Commit graph

63987 commits

Author SHA1 Message Date
Niels Dossche
ec803292c2
Fix GHSA-w8qr-v226-r27w
We should not early-out with success status if we found an ipv6
hostname, we should keep checking the rest of the conditions.
Because integrating the if-check of the ipv6 hostname in the
"Validate domain" if-check made the code hard to read, I extracted the
condition out to a separate function. This also required to make
a few pointers const in order to have some clean code.
2024-06-04 09:01:13 -04:00
Niels Dossche
39c1a90f4a
Fix GHSA-9fcc-425m-g385: bypass CVE-2024-1874
The old code checked for suffixes but didn't take into account trailing
whitespace. Furthermore, there is peculiar behaviour with trailing dots
too. This all happens because of the special path-handling code inside
CreateProcessW.

By studying Wine's code, we can see that CreateProcessInternalW calls
get_file_name [1] in our case because we haven't provided an application
name. That code gets the first whitespace-delimited string into app_name
excluding the quotes. It's then passed to create_process_params [2]
where there is the path handling code that transforms the command line
argument to an image path [3]. Inside Wine, the extension check if
performed after these transformations [4]. By doing the same thing in
PHP we match the behaviour and can properly match the extension even in
the given edge cases.

[1] 166895ae3a/dlls/kernelbase/process.c (L542-L543)
[2] 166895ae3a/dlls/kernelbase/process.c (L565)
[3] 166895ae3a/dlls/kernelbase/process.c (L150-L151)
[4] 166895ae3a/dlls/kernelbase/process.c (L647-L654)
2024-06-04 08:55:36 -04:00
Gina Peter Banyard
0accfd1fe1
ext/readline: Fix [-Wcalloc-transposed-args] compiler warning
Closes GH-14280
2024-05-21 12:17:25 +01:00
Gina Peter Banyard
d4accd8b12
ext/pdo_mysql: Fix [-Wcalloc-transposed-args] compiler warning 2024-05-21 12:17:25 +01:00
Gina Peter Banyard
3c45152798
ext/gd: Fix [-Wcalloc-transposed-args] compiler warning 2024-05-21 12:17:25 +01:00
Gina Peter Banyard
554541c4db
ext/ffi: Fix [-Wenum-int-mismatch] compiler warning 2024-05-21 12:17:25 +01:00
Gina Peter Banyard
d775ba8804
ext/bcmath: Fix [-Wenum-int-mismatch] compiler warning 2024-05-21 12:17:25 +01:00
Niels Dossche
98288a27bc
Skip .NET tests if mscoree is not available (#14281) 2024-05-20 23:26:52 +02:00
Saki Takamachi
0a8fbef996
Added test 2024-05-20 15:13:53 +01:00
Kamil Tekiela
a59868aef8
Clear mysql error in fetch_into
Closes GH-14256
2024-05-17 13:08:42 +02:00
Niels Dossche
02b7d70fa9
Fix nightly test failure (#14251)
The created files have the same filename, creating conflicts. Fix this
by adding a unique suffix.
2024-05-16 20:00:46 +02:00
Niels Dossche
ebd1a36670
Fix GH-14215: Cannot use FFI::load on CRLF header file with apache2handler
Some modules may reset _fmode, which causes mangling of line endings.
Always be explicit like we do in other places where the native open call
is used.

Closes GH-14218.
2024-05-14 19:49:22 +02:00
Ilija Tovilo
fa7933ef17
[skip ci] Fix typo 2024-05-13 13:08:28 +02:00
Ilija Tovilo
91c53e43c4
[skip ci] Adjust port for gh13860.phpt
Port 64325 is already used in ext/standard/tests/streams/gh11418.phpt. The test
randomly times out, and it's unclear whether it might be related to the
conflicting port.
2024-05-13 12:16:57 +02:00
Niels Dossche
1e2a2d7df2
Fix crash in ParentNode::append() when dealing with a fragment containing text nodes
Credits for test: https://github.com/PhpGt/Dom/pull/454.

Closes GH-14206.
2024-05-12 02:00:31 +02:00
Niels Dossche
1890d47c51
Fix missing deref in C14N (#14203)
Follow-up for 30a0b0359e, which didn't fix
all places. This is the last remaining place.
2024-05-11 17:12:20 +02:00
Calvin Buckley
4e21a26db2
Fix check for newer versions of ICU (#14186)
* Fix check for newer versions of ICU

The previous test would always trigger, even if the version of ICU
installed didn't require C++17. This was because it incorrectly used
the `test` program, which broke the build on systems without a C++17
compiler.

Tested with macOS 14 and i 7.2.

* Fix broken ICU version check for definition

Same as the previous fix for C++17.

---------

Co-authored-by: Peter Kokot <peterkokot@gmail.com>
2024-05-10 14:20:17 -03:00
Niels Dossche
217b753a3d
Fix GH-14189: PHP Interactive shell input state incorrectly handles quoted heredoc literals.
Only `'` was handled, no handling case for `"` existed. Simply add it so
the heredoc tag is set up correctly.

Closes GH-14195.
2024-05-10 16:48:26 +02:00
Niels Dossche
15813d69a5
Fix GH-14183: XMLReader::open() can't be overridden
We should only return the override if the internal static method is matched.

Closes GH-14194.
2024-05-10 15:57:09 +02:00
Saki Takamachi
12dc51976b
ext/hash: Swap the checking order of __has_builtin and __GNUC__ (#14185)
closes #14185
2024-05-10 09:37:13 +09:00
Ilija Tovilo
42ede5597e
Fix persisting of inherited class constants
Class constants are inherited to user classes without cloning. Thus, internal
class constants should not be persisted at all. Simply keep pointing to the
internal class constant.

Fixes GH-14109
Closes GH-14114
2024-05-06 16:00:48 +02:00
Ilija Tovilo
f8d1864bbb
Delay #[Attribute] arg validation until runtime
Fixes GH-13970
Closes GH-14105

We cannot validate at compile-time for multiple reasons:

* Evaluating the argument naively with zend_get_attribute_value can lead to code
  execution at compile time through the new expression, leading to possible
  reentrance of the compiler.
* Even if the evaluation was possible, it would need to be restricted to the
  current file, because constant values coming from other files can change
  without affecting the current compilation unit. For this reason, validation
  would need to be repeated at runtime anyway.
* Enums cannot be instantiated at compile-time (the actual bug report). This
  could be allowed here, because the value is immediately destroyed. But given
  the other issues, this won't be needed.

Instead, we just move it to runtime entirely. It's only needed for
ReflectionAttribute::newInstance(), which is not particularly a hot path. The
checks are also simple.
2024-05-06 12:38:56 +02:00
Dmitry Stogov
f0356612d9
Fix undefined behavior (left shift of negative number)
Fixes oss-fuzz #68722
2024-05-06 09:49:41 +03:00
Niels Dossche
427c244168
Fix GH-14124: Segmentation fault on unknown address 0x0001ffff8041 with XML extension under certain memory limit (#14126)
The ltags were not initialized, so when an OOM happens before the new value is written, uninitialized data is used.
2024-05-04 14:05:24 +02:00
Peter Kokot
b6b9eab68e
Fix tests for glibc 2.39 (#14097)
2.39 has fixed inconsistent (mon_)grouping formats in localedata:

* https://sourceware.org/git/?p=glibc.git;a=blob;f=NEWS;hb=refs/tags/glibc-2.39#l237
* https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/locales/en_AU;hb=refs/tags/glibc-2.39#l65

For en_AU locale now it returns array of 1 item instead of 2 for
grouping and mon_grouping.

Since this is upstream change depending on the system, this only syncs
tests for such case.
2024-05-01 20:43:00 +02:00
Niels Dossche
2dbe2d62b3
Fix crash when calling childNodes next() when iterator is exhausted
Closes GH-14091.
2024-04-30 22:30:58 +02:00
Niels Dossche
30a0b0359e
Fix references not handled correctly in C14N
Closes GH-14090.
2024-04-30 22:30:28 +02:00
Niels Dossche
e878b9f390
Fix crashes when entity declaration is removed while still having entity references
libxml doesn't do reference counting inside its node types. It's
possible to remove an entity declaration out of the document, but then
entity references will keep pointing to that stale declaration. This
will cause crashes.

One idea would be to check when a declaration is removed, to trigger a
hook that updates all references. However this means we have to keep
track of all references somehow, which would be a high-overhead
solution. The solution in this patch makes sure that the fields are
always updated before they are read.

Closes GH-14089.
2024-04-30 22:29:44 +02:00
David Carlier
42443b4c2e
ext/session: fix _read/_write buffer limit.
MSDN pages mention the buffer size upper limit is INT_MAX not UINT_MAX.
inspired by GH-13205.

Close GH-14017
2024-04-20 17:11:03 +01:00
Saki Takamachi
2a1aa8cac5
Fix GH-13998: Manage refcount of agg_context->val correctly (#14004)
When step_callback fails, agg_context->val is passed dtor, but agg_context->val
is also used in final_callback regardless of the success/failure of step_callback,
so should not call dtor.

closes #14004
fixes #13998
2024-04-20 22:33:25 +09:00
Jakub Zelenka
04b864e566
Fix GH-13806: openssl_x509_parse_basic test fails with OpenSSL 3.2+ (#13961)
Closes GH-13961
2024-04-19 14:09:22 +01:00
David Carlier
cc46a4e6b5
ext/intl: level up c++ runtime std for icu 74 and onwards.
to align with what is required to build icu 74 itself.

Close GH-14002
2024-04-19 10:04:25 +01:00
Saki Takamachi
fda91a0543
Fix GH-13984: Buffer size is now checked before memcmp (#13991)
Fixed an issue where a buffer overflow occurred when a string shorter than
`:memory:` was passed as the db name of pdo_sqlite.

fixed #13984
closes #13991
2024-04-18 08:35:50 +09:00
Arnaud Le Blanc
32efc76c32
Use return value of getpwuid_r(), not errno (#13969) 2024-04-16 14:08:28 +02:00
Ilija Tovilo
a7a7e6d57c
Fix clean section in test 2024-04-15 14:14:47 +02:00
Ilija Tovilo
f2cd0d5752
Fix rename test file name collision 2024-04-15 13:42:40 +02:00
Damian Wójcik
8421cfda61
Fix file_get_contents() on Windows fails with "errno=22 Invalid argument"
Closes GH-13948
2024-04-14 14:26:10 +01:00
Jakub Zelenka
3b93f13199
Revert "ext/mysqlnd: support ER_CLIENT_INTERACTION_TIMEOUT"
This reverts commit 5035b85090.

This broke Doctrine DBAL tests - more discussion in GH-13618.
2024-04-12 10:56:09 +01:00
Arnaud Le Blanc
66809c05b7
Fix usage of reentrant functions in ext/posix (#13921)
- It's not necessarily an error of sysconf(_SC_GETPW_R_SIZE_MAX) returns -1, as
  specified by posix (and the musl implementation always returns -1). Pick an
  initial buffer size in this case.
- Reentrant variants return an error number an may not set errno
- Implement retry logic for ttyname_r()
- Fix retry logic for getpwnam_r() (pw would be NULL after the first try)
- Test retry logic by setting the initial buffer size to 1 in debug builds
2024-04-11 13:27:39 +02:00
Bob Weinand
ea927caffa
Fix exception IP in JIT (#13929) 2024-04-10 20:37:54 +02:00
Appla
5035b85090
ext/mysqlnd: support ER_CLIENT_INTERACTION_TIMEOUT
Closes GH-13618.
2024-04-10 13:33:04 +02:00
Ben Ramsey
a9ffc447a4
Merge branch 'PHP-8.1' into PHP-8.2 2024-04-09 23:49:31 -05:00
Jakub Zelenka
0ba5229a3f
Fix bug GHSA-q6x7-frmf-grcw: password_verify can erroneously return true
Disallow null character in bcrypt password
2024-04-09 23:38:32 -05:00
Niels Dossche
093c08af25
Fix GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
The check happened too early as later code paths may perform more
mangling rules. Move the check downwards right before adding the actual
variable.
2024-04-09 23:37:06 -05:00
Jakub Zelenka
e3c784f2bf
Add proc_open escaping for cmd file execution 2024-04-09 23:29:28 -05:00
Bob Weinand
e48a5c14b9 Add zend_test.observer.enabled=0 to opcache tests asserting specific TMP count
Necessary to succeed when tests are run with zend_test.observer.enabled=1.
2024-04-08 20:16:35 +02:00
icy17
6f8bda0582
Fix potential NULL pointer dereference before calling EVP_SignInit
Closes GH-13870.
2024-04-08 19:30:26 +02:00
Bob Weinand
af098acd6e Always load EX(opline) into the current frame in JIT when observers are enabled
Fixes #13772.
Closes #13776.
2024-04-08 15:09:14 +02:00
Niels Dossche
a86256c950
Improve stability of test gh13860.phpt 2024-04-07 22:49:58 +02:00
Niels Dossche
2aae14c8a9
Fix GH-13860: Incorrect PHP_STREAM_OPTION_CHECK_LIVENESS case in ext/openssl/xp_ssl.c - causing use of dead socket
php_socket_errno() may return a stale value when recv returns a
value >= 0. As such, the liveness check is wrong.
This is the same bug as #70198 (fixed in GH-1456). So we fix it in the
same way.

Closes GH-13895.
2024-04-07 21:35:43 +02:00