Commit graph

17452 commits

Author SHA1 Message Date
Ilija Tovilo
5286bab392
[skip ci] Skip arginfo_zpp_mismatch on asan
These tests intermittently crash asan. It might be due to some function invoking
dl(), which is known to crash lsan. It might also be something else, the version
of asan shipped with ubuntu 22.04 is flaky.
2023-09-11 11:32:34 +02:00
Ilija Tovilo
748adf18fc
Fix zend_separate_if_call_and_write for FUNC_ARGs
Fixes GH-12102
Closees GH-12140
2023-09-07 14:25:11 +02:00
ju1ius
da7a66d647 Prevents double call to internal iterator rewind handler
Closes GH-12060

Signed-off-by: George Peter Banyard <girgias@php.net>
2023-09-05 10:26:19 +01:00
Dmitry Stogov
f1f608bf53 Fixed uninitialized EX(opline) access (possible Zend/tests/gh12073.phpt crash) 2023-09-05 10:11:54 +03:00
Ilija Tovilo
af2110e664
Fix freeing of incompletely initialized closures
Addref to relevant fields before allocating any memory. Also only set/remove the
ZEND_ACC_HEAP_RT_CACHE flag after allocating memory.

Fixes GH-12073
Closes GH-12074
2023-09-04 15:35:39 +02:00
Ilija Tovilo
dd01c74a6f
Remove redundant condition
Never refactor code just before pushing
2023-08-17 18:54:30 +02:00
Ilija Tovilo
f78d1d0d10
Fix segfault in format_default_value due to unexpected enum/object
Evaluating constants at comptime can result in arrays that contain objects. This
is problematic for printing the default value of constant ASTs containing
objects, because we don't actually know what the constructor arguments were.
Avoid this by not propagating array constants.

Fixes GH-11937
Closes GH-11947
2023-08-17 18:43:11 +02:00
Patrick Allaert
6e3f93f2f8
PHP-8.1 is now for PHP 8.1.24-dev 2023-08-15 21:09:58 +02:00
Kévin Dunglas
96885bc04f fix: handle the GNU specific version of strerror_r
Close GH-11882
2023-08-07 19:01:24 +01:00
Ilija Tovilo
ed27d70d9a
Fix use-of-uninitialized-value in start_fake_frame
Closes GH-11732
2023-08-03 09:49:51 +02:00
Dmitry Stogov
4553258df3 Fixed incorrect tracked malloc deallocation
Fixes ext/ffi/tests/list.phpt failure
2023-08-01 16:01:11 +03:00
Dmitry Stogov
b5f8a7270a Fixed incorrect QM_ASSIGN elimination
Fixes OSS Fuzz #60895
2023-07-31 14:50:13 +03:00
Dmitry Stogov
9fc0eab4b4 Fixed incorrect QM_ASSIGN elimination
Fixes OSS Fuzz #60735
2023-07-24 15:42:30 +03:00
Niels Dossche
af77d3b8da Fix GH-11716: cli server crashes on SIGINT when compiled with ZEND_RC_DEBUG=1
Closes GH-11757.
2023-07-21 15:23:56 +02:00
Ben Ramsey
6e3c520f51
PHP-8.1 is now for PHP-8.1.23-dev 2023-07-18 16:30:49 -05:00
David Carlier
69b4360e88 zend_gdb disable gdb detection for FreeBSD < 11.
ref PR: https://github.com/php/php-src/pull/11599.

Close GH-11646
2023-07-13 12:39:58 +01:00
Ilija Tovilo
b1b7c61a27
Always memoize assert
Closes GH-11686
2023-07-12 16:35:09 +02:00
Ilija Tovilo
84a2e48050
Fix use-of-uninitialized-value with ??= on assert
Normally, PHP evaluates all expressions in offsets (property or array), as well
as the right hand side of assignments before actually fetching the offsets. This
is well explained in this blog post.

https://www.npopov.com/2017/04/14/PHP-7-Virtual-machine.html#writes-and-memory-safety

For ??= we have a bit of a problem in that the rhs must only be evaluated if the
lhs is null or undefined. Thus, we have to first compile the lhs with BP_VAR_IS,
conditionally run the rhs and then re-fetch the lhs with BP_VAR_W to to make
sure the offsets are valid if they have been invalidated.

However, we don't want to just re-evaluate the entire lhs because it may contain
side-effects, as in $array[$x++] ??= 42;. In this case, we don't want to
re-evaluate $x++ because it would result in writing to a different offset than
was previously tested. The same goes for function calls, like
$array[foo()] ??= 42;, where the second call to foo() might result in a
different value. PHP behaves correctly in these cases. This is implemented by
memoizing sub-expressions in the lhs of ??= and reusing them when compiling the
lhs for the second time. This is done for any expression that isn't a variable,
i.e. anything that can (potentially) be written to.

Unfortunately, this also means that function calls are considered writable due
to their return-by-reference semantics, and will thus not be memoized. The
expression foo()['bar'] ??= 42; will invoke foo() twice. Even worse,
foo(bar()) ??= 42; will call both foo() and bar() twice, but
foo(bar() + 1) ??= 42; will only call foo() twice. This is likely not by design,
and was just overlooked in the implementation. The RFC does not specify how
function calls in the lhs of the coalesce assignment behaves. This should
probably be improved in the future.

Now, the problem this commit actually fixes is that ??= may memoize expressions
inside assert() function calls that may not actually execute. This is not only
an issue when using the VAR in the second expression (which would usually also
be skipped) but also when freeing the VAR. For this reason, it is not safe to
memoize assert() sub-expressions.

There are two possible solutions:

1. Don't memoize any sub-expressions of assert(), meaning they will execute
   twice.
2. Throw a compile error.

Option 2 is not quite simple, because we can't disallow all memoization inside
assert(), as that would break assertions like assert($array[foo()] ??= 'bar');.
Code like this is highly unlikely (and dubious) but possible. In this case, we
would need to make sure that a memoized value could not be used across the
assert boundary it was created in. The complexity for this is not worthwhile. So
we opt for option 1 and disable memoization immediately inside assert().

Fixes GH-11580
Closes GH-11581
2023-07-06 09:38:41 +02:00
Ilija Tovilo
dc73b73f8b
Fix mis-compilation of by-reference nullsafe operator
Fixes oss-fuzz #60011
Closes GH-11540

Co-authored-by: Dmitry Stogov <dmitry@zend.com>
Co-authored-by: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
2023-06-28 20:35:29 +02:00
Patrick Allaert
6c4b1e0417
PHP-8.1 is now for PHP 8.1.22-dev 2023-06-20 16:07:05 +02:00
Dmitry Stogov
06d68738b7
Keep consistent EG(current_execute_data) after return from generator (#11380) 2023-06-08 14:55:18 +03:00
Ilija Tovilo
b2ec6c24f8
Fix exception handling in array_multisort()
Closes GH-11302
2023-05-24 13:55:25 +02:00
Ilija Tovilo
f5c54fd88b
Fix access on NULL pointer in array_merge_recursive()
Closes GH-11303
2023-05-24 13:36:52 +02:00
Ben Ramsey
2f2fd06be0
PHP-8.1 is now for PHP 8.1.21-dev 2023-05-23 16:19:16 -05:00
Niels Dossche
5cad1a7176 Fix GH-11245 (In some specific cases SWITCH with one default statement will cause segfault)
The block optimizer pass allows the use of sources of the preceding
block if the block is a follower and not a target. This causes issues
when trying to remove FREE instructions: if the source is not in the
block of the FREE, then the FREE and source are still removed. Therefore
the other successor blocks, which must consume or FREE the temporary,
will still contain the FREE opline. This opline will now refer to a
temporary that doesn't exist anymore, which most of the time results in
a crash. For these kind of non-local scenarios, we'll let the SSA
based optimizations handle those cases.

Closes GH-11251.
2023-05-23 00:33:25 +02:00
Ilija Tovilo
8f66b67ccf
Fix compilation for PHP 8.1
Accidentally introduced in 175ff603c3. arData was
not part of an anonymous union.
2023-05-10 23:59:53 +02:00
Bob Weinand
975d28e278 Fix GH-11222: foreach by-ref may jump over keys during a rehash
Signed-off-by: Bob Weinand <bobwei9@hotmail.com>
2023-05-10 16:45:05 +02:00
Amedeo Baragiola
175ff603c3
Fix compilation error on old GCC versions
In older versions of GCC (<=4.5) designated initializers would not accept member
names nested inside anonymous structures. Instead, we need to use a positional
member wrapped in {}.

Fixes GH-11063
Closes GH-11212
2023-05-10 11:55:13 +02:00
Bob Weinand
05bd1423ee Fix GH-11189: Exceeding memory limit in zend_hash_do_resize leaves the array in an invalid state
There are more places in zend_hash.c where the resize happened after some values on the HashTable struct were set.
I reordered them all, but writing a test for these would rely on the particular amount of bytes allocated at given points in time.
2023-05-05 12:04:40 +02:00
nielsdos
4ca8daf3ed Fix GH-9068: Conditional jump or move depends on uninitialised value(s)
This patch preserves the scratch registers of the SysV x86-64 ABI by storing
them to the stack and restoring them later. We need to do this to prevent the
registers of the caller from being corrupted. The reason these get corrupted
is because the compiler is unaware of the Valgrind replacement function and
thus makes assumptions about the original function regarding registers which
are not true for the replacement function.

For implementation I used a GCC and Clang attribute. A more general
approach would be to use inline assembly but that's also less portable
and quite hacky. This attributes is supported since GCC 7.x, but the
target option is only supported since 11.x. For Clang the target option
does not matter.

Closes GH-10221.
2023-05-03 19:39:05 +02:00
nielsdos
fbf5216ca0 Fix too wide OR and AND range inference
There is a typo which causes the AND and OR range inference to infer a
wider range than necessary. Fix this typo. There are many ranges for
which the inference is too wide, I just picked one for AND and one for
OR that I found through symbolic execution.

In this example test, the previous range inferred for test_or was [-27..-1]
instead of [-20..-1].
And the previous range inferred for test_and was [-32..-25]
instead of [-28..-25].

Closes GH-11170.
2023-05-02 20:08:59 +02:00
Ilija Tovilo
dc20cd9c3a
Endless recursion when using + on array in foreach
This reverts commit 84b4020eb4.

Fixes GH-11171
2023-05-01 13:20:58 +02:00
Ilija Tovilo
8bf2d587d7
Propagate STREAM_DISABLE_OPEN_BASEDIR src flag to php_stream_stat_path_ex
Otherwise we can get open_basedir warnings from the stat call while still
performing the actual copy.

Fixes GH-11138
Closes GH-11156
2023-04-30 13:36:15 +02:00
Ilija Tovilo
3a76f795f8
Fix incorrect match default branch optimization
Fixes GH-11134
Closes GH-11135
2023-04-26 15:19:20 +02:00
Patrick Allaert
725f136f9a
PHP-8.1 is now for PHP 8.1.20-dev 2023-04-25 16:18:30 +02:00
Niels Dossche
691ff9f845 Set error_log to an empty value if the test relies on that feature
Some tests fail if the error_log is overriden by the loaded ini
configuration. Explicitly set it to an empty value to prevent the
failures.
See https://github.com/php/php-src/issues/10737#issuecomment-1452899299

Closes GH-10772.
2023-04-24 23:19:15 +02:00
Ilija Tovilo
4c38a79f09
Fix incorrect CG(memoize_mode) state after bailout in ??=
Fixes GH-11108
Closes GH-11109
2023-04-20 19:45:02 +02:00
Ilija Tovilo
5855bdcd6c
Fix reference returned from CallbackFilterIterator::accept()
Fixes oss-fuzz #58181
2023-04-20 10:18:18 +02:00
Ilija Tovilo
e8b8341d3d
Support enums in array_unique
Fixes GH-9775
Closes GH-11015
2023-04-16 15:34:56 +02:00
Jakub Zelenka
0ac55e9bfb
Add zend_test_crash funtion to segfault PHP process
This is useful for testing PHP-FPM handling of crashed children.

Closes GH-11082
2023-04-15 21:25:02 +01:00
Niels Dossche
fc32d39b7f Fix GH-11028: Heap Buffer Overflow in zval_undefined_cv.
For analysis see https://github.com/php/php-src/issues/11028#issuecomment-1508460440

Closes GH-11083.
2023-04-15 18:22:55 +02:00
Dmitry Stogov
0c65b396d6
Allow FETCH_OBJ_W and FETCH_STATIC_PROP_W to return INDIRECT/UNDEF zval for uninitialized typed properties (#11048) 2023-04-10 23:19:17 +03:00
Ilija Tovilo
84b4020eb4
Fix add_function_array() assertion when op2 contains op1
Fixes GH-10085
Closes GH-10975
Co-authored-by: Dmitry Stogov <dmitry@zend.com>
2023-04-03 12:48:46 +02:00
Niels Dossche
cf9b030a57 Fix GH-8841: php-cli core dump calling a badly formed function
It's actually not php-cli specific, nor SAPI specific.
We should delay the registration of the function into the function table
until after the compilation was successful, otherwise the function is
mistakingly registered and a NULL dereference will happen when trying to
call it.

I based my test of Nikita's test, so credits to him for the test:
https://github.com/php/php-src/pull/8933#issuecomment-1259881008

Closes GH-10989.
2023-04-01 19:43:09 +02:00
Ilija Tovilo
41bbb116dd
Unary minus const expression consistency
- of 0.0 should result in -0.0

Closes GH-10978
2023-03-31 14:27:54 +02:00
Ben Ramsey
d9df750b22
PHP-8.1 is now for PHP 8.1.19-dev 2023-03-29 19:51:20 -05:00
Ilija Tovilo
4e0bd03681
Reset EG(trampoline).op_array.last_var that FFI may modify
Closes GH-10916
2023-03-27 22:59:00 +02:00
Niels Dossche
93e0f6b424 Fix undefined behaviour in string uppercasing and lowercasing
At least on 32-bit, the address computations overflow in running the
test on CI with UBSAN enabled. Fix it by reordering the arithmetic.
Since a part of the expression is already used in the code above the
computation, this should not negatively affect performance.

Closes GH-10936.
2023-03-25 21:17:15 +01:00
Ilija Tovilo
9aaa5cd093
By-ref modification of typed and readonly props through ArrayIterator
Fixes GH-10844
Closes GH-10872
2023-03-25 16:14:19 +01:00
Ilija Tovilo
b5726c2cb1
Fix NUL byte in exception string terminating Exception::__toString()
Fixes GH-10810
Closes GH-10873
2023-03-19 10:48:26 +01:00