526938648e
Fix test for 8.5+
2025-12-14 13:35:03 +01:00
4d680fa1e2
Merge branch 'PHP-8.4' into PHP-8.5
...
* PHP-8.4:
Fix GH-20678: resource created by GlobIterator crashes with fclose().
2025-12-14 11:59:14 +00:00
90475249dd
Merge branch 'PHP-8.3' into PHP-8.4
...
* PHP-8.3:
Fix GH-20678: resource created by GlobIterator crashes with fclose().
2025-12-14 11:58:41 +00:00
97a90f4361
Fix GH-20678: resource created by GlobIterator crashes with fclose().
...
close GH-20697
2025-12-14 11:58:18 +00:00
6afe2cef78
Merge branch 'PHP-8.4' into PHP-8.5
...
* PHP-8.4:
Fix GH-20614: SplFixedArray incorrectly handles references in deserialization
2025-11-30 10:43:27 +01:00
9734ba4d21
Merge branch 'PHP-8.3' into PHP-8.4
...
* PHP-8.3:
Fix GH-20614: SplFixedArray incorrectly handles references in deserialization
2025-11-30 10:42:19 +01:00
366ed4c750
Fix GH-20614: SplFixedArray incorrectly handles references in deserialization
...
All other code caters to dereferencing array elements, except the
unserialize handler. This causes references to be present in the fixed
array even though this seems not intentional as reference assign is
otherwise impossible.
On 8.5+ this causes an assertion failure. On 8.3+ this causes references
to be present where they shouldn't be.
Closes GH-20616.
2025-11-30 10:41:32 +01:00
9a1b8a785d
Fix GH-20194: null offset deprecation not emitted for writes ( #20238 )
...
Based on a patch from @ndossche
2025-10-29 18:36:10 +00:00
bc76b3fca9
Improve __unserialize() hardening for SplHeap/SplPriorityQueue
...
It was possible to make the heap accept unserialize data when the heap
was corrupted or under modification. This adds the necessary check to
prevent that from happening.
Also, the exception check at the bottom is pointless,
spl_heap_unserialize_internal_state() already returns FAILURE on
exception. If it *is* necessary, it should be documented why.
Closes GH-20109.
2025-10-11 23:52:37 +02:00
0458b3c8db
Fix GH-20101: SplHeap/SplPriorityQueue serialization exposes INDIRECTs
...
Exposing INDIRECTs to userland is not allowed and can lead to all sorts
of wrong behaviour. In this case it lead to UAF bugs.
Solve it by duplicating the properties table, which de-indirects the
elements and also decouples it for future modifications.
Closes GH-20102.
2025-10-08 18:54:45 +02:00
fc353966f3
Revert deprecation of __sleep and __wakeup ( #19966 )
2025-10-06 10:30:27 +02:00
e6c07b004b
Fix GH-14402: Add support for serialization in SplPriorityQueue, SplMinHeap and SplMaxHeap ( #19447 )
2025-09-22 09:43:09 +02:00
a5f2eee785
Zend: Deprecate __wakeup() ( #19435 )
...
RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_the_sleep_and_wakeup_magic_methods
2025-09-11 06:57:21 +01:00
c1fa560ba9
Merge branch 'PHP-8.4'
...
* PHP-8.4:
Fix GH-19577: avoid integer overflow when using a small offset and PHP_INT_MAX with LimitIterator (#19585 )
2025-09-05 08:10:48 +02:00
7cceda1597
Merge branch 'PHP-8.3' into PHP-8.4
...
* PHP-8.3:
Fix GH-19577: avoid integer overflow when using a small offset and PHP_INT_MAX with LimitIterator (#19585 )
2025-09-05 08:10:22 +02:00
05133ac962
Fix GH-19577: avoid integer overflow when using a small offset and PHP_INT_MAX with LimitIterator ( #19585 )
2025-09-05 08:09:06 +02:00
49e3956b70
core: Deprecate using null as an array offset and when calling array_key_exists() ( #19511 )
...
RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_using_values_null_as_an_array_offset_and_when_calling_array_key_exists
2025-09-04 22:12:24 +01:00
fb87b14b6c
ext/spl: Deprecate ArrayObject and ArrayIterator with objects ( #19420 )
...
RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_arrayobject_and_arrayiterator_with_objects
This also moves tests into a subfolder.
2025-08-14 12:38:57 +01:00
16872310d5
ext/spl: Deprecate SplObjectStorage::contains(), SplObjectStorage::attach(), and SplObjectStorage::detach() ( #19424 )
...
RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_splobjectstoragecontains_splobjectstorageattach_and_splobjectstoragedetach
2025-08-09 11:36:14 +01:00
8c5c03e33a
ext/spl: Deprecate passing spl_autoload_call() to spl_autoload_unregister() ( #19422 )
...
RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_passing_spl_autoload_call_to_spl_autoload_unregister
2025-08-09 11:23:14 +01:00
5be04e25fd
[skip ci] Skip segfaulting OOM test in GH actions on Win
...
This only fails on the PHP-8.3 branch, most likely to be related to the
environment as discussed with Niels.
2025-08-06 14:28:47 +02:00
1e0c8baf05
tree: drop non canonical casts and ZPP tests
2025-08-06 13:20:28 +01:00
5cacae8f29
Merge branch 'PHP-8.4'
...
* PHP-8.4:
Fix GH-19094: Attaching class with no Iterator implementation to MultipleIterator causes crash
2025-07-11 12:28:47 +02:00
76b6b60b8c
Merge branch 'PHP-8.3' into PHP-8.4
...
* PHP-8.3:
Fix GH-19094: Attaching class with no Iterator implementation to MultipleIterator causes crash
2025-07-11 12:28:25 +02:00
71472268c0
Fix GH-19094: Attaching class with no Iterator implementation to MultipleIterator causes crash
...
Closes GH-19097.
2025-07-11 12:27:41 +02:00
50ddf6a68f
ext/spl: Refactor ArrayObject sort methods
2025-07-03 21:50:45 +01:00
faef004250
ext/spl: Add tests for disabled sort functions
2025-07-03 21:50:45 +01:00
0ab5f70b3c
ext/spl: Remove bool type coercions in tests
2025-06-21 22:18:52 +02:00
e3433fdaef
Merge branch 'PHP-8.4'
...
* PHP-8.4:
Fix GH-18421: Integer overflow with large numbers in LimitIterator
2025-04-25 20:06:24 +02:00
4ff41cfb4b
Merge branch 'PHP-8.3' into PHP-8.4
...
* PHP-8.3:
Fix GH-18421: Integer overflow with large numbers in LimitIterator
2025-04-25 20:06:18 +02:00
a91d913901
Fix GH-18421: Integer overflow with large numbers in LimitIterator
...
Since we already know that `pos < intern->u.limit.offset` at this point,
we can reverse the expression.
Closes GH-18424.
2025-04-25 20:05:55 +02:00
89e5f6ca53
Merge branch 'PHP-8.4'
...
* PHP-8.4:
Fix GH-18322: SplObjectStorage debug handler mismanages memory
2025-04-14 14:11:40 +02:00
fc63a98f17
Merge branch 'PHP-8.3' into PHP-8.4
...
* PHP-8.3:
Fix GH-18322: SplObjectStorage debug handler mismanages memory
2025-04-14 14:11:35 +02:00
67503870ca
Fix GH-18322: SplObjectStorage debug handler mismanages memory
...
This hack was once necessary before there was a proper get_gc handler,
but now it breaks the engine constraints.
Closes GH-18323.
2025-04-14 14:11:09 +02:00
1684c52a88
Fix GlobIterator without constructor breaks count() ( #18314 )
...
As reported by OpenAI AARDVARK.
2025-04-12 09:59:56 +02:00
3ba725a556
Merge branch 'PHP-8.4'
...
* PHP-8.4:
Fix GH-18309: ipv6 filter integer overflow
Fix GH-18304: Changing the properties of a DateInterval through dynamic properties triggers a SegFault
2025-04-11 23:36:42 +02:00
a019fbd970
Merge branch 'PHP-8.3' into PHP-8.4
...
* PHP-8.3:
Fix GH-18309: ipv6 filter integer overflow
Fix GH-18304: Changing the properties of a DateInterval through dynamic properties triggers a SegFault
2025-04-11 23:36:12 +02:00
ba0853888d
Fix GH-18304: Changing the properties of a DateInterval through dynamic properties triggers a SegFault
...
For dynamic fetches the cache_slot will be NULL, so we have to check for
that when resetting the cache. For zip and xmlreader this couldn't
easily be tested because of a lack of writable properties.
Closes GH-18307.
2025-04-11 23:33:58 +02:00
fec4f7f389
ext/standard/file: clarify fclose() warning
2025-03-24 22:54:34 +00:00
fc047b4e00
Merge branch 'PHP-8.4'
...
* PHP-8.4:
[ci skip] Fix NEWS order
Fix GH-18018: RC1 data returned from offsetGet causes UAF in ArrayObject
2025-03-13 19:11:59 +01:00
d43d4684bd
Merge branch 'PHP-8.3' into PHP-8.4
...
* PHP-8.3:
Fix GH-18018: RC1 data returned from offsetGet causes UAF in ArrayObject
2025-03-13 19:11:24 +01:00
27affd8da1
Fix GH-18018: RC1 data returned from offsetGet causes UAF in ArrayObject
...
We should first check truthiness and only after that destroy the value.
Closes GH-18034.
2025-03-13 19:10:34 +01:00
27125b8c39
Merge branch 'PHP-8.4'
2025-01-19 18:01:52 +00:00
c82e31b026
Fix GH-17516: SplFileTempObject::getPathInfo() crash on invalid class.
...
This no longer caught the case where an non SplFileInfo/inherited class
of nwas passed since the refactoring in 8.4.
close GH-17517
2025-01-19 18:01:02 +00:00
a4e25839d3
Merge branch 'PHP-8.4'
2025-01-14 18:33:00 +00:00
b1e0176455
Merge branch 'PHP-8.3' into PHP-8.4
2025-01-14 18:32:51 +00:00
e4473abefc
Fix GH-17463: SplTempFileObject::ftruncate() segfault on negative length.
...
close GH-465
2025-01-14 18:32:01 +00:00
8c443016e9
Merge branch 'PHP-8.4'
...
* PHP-8.4:
Fix GH-17307: Internal closure causes JIT failure
Generate inline frameless icall handlers only if the optimization level is set to inline
Fix GH-15981: Segfault with frameless jumps and minimal JIT
Fix GH-15833: Segmentation fault (access null pointer) in ext/spl/spl_array.c
2025-01-09 20:01:16 +01:00
b666dc9788
Fix GH-15833: Segmentation fault (access null pointer) in ext/spl/spl_array.c
...
We're accessing the object properties table directly in spl, but we're
not accounting for lazy objects. Upon accessing we should trigger the
initialization as spl is doing direct manipulations on the object
property table and expects a real object.
Closes GH-17235.
2025-01-09 19:58:00 +01:00
3de22a84e8
ext/spl: Add trampoline test for iterator_apply()
2025-01-05 12:27:28 +00:00
Niels Dossche