Commit graph

86 commits

Author SHA1 Message Date
KsaR
01b3fc03c3
Update http->https in license (#6945)
1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |
2021-05-06 12:16:35 +02:00
Tyson Andre
0c238ede01 [RFC] Only unserialize Phar metadata when getMetadata() is called
In other words, don't automatically unserialize when the magic
phar:// stream wrappers are used.
RFC: https://wiki.php.net/rfc/phar_stop_autoloading_metadata

Also, change the signature from `getMetadata()`
to `getMetadata(array $unserialize_options = [])`.
Start throwing earlier if setMetadata() is called and serialization threw.

See https://externals.io/message/110856 and
https://bugs.php.net/bug.php?id=76774

This was refactored to add a phar_metadata_tracker for the following reasons:
- The way to properly copy a zval was previously implicit and undocumented
  (e.g. is it a pointer to a raw string or an actual value)
- Avoid unnecessary serialization and unserialization in the most common case
- If a metadata value is serialized once while saving a new/modified phar file,
  this allows reusing the same serialized string.
- Have as few ways to copy/clone/lazily parse metadata (etc.) as possible,
  so that code changes can be limited to only a few places in the future.
- Performance is hopefully not a concern - copying a string should be faster
  than unserializing a value, and metadata should be rare in most cases.

Remove unnecessary skip in a test(Compression's unused)

Add additional assertions about usage of persistent phars

Improve robustness of `Phar*->setMetadata()`

- Add sanity checks for edge cases freeing metadata, when destructors
  or serializers modify the phar recursively.
- Typical use cases of php have phar.readonly=1 and would not be affected.

Closes GH-5855
2020-08-03 13:28:51 -04:00
Nikita Popov
2bfcd8825c Remove now unnecessary PHP_FUNCTION() declarations 2020-04-03 15:41:41 +02:00
Nikita Popov
1cde9e8528 Merge branch 'PHP-7.4' 2019-09-30 10:30:20 +02:00
Nikita Popov
1806ce9cb0 Add max_depth option to unserialize()
Add a max_depth option to unserialize and an unserialize_max_depth
ini setting, which can be used to control the depth limit. The
default value is 4096.

This option is intended to prevent stack overflows during the
unserialization of deeply nested structures.

This fixes bug #78549 and addresses oss-fuzz #17581, #17589, #17664,
and #17788.
2019-09-30 10:28:24 +02:00
Gabriel Caruso
5d6e923d46
Remove mention of PHP major version in Copyright headers
Closes GH-4732.
2019-09-25 14:51:43 +02:00
Zeev Suraski
0cf7de1c70 Remove yearly range from copyright notice 2019-01-30 11:03:12 +02:00
Zeev Suraski
38c337f22e Remove year range from copyright notice 2019-01-30 11:00:23 +02:00
Peter Kokot
8d3f8ca12a Remove unused Git attributes ident
The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
user who changed it.

In Git this functionality is different and can be done with Git attribute
ident. These need to be defined manually for each file in the
.gitattributes file and are afterwards replaced with 40-character
hexadecimal blob object name which is based only on the particular file
contents.

This patch simplifies handling of $Id$ keywords by removing them since
they are not used anymore.
2018-07-25 00:53:25 +02:00
Xinchen Hui
a6519d0514 year++ 2018-01-02 12:57:58 +08:00
Sammy Kaye Powers
9e29f841ce Update copyright headers to 2017 2017-01-02 09:30:12 -06:00
Nikita Popov
09f7bb2082 Followup for bug #72785
Fix incorrect handling of nesting ... need to reset to the old
value afterwards.
2016-09-06 12:59:35 +02:00
Stanislav Malyshev
747d21cfd2 Fix bug #72785 - allowed_classes only applies to outermost unserialize() 2016-09-05 19:56:36 -07:00
Nikita Popov
f7caa2bd8e Hide (un)serialize data from ABI
The (UN)SERIALIZE_INIT/DESTROY macros now go through non-inlined
functions, so any changes to them will apply to extensions without
rebuilds.

Additionally, the (un)serialize_data structures are now no longer
exported.

This means that we are allowed to change these structures in patch
releases without breaking the ABI.
2016-08-15 22:42:27 +02:00
Lior Kaplan
ed35de784f Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Happy new year (Update copyright to 2016)
2016-01-01 19:48:25 +02:00
Lior Kaplan
49493a2dcf Happy new year (Update copyright to 2016) 2016-01-01 19:21:47 +02:00
Stanislav Malyshev
feeb2fba93 fix merge 2015-08-04 23:51:55 -07:00
Xinchen Hui
fc33f52d8c bump year 2015-01-15 23:27:30 +08:00
Xinchen Hui
0579e8278d bump year 2015-01-15 23:26:37 +08:00
Stanislav Malyshev
b7a7b1a624 trailing whitespace removal 2015-01-10 15:07:38 -08:00
Anatol Belski
bdeb220f48 first shot remove TSRMLS_* things 2014-12-13 23:06:14 +01:00
Stanislav Malyshev
9d7c5dbed9 secured unserialize
- update for BC-compatible unserialize
- add tests
2014-11-22 22:25:18 -08:00
Nikita Popov
8be73f2650 Fix tests/serialize/bug64146.phpt
The var hash now retains a reference to its elements, to ensure
that addresses are not reused.

Furthermore the var hash now only stores objects and references
and directly uses their pointer as key, thus making serialization
about two times faster.
2014-09-22 23:48:31 +02:00
Nikita Popov
483697617f Remove php_varname_check
This is a leftover from PHP < 5.4.

Also removed the php_create_empty_class declaration, which no longer
exists.
2014-09-22 18:34:40 +02:00
Nikita Popov
e33f3d3b7c Move smart_str implementation into Zend/
So we can use it there as well...

For now I've retained the zend_smart_str_public.h header, though
it would probably be better to just move that one struct into
zend_types.h.
2014-09-21 20:49:39 +02:00
Johannes Schlüter
d0cb715373 s/PHP 5/PHP 7/ 2014-09-19 18:33:14 +02:00
Dmitry Stogov
72c287bd23 Combine HashTable.flags and HashTable.nApplyCount into single 32-bit word 2014-04-21 18:25:34 +04:00
Dmitry Stogov
6bfedfd22e Fixed unserialize() 2014-04-10 18:08:11 +04:00
Xinchen Hui
24540362b0 Re-fixed unserialize 2014-02-26 15:51:53 +08:00
Xinchen Hui
b7052ef16d Revert "Fixed unserialize implementation (it's complicated, this issue took me 4 hours :<, need some review)"
This reverts commit 80a178015d.
2014-02-26 13:33:55 +08:00
Xinchen Hui
80a178015d Fixed unserialize implementation (it's complicated, this issue took me 4 hours :<, need some review) 2014-02-26 12:51:23 +08:00
Dmitry Stogov
398256e5fe Use better data structures (incomplete) 2014-02-14 13:40:11 +04:00
Dmitry Stogov
40e053e7f3 Use better data structures (incomplete) 2014-02-13 17:54:23 +04:00
Xinchen Hui
c081ce628f Bump year 2014-01-03 11:08:10 +08:00
Michael Wallner
1ac4d8f2c6 fix bug #65481 (shutdown segfault due to serialize) 2013-08-20 00:05:11 +02:00
Xinchen Hui
0a7395e009 Happy New Year 2013-01-01 16:28:54 +08:00
Dmitry Stogov
ca77173afb Fixed incorrect type cast 2012-01-11 15:04:14 +00:00
Felipe Pena
4e19825281 - Year++ 2012-01-01 13:15:04 +00:00
Dmitry Stogov
878ada77a0 Added implicit type casting to allow reusage of macros in C++ extensions (Yoram) 2011-11-28 13:01:28 +00:00
Michael Wallner
b6921369b5 Fix Bug #55801 Behavior of unserialize has changed:
(un)serialize in __wakeup/__sleep now use clean var_hashes
2011-10-19 10:09:24 +00:00
Felipe Pena
0203cc3d44 - Year++ 2011-01-01 02:17:06 +00:00
Kalle Sommer Nielsen
208aa1025d Improved performance of unserialize(), original patch by galaxy dot mipt at gmail dot com 2010-09-18 16:09:28 +00:00
Scott MacVicar
c7b0abe6aa Fix a bug when var_export() causes a fatal error that could inadvertently display data due to flushing of the output buffer.
Examples include, memory limit, execution time and recursion.
2010-07-09 21:11:37 +00:00
Stanislav Malyshev
de8022e905 fix SplObjectStorage unserialization (CVE-2010-2225) 2010-06-29 00:58:31 +00:00
Michael Wallner
89e93723fb Added support for object references in recursive serialize() calls. FR #36424 2010-05-26 07:24:37 +00:00
Sebastian Bergmann
9ba1e81665 sed -i "s#1997-2009#1997-2010#g" **/*.c **/*.h **/*.php 2010-01-03 09:23:27 +00:00
Sebastian Bergmann
08659c2dcd MFH: Bump copyright year, 3 of 3. 2008-12-31 11:15:49 +00:00
Sebastian Bergmann
d1dded8751 MFH: Bump copyright year, 2 of 2. 2007-12-31 07:17:19 +00:00
Jani Taskinen
27e8fa0d31 MFH: sync (adds php_prefix_varname() API function) 2007-10-01 12:34:19 +00:00
Antony Dovgal
a69e6e2c79 MFH: improve variable name checks
add more tests
2007-05-22 14:34:23 +00:00