archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 13:38:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.3' into PHP-8.4

Browse source
This commit is contained in:
David Carlier 2025-05-04 14:15:05 +01:00
commit 2e2077172d
No known key found for this signature in database
GPG key ID: 8486F847B4B94EF1
3 changed files with 50 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
NEWS
View file

@ -2,6 +2,10 @@ PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP 8.4.8
- Core:
. Fixed GH-18480 (array_splice with large values for offset/length arguments).
(nielsdos/David Carlier)
- Curl:
. Fixed GH-18460 (curl_easy_setopt with CURLOPT_USERPWD/CURLOPT_USERNAME/
CURLOPT_PASSWORD set the Authorization header when set to NULL).

12
ext/standard/array.c
View file

@ -3364,7 +3364,7 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
/* If hash for removed entries exists, go until offset+length and copy the entries to it */
if (removed != NULL) {
for ( ; pos < offset + length && idx < in_hash->nNumUsed; idx++, entry++) {
for ( ; pos - offset < length && idx < in_hash->nNumUsed; idx++, entry++) {
if (Z_TYPE_P(entry) == IS_UNDEF) continue;
pos++;
Z_TRY_ADDREF_P(entry);
@ -3377,9 +3377,9 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
}
}
} else { /* otherwise just skip those entries */
int pos2 = pos;
zend_long pos2 = pos;
for ( ; pos2 < offset + length && idx < in_hash->nNumUsed; idx++, entry++) {
for ( ; pos2 - offset < length && idx < in_hash->nNumUsed; idx++, entry++) {
if (Z_TYPE_P(entry) == IS_UNDEF) continue;
pos2++;
zend_hash_packed_del_val(in_hash, entry);
@ -3438,7 +3438,7 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
/* If hash for removed entries exists, go until offset+length and copy the entries to it */
if (removed != NULL) {
for ( ; pos < offset + length && idx < in_hash->nNumUsed; idx++, p++) {
for ( ; pos - offset < length && idx < in_hash->nNumUsed; idx++, p++) {
if (Z_TYPE(p->val) == IS_UNDEF) continue;
pos++;
entry = &p->val;
@ -3451,9 +3451,9 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
zend_hash_del_bucket(in_hash, p);
}
} else { /* otherwise just skip those entries */
int pos2 = pos;
zend_long pos2 = pos;
for ( ; pos2 < offset + length && idx < in_hash->nNumUsed; idx++, p++) {
for ( ; pos2 - offset < length && idx < in_hash->nNumUsed; idx++, p++) {
if (Z_TYPE(p->val) == IS_UNDEF) continue;
pos2++;
zend_hash_del_bucket(in_hash, p);

40
ext/standard/tests/array/gh18480.phpt Normal file
View file

@ -0,0 +1,40 @@
--TEST--
GH-18480 (array_splice overflow with large offset / length values)
--FILE--
<?php
foreach ([PHP_INT_MIN, PHP_INT_MAX] as $length) {
$a = [PHP_INT_MAX];
$offset = PHP_INT_MAX;
var_dump(array_splice($a,$offset, $length));
$a = [PHP_INT_MAX];
$offset = PHP_INT_MIN;
var_dump(array_splice($a,$offset, $length));
$a = ["a" => PHP_INT_MAX];
$offset = PHP_INT_MAX;
var_dump(array_splice($a,$offset, $length));
$a = ["a" => PHP_INT_MAX];
$offset = PHP_INT_MIN;
var_dump(array_splice($a,$offset, $length));
}
--EXPECTF--
array(0) {
}
array(0) {
}
array(0) {
}
array(0) {
}
array(0) {
}
array(1) {
[0]=>
int(%d)
}
array(0) {
}
array(1) {
["a"]=>
int(%d)
}