Fixed bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex())
Fixed bug #62210 (Exceptions can leak temporary variables. As a part of the fix serious refactoring was done. op_array->brk_cont_array was removed, and replaced with more general and speed efficient op_array->T_liveliness. ZEND_GOTO opcode is always replaced by ZEND_JMP at compile time). (Bob, Dmitry, Laruence)
Squashed commit of the following:
commit
38e22106d4bdcc829dd2b64be1d3c6cdc089f3ed
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 15:12:19 2015 +0300
Added NEWS entry
commit
0a355935bfb10b5a4c893f4db9496ea8abbcf71b
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 15:06:32 2015 +0300
Inline function, to eliminate repeatable checks
commit
d937584f3aef0baae6001377b61fd700b6f36e14
Merge:
0341626 32677f5
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 14:35:49 2015 +0300
Merge branch 'master' into temporary_cleaning
* master:
Fixed bug #70006 (cli - function with default arg = STDOUT crash output).
Fix x86 build
Fixed use after free on closure_call_leak_with_exception.phpt
Fixed test
commit
0341626ea94a5e474c660732d33884460847d5e7
Merge:
74869fa dec35de
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 12:00:53 2015 +0300
Merge branch 'temporary_cleaning' of https://github.com/laruence/php-src into temporary_cleaning
* 'temporary_cleaning' of https://github.com/laruence/php-src:
Fixed checkpoint get
Fixed crash of invalid pointer derefer
cleanup
commit
74869fa67375b8daf772ac30b6b936fd2a2132c6
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 11:45:34 2015 +0300
Fixed wrong GOTO resolution
commit
dec35ded3294e3022e88a623188c3d1d71381675
Author: Xinchen Hui <laruence@gmail.com>
Date: Tue Jul 7 15:58:49 2015 +0800
Fixed checkpoint get
commit
b0f419540ad24c44810c9b05da046965618ffc65
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 10:47:11 2015 +0300
Fixed crash of invalid pointer derefer (laruence)
commit
7a428d98ca2899c5933914caa0cd17b4126e952c
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 10:35:47 2015 +0300
Fixed identation
commit
9c3a4dce9ce02034d19d28182aa9c1298d528daf
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 10:33:52 2015 +0300
Fixed invalid size
commit
653abc670b2a1f453b0fc3fc4a9eca919ee870cc
Author: Xinchen Hui <laruence@gmail.com>
Date: Tue Jul 7 11:29:14 2015 +0800
Fixed crash of invalid pointer derefer
commit
e04500ceda606ac4f364d03bcd562327bdc74eee
Author: Xinchen Hui <laruence@gmail.com>
Date: Tue Jul 7 11:28:26 2015 +0800
cleanup
commit
34183e1687681038e77b650078927b35ee84e933
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 04:49:46 2015 +0300
op_array->T_liveliness compression
commit
2f6ad845795a08c3d7ac219e9c42950565b20394
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 04:44:44 2015 +0300
White spaces
commit
be83f115a3f82a548c8d377c66574de5e5187410
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 04:42:26 2015 +0300
Identation
commit
1f5084b99038c374ac012b017c4d1652bb5d4222
Merge:
91b620d 1adf3df
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 04:41:54 2015 +0300
Merge branch 'master' into temporary_cleaning
* master:
Throw TypeError for invalid callback
Fix crash when exception occurs during nested rope
Fix crash when exception is thrown during ROPE_END
Small cleanup in ternary compilation
move the define to the right place
fix ext/ldap build
Rectify information about invalid shift warning being now ArithmeticError
commit
91b620d684c5a2296774432d5d0ff8f5d14397d6
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 04:32:04 2015 +0300
Replace GOTO by FREE/FE_FREE and JMP at compile time
commit
7052e5697918fab83d2975977c3392f7188fbc87
Author: Dmitry Stogov <dmitry@zend.com>
Date: Tue Jul 7 02:25:08 2015 +0300
Use zend_regenerate_var_liveliness_info() to regenerate information after pass two.
commit
ae72b0dc6797815a846b8f95abccb36367422d27
Merge:
a81c4bb a919fe8
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 21:02:34 2015 +0300
Merge branch 'master' into temporary_cleaning
* master:
Do not display EXT_TYPE_UNUSED in phpdbg opcodes
Run debug build with opcache on travis
commit
a81c4bb8c6f1ba8124a5a7636694480ff0f1328c
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 20:59:34 2015 +0300
Improved algorithm. It's actually the same algorithm with second loop removed and simpler temporary data structures. The only difference may be in "re-defined" vatriable handling. Now live-range in that case started from the seconnd definition (this must be more safe).
commit
9a16810f7a7c10373603c5250d985616acf45e97
Merge:
bbfbe47 001ecd3
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 17:57:45 2015 +0300
Merge branch 'master' into temporary_cleaning
* master:
Simplify TMP var number decoding (without HashTable)
commit
bbfbe470c865cb8b3cae8bf6518e6d06af525522
Merge:
0bda4ab 436b01e
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 17:02:01 2015 +0300
Merge branch 'master' into temporary_cleaning
* master:
Avoid dangerous optimization
Fixed JMPZNZ instruction printing
Attempt at falling back on ldap_find_control for Mac OS
commit
0bda4abea7ba0a51c2ec125edb547645d0329792
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 16:05:33 2015 +0300
Fixed live-range construction for OP_DATA opcode
Added comments about algorithm assumtions
commit
521ad9df98fdf1dd8b7c212799ddeb1a84483e6f
Merge:
4398dab a09dcb0
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Mon Jul 6 14:54:15 2015 +0200
Merge branch 'master' of https://github.com/php/php-src into temporary_cleaning
commit
4398dab82f9a5ce64df55b24988ce7d31e24074f
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Mon Jul 6 13:51:27 2015 +0200
Add a few phpt tests related to temporary cleaning
commit
739656f83ff5b570bb311d2c7cb2d72380a3c759
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 14:28:49 2015 +0300
Fixed Zend/tests/foreach_004.phpt failure (FE_FETCH shouldn't be included into TMP vatriablr live range)
commit
3df462a2bcf5fa8f9244ea299178152a5d436277
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 13:41:02 2015 +0300
Improve data layout (reduce the op_array structure size on 64-bit systems)
commit
883b73c56e6dab6489ae4cda2c1331b53a995586
Author: Dmitry Stogov <dmitry@zend.com>
Date: Mon Jul 6 13:28:45 2015 +0300
Removed op_array->brk_cont_array
commit
ae5e58b59843513505e84e396c1446ac35cb1b94
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Mon Jul 6 04:22:58 2015 +0200
Fix bug with brk_cont variable free / free loop vars via temporary liveliness info
commit
b4223ca62771e1003c9ab778a09a177ad71e6d57
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Mon Jul 6 04:07:07 2015 +0200
Fix bugs / cleanup fixes
commit
ea33189d220c7fc0884848571635abe3cddd2f4d
Author: Xinchen Hui <laruence@gmail.com>
Date: Sun Jul 5 20:58:38 2015 +0800
Removed useless TsTop
commit
1dbb007e4addba9ac3bfc227db27a651cbcf5ede
Merge:
550bbf8 3a8af24
Author: Xinchen Hui <laruence@gmail.com>
Date: Sat Jul 4 15:06:44 2015 +0800
Merge branch 'temporary_cleaning' of https://github.com/dstogov/php-src into temporary_cleaning
commit
3a8af245290ceb507108340831254672f24022fa
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 3 16:15:36 2015 +0300
More exceptions from regular liveliness analyses (with explanation in comments).
Mark old "unexplained" exceptions with ???.
commit
ba721efa2cbd2136668fec956ef3b034ac1a29d6
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 3 14:16:09 2015 +0300
Print list of live temp variables (at least for internal debugging)
commit
8d1f88fe91e62b4333703c58b871d85b66fb7b70
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 3 13:31:56 2015 +0300
Use op_array->T_liveliness to free incomplete ropes and restore error_reporting level on exception
commit
80c1d0d779e6e9609a211907838f3727aa7b301a
Author: Dmitry Stogov <dmitry@zend.com>
Date: Fri Jul 3 11:05:39 2015 +0300
Don't keep empty T_liveliness
commit
501ae8aaac0a92368b50e9f342b04d7334d263f6
Author: Dmitry Stogov <dmitry@zend.com>
Date: Thu Jul 2 22:31:48 2015 +0300
Reverted changes to Zend/zend_arena.h.
Reuse CG(arena) instead of creating a new one.
commit
a4fce36907147df5ac1af78b44135e3f07c1844c
Merge:
6ff7246 fd0fcce
Author: Dmitry Stogov <dmitry@zend.com>
Date: Thu Jul 2 22:01:42 2015 +0300
Merge branch 'temporary_cleaning' of github.com:bwoebi/php-src into temporary_cleaning
* 'temporary_cleaning' of github.com:bwoebi/php-src:
Fix remaining issues with compacted temporaries
Fix regression from last commit (+1 ?!)
Fix off-by-one (opcache may remove last ZEND_RETURN)
Speed algorithm up, more fail safety when reusing temporaries
Dumb bug in opcode.c (forgot to update Ts[i])
Fix opcache support
Exempt ROPE temporaries from freeing
Hmm, we need temporary info for all the opcodes
Add opcache support for cleaning in optimization step (Opcache seems to have a few unrelated issues which blow up together with that patch)
Add proper temporary cleaning upon frame abortion
Fix arena on small sizes (size < sizeof(zend_arena))
commit
fd0fcce81177717f3a05ac87192b5ed05eead0a1
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Thu Jul 2 20:00:33 2015 +0200
Fix remaining issues with compacted temporaries
commit
427dc58bbb93022d1c2077f874afcdb9dd82d5c5
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Wed Jul 1 22:49:12 2015 +0200
Fix regression from last commit (+1 ?!)
commit
1adcf56a6e9f09e7ad06331d4d6280035b17a7d1
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Wed Jul 1 22:17:07 2015 +0200
Fix off-by-one (opcache may remove last ZEND_RETURN)
commit
25b231b7841fa4078c65976cabdd843845a6cbe6
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Wed Jul 1 20:59:24 2015 +0200
Speed algorithm up, more fail safety when reusing temporaries
commit
22d9d05350e35d180018d0bccbad6f173cb4797d
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Wed Jul 1 16:48:46 2015 +0200
Dumb bug in opcode.c (forgot to update Ts[i])
commit
6538269bfa5bcbad34fc2f051b0fd5e4ebf2ff00
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Wed Jul 1 13:05:52 2015 +0200
Fix opcache support
commit
333a7c4a8813a45dc79ce55b8e9c0a0b98671e13
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Sat Jun 27 22:40:21 2015 +0200
Exempt ROPE temporaries from freeing
commit
02585f77085427baea48448c134a96c542af3337
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Fri Jun 26 16:20:55 2015 +0200
Hmm, we need temporary info for all the opcodes
commit
cbcaedbd78199897e5cacffd700b706f21590abf
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Fri Jun 26 01:04:09 2015 +0200
Add opcache support for cleaning in optimization step
(Opcache seems to have a few unrelated issues which blow up together with that patch)
commit
fef649f4067823a1f96f85340cf715e5877310bc
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Fri Jun 26 01:02:27 2015 +0200
Add proper temporary cleaning upon frame abortion
commit
1cec2e7271b789b84601f8acf385950af1bb0c7c
Author: Bob Weinand <bobwei9@hotmail.com>
Date: Thu Jun 25 23:33:21 2015 +0200
Fix arena on small sizes (size < sizeof(zend_arena))
Fixed bug #70006 (cli - function with default arg = STDOUT crash output).
Replace references to PHP_WIN32 and TSRM_WIN32 with ZEND_WIN32 in Zend/, this also fixes 1 instance of where fflush(stderr) was misplaced (zend_extensions.c)