Commit graph

1918 commits

Author SHA1 Message Date
David Carlier
c03196a5be
Fix GH-14712: segfault on invalid object.
If the extension does not allow to get a property pointer (like PDORow
object), we fallback
to the read property cb anyway.
2024-06-29 15:51:57 +01:00
Ilija Tovilo
b3e26c3036
Fix missing handling of CALLABLE_CONVERT in cleanup_unfinished_calls()
Fixes GH-14003
2024-04-19 20:04:51 +02:00
Gina Peter Banyard
e94ab0461c
Align error messages between normal VM and JIT for RW when using object as array (#12799) 2023-11-28 00:37:21 +03:00
Ilija Tovilo
4676d9bc43
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix access on NULL pointer in array_merge_recursive()
2023-05-24 13:37:47 +02:00
Ilija Tovilo
f5c54fd88b
Fix access on NULL pointer in array_merge_recursive()
Closes GH-11303
2023-05-24 13:36:52 +02:00
Dmitry Stogov
e14ac1caee Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Allow FETCH_OBJ_W and FETCH_STATIC_PROP_W to return INDIRECT/UNDEF zval for uninitialized typed properties (#11048)
2023-04-10 23:25:08 +03:00
Dmitry Stogov
0c65b396d6
Allow FETCH_OBJ_W and FETCH_STATIC_PROP_W to return INDIRECT/UNDEF zval for uninitialized typed properties (#11048) 2023-04-10 23:19:17 +03:00
Ilija Tovilo
efb9181a98
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Revert "Fix GH-10168: heap-buffer-overflow at zval_undefined_cv"
2023-02-16 14:13:17 +01:00
Ilija Tovilo
7b68ff46da
Revert "Fix GH-10168: heap-buffer-overflow at zval_undefined_cv"
This reverts commit 71ddede565.
2023-02-16 14:07:17 +01:00
Bob Weinand
0e31e03bc5 Merge branch 'PHP-8.1' into PHP-8.2 2023-02-13 13:10:08 +01:00
Arnaud Le Blanc
d721dcc2ef Fix colletion of unfinished function call in fibers
Fixes GH-10496.

Co-authored-by: Bob Weinand <bobwei9@hotmail.com>
2023-02-13 13:09:04 +01:00
Ilija Tovilo
972a5a02bd
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-10168: heap-buffer-overflow at zval_undefined_cv
2023-02-08 01:12:03 +01:00
Niels Dossche
71ddede565
Fix GH-10168: heap-buffer-overflow at zval_undefined_cv
The problem is that we're using the variable_ptr in the opcode handler
*after* it has already been destroyed. The solution is to create a
specialised version of zend_assign_to_variable which takes in two
destination zval pointers.

Closes GH-10524
2023-02-08 01:06:50 +01:00
Niels Dossche
972c74c300
Fix incorrect check in zend_internal_call_should_throw()
This debug code is part of arginfo validation. This validation will
never trigger properly because the OR operation makes the first if
always true. Fix it by changing to an AND.

Closes GH-10417

Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-25 00:12:13 +00:00
Niels Dossche
0801c567dc Fix GH-10248: Assertion `!(zval_get_type(&(*(property))) == 10)' failed.
The assertion failure was triggered in a debug code-path that validates
property types for internal classes.
zend_verify_internal_read_property_type was called with retval being a
reference, which is not allowed because that function eventually calls to
i_zend_check_property_type, which does not expect a reference.
The non-debug code-path already takes into account that retval can be a
reference, as it optionally dereferences retval.

Add a dereference in zend_verify_internal_read_property_type just before
the call to zend_verify_property_type, which is how other callers often
behave as well.
2023-01-20 16:40:15 +01:00
Arnaud Le Blanc
d89408075f Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Reduce HT_MAX_SIZE to account for the max load factor of 0.5 (#10242)
  GC fiber unfinished executions (#9810)
2023-01-13 12:28:21 +01:00
Arnaud Le Blanc
4fb149390a
GC fiber unfinished executions (#9810) 2023-01-13 12:04:28 +01:00
Arnaud Le Blanc
34a85fbea0 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [ci skip] NEWS
  [ci skip] NEWS
  Fix generator memory leaks when interrupted during argument evaluation (#9756)
2022-11-04 16:02:04 +01:00
Arnaud Le Blanc
4011657719 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  [ci skip] NEWS
  Fix generator memory leaks when interrupted during argument evaluation (#9756)
2022-11-04 15:59:14 +01:00
Arnaud Le Blanc
5d1f3e047c
Fix generator memory leaks when interrupted during argument evaluation (#9756) 2022-11-04 15:55:55 +01:00
Florian Sowade
b9474bf385 Don’t report arginfo violations on fake closures (#9823) 2022-10-26 12:21:41 +02:00
George Peter Banyard
5bfceae770 Only check classes in intersection type if the type might be valid
Closes GH-9522
2022-09-13 11:10:32 +01:00
George Peter Banyard
c70a8281e3 Use DNF intersection type check also for simple intersection types 2022-09-10 11:39:22 +01:00
George Peter Banyard
9286101da4 Fix GH-9516: (A&B)|D as a param should allow AB or D. Not just A.
The issue was that we didn't compute enough cache slots for DNF types.
Nor progressed throught the CE's in the cache slot, meaning we were only checking if the value passed
satisfied the first type of the nested intersection type.
2022-09-10 11:34:32 +01:00
George Peter Banyard
80315edd58 Introduce PROGRESS_CACHE_SLOT() macro 2022-09-10 11:34:11 +01:00
Bob Weinand
dc5475c191 Save previous observer on the VM stack
This avoids a possible significant performance penalty, when some leaf function was observed, deep in the stack.
As a side effect, we are not iterating over prev_execute_data anymore and thus, non-observed fake frames, possibly on stack, cannot have any impact on the observer anymore (especially within zend_observer_fcall_end_all).

Saving the previous observer happens now directly on the VM stack. If there is any observer, function frames are allocated an extra zval (the last temporary), which will, on observed frames, contain the previous observed frame address.
2022-08-04 17:16:27 +02:00
Bob Weinand
625f164963 Include internal functions in the observer API
There are two main motivations to this:
a) The logic for handling internal and userland observation can be unified.
b) Unwinding of observed functions on a bailout does notably not include observers. Even if users of observers were to ensure such handling themselves, it would be impossible to retain the relative ordering - either the user has to unwind all internal observed frames before the automatic unwinding (zend_observer_fcall_end_all) or afterwards, but not properly interleaved.

Signed-off-by: Bob Weinand <bobwei9@hotmail.com>
2022-07-30 19:20:55 +02:00
Ilija Tovilo
7aadbcb8f4
GH-8344 Fetch properties of enums in const expressions 2022-07-18 23:52:28 +02:00
Rowan Tommins
af15923bc3
Extend deprecation notices to is_callable($foo) and callable $foo
Implements https://wiki.php.net/rfc/partially-supported-callables-expand-deprecation-notices
so that uses of "self" and "parent" in is_callable() and callable
type constraints now raise a deprecation notice, independent of the
one raised when and if the callable is actually invoked.

A new flag is added to the existing check_flags parameter of
zend_is_callable / zend_is_callable_ex, for use in internal calls
that would otherwise repeat the notice multiple times. In particular,
arguments to internal function calls are checked first based on
arginfo, and then again during ZPP, so the former suppresses the
deprecation notice.

Some existing tests which raised this deprecation have been updated
to avoid the syntax, but the existing version retained for maximum
regression coverage until it is made an error.

With thanks to Juliette Reinders Folmer for the RFC and initial
investigation.

Closes GH-8823.
2022-07-14 17:07:42 +02:00
George Peter Banyard
f905590764
Add support for Disjoint Normal Form (DNF) types (#8725)
RFC: https://wiki.php.net/rfc/dnf_types

This allows to combine union and intersection types together in the following form (A&B)|(X&Y)|T but not of the form (X|A)&(Y|B) or (X|A)&(Y|B)|T.

* Improve union type parsing

Co-authored-by: Sara Golemon <pollita@php.net>
2022-07-08 11:30:23 +01:00
Ilija Tovilo
40908b10fc
Merge branch 'PHP-8.1'
* PHP-8.1:
  Disallow assigning reference to  unset readonly property
2022-07-01 12:20:32 +02:00
Ilija Tovilo
110573726b
Disallow assigning reference to unset readonly property
Closes GH-7942
Closes GH-8188
2022-07-01 12:16:32 +02:00
Joe Rowell
89688b115d
Add function exposing HAVE_GCC_GLOBAL_REGS (#8359) 2022-06-08 12:32:30 +01:00
George Peter Banyard
b40ae80804
Convert iterable into an internal alias for Traversable|array (#7309)
This does a compile time transformation of ``iterable`` into ``Traversable|array`` which simplifies some of the LSP variance handling.

The arginfo generation script from stubs is updated to produce a union type when it encounters the type ``iterable``
Extension functions which do not regenerate the arginfo, or write them manually are still supported by mimicking the compile time transformation while registering the function.

Type Reflection is preserved for single ``iterable`` (and ``?iterable``) to produce a ReflectionNamedType with name ``iterable``, however usage of ``iterable`` in union types will be converted to ``array|Traversable``
2022-06-07 13:35:34 +01:00
Levi Morrison
280fd680c8
Make vm_interrupt and timed_out atomic (#8327)
This is done by adding a new zend_atomic_bool type. The type
definition is only available for compiler alignment and size info; it
should be treated as opaque and only the zend_atomic_bool_* family of
functions should be used.

Note that directly using atomic_bool is complicated. All C++ compilers
stdlibs that I checked typedef atomic_bool to std::atomic<bool>, which
can't be used in an extern "C" section, and there's at least one usage
of this in core, and probably more outside of it.

So, instead use platform specific functions, preferring compiler
intrinsics.
2022-06-01 09:43:25 -06:00
Max Kellermann
8620788c2a Zend/zend_execute: remove duplicate deinitialization code
This code duplication was introduced by commit 85f35a8fc1 ("Separate
unspecializeble code of INCLIDE_OR_EVAL into helper functions") for no
obvious reason.
2022-04-02 17:42:49 +02:00
Max Kellermann
b9e895bca0
Replace memcmp() with zend_string functions (#8216)
* ext/oci8: use zend_string_equals()

Eliminate duplicate code.

* main/php_variables: use zend_string_equals_literal()

Eliminate duplicate code.

* Zend/zend_string: add zend_string_equals_cstr()

Allows eliminating duplicate code.

* Zend, ext/{opcache,standard}, main/output: use zend_string_equals_cstr()

Eliminate duplicate code.

* Zend/zend_string: add zend_string_starts_with()

* ext/{opcache,phar,spl,standard}: use zend_string_starts_with()

This adds missing length checks to several callers, e.g. in
cache_script_in_shared_memory().  This is important when the
zend_string is shorter than the string parameter, when memcmp()
happens to check backwards; this can result in an out-of-bounds memory
access.
2022-03-31 16:27:58 +02:00
Dmitry Stogov
107997e58e Merge branch 'PHP-8.1'
* PHP-8.1:
  Prevent array modification if it's captured by user error handler during index conversion
2022-02-01 17:23:32 +03:00
Dmitry Stogov
718478377b Prevent array modification if it's captured by user error handler during
index conversion

Fixes oss-fuzz #44235
2022-02-01 17:22:18 +03:00
Dmitry Stogov
aab52968a3 micro-optimization 2021-12-23 18:31:45 +03:00
Dmitry Stogov
79fac32d6b Don't call zend_attach/detach_symbol_table() for op_arrays without local variables 2021-12-16 17:37:01 +03:00
Dmitry Stogov
623b3fc83f Merge branch 'PHP-8.1'
* PHP-8.1:
  Move common code into helper
2021-12-14 15:32:20 +03:00
Dmitry Stogov
b16fc350a4 Move common code into helper 2021-12-14 15:31:53 +03:00
Dmitry Stogov
1959bbfc1b Merge branch 'PHP-8.1'
* PHP-8.1:
  Combine ADDREF/DELREF
2021-12-13 22:54:57 +03:00
Dmitry Stogov
1e56b64759 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Combine ADDREF/DELREF
2021-12-13 22:54:45 +03:00
Dmitry Stogov
c787f42ceb Combine ADDREF/DELREF 2021-12-13 22:38:23 +03:00
Dmitry Stogov
d9926a109d Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix array clobering by user error handler
2021-12-13 15:20:24 +03:00
Dmitry Stogov
76075823e7 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix array clobering by user error handler
2021-12-13 15:20:16 +03:00
Dmitry Stogov
cbc0b1afeb Fix array clobering by user error handler
Fixes oss-fuzz #42234
2021-12-13 14:59:30 +03:00
Dmitry Stogov
90e5eed9db Merge branch 'PHP-8.1'
* PHP-8.1:
  Separate "cold" code
2021-12-07 11:47:01 +03:00