c
2025-01-21 08:21:13 +01:00
Niels Dossche
5344bcca97 Fix GH-17408: Assertion failure Zend/zend_exceptions.c
`zend_test_create_throwing_resource` sets the exception in the `test`
call frame and unwinds to `main`. It then throws for the `resource`
variable and verifies that the exception opline is set. However, it
wasn't set in `main`, it was set at the `test` call frame and rethrown later.
The assertion is too conservative, but the end result is right, so drop
the assertion.

Closes GH-17533.

Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
2025-01-21 08:20:38 +01:00
Ilija Tovilo
3c138641e1 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Relax final+private warning for trait methods with inherited final
2025-01-13 16:46:43 +01:00
Ilija Tovilo
a6a290d541 Relax final+private warning for trait methods with inherited final
Fixes GH-17214
Closes GH-17381
2025-01-13 16:46:01 +01:00
Ilija Tovilo
147e9c808c __PROPERTY__ does not work in all constant expression contexts
Fixes GH-17222
Closes GH-17378
2025-01-13 16:42:38 +01:00
Niels Dossche
3eb79e146f Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-17409: Assertion failure Zend/zend_hash.c:1730
  NEWS
  Add comment
  Fix GH-16892: ini_parse_quantity() fails to parse inputs starting with 0x0b
  Fix GH-16886: ini_parse_quantity() fails to emit warning for 0x+0
  Merge duplicate code blocks
2025-01-09 19:54:46 +01:00
Niels Dossche
a2b8204880 Add comment
Closes GH-17274.
2025-01-09 19:52:13 +01:00
Niels Dossche
7626e88de7 Fix GH-16892: ini_parse_quantity() fails to parse inputs starting with 0x0b 2025-01-09 19:51:18 +01:00
Niels Dossche
2c267722b3 Fix GH-16886: ini_parse_quantity() fails to emit warning for 0x+0 2025-01-09 19:51:17 +01:00
Niels Dossche
e6e2ec56ab Merge duplicate code blocks
This makes the code less error-prone.
2025-01-09 19:51:17 +01:00
Niels Dossche
71493623f4 Fix GH-17234: Numeric parent hook call fails with assertion
The current code expects the property name to be a string, but it can
also be a number via the {} syntax. Handle this consistently to a string
by using zval_get_string which will do the type coercion and refcount
update (instead of assuming string and doing an explicit string copy).

Closes GH-17236.
2025-01-07 19:21:22 +01:00
Eric Mann
717b75cb43 PHP-8.3 is now for PHP-8.3.17-dev 2024-12-31 08:46:21 -08:00
Saki Takamachi
fc10c1d13d PHP-8.4 is now for PHP 8.4.4-dev 2025-01-01 00:49:12 +09:00
Niels Dossche
627432785e Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-17216: Trampoline crash on error
2024-12-21 00:26:23 +01:00
Niels Dossche
2c3b56ded0 Fix GH-17216: Trampoline crash on error
The error handling is incomplete on argument cleanup.
1. The fci is not cleared which means that zend_free_trampoline() is
   never called.
2. The cleaning for extra named arguments was missing, resulting in
   memory leak.

Closes GH-17219.
2024-12-21 00:25:06 +01:00
Arnaud Le Blanc
32148e9b10 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Add observer temporary to dl'ed functions
2024-12-20 18:50:16 +01:00
Arnaud Le Blanc
9e7932b292 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Add observer temporary to dl'ed functions
2024-12-20 18:46:55 +01:00
Arnaud Le Blanc
6f579934f0 Add observer temporary to dl'ed functions
When observer is enabled, we normally add an extra temporary to all
functions, to store the previously observed frame. However, this is done in
zend_observer_post_startup() so it doesn't happen to dl'ed() functions.

One possible fix would be to move that from zend_observer_post_startup()
to zend_register_functions(), but this would be too early: Observer may
not be enabled when zend_register_functions() is called, and may still be
enabled later.

However, when zend_register_functions() is called at run-time (during dl()),
we know definitively whether observer is enabled.

Here I update zend_register_functions() to add a temporary to dl'ed()
functions when observer is enabled.

Fixes: GH-17211
Closes: GH-17220
2024-12-20 18:45:34 +01:00
Dmitry Stogov
6666cc83c5 Fix RC inference of op1 of FETCH_OBJ and INIT_METHOD_CALL
Fixes GH-17151
Closes GH-17152
2024-12-18 19:08:51 +01:00
Ilija Tovilo
f0441744db Fix incorrect dynamic prop offset in hooked prop iterator
Fixes GH-17200
Closes GH-17203
2024-12-18 18:47:48 +01:00
Niels Dossche
160a4a65ad Export visibility for promoted property (8.3) 2024-12-17 19:14:07 +01:00
Niels Dossche
d4778224ca Add test for GH-17101 2024-12-17 19:06:10 +01:00
Niels Dossche
3f0f7ab7df Print hooks in parameter exports 2024-12-17 19:06:10 +01:00
Niels Dossche
0cba85b54d Fix property hook name mismatch 2024-12-17 19:06:10 +01:00
Niels Dossche
6920aa2ae6 Extract hook export code 2024-12-17 19:06:10 +01:00
Niels Dossche
6f41bfd1c7 Export visibility for promoted property 2024-12-17 19:06:09 +01:00
Niels Dossche
08b14a57b8 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-17162: zend_array_try_init() with dtor can cause engine UAF
2024-12-15 20:12:12 +01:00
Niels Dossche
ee0daa59db Fix GH-17162: zend_array_try_init() with dtor can cause engine UAF
Closes GH-17167.
2024-12-15 20:11:40 +01:00