Commit Graph

106402 Commits

Author SHA1 Message Date
Christoph M. Becker
8ead77936e Fix #78510: Partially uninitialized buffer returned by sodium_crypto_generichash_init()
Backport jedisct1/libsodium.php@28d13bf437.
2019-09-09 15:30:28 +02:00
Christoph M. Becker
41a4379cb4 Fix #41997: SP call yields additional empty result set
When stored procedures are called, the "final result set is a status
result that includes no result set".  Calling `::nextRowset()` on the
actual last result set should return FALSE, since there is actually no
further result set to be processed.
2019-09-03 13:29:30 +02:00
Tyson Andre
9c3b7ccda5 Fix opcache return type for hash_update_stream
It can return false if the resource type is wrong.

```
php > var_export(hash_update_stream(hash_init('md5'),
        imagecreate(1,1)));

Warning: hash_update_stream(): supplied resource is not a valid stream
resource in php shell code on line 1
false
```

The return types were initially added in
c88ffa9a56
2019-09-03 09:23:39 +02:00
Christoph M. Becker
cd63908ab8 Fix #76577: outdated documentation concerning track_errors 2019-09-02 15:05:01 +02:00
Nikita Popov
5a0980f1d9 Fix pkg-config version constraint for ICU
On PHP 7.2 our minimum ICU version is 4.0, not 40.
2019-09-02 09:36:20 +02:00
Sergei Turchanov
8f564e5308 Fixed bug #78469
fcgi_accept_request function is supposed to call a FastCGI implementation's
on_accept hook when entering an "accepting" stage (that is right before
calling "accept"). This hook implementation (fpm_request_accepting) updates
a worker state to an "accepting" state which is effectively an "Idle" state,
and updates counters on the scoreboard of the corresponding pool (idle++,
active--).

But this is not done when listening for client connections on a named pipe on
Windows platform. In that case a combination of
ConnectNamedPipe/WaitForSingleObject is used (to be able to catch in_shutdown
as far as I understand), but it is nonetheless functionally equivalent to
"accept" call. Also by not calling on_hook neither a worker's state is updated
to "accepting" state nor scoreboard counters are updated.
2019-08-30 16:06:50 +02:00
Nikita Popov
ed749edd47 Fix use-after-free of immediately invoked closure with extra args 2019-08-29 12:32:03 +02:00
Christoph M. Becker
b557265816 Fix #78473: odbc_close() closes arbitrary resources
We have to bail out, if an invalid resource is given.  For consistency
with the other `zend_fetch_resource(2)` calls, we return `FALSE`.
2019-08-28 17:55:15 +02:00
Joe Watkins
fadd7f0f1e
bump versions after release 2019-08-28 09:08:23 +02:00
Joe Watkins
481520d381
set versions for release 2019-08-28 09:06:38 +02:00
Christoph M. Becker
88ab374627 Update SDK version for AppVeyor 2019-08-27 13:34:35 +02:00
Nikita Popov
589542f50c Remove properties HT from nested GC data
The properties HT may be a GC root itself, so we need to remove it.
I'm not sure this issue actually applies to PHP 7.2, but committing
it there to be safe. As seen from the test case, the handling here
is rather buggy on 7.2.
2019-08-26 17:49:37 +02:00
Tyson Andre
1e82a2d659 Also fix signature for passthru
Backported from a1a8d14485
https://www.php.net/manual/en/function.passthru.php#refsect1-function.passthru-returnvalues

`passthru()` is false with invalid args
`passthru('command')` is null.
2019-08-26 11:13:26 +02:00
Tyson Andre
f5bccc0eb5 Fix opcache optimizer info for time_nanosleep
This can also return an array. See
https://www.php.net/manual/en/function.time-nanosleep.php#refsect1-function.time-nanosleep-returnvalues

> If the delay was interrupted by a signal, an associative array will be
returned with the components:
>
> - seconds - number of seconds remaining in the delay
> - nanoseconds - number of nanoseconds remaining in the delay

Sending a SIGUSR1 to the below program would trigger this behavior.

```
pcntl_signal(\SIGUSR1, function ($signo, $signinfo) {
    echo "Handling a signal $signo\n";
});
echo "Sleeping for 100 seconds\n";
var_export(time_nanosleep(100, 0));
```

The incomplete signature existed since c88ffa9a5.
No phpt tests existed for time_nanosleep returning an array
2019-08-26 11:13:26 +02:00
Nikita Popov
16d35eb643 Fix overflow in memory limit checks
Due to overflows in the memory limit checks, we were missing cases
where the allocation size was close to the address space size, and
caused an OOM condition rather than a memory limit error.
2019-08-26 10:25:30 +02:00
Stanislav Malyshev
4b4a656d9e Merge branch 'PHP-7.1' into PHP-7.2
* PHP-7.1:
  Fix #75457: heap-use-after-free in php7.0.25
2019-08-25 19:20:59 -07:00
Christoph M. Becker
7bf1f9d561 Fix #75457: heap-use-after-free in php7.0.25
Backport <https://vcs.pcre.org/pcre?view=revision&revision=1638>.
2019-08-25 19:19:50 -07:00
Stanislav Malyshev
087cb7bab2 Merge branch 'PHP-7.1' into PHP-7.2
* PHP-7.1:
  Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe()
  set version for release
2019-08-24 23:15:36 -07:00
Stanislav Malyshev
1258303e66 Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe()
Backport from 0f7f61ed1b
2019-08-24 23:11:45 -07:00
Christoph M. Becker
ff7029b65b Suppress deprecation warning on IDNA2003 ICU methods for clang 2019-08-23 12:18:58 +02:00
Qianqian Bu
cdf16c010a fix the problem for connect_attr, set db condition, and add a new attribute _server_host 2019-08-20 13:31:58 +02:00
Christoph M. Becker
81f52158b4 Fix #78220: Can't access OneDrive folder
As of Windows 1903, when the OneDrive on-demand feature is enabled, the
OneDrive folder is reported as reparse point by `FindFirstFile()`, but
trying to get information about the reparse point using
`DeviceIoControl()` fails with `ERROR_NOT_A_REPARSE_POINT`.  We work
around this problem by falling back to `GetFileInformationByHandle()`
if that happens, but only if the reparse point is reported as cloud
reparse point, and only if PHP is running on Windows 1903 or later.

The patch has been developed in collaboration with ab@php.net.

We should keep an eye on the somewhat quirky OneDrive behavior, since
it might change again in a future Windows release.
2019-08-19 19:55:35 +02:00
Sara Golemon
725f439778
Suppress deprecation warning on IDNA2003 ICU methods 2019-08-16 12:40:20 -04:00
Nikita Popov
fcabe7e5e4 Fixed bug #78412
$this should only be included in the generator GC buffer, if it
will be released on destruction.
2019-08-14 17:50:58 +02:00
Sara Golemon
4b64d47c99
Bump for 7.2.23 2019-08-13 19:32:12 -04:00
Nikita Popov
4eeb41d1ea Fixed bug #77191 2019-08-13 11:19:58 +02:00
Nikita Popov
18f2918a0f Don't destroy properties array with unset GC type
As the properties array can also be a GC root, it might have
already been destroyed.
2019-08-13 09:53:25 +02:00
Nikita Popov
f3fdf570b3 Intern alias old_name early
This is likely going to end up interned lateron at some point
when the new_name is referenced somewhere. However, it may be
that there are some uses that do not get interned before that.
In this case we will intern a string that already have zval
users, without updating the refcounted flag on those zvals.

In particular this can happen with something like [Foo::class],
where Foo is an imported symbol. The string it resolves to won't
get interned right away, but may be interned later.

    use Foo as Bar;
    $x = [Bar::class];
    var_dump(Bar::X);
    debug_zval_dump($x); // Will show negative refcount
    class Foo {
        const X = 1;
    }

However, this doesn't really fix the root cause, there are probably
other situations where something similar can occur.
2019-08-12 17:12:28 +02:00
Dmitry Stogov
9b43e29d9b Fixed handling of references in nested data of objects with destructor 2019-08-09 17:43:50 +03:00
Dmitry Stogov
6b1cc1252e Fixed second part of the bug #78379 (Cast to object confuses GC, causes crash) 2019-08-09 15:42:39 +03:00
Dmitry Stogov
2e2cd65d73 Added asserts to catch GC errors when refcount goes below zero. 2019-08-09 13:37:23 +03:00
Matteo Beccati
796efd849e Skip test when SIGKILL is not defined 2019-08-09 10:32:15 +02:00
Dmitry Stogov
358379be22 Fixed bug #78379 (Cast to object confuses GC, causes crash) 2019-08-08 10:00:39 +03:00
Christoph M. Becker
954543cec6 Fix #78282: atime and mtime mismatch
The fix for bug #78241 assumed that `time_t` would always be 64bit, but
actually is 32bit for x86.  We therefore enforce 64bit arithmetic to
avoid wrapping.

(cherry picked from commit bf242d58e7)
2019-08-06 17:25:54 +02:00
Christoph M. Becker
f9f4a68368 Fix #78179: MariaDB server version incorrectly detected
As of MariaDB 10.0.2, the server reports a fake version number as work-
around for replication issues[1].  We apply the same "fix" as in the
MariaDB client to cater to this.

[1] <c50ee6c23d (diff-5b45fa673c88c06a9651c7906364f592)>
2019-08-02 16:42:49 +02:00
Nikita Popov
85e8ccd55e Fixed bug #78363 2019-08-02 10:35:24 +02:00
Joe Watkins
1c01a1579e
set version for release 2019-07-31 08:21:39 +02:00
Remi Collet
b29ecec4ef add security NEW entries + reorder [ci skip] 2019-07-30 09:26:50 +02:00
Stanislav Malyshev
284fb08fdc Merge branch 'PHP-7.1' into PHP-7.2
* PHP-7.1:
  Fix #77919: Potential UAF in Phar RSHUTDOWN
  Update NEWS
  Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
2019-07-29 13:19:16 -07:00
Christoph M. Becker
cd1101e8c8 Fix #77919: Potential UAF in Phar RSHUTDOWN
We have to properly clean up in case phar_flush() is failing.

We also make the expectation of the respective test case less liberal
to avoid missing such bugs in the future.
2019-07-29 13:18:27 -07:00
Stanislav Malyshev
42e8b85d94 Update NEWS 2019-07-29 13:16:53 -07:00
Albert Casademont
dc7aa22b18 Fix bug #78326
Similar to what fread() does, truncate the stream_get_contents()
result if the original buffer was way too large.
2019-07-29 17:33:57 +02:00
Nikita Popov
38f1288b64 Fix Zend signals unblocking
There are a few parts here:
 * opcache should not be blocking signals while invoking compile_file,
   otherwise signals may remain blocked on a compile error. While at
   it, also protect SHM memory during compile_file.
 * We should deactivate Zend signals at the end of the request, to make
   sure that we gracefully recover from a missing unblock and signals
   don't remain blocked forever.
 * We don't use a critical section in deactivation, because it should
   not be necessary. Additionally we want to clean up the signal queue,
   if it is non-empty.
 * Enable SIGG(check) in debug builds so we notice issues in the future.
2019-07-29 15:17:32 +02:00
Nikita Popov
68fd435ba8 Fixed bug #78333
Don't dereference float/double values at unknown address, instead
memcpy it into an aligned stack slot and dereference that.
2019-07-29 11:27:21 +02:00
Stanislav Malyshev
aeb6d13185 Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment) 2019-07-29 00:53:37 -07:00
Stanislav Malyshev
dea2989ab8 Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail) 2019-07-29 00:53:28 -07:00
Christoph M. Becker
30eb4b3563 Fix #78342: Bus error in configure test for iconv //IGNORE
We have to check the return value of iconv_open() for error, to avoid
that and potentially other undesired behavior of iconv().
2019-07-29 08:48:13 +02:00
Levi Morrison
5649267b25 Remove .post files only for passing tests
This allows the sh script for failing tests with --POST-- to work
2019-07-25 09:48:39 -06:00
Peter Kokot
8f384bea93 Update NEWS 2019-07-23 02:13:00 +02:00
George Wang
eb7e45f662 Checked in LiteSpeed SAPI 7.5, addressed two main problems in "clean shutdown" introduced in 7.4.3,
1. falls in an infinite loop because PHP engine's inconsistent state, now override the ITIMER_PROF to 0.1 second, clean shutdown must finish before that.
2. generate too much error log, we completely disable "error_reporting" before calling php_request_shutdown().
2019-07-20 23:59:43 -04:00