Commit graph

2370 commits

Author SHA1 Message Date
Ilija Tovilo
972a5a02bd
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-10168: heap-buffer-overflow at zval_undefined_cv
2023-02-08 01:12:03 +01:00
Niels Dossche
71ddede565
Fix GH-10168: heap-buffer-overflow at zval_undefined_cv
The problem is that we're using the variable_ptr in the opcode handler
*after* it has already been destroyed. The solution is to create a
specialised version of zend_assign_to_variable which takes in two
destination zval pointers.

Closes GH-10524
2023-02-08 01:06:50 +01:00
Niels Dossche
99b86141ae Introduce convenience macros for copying flags that hold when concatenating two strings
This abstracts away, and cleans up, the flag handling for properties of
strings that hold when concatenating two strings if they both hold that
property. (These macros also work with simply copies of strings because
a copy of a string can be considered a concatenation with the empty
string.) This gets rid of some branches and some repetitive code, and
leaves room for adding more flags like these in the future.
2023-02-05 14:32:50 +00:00
Ilija Tovilo
35a36b13e5
Fix comp-time and constant evaluation of dynamic class constant fetch
Fixes GH-10486
Fixes oss-fuzz #55436
Fixes oss-fuzz #55472
Closes GH-10487
2023-02-02 19:18:17 +01:00
George Peter Banyard
64127b66c6 Concatenating two valid UTF-8 strings produces a valid UTF-8 string
The UTF-8 valid flag needs to be copied upon interning,
otherwise strings that are concatenated at compile time lose this information.

However, if previously this string was interned without the flag it is not added
E.g. in the case the string is an existing class name.

Co-authored-by: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
2023-02-02 12:02:36 +00:00
Ilija Tovilo
02bd52b5a8
Implement dynamic class const fetch
https://wiki.php.net/rfc/dynamic_class_constant_fetch

Closes GH-9793
2023-01-26 16:46:34 +01:00
Máté Kocsis
7936c8085e
Fix GH-8329 Print true/false instead of bool in error and debug messages (#8385) 2023-01-23 10:52:14 +01:00
Arnaud Le Blanc
95ccce3c13 Merge branch 'PHP-8.2'
* PHP-8.2:
  [ci skip] NEWS
  [ci skip] NEWS
  Fix GH-10248: Assertion `!(zval_get_type(&(*(property))) == 10)' failed.
2023-01-20 16:55:11 +01:00
Arnaud Le Blanc
c2e77f9c0f Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [ci skip] NEWS
  Fix GH-10248: Assertion `!(zval_get_type(&(*(property))) == 10)' failed.
2023-01-20 16:52:52 +01:00
Christoph M. Becker
7d3a7efd4a
Merge branch 'PHP-8.2'
* PHP-8.2:
  Fix incorrect check condition in ZEND_YIELD
2023-01-18 16:28:42 +01:00
Christoph M. Becker
66605994ad
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix incorrect check condition in ZEND_YIELD
2023-01-18 16:28:04 +01:00
Niels Dossche
b5e9bf7775
Fix incorrect check condition in ZEND_YIELD
The condition `UNEXPECTED(Z_TYPE_P(key)) == IS_REFERENCE` always
returned false, because `UNEXPECTED(expression)` always returns 0 or 1.
Move the parens so the comparison is executed properly.

Closes GH-10332.
2023-01-18 16:23:38 +01:00
Derick Rethans
02a5335b71 Merge branch 'PHP-8.2' 2022-12-23 16:36:48 +00:00
Derick Rethans
9529b8919f Merge branch 'PHP-8.1' into PHP-8.2 2022-12-23 16:36:40 +00:00
Derick Rethans
233ffccc35 Fix GH-10072: PHP crashes when execute_ex is overridden and a __call trampoline is used from internal code 2022-12-23 16:34:57 +00:00
Arnaud Le Blanc
a11c8a3039
Limit stack size (#9104) 2022-12-16 17:44:26 +01:00
Jorg Adam Sowa
77ee92a50c
Remove unnecessary usage of CONST_CS
Closes GH-9685.
2022-11-28 17:12:07 +01:00
Ilija Tovilo
8731fb2d09
Fix caching of default params with side-effects
Fixes GH-9965
Closes GH-9935
2022-11-17 11:52:12 +01:00
Dmitry Stogov
08f9b50a9c Merge branch 'PHP-8.2'
* PHP-8.2:
  Don't check "fake" closures (fix assertion)
2022-11-07 12:21:03 +03:00
Dmitry Stogov
05b63b1593 Don't check "fake" closures (fix assertion)
Fixes oss-fuzz #53078
2022-11-07 12:19:54 +03:00
蝦米
6d298cc784
Optimize spread operator for packed arrays (fix GH-9794) (#9796) 2022-10-26 18:52:28 -04:00
Arnaud Le Blanc
77eadc5c9f Merge branch 'PHP-8.2'
* PHP-8.2:
  [ci skip] NEWS
  [ci skip] NEWS
  [ci skip] NEWS
  Fix compilation warning
  Fix crash when memory limit is exceeded during generator initialization
2022-10-22 10:45:21 +02:00
Arnaud Le Blanc
cfd5fb98e4 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [ci skip] NEWS
  [ci skip] NEWS
  Fix compilation warning
  Fix crash when memory limit is exceeded during generator initialization
2022-10-22 10:44:55 +02:00
Arnaud Le Blanc
ebe58459aa Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  [ci skip] NEWS
  Fix compilation warning
  Fix crash when memory limit is exceeded during generator initialization
2022-10-22 10:44:06 +02:00
Arnaud Le Blanc
26c7c82d32 Fix crash when memory limit is exceeded during generator initialization 2022-10-22 10:40:28 +02:00
Máté Kocsis
519c21f87a
Do not overwrite the zobj variable in ASSIGN_OBJ opcode (#9684) 2022-10-07 06:58:09 +02:00
Dmitry Stogov
c083efb779 Fix memory leak
Fixes oss-fuzz #51622
2022-09-26 12:02:03 +03:00
Dmitry Stogov
5ad8b3bcfa Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix memory leak
2022-09-26 11:47:32 +03:00
Dmitry Stogov
b20568d4fa Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix memory leak
2022-09-26 11:44:38 +03:00
Dmitry Stogov
8258b7731b Fix memory leak
Fixes oss-fuzz #51622
2022-09-26 11:43:38 +03:00
George Peter Banyard
6a7935351b Merge branch 'PHP-8.1' 2022-08-19 12:55:12 +01:00
George Peter Banyard
c36a1ea1ae Merge branch 'PHP-8.0' into PHP-8.1 2022-08-19 12:52:58 +01:00
Tim Starling
ba029fce68 Fix GH-9323: crash when the VM enters userspace code via the GC
Closes GH-9323
2022-08-19 12:50:02 +01:00
twosee
7eba683e2c
Fix unexpected deprecated dynamic property warning (#9324)
Occurred when exit() with uncaught exception in finally block.
2022-08-15 20:54:39 +08:00
Ilija Tovilo
0f29436a2f
Remove useless UNEXPECTED around RETURN_VALUE_USED in specialized RETVAL handler (#9329)
This can lead to funny code like UNEXPECTED(1) which is non-sensical.
2022-08-15 14:21:02 +02:00
sji
3b62d66098
Implement constants in traits (#8888)
RFC: https://wiki.php.net/rfc/constants_in_traits
2022-08-04 20:08:40 +01:00
Bob Weinand
625f164963 Include internal functions in the observer API
There are two main motivations to this:
a) The logic for handling internal and userland observation can be unified.
b) Unwinding of observed functions on a bailout does notably not include observers. Even if users of observers were to ensure such handling themselves, it would be impossible to retain the relative ordering - either the user has to unwind all internal observed frames before the automatic unwinding (zend_observer_fcall_end_all) or afterwards, but not properly interleaved.

Signed-off-by: Bob Weinand <bobwei9@hotmail.com>
2022-07-30 19:20:55 +02:00
Aaron Piotrowski
2bc6025c2c
Prevent fiber switching in tick function and signal handlers (#9028) 2022-07-16 13:05:16 -05:00
Derick Rethans
5bfc160817 Don't shortcut empty oparray executions if zend_execute_ex has been overridden 2022-06-22 12:28:36 +01:00
Ilija Tovilo
ddc0b490f7
Allow arbitrary const expressions in backed enums
Closes GH-7821
Closes GH-8190
Closes GH-8418
2022-06-12 22:56:05 +02:00
Ilija Tovilo
5a855ee8d6
Fix GH-8661: Nullsafe in coalesce triggers undefined variable warning
Closes GH-8690
2022-06-12 21:52:14 +02:00
Levi Morrison
280fd680c8
Make vm_interrupt and timed_out atomic (#8327)
This is done by adding a new zend_atomic_bool type. The type
definition is only available for compiler alignment and size info; it
should be treated as opaque and only the zend_atomic_bool_* family of
functions should be used.

Note that directly using atomic_bool is complicated. All C++ compilers
stdlibs that I checked typedef atomic_bool to std::atomic<bool>, which
can't be used in an extern "C" section, and there's at least one usage
of this in core, and probably more outside of it.

So, instead use platform specific functions, preferring compiler
intrinsics.
2022-06-01 09:43:25 -06:00
Bob Weinand
b4285e5546 Ensure vm_spec_handlers exists for all opcodes <= 255 so that user defined higher opcodes do not read outside buffer
This largely has no effect in practice, but ASAN will complain then.
2022-05-25 11:28:34 +02:00
Dmitry Stogov
df0c8aaee9 JIT: Fix array clobbering by user error handler
Fixes oss-fuzz #46336
2022-04-04 16:47:47 +03:00
Dmitry Stogov
4f18dbeb97 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  JIT: Fix array clobbering by user error handler
2022-04-04 16:37:17 +03:00
Dmitry Stogov
c489e360a6 JIT: Fix array clobbering by user error handler
Fixes oss-fuzz #46336
2022-04-04 16:36:25 +03:00
Dmitry Stogov
233b659223 Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix memory leak
2022-02-01 16:26:29 +03:00
Dmitry Stogov
8e2406c59b Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix memory leak
2022-02-01 16:25:03 +03:00
Dmitry Stogov
a60a9b4a89 Fix memory leak
Fixes oss-fuzz #44222
2022-02-01 16:24:22 +03:00
Nikita Popov
4543cd32ae Remove JMPZNZ opcode
While JMPZNZ can avoid execution of a separate JMP opcode in some
cases, it also prevents smart branch optimization, so creating
JMPZNZ may actually have a negative effect. It also adds additional
complexity for optimizations.

Drop JMPZNZ in favor of JMPZ+JMP or JMPNZ+JMP.

Closes GH-7857.
2022-01-10 22:07:10 +01:00