Commit graph

684 commits

Author SHA1 Message Date
Stanislav Malyshev
33e4174d1c
Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Update NEWS
  Fix #81211: Symlinks are followed when creating PHAR archive
2021-08-23 23:30:34 -07:00
Stanislav Malyshev
40db8947e2
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
  Update NEWS
  Fix #81211: Symlinks are followed when creating PHAR archive
2021-08-23 23:29:01 -07:00
Christoph M. Becker
2ff853aa11
Fix #81211: Symlinks are followed when creating PHAR archive
It is insufficient to check whether the `base` is contained in `fname`;
we also need to ensure that `fname` is properly separated.  And of
course, `fname` has to start with `base`.
2021-08-23 23:25:16 -07:00
Máté Kocsis
2d47447d66 Add a few missing RETURN_THROWS();
Only PharFileInfo::compress() really needs it though.
2021-05-27 16:31:18 +02:00
Nikita Popov
44192ce80b Make Phar $fileNotFoundScript nullable
While "" is already treated the same way as absence, null is the
logically correct default here. Making this one argument non-nullable
is particularly pecular when considering that the preceding $alias
and $index arguments are both nullable.
2021-02-09 12:55:33 +01:00
Christoph M. Becker
cfae999f1b Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #69279: Compressed ZIP Phar extractTo() creates garbage files
2021-01-19 10:30:28 +01:00
Christoph M. Becker
68f5289e9e Fix #69279: Compressed ZIP Phar extractTo() creates garbage files
When extracting compressed files from an uncompressed Phar, we must not
use the direct file pointer, but rather get an uncompressed file
pointer.

We also add a test to show that deflated and stored entries are
properly extracted.

This also fixes #79912, which appears to be a duplicate of #69279.

Co-authored-by: Anna Filina <afilina@gmail.com>

Closes GH-6599.
2021-01-19 10:28:54 +01:00
Christoph M. Becker
afc69e46b8 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix memory leak in Phar::webPhar() on Windows
2021-01-05 14:25:44 +01:00
Christoph M. Becker
5c963731e2 Fix memory leak in Phar::webPhar() on Windows
Closes GH-6574.
2021-01-05 14:21:35 +01:00
Nikita Popov
ad7e231e81 Make compression_type nullable in a few more places
Missed that this was also used elsewhere...
2020-10-08 17:05:38 +02:00
Nikita Popov
9719d6cade Make Phar $format and $compression arguments nullable
Rather than using Greg's birthday, use null to indicate that the
existing format/compression should be retained. For the format
simply using zero would be sufficient, but as the documentation
explicitly says that NULL is allowed here, we may as well make
that the truth.
2020-10-08 13:12:22 +02:00
Máté Kocsis
c98d47696f
Consolidate new union type ZPP macro names
They will now follow the canonical order of types. Older macros are
left intact due to maintaining BC.

Closes GH-6112
2020-09-11 11:00:18 +02:00
Máté Kocsis
628db3f3b5
Fix UNKNOWN default values in various extensions
Closes GH-6075
2020-09-07 19:02:02 +02:00
Máté Kocsis
be5ba20132
Promote warnings to exceptions in ext/phar
Closes GH-6008
2020-08-25 11:57:37 +02:00
Máté Kocsis
046cc5e4c2
Add another round of missing parameter types to stubs
Closes GH-5950
2020-08-07 16:48:45 +02:00
Máté Kocsis
7b9f37c389
Fix ZPP order in ext/phar 2020-08-07 16:47:50 +02:00
Tyson Andre
0c238ede01 [RFC] Only unserialize Phar metadata when getMetadata() is called
In other words, don't automatically unserialize when the magic
phar:// stream wrappers are used.
RFC: https://wiki.php.net/rfc/phar_stop_autoloading_metadata

Also, change the signature from `getMetadata()`
to `getMetadata(array $unserialize_options = [])`.
Start throwing earlier if setMetadata() is called and serialization threw.

See https://externals.io/message/110856 and
https://bugs.php.net/bug.php?id=76774

This was refactored to add a phar_metadata_tracker for the following reasons:
- The way to properly copy a zval was previously implicit and undocumented
  (e.g. is it a pointer to a raw string or an actual value)
- Avoid unnecessary serialization and unserialization in the most common case
- If a metadata value is serialized once while saving a new/modified phar file,
  this allows reusing the same serialized string.
- Have as few ways to copy/clone/lazily parse metadata (etc.) as possible,
  so that code changes can be limited to only a few places in the future.
- Performance is hopefully not a concern - copying a string should be faster
  than unserializing a value, and metadata should be rare in most cases.

Remove unnecessary skip in a test(Compression's unused)

Add additional assertions about usage of persistent phars

Improve robustness of `Phar*->setMetadata()`

- Add sanity checks for edge cases freeing metadata, when destructors
  or serializers modify the phar recursively.
- Typical use cases of php have phar.readonly=1 and would not be affected.

Closes GH-5855
2020-08-03 13:28:51 -04:00
Nikita Popov
2160f5ce59 Call zpp_none in PharFileInfo::__destruct()
Using __destruct() with internal classes is dubious, but not so
simple to avoid here because the code extends SPL classes.
2020-07-21 10:18:33 +02:00
Max Semenik
2b5de6f839
Remove proto comments from C files
Closes GH-5758
2020-07-06 21:13:34 +02:00
Nikita Popov
785497c8ba Fix leaks in Phar::webPhar() 2020-06-25 15:42:56 +02:00
Nikita Popov
15846ff115 Add ZVAL_OBJ_COPY macro
For the common ZVAL_OBJ + GC_ADDREF pattern.
This mirrors the existing ZVAL_STR_COPY API.
2020-06-17 16:36:56 +02:00
Nikita Popov
257dbb0450 Add zend_call_known_function() API family
This adds the following APIs:

void zend_call_known_function(
    zend_function *fn, zend_object *object, zend_class_entry *called_scope,
    zval *retval_ptr, int param_count, zval *params);

void zend_call_known_instance_method(
    zend_function *fn, zend_object *object, zval *retval_ptr, int param_count, zval *params);
void zend_call_known_instance_method_with_0_params(
    zend_function *fn, zend_object *object, zval *retval_ptr);
void zend_call_known_instance_method_with_1_params(
    zend_function *fn, zend_object *object, zval *retval_ptr, zval *param);
void zend_call_known_instance_method_with_2_params(
    zend_function *fn, zend_object *object, zval *retval_ptr, zval *param1, zval *param2);

These are used to perform a call if you already have the
zend_function you want to call. zend_call_known_function()
is the base API, the rest are just really thin wrappers around
it for the common case of instance method calls.

Closes GH-5692.
2020-06-09 16:21:54 +02:00
twosee
88355dd338 Constify char * arguments of APIs
Closes GH-5676.
2020-06-08 10:38:45 +02:00
George Peter Banyard
3092a1ee12 Fix [-Wundef] warning in PHAR extension 2020-05-20 18:22:10 +02:00
Máté Kocsis
c6485535c2
Generate method entries from stubs for curl, ffi, pdo, phar
Closes GH-5375
2020-04-14 11:49:02 +02:00
Christoph M. Becker
7248341ea6 Fix # 79171: heap-buffer-overflow in phar_extract_file
We must not access memory outside of the allocated buffer.
2020-02-17 00:20:31 -08:00
Stanislav Malyshev
bcbc053dc1 Fix bug #79082 - Files added to tar with Phar::buildFromIterator have all-access permissions 2020-02-17 00:20:31 -08:00
Christoph M. Becker
b01b1f65e7 Fix # 79171: heap-buffer-overflow in phar_extract_file
We must not access memory outside of the allocated buffer.
2020-02-17 00:20:17 -08:00
Stanislav Malyshev
bbcb8cab8c Fix bug #79082 - Files added to tar with Phar::buildFromIterator have all-access permissions 2020-02-17 00:20:17 -08:00
Christoph M. Becker
7df594b943 Fix # 79171: heap-buffer-overflow in phar_extract_file
We must not access memory outside of the allocated buffer.
2020-02-17 00:20:04 -08:00
Stanislav Malyshev
6facfa59a5 Fix bug #79082 - Files added to tar with Phar::buildFromIterator have all-access permissions 2020-02-17 00:19:30 -08:00
Christoph M. Becker
9a5ea0de69 Merge branch 'PHP-7.4'
* PHP-7.4:
  Fix #76584: PharFileInfo::decompress not working
2020-01-28 10:40:00 +01:00
Christoph M. Becker
e197f65b35 Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
  Fix #76584: PharFileInfo::decompress not working
2020-01-28 10:33:10 +01:00
Christoph M. Becker
136f51f1e1 Fix #76584: PharFileInfo::decompress not working
We actually have to decompress, when told to do so.
2020-01-28 10:31:36 +01:00
Máté Kocsis
d1764ca330
Make error messages more consistent by fixing capitalization
Closes GH-5066 As a first step, let's capitalize their initial letter when it is applicable.
2020-01-17 14:52:46 +01:00
Máté Kocsis
aadd3aaed9
Use RETURN_THROWS() in various places 2020-01-03 21:10:24 +01:00
Máté Kocsis
01a50778d1
Use RETURN_THROWS() after zend_throw_exception() in most of the extensions 2020-01-02 10:56:18 +01:00
Máté Kocsis
345703724c
Use RETURN_THROWS() during ZPP in most of the extensions
Except for some bigger ones: reflection, sodium, spl
2019-12-31 11:46:11 +01:00
Dylan T
01875e8b26 phar: fix offset*() prototypes 2019-12-13 10:41:50 +01:00
Christoph M. Becker
4d067d811d Add ext/phar arginfo stubs 2019-11-02 11:55:11 +01:00
Christoph M. Becker
4008704f62 zend_parse_parameters_throw() is obsolete
Since `zend_parse_parameters()` throws now, there is no reason to
explicitly call `zend_parse_parameters_throw()` anymore, and since both
have actually the same implementation, we redefine the latter as macro.
2019-11-01 16:47:15 +01:00
Máté Kocsis
9493893412 Cleanup return values when parameter parsing is unsuccessful 2019-10-30 16:05:20 +01:00
Christoph M. Becker
375ceefec0 Add missing zend_parse_parameters_none() 2019-10-05 18:22:01 +02:00
Stanislav Malyshev
e043025fda Merge branch 'PHP-7.4'
* PHP-7.4:
  Fix #77919: Potential UAF in Phar RSHUTDOWN
  Update NEWS
  Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
2019-07-29 13:20:59 -07:00
Stanislav Malyshev
4adf3dc109 Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
  Fix #77919: Potential UAF in Phar RSHUTDOWN
  Update NEWS
  Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
2019-07-29 13:20:52 -07:00
Stanislav Malyshev
d69894734d Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2:
  Fix #77919: Potential UAF in Phar RSHUTDOWN
  Update NEWS
  Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
2019-07-29 13:20:44 -07:00
Stanislav Malyshev
284fb08fdc Merge branch 'PHP-7.1' into PHP-7.2
* PHP-7.1:
  Fix #77919: Potential UAF in Phar RSHUTDOWN
  Update NEWS
  Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
2019-07-29 13:19:16 -07:00
Christoph M. Becker
cd1101e8c8 Fix #77919: Potential UAF in Phar RSHUTDOWN
We have to properly clean up in case phar_flush() is failing.

We also make the expectation of the respective test case less liberal
to avoid missing such bugs in the future.
2019-07-29 13:18:27 -07:00
Nikita Popov
3faa903d47 Merge branch 'PHP-7.4' 2019-07-16 16:44:46 +02:00
Nikita Popov
49bac9b77b Introduce zend_stream_init_filename()
Avoid more ad-hoc initialization of zend_file_handle structures.
2019-07-16 16:44:37 +02:00