Commit graph

522 commits

Author SHA1 Message Date
Niels Dossche
ba0853888d
Fix GH-18304: Changing the properties of a DateInterval through dynamic properties triggers a SegFault
For dynamic fetches the cache_slot will be NULL, so we have to check for
that when resetting the cache. For zip and xmlreader this couldn't
easily be tested because of a lack of writable properties.

Closes GH-18307.
2025-04-11 23:33:58 +02:00
Niels Dossche
27affd8da1
Fix GH-18018: RC1 data returned from offsetGet causes UAF in ArrayObject
We should first check truthiness and only after that destroy the value.

Closes GH-18034.
2025-03-13 19:10:34 +01:00
Niels Dossche
ce8ab5f16a
Fix GH-17736: Assertion failure zend_reference_destroy()
The cache slot for FETCH_OBJ_W in function `test` is primed with the
class for C. The next call uses a simplexml instance and reuses the same
cache slot. simplexml's get_property_ptr handler does not use the cache
slot, so the old values remain in the cache slot. When
`zend_handle_fetch_obj_flags` is called this is not guarded by a check
for the class entry. So we end up using the prop_info from the property
C::$a instead of the simplexml property.

This patch adds a reset to the cache slots in the property address fetch
code and also in the extensions with a non-standard reference handler.
This keeps the run time cache consistent and avoids the issue without
complicating the fast paths.

Closes GH-17739.
2025-03-02 22:33:32 +01:00
Ilija Tovilo
dca438e6a3
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Add NEWS entry
  Also fix same issue in ArrayObject::exchangeArray()
  Fix use-after-free in ArrayObject::unset() with destructor
2024-11-04 17:47:49 +01:00
Ilija Tovilo
f7222bd2de
Also fix same issue in ArrayObject::exchangeArray() 2024-11-04 17:46:17 +01:00
Ilija Tovilo
8910ac800d
Fix use-after-free in ArrayObject::unset() with destructor
Fixes GH-16646
Closes GH-16653
2024-11-04 17:45:56 +01:00
Niels Dossche
9774cedb01
Fix GH-15918: Assertion failure in ext/spl/spl_fixedarray.c
SplFixedArray should've never get supported in ArrayObject because it's
overloaded, and so that breaks assumptions. This regressed in c4ecd82f.

Closes GH-15947.
2024-09-20 17:34:23 +02:00
Niels Dossche
dc72ceda90 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-11972: RecursiveCallbackFilterIterator regression in 8.1.18
2023-08-30 22:27:06 +02:00
Niels Dossche
262a22740c Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-11972: RecursiveCallbackFilterIterator regression in 8.1.18
2023-08-30 22:26:36 +02:00
Niels Dossche
ffd7018fcd Fix GH-11972: RecursiveCallbackFilterIterator regression in 8.1.18
When you do an assignment between two zvals (no, not zval*), you copy
all fields. This includes the additional u2 data. So that means for
example the Z_NEXT index gets copied, which in some cases can therefore
cause a cycle in zend_hash lookups.
Instead of doing an assignment, we should be doing a ZVAL_COPY (or
ZVAL_COPY_VALUE for non-refcounting cases). This avoids copying u2.

Closes GH-12086.
2023-08-30 22:18:33 +02:00
George Peter Banyard
d5ad75108e
More usage of known zend_str instead of C string (#11381) 2023-06-08 13:03:29 +01:00
George Peter Banyard
99fa740acb
Use common function for TypeError on illegal offset access (#10544)
This merges all usages of emitting an offset TypeError into a new ZEND_API function
zend_illegal_container_offset(const zend_string* container, const zval *offset, int type);

Where the container should represent the type on which the access is attempted (e.g. string, array)
The offset zval that is used, where the error message will display its type
The type of access, which should be a BP_VAR_* constant, to get special message for isset/empty/unset
2023-06-06 11:28:19 +01:00
nielsdos
001e278549 Merge branch 'PHP-8.2'
* PHP-8.2:
  Fix GH-11178: Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18)
  Fix GH-11175 and GH-11177: Stream socket timeout undefined behaviour
  Fix GH-9068: Conditional jump or move depends on uninitialised value(s)
2023-05-03 19:49:02 +02:00
nielsdos
ab3f584a25 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-11178: Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18)
  Fix GH-11175 and GH-11177: Stream socket timeout undefined behaviour
  Fix GH-9068: Conditional jump or move depends on uninitialised value(s)
2023-05-03 19:46:51 +02:00
nielsdos
81e50b4ee3 Fix GH-11178: Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18)
Dynamic property case in zend_get_property_info() can return NULL for
prop info. This was not handled.

Closes GH-11182.
2023-05-03 19:42:04 +02:00
Ilija Tovilo
a86796e52a
Merge branch 'PHP-8.2'
* PHP-8.2:
  By-ref modification of typed and readonly props through ArrayIterator
2023-03-25 16:24:08 +01:00
Ilija Tovilo
3d8107f74c
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  By-ref modification of typed and readonly props through ArrayIterator
2023-03-25 16:23:48 +01:00
Ilija Tovilo
9aaa5cd093
By-ref modification of typed and readonly props through ArrayIterator
Fixes GH-10844
Closes GH-10872
2023-03-25 16:14:19 +01:00
George Peter Banyard
1d9d1fe109
Merge branch 'PHP-8.2'
* PHP-8.2:
  Fix GH-10519: Array Data Address Reference Issue
2023-03-10 14:24:54 +00:00
George Peter Banyard
4808fb6932
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-10519: Array Data Address Reference Issue
2023-03-10 14:24:38 +00:00
NathanFreeman
49b2ff5dbb
Fix GH-10519: Array Data Address Reference Issue
We need to carry around a reference to the underlying Bucket to be able to modify it by reference.

Closes GH-10749

Signed-off-by: George Peter Banyard <girgias@php.net>
2023-03-10 14:23:30 +00:00
Marcos Marcolin
9004725367
chore: standardize the visibility of functions. (#10708)
Co-authored-by: Marcos Marcolin <marcos@ixcsoft.com.br>
2023-02-26 14:08:33 +00:00
Marcos Marcolin
641fe23e3a
Improve illegal offset error messages (#10504)
Co-authored-by: Marcos Marcolin <marcos@ixcsoft.com.br>
2023-02-08 12:11:41 +00:00
Bob Weinand
d1fc0017c9 Revert "Fix compilation on MacOS"
This reverts commit 800c6672e5.

Reverted along with a01dd9feda.
2022-09-14 11:28:06 +02:00
Bob Weinand
800c6672e5 Fix compilation on MacOS
memrchr has an always available equivalent under the name of zend_memrchr.

Signed-off-by: Bob Weinand <bobwei9@hotmail.com>
2022-08-31 16:45:27 +02:00
Máté Kocsis
adb45a63c0
Fix GH-9186 @strict-properties can be bypassed using unserialization (#9354)
* Emit deprecation warnings when adding dynamic properties to classes during unserialization - this will become an Error in php 9.0.
  (Adding dynamic properties in other contexts was already a deprecation warning - the use case of unserialization was overlooked)
* Throw an error when attempting to add a dynamic property to a `readonly` class when unserializing
* Add new serialization methods `__serialize`/`__unserialize` for SplFixedArray to avoid creating deprecated dynamic
  properties that would then be added to the backing fixed-size array
* Don't add named dynamic/declared properties (e.g. $obj->foo) of SplFixedArray to the backing array when unserializing
* Update tests to declare properties or to expect the deprecation warning
* Add news entry

Co-authored-by: Tyson Andre <tysonandre775@hotmail.com>
2022-08-30 07:46:32 -04:00
Máté Kocsis
b73f139c70
Declare ext/spl constants in stubs (#9226) 2022-08-02 16:37:12 +02:00
Arnaud Le Blanc
4df3dd7679
Reduce memory allocated by var_export, json_encode, serialize, and other (#8902)
smart_str uses an over-allocated string to optimize for append operations. Functions that use smart_str tend to return the over-allocated string directly. This results in unnecessary memory usage, especially for small strings.

The overhead can be up to 231 bytes for strings smaller than that, and 4095 for other strings. This can be avoided for strings smaller than `4096 - zend_string header size - 1` by reallocating the string.

This change introduces `smart_str_trim_to_size()`, and calls it in `smart_str_extract()`. Functions that use `smart_str` are updated to use `smart_str_extract()`.

Fixes GH-8896
2022-07-08 14:47:46 +02:00
Ilija Tovilo
3b92a96610
Convert return type of various object handlers from int to zend_result (#8755) 2022-06-26 01:00:19 +02:00
Christoph M. Becker
3de0ccfe09
Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix GH-8366: ArrayIterator may leak when calling __construct()
2022-04-15 19:10:29 +02:00
Christoph M. Becker
549cf3a24d
Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix GH-8366: ArrayIterator may leak when calling __construct()
2022-04-15 19:08:28 +02:00
Christoph M. Becker
1762a87932
Fix GH-8366: ArrayIterator may leak when calling __construct()
When we detach an iterator, we also have to delete it.

Closes GH-8374.
2022-04-15 19:05:18 +02:00
George Peter Banyard
cfc38a6014
SPL: minor refactoring (#8341)
Use more appropriate types and return macros
2022-04-13 20:34:23 +01:00
George Peter Banyard
db0db2204f
Use zend_result/bool in spl_array.c 2022-03-23 22:21:04 +00:00
George Peter Banyard
2fa33d1def
Use ZEND_THROWS() where applicable in spl_array.c 2022-03-23 22:13:08 +00:00
George Peter Banyard
69ea2d8600
Convert check + exception to assertion
Move the inside the __unserialize() method as that's the only one which now needs this check

Closes GH-8207
2022-03-23 22:02:27 +00:00
Nikita Popov
f13c22fbfb Remove unnecessary zend_user_iterator use in spl_array
We no longer use any functionality of zend_user_iterator here.
2021-09-24 15:12:55 +02:00
Nikita Popov
15bbf6f337 Automatically determine whether to reuse get_iterator()
Same as with the IteratorAggregate case, allow reusing get_iterator
if none of the Iterator methods are overridden. Drop the
REUSE_GET_ITERATOR flag that previously allowed ArrayIterator to
opt-in to unconditional get_iterator reuse, and drop the override
handling it did, in favor of the automated approach.
2021-09-24 15:11:26 +02:00
Nikita Popov
d0dbf7296b Initialize iterator_funcs_ptr upfront
Same as we do for the IteratorAggregate case, initialize the
Iterator methods upfront. This is preparation for an upcoming
change to automatically determine whether get_iterator can be
reused in a child class, in the same way we already do for
IteratorAggregate.
2021-09-24 14:57:13 +02:00
Nikita Popov
5b2ddf5a17 Export zend_use_resource_as_offset()
Use a common implementation to generate this error message, as
we do so in quite a few places dealing with array keys.
2021-08-31 10:58:01 +02:00
Nikita Popov
6d505d4445 Add RETURN/RETVAL_COPY_DEREF() macros
These were missing from the set...

I think quite a few of these usages don't actually need the DEREF,
but I've just kept things as is for now.
2021-07-22 09:44:19 +02:00
Nikita Popov
54c4c7d747 Merge branch 'PHP-8.0'
* PHP-8.0:
  Fix ArrayObject::exchangeArray() return type
2021-07-06 10:52:46 +02:00
Nikita Popov
bcefc31e4e Fix ArrayObject::exchangeArray() return type
This method cannot return null.
2021-07-06 10:52:08 +02:00
Patrick Allaert
aff365871a Fixed some spaces used instead of tabs 2021-06-29 11:30:26 +02:00
George Peter Banyard
ff1145943f
Refactor spl_array_has_dimension_ex()
Use early returns instead of else blocks
Add comments, especially to explain why we need a check_empty == 2 check
2021-06-18 00:47:04 +01:00
Nikita Popov
71fb83567f Fix bug #80945: Don't throw undefined array key warning in ArrayObject unset()
This makes the behavior of ArrayObject the same as far plain
arrays, which don't throw a warning when unsetting a key that
already doesn't exit.
2021-06-14 10:14:38 +02:00
Nikita Popov
9d2a466c4b Remove explicit assignments of zend_objects_destroy_object
This is the default handler, no need to set it explicitly. This
makes it easier to see which objects really have a custom dtor_obj.
2021-06-09 11:29:50 +02:00
George Peter Banyard
b6958bb847
Implement "Deprecate implicit non-integer-compatible float to int conversions" RFC. (#6661)
RFC: https://wiki.php.net/rfc/implicit-float-int-deprecate

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>
2021-05-31 15:48:45 +01:00
KsaR
01b3fc03c3
Update http->https in license (#6945)
1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |
2021-05-06 12:16:35 +02:00
George Peter Banyard
5caaf40b43
Introduce pseudo-keyword ZEND_FALLTHROUGH
And use it instead of comments
2021-04-07 00:46:29 +01:00