Commit graph

2249 commits

Author SHA1 Message Date
Niels Dossche
553d79c709
Fix GH-16799: Assertion failure at Zend/zend_vm_execute.h:7469
zend_is_callable_ex() can unfortunately emit a deprecation, and then
a user error handler can throw an exception. This causes an assert
failure at ZEND_VM_NEXT_OPCODE(). We fix this by checking if there's an
exception after zend_is_callable_ex().

Closes GH-16803.
2024-11-15 20:02:26 +01:00
Ilija Tovilo
f203edd3c5
Fix leak of call->extra_named_params on internal __call
Fixes GH-12835
Closes GH-12836
2023-12-01 16:49:16 +01:00
Bob Weinand
50ccea31f2 Merge branch 'PHP-8.1' into PHP-8.2 2023-11-25 00:59:26 +01:00
Florian Engelhardt
8d2df86b06
Fix invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC (#12768)
* fix segfault in `ZEND_BIND_STATIC`

In case a `ZEND_BIND_STATIC` is being executed, while the current chunk is full,
the `zend_array_dup()` call will trigger a OOM in ZendMM which will crash, as
the opline might be a dangling pointer.

* add missing test

* `assert()`ing seems easier than trying to make the compiler to not optimize

* moved from function call to INI setting, so we can use this in other places as well

* make `assert()` work no NDEBUG builds

* document magic number

* fix segfault in `ZEND_FUNC_GET_ARGS`

In case a `ZEND_FUNC_GET_ARGS` is being executed, while the current chunk is
full, the `zend_new_array()` call will trigger a OOM in ZendMM which will crash,
as the opline might be a dangling pointer.

---------

Co-authored-by: Florian Engelhardt <florian@engelhardt.tc>
2023-11-25 00:54:02 +01:00
Ilija Tovilo
1fdcfa4ebe
Fix use-after-free of name in var-var with malicious error handler
Fixes oss-fuzz #54325
Closes GH-12732
2023-11-22 21:08:55 -06:00
Ilija Tovilo
ea52706a2a
Fix use-after-free of name in var-var with malicious error handler
Fixes oss-fuzz #54325
Closes GH-12732
2023-11-20 14:05:46 +01:00
Dmitry Stogov
ab6d564a7e Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fixed uninitialized EX(opline) access (possible Zend/tests/gh12073.phpt crash)
2023-09-05 10:13:22 +03:00
Dmitry Stogov
f1f608bf53 Fixed uninitialized EX(opline) access (possible Zend/tests/gh12073.phpt crash) 2023-09-05 10:11:54 +03:00
Dmitry Stogov
42619b2378 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Keep consistent EG(current_execute_data) after return from generator (#11380)
2023-06-08 14:55:43 +03:00
Dmitry Stogov
06d68738b7
Keep consistent EG(current_execute_data) after return from generator (#11380) 2023-06-08 14:55:18 +03:00
Dmitry Stogov
e14ac1caee Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Allow FETCH_OBJ_W and FETCH_STATIC_PROP_W to return INDIRECT/UNDEF zval for uninitialized typed properties (#11048)
2023-04-10 23:25:08 +03:00
Dmitry Stogov
0c65b396d6
Allow FETCH_OBJ_W and FETCH_STATIC_PROP_W to return INDIRECT/UNDEF zval for uninitialized typed properties (#11048) 2023-04-10 23:19:17 +03:00
Kamil Tekiela
e223bf2015
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix strlen error message param name
2023-03-10 12:48:46 +00:00
Kamil Tekiela
1be99faeff
Fix strlen error message param name 2023-03-04 23:25:42 +00:00
Ilija Tovilo
81f3fcd5cc
Revert "Remove useless UNEXPECTED around RETURN_VALUE_USED in specialized RETVAL handler"
This reverts commit 5b801612cb.
2023-02-17 00:28:33 +01:00
Ilija Tovilo
efb9181a98
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Revert "Fix GH-10168: heap-buffer-overflow at zval_undefined_cv"
2023-02-16 14:13:17 +01:00
Ilija Tovilo
7b68ff46da
Revert "Fix GH-10168: heap-buffer-overflow at zval_undefined_cv"
This reverts commit 71ddede565.
2023-02-16 14:07:17 +01:00
Ilija Tovilo
972a5a02bd
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-10168: heap-buffer-overflow at zval_undefined_cv
2023-02-08 01:12:03 +01:00
Niels Dossche
71ddede565
Fix GH-10168: heap-buffer-overflow at zval_undefined_cv
The problem is that we're using the variable_ptr in the opcode handler
*after* it has already been destroyed. The solution is to create a
specialised version of zend_assign_to_variable which takes in two
destination zval pointers.

Closes GH-10524
2023-02-08 01:06:50 +01:00
Arnaud Le Blanc
c2e77f9c0f Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [ci skip] NEWS
  Fix GH-10248: Assertion `!(zval_get_type(&(*(property))) == 10)' failed.
2023-01-20 16:52:52 +01:00
Christoph M. Becker
66605994ad
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix incorrect check condition in ZEND_YIELD
2023-01-18 16:28:04 +01:00
Niels Dossche
b5e9bf7775
Fix incorrect check condition in ZEND_YIELD
The condition `UNEXPECTED(Z_TYPE_P(key)) == IS_REFERENCE` always
returned false, because `UNEXPECTED(expression)` always returns 0 or 1.
Move the parens so the comparison is executed properly.

Closes GH-10332.
2023-01-18 16:23:38 +01:00
Derick Rethans
9529b8919f Merge branch 'PHP-8.1' into PHP-8.2 2022-12-23 16:36:40 +00:00
Derick Rethans
233ffccc35 Fix GH-10072: PHP crashes when execute_ex is overridden and a __call trampoline is used from internal code 2022-12-23 16:34:57 +00:00
Dmitry Stogov
05b63b1593 Don't check "fake" closures (fix assertion)
Fixes oss-fuzz #53078
2022-11-07 12:19:54 +03:00
Arnaud Le Blanc
cfd5fb98e4 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [ci skip] NEWS
  [ci skip] NEWS
  Fix compilation warning
  Fix crash when memory limit is exceeded during generator initialization
2022-10-22 10:44:55 +02:00
Arnaud Le Blanc
ebe58459aa Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  [ci skip] NEWS
  Fix compilation warning
  Fix crash when memory limit is exceeded during generator initialization
2022-10-22 10:44:06 +02:00
Arnaud Le Blanc
26c7c82d32 Fix crash when memory limit is exceeded during generator initialization 2022-10-22 10:40:28 +02:00
Dmitry Stogov
c083efb779 Fix memory leak
Fixes oss-fuzz #51622
2022-09-26 12:02:03 +03:00
Dmitry Stogov
5ad8b3bcfa Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix memory leak
2022-09-26 11:47:32 +03:00
Dmitry Stogov
b20568d4fa Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix memory leak
2022-09-26 11:44:38 +03:00
Dmitry Stogov
8258b7731b Fix memory leak
Fixes oss-fuzz #51622
2022-09-26 11:43:38 +03:00
George Peter Banyard
6a7935351b Merge branch 'PHP-8.1' 2022-08-19 12:55:12 +01:00
George Peter Banyard
c36a1ea1ae Merge branch 'PHP-8.0' into PHP-8.1 2022-08-19 12:52:58 +01:00
Tim Starling
ba029fce68 Fix GH-9323: crash when the VM enters userspace code via the GC
Closes GH-9323
2022-08-19 12:50:02 +01:00
twosee
7eba683e2c
Fix unexpected deprecated dynamic property warning (#9324)
Occurred when exit() with uncaught exception in finally block.
2022-08-15 20:54:39 +08:00
Ilija Tovilo
0f29436a2f
Remove useless UNEXPECTED around RETURN_VALUE_USED in specialized RETVAL handler (#9329)
This can lead to funny code like UNEXPECTED(1) which is non-sensical.
2022-08-15 14:21:02 +02:00
sji
3b62d66098
Implement constants in traits (#8888)
RFC: https://wiki.php.net/rfc/constants_in_traits
2022-08-04 20:08:40 +01:00
Bob Weinand
625f164963 Include internal functions in the observer API
There are two main motivations to this:
a) The logic for handling internal and userland observation can be unified.
b) Unwinding of observed functions on a bailout does notably not include observers. Even if users of observers were to ensure such handling themselves, it would be impossible to retain the relative ordering - either the user has to unwind all internal observed frames before the automatic unwinding (zend_observer_fcall_end_all) or afterwards, but not properly interleaved.

Signed-off-by: Bob Weinand <bobwei9@hotmail.com>
2022-07-30 19:20:55 +02:00
Aaron Piotrowski
2bc6025c2c
Prevent fiber switching in tick function and signal handlers (#9028) 2022-07-16 13:05:16 -05:00
Derick Rethans
5bfc160817 Don't shortcut empty oparray executions if zend_execute_ex has been overridden 2022-06-22 12:28:36 +01:00
Ilija Tovilo
ddc0b490f7
Allow arbitrary const expressions in backed enums
Closes GH-7821
Closes GH-8190
Closes GH-8418
2022-06-12 22:56:05 +02:00
Ilija Tovilo
5a855ee8d6
Fix GH-8661: Nullsafe in coalesce triggers undefined variable warning
Closes GH-8690
2022-06-12 21:52:14 +02:00
Levi Morrison
280fd680c8
Make vm_interrupt and timed_out atomic (#8327)
This is done by adding a new zend_atomic_bool type. The type
definition is only available for compiler alignment and size info; it
should be treated as opaque and only the zend_atomic_bool_* family of
functions should be used.

Note that directly using atomic_bool is complicated. All C++ compilers
stdlibs that I checked typedef atomic_bool to std::atomic<bool>, which
can't be used in an extern "C" section, and there's at least one usage
of this in core, and probably more outside of it.

So, instead use platform specific functions, preferring compiler
intrinsics.
2022-06-01 09:43:25 -06:00
Dmitry Stogov
df0c8aaee9 JIT: Fix array clobbering by user error handler
Fixes oss-fuzz #46336
2022-04-04 16:47:47 +03:00
Dmitry Stogov
4f18dbeb97 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  JIT: Fix array clobbering by user error handler
2022-04-04 16:37:17 +03:00
Dmitry Stogov
c489e360a6 JIT: Fix array clobbering by user error handler
Fixes oss-fuzz #46336
2022-04-04 16:36:25 +03:00
Dmitry Stogov
233b659223 Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix memory leak
2022-02-01 16:26:29 +03:00
Dmitry Stogov
8e2406c59b Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix memory leak
2022-02-01 16:25:03 +03:00
Dmitry Stogov
a60a9b4a89 Fix memory leak
Fixes oss-fuzz #44222
2022-02-01 16:24:22 +03:00