* PHP-7.3:
Validate subject encoding in mb_split and mb_ereg_match
Validate pattern against mbregex encoding
SQLite3: add DEFENSIVE config for SQLite >= 3.26.0 as a mitigation strategy against potential security flaws
* PHP-7.2:
Validate subject encoding in mb_split and mb_ereg_match
Validate pattern against mbregex encoding
SQLite3: add DEFENSIVE config for SQLite >= 3.26.0 as a mitigation strategy against potential security flaws
* PHP-7.1:
Validate subject encoding in mb_split and mb_ereg_match
Validate pattern against mbregex encoding
SQLite3: add DEFENSIVE config for SQLite >= 3.26.0 as a mitigation strategy against potential security flaws
Nikita Popov [Mon, 11 Feb 2019 11:10:40 +0000 (12:10 +0100)]
Validate pattern against mbregex encoding
Oniguruma does not consistently perform this validation itself (at least
on older versions), so make sure we check pattern encoding validity on the
PHP side.
Nikita Popov [Wed, 27 Mar 2019 17:09:09 +0000 (18:09 +0100)]
Treat abstract ctors the same, regardless of origin
Abstract ctor signatures should always be respected by all children,
independently of whether it comes from an interface or an abstract
class. Previously abstract ctor signatures (if they didn't come from
an interface) were only checked to one level of inheritance.
Nikita Popov [Mon, 25 Mar 2019 14:46:43 +0000 (15:46 +0100)]
Make PCRE cache per-request on CLI
There will only be one request on the CLI SAPI, so there is no
advantage to having a persistent PCRE cache. Using a non-persistent
cache allows us to use arbitrary strings as cache keys.
Peter Kokot [Sat, 23 Mar 2019 18:05:37 +0000 (19:05 +0100)]
[ci skip] Join contributing and patches docs
This joins two similar contextual information together in the main
CONTRIBUTING.md file.
Additionally:
- http links updated to https where possible
- sentences and sections refactored more so they make some sence. GitHub
pull requests are preferred way for contributing code.
- reorder paragraphs and contextual info
- s/mail list/mailing list
- PHP internals refactorings
- use canonical https://www.php.net
Niklas Keller [Sun, 24 Mar 2019 18:39:25 +0000 (19:39 +0100)]
Fix #77794: Incorrect Date header format in built-in server
- Fix the date format to be compliant with https://tools.ietf.org/html/rfc7231#section-7.1.1.2
- Fix date format length and use GMT time
- Previously, local time was used instead of GMT.
- Remove extra whitespace
- Simplify string appends in php_cli_server.c
Tyson Andre [Sat, 23 Mar 2019 20:47:10 +0000 (16:47 -0400)]
Make run-tests.php compatible with php 7.0-7.2
Motivation:
As an extension author, I want to speed up running tests in php <=7.3,
both locally and in CI (e.g. with valgrind).
This can be done by manually copying php 7.4's run-tests.php script
to replace the one generated by `phpize`
- list() doesn't work in php 7.0
- negative string offset doesn't work in php 7.2
If run-tests.php can be copied from php-src without any manual patches,
that would be the easiest.
Related to #2822 - I didn't see any discussion for/against compatibility
with older php versions
Nikita Popov [Fri, 15 Mar 2019 11:36:49 +0000 (12:36 +0100)]
Switch to bison location tracking
Locations for AST nodes are now tracked with the help of bison
location tracking. This is more accurate than what we currently do
and easier to extend with more information.
A zend_ast_loc structure is introduced, which is used for the location
stack. Currently it only holds the start lineno, but can be extended
to also hold end lineno and offset/column information in the future.
All AST constructors now accept a zend_ast_loc* as first argument, and
will use it to determine their lineno. Previously this used either the
CG(zend_lineno), or the smallest AST lineno of child nodes.
On the parser side, the location structure for a whole rule can be
obtained using the &@$ character salad.
Nikita Popov [Wed, 20 Mar 2019 11:03:45 +0000 (12:03 +0100)]
Fixed bug #74345
Export zend_release_fcall_info_cache(). It is only necessary to
call it if the fcc may not have been used -- if it is passed to
zend_call_function() and friends, then they will take care of
freeing trampolines.
Peter Kokot [Mon, 18 Mar 2019 23:33:53 +0000 (00:33 +0100)]
Upgrade deprecated directives and use non-posix bison
With Bison 3.0 some directives are deprecated:
- %name-prefix "x" should be %define api.prefix {x}
- %error-verbose should be %define parse.error verbose
Bison 3.3 also started emiting more warnings and since PHP souce parsers
are not POSIX compliant this patch fixes this as pointed out via 495a46aa1dc564656bf919cb49aae48a31ae15f4.
projects / php / log