]> granicus.if.org Git - php/log
php
5 years agoAdd pcre_get_compiled_regex_cache_ex() with local_aware flag
Sergei Turchanov [Tue, 8 Oct 2019 07:55:07 +0000 (17:55 +1000)]
Add pcre_get_compiled_regex_cache_ex() with local_aware flag

A new function `pcre_get_compiled_regex_cache_ex()` is introduced,
which allows to compile regexp pattern using the "C" locale instead
of a current locale.

This will be needed to replace setlocale() usage in fileinfo,
which is not thread-safe.

5 years agoAdd missing SKIPIFs in exif tests
Fabien Villepinte [Tue, 8 Oct 2019 11:50:03 +0000 (13:50 +0200)]
Add missing SKIPIFs in exif tests

5 years agoFix #78642: Wrong libiconv version displayed
Christoph M. Becker [Tue, 8 Oct 2019 10:09:11 +0000 (12:09 +0200)]
Fix #78642: Wrong libiconv version displayed

The high byte of `_libiconv_version` specifies the major version; the
low byte the minor version.

5 years agonext is 7.2.25
Remi Collet [Tue, 8 Oct 2019 09:36:10 +0000 (11:36 +0200)]
next is 7.2.25

5 years agoFix #78641: addGlob can modify given remove_path value
Christoph M. Becker [Tue, 8 Oct 2019 07:25:56 +0000 (09:25 +0200)]
Fix #78641: addGlob can modify given remove_path value

`remove_path` points to the given string, so we must not modify it.
Instead we use a duplicate, if we need the modification.

We may want to switch to `zend_string`s in master.

5 years agoCheck for object_init_ex() failure in user filter factory
Nikita Popov [Mon, 7 Oct 2019 15:40:59 +0000 (17:40 +0200)]
Check for object_init_ex() failure in user filter factory

5 years agoSet session.gc_probability=0 in bug78624.phpt
Nikita Popov [Mon, 7 Oct 2019 14:43:19 +0000 (16:43 +0200)]
Set session.gc_probability=0 in bug78624.phpt

We only want to test manually triggered session GC.
Avoid spurious output due to automatic GC.

5 years agoFix #78623: Regression caused by "SP call yields additional empty result set"
Christoph M. Becker [Mon, 7 Oct 2019 06:58:11 +0000 (08:58 +0200)]
Fix #78623: Regression caused by "SP call yields additional empty result set"

This reverts commit 41a4379cb45419a376043ca5f8c5a2bca82cea7c.

5 years agoSplit intl tests for ICU 65
Christoph M. Becker [Fri, 4 Oct 2019 10:48:40 +0000 (12:48 +0200)]
Split intl tests for ICU 65

5 years agoFix #78620: Out of memory error
Christoph M. Becker [Thu, 3 Oct 2019 17:23:05 +0000 (19:23 +0200)]
Fix #78620: Out of memory error

The integer addition in `ZEND_MM_ALIGNED_SIZE_EX` can overflow, what we
have to catch early.

5 years agofix #78624: session_gc return value for user defined session handlers
Brent Shaffer [Wed, 2 Oct 2019 23:44:58 +0000 (16:44 -0700)]
fix #78624: session_gc return value for user defined session handlers

5 years agoFix bug #76809 (SSL settings aren't respected when persistent connection is reused)
Fábio Souto [Mon, 3 Sep 2018 16:18:37 +0000 (17:18 +0100)]
Fix bug #76809 (SSL settings aren't respected when persistent connection is reused)

5 years agoFix #76859 stream_get_line skips data if used with data-generating filter
Konstantin Kopachev [Tue, 18 Sep 2018 04:44:01 +0000 (21:44 -0700)]
Fix #76859 stream_get_line skips data if used with data-generating filter

stream_get-line repeatedly calls php_stream_fill_read_buffer until
enough data is accumulated in buffer. However, when stream contains
filters attached to it, then each call to fill buffer essentially
resets buffer read/write pointers and new data is written over old.
This causes stream_get_line to skip parts of data from stream
This patch fixes such behavior, so fill buffer call will append.

5 years agoRevert "Fix #78620: Out of memory error"
Christoph M. Becker [Wed, 2 Oct 2019 17:01:35 +0000 (19:01 +0200)]
Revert "Fix #78620: Out of memory error"

This reverts commit 8ce04df7e0108a10f7b782a28204e9384ab1129c.

Cf. <https://github.com/php/php-src/pull/4766#discussion_r330658679>.

5 years agoFix #78620: Out of memory error
Christoph M. Becker [Wed, 2 Oct 2019 14:42:28 +0000 (16:42 +0200)]
Fix #78620: Out of memory error

If the integer addition in `ZEND_MM_ALIGNED_SIZE_EX` overflows, the
macro evaluates to `0`, what we should catch early.

5 years agoFix segfault with __COMPILER_HALT_OFFSET__ and trailing {}
Nikita Popov [Wed, 2 Oct 2019 10:06:00 +0000 (12:06 +0200)]
Fix segfault with __COMPILER_HALT_OFFSET__ and trailing {}

Fixes OSS-Fuzz #17895.

5 years agoFixed test that "fails" from time to time
Dmitry Stogov [Tue, 1 Oct 2019 21:54:59 +0000 (00:54 +0300)]
Fixed test that "fails" from time to time

5 years agoFixed test that "fails" from time to time
Dmitry Stogov [Tue, 1 Oct 2019 21:48:42 +0000 (00:48 +0300)]
Fixed test that "fails" from time to time

5 years agoAdd missing skip keyword in tests
Fabien Villepinte [Tue, 1 Oct 2019 08:59:40 +0000 (10:59 +0200)]
Add missing skip keyword in tests

5 years agoFixed bug #78612
Nikita Popov [Mon, 30 Sep 2019 13:05:35 +0000 (15:05 +0200)]
Fixed bug #78612

5 years agoFix #78609: mb_check_encoding() no longer supports stringable objects
Christoph M. Becker [Mon, 30 Sep 2019 09:07:03 +0000 (11:07 +0200)]
Fix #78609: mb_check_encoding() no longer supports stringable objects

We apply type juggling for other types than array.

5 years agoFix build for libzip < 0.11.2
Christoph M. Becker [Sun, 29 Sep 2019 11:31:22 +0000 (13:31 +0200)]
Fix build for libzip < 0.11.2

We must not define method entries, if the actual method definitions or
the arginfo structures are not defined.

5 years agoFix SKIPIF in ext/mysqli
Fabien Villepinte [Fri, 27 Sep 2019 12:06:17 +0000 (14:06 +0200)]
Fix SKIPIF in ext/mysqli

5 years agoFix skipif.inc
Christoph M. Becker [Fri, 27 Sep 2019 10:50:04 +0000 (12:50 +0200)]
Fix skipif.inc

5 years agoFix memory leak with ** on array operands
Nikita Popov [Thu, 26 Sep 2019 11:45:45 +0000 (13:45 +0200)]
Fix memory leak with ** on array operands

5 years agoFix null-pointer deref in if stmt printing
Nikita Popov [Thu, 26 Sep 2019 08:24:49 +0000 (10:24 +0200)]
Fix null-pointer deref in if stmt printing

Fixes OSS-Fuzz #17721.

5 years agoFix hash key length in umsg_parse_format()
Jinesh Patel [Mon, 29 Jul 2019 18:19:52 +0000 (14:19 -0400)]
Fix hash key length in umsg_parse_format()

Fix array length passed to zend_hash_str_find_ptr() casting from
UChar array to char array requires mul by sizeof(UChar).

5 years agoFix NEWS entry
Christoph M. Becker [Mon, 23 Sep 2019 20:59:55 +0000 (22:59 +0200)]
Fix NEWS entry

Cf. <https://bugs.php.net/78590>.

5 years agoFix skipif condition
Nikita Popov [Mon, 23 Sep 2019 15:17:52 +0000 (17:17 +0200)]
Fix skipif condition

5 years agoSkip test on 32-bit
Nikita Popov [Mon, 23 Sep 2019 14:42:24 +0000 (16:42 +0200)]
Skip test on 32-bit

5 years agoFix signed integer overflow in SplObjectStorage unserialization
Nikita Popov [Mon, 23 Sep 2019 11:16:58 +0000 (13:16 +0200)]
Fix signed integer overflow in SplObjectStorage unserialization

If count is ZEND_LONG_MIN the count-- loop underflows. This is
ultimately harmless, but results in a ubsan warning.

Fix this by adding a sanity check that the count isn't negative,
because that doesn't make sense...

5 years agoFix test to be skipped if dom is not available
Christoph M. Becker [Sun, 22 Sep 2019 16:39:55 +0000 (18:39 +0200)]
Fix test to be skipped if dom is not available

5 years agoFix leak of temporary buffer during exif tag reading
Nikita Popov [Sun, 22 Sep 2019 10:10:17 +0000 (12:10 +0200)]
Fix leak of temporary buffer during exif tag reading

5 years agoFix multiple leaks in exif_read_data()
Nikita Popov [Sat, 21 Sep 2019 18:38:24 +0000 (20:38 +0200)]
Fix multiple leaks in exif_read_data()

This fixes two leaks related to duplicate tags, as well as a leak
of zero-length FMT_(S)BYTE with non-null value. This can show up
for MAKERNOTE values where the original length is non-zero, but
the first character is a null byte.

5 years agoFix length of key passed to zend_hash_str_find_ptr
Jinesh Patel [Mon, 29 Jul 2019 18:21:25 +0000 (14:21 -0400)]
Fix length of key passed to zend_hash_str_find_ptr

5 years agoFix #78579: mb_decode_numericentity: args number inconsistency
Christoph M. Becker [Sat, 21 Sep 2019 13:56:06 +0000 (15:56 +0200)]
Fix #78579: mb_decode_numericentity: args number inconsistency

mb_decode_numericentity() accepts a fourth optional parameter, which is
unused, however.  Since this parameter doesn't do any harm, and to avoid
the small BC break, we're keeping this parameter for PHP 7, but adjust
the arginfo.

For PHP 8, we will remove this parameter.

5 years agoFix out-of-bounds read in exif tag reading
Nikita Popov [Thu, 19 Sep 2019 19:11:57 +0000 (21:11 +0200)]
Fix out-of-bounds read in exif tag reading

This issue was recently introduced in c739023a50876e2a90588f915803b0140a95638e,
when the restriction that components>0 has been relaxed. We now need
to make sure that any tags that expect at least one component check
that this is the case.

5 years agoFix iterable return type optimization
Nikita Popov [Thu, 19 Sep 2019 15:20:10 +0000 (17:20 +0200)]
Fix iterable return type optimization

5 years agoFix exif leak on duplicate copyright tags
Nikita Popov [Thu, 19 Sep 2019 12:16:36 +0000 (14:16 +0200)]
Fix exif leak on duplicate copyright tags

5 years agoFix typo
CJDennis [Wed, 18 Sep 2019 10:03:24 +0000 (20:03 +1000)]
Fix typo

`sizeof("data")-1` and `sizeof("date")-1` are both 4, so no change in behaviour

5 years agoIncrease timeout in test
Nikita Popov [Tue, 17 Sep 2019 15:33:46 +0000 (17:33 +0200)]
Increase timeout in test

5 years agoFix #76342: file_get_contents waits twice specified timeout
fancyweb [Mon, 29 Jul 2019 22:33:13 +0000 (00:33 +0200)]
Fix #76342: file_get_contents waits twice specified timeout

5 years agoAdd tilde to allowed status/ping path
Drakano [Thu, 12 Sep 2019 08:18:30 +0000 (10:18 +0200)]
Add tilde to allowed status/ping path

Because of user specific webdirs it should be possible to set a
status/ping path like "/~username/status".

Closes GH-4698.

5 years agoFix opcache return type for get_headers in zend_func_info
Tyson Andre [Fri, 13 Sep 2019 18:09:15 +0000 (14:09 -0400)]
Fix opcache return type for get_headers in zend_func_info

https://www.php.net/manual/en/function.get-headers.php#refsect1-function.get-headers-examples
shows that it will return string keys when the second argument is
non-zero. I've verified that this is the case.

This bug was there since the initial commit in c88ffa9a567.

Closes GH-4702.

5 years agoFixed bug #78545
Nikita Popov [Mon, 16 Sep 2019 13:00:20 +0000 (15:00 +0200)]
Fixed bug #78545

By using an explicit (double) cast.

5 years agoFix leak in SplObjectStorage unserialization
Nikita Popov [Mon, 16 Sep 2019 11:01:59 +0000 (13:01 +0200)]
Fix leak in SplObjectStorage unserialization

The result of php_var_unserialize always needs to be destroyed,
even if the call failed.

5 years agoStick with zend_long for ABI compatibility
Christoph M. Becker [Sun, 15 Sep 2019 13:11:25 +0000 (15:11 +0200)]
Stick with zend_long for ABI compatibility

Cf. <https://github.com/php/php-src/pull/4700#issuecomment-531515689>.

5 years agoFix #78535: auto_detect_line_endings value not parsed as bool
bugreportuser [Thu, 12 Sep 2019 18:44:08 +0000 (12:44 -0600)]
Fix #78535: auto_detect_line_endings value not parsed as bool

5 years agoNEWS
Kalle Sommer Nielsen [Thu, 12 Sep 2019 03:50:53 +0000 (06:50 +0300)]
NEWS

5 years agoFixed bug #78442 ('Illegal component' on exif_read_data since PHP7)
Kalle Sommer Nielsen [Thu, 12 Sep 2019 03:21:39 +0000 (06:21 +0300)]
Fixed bug #78442 ('Illegal component' on exif_read_data since PHP7)

5 years agoBump for 7.2.24
Sara Golemon [Tue, 10 Sep 2019 17:03:27 +0000 (13:03 -0400)]
Bump for 7.2.24

5 years agoRaise minimal GCC version,
Remi Collet [Tue, 10 Sep 2019 14:28:35 +0000 (16:28 +0200)]
Raise minimal GCC version,
Test with 4.8 is OK
With 4.4: error: #pragma GCC diagnostic not allowed inside functions

5 years agoDrop regression test
Christoph M. Becker [Tue, 10 Sep 2019 08:07:39 +0000 (10:07 +0200)]
Drop regression test

The state returned by `sodium_crypto_generichash_init()` has to be
regarded as opaque byte string; neither its size nor its exact
structure are fixed, and actually vary for diffent libsodium versions.
Therefore we drop the test altogether.

5 years agoFix bug #72884 isCloneable() on SplFileObject should return false
CHU Zhaowei [Sun, 8 Sep 2019 09:29:32 +0000 (09:29 +0000)]
Fix bug #72884 isCloneable() on SplFileObject should return false

5 years agoFix #78510: Partially uninitialized buffer returned by sodium_crypto_generichash_init()
Christoph M. Becker [Mon, 9 Sep 2019 13:30:28 +0000 (15:30 +0200)]
Fix #78510: Partially uninitialized buffer returned by sodium_crypto_generichash_init()

Backport jedisct1/libsodium.php@28d13bf437cb969a0583031fc7ac54c5a8dc8116.

5 years agoFix #41997: SP call yields additional empty result set
Christoph M. Becker [Tue, 6 Aug 2019 12:30:41 +0000 (14:30 +0200)]
Fix #41997: SP call yields additional empty result set

When stored procedures are called, the "final result set is a status
result that includes no result set".  Calling `::nextRowset()` on the
actual last result set should return FALSE, since there is actually no
further result set to be processed.

5 years agoFix opcache return type for hash_update_stream
Tyson Andre [Tue, 3 Sep 2019 01:32:24 +0000 (21:32 -0400)]
Fix opcache return type for hash_update_stream

It can return false if the resource type is wrong.

```
php > var_export(hash_update_stream(hash_init('md5'),
        imagecreate(1,1)));

Warning: hash_update_stream(): supplied resource is not a valid stream
resource in php shell code on line 1
false
```

The return types were initially added in
c88ffa9a5673cb3141660626ba1921671f0b84d6

5 years agoFix #76577: outdated documentation concerning track_errors
Christoph M. Becker [Mon, 2 Sep 2019 13:05:01 +0000 (15:05 +0200)]
Fix #76577: outdated documentation concerning track_errors

5 years agoFix pkg-config version constraint for ICU
Nikita Popov [Mon, 2 Sep 2019 07:36:20 +0000 (09:36 +0200)]
Fix pkg-config version constraint for ICU

On PHP 7.2 our minimum ICU version is 4.0, not 40.

5 years agoFixed bug #78469
Sergei Turchanov [Wed, 28 Aug 2019 03:05:14 +0000 (13:05 +1000)]
Fixed bug #78469

fcgi_accept_request function is supposed to call a FastCGI implementation's
on_accept hook when entering an "accepting" stage (that is right before
calling "accept"). This hook implementation (fpm_request_accepting) updates
a worker state to an "accepting" state which is effectively an "Idle" state,
and updates counters on the scoreboard of the corresponding pool (idle++,
active--).

But this is not done when listening for client connections on a named pipe on
Windows platform. In that case a combination of
ConnectNamedPipe/WaitForSingleObject is used (to be able to catch in_shutdown
as far as I understand), but it is nonetheless functionally equivalent to
"accept" call. Also by not calling on_hook neither a worker's state is updated
to "accepting" state nor scoreboard counters are updated.

5 years agoFix use-after-free of immediately invoked closure with extra args
Nikita Popov [Thu, 29 Aug 2019 10:30:39 +0000 (12:30 +0200)]
Fix use-after-free of immediately invoked closure with extra args

5 years agoFix #78473: odbc_close() closes arbitrary resources
Christoph M. Becker [Wed, 28 Aug 2019 15:51:57 +0000 (17:51 +0200)]
Fix #78473: odbc_close() closes arbitrary resources

We have to bail out, if an invalid resource is given.  For consistency
with the other `zend_fetch_resource(2)` calls, we return `FALSE`.

5 years agoUpdate SDK version for AppVeyor
Christoph M. Becker [Tue, 27 Aug 2019 11:34:35 +0000 (13:34 +0200)]
Update SDK version for AppVeyor

5 years agoRemove properties HT from nested GC data
Nikita Popov [Mon, 26 Aug 2019 15:48:05 +0000 (17:48 +0200)]
Remove properties HT from nested GC data

The properties HT may be a GC root itself, so we need to remove it.
I'm not sure this issue actually applies to PHP 7.2, but committing
it there to be safe. As seen from the test case, the handling here
is rather buggy on 7.2.

5 years agoAlso fix signature for passthru
Tyson Andre [Sun, 25 Aug 2019 15:02:28 +0000 (11:02 -0400)]
Also fix signature for passthru

Backported from a1a8d144854acb1c891cf0c21abb0f612b1d8de7
https://www.php.net/manual/en/function.passthru.php#refsect1-function.passthru-returnvalues

`passthru()` is false with invalid args
`passthru('command')` is null.

5 years agoFix opcache optimizer info for time_nanosleep
Tyson Andre [Sun, 25 Aug 2019 14:48:52 +0000 (10:48 -0400)]
Fix opcache optimizer info for time_nanosleep

This can also return an array. See
https://www.php.net/manual/en/function.time-nanosleep.php#refsect1-function.time-nanosleep-returnvalues

> If the delay was interrupted by a signal, an associative array will be
returned with the components:
>
> - seconds - number of seconds remaining in the delay
> - nanoseconds - number of nanoseconds remaining in the delay

Sending a SIGUSR1 to the below program would trigger this behavior.

```
pcntl_signal(\SIGUSR1, function ($signo, $signinfo) {
    echo "Handling a signal $signo\n";
});
echo "Sleeping for 100 seconds\n";
var_export(time_nanosleep(100, 0));
```

The incomplete signature existed since c88ffa9a5.
No phpt tests existed for time_nanosleep returning an array

5 years agoFix overflow in memory limit checks
Nikita Popov [Mon, 26 Aug 2019 08:23:23 +0000 (10:23 +0200)]
Fix overflow in memory limit checks

Due to overflows in the memory limit checks, we were missing cases
where the allocation size was close to the address space size, and
caused an OOM condition rather than a memory limit error.

5 years agoMerge branch 'PHP-7.1' into PHP-7.2
Stanislav Malyshev [Mon, 26 Aug 2019 02:20:59 +0000 (19:20 -0700)]
Merge branch 'PHP-7.1' into PHP-7.2

* PHP-7.1:
  Fix #75457: heap-use-after-free in php7.0.25

5 years agoFix #75457: heap-use-after-free in php7.0.25
Christoph M. Becker [Fri, 16 Aug 2019 12:29:19 +0000 (14:29 +0200)]
Fix #75457: heap-use-after-free in php7.0.25

Backport <https://vcs.pcre.org/pcre?view=revision&revision=1638>.

5 years agoMerge branch 'PHP-7.1' into PHP-7.2
Stanislav Malyshev [Sun, 25 Aug 2019 06:15:36 +0000 (23:15 -0700)]
Merge branch 'PHP-7.1' into PHP-7.2

* PHP-7.1:
  Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe()
  set version for release

5 years agoFix CVE-2019-13224: don't allow different encodings for onig_new_deluxe()
Stanislav Malyshev [Sun, 25 Aug 2019 06:11:45 +0000 (23:11 -0700)]
Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe()

Backport from https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55

5 years agoSuppress deprecation warning on IDNA2003 ICU methods for clang
Christoph M. Becker [Fri, 23 Aug 2019 09:14:18 +0000 (11:14 +0200)]
Suppress deprecation warning on IDNA2003 ICU methods for clang

5 years agofix the problem for connect_attr, set db condition, and add a new attribute _server_host
Qianqian Bu [Mon, 12 Aug 2019 02:00:31 +0000 (04:00 +0200)]
fix the problem for connect_attr, set db condition, and add a new attribute _server_host

5 years agoFix #78220: Can't access OneDrive folder
Christoph M. Becker [Mon, 19 Aug 2019 17:44:37 +0000 (19:44 +0200)]
Fix #78220: Can't access OneDrive folder

As of Windows 1903, when the OneDrive on-demand feature is enabled, the
OneDrive folder is reported as reparse point by `FindFirstFile()`, but
trying to get information about the reparse point using
`DeviceIoControl()` fails with `ERROR_NOT_A_REPARSE_POINT`.  We work
around this problem by falling back to `GetFileInformationByHandle()`
if that happens, but only if the reparse point is reported as cloud
reparse point, and only if PHP is running on Windows 1903 or later.

The patch has been developed in collaboration with ab@php.net.

We should keep an eye on the somewhat quirky OneDrive behavior, since
it might change again in a future Windows release.

5 years agoSuppress deprecation warning on IDNA2003 ICU methods
Sara Golemon [Fri, 16 Aug 2019 16:40:20 +0000 (12:40 -0400)]
Suppress deprecation warning on IDNA2003 ICU methods

5 years agoFixed bug #78412
Nikita Popov [Wed, 14 Aug 2019 15:48:57 +0000 (17:48 +0200)]
Fixed bug #78412

$this should only be included in the generator GC buffer, if it
will be released on destruction.

5 years agoBump for 7.2.23
Sara Golemon [Tue, 13 Aug 2019 23:32:12 +0000 (19:32 -0400)]
Bump for 7.2.23

5 years agoFixed bug #77191
Nikita Popov [Tue, 13 Aug 2019 09:19:58 +0000 (11:19 +0200)]
Fixed bug #77191

5 years agoDon't destroy properties array with unset GC type
Nikita Popov [Tue, 13 Aug 2019 07:51:29 +0000 (09:51 +0200)]
Don't destroy properties array with unset GC type

As the properties array can also be a GC root, it might have
already been destroyed.

5 years agoIntern alias old_name early
Nikita Popov [Mon, 12 Aug 2019 14:58:52 +0000 (16:58 +0200)]
Intern alias old_name early

This is likely going to end up interned lateron at some point
when the new_name is referenced somewhere. However, it may be
that there are some uses that do not get interned before that.
In this case we will intern a string that already have zval
users, without updating the refcounted flag on those zvals.

In particular this can happen with something like [Foo::class],
where Foo is an imported symbol. The string it resolves to won't
get interned right away, but may be interned later.

    use Foo as Bar;
    $x = [Bar::class];
    var_dump(Bar::X);
    debug_zval_dump($x); // Will show negative refcount
    class Foo {
        const X = 1;
    }

However, this doesn't really fix the root cause, there are probably
other situations where something similar can occur.

5 years agoFixed handling of references in nested data of objects with destructor
Dmitry Stogov [Fri, 9 Aug 2019 14:43:50 +0000 (17:43 +0300)]
Fixed handling of references in nested data of objects with destructor

5 years agoFixed second part of the bug #78379 (Cast to object confuses GC, causes crash)
Dmitry Stogov [Fri, 9 Aug 2019 12:42:39 +0000 (15:42 +0300)]
Fixed second part of the bug #78379 (Cast to object confuses GC, causes crash)

5 years agoAdded asserts to catch GC errors when refcount goes below zero.
Dmitry Stogov [Fri, 9 Aug 2019 10:37:23 +0000 (13:37 +0300)]
Added asserts to catch GC errors when refcount goes below zero.

5 years agoSkip test when SIGKILL is not defined
Matteo Beccati [Fri, 9 Aug 2019 08:32:15 +0000 (10:32 +0200)]
Skip test when SIGKILL is not defined

5 years agoFixed bug #78379 (Cast to object confuses GC, causes crash)
Dmitry Stogov [Thu, 8 Aug 2019 07:00:39 +0000 (10:00 +0300)]
Fixed bug #78379 (Cast to object confuses GC, causes crash)

5 years agoFix #78282: atime and mtime mismatch
Christoph M. Becker [Sat, 13 Jul 2019 07:40:50 +0000 (09:40 +0200)]
Fix #78282: atime and mtime mismatch

The fix for bug #78241 assumed that `time_t` would always be 64bit, but
actually is 32bit for x86.  We therefore enforce 64bit arithmetic to
avoid wrapping.

(cherry picked from commit bf242d58e77d50d4d8fdaaaca7ede686ec4467c0)

5 years agoFix #78179: MariaDB server version incorrectly detected
Christoph M. Becker [Fri, 2 Aug 2019 14:42:49 +0000 (16:42 +0200)]
Fix #78179: MariaDB server version incorrectly detected

As of MariaDB 10.0.2, the server reports a fake version number as work-
around for replication issues[1].  We apply the same "fix" as in the
MariaDB client to cater to this.

[1] <https://github.com/MariaDB/server/commit/c50ee6c23dbeb090963580754bec2f0a96ac0557#diff-5b45fa673c88c06a9651c7906364f592>

5 years agoFixed bug #78363
Nikita Popov [Fri, 2 Aug 2019 08:35:24 +0000 (10:35 +0200)]
Fixed bug #78363

5 years agoset version for release php-7.1.31
Joe Watkins [Wed, 31 Jul 2019 06:21:39 +0000 (08:21 +0200)]
set version for release

5 years agoadd security NEW entries + reorder [ci skip]
Remi Collet [Tue, 30 Jul 2019 07:26:50 +0000 (09:26 +0200)]
add security NEW entries + reorder [ci skip]

5 years agoMerge branch 'PHP-7.1' into PHP-7.2
Stanislav Malyshev [Mon, 29 Jul 2019 20:19:16 +0000 (13:19 -0700)]
Merge branch 'PHP-7.1' into PHP-7.2

* PHP-7.1:
  Fix #77919: Potential UAF in Phar RSHUTDOWN
  Update NEWS
  Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)

5 years agoFix #77919: Potential UAF in Phar RSHUTDOWN
Christoph M. Becker [Mon, 29 Jul 2019 14:08:03 +0000 (16:08 +0200)]
Fix #77919: Potential UAF in Phar RSHUTDOWN

We have to properly clean up in case phar_flush() is failing.

We also make the expectation of the respective test case less liberal
to avoid missing such bugs in the future.

5 years agoUpdate NEWS
Stanislav Malyshev [Mon, 29 Jul 2019 07:55:18 +0000 (00:55 -0700)]
Update NEWS

5 years agoFix bug #78326
Albert Casademont [Tue, 23 Jul 2019 12:03:06 +0000 (14:03 +0200)]
Fix bug #78326

Similar to what fread() does, truncate the stream_get_contents()
result if the original buffer was way too large.

5 years agoFix Zend signals unblocking
Nikita Popov [Tue, 23 Jul 2019 08:38:23 +0000 (10:38 +0200)]
Fix Zend signals unblocking

There are a few parts here:
 * opcache should not be blocking signals while invoking compile_file,
   otherwise signals may remain blocked on a compile error. While at
   it, also protect SHM memory during compile_file.
 * We should deactivate Zend signals at the end of the request, to make
   sure that we gracefully recover from a missing unblock and signals
   don't remain blocked forever.
 * We don't use a critical section in deactivation, because it should
   not be necessary. Additionally we want to clean up the signal queue,
   if it is non-empty.
 * Enable SIGG(check) in debug builds so we notice issues in the future.

5 years agoFixed bug #78333
Nikita Popov [Mon, 29 Jul 2019 09:23:26 +0000 (11:23 +0200)]
Fixed bug #78333

Don't dereference float/double values at unknown address, instead
memcpy it into an aligned stack slot and dereference that.

5 years agoFix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
Stanislav Malyshev [Mon, 8 Jul 2019 00:39:59 +0000 (17:39 -0700)]
Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)

5 years agoFix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
Stanislav Malyshev [Mon, 8 Jul 2019 00:01:01 +0000 (17:01 -0700)]
Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)

5 years agoFix #78342: Bus error in configure test for iconv //IGNORE
Christoph M. Becker [Mon, 29 Jul 2019 06:48:13 +0000 (08:48 +0200)]
Fix #78342: Bus error in configure test for iconv //IGNORE

We have to check the return value of iconv_open() for error, to avoid
that and potentially other undesired behavior of iconv().

5 years agoRemove .post files only for passing tests
Levi Morrison [Thu, 25 Jul 2019 15:48:29 +0000 (09:48 -0600)]
Remove .post files only for passing tests

This allows the sh script for failing tests with --POST-- to work