Commit Graph

1147 Commits

Author SHA1 Message Date
Derick Rethans
4b24f5d6db
Merge branch 'PHP-8.3' 2024-06-13 14:04:48 +01:00
Derick Rethans
31798e4b6d
Merge branch 'PHP-8.2' into PHP-8.3 2024-06-13 14:04:13 +01:00
Derick Rethans
ad56ec7bbf
Fixed off-by-one error in checking length of abtract namespace Unix sockets 2024-06-13 12:46:22 +01:00
Peter Kokot
5d3fab9334
Sync #if/ifdef/defined (#14520)
These are either undefined or defined (to value 1):
- __DragonFly__
- __FreeBSD__
- HAS_MCAST_EXT
- HAVE_GETCWD
- HAVE_GETWD
- HAVE_GLIBC_ICONV
- HAVE_JIT
- HAVE_LCHOWN
- HAVE_NL_LANGINFO
- HAVE_RL_CALLBACK_READ_CHAR
- HAVE_RL_ON_NEW_LINE
- HAVE_SQL_EXTENDED_FETCH
- HAVE_UTIME

Follow up of GH-5526 (-Wundef)
2024-06-11 22:47:05 +02:00
Niels Dossche
bcecbb59d3
Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix GH-11078: PHP Fatal error triggers pointer being freed was not allocated and malloc: double free for ptr errors
2024-06-10 19:40:03 +02:00
Niels Dossche
ccdd1c4e67
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-11078: PHP Fatal error triggers pointer being freed was not allocated and malloc: double free for ptr errors
2024-06-10 19:39:25 +02:00
Niels Dossche
bc558bf7a3
Fix GH-11078: PHP Fatal error triggers pointer being freed was not allocated and malloc: double free for ptr errors
Although the issue was demonstrated using Curl, the issue is purely in
the streams layer of PHP.

Full analysis is written in GH-11078 [1], but here is the brief version:
Here's what actually happens:
1) We're creating a FILE handle from a stream using the casting mechanism.
   This will create a cookie-based FILE handle using funopen.
2) We're reading stream data using fread from the userspace stream. This will
   temporarily set a buffer into a field _bf.base [2]. This buffer is now equal
   to the upload buffer that Curl allocated and note that that buffer is owned
   by Curl.
3) The fatal error occurs and we bail out from the fread function, notice how
   the reset code is never executed and so the buffer will still point to
   Curl's upload buffer instead of FILE's own buffer [3].
4) The resources are destroyed, this includes our opened stream and because the
   FILE handle is cached, it gets destroyed as well.
   In fact, the stream code calls through fclose on purpose in this case.
5) The fclose code frees the _bs.base buffer [4].
   However, this is not the buffer that FILE owns but the one that Curl owns
   because it isn't reset properly due to the bailout!
6) The objects are getting destroyed, and so the curl free logic is invoked.
   When Curl tries to gracefully clean up, it tries to free the buffer.
   But that buffer is actually already freed mistakingly by the C library!

This also explains why we can't reproduce it on Linux: this bizarre buffer
swapping only happens on macOS and BSD, not on Linux.

To solve this, we switch to an unbuffered mode for cookie-based FILEs.
This avoids any stateful problems related to buffers especially when the
bailout mechanism triggers. As streams have their own buffering
mechanism, I don't expect this to impact performance.

[1] https://github.com/php/php-src/issues/11078#issuecomment-2155616843
[2] 5e566be7a7/stdio/FreeBSD/fread.c (L102-L103)
[3] 5e566be7a7/stdio/FreeBSD/fread.c (L117)
[4] 5e566be7a7/stdio/FreeBSD/fclose.c (L66-L67)

Closes GH-14524.
2024-06-10 19:38:21 +02:00
Peter Kokot
84a0da1574
Sync #if/ifdef/defined (#14508)
This syncs CPP macro conditions:
- _WIN32
- _WIN64
- HAVE_ALLOCA_H
- HAVE_ALPHASORT
- HAVE_ARPA_INET_H
- HAVE_CONFIG_H
- HAVE_DIRENT_H
- HAVE_DLFCN_H
- HAVE_GETTIMEOFDAY
- HAVE_LIBDL
- HAVE_POLL_H
- HAVE_PWD_H
- HAVE_SCANDIR
- HAVE_SYS_FILE_H
- HAVE_SYS_PARAM_H
- HAVE_SYS_SOCKET_H
- HAVE_SYS_TIME_H
- HAVE_SYS_TYPES_H
- HAVE_SYS_WAIT_H
- HAVE_UNISTD_H
- PHP_WIN32
- ZEND_WIN32

These are either undefined or defined to 1 in Autotools and Windows.

Follow up of GH-5526 (-Wundef).
2024-06-09 14:23:41 +02:00
Peter Kokot
da86eec3db
Sync #if/ifdef/defined (#14371)
These are either undefined or defined to value 1 in Autotools and
Windows:
- HAVE_COMMONCRYPTO_COMMONRANDOM_H
- HAVE_EXIF
- HAVE_FOPENCOOKIE
- HAVE_IF_NAMETOINDEX
- HAVE_LIBICONV
- HAVE_SOCKETS
- HAVE_STRUCT_STAT_ST_RDEV
- HAVE_STRUCT_TM_TM_GMTOFF
- HAVE_STRUCT_TM_TM_ZONE

Follow up of GH-5526 (-Wundef)
2024-06-07 23:45:17 +02:00
Cristian Rodríguez
8e62e2b829
Mark multple functions as static (#13864)
* Mark many functions as static

Multiple functions are missing the static qualifier.

* remove unused struct sigactions

struct sigaction act, old_term, old_quit, old_int;
all unused.

* optimizer: minXOR and maxXOR are unused
2024-05-22 13:11:46 +02:00
Jakub Zelenka
ce4c8ab412
Merge branch 'PHP-8.3' 2024-04-14 14:27:49 +01:00
Jakub Zelenka
4dad74f250
Merge branch 'PHP-8.2' into PHP-8.3 2024-04-14 14:27:05 +01:00
Damian Wójcik
8421cfda61
Fix file_get_contents() on Windows fails with "errno=22 Invalid argument"
Closes GH-13948
2024-04-14 14:26:10 +01:00
Niels Dossche
ae5220aed6
Avoid call to php_socket_errno() if possible (#13909)
This call is only necessary if ret < 0.
Note that I also had to reoder the checks for EWOULDBLOCK, EMSGSIZE, EAGAIN
to avoid a false positive GCC warning about a duplicate condition
(EAGAIN == EWOULDBLOCK on my system).
2024-04-08 19:53:01 +02:00
Arnaud Le Blanc
345580c5e8 Merge branch 'PHP-8.3'
* PHP-8.3:
  [ci skip] NEWS
  [ci skip] NEWS
  Fix cookie_seek_function_t signature under musl (#13890)
2024-04-08 15:03:37 +02:00
Arnaud Le Blanc
618eb3d468 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [ci skip] NEWS
  Fix cookie_seek_function_t signature under musl (#13890)
2024-04-08 15:02:32 +02:00
Arnaud Le Blanc
577b8ae422
Fix cookie_seek_function_t signature under musl (#13890)
Fixes GH-11678
2024-04-08 14:58:12 +02:00
Niels Dossche
b9a2533cb3
Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix gcc-14 Wcalloc-transposed-args warnings
2024-04-01 20:34:44 +02:00
Niels Dossche
e34c86ce1a
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix gcc-14 Wcalloc-transposed-args warnings
2024-04-01 20:34:37 +02:00
Cristian Rodríguez
18d70db091
Fix gcc-14 Wcalloc-transposed-args warnings
gcc-14 and later warns of inverted arguments in calloc or
calloc-like __alloc_size__ annotated functions.

Closes GH-13818.
2024-04-01 20:34:14 +02:00
Jakub Zelenka
894e17c139
Merge branch 'PHP-8.3' 2024-03-29 16:09:48 +00:00
Jakub Zelenka
caec2b6186
Merge branch 'PHP-8.2' into PHP-8.3 2024-03-29 16:09:09 +00:00
Jakub Zelenka
c087398cc2
Fix GH-13264: Part 1 - Memory leak on filter failure
Closes GH-13790
2024-03-29 16:06:49 +00:00
Jakub Zelenka
cc953e5ebc
Merge branch 'PHP-8.3' 2024-03-09 19:59:39 +00:00
Jakub Zelenka
4612bb77fb
Merge branch 'PHP-8.2' into PHP-8.3 2024-03-09 19:59:06 +00:00
divinity76
2343791aff
Fix GH-13203: file_put_contents fail on strings over 4GB on Windows
Closes GH-13205
2024-03-09 19:58:28 +00:00
Máté Kocsis
10957e498c
Do not generate frameless info items when func info generation is disabled
While here, I fixed newlines around arginfo and function entry generation. Previously, newlines were repeated.
2024-02-18 11:39:00 +01:00
Niels Dossche
23b94cb5a7 Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix GH-13071: Copying large files using mmap-able source streams may exhaust available memory and fail
2024-01-16 23:53:12 +01:00
Niels Dossche
47454cb771 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-13071: Copying large files using mmap-able source streams may exhaust available memory and fail
2024-01-16 23:46:43 +01:00
Niels Dossche
5e9e9c9d51 Fix GH-13071: Copying large files using mmap-able source streams may exhaust available memory and fail
Commit 5cbe5a538c disabled chunking for all writes to streams. However,
user streams have a callback where code is executed on data that is
subject to the memory limit. Therefore, when using large writes or
stream_copy_to_stream/copy the memory limit can easily be hit with large
enough data.

To solve this, we reintroduce chunking for userspace streams.
Users have control over the chunk size, which is neat because
they can improve the performance by setting the chunk size if
that turns out to be a bottleneck.

In an ideal world, we add an option so we can "ask" the stream whether
it "prefers" chunked writes, similar to how we have
php_stream_mmap_supported & friends. However, that cannot be done on
stable branches.

Closes GH-13136.
2024-01-16 23:44:58 +01:00
Jakub Zelenka
d6299206dd
Merge branch 'PHP-8.3' 2023-12-15 14:14:15 +00:00
Jakub Zelenka
1b8be9acf0
Merge branch 'PHP-8.2' into PHP-8.3 2023-12-15 14:13:41 +00:00
Jakub Zelenka
40ccc8ea7e
Fix GH-9698: stream_wrapper_register crashes with FFI\CData provided as class
Closes GH-12926
2023-12-15 14:11:56 +00:00
Jakub Zelenka
62b2ad4b8a
Merge branch 'PHP-8.3' 2023-11-17 13:42:59 +00:00
Jakub Zelenka
7abe3fe4c6
Merge branch 'PHP-8.2' into PHP-8.3 2023-11-17 13:41:50 +00:00
Jakub Zelenka
6734880ef5
Fix bug #79945: Stream wrappers in imagecreatefrompng causes segfault
Closes GH-12696
2023-11-17 13:26:42 +00:00
Peter Kokot
abed8b8e41 Remove _IO_cookie_io_functions_t in favor of cookie_io_functions_t
As noted in glibc, the cookie_io_functions_t should be used instead of
internal _IO_cookie_io_functions_t.

The _IO_cookie_io_functions_t was once used as a convenience for not
having the cookie_io_functions_t available (glibc <=2.1.1) as noted in
67bb9d1ae2.

Check in the build system was also always setting the
COOKIE_IO_FUNCTIONS_T to cookie_io_functions_t due to a typo. There is
unused variable have_IO_cookie_io_functions_t vs.
have_cookie_io_functions_t.

- COOKIE_IO_FUNCTIONS_T removed

Closes GH-12236
2023-09-22 22:31:19 +02:00
Christian Clauss
886bf820c9
[skip ci] Fix typos discovered by codespell (#12228) 2023-09-18 11:07:17 +01:00
George Peter Banyard
d68073c23b
streams: Checking if a stream is castable should not emit warnings for user defined streams
Closes GH-10435
2023-09-08 13:22:43 +01:00
Jakub Zelenka
ba9650d697
Fix bug #52335 (fseek() on memory stream behavior different then file)
This changes memory stream to allow seeking past end which makes it the
same as seeking on files. It means the position is allowed to be higher
than the string length. The size only increases if data is appended to
the past position. The space between the previous string and position
is filled with zero bytes.

Fixes GH-9441
Closes GH-12058
2023-08-28 13:32:34 +01:00
Niels Dossche
26d6bb3627
Remove useless duplicated call to php_stream_parse_fopen_modes (#12059) 2023-08-27 17:22:23 +02:00
Ilija Tovilo
b0037eda26
Merge branch 'PHP-8.2'
* PHP-8.2:
  Fix use-after-free when unregistering user stream wrapper from itself
2023-07-19 11:20:18 +02:00
Ilija Tovilo
c3ccc363c6
Fix use-after-free when unregistering user stream wrapper from itself
Fixes GH-11735
Closes GH-11737
2023-07-19 11:17:57 +02:00
Jakub Zelenka
4a5d13e205
Fix GH-11242: Use dynamic buffer for large length in stream mem copy 2023-07-08 11:43:05 +01:00
Niels Dossche
0b2e6bc2b0 Cache d_type in directory entry 2023-07-07 18:02:32 +02:00
Jakub Zelenka
49fbbea2ea
Fix GH-10406: fgets on a redis socket connection fails on PHP 8.3
This is an alternative implementation for GH-10406 that resets the
has_buffered_data flag after finishing stream read so it does not impact
other ops->read use like for example php_stream_get_line.

Closes GH-11421
2023-06-11 13:27:00 +01:00
Niels Dossche
d22d0e26dc Implement GH-8641: STREAM_NOTIFY_COMPLETED over HTTP never emitted
This adds support for the completed event. Since the read handler could
be entered twice towards the end of the stream we remember what the eof
flag was before reading so we can emit the completed event when the flag
changes to true.

Closes GH-10505.
2023-06-10 19:47:36 +02:00
George Peter Banyard
13ad8ef40b memory stream: fix [-Wanalyzer-deref-before-check]
|  732 |                 ts->mode = mode && mode[0] == 'r' && mode[1] != '+' ? TEMP_STREAM_READONLY : 0;
    |      |                            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~

Although mode is already dereference on line 723 in the call to strlen()
2023-06-02 20:33:20 +01:00
iamluc
730f32bad9
Keep the orig_path for xport stream
Closes GH-11113
2023-05-12 15:33:55 +01:00
Niels Dossche
acc940645e
Remove unnecessary NULL assignments after ecalloc in streams (#11209)
ecalloc already zeroes the structure, so writing NULL is not necessary.
2023-05-09 19:46:45 +02:00