This fixes a way it was possible to trigger an Internel Error
by disabling function (via the INI setting) when SPL was acting
as a proxy to the function call.
Fix flock_compat layer as it needs to used in SPL now.
For php-ast interning the file name is an effective memory leak,
see php-ast#134.
I don't think there's any reason to do this. At some point this
was needed due to bugs in the interned string mechanism that
caused issues if the string was later interned, e.g. through a
__FILE__ reference. These issues have since been resolved.
In conjunction with the filenames_table removal in c4016ecd446ef26bb3dc77735b6e441e151ea985
this means that filenames now need to be refcounted like normal
strings. In particular the filename reference in op_arrays and CEs
are refcounted.
Applying the obvious fix ... however, I think we may need to
rething how we handle trampoline fcc for "f" zpp. It might make
sense to use fcc->function_handler == NULL for that case and
force it to be fetched in zend_call_function instead (it will
be reset to that after the call anyway). Otherwise we will keep
chasing these leaks, as it's the only instance where it's
necessary to free a zpp result.
Handle memory limit error during string reallocation correctly
Do not decrement the refcount before allocating the new string,
as the allocation operation may bail out and cause a use-after-free
lateron. We can only decrement the refcount once the allocation
has succeeded.
Alex Dowad [Thu, 30 Jul 2020 20:08:25 +0000 (22:08 +0200)]
Fix typos in mbstring tests
Man, I can be pedantic sometimes. Tiny little things like misspelled words just
hurt me inside. So while it's not really a big deal, I couldn't leave these typos
alone...
Fix throwing of yield from related exceptions into generator
Use the general zend_generator_throw_exception() helper for this.
Otherwise we don't handle the off-by-one opline correctly (should
we maybe just stop doing that?)
This is a followup to ad750c3bb6e7b48384c6265eb9d3bcf5b4000652,
which fixed a different yield from exception handling problem that
happened to show up in the same test case from oss-fuzz #25321.
Now both issues should be fixed.
Shift the responsibility for emitting MAKE_REF to the list assignment
code, to make sure that LIST_W and MAKE_REF are directly adjacent,
and there are no opcodes in between that could modify the LIST_W
result.
Additionally, adjust the zend_wrong_string_offset() code to not
perform a loop over opcodes and assert that the next opcode is
a relevant one. The VM write-safety model requires this.
This can happen if zend_call_function inserted a dummy frame,
and we already switched to the dummy frame in leave_helper,
and an exception is thrown during CV destruction.
After a99d08b5d135fffa1d83b08b056e0080d295d863 the type can
include UNDEF. However, UNDEF can only reach FE_FREE, not FE_FETCH.
As such, simply ignore this type.
FE_RESET sets the result to UNDEF in this case. We should infer
some type here, because no type generally implies unreachable
code. In this case SCCP ended up replacing the FE_RESET result
with null, including in FE_FREE.
Alex Dowad [Sun, 5 Jul 2020 18:05:29 +0000 (20:05 +0200)]
Don't guard mbstring code with #ifdef HAVE_MBSTRING
This is just a very silly feature of mbstring -- you can compile the source files with
HAVE_MBSTRING undefined, and it will all just compile to (almost) nothing. What is the
use of this? Why compile the source files and link against them if you don't want the
mbstring extension? It doesn't make any kind of sense.
Alex Dowad [Sat, 4 Jul 2020 21:52:32 +0000 (23:52 +0200)]
Remove redundant includes from mbstring (and make sure correct config.h is used)
Very interesting... it turns out that when Valgrind support was enabled,
`#include "config.h"` from within mbstring was actually including the file "config.h"
from Valgrind, and not the one from mbstring!!
This is because -I/usr/include/valgrind was added to the compiler invocation _before_
-Iext/mbstring/libmbfl.
Make sure we actually include the file which was intended.
Alex Dowad [Sat, 27 Jun 2020 22:25:13 +0000 (00:25 +0200)]
Optimize php_unicode_convert_case (cuts mbstring case conversion time ~15%)
This function uses various subfunctions to convert case of Unicode wchars.
Previously, these subfunctions would store the case-converted characters in
a buffer, and the parent function would then pass them (byte by byte) to
the next filter in the filter chain.
Rather than passing around that buffer, it's better for the subfunctions to
directly pass the case-converted bytes to the next filter in the filter chain.
This speeds things up nicely.
Alex Dowad [Fri, 3 Jul 2020 19:52:27 +0000 (21:52 +0200)]
Separate implementation of mb_{en,de}code_numericentity
Rather than using a magic boolean parameter to choose different behavior of
the subfunction, inline it. The code size doesn't really grow anyways. And
soon these will be trimmed down more.
Alex Dowad [Sat, 27 Jun 2020 15:00:17 +0000 (17:00 +0200)]
Inline unneeded indirection for mbstring memory management
All memory allocation and deallocation for mbstring bounces through a table of
function pointers before going to emalloc/efree/etc. But this is unnecessary.
The allocators are never swapped out. Better to just call them directly.
Nikita Popov [Mon, 31 Aug 2020 12:02:35 +0000 (14:02 +0200)]
Fix fetching default value of internal function with userland arginfo
"Fix" in the sense of "not crash". We aren't able to actually
display the default value for this case, as there's no way to
fetch the relevant information right now.