Commit graph

1863 commits

Author SHA1 Message Date
Ilija Tovilo
f5c54fd88b
Fix access on NULL pointer in array_merge_recursive()
Closes GH-11303
2023-05-24 13:36:52 +02:00
Dmitry Stogov
0c65b396d6
Allow FETCH_OBJ_W and FETCH_STATIC_PROP_W to return INDIRECT/UNDEF zval for uninitialized typed properties (#11048) 2023-04-10 23:19:17 +03:00
Ilija Tovilo
7b68ff46da
Revert "Fix GH-10168: heap-buffer-overflow at zval_undefined_cv"
This reverts commit 71ddede565.
2023-02-16 14:07:17 +01:00
Arnaud Le Blanc
d721dcc2ef Fix colletion of unfinished function call in fibers
Fixes GH-10496.

Co-authored-by: Bob Weinand <bobwei9@hotmail.com>
2023-02-13 13:09:04 +01:00
Niels Dossche
71ddede565
Fix GH-10168: heap-buffer-overflow at zval_undefined_cv
The problem is that we're using the variable_ptr in the opcode handler
*after* it has already been destroyed. The solution is to create a
specialised version of zend_assign_to_variable which takes in two
destination zval pointers.

Closes GH-10524
2023-02-08 01:06:50 +01:00
Niels Dossche
0801c567dc Fix GH-10248: Assertion `!(zval_get_type(&(*(property))) == 10)' failed.
The assertion failure was triggered in a debug code-path that validates
property types for internal classes.
zend_verify_internal_read_property_type was called with retval being a
reference, which is not allowed because that function eventually calls to
i_zend_check_property_type, which does not expect a reference.
The non-debug code-path already takes into account that retval can be a
reference, as it optionally dereferences retval.

Add a dereference in zend_verify_internal_read_property_type just before
the call to zend_verify_property_type, which is how other callers often
behave as well.
2023-01-20 16:40:15 +01:00
Arnaud Le Blanc
4fb149390a
GC fiber unfinished executions (#9810) 2023-01-13 12:04:28 +01:00
Arnaud Le Blanc
4011657719 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  [ci skip] NEWS
  Fix generator memory leaks when interrupted during argument evaluation (#9756)
2022-11-04 15:59:14 +01:00
Arnaud Le Blanc
5d1f3e047c
Fix generator memory leaks when interrupted during argument evaluation (#9756) 2022-11-04 15:55:55 +01:00
Ilija Tovilo
110573726b
Disallow assigning reference to unset readonly property
Closes GH-7942
Closes GH-8188
2022-07-01 12:16:32 +02:00
Dmitry Stogov
718478377b Prevent array modification if it's captured by user error handler during
index conversion

Fixes oss-fuzz #44235
2022-02-01 17:22:18 +03:00
Dmitry Stogov
b16fc350a4 Move common code into helper 2021-12-14 15:31:53 +03:00
Dmitry Stogov
1e56b64759 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Combine ADDREF/DELREF
2021-12-13 22:54:45 +03:00
Dmitry Stogov
c787f42ceb Combine ADDREF/DELREF 2021-12-13 22:38:23 +03:00
Dmitry Stogov
76075823e7 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix array clobering by user error handler
2021-12-13 15:20:16 +03:00
Dmitry Stogov
cbc0b1afeb Fix array clobering by user error handler
Fixes oss-fuzz #42234
2021-12-13 14:59:30 +03:00
Dmitry Stogov
08f1d470fb Separate "cold" code 2021-12-07 11:46:32 +03:00
Dmitry Stogov
5459ed4c2f Fix use after free because of data clobbering by user error handler
Fixes oss-fuzz #41692
2021-12-06 13:08:27 +03:00
Dmitry Stogov
731ce6be01 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix array object clobbering by user error handler
2021-12-03 13:36:33 +03:00
Dmitry Stogov
1d054b3fa7 Fix array object clobbering by user error handler
Fixes oss-fuss #41605 and #41610
2021-12-03 13:35:28 +03:00
Dmitry Stogov
b9ff359a99 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Add missing zend_string_release_ex(tmp, 0) and cleanup
2021-12-02 11:21:04 +03:00
Dmitry Stogov
37ac707cac Add missing zend_string_release_ex(tmp, 0) and cleanup
- use GC_DELREF() instead of zend_string_release_ex()
- add expectations for exceptional cases
- replace IS_ARRAY_IMMUTABLE by IS_STR_INTERNED
2021-12-02 11:18:08 +03:00
Dmitry Stogov
4eaba3e2ed Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fixed ext/bz2/tests/005.phpt test failure introduesed by 09547c64c2
2021-12-02 10:34:14 +03:00
Dmitry Stogov
df16da3697 Fixed ext/bz2/tests/005.phpt test failure introduesed by 09547c64c2 2021-12-02 10:32:45 +03:00
Dmitry Stogov
e833e5cfa0 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix clobering of operand by error handler in assignment to string offset (optimization and JIT support)
2021-12-02 01:20:48 +03:00
Dmitry Stogov
4595a57e99 Fix clobering of operand by error handler in assignment to string offset (optimization and JIT support) 2021-12-02 01:20:17 +03:00
Dmitry Stogov
9786eac9a3 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix clobering of operand by error handler in assignment to string offset
2021-12-02 00:46:27 +03:00
Dmitry Stogov
09547c64c2 Fix clobering of operand by error handler in assignment to string offset
In some cases new code requires two reallocations insead of one.

Fixes oss-fuzz #31716, #36196, #39739 and #40002
2021-12-02 00:24:05 +03:00
Dmitry Stogov
10cfe9f13b Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Use proper functions
2021-12-01 22:45:15 +03:00
Dmitry Stogov
9f6ab78610 Use proper functions 2021-12-01 22:43:19 +03:00
Dmitry Stogov
b594a95a2f Fixed crash in ZEND_ASSIGN_DIM_OP because of array cloberring by user error handler
Fixes oss-fuzz #36214
2021-11-30 23:33:34 +03:00
Dmitry Stogov
afd881718e Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix crash after indirect modification of string by user error handler
2021-11-30 16:09:58 +03:00
Dmitry Stogov
df434f056f Fix crash after indirect modification of string by user error handler
Fixes oss-fuzz #39346
2021-11-30 16:07:38 +03:00
Nikita Popov
dab6527352 Fix build without global registers 2021-10-05 16:45:44 +02:00
Nikita Popov
a4fa00ead3 Reuse wrong string offset logic in jit
JIT contains a copy of this function that effectively only differs
by fetching current_execute_data from EG. We can do that in the VM
version as well, as this is just used to throw an error.

Export the VM function and reuse it in JIT.
2021-10-05 16:33:31 +02:00
Nikita Popov
14f599ea7d Use zend_long for resource ID
Currently, resource IDs are limited to 32-bits. As resource IDs
are not reused, this means that resource ID overflow for
long-running processes is very possible.

This patch switches resource IDs to use zend_long instead, which
means that on 64-bit systems, 64-bit resource IDs will be used.
This makes resource ID overflow practically impossible.

The tradeoff is an 8 byte increase in zend_resource size.

Closes GH-7436.
2021-08-31 14:58:59 +02:00
Nikita Popov
5b2ddf5a17 Export zend_use_resource_as_offset()
Use a common implementation to generate this error message, as
we do so in quite a few places dealing with array keys.
2021-08-31 10:58:01 +02:00
Nikita Popov
315f40942b
Always use CE_CACHE, remove TYPE_HAS_CE (#7336)
Currently, CE_CACHE on strings is only used with opcache interned strings. This
patch extends usage to non-opcache interned strings as well. This means that
most type strings can now make use of CE_CACHE even if opcache is not loaded,
which allows us to remove TYPE_HAS_CE kind, and fix some discrepancies
depending on whether a type stores a resolved or non-resolved name.

There are two cases where CE_CACHE will not be used:

 * When opcache is not used and a permanent interned string (that is not an
   internal class name) is used as a type name during the request. In this case
   we can't allocate a map_ptr index for the permanent string, as it would be
   not be in the permanent map_ptr index space.
 * When opcache is used but the script is not cached (e.g. eval'd code or
   opcache full). If opcache is used, we can't allocate additional map_ptr
   indexes at runtime, because they may conflict with indexes allocated by
   opcache.

In these two cases we would end up not using CE caching for property types
(argument/return types still have the separate cache slot).
2021-08-11 10:28:52 +02:00
Joe Watkins
05ef6334cd
Fix bug #81303 improve match errors 2021-08-02 17:31:26 +02:00
Nikita Popov
7b85d3bbdd Add support for verifying optimizer func info
This is guarded by -DZEND_VERIFY_FUNC_INFO=1. Enable this on the
variation job.

Closes GH-6924.
2021-07-21 12:24:30 +02:00
Levi Morrison
ae8647d9d3
Remove leading underscore for _zend_hash_find_known_hash (#7260)
Convert zend_hash_find_ex(..., 1) to zend_hash_find_known_hash(...)
Convert zend_hash_find_ex(..., 0) to zend_hash_find(...)

Also add serializable changes to UPGRADING.INTERNALS summary
2021-07-20 17:07:17 -06:00
Nikita Popov
c50f4dece0 Fix typo in comment
[ci skip]
2021-07-20 12:44:05 +02:00
Nikita Popov
6780aaa532 Implement readonly properties
Add support for readonly properties, for which only a single
initializing assignment from the declaring scope is allowed.

RFC: https://wiki.php.net/rfc/readonly_properties_v2

Closes GH-7089.
2021-07-20 12:05:46 +02:00
Kamil Tekiela
052af90b86 Deprecate autovivification on false
Deprecate automatically converting "false" into an empty array
on write operands. Autovivification continues to be supported
for "null" values, as well as undefined/uninitialized values.

RFC: https://wiki.php.net/rfc/autovivification_false

Closes GH-7131.

Co-authored-by: Tyson Andre <tysonandre775@hotmail.com>
Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>
2021-07-19 14:49:37 +02:00
Nikita Popov
ee65e92070 Check internal function type consistency in zend_call_function
We do this for calls in the engine, but not those going through
zend_call_function().
2021-07-13 11:50:07 +02:00
Nikita Popov
a80360dbed Deprecate direct access to static trait members
Static trait members may only be accessed through a class in which
the trait is used, not directly on the trait.

A complication here is that we should not store static
methods/properties for which a deprecation is triggered in a
cache slot. As the check for this is simple and cheap, I'm handling
this in the cache slot population code in the VM. The alternative
would be to pass the cache slot down into the fetching code.

Part of https://wiki.php.net/rfc/deprecations_php_8_1.
2021-07-09 14:12:28 +02:00
George Peter Banyard
069a9fa5e4
Pure Intersection types (#6799)
Implement pure intersection types RFC

RFC: https://wiki.php.net/rfc/pure-intersection-types

Co-authored-by: Nikita Popov <nikic@php.net>
Co-authored-by: Ilija Tovilo <ilutov@php.net>
2021-07-05 14:11:03 +02:00
Nikita Popov
629965c80f Handle promoted exception in int|string type
Fixes oss-fuzz #35790.
2021-07-05 10:48:20 +02:00
Nikita Popov
3321440166 Merge branch 'PHP-8.0'
* PHP-8.0:
  Fix return value of wrong fucntion by-ref assign
2021-07-02 11:18:46 +02:00
Nikita Popov
6617829f1b Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix return value of wrong fucntion by-ref assign
2021-07-02 11:18:09 +02:00