Commit Graph

16451 Commits

Author SHA1 Message Date
Go Kudo
3725717de1
Remove ZEND_DVAL_TO_LVAL_CAST_OK (#9215)
* Remove ZEND_DVAL_TO_LVAL_CAST_OK
As far as I can see, this operation should always use the _slow method, and the results seem to be wrong when ZEND_DVAL_TO_LVAL_CAST_OK is enabled.

* update NEWS
2022-08-04 23:56:19 +09:00
Tobias Bachert
ede92a86f2
Fix WeakMap object reference offset causing TypeError (#8995) 2022-07-15 13:00:48 +02:00
Jakub Zelenka
b765d4cd41 Fix bug #50293 and #81713: file path checking in OpenSSL functions
It introduces a single function to check file paths passed to OpenSSL
functions. It expands the path, check null bytes and finally does
an open basedir check.
2022-06-09 19:49:59 +01:00
Sara Golemon
e05897fe5e
Bump for 8.0.21 2022-05-24 18:51:01 +00:00
Derick Rethans
c06e1abbaa Emit EXT_STMT for each 'elseif' clause 2022-05-20 10:51:58 +01:00
vajexal
74924ada93
Fix get_function_or_method_name when included file is scoped (#8467) 2022-05-03 21:34:01 +02:00
Ollie Read
d0f1b987a5
Fix GH-8421: Attributes that target functions are not valid for anonymous functions defined within a method
Closes GH-8424
2022-04-23 11:16:28 +02:00
Nikita Popov
5d072578cd Don't use CE for by-ref arguments 2022-04-15 23:00:43 +02:00
Nikita Popov
41f33b9dc3 Don't use CE info from pi node for MAY_BE_REF var
Once again, the actual class type may be reassigned indirectly.
2022-04-15 22:36:13 +02:00
Nikita Popov
b08aac0451 Fix inference for assignment of known object to reference
We cannot retain the ce information in that case, we have to
assume the ce may change indirectly through the reference.

Fixes oss-fuzz #46720.
2022-04-15 22:14:44 +02:00
Christoph M. Becker
43f3745abb
Bump version
Apparently, this has been forgotten when PHP 8.0.17RC1 and 8.0.18RC1
had been tagged.

We also fix the version of the fix for GH-8253, which didn't make it
into PHP 8.0.18RC1.
2022-04-05 13:19:02 +02:00
Dmitry Stogov
c489e360a6 JIT: Fix array clobbering by user error handler
Fixes oss-fuzz #46336
2022-04-04 16:36:25 +03:00
Bob Weinand
9cb512ecc1 Ensure correct target opline for exceptions thrown during yield from
Also appends the exception during a yield from values dtor instead of prepending it

Fixing regression introduced in 13649451c2.
2022-04-04 14:24:39 +02:00
Bob Weinand
13649451c2 Fix GH-8289: Exceptions thrown within a yielded from iterator are not rethrown into the generator
This also fixes the fact that exception traces were not including the generator frame when thrown in a yielded from iterator.
2022-04-01 17:32:48 +02:00
Bob Weinand
15949b61ba Fix ZTS build after cherry-pick 2022-03-07 22:24:55 +01:00
Tim Düsterhus
0d7e10c1a9 Fix memory leak of function attribute hash table (#8070)
==109253== 280 (56 direct, 224 indirect) bytes in 1 blocks are definitely lost in loss record 4 of 4
    ==109253==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
    ==109253==    by 0x6D9FA2: __zend_malloc (zend_alloc.c:3068)
    ==109253==    by 0x745138: zend_add_attribute (zend_attributes.c:226)
    ==109253==    by 0x6680D1: zend_add_parameter_attribute (zend_attributes.h:102)
    ==109253==    by 0x66B787: zm_startup_zend_test (test.c:478)
    ==109253==    by 0x7224CD: zend_startup_module_ex (zend_API.c:2202)
    ==109253==    by 0x72252C: zend_startup_module_zval (zend_API.c:2217)
    ==109253==    by 0x734288: zend_hash_apply (zend_hash.c:2011)
    ==109253==    by 0x722C30: zend_startup_modules (zend_API.c:2328)
    ==109253==    by 0x67409B: php_module_startup (main.c:2256)
    ==109253==    by 0x88EDDE: php_cli_startup (php_cli.c:409)
    ==109253==    by 0x890F61: main (php_cli.c:1334)
2022-03-07 22:05:40 +01:00
Bob Weinand
f095d2c91b Fix freeing of internal attribute arguments 2022-03-07 22:04:16 +01:00
Bob Weinand
e6cf583160 Fix GH-8082: Prevent leaking memory on observed transient run_time_caches
This is achieved by tracking the observers on the run_time_cache (with a fixed amount of slots, 2 for each observer).
That way round, if the run_time_cache is freed all associated observer data is as well.

This approach has been chosen, as to avoid any ABI or API breakage.
Future versions may for example choose to provide a hookable API for run_time_cache freeing or similar.
2022-03-01 14:49:44 +01:00
Dmitry Stogov
01702a851b Fix use after free
Fixes oss-fuzz #44885
2022-03-01 01:33:22 +03:00
Dmitry Stogov
84a638a346 Fix memory leak
Fixes oss-fuzz #44685
2022-02-18 12:20:40 +03:00
Dmitry Stogov
c035298eb2 Free cached chunks when the requested memory limit is above real usage 2022-02-08 15:45:40 +03:00
Sara Golemon
8a46311dbd
Bump for 8.0.17-dev 2022-02-02 23:44:02 +00:00
Dmitry Stogov
a60a9b4a89 Fix memory leak
Fixes oss-fuzz #44222
2022-02-01 16:24:22 +03:00
Dmitry Stogov
464e725bb5 Fix typo (wrong string length)
Fixes oss-fuzz #44110
2022-01-28 11:04:51 +03:00
Christoph M. Becker
ee610947ce
Revert "Fix zend_observer_fcall_end_all() accessing dangling pointers"
This reverts commit 76e2a8380e.  Cf.
<76e2a8380e (r62560239)>.
2021-12-27 21:08:51 +01:00
Florian Sowade
76e2a8380e
Fix zend_observer_fcall_end_all() accessing dangling pointers
This may happen, when the execute_data was allocated on the stack.  We
ensure that the runtime cache pointer is not NULL before dereferencing
it.

This is a partial fix for bug 81430.

Closes GH-7665.
2021-12-27 18:19:13 +01:00
David Carlier
3f0bb67361
Avoid void* arithmetic in sockets/multicast.c on NetBSD
On NetBSD, ifconf.ifc_buf member, unlike most of platforms, is a void
pointer.

We also fix the cpuinfo declarations with empty parameter lists.

Closes GH-7819.
2021-12-23 16:17:30 +01:00
David CARLIER
62bcb31706
zend gdb detection fix on FreeBSD. 2021-12-21 07:19:33 +01:00
Dmitry Stogov
c787f42ceb Combine ADDREF/DELREF 2021-12-13 22:38:23 +03:00
Dmitry Stogov
cbc0b1afeb Fix array clobering by user error handler
Fixes oss-fuzz #42234
2021-12-13 14:59:30 +03:00
Christoph M. Becker
5675ebe649
Fix #81585: cached_chunks are not counted to real_size on shutdown
The amount of allocated system memory is kept in `real_size`, including
the allocated `cached_chunks`.  Thus, we need to keep the proper count
at the end of the shutdown.

Closes GH-7745.
2021-12-10 12:24:06 +01:00
Dmitry Stogov
8d7d87cdc4 Add test 2021-12-03 13:40:17 +03:00
Dmitry Stogov
1d054b3fa7 Fix array object clobbering by user error handler
Fixes oss-fuss #41605 and #41610
2021-12-03 13:35:28 +03:00
Dmitry Stogov
94286cd596 Fix yet another indirect string modification by error handler problem 2021-12-02 16:16:54 +03:00
Dmitry Stogov
37ac707cac Add missing zend_string_release_ex(tmp, 0) and cleanup
- use GC_DELREF() instead of zend_string_release_ex()
- add expectations for exceptional cases
- replace IS_ARRAY_IMMUTABLE by IS_STR_INTERNED
2021-12-02 11:18:08 +03:00
Dmitry Stogov
df16da3697 Fixed ext/bz2/tests/005.phpt test failure introduesed by 09547c64c2 2021-12-02 10:32:45 +03:00
Sara Golemon
999c6f2c5d
Bump for 8.0.15 2021-12-02 05:09:07 +00:00
Dmitry Stogov
4595a57e99 Fix clobering of operand by error handler in assignment to string offset (optimization and JIT support) 2021-12-02 01:20:17 +03:00
Dmitry Stogov
09547c64c2 Fix clobering of operand by error handler in assignment to string offset
In some cases new code requires two reallocations insead of one.

Fixes oss-fuzz #31716, #36196, #39739 and #40002
2021-12-02 00:24:05 +03:00
Dmitry Stogov
9f6ab78610 Use proper functions 2021-12-01 22:43:19 +03:00
Dmitry Stogov
df434f056f Fix crash after indirect modification of string by user error handler
Fixes oss-fuzz #39346
2021-11-30 16:07:38 +03:00
Christoph M. Becker
816aa20391
Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #74604: Out of bounds in php_pcre_replace_impl
2021-11-29 19:15:20 +01:00
Christoph M. Becker
712fc54e85
Fix #74604: Out of bounds in php_pcre_replace_impl
Trying to allocate a `zend_string` with a length only slighty smaller
than `SIZE_MAX` causes an integer overflow; we make sure that this
doesn't happen by catering to the maximal overhead of a `zend_string`.

Closes GH-7597.
2021-11-29 19:12:55 +01:00
Nikita Popov
be271f277e Fix bug #81652
We need to check not only for defs but also for uses of the
variable.
2021-11-24 15:18:31 +01:00
Tyson Andre
241bd3f454 Fix use after free when WeakMap is modified during field write
(When a value's destructor triggers a resizing or rehashing of the WeakMap)

Closes GH-7671
2021-11-20 16:52:25 -05:00
Nikita Popov
4d4fe7639f Fixed bug #81631
We need to save the opline before fetching the operand, as it may
throw an undef var warning.
2021-11-17 16:06:25 +01:00
Nikita Popov
9e25c4b3a6 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fixed bug #81626
2021-11-16 12:46:20 +01:00
Nikita Popov
d26965b247 Fixed bug #81626
Backport of a8926474cb to 7.4.
2021-11-16 12:45:33 +01:00
Dmitry Stogov
fa0b84a06b Partially fix handling of exceptions thrown in interrupt handlers 2021-11-11 20:59:56 +03:00
Nikita Popov
8c4a7f20f5 Fix COPY_TMP live range construction with optimization
The use may be optimized away, leaving us only with the free use.
Also fix off-by-one error in the other optimization case.
2021-11-11 10:35:34 +01:00