Commit graph

536 commits

Author SHA1 Message Date
Niels Dossche
a019fbd970
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-18309: ipv6 filter integer overflow
  Fix GH-18304: Changing the properties of a DateInterval through dynamic properties triggers a SegFault
2025-04-11 23:36:12 +02:00
Niels Dossche
ba0853888d
Fix GH-18304: Changing the properties of a DateInterval through dynamic properties triggers a SegFault
For dynamic fetches the cache_slot will be NULL, so we have to check for
that when resetting the cache. For zip and xmlreader this couldn't
easily be tested because of a lack of writable properties.

Closes GH-18307.
2025-04-11 23:33:58 +02:00
Niels Dossche
d43d4684bd
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-18018: RC1 data returned from offsetGet causes UAF in ArrayObject
2025-03-13 19:11:24 +01:00
Niels Dossche
27affd8da1
Fix GH-18018: RC1 data returned from offsetGet causes UAF in ArrayObject
We should first check truthiness and only after that destroy the value.

Closes GH-18034.
2025-03-13 19:10:34 +01:00
Niels Dossche
ee4a9a4a7c
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-17736: Assertion failure zend_reference_destroy()
2025-03-02 22:37:07 +01:00
Niels Dossche
ce8ab5f16a
Fix GH-17736: Assertion failure zend_reference_destroy()
The cache slot for FETCH_OBJ_W in function `test` is primed with the
class for C. The next call uses a simplexml instance and reuses the same
cache slot. simplexml's get_property_ptr handler does not use the cache
slot, so the old values remain in the cache slot. When
`zend_handle_fetch_obj_flags` is called this is not guarded by a check
for the class entry. So we end up using the prop_info from the property
C::$a instead of the simplexml property.

This patch adds a reset to the cache slots in the property address fetch
code and also in the extensions with a non-standard reference handler.
This keeps the run time cache consistent and avoids the issue without
complicating the fast paths.

Closes GH-17739.
2025-03-02 22:33:32 +01:00
Niels Dossche
b666dc9788
Fix GH-15833: Segmentation fault (access null pointer) in ext/spl/spl_array.c
We're accessing the object properties table directly in spl, but we're
not accounting for lazy objects. Upon accessing we should trigger the
initialization as spl is doing direct manipulations on the object
property table and expects a real object.

Closes GH-17235.
2025-01-09 19:58:00 +01:00
Ilija Tovilo
66ad4ce699
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Add NEWS entry
  Also fix same issue in ArrayObject::exchangeArray()
  Fix use-after-free in ArrayObject::unset() with destructor
2024-11-04 17:49:08 +01:00
Ilija Tovilo
dca438e6a3
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Add NEWS entry
  Also fix same issue in ArrayObject::exchangeArray()
  Fix use-after-free in ArrayObject::unset() with destructor
2024-11-04 17:47:49 +01:00
Ilija Tovilo
f7222bd2de
Also fix same issue in ArrayObject::exchangeArray() 2024-11-04 17:46:17 +01:00
Ilija Tovilo
8910ac800d
Fix use-after-free in ArrayObject::unset() with destructor
Fixes GH-16646
Closes GH-16653
2024-11-04 17:45:56 +01:00
Niels Dossche
1b171bb6b4
Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix GH-15918: Assertion failure in ext/spl/spl_fixedarray.c
2024-09-20 17:34:54 +02:00
Niels Dossche
9774cedb01
Fix GH-15918: Assertion failure in ext/spl/spl_fixedarray.c
SplFixedArray should've never get supported in ArrayObject because it's
overloaded, and so that breaks assumptions. This regressed in c4ecd82f.

Closes GH-15947.
2024-09-20 17:34:23 +02:00
Arnaud Le Blanc
1fbb666545
Use zend_std_build_properties() to access zend_object.properties
The zend_object.properties HashTable needs to be built just in time by calling
rebuild_object_properties() on the object before accessing it. Normally this is
done automatically in zend_std_get_properties(), but we do it manually in a few
places.

In this change I introduce an inline variant of zend_std_build_properties(), and
refactor these places to use it instead of calling rebuild_object_properties()
manually.

rebuild_object_properties() renamed as rebuild_object_properties_internal(), to
enforce usage of zend_std_get_properties() or zend_std_build_properties_ex().

Closes GH-14996
2024-07-18 22:18:38 +02:00
Gina Peter Banyard
5337172508 ext/spl: Use ArrayObject object handlers for ArrayIterator
They are the same
2024-06-15 01:33:09 +01:00
Gina Peter Banyard
809410423f ext/spl: Refactor debug handlers
Mainly to use zend_mangle_property_name() directly instead of spl_gen_private_prop_name()
2024-06-15 01:33:09 +01:00
Gina Peter Banyard
54047c1090 ext/spl: Remove some useless header includes and clarify usages 2024-06-15 01:33:09 +01:00
Gina Peter Banyard
fd2d869642
Clean-up some more headers (#14416)
Remove unused headers (such as php_ini.h for extensions that don't define INI settings)
Use more specific headers when possible
2024-06-08 17:15:36 +01:00
Gina Peter Banyard
0de88dfb81
ext/spl: mark all zend_object_handlers as static (#13547) 2024-02-28 15:31:28 +00:00
David CARLIER
9726721560
general signatures discrepencies fixes (#13122) 2024-01-10 22:19:23 +00:00
George Peter Banyard
ba204a2e3a
ext/spl: Restructure spl_array.c file to move ArrayObject methods together 2023-11-16 00:41:37 +00:00
Niels Dossche
dc72ceda90 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-11972: RecursiveCallbackFilterIterator regression in 8.1.18
2023-08-30 22:27:06 +02:00
Niels Dossche
262a22740c Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-11972: RecursiveCallbackFilterIterator regression in 8.1.18
2023-08-30 22:26:36 +02:00
Niels Dossche
ffd7018fcd Fix GH-11972: RecursiveCallbackFilterIterator regression in 8.1.18
When you do an assignment between two zvals (no, not zval*), you copy
all fields. This includes the additional u2 data. So that means for
example the Z_NEXT index gets copied, which in some cases can therefore
cause a cycle in zend_hash lookups.
Instead of doing an assignment, we should be doing a ZVAL_COPY (or
ZVAL_COPY_VALUE for non-refcounting cases). This avoids copying u2.

Closes GH-12086.
2023-08-30 22:18:33 +02:00
George Peter Banyard
d5ad75108e
More usage of known zend_str instead of C string (#11381) 2023-06-08 13:03:29 +01:00
George Peter Banyard
99fa740acb
Use common function for TypeError on illegal offset access (#10544)
This merges all usages of emitting an offset TypeError into a new ZEND_API function
zend_illegal_container_offset(const zend_string* container, const zval *offset, int type);

Where the container should represent the type on which the access is attempted (e.g. string, array)
The offset zval that is used, where the error message will display its type
The type of access, which should be a BP_VAR_* constant, to get special message for isset/empty/unset
2023-06-06 11:28:19 +01:00
nielsdos
001e278549 Merge branch 'PHP-8.2'
* PHP-8.2:
  Fix GH-11178: Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18)
  Fix GH-11175 and GH-11177: Stream socket timeout undefined behaviour
  Fix GH-9068: Conditional jump or move depends on uninitialised value(s)
2023-05-03 19:49:02 +02:00
nielsdos
ab3f584a25 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-11178: Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18)
  Fix GH-11175 and GH-11177: Stream socket timeout undefined behaviour
  Fix GH-9068: Conditional jump or move depends on uninitialised value(s)
2023-05-03 19:46:51 +02:00
nielsdos
81e50b4ee3 Fix GH-11178: Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18)
Dynamic property case in zend_get_property_info() can return NULL for
prop info. This was not handled.

Closes GH-11182.
2023-05-03 19:42:04 +02:00
Ilija Tovilo
a86796e52a
Merge branch 'PHP-8.2'
* PHP-8.2:
  By-ref modification of typed and readonly props through ArrayIterator
2023-03-25 16:24:08 +01:00
Ilija Tovilo
3d8107f74c
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  By-ref modification of typed and readonly props through ArrayIterator
2023-03-25 16:23:48 +01:00
Ilija Tovilo
9aaa5cd093
By-ref modification of typed and readonly props through ArrayIterator
Fixes GH-10844
Closes GH-10872
2023-03-25 16:14:19 +01:00
George Peter Banyard
1d9d1fe109
Merge branch 'PHP-8.2'
* PHP-8.2:
  Fix GH-10519: Array Data Address Reference Issue
2023-03-10 14:24:54 +00:00
George Peter Banyard
4808fb6932
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-10519: Array Data Address Reference Issue
2023-03-10 14:24:38 +00:00
NathanFreeman
49b2ff5dbb
Fix GH-10519: Array Data Address Reference Issue
We need to carry around a reference to the underlying Bucket to be able to modify it by reference.

Closes GH-10749

Signed-off-by: George Peter Banyard <girgias@php.net>
2023-03-10 14:23:30 +00:00
Marcos Marcolin
9004725367
chore: standardize the visibility of functions. (#10708)
Co-authored-by: Marcos Marcolin <marcos@ixcsoft.com.br>
2023-02-26 14:08:33 +00:00
Marcos Marcolin
641fe23e3a
Improve illegal offset error messages (#10504)
Co-authored-by: Marcos Marcolin <marcos@ixcsoft.com.br>
2023-02-08 12:11:41 +00:00
Bob Weinand
d1fc0017c9 Revert "Fix compilation on MacOS"
This reverts commit 800c6672e5.

Reverted along with a01dd9feda.
2022-09-14 11:28:06 +02:00
Bob Weinand
800c6672e5 Fix compilation on MacOS
memrchr has an always available equivalent under the name of zend_memrchr.

Signed-off-by: Bob Weinand <bobwei9@hotmail.com>
2022-08-31 16:45:27 +02:00
Máté Kocsis
adb45a63c0
Fix GH-9186 @strict-properties can be bypassed using unserialization (#9354)
* Emit deprecation warnings when adding dynamic properties to classes during unserialization - this will become an Error in php 9.0.
  (Adding dynamic properties in other contexts was already a deprecation warning - the use case of unserialization was overlooked)
* Throw an error when attempting to add a dynamic property to a `readonly` class when unserializing
* Add new serialization methods `__serialize`/`__unserialize` for SplFixedArray to avoid creating deprecated dynamic
  properties that would then be added to the backing fixed-size array
* Don't add named dynamic/declared properties (e.g. $obj->foo) of SplFixedArray to the backing array when unserializing
* Update tests to declare properties or to expect the deprecation warning
* Add news entry

Co-authored-by: Tyson Andre <tysonandre775@hotmail.com>
2022-08-30 07:46:32 -04:00
Máté Kocsis
b73f139c70
Declare ext/spl constants in stubs (#9226) 2022-08-02 16:37:12 +02:00
Arnaud Le Blanc
4df3dd7679
Reduce memory allocated by var_export, json_encode, serialize, and other (#8902)
smart_str uses an over-allocated string to optimize for append operations. Functions that use smart_str tend to return the over-allocated string directly. This results in unnecessary memory usage, especially for small strings.

The overhead can be up to 231 bytes for strings smaller than that, and 4095 for other strings. This can be avoided for strings smaller than `4096 - zend_string header size - 1` by reallocating the string.

This change introduces `smart_str_trim_to_size()`, and calls it in `smart_str_extract()`. Functions that use `smart_str` are updated to use `smart_str_extract()`.

Fixes GH-8896
2022-07-08 14:47:46 +02:00
Ilija Tovilo
3b92a96610
Convert return type of various object handlers from int to zend_result (#8755) 2022-06-26 01:00:19 +02:00
Christoph M. Becker
3de0ccfe09
Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix GH-8366: ArrayIterator may leak when calling __construct()
2022-04-15 19:10:29 +02:00
Christoph M. Becker
549cf3a24d
Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix GH-8366: ArrayIterator may leak when calling __construct()
2022-04-15 19:08:28 +02:00
Christoph M. Becker
1762a87932
Fix GH-8366: ArrayIterator may leak when calling __construct()
When we detach an iterator, we also have to delete it.

Closes GH-8374.
2022-04-15 19:05:18 +02:00
George Peter Banyard
cfc38a6014
SPL: minor refactoring (#8341)
Use more appropriate types and return macros
2022-04-13 20:34:23 +01:00
George Peter Banyard
db0db2204f
Use zend_result/bool in spl_array.c 2022-03-23 22:21:04 +00:00
George Peter Banyard
2fa33d1def
Use ZEND_THROWS() where applicable in spl_array.c 2022-03-23 22:13:08 +00:00
George Peter Banyard
69ea2d8600
Convert check + exception to assertion
Move the inside the __unserialize() method as that's the only one which now needs this check

Closes GH-8207
2022-03-23 22:02:27 +00:00