Commit graph

5983 commits

Author SHA1 Message Date
Niels Dossche
88315f263d
Fix GHSA-3qgc-jrrr-25jv
The original code is error-prone due to the "best fit mapping" that
happens with the argument parsing but not with the query string.
When we get a non-ASCII character, try to remap it and see if it becomes
a hyphen.

An alternative approach is to create a custom main `wmain` receiving
wide-character variations that does the ANSI transformation with the
best-fit mapping, but that's more error-prone and could cause unexpected
breakage.

Another alternative was just don't doing this check altogether and
always check for `cgi || fastcgi` instead, but that breaks real-world
use-cases.
2024-06-04 08:58:51 -04:00
Benjamin Cremer
5b6cda6523
Fix GH-14175: Use two digit float specifier for FPM systemd format req rate
Close GH-14175
2024-05-12 13:30:29 +01:00
Niels Dossche
217b753a3d
Fix GH-14189: PHP Interactive shell input state incorrectly handles quoted heredoc literals.
Only `'` was handled, no handling case for `"` existed. Simply add it so
the heredoc tag is set up correctly.

Closes GH-14195.
2024-05-10 16:48:26 +02:00
David Carlier
74843947f4
sapi/cgi: fix buffer limit on windows.
MSDN recommends dropping the deprecated `read` in favor of `_read`.
Also, the buffer size limit is INT_MAX.

Close GH-14022
2024-05-01 13:58:53 +01:00
Niels Dossche
093d334684
Fix GH-13978: Fuzzer readme still mentions obsolete --enable-json flag (#13983)
[ci skip]
2024-04-16 22:16:51 +02:00
Niels Dossche
c3acfb1b57
Fix GH-13931: Applying zero offset to null pointer in Zend/zend_opcode.c
In the test cases, the compiler bails out due to a fatal error.
The data structures used by the compiler will contain stale values.
In particular, for the test case CG(loop_var_stack) will contain data.
The next compilation will incorrectly use elements from the previous
stack.
To solve this, we reset part of the compiler data structures.
We don't do a full re-initialization via init_compiler() because that will
also reset streams and resources.

Closes GH-13938.
2024-04-15 19:39:05 +02:00
Ilija Tovilo
97162e92be
Fix opcache dump varying tmps 2024-04-05 14:11:41 +02:00
Jakub Zelenka
9b1d2e93b8
Fix FPM tester default env vars change
This broke cloexec test
2024-03-30 14:37:54 +00:00
Niels Dossche
d3f1f3ab40 Fix GH-13827: Null pointer access of type 'zval' in phpdbg_frame
We don't always have the line and filename in a backtrace frame, but
phpdbg assumes we do.

Closes GH-13831.
2024-03-29 17:54:23 +01:00
Jakub Zelenka
d0a8d41eee
Fix GH-13563: Setting bool values via env in FPM config fails
Closes GH-13786
2024-03-28 15:43:50 +00:00
Niels Dossche
dd3aa18545
Fix incorrect check in fpm_shm_free() (#13797)
`if (fpm_shm_size - size > 0)` will be rewritten by the compiler as this: `if (fpm_shm_size != size)`, which is undesirable. The reason this happens is that both variables are size_t, so subtracting them cannot be negative. The only way it can be not > 0, is if they're equal because the result will then be 0. This means that the else branch won't work properly. E.g. if `fpm_shm_size == 50` and `size == 51`, then `fpm_shm_size` will wraparound instead of becoming zero.

To showcase that the compiler actually does this, take a look at this
isolated case: https://godbolt.org/z/azobdWcrY. Here we can see the
usage of the compare instruction + cmove, so the "then" branch
is only done if the variables are equal.
2024-03-24 13:57:08 +01:00
David Carlier
868257a3de Fix GH-13727: macro generating invalid call test prototypes fixes.
autoconf/libtool generating code to test features missed `void` for
C calls prototypes w/o arguments.
Note that specific changes related to libtool have to be upstreamed.

Co-authored-by: Peter Kokot <petk@php.net>

close GH-13732
2024-03-18 06:53:39 +00:00
Jakub Zelenka
bc30ae4f04
Fix bug #75712: getenv in php-fpm should not read $_ENV, $_SERVER
Closes GH-13195
2024-02-04 11:58:18 +00:00
Dmitry Stogov
b45e7a613f Wrap cleanup function call with zend_try.
Fizes oss-fuzz #65911
2024-01-22 10:32:04 +03:00
Niels Dossche
cd483f136c Use getenv to prevent undefined key warning 2024-01-15 20:15:04 +01:00
Jakub Zelenka
b04b09ef56
Fix GH-12996: Incorrect SCRIPT_NAME with Apache ProxyPassMatch when plus in path
Closes GH-13072
2024-01-11 16:47:08 +00:00
Jan Palus
d57a7767a2 Set libtool tag per command instead of global one
Global --tag=CC defined in configure.ac is not correct in all cases. For example
linking objects that were compiled from C++ sources needs to be done with C++
compiler, however for link mode libtool will prefer compiler indicated with
--tag.

Fixes GH-12349
2024-01-10 09:09:45 +01:00
Peter Kokot
2575e6b88c Update year to 2024 2024-01-04 19:26:32 +01:00
Niels Dossche
a6d17bffe1 Fix GH-12962: Double free of init_file in phpdbg_prompt.c
See GH-12962 for analysis.

Closes GH-12963.
2023-12-17 11:46:02 +01:00
Jakub Zelenka
62682cbd97
Add FPM tester logs printing for all errors
Closes GH-12902
2023-12-09 13:21:41 +00:00
Ilija Tovilo
299c3ba89e
Fix max_execution_time with cli-server router script
When the cli-server specifies a router script, we run it using
zend_execute_scripts instead of php_execute_script, because the former preserves
the return value of the script. However, php_execute_script also starts resets
the execution timer with the value from max_execution_time. If the timer has
previously been initialized with max_input_time, it will never be reset, and
thus trigger at the incorrect time.

Closes GH-12886
2023-12-07 16:11:48 +01:00
Remi Collet
0d1bf582ce
fix function declaration isn't a prototype [-Wstrict-prototypes] 2023-12-06 14:51:27 +01:00
Jakub Zelenka
2303e76740
Merge branch 'PHP-8.1' into PHP-8.2 2023-12-01 14:45:48 +00:00
Patrick Prasse
df259f88da
Fix bug GH-12705: Segmentation fault in fpm_status_export_to_zval
Closes GH-12706
2023-12-01 14:43:58 +00:00
Niels Dossche
df2af7ff65
Fix GH-12675: MEMORY_LEAK in phpdbg_prompt.c
Have to use file_put_contents() instead of --FILE-- because we have to
actually load it using the exec command, *and* have to make multiple
files, and note that we can only load files relative from the current
directory, so we can't rely on files being in the sapi/phpdbg/tests
folder.

Closes GH-12680.
2023-11-22 20:39:29 -06:00
Niels Dossche
e1c6a7c4de
Fix GH-12621: browscap segmentation fault when configured in the vhost
The temporary HashTable has a destructor that releases the string held
by the entry's value. However, browscap_intern_str(_ci) only incremented
the refcount for the reference created by the return value. As the
HashTable is only used during parsing, we don't need to manage the
reference count of the value anyway, so get rid of the destructor.

This is triggerable in two cases:
 - When using php_admin_value to set the ini at the activation stage
 - When running out of space for the opcache-interned strings

Closes GH-12634.
2023-11-22 20:39:28 -06:00
Niels Dossche
4f1103ef3b Fix GH-12675: MEMORY_LEAK in phpdbg_prompt.c
Have to use file_put_contents() instead of --FILE-- because we have to
actually load it using the exec command, *and* have to make multiple
files, and note that we can only load files relative from the current
directory, so we can't rely on files being in the sapi/phpdbg/tests
folder.

Closes GH-12680.
2023-11-15 21:59:55 +01:00
Niels Dossche
7353c7ce17 Fix GH-12621: browscap segmentation fault when configured in the vhost
The temporary HashTable has a destructor that releases the string held
by the entry's value. However, browscap_intern_str(_ci) only incremented
the refcount for the reference created by the return value. As the
HashTable is only used during parsing, we don't need to manage the
reference count of the value anyway, so get rid of the destructor.

This is triggerable in two cases:
 - When using php_admin_value to set the ini at the activation stage
 - When running out of space for the opcache-interned strings

Closes GH-12634.
2023-11-11 18:35:57 +01:00
Jakub Zelenka
882cc4f804
Merge branch 'PHP-8.1' into PHP-8.2 2023-11-03 17:17:23 +00:00
Jakub Zelenka
a8c6c6165b
Fix GH-9921: Loading ext in FPM config does not register module handlers
Closes GH-12377
2023-11-03 16:53:09 +00:00
Jakub Zelenka
e3d1beb0f1
Fix bug #76922: FastCGI terminates conn after FCGI_GET_VALUES
Closes GH-12387
2023-11-03 14:06:36 +00:00
Jakub Zelenka
c776f79578
Merge branch 'PHP-8.1' into PHP-8.2 2023-10-14 18:41:48 +01:00
Jakub Zelenka
0217be4d5b
Fix GH-12232: FPM: segfault dynamically loading extension without opcache
Also fixes incorrect assertion in ini init that php_dl is always
temporary.

Closes GH-12277
2023-10-14 18:38:21 +01:00
Niels Dossche
a1845944ce Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  php_cli_server: ensure single date header is present
2023-10-06 17:50:13 +02:00
coppolafab
f6ac08c6a3 php_cli_server: ensure single date header is present
Currently the PHP Development Server appends a Date header in the
response, despite already set from user code.

Added a check condition before append the header, and a test file.

Closes GH-12363.
2023-10-06 17:49:30 +02:00
Niels Dossche
6aa20956fb Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Ignore optional warning output in test
2023-10-02 22:55:28 +02:00
Niels Dossche
6cf76d552e Ignore optional warning output in test
Due to the greedy behaviour of regex, we can't seem to use %A?
Use a for loop with a marker instead to ignore module startup warnings.
2023-10-02 22:53:39 +02:00
Niels Dossche
87cd401aaf Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix test under older CI configurations
2023-10-02 21:52:52 +02:00
Niels Dossche
b140f6e9f8 Fix test under older CI configurations 2023-10-02 21:52:44 +02:00
Niels Dossche
28a909d40a Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix #80092: ZTS + preload = segfault on shutdown
2023-10-02 19:37:09 +02:00
Niels Dossche
bdc87b0f66 Fix #80092: ZTS + preload = segfault on shutdown
After preloading has executed, the executor globals for class_table and
function_table are still referring to the values during preloading.
If no request happens after that then these values will remain dangling
pointers. If then the -v option on CLI or -h option (and possibly
others) on CGI is provided, there is a double free.
Fix it by nulling the pointers explicitly after preloading has finished
to fix it for all SAPIs.

Closes GH-12311.
2023-10-02 19:33:41 +02:00
Niels Dossche
75441d71d8 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-10964: Improve `man` page about the built-in server
  Fix GH-11438: mysqlnd fails to authenticate with sha256_password accounts using passwords longer than 19 characters
2023-08-03 20:32:30 +02:00
Alexandre Daubois
997a36750b Fix GH-10964: Improve man page about the built-in server
Closes GH-11857.
2023-08-03 20:29:13 +02:00
Niels Dossche
272dc9a09c Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-11716: cli server crashes on SIGINT when compiled with ZEND_RC_DEBUG=1
2023-07-21 15:31:20 +02:00
Niels Dossche
af77d3b8da Fix GH-11716: cli server crashes on SIGINT when compiled with ZEND_RC_DEBUG=1
Closes GH-11757.
2023-07-21 15:23:56 +02:00
Niels Dossche
4a28cc725a Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-9669: phpdbg -h options doesn't list the -z option
2023-07-07 19:17:35 +02:00
Adam Saponara
119b062169 Fix GH-9669: phpdbg -h options doesn't list the -z option
Adds `-z` flag in phpdbg output.

Closes GH-9713.
2023-07-07 19:16:32 +02:00
nielsdos
b9bf9ee2cb Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix interrupted CLI output causing the process to exit
2023-06-23 17:42:45 +02:00
nielsdos
1111a9517b Fix interrupted CLI output causing the process to exit
When writing the output in the CLI is interrupted by a signal, the
writing will fail in sapi_cli_single_write(), causing an exit later in
sapi_cli_ub_write(). This was the other part of the issue in GH-11498.
The solution is to restart the write if an EINTR has been observed.

Closes GH-11510.
2023-06-23 17:39:04 +02:00
Jakub Zelenka
6877b4f110
Merge branch 'PHP-8.1' into PHP-8.2 2023-06-15 17:37:09 +01:00