]>
granicus.if.org Git - php/log
Nikita Popov [Fri, 28 Aug 2020 07:57:11 +0000 (09:57 +0200)]
Store incomplete_class entry as normal global
I don't see any reason why this needs to live in a thread-safe
global, unlikely all other class entries.
Dmitry Stogov [Thu, 27 Aug 2020 21:53:09 +0000 (00:53 +0300)]
Avoid useless IP load
Dmitry Stogov [Thu, 27 Aug 2020 21:02:10 +0000 (00:02 +0300)]
Remove useless register allocations
Dmitry Stogov [Thu, 27 Aug 2020 19:59:30 +0000 (22:59 +0300)]
Replace "mov %eax, %ecx; shl $1, $ecx" by "lea (%eax,%eax), %ecx"
Nikita Popov [Thu, 27 Aug 2020 14:57:09 +0000 (16:57 +0200)]
Fix typo
This was supposed to include the header, not the C file...
Nikita Popov [Thu, 27 Aug 2020 12:42:34 +0000 (14:42 +0200)]
Generate execute corpus in generate_all.php
And add crypt() to the function blacklist, it can be very slow.
Nikita Popov [Thu, 27 Aug 2020 14:19:15 +0000 (16:19 +0200)]
Merge branch 'PHP-7.4'
* PHP-7.4:
Don't assert when comparing uninit DateTimeZone objects
Nikita Popov [Thu, 27 Aug 2020 14:18:45 +0000 (16:18 +0200)]
Don't assert when comparing uninit DateTimeZone objects
Nothing guarantees that the objects are initialized here... just
check as usual.
Nikita Popov [Thu, 27 Aug 2020 13:51:58 +0000 (15:51 +0200)]
Merge branch 'PHP-7.4'
* PHP-7.4:
Require non-negative length in stream_get_contents()
Nikita Popov [Thu, 27 Aug 2020 13:51:35 +0000 (15:51 +0200)]
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
Require non-negative length in stream_get_contents()
Nikita Popov [Thu, 27 Aug 2020 13:49:33 +0000 (15:49 +0200)]
Require non-negative length in stream_get_contents()
If the length is not -1, require it to be non-negative.
Using such lengths doesn't make sense (as only -1 is special-case
to read in chunks, anything else will end up doing a huge upfront
allocation) and can lead to string allocation overflow.
A similar check is already in place for file_get_contents(). That
one does not allow -1 (and uses null instead), but this function
is explicitly specified to accept -1, so stick to that behavior.
Nikita Popov [Thu, 27 Aug 2020 12:52:54 +0000 (14:52 +0200)]
Use zend_dval_to_lval() in spl_offset_convert_to_long()
Avoid fptoi UB and use the standard PHP conversion behavior.
Nikita Popov [Thu, 27 Aug 2020 12:36:12 +0000 (14:36 +0200)]
Fix leak in typed reference assignment
We're only creating tmp here to compare against the existing
coerced_value. We need to destroy it in all cases.
Dmitry Stogov [Thu, 27 Aug 2020 12:29:11 +0000 (15:29 +0300)]
Update operands range information accoring to the taken branches and use this indormation to eliminate useless overflow checks.
Nikita Popov [Wed, 9 Oct 2019 17:17:07 +0000 (19:17 +0200)]
Add experimental "execute" fuzzer
This is an end-to-end fuzzer that executes arbitrary PHP code.
We replace the executor with a finite-step executor to avoid
getting stuck in loops or recursion.
Nikita Popov [Thu, 27 Aug 2020 10:54:43 +0000 (12:54 +0200)]
Fix leak on failed DatePeriod initialization
We need to free not only p here, but also b and e.
Nikita Popov [Thu, 27 Aug 2020 10:42:08 +0000 (12:42 +0200)]
Allow removing non-existing key from WeakMap
In line with usual PHP semantics. This previously triggered an
assertion failure.
Nikita Popov [Thu, 27 Aug 2020 10:24:58 +0000 (12:24 +0200)]
Clean up strtok implementation
Store the zend_string instead of performing a copy and storing
in a zval. Also make sure the string is released immediately if
it's no longer needed. Finally, avoid null pointer offset UB if
no string has been set -- though I'm wondering if this case
shouldn't be generating a warning?
Nikita Popov [Thu, 27 Aug 2020 10:05:06 +0000 (12:05 +0200)]
Fix use-after-free is WeakMap key and value are the same
Drop the object from the WeakMap as the last step, as this might
end up destroying the object.
Dmitry Stogov [Thu, 27 Aug 2020 08:38:15 +0000 (11:38 +0300)]
Eliminate ZSTR_IS_INTERNED() check
Christoph M. Becker [Thu, 27 Aug 2020 08:25:01 +0000 (10:25 +0200)]
Merge branch 'PHP-7.4' into master
* PHP-7.4:
Catch potential exceptions during to string conversion
Christoph M. Becker [Tue, 25 Aug 2020 13:40:17 +0000 (15:40 +0200)]
Catch potential exceptions during to string conversion
As of PHP 7.4.0, exceptions are allowed to be thrown from inside
`__toString()` methods; we have to cater to that, and catch these
exceptions early.
Closes GH-6042
Nikita Popov [Wed, 26 Aug 2020 15:09:14 +0000 (17:09 +0200)]
Enforce memory limit in tracked allocation mode
A very basic limit (for single allocations) was already enforced.
This extends it to count the total memory allocations.
This is useful to avoid out of memory conditions while fuzzing.
Dmitry Stogov [Thu, 27 Aug 2020 08:04:23 +0000 (11:04 +0300)]
Check interrupt only if the link is a part of the loop.
Dmitry Stogov [Thu, 27 Aug 2020 07:31:39 +0000 (10:31 +0300)]
Rename zend_jit_var_may_be_modified_indirectly() into zend_jit_var_may_alias()
Dmitry Stogov [Wed, 26 Aug 2020 21:40:55 +0000 (00:40 +0300)]
Check reference guard once
Dmitry Stogov [Wed, 26 Aug 2020 18:13:55 +0000 (21:13 +0300)]
Use "movaps" instead of "movsd" to copy the whole %xmm register.
Dmitry Stogov [Wed, 26 Aug 2020 15:56:54 +0000 (18:56 +0300)]
Fixed reference-counting
Nikita Popov [Wed, 26 Aug 2020 14:12:56 +0000 (16:12 +0200)]
Merge branch 'PHP-7.4'
* PHP-7.4:
Property handle read_property exception in fetch_property_address
Nikita Popov [Wed, 26 Aug 2020 14:10:29 +0000 (16:10 +0200)]
Property handle read_property exception in fetch_property_address
Otherwise we leak (and corrupt uninitialized_zval).
Christoph M. Becker [Wed, 26 Aug 2020 13:43:43 +0000 (15:43 +0200)]
Merge branch 'PHP-7.4' into master
* PHP-7.4:
Fix com_safearray_proxy related memory management issues
Christoph M. Becker [Wed, 26 Aug 2020 13:40:57 +0000 (15:40 +0200)]
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
Fix com_safearray_proxy related memory management issues
Christoph M. Becker [Wed, 26 Aug 2020 13:31:26 +0000 (15:31 +0200)]
Fix com_safearray_proxy related memory management issues
Nikita Popov [Wed, 26 Aug 2020 13:19:23 +0000 (15:19 +0200)]
Lowercase method name in zend_call_method()
Nikita Popov [Wed, 26 Aug 2020 13:09:42 +0000 (15:09 +0200)]
Fix pass by ref error for named params
Christoph M. Becker [Wed, 26 Aug 2020 13:02:34 +0000 (15:02 +0200)]
Merge branch 'PHP-7.4' into master
* PHP-7.4:
Separate COM::__construct()s $server_name array
Christoph M. Becker [Wed, 26 Aug 2020 13:01:22 +0000 (15:01 +0200)]
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
Separate COM::__construct()s $server_name array
Christoph M. Becker [Tue, 25 Aug 2020 11:48:50 +0000 (13:48 +0200)]
Separate COM::__construct()s $server_name array
This may otherwise be modified.
Christoph M. Becker [Wed, 26 Aug 2020 12:55:34 +0000 (14:55 +0200)]
Merge branch 'PHP-7.4' into master
* PHP-7.4:
Fix #64130: COM obj parameters passed by reference are not updated
Christoph M. Becker [Wed, 26 Aug 2020 12:52:09 +0000 (14:52 +0200)]
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
Fix #64130: COM obj parameters passed by reference are not updated
Christoph M. Becker [Wed, 26 Aug 2020 12:45:13 +0000 (14:45 +0200)]
Fix #64130: COM obj parameters passed by reference are not updated
`ITypeInfo_GetIDsOfNames()` is supposed to fail with `E_NOTIMPL` for
out-of-process servers, thus we should not remove the already available
typeinfo of the object in this case.
We also properly free the `byref_vals`.
George Peter Banyard [Wed, 26 Aug 2020 10:57:24 +0000 (12:57 +0200)]
Drop various unused macros/APIs
Also convert_libmagic_pattern() to return a zend_string*
Closes GH-6029
Nikita Popov [Wed, 26 Aug 2020 10:32:22 +0000 (12:32 +0200)]
Merge branch 'PHP-7.4'
* PHP-7.4:
Fix file name clash in test
Nikita Popov [Wed, 26 Aug 2020 10:32:06 +0000 (12:32 +0200)]
Fix file name clash in test
Nikita Popov [Wed, 26 Aug 2020 10:19:17 +0000 (12:19 +0200)]
Fix memory leak on unknown named param in iterator unpack
Nikita Popov [Wed, 26 Aug 2020 10:12:23 +0000 (12:12 +0200)]
Merge branch 'PHP-7.4'
* PHP-7.4:
Avoid socket path clash in test
Nikita Popov [Wed, 26 Aug 2020 10:11:22 +0000 (12:11 +0200)]
Avoid socket path clash in test
Dmitry Stogov [Wed, 26 Aug 2020 10:09:16 +0000 (13:09 +0300)]
Improved JIT for FETCH_DIM_R/IS and ISSET_DIM_OBJ
Nikita Popov [Wed, 26 Aug 2020 09:52:45 +0000 (11:52 +0200)]
Fix passing of undef var to named arg
This needs to use the previously computed argument target.
Nikita Popov [Wed, 26 Aug 2020 09:44:15 +0000 (11:44 +0200)]
Fix memory leak on unknown named param
Nikita Popov [Wed, 26 Aug 2020 09:32:56 +0000 (11:32 +0200)]
Merge branch 'PHP-7.4'
* PHP-7.4:
Fix memory leak when yielding from non-iterable
Nikita Popov [Wed, 26 Aug 2020 09:32:31 +0000 (11:32 +0200)]
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
Fix memory leak when yielding from non-iterable
Nikita Popov [Wed, 26 Aug 2020 09:32:01 +0000 (11:32 +0200)]
Fix memory leak when yielding from non-iterable
Nikita Popov [Wed, 26 Aug 2020 09:01:15 +0000 (11:01 +0200)]
Fix over-eager named params optimization
We can't relax a named param to a positional param if we encountered
any unknown parameters in the meantime.
Nikita Popov [Wed, 26 Aug 2020 08:20:31 +0000 (10:20 +0200)]
Prevent ResourceBundle double-construction
Nikita Popov [Wed, 26 Aug 2020 08:16:32 +0000 (10:16 +0200)]
Prevent double-construction of NumberFormatter
Nikita Popov [Wed, 26 Aug 2020 08:10:41 +0000 (10:10 +0200)]
Prevent double-construction of IntlGregorianCalendar
Nikita Popov [Wed, 26 Aug 2020 08:03:11 +0000 (10:03 +0200)]
Prevent double-construction of IntlRuleBasedBreakIterator
Dmitry Stogov [Tue, 25 Aug 2020 23:34:31 +0000 (02:34 +0300)]
Use guard to check if array is packed or hash
Dmitry Stogov [Tue, 25 Aug 2020 22:07:34 +0000 (01:07 +0300)]
Prevent negative array index access
Dmitry Stogov [Tue, 25 Aug 2020 19:33:52 +0000 (22:33 +0300)]
Merge branch 'jit_match'
* jit_match:
Support for CASE_STRICT
JIT for MATCH and CASE_STRICT instructions
Dmitry Stogov [Tue, 25 Aug 2020 18:38:23 +0000 (21:38 +0300)]
Avoid priniting "array [long, string] of"
Nikita Popov [Tue, 25 Aug 2020 18:26:17 +0000 (20:26 +0200)]
Merge branch 'PHP-7.4'
* PHP-7.4:
Don't enable --with-mm in CI
Nikita Popov [Tue, 25 Aug 2020 18:25:07 +0000 (20:25 +0200)]
Don't enable --with-mm in CI
Turns out this has a large negative effect on startup time,
making tests much slower.
Dmitry Stogov [Tue, 25 Aug 2020 16:39:42 +0000 (19:39 +0300)]
Record information about packed arrays
Máté Kocsis [Tue, 25 Aug 2020 16:06:07 +0000 (18:06 +0200)]
Promote warnings to exceptions in ext/pcre
Closes GH-6006
Dmitry Stogov [Tue, 25 Aug 2020 15:28:23 +0000 (18:28 +0300)]
Infer information about packed/hash arrays and use it for JIT
Nikita Popov [Tue, 25 Aug 2020 13:28:58 +0000 (15:28 +0200)]
Ensure RuleBasedBreakIterator constructor throws on failure
Constructors must throw on failure indepdendent of the configured
intl error mode.
Máté Kocsis [Tue, 18 Aug 2020 17:20:56 +0000 (19:20 +0200)]
Promote warnings to exceptions in ext/simplexml
Closes GH-6011
Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>
Dmitry Stogov [Tue, 25 Aug 2020 13:08:33 +0000 (16:08 +0300)]
Fixed JIT failure on "$a = []; $a[1] += 2;"
Christoph M. Becker [Tue, 25 Aug 2020 11:15:06 +0000 (13:15 +0200)]
Merge branch 'PHP-7.4' into master
* PHP-7.4:
Avoid double-free
Christoph M. Becker [Tue, 25 Aug 2020 11:12:41 +0000 (13:12 +0200)]
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
Avoid double-free
Nikita Popov [Fri, 14 Aug 2020 14:56:25 +0000 (16:56 +0200)]
Clean up BreakIterator create_object handler
Use standard zend_object_alloc() function and fix the
object_init_properties() call (which works out okay because there
are no properties).
Nikita Popov [Tue, 25 Aug 2020 11:09:38 +0000 (13:09 +0200)]
Fix XMLWriter::writeDtdEntity() stub
$isparam is optional.
Christoph M. Becker [Tue, 25 Aug 2020 11:07:29 +0000 (13:07 +0200)]
Avoid double-free
As of commit
b2e3fd1 [1] the `authid.User` is no longer newly allocated,
so we must not free it.
[1] <http://git.php.net/?p=php-src.git;a=commit;h=
b2e3fd1e691b1dc82aaaf4150461db97bd5acf4a >
Máté Kocsis [Thu, 13 Aug 2020 22:32:36 +0000 (00:32 +0200)]
Promote warnings to exceptions in ext/shmop
Closes GH-5986
Máté Kocsis [Mon, 17 Aug 2020 20:37:20 +0000 (22:37 +0200)]
Promote warnings to exceptions in ext/pcntl
Closes GH-6004
Nikita Popov [Tue, 25 Aug 2020 10:36:06 +0000 (12:36 +0200)]
Merge branch 'PHP-7.4'
* PHP-7.4:
Remove bogus REGISTER_LONG_CONSTANT
Nikita Popov [Tue, 25 Aug 2020 10:35:54 +0000 (12:35 +0200)]
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
Remove bogus REGISTER_LONG_CONSTANT
Nikita Popov [Tue, 25 Aug 2020 10:34:32 +0000 (12:34 +0200)]
Remove bogus REGISTER_LONG_CONSTANT
This shouldn't be in this function, probably a copy/paste mistake...
twosee [Tue, 25 Aug 2020 10:02:38 +0000 (18:02 +0800)]
Remove useless same_zval function
Closes GH-6039.
Máté Kocsis [Tue, 18 Aug 2020 11:38:18 +0000 (13:38 +0200)]
Promote warnings to exceptions in ext/phar
Closes GH-6008
Máté Kocsis [Wed, 19 Aug 2020 20:35:22 +0000 (22:35 +0200)]
Promote warnings to exceptions in ext/xmlreader
Closes GH-6021
Nikita Popov [Tue, 25 Aug 2020 09:27:58 +0000 (11:27 +0200)]
Don't return temporary from SXE write_property handler
Return the original value. If we don't return the original value,
we need to own the zval, which we don't.
For clarity also switch things to work on a zend_string* value
instead of a zval*.
Nikita Popov [Tue, 25 Aug 2020 09:01:22 +0000 (11:01 +0200)]
Simplify change_node_zval implementation
At this point, the value has already been converted into a string.
Dmitry Stogov [Tue, 25 Aug 2020 08:37:30 +0000 (11:37 +0300)]
Move AVOID_REFCOUNTING type info flag into a separate bit
Dmitry Stogov [Mon, 24 Aug 2020 13:47:20 +0000 (16:47 +0300)]
Support for CASE_STRICT
Dmitry Stogov [Mon, 24 Aug 2020 12:22:52 +0000 (15:22 +0300)]
JIT for MATCH and CASE_STRICT instructions
Christoph M. Becker [Mon, 24 Aug 2020 15:38:50 +0000 (17:38 +0200)]
Merge branch 'PHP-7.4' into master
* PHP-7.4:
Fix potential integer overflow detected by oss-fuzz
Máté Kocsis [Wed, 19 Aug 2020 20:43:07 +0000 (22:43 +0200)]
Promote warning to exception in ext/enchant
Closes GH-6022
Christoph M. Becker [Mon, 24 Aug 2020 15:36:50 +0000 (17:36 +0200)]
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
Fix potential integer overflow detected by oss-fuzz
Christoph M. Becker [Mon, 24 Aug 2020 15:32:06 +0000 (17:32 +0200)]
Fix potential integer overflow detected by oss-fuzz
We port the respective fix from upstream[1].
[1] <https://github.com/libgd/libgd/commit/
9ed642764cf0b4585d135eb738812a43265cb2d3 >
Máté Kocsis [Tue, 18 Aug 2020 12:24:46 +0000 (14:24 +0200)]
Promote warning to exception in ext/posix
Closes GH-6009
Máté Kocsis [Mon, 10 Aug 2020 17:06:55 +0000 (19:06 +0200)]
Promote warnings to exceptions in ext/filter
Closes GH-5970
Nikita Popov [Mon, 24 Aug 2020 15:30:31 +0000 (17:30 +0200)]
Drop a spurious zend_string_release
This should have been dropped in the refactoring.
Nikita Popov [Mon, 24 Aug 2020 15:09:33 +0000 (17:09 +0200)]
Clean up setlocale implementation
Factor out the core logic into a separate function and drop the
"clever" code that combines iteration through variadic arguments
and arrays.
This fixes bug #79829 as a side effect.
Nikita Popov [Mon, 24 Aug 2020 14:49:37 +0000 (16:49 +0200)]
Remove php_my_setlocale workaround
This works around a macro-expansion issue that is no longer
relevant in PHP 8.
Nikita Popov [Mon, 24 Aug 2020 14:30:49 +0000 (16:30 +0200)]
Fix refcounting for the named params case as well
Adjust the test case to pass a refcounted value and to also check
the named params case.
Nikita Popov [Mon, 24 Aug 2020 14:23:33 +0000 (16:23 +0200)]
Merge branch 'PHP-7.4'
* PHP-7.4:
Fix refcounting
Nikita Popov [Mon, 24 Aug 2020 14:23:19 +0000 (16:23 +0200)]
Fix refcounting