Update versions for PHP 7.2.22RC1

Update CREDITS for PHP 7.2.22RC1
Update NEWS for PHP 7.2.22RC1
2026-11-11 11:10:49 +00:00 · 2019-08-13 22:57:08 +00:00 · 2019-08-13 22:57:08 +00:00 · 2019-08-13 22:57:08 +00:00 · 2019-08-13 11:19:58 +02:00 · 2019-08-13 09:53:25 +02:00
42 changed files with 523 additions and 147 deletions
@@ -1,6 +1,50 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2019, PHP 7.2.21
+15 Aug 2019, PHP 7.2.22RC1
+
+- Core:
+  . Fixed bug #78363 (Buffer overflow in zendparse). (Nikita)
+  . Fixed bug #78379 (Cast to object confuses GC, causes crash). (Dmitry)
+
+- Curl:
+  . Fixed bug #77946 (Bad cURL resources returned by curl_multi_info_read()).
+    (Abyr Valg)
+
+- Exif:
+  . Fixed bug #78333 (Exif crash (bus error) due to wrong alignment and
+    invalid cast). (Nikita)
+
+- Iconv:
+  . Fixed bug #78342 (Bus error in configure test for iconv //IGNORE). (Rainer
+    Jung)
+
+- LiteSpeed:
+  . Updated to LiteSpeed SAPI V7.5 (Fixed clean shutdown). (George Wang)
+
+- MySQLnd:
+  . Fixed bug #78179 (MariaDB server version incorrectly detected). (cmb)
+
+- Opcache:
+  . Fixed bug #77191 (Assertion failure in dce_live_ranges() when silencing is
+    used). (Nikita)
+
+- Standard:
+  . Fixed bug #69100 (Bus error from stream_copy_to_stream (file -> SSL stream)
+    with invalid length). (Nikita)
+  . Fixed bug #78282 (atime and mtime mismatch). (cmb)
+  . Fixed bug #78326 (improper memory deallocation on stream_get_contents()
+    with fixed length buffer). (Albert Casademont)
+
+01 Aug 2019, PHP 7.2.21
+
+- Date:
+  . Fixed bug #69044 (discrepency between time and microtime). (krakjoe)
+
+- EXIF:
+  . Fixed bug #78256 (heap-buffer-overflow on exif_process_user_comment).
+    (CVE-2019-11042) (Stas)
+  . Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail).
+    (CVE-2019-11041) (Stas)

 - Fileinfo:
  . Fixed bug #78183 (finfo_file shows wrong mime-type for .tga file).
@@ -9,20 +53,6 @@ PHP                                                                        NEWS
 - FTP:
  . Fixed bug #77124 (FTP with SSL memory leak). (Nikita)

- PDO_Sqlite:
-  . Fixed bug #78192 (SegFault when reuse statement after schema has changed).
-    (Vincent Quatrevieux)
-
- SQLite:
-  . Upgraded to SQLite 3.28.0. (cmb)
-
- XMLRPC:
-  . Fixed bug #78173 (XML-RPC mutates immutable objects during encoding).
-    (Asher Baker)
-
- Date:
-  . Fixed bug #69044 (discrepency between time and microtime). (krakjoe)
-
 - Libxml:
  . Fixed bug #78279 (libxml_disable_entity_loader settings is shared between
    requests (cgi-fcgi)). (Nikita)
@@ -45,12 +75,29 @@ PHP                                                                        NEWS
  . Fixed bug #78291 (opcache_get_configuration doesn't list all directives).
    (Andrew Collington)

+- Phar:
+  . Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN). (cmb)
+
+- Phpdbg:
+  . Fixed bug #78297 (Include unexistent file memory leak). (Nikita)
+
+- PDO_Sqlite:
+  . Fixed bug #78192 (SegFault when reuse statement after schema has changed).
+    (Vincent Quatrevieux)
+
+- SQLite:
+  . Upgraded to SQLite 3.28.0. (cmb)
+
 - Standard:
  . Fixed bug #78241 (touch() does not handle dates after 2038 in PHP 64-bit).
    (cmb)
  . Fixed bug #78269 (password_hash uses weak options for argon2). (Remi)

-27 Jun 2019, PHP 7.2.20
+- XMLRPC:
+  . Fixed bug #78173 (XML-RPC mutates immutable objects during encoding).
+    (Asher Baker)
+
+04 Jul 2019, PHP 7.2.20

 - Core:
  . Fixed bug #76980 (Interface gets skipped if autoloader throws an exception).
@@ -804,7 +804,7 @@ static zend_always_inline void UnixTimeToFileTime(time_t t, LPFILETIME pft) /* {
 	// Note that LONGLONG is a 64-bit value
 	LONGLONG ll;

-	ll = t * 10000000 + 116444736000000000;
+	ll = t * 10000000LL + 116444736000000000LL;
 	pft->dwLowDateTime = (DWORD)ll;
 	pft->dwHighDateTime = ll >> 32;
 }
@@ -0,0 +1,32 @@
+--TEST--
+Bug #78379 (Cast to object confuses GC, causes crash)
+--INI--
+opcache.enable=0
+--FILE--
+<?php
+class C {
+	public function __construct() {
+		$this->p = (object)["x" => [1]];
+	}
+}
+class E {
+}
+$e = new E;
+$e->f = new E;
+$e->f->e = $e;
+$e->a = new C;
+$e = null;
+gc_collect_cycles();
+var_dump(new C);
+?>
+--EXPECTF--
+object(C)#%d (1) {
+  ["p"]=>
+  object(stdClass)#%d (1) {
+    ["x"]=>
+    array(1) {
+      [0]=>
+      int(1)
+    }
+  }
+}
@@ -0,0 +1,19 @@
+--TEST--
+Bug #78379.2 (Cast to object confuses GC, causes crash)
+--FILE--
+<?php
+class E {}
+function f() {
+	$e1 = new E;
+	$e2 = new E;
+	$a = ['e2' => $e2];
+	$e1->a = (object)$a;
+	$e2->e1 = $e1;
+	$e2->a = (object)$a;
+}
+f();
+gc_collect_cycles();
+echo "End\n";
+?>
+--EXPECT--
+End
@@ -0,0 +1,35 @@
+--TEST--
+GC 041: Handling of references in nested data of objects with destructor
+--INI--
+zend.enable_gc = 1
+--FILE--
+<?php
+class ryat {
+	    var $ryat;
+        var $chtg;
+        var $nested;
+	    function __destruct() {
+	            $GLOBALS['x'] = $this;
+        }
+}
+$o = new ryat;
+$o->nested = [];
+$o->nested[] =& $o->nested;
+$o->ryat = $o;
+$x =& $o->chtg;
+unset($o);
+gc_collect_cycles();
+var_dump($x);
+?>
+--EXPECT--
+object(ryat)#1 (3) {
+  ["ryat"]=>
+  *RECURSION*
+  ["chtg"]=>
+  *RECURSION*
+  ["nested"]=>
+  &array(1) {
+    [0]=>
+    *RECURSION*
+  }
+}
@@ -6619,6 +6619,7 @@ void zend_compile_use(zend_ast *ast) /* {{{ */
 		}

 		zend_string_addref(old_name);
+		old_name = zend_new_interned_string(old_name);
 		if (!zend_hash_add_ptr(current_import, lookup_name, old_name)) {
 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot use%s %s as %s because the name "
 				"is already in use", zend_get_use_type_str(type), ZSTR_VAL(old_name), ZSTR_VAL(new_name));
@@ -388,11 +388,14 @@ tail_call:
 			ZVAL_OBJ(&tmp, obj);
 			ht = get_gc(&tmp, &zv, &n);
 			end = zv + n;
-			if (EXPECTED(!ht)) {
+			if (EXPECTED(!ht) || UNEXPECTED(GC_REF_GET_COLOR(ht) == GC_BLACK)) {
+				ht = NULL;
 				if (!n) return;
 				while (!Z_REFCOUNTED_P(--end)) {
 					if (zv == end) return;
 				}
+			} else {
+				GC_REF_SET_BLACK(ht);
 			}
 			while (zv != end) {
 				if (Z_REFCOUNTED_P(zv)) {
@@ -498,15 +501,19 @@ tail_call:
 				ZVAL_OBJ(&tmp, obj);
 				ht = get_gc(&tmp, &zv, &n);
 				end = zv + n;
-				if (EXPECTED(!ht)) {
+				if (EXPECTED(!ht) || UNEXPECTED(GC_REF_GET_COLOR(ht) == GC_GREY)) {
+					ht = NULL;
 					if (!n) return;
 					while (!Z_REFCOUNTED_P(--end)) {
 						if (zv == end) return;
 					}
+				} else {
+					GC_REF_SET_COLOR(ht, GC_GREY);
 				}
 				while (zv != end) {
 					if (Z_REFCOUNTED_P(zv)) {
 						ref = Z_COUNTED_P(zv);
+						ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 						GC_REFCOUNT(ref)--;
 						gc_mark_grey(ref);
 					}
@@ -514,6 +521,7 @@ tail_call:
 				}
 				if (EXPECTED(!ht)) {
 					ref = Z_COUNTED_P(zv);
+					ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 					GC_REFCOUNT(ref)--;
 					goto tail_call;
 				}
@@ -530,6 +538,7 @@ tail_call:
 		} else if (GC_TYPE(ref) == IS_REFERENCE) {
 			if (Z_REFCOUNTED(((zend_reference*)ref)->val)) {
 				ref = Z_COUNTED(((zend_reference*)ref)->val);
+				ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 				GC_REFCOUNT(ref)--;
 				goto tail_call;
 			}
@@ -559,6 +568,7 @@ tail_call:
 			}
 			if (Z_REFCOUNTED_P(zv)) {
 				ref = Z_COUNTED_P(zv);
+				ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 				GC_REFCOUNT(ref)--;
 				gc_mark_grey(ref);
 			}
@@ -569,6 +579,7 @@ tail_call:
 			zv = Z_INDIRECT_P(zv);
 		}
 		ref = Z_COUNTED_P(zv);
+		ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 		GC_REFCOUNT(ref)--;
 		goto tail_call;
 	}
@@ -611,11 +622,14 @@ tail_call:
 					ZVAL_OBJ(&tmp, obj);
 					ht = get_gc(&tmp, &zv, &n);
 					end = zv + n;
-					if (EXPECTED(!ht)) {
+					if (EXPECTED(!ht) || UNEXPECTED(GC_REF_GET_COLOR(ht) != GC_GREY)) {
+						ht = NULL;
 						if (!n) return;
 						while (!Z_REFCOUNTED_P(--end)) {
 							if (zv == end) return;
 						}
+					} else {
+						GC_REF_SET_COLOR(ht, GC_WHITE);
 					}
 					while (zv != end) {
 						if (Z_REFCOUNTED_P(zv)) {
@@ -786,7 +800,8 @@ tail_call:
 				ZVAL_OBJ(&tmp, obj);
 				ht = get_gc(&tmp, &zv, &n);
 				end = zv + n;
-				if (EXPECTED(!ht)) {
+				if (EXPECTED(!ht) || UNEXPECTED(GC_REF_GET_COLOR(ht) == GC_BLACK)) {
+					ht = NULL;
 					if (!n) return count;
 					while (!Z_REFCOUNTED_P(--end)) {
 						/* count non-refcounted for compatibility ??? */
@@ -795,6 +810,8 @@ tail_call:
 						}
 						if (zv == end) return count;
 					}
+				} else {
+					GC_REF_SET_BLACK(ht);
 				}
 				while (zv != end) {
 					if (Z_REFCOUNTED_P(zv)) {
@@ -936,11 +953,9 @@ static void gc_remove_nested_data_from_buffer(zend_refcounted *ref, gc_root_buff
 	zval *zv;

 tail_call:
-	if (root ||
-	    (GC_ADDRESS(GC_INFO(ref)) != 0 &&
-	     GC_REF_GET_COLOR(ref) == GC_BLACK)) {
-		GC_TRACE_REF(ref, "removing from buffer");
+	do {
 		if (root) {
+			GC_TRACE_REF(ref, "removing from buffer");
 			if (EXPECTED(GC_ADDRESS(GC_INFO(root->ref)) < GC_ROOT_BUFFER_MAX_ENTRIES)) {
 				gc_remove_from_roots(root);
 			} else {
@@ -948,8 +963,18 @@ tail_call:
 			}
 			GC_INFO(ref) = 0;
 			root = NULL;
-		} else {
+		} else if (GC_ADDRESS(GC_INFO(ref)) != 0
+		 && GC_REF_GET_COLOR(ref) == GC_BLACK) {
+			GC_TRACE_REF(ref, "removing from buffer");
 			GC_REMOVE_FROM_BUFFER(ref);
+		} else if (GC_TYPE(ref) == IS_REFERENCE) {
+			if (Z_REFCOUNTED(((zend_reference*)ref)->val)) {
+				ref = Z_COUNTED(((zend_reference*)ref)->val);
+				goto tail_call;
+			}
+			return;
+		} else {
+			return;
 		}

 		if (GC_TYPE(ref) == IS_OBJECT) {
@@ -987,12 +1012,6 @@ tail_call:
 			}
 		} else if (GC_TYPE(ref) == IS_ARRAY) {
 			ht = (zend_array*)ref;
-		} else if (GC_TYPE(ref) == IS_REFERENCE) {
-			if (Z_REFCOUNTED(((zend_reference*)ref)->val)) {
-				ref = Z_COUNTED(((zend_reference*)ref)->val);
-				goto tail_call;
-			}
-			return;
 		} else {
 			return;
 		}
@@ -1028,7 +1047,7 @@ tail_call:
 		}
 		ref = Z_COUNTED_P(zv);
 		goto tail_call;
-	}
+	} while (0);
 }

 ZEND_API int zend_gc_collect_cycles(void)
@@ -1315,7 +1315,7 @@ static YYSIZE_T zend_yytnamerr(char *yyres, const char *yystr)

 		if (LANG_SCNG(yy_text)[0] == 0 &&
 			LANG_SCNG(yy_leng) == 1 &&
-			memcmp(yystr, "\"end of file\"", sizeof("\"end of file\"") - 1) == 0) {
+			strcmp(yystr, "\"end of file\"") == 0) {
 			if (yyres) {
 				yystpcpy(yyres, "end of file");
 			}
@@ -138,6 +138,11 @@ ZEND_API HashTable *zend_std_get_gc(zval *object, zval **table, int *n) /* {{{ *
 		if (zobj->properties) {
 			*table = NULL;
 			*n = 0;
+			if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)
+			 && EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
+				GC_REFCOUNT(zobj->properties)--;
+				zobj->properties = zend_array_dup(zobj->properties);
+			}
 			return zobj->properties;
 		} else {
 			*table = zobj->properties_table;
@@ -46,7 +46,8 @@ ZEND_API void zend_object_std_dtor(zend_object *object)

 	if (object->properties) {
 		if (EXPECTED(!(GC_FLAGS(object->properties) & IS_ARRAY_IMMUTABLE))) {
-			if (EXPECTED(--GC_REFCOUNT(object->properties) == 0)) {
+			if (EXPECTED(--GC_REFCOUNT(object->properties) == 0)
+					&& EXPECTED(GC_TYPE(object->properties) != IS_NULL)) {
 				zend_array_destroy(object->properties);
 			}
 		}
@@ -330,13 +330,13 @@ void zend_signal_activate(void)

 	SIGG(active) = 1;
 	SIGG(depth)  = 0;
+	SIGG(check)  = ZEND_DEBUG;
 } /* }}} */

 /* {{{ zend_signal_deactivate
 * */
 void zend_signal_deactivate(void)
 {
-
 	if (SIGG(check)) {
 		size_t x;
 		struct sigaction sa;
@@ -344,21 +344,32 @@ void zend_signal_deactivate(void)
 		if (SIGG(depth) != 0) {
 			zend_error(E_CORE_WARNING, "zend_signal: shutdown with non-zero blocking depth (%d)", SIGG(depth));
 		}
+
 		/* did anyone steal our installed handler */
 		for (x = 0; x < sizeof(zend_sigs) / sizeof(*zend_sigs); x++) {
 			sigaction(zend_sigs[x], NULL, &sa);
-			if (sa.sa_sigaction != zend_signal_handler_defer) {
+			if (sa.sa_sigaction != zend_signal_handler_defer &&
+					sa.sa_sigaction != (void *) SIG_IGN) {
 				zend_error(E_CORE_WARNING, "zend_signal: handler was replaced for signal (%d) after startup", zend_sigs[x]);
 			}
 		}
 	}

-	SIGNAL_BEGIN_CRITICAL();
-	SIGG(active) = 0;
+	/* After active=0 is set, signal handlers will be called directly and other
+	 * state that is reset below will not be accessed. */
+	*((volatile int *) &SIGG(active)) = 0;
+
 	SIGG(running) = 0;
 	SIGG(blocked) = 0;
 	SIGG(depth) = 0;
-	SIGNAL_END_CRITICAL();
+
+	/* If there are any queued signals because of a missed unblock, drop them. */
+	if (SIGG(phead) && SIGG(ptail)) {
+		SIGG(ptail)->next = SIGG(pavail);
+		SIGG(pavail) = SIGG(phead);
+		SIGG(phead) = NULL;
+		SIGG(ptail) = NULL;
+	}
 }
 /* }}} */

@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
-PHP_RELEASE_VERSION=21
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=22
+PHP_EXTRA_VERSION="RC1"
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -152,8 +152,6 @@ static void _php_curl_close_ex(php_curl *ch);
 static void _php_curl_close(zend_resource *rsrc);


-#define SAVE_CURL_ERROR(__handle, __err) (__handle)->err.no = (int) __err;
-
 #define CAAL(s, v) add_assoc_long_ex(return_value, s, sizeof(s) - 1, (zend_long) v);
 #define CAAD(s, v) add_assoc_double_ex(return_value, s, sizeof(s) - 1, (double) v);
 #define CAAS(s, v) add_assoc_string_ex(return_value, s, sizeof(s) - 1, (char *) (v ? v : ""));
@@ -339,6 +339,7 @@ PHP_FUNCTION(curl_multi_info_read)
 	CURLMsg	  *tmp_msg;
 	int        queued_msgs;
 	zval      *zmsgs_in_queue = NULL;
+	php_curl  *ch;

 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_RESOURCE(z_mh)
@@ -376,6 +377,10 @@ PHP_FUNCTION(curl_multi_info_read)
 			   being done in add_assoc_resource */
 			Z_ADDREF_P(pz_ch);

+			/* we must save result to be able to read error message */
+			ch = (php_curl*)zend_fetch_resource(Z_RES_P(pz_ch), le_curl_name, le_curl);
+			SAVE_CURL_ERROR(ch, tmp_msg->data.result);
+
 			/* add_assoc_resource automatically creates a new zval to
 			   wrap the "resource" represented by the current pz_ch */

@@ -60,6 +60,8 @@ extern zend_module_entry curl_module_entry;
 #define PHP_CURL_RETURN 4
 #define PHP_CURL_IGNORE 7

+#define SAVE_CURL_ERROR(__handle, __err) (__handle)->err.no = (int) __err;
+
 extern int  le_curl;
 #define le_curl_name "cURL handle"
 extern int  le_curl_multi_handle;
@@ -0,0 +1,43 @@
+--TEST--
+Bug #77946 (Errored cURL resources returned by curl_multi_info_read() must be compatible with curl_errno() and curl_error())
+--SKIPIF--
+<?php
+
+if (!extension_loaded('curl')) {
+	exit('skip curl extension not loaded');
+}
+
+?>
+--FILE--
+<?php
+$urls = array(
+   'unknown://scheme.tld',
+);
+
+$mh = curl_multi_init();
+
+foreach ($urls as $i => $url) {
+    $conn[$i] = curl_init($url);
+    curl_multi_add_handle($mh, $conn[$i]);
+}
+
+do {
+    $status = curl_multi_exec($mh, $active);
+    $info = curl_multi_info_read($mh);
+    if (false !== $info) {
+        var_dump($info['result']);
+        var_dump(curl_errno($info['handle']));
+        var_dump(curl_error($info['handle']));
+    }
+} while ($status === CURLM_CALL_MULTI_PERFORM || $active);
+
+foreach ($urls as $i => $url) {
+    curl_close($conn[$i]);
+}
+
+curl_multi_close($mh);
+?>
+--EXPECTF--
+int(1)
+int(1)
+string(%d) "Protocol %Sunknown%S not supported or disabled in libcurl"
@@ -1541,6 +1541,20 @@ static void php_ifd_set32u(char *data, size_t value, int motorola_intel)
 }
 /* }}} */

+static float php_ifd_get_float(char *data) {
+	/* Copy to avoid alignment issues */
+	float f;
+	memcpy(&f, data, sizeof(float));
+	return f;
+}
+
+static double php_ifd_get_double(char *data) {
+	/* Copy to avoid alignment issues */
+	double f;
+	memcpy(&f, data, sizeof(double));
+	return f;
+}
+
 #ifdef EXIF_DEBUG
 char * exif_dump_data(int *dump_free, int format, int components, int length, int motorola_intel, char *value_ptr) /* {{{ */
 {
@@ -1653,12 +1667,12 @@ static double exif_convert_any_format(void *value, int format, int motorola_inte
 #ifdef EXIF_DEBUG
 			php_error_docref(NULL, E_NOTICE, "Found value of type single");
 #endif
-			return (double)*(float *)value;
+			return (double) php_ifd_get_float(value);
 		case TAG_FMT_DOUBLE:
 #ifdef EXIF_DEBUG
 			php_error_docref(NULL, E_NOTICE, "Found value of type double");
 #endif
-			return *(double *)value;
+			return php_ifd_get_double(value);
 	}
 	return 0;
 }
@@ -1716,12 +1730,12 @@ static size_t exif_convert_any_to_int(void *value, int format, int motorola_inte
 #ifdef EXIF_DEBUG
 			php_error_docref(NULL, E_NOTICE, "Found value of type single");
 #endif
-			return (size_t)*(float *)value;
+			return (size_t) php_ifd_get_float(value);
 		case TAG_FMT_DOUBLE:
 #ifdef EXIF_DEBUG
 			php_error_docref(NULL, E_NOTICE, "Found value of type double");
 #endif
-			return (size_t)*(double *)value;
+			return (size_t) php_ifd_get_double(value);
 	}
 	return 0;
 }
@@ -2188,13 +2202,13 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 #ifdef EXIF_DEBUG
 						php_error_docref(NULL, E_WARNING, "Found value of type single");
 #endif
-						info_value->f = *(float *)value;
+						info_value->f = php_ifd_get_float(value);
 						break;
 					case TAG_FMT_DOUBLE:
 #ifdef EXIF_DEBUG
 						php_error_docref(NULL, E_WARNING, "Found value of type double");
 #endif
-						info_value->d = *(double *)value;
+						info_value->d = php_ifd_get_double(value);
 						break;
 				}
 			}
@@ -3040,11 +3054,11 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			/* First try to detect BOM: ZERO WIDTH NOBREAK SPACE (FEFF 16)
 			 * since we have no encoding support for the BOM yet we skip that.
 			 */
-			if (!memcmp(szValuePtr, "\xFE\xFF", 2)) {
+			if (ByteCount >=2 && !memcmp(szValuePtr, "\xFE\xFF", 2)) {
 				decode = "UCS-2BE";
 				szValuePtr = szValuePtr+2;
 				ByteCount -= 2;
-			} else if (!memcmp(szValuePtr, "\xFF\xFE", 2)) {
+			} else if (ByteCount >=2 && !memcmp(szValuePtr, "\xFF\xFE", 2)) {
 				decode = "UCS-2LE";
 				szValuePtr = szValuePtr+2;
 				ByteCount -= 2;
@@ -3919,7 +3933,7 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
 	size_t          length=2, pos=0;
 	jpeg_sof_info   sof_info;

-	if (!data) {
+	if (!data || ImageInfo->Thumbnail.size < 4) {
 		return FALSE; /* nothing to do here */
 	}
 	if (memcmp(data, "\xFF\xD8\xFF", 3)) {
@@ -0,0 +1,11 @@
+--TEST--
+Bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+exif_read_data(__DIR__."/bug78222.jpg", 'THUMBNAIL', FALSE, TRUE);
+?>
+DONE
+--EXPECTF--
+DONE
@@ -0,0 +1,11 @@
+--TEST--
+Bug #78256 (heap-buffer-overflow on exif_process_user_comment)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+@exif_read_data(__DIR__."/bug78256.jpg", 'COMMENT', FALSE, TRUE);
+?>
+DONE
+--EXPECTF--
+DONE
@@ -166,6 +166,9 @@ int main() {

 int main() {
  iconv_t cd = iconv_open( "UTF-8//IGNORE", "UTF-8" );
+  if(cd == (iconv_t)-1) {
+    return 1;
+  }
  char *in_p = "\xC3\xC3\xC3\xB8";
  size_t in_left = 4, out_left = 4096;
  char *out = malloc(out_left);
@@ -1485,6 +1485,14 @@ MYSQLND_METHOD(mysqlnd_conn_data, get_server_version)(const MYSQLND_CONN_DATA *
 		return 0;
 	}

+#define MARIA_DB_VERSION_HACK_PREFIX "5.5.5-"
+
+	if (conn->server_capabilities & CLIENT_PLUGIN_AUTH
+		&& !strncmp(p, MARIA_DB_VERSION_HACK_PREFIX, sizeof(MARIA_DB_VERSION_HACK_PREFIX)-1))
+	{
+		p += sizeof(MARIA_DB_VERSION_HACK_PREFIX)-1;
+	}
+
 	major = ZEND_STRTOL(p, &p, 10);
 	p += 1; /* consume the dot */
 	minor = ZEND_STRTOL(p, &p, 10);
@@ -565,7 +565,8 @@ static void dce_live_ranges(context *ctx, zend_op_array *op_array, zend_ssa *ssa

 			if ((op_array->opcodes[def].result_type == IS_UNUSED) &&
 					(UNEXPECTED(op_array->opcodes[def].opcode == ZEND_EXT_STMT) ||
-					UNEXPECTED(op_array->opcodes[def].opcode == ZEND_EXT_FCALL_END))) {
+					UNEXPECTED(op_array->opcodes[def].opcode == ZEND_EXT_FCALL_END) ||
+					UNEXPECTED(op_array->opcodes[def].opcode == ZEND_END_SILENCE))) {
 				def--;
 			}

@@ -1570,7 +1570,9 @@ static zend_persistent_script *opcache_compile_file(zend_file_handle *file_handl

 	/* check blacklist right after ensuring that file was opened */
 	if (file_handle->opened_path && zend_accel_blacklist_is_blacklisted(&accel_blacklist, ZSTR_VAL(file_handle->opened_path))) {
+		SHM_UNPROTECT();
 		ZCSG(blacklist_misses)++;
+		SHM_PROTECT();
 		*op_array_p = accelerator_orig_compile_file(file_handle, type);
 		return NULL;
 	}
@@ -1601,7 +1603,9 @@ static zend_persistent_script *opcache_compile_file(zend_file_handle *file_handl
 		}

 		if (ZCG(accel_directives).max_file_size > 0 && size > (size_t)ZCG(accel_directives).max_file_size) {
+			SHM_UNPROTECT();
 			ZCSG(blacklist_misses)++;
+			SHM_PROTECT();
 			*op_array_p = accelerator_orig_compile_file(file_handle, type);
 			return NULL;
 		}
@@ -2003,11 +2007,16 @@ zend_op_array *persistent_compile_file(zend_file_handle *file_handle, int type)
 			return accelerator_orig_compile_file(file_handle, type);
 		}

+		SHM_PROTECT();
+		HANDLE_UNBLOCK_INTERRUPTIONS();
+		persistent_script = opcache_compile_file(file_handle, type, key, &op_array);
+		HANDLE_BLOCK_INTERRUPTIONS();
+		SHM_UNPROTECT();
+
 		/* Try and cache the script and assume that it is returned from_shared_memory.
         * If it isn't compile_and_cache_file() changes the flag to 0
         */
       	from_shared_memory = 0;
-		persistent_script = opcache_compile_file(file_handle, type, key, &op_array);
 		if (persistent_script) {
 			persistent_script = cache_script_in_shared_memory(persistent_script, key, key ? key_length : 0, &from_shared_memory);
 		}
@@ -0,0 +1,17 @@
+--TEST--
+Bug #77191: Assertion failure in dce_live_ranges() when silencing is used
+--FILE--
+<?php
+function test($x) {
+	switch (@$x['y']) {
+		case 1: return 'a';
+		case 2: return 'b';
+		case 3: return 'c';
+		case 4: return 'd';
+	}
+	return 'e';
+}
+var_dump(test([]));
+?>
+--EXPECT--
+string(1) "e"
@@ -2037,7 +2037,7 @@ static zend_object *phar_rename_archive(phar_archive_data **sphar, char *ext) /*
 	char *newname = NULL, *newpath = NULL;
 	zval ret, arg1;
 	zend_class_entry *ce;
-	char *error;
+	char *error = NULL;
 	const char *pcr_error;
 	int ext_len = ext ? strlen(ext) : 0;
 	size_t new_len, oldname_len, phar_ext_len;
@@ -2252,6 +2252,8 @@ its_ok:
 	phar_flush(phar, 0, 0, 1, &error);

 	if (error) {
+		zend_hash_str_del(&(PHAR_G(phar_fname_map)), newpath, phar->fname_len);
+		*sphar = NULL;
 		zend_throw_exception_ex(spl_ce_BadMethodCallException, 0, "%s", error);
 		efree(error);
 		efree(oldpath);
@@ -15,4 +15,7 @@ DONE
 ?>
 --EXPECTF--
 Fatal error: Uncaught BadMethodCallException: tar-based phar "%s/bug71488.test" cannot be created, link "%s" is too long for format in %sbug71488.php:%d
-Stack trace:%A
+Stack trace:
+#0 %s(%d): PharData->decompress('test')
+#1 {main}
+  thrown in %s on line %d
@@ -6,7 +6,8 @@ Francesco Fullone ff@ideato.it
 #PHPTestFest Cesena Italia on 2009-06-20
 --SKIPIF--
 <?php
-        if(!extension_loaded("posix")) print "skip - POSIX extension not loaded";
+if(!extension_loaded("posix")) print "skip posix extension not loaded";
+if(!extension_loaded("pcntl")) print "skip pcntl extension not loaded";
 ?>
 --FILE--
 <?php
@@ -1,11 +1,11 @@
-/* 
+/*
                      DO NOT EDIT THIS FILE!

- it has been automaticaly created by php7/scripts/credits from  
+ it has been automaticaly created by php7/scripts/credits from
 the information found in the various php7/ext/.../CREDITS and
- php7/sapi/.../CREDITS files 
- 
- if you want to change an entry you have to edit the appropriate 
+ php7/sapi/.../CREDITS files
+
+ if you want to change an entry you have to edit the appropriate
 CREDITS file instead

 */
@@ -28,7 +28,7 @@ CREDIT_LINE("FTP", "Stefan Esser, Andrew Skalski");
 CREDIT_LINE("GD imaging", "Rasmus Lerdorf, Stig Bakken, Jim Winstead, Jouni Ahto, Ilia Alshanetsky, Pierre-Alain Joye, Marcus Boerger");
 CREDIT_LINE("GetText", "Alex Plotnick");
 CREDIT_LINE("GNU GMP support", "Stanislav Malyshev");
-CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi ");
+CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi");
 CREDIT_LINE("IMAP", "Rex Logan, Mark Musone, Brian Wang, Kaj-Michael Lang, Antoni Pamies Olive, Rasmus Lerdorf, Andrew Skalski, Chuck Hagenbuch, Daniel R Kalowsky");
 CREDIT_LINE("Input Filter", "Rasmus Lerdorf, Derick Rethans, Pierre-Alain Joye, Ilia Alshanetsky");
 CREDIT_LINE("InterBase", "Jouni Ahto, Andrew Avdeev, Ard Biesheuvel");
@@ -1,11 +1,11 @@
-/* 
+/*
                      DO NOT EDIT THIS FILE!

- it has been automaticaly created by php7/scripts/credits from  
+ it has been automaticaly created by php7/scripts/credits from
 the information found in the various php7/ext/.../CREDITS and
- php7/sapi/.../CREDITS files 
- 
- if you want to change an entry you have to edit the appropriate 
+ php7/sapi/.../CREDITS files
+
+ if you want to change an entry you have to edit the appropriate
 CREDITS file instead

 */
@@ -0,0 +1,24 @@
+--TEST--
+Bug #69100: Bus error from stream_copy_to_stream (file -> SSL stream) with invalid length
+--FILE--
+<?php
+
+$fileIn = __DIR__ . '/bug69100_in.txt';
+$fileOut = __DIR__ . '/bug69100_out.txt';
+
+file_put_contents($fileIn, str_repeat('A', 64 * 1024));
+$fr = fopen($fileIn, 'rb');
+$fw = fopen($fileOut, 'w');
+
+var_dump(stream_copy_to_stream($fr, $fw, 32 * 1024));
+var_dump(stream_copy_to_stream($fr, $fw, 64 * 1024));
+
+fclose($fr);
+fclose($fw);
+unlink($fileIn);
+unlink($fileOut);
+
+?>
+--EXPECT--
+int(32768)
+int(32768)
@@ -0,0 +1,18 @@
+--TEST--
+memory allocation on stream_get_contents()
+--INI--
+memory_limit=32M
+--FILE--
+<?php
+$f = tmpfile();
+fwrite($f, '.');
+
+$chunks = array();
+for ($i = 0; $i < 1000; ++$i) {
+    rewind($f);
+    $chunks[] = stream_get_contents($f, 1000000);
+}
+var_dump(count($chunks));
+?>
+--EXPECT--
+int(1000)
@@ -0,0 +1,10 @@
+--TEST--
+proper string length on stream_get_contents()
+--FILE--
+<?php
+$f = fopen('php://memory', 'rw');
+fwrite($f, str_repeat('X', 1000));
+fseek($f, 0);
+var_dump(strlen(stream_get_contents($f, 1024)));
+--EXPECT--
+int(1000)
@@ -1932,6 +1932,11 @@ void php_request_shutdown(void *dummy)
 		zend_unset_timeout();
 	} zend_end_try();

+	/* 17. Deactivate Zend signals */
+#ifdef ZEND_SIGNALS
+	zend_signal_deactivate();
+#endif
+
 #ifdef PHP_WIN32
 	if (PG(com_initialized)) {
 		CoUninitialize();
@@ -2,7 +2,7 @@
 /* edit configure.ac to change version number */
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 2
-#define PHP_RELEASE_VERSION 21
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.2.21-dev"
-#define PHP_VERSION_ID 70221
+#define PHP_RELEASE_VERSION 22
+#define PHP_EXTRA_VERSION "RC1"
+#define PHP_VERSION "7.2.22RC1"
+#define PHP_VERSION_ID 70222
@@ -696,18 +696,15 @@ static int php_stdiop_set_option(php_stream *stream, int option, int value, void
 						return fd == -1 ? PHP_STREAM_OPTION_RETURN_ERR : PHP_STREAM_OPTION_RETURN_OK;

 					case PHP_STREAM_MMAP_MAP_RANGE:
-						if(do_fstat(data, 1) != 0) {
+						if (do_fstat(data, 1) != 0) {
 							return PHP_STREAM_OPTION_RETURN_ERR;
 						}
-						if (range->length == 0 && range->offset > 0 && range->offset < data->sb.st_size) {
-							range->length = data->sb.st_size - range->offset;
-						}
-						if (range->length == 0 || range->length > data->sb.st_size) {
-							range->length = data->sb.st_size;
-						}
-						if (range->offset >= data->sb.st_size) {
+						if (range->offset > data->sb.st_size) {
 							range->offset = data->sb.st_size;
-							range->length = 0;
+						}
+						if (range->length == 0 ||
+								range->length > data->sb.st_size - range->offset) {
+							range->length = data->sb.st_size - range->offset;
 						}
 						switch (range->mode) {
 							case PHP_STREAM_MAP_MODE_READONLY:
@@ -1418,8 +1418,13 @@ PHPAPI zend_string *_php_stream_copy_to_mem(php_stream *src, size_t maxlen, int
 			ptr += ret;
 		}
 		if (len) {
-			*ptr = '\0';
 			ZSTR_LEN(result) = len;
+			ZSTR_VAL(result)[len] = '\0';
+
+			/* Only truncate if the savings are large enough */
+			if (len < maxlen / 2) {
+				result = zend_string_truncate(result, len, persistent);
+			}
 		} else {
 			zend_string_free(result);
 			result = NULL;
@@ -1994,8 +1994,6 @@ COMMAND $cmd
 		}
 	}

-	@unlink($tmp_post);
-
 	$leaked = false;
 	$passed = false;

@@ -2207,6 +2205,10 @@ COMMAND $cmd
 		$restype[] = 'WARN';
 	}

+	if ($passed) {
+		@unlink($tmp_post);
+	}
+
 	if (!$passed) {
 		if (isset($section_text['XFAIL'])) {
 			$restype[] = 'XFAIL';
@@ -66,6 +66,7 @@
 #include <sys/socket.h>
 #include <arpa/inet.h>
 #include <netinet/in.h>
+#include <sys/time.h>

 #if defined(linux) || defined(__linux) || defined(__linux__) || defined(__gnu_linux__)
 #include "lscriu.c"
@@ -620,7 +621,7 @@ static int sapi_lsapi_activate()
 static sapi_module_struct lsapi_sapi_module =
 {
    "litespeed",
-    "LiteSpeed V7.4.3",
+    "LiteSpeed V7.5",

    php_lsapi_startup,              /* startup */
    php_module_shutdown_wrapper,    /* shutdown */
@@ -703,66 +704,90 @@ static void lsapi_sigsegv( int signal )

 static int clean_onexit = 1;

-static void lsapi_sigterm( int signal )
+
+static void lsapi_clean_shutdown()
 {
-    struct sigaction act, old_act;
+    struct sigaction act;
    int sa_rc;
+    struct itimerval tmv;
+#if PHP_MAJOR_VERSION >= 7
+    zend_string * key;
+#endif
+    clean_onexit = 1;
+    sigemptyset(&act.sa_mask);
+    act.sa_flags = 0;
+    act.sa_handler = lsapi_sigsegv;
+    sa_rc = sigaction(SIGINT,  &act, NULL);
+    sa_rc = sigaction(SIGQUIT, &act, NULL);
+    sa_rc = sigaction(SIGILL,  &act, NULL);
+    sa_rc = sigaction(SIGABRT, &act, NULL);
+    sa_rc = sigaction(SIGBUS,  &act, NULL);
+    sa_rc = sigaction(SIGSEGV, &act, NULL);
+    sa_rc = sigaction(SIGTERM, &act, NULL);
+
+    sa_rc = sigaction(SIGPROF, &act, NULL);
+    memset(&tmv, 0, sizeof(struct itimerval));
+    tmv.it_value.tv_sec = 0;
+    tmv.it_value.tv_usec = 100000;
+    setitimer(ITIMER_PROF, &tmv, NULL);
+
+#if PHP_MAJOR_VERSION >= 7
+    key = zend_string_init("error_reporting", 15, 1);
+    zend_alter_ini_entry_chars_ex(key, "0", 1,
+                        PHP_INI_SYSTEM, PHP_INI_STAGE_SHUTDOWN, 1);
+    zend_string_release(key);
+#else
+    zend_alter_ini_entry("error_reporting", 16, "0", 1,
+                        PHP_INI_SYSTEM, PHP_INI_STAGE_SHUTDOWN);
+#endif
+
+    zend_try {
+        php_request_shutdown(NULL);
+    } zend_end_try();
+}
+
+static void lsapi_sigterm(int signal)
+{

    // fprintf(stderr, "lsapi_sigterm: %d: clean_onexit %d\n", getpid(), clean_onexit );
    if(!clean_onexit)
    {
-        clean_onexit = 1;
-        act.sa_flags = 0;
-        act.sa_handler = lsapi_sigsegv;
-        sa_rc = sigaction( SIGINT, &act, &old_act );
-        sa_rc = sigaction( SIGQUIT, &act, &old_act );
-        sa_rc = sigaction( SIGILL, &act, &old_act );
-        sa_rc = sigaction( SIGABRT, &act, &old_act );
-        sa_rc = sigaction( SIGBUS, &act, &old_act );
-        sa_rc = sigaction( SIGSEGV, &act, &old_act );
-        sa_rc = sigaction( SIGTERM, &act, &old_act );
-
-        zend_try {
-            php_request_shutdown(NULL);
-        } zend_end_try();
+        lsapi_clean_shutdown();
    }
    exit(1);
 }

-static void lsapi_atexit( void )
+static void lsapi_atexit(void)
 {
-    struct sigaction act, old_act;
-    int sa_rc;
-
    //fprintf(stderr, "lsapi_atexit: %d: clean_onexit %d\n", getpid(), clean_onexit );
    if(!clean_onexit)
    {
-        clean_onexit = 1;
-        act.sa_flags = 0;
-        act.sa_handler = lsapi_sigsegv;
-        sa_rc = sigaction( SIGINT, &act, &old_act );
-        sa_rc = sigaction( SIGQUIT, &act, &old_act );
-        sa_rc = sigaction( SIGILL, &act, &old_act );
-        sa_rc = sigaction( SIGABRT, &act, &old_act );
-        sa_rc = sigaction( SIGBUS, &act, &old_act );
-        sa_rc = sigaction( SIGSEGV, &act, &old_act );
-        sa_rc = sigaction( SIGTERM, &act, &old_act );
-
-        //fprintf(stderr, "lsapi_atexit: %d: before php_request_shutdown\n", getpid(), clean_onexit );
-        zend_try {
-            php_request_shutdown(NULL);
-        } zend_end_try();
+        lsapi_clean_shutdown();
    }
 }

+
 static int lsapi_module_main(int show_source)
 {
+    struct sigaction act;
+    int sa_rc;
    zend_file_handle file_handle;
    memset(&file_handle, 0, sizeof(file_handle));
    if (php_request_startup() == FAILURE ) {
        return -1;
    }

+    sigemptyset(&act.sa_mask);
+    act.sa_flags = SA_NODEFER;
+    act.sa_handler = lsapi_sigterm;
+    sa_rc = sigaction( SIGINT, &act, NULL);
+    sa_rc = sigaction( SIGQUIT, &act, NULL);
+    sa_rc = sigaction( SIGILL, &act, NULL);
+    sa_rc = sigaction( SIGABRT, &act, NULL);
+    sa_rc = sigaction( SIGBUS, &act, NULL);
+    sa_rc = sigaction( SIGSEGV, &act, NULL);
+    sa_rc = sigaction( SIGTERM, &act, NULL);
+
    clean_onexit = 0;

    if (show_source) {
@@ -1397,6 +1422,7 @@ void start_children( int children )
    setsid();

    /* Set up handler to kill children upon exit */
+    sigemptyset(&act.sa_mask);
    act.sa_flags = 0;
    act.sa_handler = litespeed_cleanup;
    if( sigaction( SIGTERM, &act, &old_term ) ||
@@ -1473,15 +1499,6 @@ int main( int argc, char * argv[] )
    int slow_script_msec = 0;
    char time_buf[40];

-    struct sigaction act, old_act;
-    struct sigaction INT_act;
-    struct sigaction QUIT_act;
-    struct sigaction ILL_act;
-    struct sigaction ABRT_act;
-    struct sigaction BUS_act;
-    struct sigaction SEGV_act;
-    struct sigaction TERM_act;
-    int sa_rc;

 #ifdef HAVE_SIGNAL_H
 #if defined(SIGPIPE) && defined(SIG_IGN)
@@ -1584,15 +1601,6 @@ int main( int argc, char * argv[] )
    int iRequestsProcessed = 0;
    int result;

-    act.sa_flags = SA_NODEFER;
-    act.sa_handler = lsapi_sigterm;
-    sa_rc = sigaction( SIGINT, &act, &INT_act );
-    sa_rc = sigaction( SIGQUIT, &act, &QUIT_act );
-    sa_rc = sigaction( SIGILL, &act, &ILL_act );
-    sa_rc = sigaction( SIGABRT, &act, &ABRT_act );
-    sa_rc = sigaction( SIGBUS, &act, &BUS_act );
-    sa_rc = sigaction( SIGSEGV, &act, &SEGV_act );
-    sa_rc = sigaction( SIGTERM, &act, &TERM_act );
    atexit(lsapi_atexit);

    while( ( result = LSAPI_Prefork_Accept_r( &g_req )) >= 0 ) {
@@ -1625,14 +1633,6 @@ int main( int argc, char * argv[] )
        }
    }

-    sa_rc = sigaction( SIGINT, &INT_act, &old_act );
-    sa_rc = sigaction( SIGQUIT, &QUIT_act, &old_act );
-    sa_rc = sigaction( SIGILL, &ILL_act, &old_act );
-    sa_rc = sigaction( SIGABRT, &ABRT_act, &old_act );
-    sa_rc = sigaction( SIGBUS, &BUS_act, &old_act );
-    sa_rc = sigaction( SIGSEGV, &SEGV_act, &old_act );
-    sa_rc = sigaction( SIGTERM, &TERM_act, &old_act );
-
    php_module_shutdown();

 #ifdef ZTS
@@ -248,6 +248,7 @@ zend_op_array *phpdbg_compile_file(zend_file_handle *file, int type) {
 		} else {
 			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, file->filename);
 		}
+		return NULL;
 	}

 	data.buf = estrndup(bufptr, len);
@@ -0,0 +1,16 @@
+--TEST--
+Bug #78297: Include unexistent file memory leak
+--PHPDBG--
+r
+q
+--FILE--
+<?php
+include "does_not_exist.php";
+--EXPECTF--
+[Successful compilation of %s]
+prompt> 
+Warning: include(%s): failed to open stream: No such file or directory in %s on line %d
+
+Warning: include(): Failed opening 'does_not_exist.php' for inclusion (include_path=%s) in %s on line %d
+[Script ended normally]
+prompt>
Author	SHA1	Message	Date
Sara Golemon	47ecbb3094	Update versions for PHP 7.2.22RC1	2019-08-13 22:57:08 +00:00
Sara Golemon	39b0c30a0d	Update CREDITS for PHP 7.2.22RC1	2019-08-13 22:57:08 +00:00
Sara Golemon	6a0e04c623	Update NEWS for PHP 7.2.22RC1	2019-08-13 22:57:08 +00:00
Nikita Popov	4eeb41d1ea	Fixed bug #77191	2019-08-13 11:19:58 +02:00
Nikita Popov	18f2918a0f	Don't destroy properties array with unset GC type As the properties array can also be a GC root, it might have already been destroyed.	2019-08-13 09:53:25 +02:00
Nikita Popov	f3fdf570b3	Intern alias old_name early This is likely going to end up interned lateron at some point when the new_name is referenced somewhere. However, it may be that there are some uses that do not get interned before that. In this case we will intern a string that already have zval users, without updating the refcounted flag on those zvals. In particular this can happen with something like [Foo::class], where Foo is an imported symbol. The string it resolves to won't get interned right away, but may be interned later. use Foo as Bar; $x = [Bar::class]; var_dump(Bar::X); debug_zval_dump($x); // Will show negative refcount class Foo { const X = 1; } However, this doesn't really fix the root cause, there are probably other situations where something similar can occur.	2019-08-12 17:12:28 +02:00
Dmitry Stogov	9b43e29d9b	Fixed handling of references in nested data of objects with destructor	2019-08-09 17:43:50 +03:00
Dmitry Stogov	6b1cc1252e	Fixed second part of the bug #78379 (Cast to object confuses GC, causes crash)	2019-08-09 15:42:39 +03:00
Dmitry Stogov	2e2cd65d73	Added asserts to catch GC errors when refcount goes below zero.	2019-08-09 13:37:23 +03:00
Matteo Beccati	796efd849e	Skip test when SIGKILL is not defined	2019-08-09 10:32:15 +02:00
Dmitry Stogov	358379be22	Fixed bug #78379 (Cast to object confuses GC, causes crash)	2019-08-08 10:00:39 +03:00
Christoph M. Becker	954543cec6	Fix #78282 : atime and mtime mismatch The fix for bug #78241 assumed that `time_t` would always be 64bit, but actually is 32bit for x86. We therefore enforce 64bit arithmetic to avoid wrapping. (cherry picked from commit `bf242d58e7`)	2019-08-06 17:25:54 +02:00
Christoph M. Becker	f9f4a68368	Fix #78179 : MariaDB server version incorrectly detected As of MariaDB 10.0.2, the server reports a fake version number as work- around for replication issues[1]. We apply the same "fix" as in the MariaDB client to cater to this. [1] <https://github.com/MariaDB/server/commit/c50ee6c23dbeb090963580754bec2f0a96ac0557#diff-5b45fa673c88c06a9651c7906364f592>	2019-08-02 16:42:49 +02:00
Nikita Popov	85e8ccd55e	Fixed bug #78363	2019-08-02 10:35:24 +02:00
Remi Collet	b29ecec4ef	add security NEW entries + reorder [ci skip]	2019-07-30 09:26:50 +02:00
Stanislav Malyshev	284fb08fdc	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix #77919: Potential UAF in Phar RSHUTDOWN Update NEWS Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment) Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)	2019-07-29 13:19:16 -07:00
Christoph M. Becker	cd1101e8c8	Fix #77919 : Potential UAF in Phar RSHUTDOWN We have to properly clean up in case phar_flush() is failing. We also make the expectation of the respective test case less liberal to avoid missing such bugs in the future.	2019-07-29 13:18:27 -07:00
Stanislav Malyshev	42e8b85d94	Update NEWS	2019-07-29 13:16:53 -07:00
Albert Casademont	dc7aa22b18	Fix bug #78326 Similar to what fread() does, truncate the stream_get_contents() result if the original buffer was way too large.	2019-07-29 17:33:57 +02:00
Nikita Popov	38f1288b64	Fix Zend signals unblocking There are a few parts here: * opcache should not be blocking signals while invoking compile_file, otherwise signals may remain blocked on a compile error. While at it, also protect SHM memory during compile_file. * We should deactivate Zend signals at the end of the request, to make sure that we gracefully recover from a missing unblock and signals don't remain blocked forever. * We don't use a critical section in deactivation, because it should not be necessary. Additionally we want to clean up the signal queue, if it is non-empty. * Enable SIGG(check) in debug builds so we notice issues in the future.	2019-07-29 15:17:32 +02:00
Nikita Popov	68fd435ba8	Fixed bug #78333 Don't dereference float/double values at unknown address, instead memcpy it into an aligned stack slot and dereference that.	2019-07-29 11:27:21 +02:00
Stanislav Malyshev	aeb6d13185	Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)	2019-07-29 00:53:37 -07:00
Stanislav Malyshev	dea2989ab8	Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)	2019-07-29 00:53:28 -07:00
Christoph M. Becker	30eb4b3563	Fix #78342 : Bus error in configure test for iconv //IGNORE We have to check the return value of iconv_open() for error, to avoid that and potentially other undesired behavior of iconv().	2019-07-29 08:48:13 +02:00
Levi Morrison	5649267b25	Remove .post files only for passing tests This allows the sh script for failing tests with --POST-- to work	2019-07-25 09:48:39 -06:00
Peter Kokot	8f384bea93	Update NEWS	2019-07-23 02:13:00 +02:00
George Wang	eb7e45f662	Checked in LiteSpeed SAPI 7.5, addressed two main problems in "clean shutdown" introduced in 7.4.3, 1. falls in an infinite loop because PHP engine's inconsistent state, now override the ITIMER_PROF to 0.1 second, clean shutdown must finish before that. 2. generate too much error log, we completely disable "error_reporting" before calling php_request_shutdown().	2019-07-20 23:59:43 -04:00
Abyr Valg	c8c183eb62	Fixed bug #77946 Save multi_info_read() result into easy handle.	2019-07-18 14:40:47 +02:00
Nikita Popov	b864abfe23	Fixed bug #69100	2019-07-17 15:58:29 +02:00
Remi Collet	bd0514913b	move NEWS entry [ci skip]	2019-07-16 13:00:13 +02:00
Nikita Popov	8a19fe29de	Fixed bug #78297	2019-07-16 11:09:17 +02:00
Remi Collet	c9037421ac	next is 7.2.22	2019-07-16 10:38:20 +02:00