Commit Graph

527 Commits

Author SHA1 Message Date
Peter Kokot
1ceadaed52
Autotools: Normalize and quote all PHP_NEW_EXTENSION arguments (#15144)
This adds Autoconf quote characters to all PHP_NEW_EXTENSION arguments
and syncs the CS across the php-src Autotools build system.
2024-07-29 00:14:59 +02:00
Peter Kokot
82e63a06e2
Add pcre dependency as required to ext/filter (#15099)
This is configure phase dependency synced with already present Autotools
pcre dependency check.
2024-07-24 23:30:57 +02:00
Arnaud Le Blanc
11accb5cdf
Preferably include from build dir (#13516)
* Include from build dir first

This fixes out of tree builds by ensuring that configure artifacts are included
from the build dir.

Before, out of tree builds would preferably include files from the src dir, as
the include path was defined as follows (ignoring includes from ext/ and sapi/) :

    -I$(top_builddir)/main
    -I$(top_srcdir)
    -I$(top_builddir)/TSRM
    -I$(top_builddir)/Zend
    -I$(top_srcdir)/main
    -I$(top_srcdir)/Zend
    -I$(top_srcdir)/TSRM
    -I$(top_builddir)/

As a result, an out of tree build would include configure artifacts such as
`main/php_config.h` from the src dir.

After this change, the include path is defined as follows:

    -I$(top_builddir)/main
    -I$(top_builddir)
    -I$(top_srcdir)/main
    -I$(top_srcdir)
    -I$(top_builddir)/TSRM
    -I$(top_builddir)/Zend
    -I$(top_srcdir)/Zend
    -I$(top_srcdir)/TSRM

* Fix extension include path for out of tree builds

* Include config.h with the brackets form

`#include "config.h"` searches in the directory containing the including-file
before any other include path. This can include the wrong config.h when building
out of tree and a config.h exists in the source tree.

Using `#include <config.h>` uses exclusively the include path, and gives
priority to the build dir.
2024-06-26 00:26:43 +02:00
Gina Peter Banyard
fd2d869642
Clean-up some more headers (#14416)
Remove unused headers (such as php_ini.h for extensions that don't define INI settings)
Use more specific headers when possible
2024-06-08 17:15:36 +01:00
Ben Ramsey
bda372fc6c
Merge branch 'PHP-8.3' 2024-06-05 01:11:59 -05:00
Ben Ramsey
e4453dcbd2
Merge branch 'PHP-8.2' into PHP-8.3 2024-06-05 01:11:30 -05:00
Ben Ramsey
8aff5b49c3
Merge branch 'PHP-8.1' into PHP-8.2 2024-06-05 01:10:47 -05:00
Niels Dossche
7e0e3cc820
Fix GHSA-w8qr-v226-r27w
We should not early-out with success status if we found an ipv6
hostname, we should keep checking the rest of the conditions.
Because integrating the if-check of the ipv6 hostname in the
"Validate domain" if-check made the code hard to read, I extracted the
condition out to a separate function. This also required to make
a few pointers const in order to have some clean code.
2024-06-05 00:31:17 -05:00
Gina Peter Banyard
25a5146180
Clean-up unused headers (#14365)
* ext/mbstring.c: clean-up headers and include intrinsics
2024-06-01 17:12:42 +01:00
Peter Kokot
d26617f760
Remove unused PARSE_SESSION and PARSE_REQUEST (#14081)
These were removed via 0904dd3dc2.
2024-04-30 16:39:00 +02:00
Juan Morales
c96b975f67
filter_input_array - Implement solution 2 of GH-13805 (#13804) 2024-04-07 00:18:12 +02:00
Máté Kocsis
10957e498c
Do not generate frameless info items when func info generation is disabled
While here, I fixed newlines around arginfo and function entry generation. Previously, newlines were repeated.
2024-02-18 11:39:00 +01:00
Peter Kokot
b558a18c15
Remove unused <extension>_SHARED_LIBADD variables (#13361)
These are used to store libraries needed to link when extension is
shared and needs libraries linked to it. Since other similar types of
extensions don't have these variables substituted in Makefile, these can
be also removed. The filter and mysqli don't need any libraries for
linking here.
2024-02-09 22:20:32 +01:00
Peter Kokot
085da2725f Merge branch 'PHP-8.3'
* PHP-8.3:
  Use EXTENSIONS instead of SKIPIF sections in *.phpt
2024-01-31 11:20:56 +01:00
Peter Kokot
8d5fc8d23f Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Use EXTENSIONS instead of SKIPIF sections in *.phpt
2024-01-31 11:20:44 +01:00
Peter Kokot
218a93b898 Use EXTENSIONS instead of SKIPIF sections in *.phpt
This also fixes skipped tests due to different naming "zend-test"
instead of "zend_test" and "PDO" instead of "pdo":

- ext/dom/tests/libxml_global_state_entity_loader_bypass.phpt
- ext/simplexml/tests/libxml_global_state_entity_loader_bypass.phpt
- ext/xmlreader/tests/libxml_global_state_entity_loader_bypass.phpt
- ext/zend_test/tests/observer_sqlite_create_function.phpt

EXTENSIONS section is used for the Windows build to load the non-static
extensions.

Closes GH-13276
2024-01-31 11:18:21 +01:00
Peter Kokot
52dba99d47 Sync headers installation
This syncs the installed sapi and extension headers on *nix and Windows
systems by installing only what is intended outside of php-src.

- ext/gd: without gd_arginfo.h and gd_compat.h
- ext/hash: php_hash_joaat.h and php_hash_fnv.h added also on Windows
  installation; xxhash/xxhash.h added on both installations as it is
  included in php_hash_xxhash.h; Include path for xxhash.h changed to
  relative so the php_hash_xxhash.h can be included outside of php-src;
  Redundant include flags removed
- ext/iconv: without iconv_arginfo.h
- ext/mysqli: mysqli_mysqlnd.h was missing on Windows
- ext/phar: php_phar.h was missing on Windows
- ext/sodium: php_libsodium.h was missing on *nix
- ext/xml: without xml_arginfo.h
- sapi/cli: cli.h was missing on Windows

Closes GH-13210
Closes GH-13213
2024-01-28 19:50:55 +01:00
Ilija Tovilo
b169725757
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix filter_var with callback and explicit REQUIRE_SCALAR
2023-09-14 11:49:44 +02:00
Ilija Tovilo
85ceb91789
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix filter_var with callback and explicit REQUIRE_SCALAR
2023-09-14 11:49:10 +02:00
Ilija Tovilo
c2fb10d2d2
Fix filter_var with callback and explicit REQUIRE_SCALAR
For some reason, FILTER_CALLBACK disables the FILTER_REQUIRE_SCALAR flag that is
normally set by default. While surprising, this is not something we can change.

However, even specifying FILTER_REQUIRE_SCALAR explicitly does not corrently set
this flag. This is because FILTER_CALLBACK zeroes the flags after they have been
populated from the parameters.

We reverse the checks to make explicitly specifying the flag behave as expected.

Closes GH-12203
2023-09-14 11:48:40 +02:00
George Peter Banyard
a123ce9dd4
Merge branch 'PHP-8.2'
* PHP-8.2:
  Add missing EXTENSION section to tests
2022-10-27 14:42:40 +01:00
George Peter Banyard
a27ae67c0f
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Add missing EXTENSION section to tests
2022-10-27 14:42:17 +01:00
George Peter Banyard
a4acba9e52
Add missing EXTENSION section to tests 2022-10-27 14:39:43 +01:00
juan-morales
fca9e23a6f
QA - filter_input - LCOV - FILTER_NULL_ON_FAILURE
Closes GH-9737.
2022-10-13 13:59:48 +02:00
Máté Kocsis
b4ec3e9bc0
Do not generate CONST_CS when registering constants (#9439) 2022-08-28 08:27:19 +02:00
Máté Kocsis
e328c68305
Rename @cname to @cvalue in stubs (#9043)
@cname currently refers to the constant name in C. However, it is not always a (constant) name, but sometimes a function invocation, so naming it as @cvalue would be more appropriate.
2022-07-19 15:11:42 +02:00
root
d8fc05c05e
Add FILTER_FLAG_GLOBAL_RANGE to filter Global IPs as per RFC 6890 2022-07-18 17:56:05 +01:00
Rowan Tommins
af15923bc3
Extend deprecation notices to is_callable($foo) and callable $foo
Implements https://wiki.php.net/rfc/partially-supported-callables-expand-deprecation-notices
so that uses of "self" and "parent" in is_callable() and callable
type constraints now raise a deprecation notice, independent of the
one raised when and if the callable is actually invoked.

A new flag is added to the existing check_flags parameter of
zend_is_callable / zend_is_callable_ex, for use in internal calls
that would otherwise repeat the notice multiple times. In particular,
arguments to internal function calls are checked first based on
arginfo, and then again during ZPP, so the former suppresses the
deprecation notice.

Some existing tests which raised this deprecation have been updated
to avoid the syntax, but the existing version retained for maximum
regression coverage until it is made an error.

With thanks to Juliette Reinders Folmer for the RFC and initial
investigation.

Closes GH-8823.
2022-07-14 17:07:42 +02:00
Arnaud Le Blanc
4df3dd7679
Reduce memory allocated by var_export, json_encode, serialize, and other (#8902)
smart_str uses an over-allocated string to optimize for append operations. Functions that use smart_str tend to return the over-allocated string directly. This results in unnecessary memory usage, especially for small strings.

The overhead can be up to 231 bytes for strings smaller than that, and 4095 for other strings. This can be avoided for strings smaller than `4096 - zend_string header size - 1` by reallocating the string.

This change introduces `smart_str_trim_to_size()`, and calls it in `smart_str_extract()`. Functions that use `smart_str` are updated to use `smart_str_extract()`.

Fixes GH-8896
2022-07-08 14:47:46 +02:00
Pierrick Charron
6fd2b39397
Indent with TAB in .h files generated by gen_stub 2022-06-13 08:55:54 -04:00
Máté Kocsis
debd38f851 Add support for sensitive parameters in stubs 2022-06-04 18:15:05 +02:00
Máté Kocsis
fd049e8385
Declare ext/filter constants in stubs (#8702) 2022-06-04 11:40:54 +02:00
Stanislav Malyshev
187a0e4707
Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Don't try to access memory outside string
2022-03-28 10:54:05 -06:00
Stanislav Malyshev
2119ba215a
Don't try to access memory outside string 2022-03-28 10:52:34 -06:00
Christoph M. Becker
1c3374c785
Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix signedness confusion in php_filter_validate_domain()
2022-03-28 14:02:32 +02:00
Christoph M. Becker
771dbdb319
Fix signedness confusion in php_filter_validate_domain()
As is, there is the possibility that integer underflow occurs, making
`_php_filter_validate_domain()` succeed for very long domain names.

Cf. <https://pwning.systems/posts/php_filter_var_shenanigans/>.
2022-03-28 14:00:22 +02:00
Stanislav Malyshev
414d5620b0 Merge branch 'PHP-8.0' into PHP-8.1 2022-02-13 21:58:24 -08:00
Christoph M. Becker
82f1bf1b6b Fix #81708: UAF due to php_filter_float() failing for ints
We must only release the zval, if we actually assign a new zval.
2022-02-13 21:56:39 -08:00
Christoph M. Becker
a000af6ecc
Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix FILTER_FLAG_NO_RES_RANGE flag
2021-12-19 16:25:54 +01:00
Yifan Tong
3587e13ab3
Fix FILTER_FLAG_NO_RES_RANGE flag
`2001:10::/28` is a reserved IPv6 range. But there's a typo in GH-7476,
which caused IPv6 address like `240b:0010::1` will be filtered by the
flag `FILTER_FLAG_NO_RES_RANGE`.

http://www.faqs.org/rfcs/rfc6890.html

Closes GH-7790.
2021-12-19 16:24:34 +01:00
Christoph M. Becker
1dcc0ff5f6
Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix #61700: FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing
2021-09-20 17:45:34 +02:00
Christoph M. Becker
fbc922d55c
Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #61700: FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing
2021-09-20 17:39:22 +02:00
Christoph M. Becker
288c25f7d1
Fix #61700: FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing
It makes no sense to compare IPv6 address ranges as strings; there are
too many different representation possibilities.  Instead, we change
`_php_filter_validate_ipv6()` so that it can calculate the IP address
as integer array.  We do not rely on `inet_pton()` which may not be
available everywhere, at least IPv6 support may not, but rather parse
the IP address manually.  Finally, we compare the integers.

Note that this patch does not fix what we consider as reserved and
private, respectively, but merely tries to keep what we had so far.

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>

Closes GH-7476.
2021-09-20 17:38:05 +02:00
Máté Kocsis
8e6e9838b0
Add support for generating MAY_BE_ARRAY_OF_REF func info flag (#7416) 2021-08-30 13:50:34 +02:00
Máté Kocsis
50f31829b1
Generate optimizer func info from stubs for a few extensions - part 2 (#7401)
ext/bcmath, ext/fileinfo, ext/filter, ext/gettext, ext/session
2021-08-25 15:29:46 +02:00
Nikita Popov
aa733e8ac8 Deprecate filter.default
There's a subtlety here regarding filter.default_flags. The RFC
stated that no separate deprecation warning will be emitted for
it, on the premise that it is only meaningful if filter.default
is set. However, it turns out that even FILTER_UNSAFE_RAW (which
is the "no-op filter") can be combined with stripping flags.
However, this is compensated by the fact that this doesn't actually
work when setting filter.default=unsafe_raw and non-default
filter.default_flags -- the flags are simply ignored in that case.
So everything works out in the end.

Part of https://wiki.php.net/rfc/deprecations_php_8_1.
2021-07-12 09:33:08 +02:00
Nikita Popov
bf94010b4b Deprecate FILTER_SANITIZE_STRING/STRIPPED
Deprecate the FILTER_SANITIZE_STRING and FILTER_SANITIZE_STRIPPED
filters.

This is part of https://wiki.php.net/rfc/deprecations_php_8_1.
2021-07-08 16:46:59 +02:00
Patrick Allaert
aff365871a Fixed some spaces used instead of tabs 2021-06-29 11:30:26 +02:00
Stanislav Malyshev
7bab67c2d0
Fix warning
(cherry picked from commit 190013787b)
2021-06-28 14:41:33 +02:00
Stanislav Malyshev
4957b7c02b
Merge branch 'PHP-8.0'
* PHP-8.0:
  Fix warning
2021-06-27 21:58:10 -07:00