Commit graph

232 commits

Author SHA1 Message Date
icy17
6f8bda0582
Fix potential NULL pointer dereference before calling EVP_SignInit
Closes GH-13870.
2024-04-08 19:30:26 +02:00
Niels Dossche
3ee2ade917 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Add missing check on EVP_VerifyUpdate() in phar util
2023-07-09 22:55:01 +02:00
Niels Dossche
0d07b6d647 Add missing check on EVP_VerifyUpdate() in phar util
Closes GH-11640.
2023-07-09 22:54:27 +02:00
Niels Dossche
a13cca8a81 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Add missing error check on PEM_write_bio_PKCS7()
  Add missing error check on PEM_write_bio_CMS()
  Add missing error check on i2d_PKCS12_bio()
  Add missing error checks on EVP_MD_CTX_create() and EVP_VerifyInit()
2023-03-05 22:12:36 +01:00
Niels Dossche
30ebecb1d4 Add missing error checks on EVP_MD_CTX_create() and EVP_VerifyInit()
The first one returns NULL on error, and the second one returns 0 on
error. These weren't checked.

Closes GH-10762.
2023-03-05 22:05:11 +01:00
Dmitry Stogov
90b7bde615 Use more compact representation for packed arrays.
- for packed arrays we store just an array of zvals without keys.
- the elements of packed array are accessible throuf as ht->arPacked[i]
  instead of ht->arData[i]
- in addition to general ZEND_HASH_FOREACH_* macros, we introduced similar
  familied for packed (ZEND_HASH_PACKED_FORECH_*) and real hashes
  (ZEND_HASH_MAP_FOREACH_*)
- introduced an additional family of macros to access elements of array
  (packed or real hashes) ZEND_ARRAY_ELEMET_SIZE, ZEND_ARRAY_ELEMET_EX,
  ZEND_ARRAY_ELEMET, ZEND_ARRAY_NEXT_ELEMENT, ZEND_ARRAY_PREV_ELEMENT
- zend_hash_minmax() prototype was changed to compare only values

Because of smaller data set, this patch may show performance improvement
on some apps and benchmarks that use packed arrays. (~1% on PHP-Parser)

TODO:
    - sapi/phpdbg needs special support for packed arrays (WATCH_ON_BUCKET).
    - zend_hash_sort_ex() may require converting packed arrays to hash.
2021-11-03 15:18:26 +03:00
Remi Collet
c51af22fef
implement openssl_256 and openssl_512 for phar singatures 2021-08-11 14:13:57 +02:00
Remi Collet
8bb0c74e24
switch phar to use sha256 signature by default 2021-08-11 14:13:54 +02:00
KsaR
01b3fc03c3
Update http->https in license (#6945)
1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |
2021-05-06 12:16:35 +02:00
George Peter Banyard
5caaf40b43
Introduce pseudo-keyword ZEND_FALLTHROUGH
And use it instead of comments
2021-04-07 00:46:29 +01:00
Dmitry Stogov
c732ab400a Change Zend Stream API to use zend_string* instead of char*.
This allows to eliminate re-calculation of string lenght and hash value.
See the detailed list of changes in UPGRADING.INTERNALS.
2021-03-16 20:31:36 +03:00
Dmitry Stogov
187ba4353a Fix ASAN warning (Zend/zend_string.h:165:2: runtime error: null pointer passed as argument 2 of memcpy(), which is declared to never be null) 2021-03-04 17:27:26 +03:00
Christoph M. Becker
c2fbab392c Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #77322: PharData::addEmptyDir('/') Possible integer overflow
2020-12-15 11:46:28 +01:00
Christoph M. Becker
a53d67ceac Fix #77322: PharData::addEmptyDir('/') Possible integer overflow
`phar_path_check()` already strips a leading slash, so we must not
attempt to strip the trailing slash from an now empty directory name.

Closes GH-6508.
2020-12-15 11:44:53 +01:00
Tyson Andre
0c238ede01 [RFC] Only unserialize Phar metadata when getMetadata() is called
In other words, don't automatically unserialize when the magic
phar:// stream wrappers are used.
RFC: https://wiki.php.net/rfc/phar_stop_autoloading_metadata

Also, change the signature from `getMetadata()`
to `getMetadata(array $unserialize_options = [])`.
Start throwing earlier if setMetadata() is called and serialization threw.

See https://externals.io/message/110856 and
https://bugs.php.net/bug.php?id=76774

This was refactored to add a phar_metadata_tracker for the following reasons:
- The way to properly copy a zval was previously implicit and undocumented
  (e.g. is it a pointer to a raw string or an actual value)
- Avoid unnecessary serialization and unserialization in the most common case
- If a metadata value is serialized once while saving a new/modified phar file,
  this allows reusing the same serialized string.
- Have as few ways to copy/clone/lazily parse metadata (etc.) as possible,
  so that code changes can be limited to only a few places in the future.
- Performance is hopefully not a concern - copying a string should be faster
  than unserializing a value, and metadata should be rare in most cases.

Remove unnecessary skip in a test(Compression's unused)

Add additional assertions about usage of persistent phars

Improve robustness of `Phar*->setMetadata()`

- Add sanity checks for edge cases freeing metadata, when destructors
  or serializers modify the phar recursively.
- Typical use cases of php have phar.readonly=1 and would not be affected.

Closes GH-5855
2020-08-03 13:28:51 -04:00
twosee
7d6a0ba808 Fix expression warnings and break warnings
Close GH-5675.
2020-06-07 10:41:11 +02:00
George Peter Banyard
6d6d954d0d Cleanup of remaining E_STRICT in tests 2019-07-23 11:27:23 +02:00
Peter Kokot
033cafacbd Sync HAVE_HASH, HAVE_HASH_EXT, PHAR_HASH_OK symbols
The hash extension is always available since PHP-7.4. The symbol
HAVE_HASH_EXT is kept for BC reasons and removed in PHP-8.0.

This patch also removes the PHAR_HASH_OK since it is no longer
relevant.
2019-06-27 23:25:33 +02:00
Nikita Popov
31123de0c8 Fix EVP_PKEY leak in phar 2019-06-25 10:25:44 +02:00
Nikita Popov
585f4cbb21 Merge branch 'PHP-7.3' into PHP-7.4 2019-03-15 17:08:01 +01:00
Xinchen Hui
b419590893 Fixed bug #77697 (Crash on Big_Endian platform) 2019-03-15 16:58:08 +08:00
Peter Kokot
c245898bfa Update and fix remaining year ranges (2019)
This patch follows previous license year ranges updates. With new
approach source code files now have simplified headers with license
information without year ranges.
2019-02-08 23:14:29 +01:00
Peter Kokot
92ac598aab Remove local variables
This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly used by Vim and Emacs editors
yet with recent changes the once working definitions don't work
anymore in Vim without custom plugins or additional configuration.
Neither are these settings synced across the PHP code base.

A simpler and better approach is EditorConfig and fixing code
using some code style fixing tools in the future instead.

This patch also removes the so called modelines for Vim. Modelines
allow Vim editor specifically to set some editor configuration such as
syntax highlighting, indentation style and tab width to be set in the
first line or the last 5 lines per file basis. Since the php test
files have syntax highlighting already set in most editors properly and
EditorConfig takes care of the indentation settings, this patch removes
these as well for the Vim 6.0 and newer versions.

With the removal of local variables for certain editors such as
Emacs and Vim, the footer is also probably not needed anymore when
creating extensions using ext_skel.php script.

Additionally, Vim modelines for setting php syntax and some editor
settings has been removed from some *.phpt files.  All these are
mostly not relevant for phpt files neither work properly in the
middle of the file.
2019-02-03 21:03:00 +01:00
Dmitry Stogov
675a8a64c3 Use HT_IS_INITIALIZED() and HT_INVALIDATE() macros instead of hackish HT_FLAGS assumtions. 2018-12-27 22:48:25 +03:00
Peter Kokot
8d3f8ca12a Remove unused Git attributes ident
The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
user who changed it.

In Git this functionality is different and can be done with Git attribute
ident. These need to be defined manually for each file in the
.gitattributes file and are afterwards replaced with 40-character
hexadecimal blob object name which is based only on the particular file
contents.

This patch simplifies handling of $Id$ keywords by removing them since
they are not used anymore.
2018-07-25 00:53:25 +02:00
Dmitry Stogov
b6fb584505 Replace zval_dtor() with specialized destructors 2018-07-05 13:32:39 +03:00
Dmitry Stogov
5eb1f92f31 Use zend_string_release_ex() instread of zend_string_release() in places, where we sure about string persistence. 2018-05-28 16:27:12 +03:00
Anatol Belski
2e5ac355b9 Move to unsigned types in phar
Preventing integer overflows in principle, which allows to avoid additional
range checks. The phar format is based on 32-bit lengths, so the storage
sizes was kept same.
2018-04-18 20:15:05 +02:00
Dmitry Stogov
9cbb521094 Access HashTable.u.flags through HT_FLAGS() macro. 2018-01-22 13:36:15 +03:00
Xinchen Hui
a6519d0514 year++ 2018-01-02 12:57:58 +08:00
Dmitry Stogov
238916b5c9 Use persistent strings for preloaded phar files 2017-11-02 19:28:34 +03:00
Joe Watkins
bb9ea4e88b
Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Fix bug #74991 - include_path has a 4096 char (minus "__DIR__:") limit, in some PHAR cases
2017-07-26 10:47:22 +01:00
Benjamin W. Broersma
6b1fbafdf0
Fix bug #74991 - include_path has a 4096 char (minus "__DIR__:") limit, in some PHAR cases 2017-07-26 10:46:50 +01:00
Jakub Zelenka
cdc33251d2 Add OpenSSL 1.1.0 support to PHP 7.0 2017-04-07 19:21:33 +01:00
Sammy Kaye Powers
dac6c639bb Update copyright headers to 2017 2017-01-04 11:23:42 -06:00
Sammy Kaye Powers
478f119ab9 Update copyright headers to 2017 2017-01-04 11:14:55 -06:00
Stanislav Malyshev
dad0e9d1a3 Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0: (22 commits)
  Fix bug #72293 - Heap overflow in mysqlnd related to BIT fields
  I don't think 8cceb012a7 is needed
  Fix test
  Add check in fgetcsv in case sizeof(unit) != sizeof(size_t)
  Fix bug #73065: Out-Of-Bounds Read in php_wddx_push_element of wddx.c
  Fix bug #73035 (Out of bound when verify signature of tar phar in phar_parse_tarfile)
  Fix bug #73052 - Memory Corruption in During Deserialized-object Destruction
  Fix bug #73029 - Missing type check when unserializing SplArray
  Fix bug #72860: wddx_deserialize use-after-free
  Fix bug #73007: add locale length check
  Fix bug #72928 - Out of bound when verify signature of zip phar in phar_parse_zipfile
  sync NEWS
  Revert "Merge branch 'PHP-5.6' into PHP-7.0"
  Merge branch 'PHP-5.6' into PHP-7.0
  Merge branch 'PHP-5.6' into PHP-7.0
  Revert "Revert "Merge branch 'PHP-5.6' into PHP-7.0""
  fix version
  sync NEWS
  Fix bug #72957
  set versions
  ...
2016-09-12 21:10:34 -07:00
Stanislav Malyshev
0bfb970f43 Fix bug #72928 - Out of bound when verify signature of zip phar in phar_parse_zipfile
(cherry picked from commit 19484ab77466f99c78fc0e677f7e03da0584d6a2)
2016-09-12 17:04:19 +02:00
Jakub Zelenka
98514f96c9 Use opaque EVP_MD in phar_verify_signature 2016-07-17 17:43:35 +01:00
Dmitry Stogov
323b2733f6 Fixed compilation warnings 2016-06-22 00:40:50 +03:00
Rouven Weßling
a61029b155 Replace usage of php_int32 and php_uint32 with int32_t and uint32_t 2016-02-04 11:57:41 +01:00
Nikita Popov
93dc91b386 Remove version checks
PHP_VERSION_ID
PHP_API_VERSION
ZEND_MODULE_API_NO
PHP_MAJOR_VERSION, PHP_MINOR_VERSION
ZEND_ENGINE_2

I've left litespeed alone, as it seems to genuinely maintain support
for many PHP versions.
2016-01-30 15:35:28 +01:00
Lior Kaplan
ed35de784f Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Happy new year (Update copyright to 2016)
2016-01-01 19:48:25 +02:00
Lior Kaplan
49493a2dcf Happy new year (Update copyright to 2016) 2016-01-01 19:21:47 +02:00
Stanislav Malyshev
d6e8426ebf Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Better fix for bug #70433

Conflicts:
	ext/phar/dirstream.c
	ext/phar/util.c
2015-09-28 21:43:16 -07:00
Stanislav Malyshev
2e267bd3c7 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  Better fix for bug #70433

Conflicts:
	ext/phar/dirstream.c
2015-09-28 21:42:08 -07:00
Stanislav Malyshev
1ddf72180a Better fix for bug #70433 2015-09-28 21:41:02 -07:00
Stanislav Malyshev
4c6f4863fa Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  fix memory leak
  FIx bug #70433 - Uninitialized pointer in phar_make_dirstream when zip entry filename is "/"

Conflicts:
	ext/phar/dirstream.c
2015-09-28 20:45:02 -07:00
Stanislav Malyshev
51b23cd0f0 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  fix memory leak
  FIx bug #70433 - Uninitialized pointer in phar_make_dirstream when zip entry filename is "/"

Conflicts:
	ext/phar/dirstream.c
2015-09-28 20:44:28 -07:00
Stanislav Malyshev
f98ab19dc0 fix memory leak 2015-09-28 20:43:18 -07:00