Commit graph

135651 commits

Author SHA1 Message Date
Niels Dossche
1863014fbd
Split off php_set_sock_blocking() and s.is_blocked to a separate function
This makes it harder to forget the check and keeps the variable and
function call consistent.

Closes GH-18604.
2025-05-20 08:08:06 +02:00
Niels Dossche
31ebb42268
Fix missing checks against php_set_blocking() in xp_ssl.c 2025-05-20 08:07:34 +02:00
Niels Dossche
b2d78ae00c
Backport accel_globals->key leak fix (8.3)
Closes GH-18602.
2025-05-19 22:27:54 +02:00
Niels Dossche
41e11a627d
Fix GH-18567: Preloading with internal class alias triggers assertion failure
The assertion is imprecise now, and the code assumed that from the
moment an internal class was encountered that there were only internal
classes remaining. This is wrong now, and we still have to continue if
we encounter an internal class. We can only skip the remaining iterations
if the entry in the hash table is not an alias.

Closes GH-18575.
2025-05-19 19:19:26 +02:00
Niels Dossche
92a0cc7d94
Fix deprecation warning for libxml SAX header (#18594)
This header is deprecated, but fortunately it isn't actually used.
2025-05-19 19:10:27 +02:00
Niels Dossche
98cb17f4fd
Fix OSS-Fuzz #418106144
The VM assumes that an exception must be handled when the AST evaluation
returns FAILURE. However, the comparison functions always return SUCCESS
even if an exception happened. This can be fixed in
zend_ast_evaluate_inner() or we can make is_smaller_function() etc check
for the exception. I chose the former to avoid impact or API breaks.
Perhaps in the future the comparison functions should either return void
or return whether an exception happened, as to be not misleading.

Closes GH-18589.
2025-05-19 19:05:32 +02:00
Niels Dossche
46ac878f6a
Fix OSS-Fuzz #417078295
If the variable_ptr and fetched value are the same or overlap, then we
get a UAF. Prevent this by delaying destruction.

Closes GH-18588.
2025-05-19 19:04:58 +02:00
Levi Morrison
35455b17be
fix: dangling opline in ZEND_INIT_ARRAY (#18578)
This causes problems if an allocation profiler decides to walk the
stack, or if the engine itself OOMs on this opcode, and it tries to
print file and line information.
2025-05-19 09:45:28 -06:00
David Carlier
88d6e7c238
fix regex typo for GH-18577 new test 2025-05-17 12:44:57 +01:00
David Carlier
4dcbd24bad
GH-18572: infinite stack recursion in fallback object comparison.
With nested objects and recursive comparisons, it is for now unavoidable
to have a stack overflow we do some early damage control attempt early
on with zend.max_allowed_stack_size check but ultimately more a band-aid
than a definitive solution.

close GH-18577
2025-05-17 11:20:16 +01:00
George Wang
8e5b3129de Address compiler warnings. 2025-05-15 11:52:49 -04:00
Remi Collet
8da9530652
NEWS 2025-05-15 09:21:58 +02:00
Remi Collet
2760a3ef97
Fix GH-18529: ldap no longer respects TLS_CACERT from ldaprc in ldap_start_tls() Regresion introduced in fix for GH-17776
- ensure TLS string options are properly inherited
  workaround to openldap issue https://bugs.openldap.org/show_bug.cgi?id=10337

- fix ldaps/start_tls tests using LDAPNOINIT in ldaps/tls tests
2025-05-15 09:19:57 +02:00
Tim Düsterhus
8d2682fc50
standard: Take zend.assertions into account for dynamic calls to assert() (#18521)
Fixes php/php-src#18509.
2025-05-12 08:44:46 +02:00
Niels Dossche
e7a44a68e9
Sync EXTENSIONS and extend maintenance time 2025-05-06 22:06:31 +02:00
Ilija Tovilo
69f0882d3b
Fix missing include in win32/globals.c
This previously errored with:

win32\globals.c(66): error C2220: the following warning is treated as an error
win32\globals.c(66): warning C4013: 'php_win32_signal_ctrl_handler_request_shutdown' undefined; assuming extern returning int

This only errors on master because of 2473f57ba (thanks to Niels for
that info!).

Closes GH-18508
2025-05-06 15:51:37 +02:00
Niels Dossche
dcf9d8f812
Fix GH-18494: PDO OCI segfault in statement GC
This is the same issue that was fixed in 2ae897fff7, but now for OCI.

Closes GH-18495.
2025-05-05 19:30:23 +02:00
Niels Dossche
fb3536fd60
Fix leak+crash with sapi_windows_set_ctrl_handler()
The ctrl_handler is never destroyed. We have to destroy it at request
end so we avoid leaking it and also avoid keeping a reference to
previous request memory in a next request. The latter can result in a
crash and can be demonstrated with this script and `--repeat 2`:

```php
class Test {
	public function set() {
		sapi_windows_set_ctrl_handler(self::cb(...));
	}
	public function cb() {
	}
}

$test = new Test;
$test->set();
sleep(3);
```
When you hit CTRL+C in the second request you can crash.

This patch resolves both the leak and crash by destroying the
ctrl_handler after a request.

Closes GH-18231.
2025-05-05 19:13:39 +02:00
David Carlier
8a585856d1
Fix GH-18480: array_splice overflow on array length with offset.
close GH-18483
2025-05-04 14:14:22 +01:00
David Carlier
0227d96f48
Fix GH-18481: date_sunrise check sun rise with offset if is finite/is nan
close GH-18484
2025-05-03 16:56:09 +01:00
David Carlier
24ab0f1ea1
Fixed GH-18458: Authorization set with CURLOPT_USERPWD with NULL value.
Close GH-18460
2025-05-02 21:31:50 +01:00
Niels Dossche
9c555f5a84
Update NEWS for the intl reference fixes 2025-05-01 10:41:57 +02:00
Niels Dossche
a090e59b37
Fix reference handling of IntlTimeZone::getCanonicalID/intltz_get_canonical_id
Closes GH-18469.
2025-05-01 10:41:32 +02:00
Niels Dossche
e3105f5f1e
Fix reference handling of grapheme_extract()
Closes GH-18471.
2025-05-01 10:40:17 +02:00
Niels Dossche
e3cac07a9b
Fix numfmt_parse_currency() reference handling
Closes GH-18472.
2025-05-01 10:39:53 +02:00
David Carlier
d9d58c9d79
Revert "Fixed GH-18458: Authorization set with CURLOPT_USERPWD with NULL value."
This reverts commit bb431f124c.
2025-04-29 22:48:16 +01:00
David Carlier
bb431f124c
Fixed GH-18458: Authorization set with CURLOPT_USERPWD with NULL value. 2025-04-29 22:41:32 +01:00
Niels Dossche
7869af6fa8
Fix GH-18417: Windows SHM reattachment fails when increasing memory_consumption or jit_buffer_size
When a first PHP process launches, Opcache creates a shared file mapping
to use as a shm region. The size of this mapping is set by
opcache.memory_consumption.
When a new PHP process launches while the old one is still running,
Opcache tries to reattach to the shm.
When reattaching it tries to map the requested size (i.e. set by
opcache.memory_consumption). However, if the new requested size is
larger than the size used in the original file mapping, then the call
to VirtualProtect() will fail and the new PHP process will fail to
launch.
It's not possible to resize the virtual region on Windows, unless
relying on undocumented APIs like `NtExtendSection` but then we would
sitll need to communicate that to the first process.

This issue is the root cause of Psalm end-to-end tests failing in
GH-18417: Psalm estimates the required memory sizes and relaunches itself
with more memory requested, if its estimate is below the currently allocated
shared memory. This causes a crash on startup and the tests fail.

To solve this, we need to make the mappings unique per requested size.
There are two ideas:
1. Include in zend_system_id. However, this also affects other things
   and may be too overkill.
2. Include it in the filename, this is an easy local change.
   I went with this option.

Closes GH-18443.
2025-04-28 19:51:31 +02:00
Ilija Tovilo
a16b2c5606
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Use --ignore-platform-req=php+ in community build
2025-04-28 17:11:16 +02:00
Ilija Tovilo
25d21f4161
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Use --ignore-platform-req=php+ in community build
2025-04-28 17:10:58 +02:00
Ilija Tovilo
0a42e6fbc5
Use --ignore-platform-req=php+ in community build
--ignore-platform-reqs may accidentally install versions of dependencies
that no longer support the given PHP version. --ignore-platform-req=php+
will only suppress errors for new PHP version but not change behavior
for older versions. Thanks to Tim for the hint.

Also skip the Laravel build for PHP 8.1, which is no longer supported on
Laravel's default branch.
2025-04-28 17:04:54 +02:00
George Wang
03844d1f51 Update LSAPI version to V8.2 2025-04-27 11:59:40 -04:00
George Wang
58e5d0c240 Update max size of request headers from 65535 to 256K 2025-04-27 11:52:51 -04:00
George Wang
e4f2e4a99a Update SAPI_LITESPEED_PATH to sapi/litespeed/lsphp 2025-04-27 11:20:32 -04:00
Niels Dossche
2beec54e47
datefmt_parse/datefmt_localtime references type system fixes
Closes GH-18441.
2025-04-27 11:31:35 +02:00
Niels Dossche
2eb3100dca
Fix GH-18438: Handling of empty data and errors in ZipArchive::addPattern
There is a ZPP arginfo violation because the empty return or error
return is not always properly handled.
And there is also a memory leak if creating the regular expression
instance fails.

Closes GH-18438.
2025-04-27 11:30:57 +02:00
Niels Dossche
b066ac0b23
Fix GH-18431: Registering ZIP progress callback twice doesn't work
Libzip already cleans up the previous callback, so when that means:
1. The callback zval being already copied over the previous one causes
   libzip to clean up the new callback object. This is the root cause.
2. Our own code to clean the old callback is redundant.

Closes GH-18432.
2025-04-26 14:21:03 +02:00
Niels Dossche
a91d913901
Fix GH-18421: Integer overflow with large numbers in LimitIterator
Since we already know that `pos < intern->u.limit.offset` at this point,
we can reverse the expression.

Closes GH-18424.
2025-04-25 20:05:55 +02:00
Niels Dossche
32e091260a
Fix GH-17403: Potential deadlock when putenv fails
Closes GH-18368.
2025-04-24 20:22:04 +02:00
Ilija Tovilo
438f07c9f7
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [skip ci] Increase tolerance for cve-2014-3538 tests
2025-04-24 11:27:25 +02:00
Ilija Tovilo
86ac21c3cd
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [skip ci] Increase tolerance for cve-2014-3538 tests
2025-04-24 11:27:16 +02:00
Ilija Tovilo
b5081339e9
[skip ci] Increase tolerance for cve-2014-3538 tests
These regularly fail with "Failed, time=1.5x".
2025-04-24 11:26:17 +02:00
Niels Dossche
54e662c6f5
Revert "Port XML_GetCurrentByteIndex to public APIs"
This reverts commit 8dc799aac7.

Originally, this was going to be deprecated in libxml2 2.14, but this
didn't end up happening in the end, and the replacement function that we
used got deprecated instead. So fix the deprecation warning by reverting
to the original code.

Closes GH-18407.
2025-04-23 22:07:26 +02:00
Niels Dossche
d6e70e7053
Fix DOM tests for upcoming libxml2 serializer changes
DOM HTML serializer will be closer compliant to HTML5 in the next
libxml2 version, so the tests need to be adapted.
Ref: https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/309

Closes GH-18406.
2025-04-23 18:29:44 +02:00
Ilija Tovilo
041abec5b2
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  backporting C++17 detection support for recent icu4c releases.
  Drop tidyp from FreeBSD build
2025-04-23 11:01:31 +02:00
Ilija Tovilo
8e533496b0
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  backporting C++17 detection support for recent icu4c releases.
  Drop tidyp from FreeBSD build
2025-04-23 11:01:23 +02:00
David Carlier
3fdd3ed9f7
backporting C++17 detection support for recent icu4c releases. 2025-04-23 11:01:11 +02:00
Ilija Tovilo
35936bfa79
Drop tidyp from FreeBSD build
It looks like it's no longer supported. We don't test tidy on FreeBSD
anyway.
2025-04-23 11:00:24 +02:00
Saki Takamachi
c668ed4225
[skip ci] NEWS for #18317 2025-04-23 09:31:10 +09:00
Tim Düsterhus
92cec8add5
fileinfo: Fix cleanup in ext/fileinfo/tests/cve-2014-1943-mb.phpt (#18397)
This also removes an accidentally committed file.
2025-04-22 22:24:49 +02:00