Commit graph

19546 commits

Author SHA1 Message Date
Saki Takamachi
f600f86ac4
Update versions for PHP 8.4.10 2025-07-02 11:13:24 +09:00
Niels Dossche
fc89d1968c
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  zend_alloc: Fix compile with ZEND_MM_STAT=0
2025-06-09 17:28:06 +02:00
Niels Dossche
d11f9717fd
zend_alloc: Fix compile with ZEND_MM_STAT=0
Closes GH-18811.
2025-06-09 17:27:39 +02:00
Niels Dossche
5526301908
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  pdo_odbc: Fix memory leak if WideCharToMultiByte() fails
  Fix memory leak on php_odbc_fetch_hash() failure
  Do not delete main chunk in zend_gc
2025-06-09 11:25:41 +02:00
Daniil Gentili
9a9d98e02f
Do not delete main chunk in zend_gc
Closes GH-18756.

Co-authored-by: Arnaud Le Blanc <arnaud.lb@gmail.com>
2025-06-09 11:23:29 +02:00
Niels Dossche
976143e365
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix compile without ZEND_MM_STORAGE
2025-06-05 21:51:38 +02:00
Niels Dossche
4162c20787
Fix compile without ZEND_MM_STORAGE 2025-06-05 21:51:30 +02:00
Niels Dossche
2b383848a7
Fix handling of references in zval_try_get_long()
This API can't handle references, yet everyone keeps forgetting that it
can't and that you should DEREF upfront. Fix every type of this issue
once and for all by moving the reference handling to this Zend API.

Closes GH-18761.
2025-06-04 21:00:05 +02:00
Nikita Popov
d66e87b02e Fix line assignment in zend_ast_create_va()
The intent here was to assign the first found line. Instead this
always fell back to CG(zend_lineno).

Not sure if this line matters for anything in php-src, but the
issue was observed in https://github.com/nikic/php-ast/issues/247.
2025-06-01 20:35:35 +02:00
Máté Kocsis
08b616e2f5
Backport relevant changes of https://github.com/php/php-src/pull/18719
These property writes may now throw exceptions because of property hooks, and this was not handled previously.
2025-05-31 22:31:48 +02:00
Daniel Scherzer
e44c13cffe
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-18695: float numbers zero fraction is now preserved in zend_ast_export() (#18699)
2025-05-29 13:48:38 -07:00
Oleg Efimov
087f38f347
Fix GH-18695: float numbers zero fraction is now preserved in zend_ast_export() (#18699) 2025-05-29 13:46:11 -07:00
DanielEScherzer
cd751f98cb
Reapply GH-17712 with a fix for internal class constants (#18464)
Add recursion protection when emitting deprecation warnings for class
constants, since the deprecation message can come from an attribute that is
using the same constant for the message, or otherwise result in recursion.

But, internal constants are persisted, and thus cannot have recursion
protection. Otherwise, if a user error handler triggers bailout before the
recursion flag is removed then a subsequent request (e.g. with `--repeat 2`)
would start with that flag already applied. Internal constants can presumably
be trusted not to use deprecation messages that come from recursive attributes.

Fixes GH-18463
Fixes GH-17711
2025-05-25 16:43:36 -07:00
Máté Kocsis
bc32d806dd
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix build on Apple Clang 17+ (#18629)
2025-05-24 22:30:02 +02:00
Máté Kocsis
772479ea2f
Fix build on Apple Clang 17+ (#18629)
Fixing "invalid cpu feature string for builtin" errors that started to appear on Apple Clang 17.0.0
2025-05-24 22:26:06 +02:00
Jakub Zelenka
8e2c2be7a5
PHP-8.3 is now for PHP 8.3.23-dev 2025-05-21 00:39:56 +02:00
Calvin Buckley
3e0a4259a8
PHP 8.4 is now for PHP-8.4.9-dev 2025-05-20 13:13:34 -03:00
Niels Dossche
6b795f64a5
Fix GH-18534: FPM exit code 70 with enabled opcache and hooked properties in traits
The trait handling for property hooks in preloading did not exist, we
add a check to skip trait clones and we add the necessary code to update
the op arrays.

Closes GH-18586.
2025-05-19 19:21:53 +02:00
Niels Dossche
08cba2dcc1
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix OSS-Fuzz #418106144
  Fix OSS-Fuzz #417078295
2025-05-19 19:07:17 +02:00
Niels Dossche
98cb17f4fd
Fix OSS-Fuzz #418106144
The VM assumes that an exception must be handled when the AST evaluation
returns FAILURE. However, the comparison functions always return SUCCESS
even if an exception happened. This can be fixed in
zend_ast_evaluate_inner() or we can make is_smaller_function() etc check
for the exception. I chose the former to avoid impact or API breaks.
Perhaps in the future the comparison functions should either return void
or return whether an exception happened, as to be not misleading.

Closes GH-18589.
2025-05-19 19:05:32 +02:00
Niels Dossche
46ac878f6a
Fix OSS-Fuzz #417078295
If the variable_ptr and fetched value are the same or overlap, then we
get a UAF. Prevent this by delaying destruction.

Closes GH-18588.
2025-05-19 19:04:58 +02:00
Levi Morrison
59e6165fa6
Merge branch 'PHP-8.3' into PHP-8.4 2025-05-19 09:53:15 -06:00
Levi Morrison
35455b17be
fix: dangling opline in ZEND_INIT_ARRAY (#18578)
This causes problems if an allocation profiler decides to walk the
stack, or if the engine itself OOMs on this opcode, and it tries to
print file and line information.
2025-05-19 09:45:28 -06:00
David Carlier
68abc19229
Follow-up on GH-18577, adjust new test due to change on nested objects. 2025-05-17 12:46:27 +01:00
David Carlier
e4e71215d6
Merge branch 'PHP-8.3' into PHP-8.4 2025-05-17 12:45:13 +01:00
David Carlier
88d6e7c238
fix regex typo for GH-18577 new test 2025-05-17 12:44:57 +01:00
David Carlier
a7884250b1
Merge branch 'PHP-8.3' into PHP-8.4 2025-05-17 11:20:39 +01:00
David Carlier
4dcbd24bad
GH-18572: infinite stack recursion in fallback object comparison.
With nested objects and recursive comparisons, it is for now unavoidable
to have a stack overflow we do some early damage control attempt early
on with zend.max_allowed_stack_size check but ultimately more a band-aid
than a definitive solution.

close GH-18577
2025-05-17 11:20:16 +01:00
Ilija Tovilo
386ab1dad2
Revert "Fix infinite recursion on deprecated attribute evaluation"
This reverts commit 272f7f75e2.

Reverts GH-17712 for the PHP-8.4 branch. This will be reapplied later
with a fix for GH-18463 (GH-18464).
2025-04-30 20:52:56 +02:00
Saki Takamachi
33b977e36b
PHP-8.4 is now for PHP 8.4.8-dev 2025-04-22 22:23:08 +09:00
Eric Mann
2852177f4d
PHP-8.3 is now for PHP 8.3.22-dev 2025-04-22 06:09:24 -07:00
Niels Dossche
1a1a83f1fc
Fix GH-18136: tracing JIT floating point register clobbering on Windows and ARM64
On win64, xmm6-xmm15 are preserved registers, but the prologues and
epilogues of JITted code don't handle these. The issue occurs when
calling into the JIT code again via an internal handler
(like call_user_func). Therefore, we want to save/restore xmm registers
upon entering/leaving execute_ex. Since MSVC x64 does not support inline
assembly, we create an assembly wrapper around the real execute_ex
function.
The alternative is to always save/restore these xmm registers into the
fixed call frame, but this causes unnecessary overhead.
The same issue occurs for ARM64 platforms for floating point register
8 to 15. However, there we can use inline asm to fix this.

Closes GH-18352.
2025-04-21 13:15:43 +02:00
Ilija Tovilo
6d458caefe
Fix prop info fetching from prop slot with added hooks
Fixes GH-18268
Closes GH-18271
2025-04-08 18:45:26 +02:00
Arnaud Le Blanc
26f5009e91
Fix lazy proxy calling magic methods twice
Fixes GH-18038
Closes GH-18039
2025-03-27 16:17:13 +01:00
Ilija Tovilo
272f7f75e2
Fix infinite recursion on deprecated attribute evaluation
Fixes GH-17711
Fixes GH-18022
Closes GH-17712
2025-03-26 23:39:38 +01:00
Jakub Zelenka
b57f425cfe
PHP 8.3 is now for PHP 8.3.21-dev 2025-03-25 22:09:16 +01:00
Calvin Buckley
9d0c492d30
Bump for 8.4.7-dev 2025-03-25 16:38:46 -03:00
Ilija Tovilo
d5bdf8f508
Fix segfault when evaluating const expr default value of child prop with added hooks
Introduced by GH-17870. Not adding a NEWS entry since this is fixed in
the same version.

Fixes oss-fuzz #403816122
Closes GH-18098
2025-03-23 16:35:04 +01:00
Niels Dossche
d765b60778
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-18107: Opcache CFG jmp optimization with try-finally breaks the exception table
2025-03-21 13:57:16 +01:00
Niels Dossche
2ec8d37eb4
Fix GH-18107: Opcache CFG jmp optimization with try-finally breaks the exception table
If there's a try-finally where the try_op starts on a basic block with a
single JMP, and the JMP optimization causes that basic block to become
unreachable, then we update try_op.
In this case, there is no catch_op, so try_op is erroneously set to 0,
we should instead set it to `b->start`.

Closes GH-18110.
2025-03-21 13:56:31 +01:00
Niels Dossche
8d7cb8cc21
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-17836: zend_vm_gen.php shouldn't break on Windows line endings
2025-03-21 11:51:05 +01:00
Daniel Scherzer
fa3c1c81d5
Fix GH-17836: zend_vm_gen.php shouldn't break on Windows line endings
Closes GH-18121.
2025-03-21 11:50:34 +01:00
Niels Dossche
e98e4e39a3
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fixed bug GH-13193 again
2025-03-21 11:48:16 +01:00
Niels Dossche
447d143b9d
Fixed bug GH-13193 again
Closes GH-13193.
2025-03-21 11:47:52 +01:00
Ilija Tovilo
56841998de
Fix IN_ARRAY optimization
in_array() calls are compiled to frameless calls. Adjust the
optimization appropriately. Luckily, frameless opcodes simplify the
optimization quite a bit.

Fixes GH-18050
Closes GH-18066
2025-03-18 13:42:53 +01:00
Niels Dossche
4fd9992561
Fix OSS-Fuzz #403308724
Because simple hooks can be nested without starting a new context, we
need to restore the old property info in case of nested hooks.

Closes GH-18074.
2025-03-16 13:42:40 +01:00
Arnaud Le Blanc
4b9c72f329
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Destroy temporary module classes in reverse order
2025-03-14 10:49:10 +01:00
Arnaud Le Blanc
1c182674b0
Destroy temporary module classes in reverse order
We destroy classes of dl()'ed modules in clean_module_classes(), during
shutdown. Child classes of a module use structures of the parent class (such as
inherited properties), which are destroyed earlier, so we have a use-after-free
when destroying a child class.

Here I destroy classes in reverse order, as it is done in zend_shutdown() for
persistent classes.

Fixes GH-17961
Fixes GH-15367
2025-03-14 10:45:17 +01:00
Eric Mann
517d7d909d
PHP-8.3 is now for PHP-8.3.20-dev 2025-03-12 06:34:55 -07:00
Jakub Zelenka
6976fb6ba7
Merge branch 'PHP-8.3' into PHP-8.4 2025-03-11 22:23:09 +01:00