Commit graph

134274 commits

Author SHA1 Message Date
Eric Mann
c0799fc3b9
Update NEWS 2024-06-04 07:43:27 -07:00
Niels Dossche
c7486130d9
Fix GHSA-w8qr-v226-r27w
We should not early-out with success status if we found an ipv6
hostname, we should keep checking the rest of the conditions.
Because integrating the if-check of the ipv6 hostname in the
"Validate domain" if-check made the code hard to read, I extracted the
condition out to a separate function. This also required to make
a few pointers const in order to have some clean code.
2024-06-04 07:39:53 -07:00
Niels Dossche
b6d1d3980a
Fix GHSA-3qgc-jrrr-25jv
The original code is error-prone due to the "best fit mapping" that
happens with the argument parsing but not with the query string.
When we get a non-ASCII character, try to remap it and see if it becomes
a hyphen.

An alternative approach is to create a custom main `wmain` receiving
wide-character variations that does the ANSI transformation with the
best-fit mapping, but that's more error-prone and could cause unexpected
breakage.

Another alternative was just don't doing this check altogether and
always check for `cgi || fastcgi` instead, but that breaks real-world
use-cases.
2024-06-04 07:39:11 -07:00
Niels Dossche
e6a82adace
Fix GHSA-9fcc-425m-g385: bypass CVE-2024-1874
The old code checked for suffixes but didn't take into account trailing
whitespace. Furthermore, there is peculiar behaviour with trailing dots
too. This all happens because of the special path-handling code inside
CreateProcessW.

By studying Wine's code, we can see that CreateProcessInternalW calls
get_file_name [1] in our case because we haven't provided an application
name. That code gets the first whitespace-delimited string into app_name
excluding the quotes. It's then passed to create_process_params [2]
where there is the path handling code that transforms the command line
argument to an image path [3]. Inside Wine, the extension check if
performed after these transformations [4]. By doing the same thing in
PHP we match the behaviour and can properly match the extension even in
the given edge cases.

[1] 166895ae3a/dlls/kernelbase/process.c (L542-L543)
[2] 166895ae3a/dlls/kernelbase/process.c (L565)
[3] 166895ae3a/dlls/kernelbase/process.c (L150-L151)
[4] 166895ae3a/dlls/kernelbase/process.c (L647-L654)
2024-06-04 07:38:07 -07:00
Gina Peter Banyard
b2c0db1f89
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  ext/readline: Fix [-Wcalloc-transposed-args] compiler warning
  ext/pdo_mysql: Fix [-Wcalloc-transposed-args] compiler warning
  ext/gd: Fix [-Wcalloc-transposed-args] compiler warning
  ext/ffi: Fix [-Wenum-int-mismatch] compiler warning
  ext/bcmath: Fix [-Wenum-int-mismatch] compiler warning
2024-05-21 12:21:46 +01:00
Gina Peter Banyard
0accfd1fe1
ext/readline: Fix [-Wcalloc-transposed-args] compiler warning
Closes GH-14280
2024-05-21 12:17:25 +01:00
Gina Peter Banyard
d4accd8b12
ext/pdo_mysql: Fix [-Wcalloc-transposed-args] compiler warning 2024-05-21 12:17:25 +01:00
Gina Peter Banyard
3c45152798
ext/gd: Fix [-Wcalloc-transposed-args] compiler warning 2024-05-21 12:17:25 +01:00
Gina Peter Banyard
554541c4db
ext/ffi: Fix [-Wenum-int-mismatch] compiler warning 2024-05-21 12:17:25 +01:00
Gina Peter Banyard
d775ba8804
ext/bcmath: Fix [-Wenum-int-mismatch] compiler warning 2024-05-21 12:17:25 +01:00
Niels Dossche
59744a7fc0
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Skip .NET tests if mscoree is not available (#14281)
2024-05-20 23:27:51 +02:00
Niels Dossche
98288a27bc
Skip .NET tests if mscoree is not available (#14281) 2024-05-20 23:26:52 +02:00
Derick Rethans
9c9f49a1f4
Merge branch 'PHP-8.2' into PHP-8.3 2024-05-20 15:49:46 +01:00
Saki Takamachi
0a8fbef996
Added test 2024-05-20 15:13:53 +01:00
Derick Rethans
e5cb9d7df9
Force ffp-contract to off 2024-05-20 15:13:53 +01:00
Niels Dossche
6bb6ff2adb
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix undefined behaviour in fastcgi.c (#14269)
2024-05-19 22:55:02 +02:00
Niels Dossche
ad5138a341
Fix undefined behaviour in fastcgi.c (#14269)
Arithmetic on NULL pointers is undefined.
2024-05-19 22:54:06 +02:00
Tim Düsterhus
a89d22cc0c
Make the fcc parameter const in zend_call_known_fcc (#14259)
This makes it legal to call the function from a caller that only has a `const`
pointer to the `fcc` to prevent accidental modification.
2024-05-17 16:14:16 +02:00
Kamil Tekiela
05efcc245e
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Clear mysql error in fetch_into
2024-05-17 13:13:18 +02:00
Kamil Tekiela
a59868aef8
Clear mysql error in fetch_into
Closes GH-14256
2024-05-17 13:08:42 +02:00
Niels Dossche
cce922e49b
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix nightly test failure (#14251)
2024-05-16 20:01:38 +02:00
Niels Dossche
02b7d70fa9
Fix nightly test failure (#14251)
The created files have the same filename, creating conflicts. Fix this
by adding a unique suffix.
2024-05-16 20:00:46 +02:00
Niels Dossche
9e71697aba
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-14100: Corrected spelling mistake in php.ini files.
2024-05-15 19:48:00 +02:00
Marcus Xavier
32d21af296
Fix GH-14100: Corrected spelling mistake in php.ini files.
Closes GH-14138.
2024-05-15 19:46:52 +02:00
Niels Dossche
0e98a05a3d
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-14215: Cannot use FFI::load on CRLF header file with apache2handler
2024-05-14 19:52:19 +02:00
Niels Dossche
ebd1a36670
Fix GH-14215: Cannot use FFI::load on CRLF header file with apache2handler
Some modules may reset _fmode, which causes mangling of line endings.
Always be explicit like we do in other places where the native open call
is used.

Closes GH-14218.
2024-05-14 19:49:22 +02:00
Niels Dossche
f16e712327
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix Windows SKIPIF (#14219)
2024-05-13 22:10:42 +02:00
Niels Dossche
719fa46150
Fix Windows SKIPIF (#14219)
PHP_OS_FAMILY never has the value WIN, for Windows platforms it is the
string "Windows". As such, this test was never executed. Fix this.
2024-05-13 22:09:47 +02:00
Ilija Tovilo
614323e4b6
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [skip ci] Fix typo
2024-05-13 13:08:49 +02:00
Ilija Tovilo
fa7933ef17
[skip ci] Fix typo 2024-05-13 13:08:28 +02:00
Ilija Tovilo
018ee8dc6e
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [skip ci] Adjust port for gh13860.phpt
2024-05-13 12:17:05 +02:00
Ilija Tovilo
91c53e43c4
[skip ci] Adjust port for gh13860.phpt
Port 64325 is already used in ext/standard/tests/streams/gh11418.phpt. The test
randomly times out, and it's unclear whether it might be related to the
conflicting port.
2024-05-13 12:16:57 +02:00
Jakub Zelenka
7f8ffbc813
Merge branch 'PHP-8.2' into PHP-8.3 2024-05-12 13:32:56 +01:00
Benjamin Cremer
5b6cda6523
Fix GH-14175: Use two digit float specifier for FPM systemd format req rate
Close GH-14175
2024-05-12 13:30:29 +01:00
Niels Dossche
12ef6cc5a6
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix crash in ParentNode::append() when dealing with a fragment containing text nodes
2024-05-12 02:03:28 +02:00
Niels Dossche
1e2a2d7df2
Fix crash in ParentNode::append() when dealing with a fragment containing text nodes
Credits for test: https://github.com/PhpGt/Dom/pull/454.

Closes GH-14206.
2024-05-12 02:00:31 +02:00
Niels Dossche
59f16223ae
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix missing deref in C14N (#14203)
2024-05-11 17:13:12 +02:00
Niels Dossche
1890d47c51
Fix missing deref in C14N (#14203)
Follow-up for 30a0b0359e, which didn't fix
all places. This is the last remaining place.
2024-05-11 17:12:20 +02:00
Calvin Buckley
68089f0c2a Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Update NEWS for ICU regression fix
2024-05-10 15:35:37 -03:00
Calvin Buckley
239003e01d Update NEWS for ICU regression fix 2024-05-10 15:33:19 -03:00
Calvin Buckley
d479ac4856 Merge remote-tracking branch 'origin/PHP-8.2' into PHP-8.3 2024-05-10 15:08:25 -03:00
Calvin Buckley
4e21a26db2
Fix check for newer versions of ICU (#14186)
* Fix check for newer versions of ICU

The previous test would always trigger, even if the version of ICU
installed didn't require C++17. This was because it incorrectly used
the `test` program, which broke the build on systems without a C++17
compiler.

Tested with macOS 14 and i 7.2.

* Fix broken ICU version check for definition

Same as the previous fix for C++17.

---------

Co-authored-by: Peter Kokot <peterkokot@gmail.com>
2024-05-10 14:20:17 -03:00
Niels Dossche
f365ced13a
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-14189: PHP Interactive shell input state incorrectly handles quoted heredoc literals.
2024-05-10 16:48:59 +02:00
Niels Dossche
217b753a3d
Fix GH-14189: PHP Interactive shell input state incorrectly handles quoted heredoc literals.
Only `'` was handled, no handling case for `"` existed. Simply add it so
the heredoc tag is set up correctly.

Closes GH-14195.
2024-05-10 16:48:26 +02:00
Niels Dossche
d2970cc81f
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-14183: XMLReader::open() can't be overridden
2024-05-10 15:58:14 +02:00
Niels Dossche
15813d69a5
Fix GH-14183: XMLReader::open() can't be overridden
We should only return the override if the internal static method is matched.

Closes GH-14194.
2024-05-10 15:57:09 +02:00
Saki Takamachi
ccdbbdc242
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  ext/hash: Swap the checking order of __has_builtin and __GNUC__ (#14185)
2024-05-10 09:38:42 +09:00
Saki Takamachi
12dc51976b
ext/hash: Swap the checking order of __has_builtin and __GNUC__ (#14185)
closes #14185
2024-05-10 09:37:13 +09:00
Tim Düsterhus
402f3a923f
CI: Do not save the ccache for PRs (8.3+)
see GH-14168
2024-05-07 20:53:33 +02:00
Tim Düsterhus
1bf42b4eb4
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  CI: Do not save the ccache for PRs (#14168)
2024-05-07 20:52:25 +02:00