]> granicus.if.org Git - php/log
php
4 years agoFix typos in comments in mb_send_mail
Alex Dowad [Mon, 29 Jun 2020 13:10:25 +0000 (15:10 +0200)]
Fix typos in comments in mb_send_mail

4 years agoRemove unused functions from mbstring
Alex Dowad [Sat, 27 Jun 2020 21:39:43 +0000 (23:39 +0200)]
Remove unused functions from mbstring

- mbfl_buffer_converter_reset
- mbfl_buffer_converter_strncat
- mbfl_buffer_converter_getbuffer
- mbfl_oddlen
- mbfl_filter_output_pipe_flush
- mbfl_memory_device_output2
- mbfl_memory_device_output4
- mbfl_is_support_encoding
- mbfl_buffer_converter_feed2
- _php_mb_regex_globals_dtor
- mime_header_encoder_feed
- mime_header_decoder_feed
- mbfl_convert_filter_feed

4 years agoSeparate implementation of mb_{en,de}code_numericentity
Alex Dowad [Fri, 3 Jul 2020 19:52:27 +0000 (21:52 +0200)]
Separate implementation of mb_{en,de}code_numericentity

Rather than using a magic boolean parameter to choose different behavior of
the subfunction, inline it. The code size doesn't really grow anyways. And
soon these will be trimmed down more.

4 years agoUse new-style argument parsing macros in mbstring.c
Alex Dowad [Fri, 26 Jun 2020 18:34:38 +0000 (20:34 +0200)]
Use new-style argument parsing macros in mbstring.c

4 years agoInline unneeded indirection for mbstring memory management
Alex Dowad [Sat, 27 Jun 2020 15:00:17 +0000 (17:00 +0200)]
Inline unneeded indirection for mbstring memory management

All memory allocation and deallocation for mbstring bounces through a table of
function pointers before going to emalloc/efree/etc. But this is unnecessary.
The allocators are never swapped out. Better to just call them directly.

4 years agoAdditional tests for mbstring extension
Alex Dowad [Wed, 15 Jul 2020 19:41:50 +0000 (21:41 +0200)]
Additional tests for mbstring extension

4 years agoPrevent com::__construct() to modify the $server_name array
Christoph M. Becker [Wed, 26 Aug 2020 13:12:16 +0000 (15:12 +0200)]
Prevent com::__construct() to modify the $server_name array

We switch to `zend_string`s for simplicity, so there's no need to
`convert_to_string()` anymore, what makes the array separation
superfluous.

Closes GH-6040

4 years agoMerge branch 'PHP-7.4'
Nikita Popov [Mon, 31 Aug 2020 15:06:08 +0000 (17:06 +0200)]
Merge branch 'PHP-7.4'

* PHP-7.4:
  Fix leak on assign concat of array and empty string

4 years agoMerge branch 'PHP-7.3' into PHP-7.4
Nikita Popov [Mon, 31 Aug 2020 15:05:44 +0000 (17:05 +0200)]
Merge branch 'PHP-7.3' into PHP-7.4

* PHP-7.3:
  Fix leak on assign concat of array and empty string

4 years agoFix leak on assign concat of array and empty string
Nikita Popov [Mon, 31 Aug 2020 15:03:27 +0000 (17:03 +0200)]
Fix leak on assign concat of array and empty string

4 years agoFix nullsafe operator with delayed oplines
Nikita Popov [Mon, 31 Aug 2020 13:31:18 +0000 (15:31 +0200)]
Fix nullsafe operator with delayed oplines

Closes GH-6056.

4 years agoAdd tests for nullsafe operator on delayed oplines
Ilija Tovilo [Sat, 15 Aug 2020 15:43:34 +0000 (17:43 +0200)]
Add tests for nullsafe operator on delayed oplines

4 years agoMore agressive "packed array" guards insertion
Dmitry Stogov [Mon, 31 Aug 2020 13:34:56 +0000 (16:34 +0300)]
More agressive "packed array" guards insertion

4 years agoMerge branch 'PHP-7.4'
Nikita Popov [Mon, 31 Aug 2020 13:10:34 +0000 (15:10 +0200)]
Merge branch 'PHP-7.4'

* PHP-7.4:
  Fix leak on consteval exception in ReflectionClass::__toString()

4 years agoFix leak on consteval exception in ReflectionClass::__toString()
Nikita Popov [Mon, 31 Aug 2020 13:10:09 +0000 (15:10 +0200)]
Fix leak on consteval exception in ReflectionClass::__toString()

4 years agoMerge branch 'PHP-7.4'
Nikita Popov [Mon, 31 Aug 2020 12:50:31 +0000 (14:50 +0200)]
Merge branch 'PHP-7.4'

* PHP-7.4:
  Check update constant failure in ReflectionClassConstant::__toString()

4 years agoCheck update constant failure in ReflectionClassConstant::__toString()
Nikita Popov [Mon, 31 Aug 2020 12:49:16 +0000 (14:49 +0200)]
Check update constant failure in ReflectionClassConstant::__toString()

4 years agoFix build warnings after timelib update
Nikita Popov [Mon, 31 Aug 2020 12:27:09 +0000 (14:27 +0200)]
Fix build warnings after timelib update

4 years agoPerform type guard checks before IS_UNDEF checks (check IS_UNDEF during deoptimization)
Dmitry Stogov [Mon, 31 Aug 2020 12:25:23 +0000 (15:25 +0300)]
Perform type guard checks before IS_UNDEF checks (check IS_UNDEF during deoptimization)

4 years agoFix fetching default value of internal function with userland arginfo
Nikita Popov [Mon, 31 Aug 2020 12:02:35 +0000 (14:02 +0200)]
Fix fetching default value of internal function with userland arginfo

"Fix" in the sense of "not crash". We aren't able to actually
display the default value for this case, as there's no way to
fetch the relevant information right now.

4 years agoMerge branch 'PHP-7.4' into master
Derick Rethans [Mon, 31 Aug 2020 11:33:44 +0000 (12:33 +0100)]
Merge branch 'PHP-7.4' into master

4 years agoMerge branch 'PHP-7.3' into PHP-7.4
Derick Rethans [Mon, 31 Aug 2020 11:31:44 +0000 (12:31 +0100)]
Merge branch 'PHP-7.3' into PHP-7.4

4 years agoFixed test case
Derick Rethans [Mon, 31 Aug 2020 11:31:23 +0000 (12:31 +0100)]
Fixed test case

4 years agoUpdate timelib to 2020.02
Derick Rethans [Mon, 31 Aug 2020 11:23:54 +0000 (12:23 +0100)]
Update timelib to 2020.02

4 years agoMerge branch 'master' of git.php.net:php-src into master
Derick Rethans [Mon, 31 Aug 2020 11:03:21 +0000 (12:03 +0100)]
Merge branch 'master' of git.php.net:php-src into master

4 years agoUpdate timelib to 2020.01
Derick Rethans [Mon, 31 Aug 2020 11:03:08 +0000 (12:03 +0100)]
Update timelib to 2020.01

4 years agoPromote warnings to exceptions in ext/ftp
Máté Kocsis [Sun, 30 Aug 2020 21:53:00 +0000 (23:53 +0200)]
Promote warnings to exceptions in ext/ftp

Closes GH-6054

4 years agoMerge branch 'PHP-7.4' into master
Derick Rethans [Mon, 31 Aug 2020 10:42:20 +0000 (11:42 +0100)]
Merge branch 'PHP-7.4' into master

4 years agoMerge branch 'PHP-7.3' into PHP-7.4
Derick Rethans [Mon, 31 Aug 2020 10:41:57 +0000 (11:41 +0100)]
Merge branch 'PHP-7.3' into PHP-7.4

4 years agoUpdate timelib to 2018.04
Derick Rethans [Mon, 31 Aug 2020 10:41:41 +0000 (11:41 +0100)]
Update timelib to 2018.04

4 years agoFixed bug #80030
Nikita Popov [Mon, 31 Aug 2020 10:38:11 +0000 (12:38 +0200)]
Fixed bug #80030

4 years agoMerge branch 'PHP-7.4'
Nikita Popov [Mon, 31 Aug 2020 10:19:00 +0000 (12:19 +0200)]
Merge branch 'PHP-7.4'

* PHP-7.4:
  Fix bug #80037

4 years agoFix bug #80037
Nikita Popov [Mon, 31 Aug 2020 10:17:00 +0000 (12:17 +0200)]
Fix bug #80037

If we're accessing an uninitialized typed property and __get is
defined, don't perform a read_property callback, as __get is
supposed to have no effect on uninitialized typed properties.
Usually it doesn't, but by-reference assignments cannot be
performed through read_property.

I'm deleting the test for bug #80039 again, as it doesn't really
make sense anymore with this fix.

4 years agoMerge branch 'PHP-7.4'
Nikita Popov [Mon, 31 Aug 2020 09:22:51 +0000 (11:22 +0200)]
Merge branch 'PHP-7.4'

* PHP-7.4:
  Add test for bug #80039

4 years agoAdd test for bug #80039
Nikita Popov [Mon, 31 Aug 2020 09:22:16 +0000 (11:22 +0200)]
Add test for bug #80039

This has already been fixed by 247105ae1ae2a04608078f7fcfe88dacab9f55a4,
but let's add the additional test case.

4 years agoMerge branch 'PHP-7.4'
Matteo Beccati [Mon, 31 Aug 2020 09:09:36 +0000 (11:09 +0200)]
Merge branch 'PHP-7.4'

* PHP-7.4:
  Fix #80027 Terrible performance using $query->fetch on queries with many bind parameters

4 years agoMerge branch 'PHP-7.3' into PHP-7.4
Matteo Beccati [Mon, 31 Aug 2020 09:08:26 +0000 (11:08 +0200)]
Merge branch 'PHP-7.3' into PHP-7.4

* PHP-7.3:
  Fix #80027 Terrible performance using $query->fetch on queries with many bind parameters

4 years agoFix #80027 Terrible performance using $query->fetch on queries with many bind parameters
Matteo Beccati [Mon, 31 Aug 2020 08:45:36 +0000 (10:45 +0200)]
Fix #80027 Terrible performance using $query->fetch on queries with many bind parameters

Added new flags that allow skipping param_evt(s) that are not used by drivers,
in a backwards and forward compatible manner. Updated the pgsql, mysql, sqlite
and oci drivers to properly use the new flags. I've left out pdo_dblib, which
doesn't have a param_hook, and pdo_firebird, which seems to be using
PARAM_EVT_NORMALIZE in a wrong context (param type vs event type).

4 years agoFix #80027 Terrible performance using $query->fetch on queries with many bind parameters
Matteo Beccati [Mon, 31 Aug 2020 08:45:36 +0000 (10:45 +0200)]
Fix #80027 Terrible performance using $query->fetch on queries with many bind parameters

Added new flags that allow skipping param_evt(s) that are not used by drivers,
in a backwards and forward compatible manner. Updated the pgsql, mysql, sqlite
and oci drivers to properly use the new flags. I've left out pdo_dblib, which
doesn't have a param_hook, and pdo_firebird, which seems to be using
PARAM_EVT_NORMALIZE in a wrong context (param type vs event type).

4 years agoMerge branch 'PHP-7.4'
Nikita Popov [Mon, 31 Aug 2020 08:52:07 +0000 (10:52 +0200)]
Merge branch 'PHP-7.4'

* PHP-7.4:
  Fix handling of exception if valid() during yield from

4 years agoMerge branch 'PHP-7.3' into PHP-7.4
Nikita Popov [Mon, 31 Aug 2020 08:51:49 +0000 (10:51 +0200)]
Merge branch 'PHP-7.3' into PHP-7.4

* PHP-7.3:
  Fix handling of exception if valid() during yield from

4 years agoFix handling of exception if valid() during yield from
Nikita Popov [Mon, 31 Aug 2020 08:51:00 +0000 (10:51 +0200)]
Fix handling of exception if valid() during yield from

Fixes oss-fuzz #25296.

4 years agoCorrectly report failure in zend_handle_undef_args()
Nikita Popov [Mon, 31 Aug 2020 08:37:19 +0000 (10:37 +0200)]
Correctly report failure in zend_handle_undef_args()

And do the check before increfing the closure object, otherwise
we'd have to release it as well.

Fixes oss-fuzz #25313.

4 years agoFix trampoline leak in array_map
Nikita Popov [Mon, 31 Aug 2020 08:14:39 +0000 (10:14 +0200)]
Fix trampoline leak in array_map

4 years agoFix bug #80018: Tolerate var_dump() printing floats in exponential notation in tests
Jamie Liu [Tue, 25 Aug 2020 20:39:43 +0000 (13:39 -0700)]
Fix bug #80018: Tolerate var_dump() printing floats in exponential notation in tests

4 years agoMerge branch 'PHP-7.4'
Nikita Popov [Mon, 31 Aug 2020 07:36:48 +0000 (09:36 +0200)]
Merge branch 'PHP-7.4'

* PHP-7.4:
  Make MAX_IFD_NESTING_LEVEL an actual nesting level

4 years agoMerge branch 'PHP-7.3' into PHP-7.4
Nikita Popov [Mon, 31 Aug 2020 07:32:40 +0000 (09:32 +0200)]
Merge branch 'PHP-7.3' into PHP-7.4

* PHP-7.3:
  Make MAX_IFD_NESTING_LEVEL an actual nesting level

4 years agoMake MAX_IFD_NESTING_LEVEL an actual nesting level
Nikita Popov [Wed, 12 Aug 2020 08:09:37 +0000 (10:09 +0200)]
Make MAX_IFD_NESTING_LEVEL an actual nesting level

Currently we only ever increment ifd_nesting_level, so this ends up
being a limit on the total number of IFD tags and we regularly get
bug reports of it being exceeded. I think the intention behind this
limit was to prevent recursion stack overflow, and for that we only
need to check actual recursive usage. I've implemented that here,
and dropped the nesting limit down to a smaller value
(which still passes our tests).

However, it seems that we do also need to have a total limit on
the number of tags, as we don't catch some instances of infinite
looping otherwise. Add this as a separate limit with a higher
value, that should hopefully be sufficient.

This is expected to fix a number of bugs:

https://bugs.php.net/bug.php?id=78083
https://bugs.php.net/bug.php?id=78701
https://bugs.php.net/bug.php?id=79907
https://bugs.php.net/bug.php?id=80016

4 years agoMerge branch 'PHP-7.4'
twosee [Tue, 25 Aug 2020 11:54:13 +0000 (19:54 +0800)]
Merge branch 'PHP-7.4'

* PHP-7.4:
  Improve error_handing replacement functions

# Conflicts:
# Zend/zend_API.c

4 years agoMerge branch 'PHP-7.3' into PHP-7.4
twosee [Sun, 30 Aug 2020 08:25:12 +0000 (16:25 +0800)]
Merge branch 'PHP-7.3' into PHP-7.4

* PHP-7.3:
  Improve error_handing replacement functions

4 years agoImprove error_handing replacement functions
twosee [Thu, 27 Aug 2020 16:54:46 +0000 (00:54 +0800)]
Improve error_handing replacement functions

We explicitly skip calls to user_error_handler in EH_THROW mode

Closes GH-6050.

4 years agolibmagic: Update patch [ci skip]
Anatol Belski [Sat, 29 Aug 2020 19:26:44 +0000 (21:26 +0200)]
libmagic: Update patch [ci skip]

Signed-off-by: Anatol Belski <ab@php.net>
4 years agoEXTENSIONS: Update fileinfo maintainership info [ci skip]
Anatol Belski [Sat, 29 Aug 2020 19:05:10 +0000 (21:05 +0200)]
EXTENSIONS: Update fileinfo maintainership info [ci skip]

Signed-off-by: Anatol Belski <ab@php.net>
4 years agoNEWS: Add libmagic note [ci skip]
Anatol Belski [Sat, 29 Aug 2020 19:03:30 +0000 (21:03 +0200)]
NEWS: Add libmagic note [ci skip]

Signed-off-by: Anatol Belski <ab@php.net>
4 years agolibmagic: Fix VS compat
Anatol Belski [Sat, 29 Aug 2020 17:58:26 +0000 (19:58 +0200)]
libmagic: Fix VS compat

4 years agolibmagic: Remove unneeded includes
Anatol Belski [Sat, 29 Aug 2020 17:40:41 +0000 (19:40 +0200)]
libmagic: Remove unneeded includes

Signed-off-by: Anatol Belski <ab@php.net>
4 years agofileinfo: Followup fixes
Anatol Belski [Sun, 5 Jul 2020 17:48:24 +0000 (19:48 +0200)]
fileinfo: Followup fixes

Signed-off-by: Anatol Belski <ab@php.net>
4 years agofileinfo: Upgrade to libmagic 5.39
Anatol Belski [Sat, 4 Jul 2020 15:28:32 +0000 (17:28 +0200)]
fileinfo: Upgrade to libmagic 5.39

Signed-off-by: Anatol Belski <ab@php.net>
4 years agoSupport cli_server.color on Windows
Christoph M. Becker [Sun, 16 Aug 2020 15:24:13 +0000 (17:24 +0200)]
Support cli_server.color on Windows

On Windows, we have to check whether stdout is attached to a console,
and whether that console supports VT100 control codes.

Closes GH-5996

4 years agoFix call to type error functions from jit
Nikita Popov [Fri, 28 Aug 2020 15:37:00 +0000 (17:37 +0200)]
Fix call to type error functions from jit

Missed to adjust those calls.

4 years agoAvoid ubsan warning with dummy cache slot addr
Nikita Popov [Fri, 28 Aug 2020 15:24:21 +0000 (17:24 +0200)]
Avoid ubsan warning with dummy cache slot addr

4 years agoFix unused variable warning
Nikita Popov [Fri, 28 Aug 2020 15:19:32 +0000 (17:19 +0200)]
Fix unused variable warning

4 years agoRemove unnecessary cache_slot arguments
Nikita Popov [Fri, 28 Aug 2020 15:15:09 +0000 (17:15 +0200)]
Remove unnecessary cache_slot arguments

zend_verify_type_error_common() no longer needs the cache_slot,
so drop it there and from all users.

4 years agoFix execute fuzzer on i386
Nikita Popov [Fri, 28 Aug 2020 15:03:54 +0000 (17:03 +0200)]
Fix execute fuzzer on i386

Opcode handlers use the FASTCALL calling convention...

4 years agoRehash function table after disabling functions
Nikita Popov [Fri, 28 Aug 2020 14:43:22 +0000 (16:43 +0200)]
Rehash function table after disabling functions

To perform fast shutdown without full table cleanup we need all
internal functions to be in one continuous chunk. This was
violated when functions were deleted via disable_functions.

This drops the zend_disable_function() API in favor of
zend_disable_functions(), which disables the given list of
functions and performs the necessary rehash afterwards.

Also drop PG(disabled_functions), which is no longer used.

4 years agoDon't mark variadic functions as ZEND_FASTCALL
Nikita Popov [Fri, 28 Aug 2020 10:05:41 +0000 (12:05 +0200)]
Don't mark variadic functions as ZEND_FASTCALL

Variadic functions do not support the fastcall calling convention.

4 years agoImprove type declarations for Zend APIs
George Peter Banyard [Fri, 28 Aug 2020 13:41:27 +0000 (15:41 +0200)]
Improve type declarations for Zend APIs

Voidification of Zend API which always succeeded
Use bool argument types instead of int for boolean arguments
Use bool return type for functions which return true/false (1/0)
Use zend_result return type for functions which return SUCCESS/FAILURE as they don't follow normal boolean semantics

Closes GH-6002

4 years agoDon't load IP when entering inlined function
Dmitry Stogov [Fri, 28 Aug 2020 10:27:35 +0000 (13:27 +0300)]
Don't load IP when entering inlined function

4 years agoFix tracked_realloc
Nikita Popov [Fri, 28 Aug 2020 09:37:42 +0000 (11:37 +0200)]
Fix tracked_realloc

We should only drop the information about the old allocation after
checking the memory limit. This makes the code a bit more awkward...

4 years agoPromote incomplete class to modification to Error
Nikita Popov [Fri, 28 Aug 2020 09:14:43 +0000 (11:14 +0200)]
Promote incomplete class to modification to Error

In line with engine diagnostic promotions, property writes throw
an Error exception, while reads throw a warning.

4 years agoPromote ArrayObject modification during sorting to Error exception
Nikita Popov [Fri, 28 Aug 2020 08:42:14 +0000 (10:42 +0200)]
Promote ArrayObject modification during sorting to Error exception

4 years agoThrow Error instead of E_ERROR when calling method on incomplete class
Nikita Popov [Fri, 28 Aug 2020 08:34:21 +0000 (10:34 +0200)]
Throw Error instead of E_ERROR when calling method on incomplete class

There's no reason for this to abort execution completely.

4 years agoRemove unused BG(str_ebuf) global
Nikita Popov [Fri, 28 Aug 2020 08:12:28 +0000 (10:12 +0200)]
Remove unused BG(str_ebuf) global

Also change BG(strtok_len) to size_t. This stores a string length,
so it should be size_t rather than zend_ulong.

4 years agoExport and reuse zend_is_valid_class_name API
Nikita Popov [Fri, 28 Aug 2020 08:06:01 +0000 (10:06 +0200)]
Export and reuse zend_is_valid_class_name API

Unserialization does the same check as zend_lookup_class, so let's
share the same optimized implementation.

4 years agoUse zend_string when storing incomplete class name
Nikita Popov [Fri, 28 Aug 2020 08:01:46 +0000 (10:01 +0200)]
Use zend_string when storing incomplete class name

No need to copy the string here...

4 years agoStore incomplete_class entry as normal global
Nikita Popov [Fri, 28 Aug 2020 07:57:11 +0000 (09:57 +0200)]
Store incomplete_class entry as normal global

I don't see any reason why this needs to live in a thread-safe
global, unlikely all other class entries.

4 years agoAvoid useless IP load
Dmitry Stogov [Thu, 27 Aug 2020 21:53:09 +0000 (00:53 +0300)]
Avoid useless IP load

4 years agoRemove useless register allocations
Dmitry Stogov [Thu, 27 Aug 2020 21:02:10 +0000 (00:02 +0300)]
Remove useless register allocations

4 years agoReplace "mov %eax, %ecx; shl $1, $ecx" by "lea (%eax,%eax), %ecx"
Dmitry Stogov [Thu, 27 Aug 2020 19:59:30 +0000 (22:59 +0300)]
Replace "mov %eax, %ecx; shl $1, $ecx" by "lea (%eax,%eax), %ecx"

4 years agoFix typo
Nikita Popov [Thu, 27 Aug 2020 14:57:09 +0000 (16:57 +0200)]
Fix typo

This was supposed to include the header, not the C file...

4 years agoGenerate execute corpus in generate_all.php
Nikita Popov [Thu, 27 Aug 2020 12:42:34 +0000 (14:42 +0200)]
Generate execute corpus in generate_all.php

And add crypt() to the function blacklist, it can be very slow.

4 years agoMerge branch 'PHP-7.4'
Nikita Popov [Thu, 27 Aug 2020 14:19:15 +0000 (16:19 +0200)]
Merge branch 'PHP-7.4'

* PHP-7.4:
  Don't assert when comparing uninit DateTimeZone objects

4 years agoDon't assert when comparing uninit DateTimeZone objects
Nikita Popov [Thu, 27 Aug 2020 14:18:45 +0000 (16:18 +0200)]
Don't assert when comparing uninit DateTimeZone objects

Nothing guarantees that the objects are initialized here... just
check as usual.

4 years agoMerge branch 'PHP-7.4'
Nikita Popov [Thu, 27 Aug 2020 13:51:58 +0000 (15:51 +0200)]
Merge branch 'PHP-7.4'

* PHP-7.4:
  Require non-negative length in stream_get_contents()

4 years agoMerge branch 'PHP-7.3' into PHP-7.4
Nikita Popov [Thu, 27 Aug 2020 13:51:35 +0000 (15:51 +0200)]
Merge branch 'PHP-7.3' into PHP-7.4

* PHP-7.3:
  Require non-negative length in stream_get_contents()

4 years agoRequire non-negative length in stream_get_contents()
Nikita Popov [Thu, 27 Aug 2020 13:49:33 +0000 (15:49 +0200)]
Require non-negative length in stream_get_contents()

If the length is not -1, require it to be non-negative.

Using such lengths doesn't make sense (as only -1 is special-case
to read in chunks, anything else will end up doing a huge upfront
allocation) and can lead to string allocation overflow.

A similar check is already in place for file_get_contents(). That
one does not allow -1 (and uses null instead), but this function
is explicitly specified to accept -1, so stick to that behavior.

4 years agoUse zend_dval_to_lval() in spl_offset_convert_to_long()
Nikita Popov [Thu, 27 Aug 2020 12:52:54 +0000 (14:52 +0200)]
Use zend_dval_to_lval() in spl_offset_convert_to_long()

Avoid fptoi UB and use the standard PHP conversion behavior.

4 years agoFix leak in typed reference assignment
Nikita Popov [Thu, 27 Aug 2020 12:36:12 +0000 (14:36 +0200)]
Fix leak in typed reference assignment

We're only creating tmp here to compare against the existing
coerced_value. We need to destroy it in all cases.

4 years agoUpdate operands range information accoring to the taken branches and use this indorma...
Dmitry Stogov [Thu, 27 Aug 2020 12:29:11 +0000 (15:29 +0300)]
Update operands range information accoring to the taken branches and use this indormation to eliminate useless overflow checks.

4 years agoAdd experimental "execute" fuzzer
Nikita Popov [Wed, 9 Oct 2019 17:17:07 +0000 (19:17 +0200)]
Add experimental "execute" fuzzer

This is an end-to-end fuzzer that executes arbitrary PHP code.

We replace the executor with a finite-step executor to avoid
getting stuck in loops or recursion.

4 years agoFix leak on failed DatePeriod initialization
Nikita Popov [Thu, 27 Aug 2020 10:54:43 +0000 (12:54 +0200)]
Fix leak on failed DatePeriod initialization

We need to free not only p here, but also b and e.

4 years agoAllow removing non-existing key from WeakMap
Nikita Popov [Thu, 27 Aug 2020 10:42:08 +0000 (12:42 +0200)]
Allow removing non-existing key from WeakMap

In line with usual PHP semantics. This previously triggered an
assertion failure.

4 years agoClean up strtok implementation
Nikita Popov [Thu, 27 Aug 2020 10:24:58 +0000 (12:24 +0200)]
Clean up strtok implementation

Store the zend_string instead of performing a copy and storing
in a zval. Also make sure the string is released immediately if
it's no longer needed. Finally, avoid null pointer offset UB if
no string has been set -- though I'm wondering if this case
shouldn't be generating a warning?

4 years agoFix use-after-free is WeakMap key and value are the same
Nikita Popov [Thu, 27 Aug 2020 10:05:06 +0000 (12:05 +0200)]
Fix use-after-free is WeakMap key and value are the same

Drop the object from the WeakMap as the last step, as this might
end up destroying the object.

4 years agoEliminate ZSTR_IS_INTERNED() check
Dmitry Stogov [Thu, 27 Aug 2020 08:38:15 +0000 (11:38 +0300)]
Eliminate ZSTR_IS_INTERNED() check

4 years agoMerge branch 'PHP-7.4' into master
Christoph M. Becker [Thu, 27 Aug 2020 08:25:01 +0000 (10:25 +0200)]
Merge branch 'PHP-7.4' into master

* PHP-7.4:
  Catch potential exceptions during to string conversion

4 years agoCatch potential exceptions during to string conversion
Christoph M. Becker [Tue, 25 Aug 2020 13:40:17 +0000 (15:40 +0200)]
Catch potential exceptions during to string conversion

As of PHP 7.4.0, exceptions are allowed to be thrown from inside
`__toString()` methods; we have to cater to that, and catch these
exceptions early.

Closes GH-6042

4 years agoEnforce memory limit in tracked allocation mode
Nikita Popov [Wed, 26 Aug 2020 15:09:14 +0000 (17:09 +0200)]
Enforce memory limit in tracked allocation mode

A very basic limit (for single allocations) was already enforced.
This extends it to count the total memory allocations.

This is useful to avoid out of memory conditions while fuzzing.

4 years agoCheck interrupt only if the link is a part of the loop.
Dmitry Stogov [Thu, 27 Aug 2020 08:04:23 +0000 (11:04 +0300)]
Check interrupt only if the link is a part of the loop.

4 years agoRename zend_jit_var_may_be_modified_indirectly() into zend_jit_var_may_alias()
Dmitry Stogov [Thu, 27 Aug 2020 07:31:39 +0000 (10:31 +0300)]
Rename zend_jit_var_may_be_modified_indirectly() into zend_jit_var_may_alias()