A recent commit[1] which fixed a memory leak introduced a regression
regarding the formerly liberal handling of IP addresses to bind to. We
fix this by reverting that commit, and fix the memory leak where it
actually occurs. In other words, this fix is less intrusive than the
former fix.
[1] <http://git.php.net/?p=php-src.git;a=commit;h=0b8c83f5936581942715d14883cdebddc18bad30>
Closes GH-6104.
Modules may have changed after restart which can cause dangling pointers from custom opcode handlers in the second-level cache files. This fix includes the installed module names and versions in the accel_system_id hash as entropy. Closes GH-5836
Quoting from the bug report:
> The domain names passed to getmxrr() do not contain a trailing dot.
> DNS lookups which do not find records will (depending on the local
> resolver config) try again by adding the local domain to the end of
> the searched host/domain. In many environments there's an mx record
> for any subdomain of the local domain and the MX query will return
> a hit. But the test expects no hit. So the test fails when checking
> that "qa.php.net" does not have an MX record in DNS. In our local
> environment the resolver falls back to also check qa.php.net.kippdata.de
> which does have an MX record. Using "qa.php.net." instead of "qa.php.net"
> should fix this for everyone.
Do not decrement the refcount before allocating the new string,
as the allocation operation may bail out and cause a use-after-free
lateron. We can only decrement the refcount once the allocation
has succeeded.
Fixes oss-fuzz #25384.
php_parse_url() is intended to support strings that are not zero
terminated. We can't use strcspn in the implementation.
As we have two uses of strcspn, add a helper.
Use the general zend_generator_throw_exception() helper for this.
Otherwise we don't handle the off-by-one opline correctly (should
we maybe just stop doing that?)
This is a followup to ad750c3bb6,
which fixed a different yield from exception handling problem that
happened to show up in the same test case from oss-fuzz #25321.
Now both issues should be fixed.
There is a deeper underlying issue here, in that the opcodes violate
VM write-fetch safety, but let's fix the infinite loop first.
This fixes oss-fuzz #25352.
This can happen if zend_call_function inserted a dummy frame,
and we already switched to the dummy frame in leave_helper,
and an exception is thrown during CV destruction.
Fixes oss-fuzz #25343.
We can't just remove the uses, we need to replace uses.
The test case only fails on master with SSA integrity violations,
but I believe the root issue also existed previously.
If we're accessing an uninitialized typed property and __get is
defined, don't perform a read_property callback, as __get is
supposed to have no effect on uninitialized typed properties.
Usually it doesn't, but by-reference assignments cannot be
performed through read_property.
I'm deleting the test for bug #80039 again, as it doesn't really
make sense anymore with this fix.
Added new flags that allow skipping param_evt(s) that are not used by drivers,
in a backwards and forward compatible manner. Updated the pgsql, mysql, sqlite
and oci drivers to properly use the new flags. I've left out pdo_dblib, which
doesn't have a param_hook, and pdo_firebird, which seems to be using
PARAM_EVT_NORMALIZE in a wrong context (param type vs event type).
Currently we only ever increment ifd_nesting_level, so this ends up
being a limit on the total number of IFD tags and we regularly get
bug reports of it being exceeded. I think the intention behind this
limit was to prevent recursion stack overflow, and for that we only
need to check actual recursive usage. I've implemented that here,
and dropped the nesting limit down to a smaller value
(which still passes our tests).
However, it seems that we do also need to have a total limit on
the number of tags, as we don't catch some instances of infinite
looping otherwise. Add this as a separate limit with a higher
value, that should hopefully be sufficient.
This is expected to fix a number of bugs:
https://bugs.php.net/bug.php?id=78083https://bugs.php.net/bug.php?id=78701https://bugs.php.net/bug.php?id=79907https://bugs.php.net/bug.php?id=80016
If the length is not -1, require it to be non-negative.
Using such lengths doesn't make sense (as only -1 is special-case
to read in chunks, anything else will end up doing a huge upfront
allocation) and can lead to string allocation overflow.
A similar check is already in place for file_get_contents(). That
one does not allow -1 (and uses null instead), but this function
is explicitly specified to accept -1, so stick to that behavior.
As of PHP 7.4.0, exceptions are allowed to be thrown from inside
`__toString()` methods; we have to cater to that, and catch these
exceptions early.
Closes GH-6042
`ITypeInfo_GetIDsOfNames()` is supposed to fail with `E_NOTIMPL` for
out-of-process servers, thus we should not remove the already available
typeinfo of the object in this case.
We also properly free the `byref_vals`.
`tolower()` returns an `int`, so we must not convert to `char` which
may be `signed` and as such may be subject to overflow (actually,
implementation defined behavior).
Closes GH-6007
PDO driver constructors are throwing PdoException without setting
errorInfo, so create a new reusable function that throws exceptions
for PDO and will also set the errorInfo. Use this function in
pdo_mysql, pdo_sqlite, and pdo_pgsql.
Different manufacturer models may come with a
different endianness (motorola/intel) format. In
order to avoid a big refactor and a gigantic lookup
table, this commit simply attempts to switch the
endianness and proceed when values are acceptable.
Closes GH-5849.
op_arrays can be shared on two levels: Either the op_array is
completely shared, or it is distinct but shares all members
(apart from static_variables).
The the op_array is distinct, we need to make sure to properly
initialize the MAP_PTR structures.
Whether the type library is cached is actually irrelevant here; what
matters is that the symbols are imported, and since these are not
cached, we have to import them for every request. And we cannot cache
the symbols, because the import depends on the current codepage, but
the codepage is a `PHP_INI_ALL` setting.
We must not call `zend_list_delete()` in resource closer functions
exposed to userland, because decreasing the refcount there leads to
use-after-free scenarios. In this case, commit 4a42fbb worked for
typical use-cases where `xml_parser_free()` has been called exactly
once for the resource, because there is an internal zval (`->index`)
referencing the same resource which already increased the refcount by
one. However, when `xml_parser_free()` is called multiple times on the
same XML parser resource, the resource would be freed prematurely.
Instead we forcefully close the resource in `xml_parser_free()`. We
also could decrease the refcount of the resource there, but that would
require to call `xml_parser_free()` which is somewhat uncommon, and
would be particularly bad wrt. PHP 8 where that function is a NOP, and
as such doesn't have to be called. So we do no longer increase the
refcount of the resource when copying it to the internal zval, and let
the usualy refcounting semantics take care of the resource destruction.
[1] <http://git.php.net/?p=php-src.git;a=commit;h=4a42fbbbc73aad7427aef5c89974d1833636e082>
Move the FREE_OP for op_data out of the zend_binary_assign_op_dim_slow()
slow path, so it can be used by the other error path as well. This
makes ASSIGN_DIM_OP structurally more similar to ASSIGN_DIM.
These systems has two versions of the iovec interface dependent on
compiler flags passed, the legacy version causing little build issue.
Closes GH-5939.
Okay, looks like ai_canonname does not get set on macos even if
AI_CANONNAME is specified, so canonicalize this in the other
direction instead and unset ai_canonname if it is present.
This test is doing something really dubious. There's a race
condition here that would kill some poor process that happens
to start at just the wrong time.
Instead of storing the mapping base address and the address of
`execute_ex()` in a separate file in the temporary folder, we store
them right at the beginning of the memory mapping.
This reverts commit e1f6ab3388, reversing
changes made to e0ebe56ebf.
There are obviously issues with running tests in parallel, maybe
related to the cache ID. This needs to be investigated. Revert for
now.
If the CTRL-C event can't be sent to the child for whatever reason, the
test will never terminate, because `proc_close()` waits for an infinite
amount of time. Therefore, we `proc_terminate()` the child instead,
after explicitly closing the pipes.
Instead of storing the mapping base address and the address of
`execute_ex()` in a separate file in the temporary folder, we store
them right at the beginning of the memory mapping.
The file extension to mime type mapping *must* not depend on the file
extension's case for case-insensitive file systems, and *should* not
for case-sensitive file systems.
It does not make sense to make assumptions about `PHP_CONFIG_FILE_PATH`
during build time, since that value is never used during run time on
Windows. Since there is no `--with-config-file-path` on Windows
either, we define `PHP_CONFIG_FILE_PATH` as `""`.
This test fails occasionally due to timing issues, because the session
file may have been unlinked by the first `session_start()`'s GC. We
adapt the test expectation to this reality.
This only leaks at the end of the process, so per se not an issue, but
the leak is caught by MSVC's CRT leak checker, so we better properly
clean up to avoid false positives.
We must not mix multibyte and wide character strings in the
`COAUTHIDENTITY` structure. Using wide character strings throughout
would have the advantage that the remote connection can be established
regardless of the code page of the server, but that would more likely
break BC, so we just drop the wide character string conversion of the
username.
Similar to what is done for ReflectionType itself, copy the
type name stored inside ReflectionProperty. Also make sure the
type field is always initialized for dynamic properties.
This is a non-issue in PHP 8, because we store a pointer to the
property_info there, rather than a copy.
We mark symlink_link_linkinfo_is_link_error2.phpt as XFAIL on Windows
ZTS. Several Windows API file system functions ignore trailing spaces
in absolute filenames after the final directory separator, which causes
`link(' ', $link)` to actually call `CreateHardLink()` which then
fails, because linking folders is not supported. However, with NTS
builds (as well as on other systems), the $target is found to not
exist, so the function fails without actually attempting to create the
link. This needs further investigation.
When performing an RW modification of an array offset, the undefined
offset warning may call an error handler / OB callback, which may
destroy the array we're supposed to change. Detect this by temporarily
incrementing the reference count. If we find that the array has been
modified/destroyed in the meantime, we do nothing -- the execution
model here would be that the modification has happened on the destroyed
version of the array.
In the interest of avoiding side-effects during dumping, I'm
replacing the value with a <constant ast> string instead of
performing an update constant operation.
We modify _basic1.phpt so it runs on Windows as well. The other test
cases hit the issue that `readlink()` fails normally for regular files,
but succeeds on Windows[1]. Therefore, we split these tests, but still
fix the skip reasons.
[1] <http://svn.php.net/viewvc?view=revision&revision=350097>
Most of these have been skipped on Windows for no good reason (`lstat`
is available there as of PHP 4). Several others would only fail,
because the `blksize` and `blocks` elements are always `-1` on Windows,
which can easily be fixed by using `%i` format specifiers instead of
`%d`.
Fixes a use-after-free encountered in Symfony's SecurityBundle.
I don't have a reproducer for this, and believe the issue can only
occur if we leak an iterator (the leak is a separate issue).
We should not free the generator iterator here, because we do not
own it. The code that fetched the iterator is responsible for
releasing it. In the rare case where we do hit this code-path,
we cause a use-after-free.
A `BSTR` is similar to a `zend_string`; it stores the length of the
string just before the actual string, and thus the string may contain
NUL bytes. However, `php_com_olestring_to_string()` is supposed to
deal with arbitrary `OLECHAR*`s which may not be `BSTR`s, so we
introduce `php_com_bstr_to_string()` and use it for the only case where
we actually have to deal with `BSTR`s which may contain NUL bytes.
Contrary to `php_com_olestring_to_string()` we return a `zend_string`,
so we can save the re-allocation when converting to a `zval`.
We also cater to `php_com_string_to_olestring()` not being binary safe,
with basically the same fix we did for `php_com_olestring_to_string()`.
`ReflectionClass` allows reading of the values of private and protected
constants, and also to get private and protected static methods.
Therefore getting the values of private and protected static properties
is also permissible, especially since `::getStaticProperties()` already
allows to do so.
We also allow ::setStaticPropertyValue() to modify private and
protected properties, because otherwise this method is useless, as
modifying public properties can be done directly.
`atol()` returns a `long` which is not the same as `zend_long` on
LLP64; we use `ZEND_ATOL()` instead.
There is no need for a new test case, since filesize_large.phpt already
tests for that behavior; unfortunately, the FTP test suite relies on
`pcntl_fork()` and therefore cannot be run on Windows.
Check if data would overlap and also add an assert. Previous
implementations didn't have this issue, as the direct assignment was
used.
Signed-off-by: Anatol Belski <ab@php.net>
These were XFAILed due to a bug in the log implementation that
caused intermittent failures. However, this issue is supposed to
be resolved in the meantime, so try dropping the XFAIL marker.
The `security_level` stream option is only available as of OpenSSL
1.1.0, so we only set it for these versions. Older OpenSSL versions
do not have security levels at all.
This migrates all the tests using ext/openssl/tests/streams_crypto_method.pem
to the certificate generator, so we can easily adjust needed parameters.
In particular, this makes the cert security level 2 compatible.
However, we still need to downgrade security_level to 1 in a number
of tests, because they are testing TLS < 1.2 connections.
Saw a spurious failure from this one on azure macos, presumably
the process got interrupted in the middle and waited for more than
one second to resume.
After looking a bit more closely, this test doesn't actually test
what bug #48187 reported, because there is no DateTime::diff()
anywhere to be found. This test was also added speculatively,
because the root cause was never diagnosed, and the problems seems
to have resolved itself at some point.
As such, I'm simply dropping this test, rather than figuring out
how to make it more robust.
This makes the generated certificates compatible with security
level 2, which is apparently the default on Ubuntu 20.04.
Unfortunately this does not fix all tests, because some are using
pre-generated certificates.
Even if the length of a maker note does not match our expectations
(either because the maker note is corrupted, or because our
expectations do not quite match reality), there is no need to let
parsing fail; we can still go on parsing the other meta information.
Exception should be thrown before the db handle is destroyed.
The backtrace excerpt
==26628== Invalid read of size 4
==26628== at 0x53C49E3: sqlite3_errmsg (in /usr/lib64/libsqlite3.so.0.8.6)
==26628== by 0x38C4E9: zim_sqlite3_open (sqlite3.c:142)
==26628== by 0x8977BF: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1618)
==26628== by 0x8F801E: execute_ex (zend_vm_execute.h:53824)
==26628== by 0x8FC0BB: zend_execute (zend_vm_execute.h:57920)
==26628== by 0x828F54: zend_execute_scripts (zend.c:1672)
==26628== by 0x793C2C: php_execute_script (main.c:2621)
==26628== by 0x8FEA44: do_cli (php_cli.c:964)
==26628== by 0x8FF9DC: main (php_cli.c:1359)
Signed-off-by: Anatol Belski <ab@php.net>
The output normalization of bless_tests.php only detected absolute Unix
filenames; we extend this for absolute Windows filenames, regardless of
the platform we're running on (tests may have been run on Windows, but
bless_tests.php may be run from WSL or a Linux VM, for instance).
In module startup stage, we should not initiliaze
EG(modified_ini_directives) as it use zend MM, the zend MM will be
restart at the end of modules startup stage,
by say "partial", because this issue still exists if altering ZEND_USER
inis, we should add a zend_ini_deactive at the end of modules startup
stage, but it brings some new cost, and I think no one would do things
like that
The `timercmp()` manpage[1] points out that some systems have a broken
implementation which does not support `>=`. This is definitely the
case for the Windows SDK, which only supports `<` and `>`.
[1] <https://linux.die.net/man/3/timercmp>
If the current character is a line break character, it cannot be a tab
or space character, so we would always fail with an invalid sequence
error. Obviously, these `scan_stat == 4` conditions are meant to be
exclusive.
Furthermore, if `in_pp == NULL || in_left_p == NULL` is true, we hit a
segfault if we are not returning right away. Obviously, the additional
constraints don't make sense, so we remove them.
Extend configure.ac to accept PHP_UNAME as env variable to set the value of the
PHP_UNAME define in a reproducible manner. This allows distributions to set a
fixed value for php_uname and keep the default behaviour if PHP_UNAME is not
set.
Motivation: https://reproducible-builds.org/
Closes GH-5671.
Currently ./configure --enable-phar --program-suffix=7.4 will
result in binaries named php7.4 and phar but should instead
result in php7.4 and phar7.4
Closes GH-5650.
As its name suggests, `sqlite3_data_count` returns the number of
columns in the current row of the result set; we are interested in the
number of columns regardless of the current row, so we have to use
`sqlite3_column_count` instead.
As of PHP 7.3.0, `sapi_cli_single_write()` is supposed to return `< 0`
on failure, but `fwrite()` returns a `size_t`, and signals error by
setting the stream's error indicator. We have to cater to that.
* Properly initialize PHPDBG_G(watch_tmp)
Otherwise that may cause segfaults in ZTS builds.
* Deactivate potentially remaining watchpoints after REPL
Otherwise the memory could still be protected, resulting in segfaults
during shutdown.
* NULL zend_handlers_table after freeing
As of commit 4130fe4[1], the `zend_handlers_table` is explicitly
freed in the `zend_vm_dtor()`. Since phpdbg (and maybe some other
SAPIs) may restart the engine afterwards, we have to make sure that
the table is also NULLed.
* Only set context option if there is a context
In other words, we must not follow the null pointer.
* Cater to file handles without attached console
File handles do not necessarily have an attached console (for
instance, pipes do not), in which case `GetConsoleScreenBufferInfo()`
fails. In this case we set a default value (`40`) for lines like on
other systems.
[1] <http://git.php.net/?p=php-src.git;a=commit;h=4130fe437a5db7ead1444d3748bd0fbad9829cb2>
On startup, PHP deliberately changes the floating point control word to
enforce binary64 format for the calculations for best consistency
across platforms. However, this is unnessary for x86_64 architectures,
because in this case SSE instructions are used by default, and there is
no good reason to pass `-mfpmath=i387` or such.
Therefore, we can skip the modification, which has the benefit that
system libraries are free to work in the mode of their liking.
I decided to null out EG(exception) early here, which means only
the exception from the dtor / ref assign is preserved, and the
previous exception is not chained in. This is more robust, and
I don't think this situation is common enough to be bothered about
the precise behavior.
There was some confusion going on here regarding the original
value vs the copied value.
I've dropped the needs_copy variable, because this code is not
inlined, so it would always be true anyway.
What we need to do is perform a move-assignment of the copied
value (in which case we don't care about performing the assignment
before destroying garbage), and destroying the original value
for the VAR/TMP cases. This is a bit complicated by the fact that
references are passed in via a separate ref variable, so we can't
just ptr_dtor the original variable.
On startup, PHP deliberately changes the floating point control word to
enforce binary64 format for the calculations for best consistency
across platforms. However, this is unnessary when compiling under
`__SSE__`, because in this case the x87 instructions are not used.
Therefore, we can skip the modification, which has the benefit that
system libraries are free to work in the mode of their liking.
The color resolution is expected in bits 4-6 of the packed fields byte
of the logical screen descriptor (byte 10 of the GIF data stream),
according to the specification[1], section 18.
[1] <https://www.w3.org/Graphics/GIF/spec-gif89a.txt>
If the class is already linked, we need to serialize and
unserialize INDIRECTed static properties. Normally these would
be set up when copying from cache.
Since the member is not used in `OnUpdateEol()` that's not really an
issue, but still it's confusing to apparently have two INI settings
targeting the same member.
* 'PHP-7.4' of git.php.net:/php-src:
Fix#79557: extension_dir = ./ext now use current directory for base
Fix#79596: MySQL FLOAT truncates to int some locales
[ci skip] Fix NEWS
For some reason, `ImageLoad()` fails to load images with a relative
path starting with `.\` or `./`. We work around this issue by
stripping those leading characters.
We add the missing release dates, the NEWS regarding the latest CVE
fixes, and move the entry for bug #79536 to 7.4.7 because it didn't
make it into 7.4.6.
lcov is emitting several errors for generated regex files that have no code
coverage data. The fix is to add the files to the lcov exlusion list.
This is not an issue for CI because it uses gcovr to generate code coverage.
The errors:
Processing ext/date/lib/parse_date.gcda
geninfo: WARNING: could not open /home/code/vendor/php/php-src/parse_date.re
geninfo: WARNING: could not open /home/code/vendor/php/php-src/<stdout>
geninfo: WARNING: some exclusion markers may be ignored
Processing ext/date/lib/parse_tz.gcda
Processing ext/date/lib/tm2unixtime.gcda
Processing ext/date/lib/parse_iso_intervals.gcda
geninfo: WARNING: could not open /home/code/vendor/php/php-src/<stdout>
geninfo: WARNING: could not open /home/code/vendor/php/php-src/parse_iso_intervals.re
geninfo: WARNING: some exclusion markers may be ignored
...
genhtml: ERROR: cannot read /home/code/vendor/php/php-src/parse_date.re
Processing file /home/code/vendor/php/php-src/parse_date.re
make: *** [Makefile:443: lcov-html] Error 2
Closes GH-5568.
To solve bug #70886, the test uses random keys to prevent collisions;
however, this is not guaranteed, and as such it may even collide with
other tests in the shmop test suite. The proper solution would be to
use a single key (which could be randomly generated), but to actually
`shmop_close()` after each `shmop_delete()`. This would, however, not
work on Windows due to bug #65987. Therefore we use three different
keys for now.
* PHP-7.3:
Fix#78876: Long variables cause OOM and temp files are not cleaned
Fix#78875: Long filenames cause OOM and temp files are not cleaned
Update NEWS for 7.2.31
Update CREDITS for PHP 7.2.30
Update NEWS for PHP 7.2.30
* PHP-7.2:
Fix#78876: Long variables cause OOM and temp files are not cleaned
Fix#78875: Long filenames cause OOM and temp files are not cleaned
Update NEWS for 7.2.31
Update CREDITS for PHP 7.2.30
Update NEWS for PHP 7.2.30
We must not cast `size_t` to `int` (unless the `size_t` value is
guaranteed to be less than or equal to `INT_MAX`). In this case we can
declare `array_len` as `size_t` in the first place.
We must not attempt to access arbitrary union members when retrieving
debug info, because that may not be valid. Therefore we do no longer
dereference pointer types inside of unions, but report their address as
string in `%p` format instead.
This is a funny one. I discovered that lstat_stat_variation10.phpt was failing every
now and again when the PHP test suite was run on my dev PC. The output from the failing
test showed that the atime (access time) of the directory created in the test was changing
between these lines:
$old_stat = stat($dirname);
clearstatcache();
sleep(1);
var_dump( is_dir($dirname) );
$new_stat = stat($dirname);
Could is_dir() be accessing the directory and changing the atime? strace showed that is_dir
was only issuing a single stat() syscall. Could stat() change the atime? No, no, that would
just be perverse. Nobody would be stupid enough to implement the kernel in that way.
Checked the kernel source, found that the function called when atime needs to be updated
appears to be touch_atime(). Broke out the BCC kernel tracing tools and ran this one
while running the flaky test case in a loop:
sudo trace -I<kernel src dir>/include/linux/path.h -I<same>/include/linux/dcache.h 'touch_atime(struct path *path) "%s", path->dentry->d_name.name'
Inspecting the results showed that something called "git_thread" was occcasionally updating
the atime on the directory in question!! What on earth...???
The PID shown by trace revealed that this was a background thread for Sublime Text 3.
Sublime now has git integration and shows when there are untracked or modified files. It
seems that it uses a background thread to regularly scan the project directory and look
for new and modified files. This was causing the atime to change.
Even though other developers may not be running ST3, there are any number of reasons why
a background process might recurse through various directories and could cause the atime
to change unexpectedly. Therefore, update the test case so it doesn't fail in such cases.
Closes GH-5553.
We map the POSIX semantics of `IPC_PRIVATE` by creating unnamed file
mapping objects on Windows. While that is not particularly useful for
ext/shmop, which is the only bundled extension which uses `shmget()`,
it may be useful for external extensions.
On Windows, reusing/sharing of OPcache instances with different
configuration is not necessarily supported, so we have to make that it
does not happen for the clean scripts, by using `$orig_ini_settings`
instead of `$clean_params`.
* 'PHP-7.4' of git.php.net:/php-src:
Fix#79532: sizeof off_t can be wrong
Make 045.phpt busy wait
Revert "Fix #79065: DOM classes do not expose properties to Reflection"
Bump version
Fix#79065: DOM classes do not expose properties to Reflection
Fix#79470: PHP incompatible with 3rd party file system on demand
We have to actually determine the proper `SIZEOF_OFF_T`.
Interestingly, it is `4` on Windows x64.
We also have to prevent the redefinition in pg_config.h. The clean
solution would likely be to not include pg_config.h at all, but that's
out of scope for BC reasons for now.
The timeout is only real-time based on Windows. Make this use
a busy wait loop instead. If hard_timeout is broken, this will
fail with a run-tests enforced timeout instead.
Partially reverts 846b647953: instead of
throwing, this skips uninitialized typed properties when serializing objects.
This makes serialize with __sleep() behave the same as serialize()
without __sleep().
As in the non-__sleep() case, unserialize(serialize($x)) identity
may not be preserved due to replacement of uninitialized/unset
properties with default values. Fixing this will require changes to
the serialization format.
Closes GH-5396.
When ArrayObject is round-tripped through serialize() and unserialize(),
it forgets any iterator class name which was set using ::setIteratorClass().
Fix that.
The `start` parameter of `php_cgi_ini_activate_user_config` is supposed
to hold the byte offset of the doc root in the given `path`. However,
the current expression which fixes a potential type incompatibility
will ever only evaluate to zero or one, because it uses the *logical*
and operator (`&&`). Furthermore we notice that subtracting one from
`doc_root_len` is not necessary, so there is even no need for the
`start` parameter at all.
This is the change from GH-5417 but for FPM. This was stripping the
last character from the doc_root. Given how it is used, this should
be harmless, but let's make it less confusing...
I stumbled upon this while debugging a strange issue with
stream_socket_client() where it randomly throws out errors when
the connection timeout is set to below 1s. The logic to calculate
time difference in php_openssl_subtract_timeval() is wrong when
a.tv_usec < b.tv_usec, causing connection errors before the timeout
is reached.
The DO_INIT flag, which will skip the first resume on a primed
generator, should always be set when starting to yield from a
new generator, not only when the yield from happens during priming.
There is no reason to expect a `1` after the PID; neither the session
ID nor the memory usage are required to contain one. Actually, we just
want to verify here, that the process with the $child_pid is running,
and is a php.exe process.
We have to free the retrieved text content; to keep the code readable,
we extract a helper function to check for empty nodes. Unfortunately,
we cannot use xmlIsBlankNode(), because that also recognizes whitespace
only text content.
We also make sure to properly handle NULL returns from
xmlNodeGetContent().
* PHP-7.3:
Revert "Went to fast and forgot to update tests"
Revert "Fix Bug #79448 0 is a valid Unicode codepoint, but mb_substitute_character(0) fails"
This commit brings some substantial changes in behaviour due to the weird implementation.
This will be fixed in master due to BC concerns.
This reverts commit 1333b46d6d.
We actually implement `::__debugInfo()` and drop the `get_debug_info()`
handlers of all relevant SPL classes. This is cleaner and gives more
flexibility regarding overriding the functionality in descendant
classes.
In commit a7305eb539 the last_message
field of the connection object was changed to be always non-persistent.
But there is a place on change_user path that still treats it
depending on conn->persistent flag. This will cause PHP crash after
com_change_user success when there is last_message set
The comment on `PS_VALIDATE_SID_FUNC(files)` is very clear that the
function is supposed to return `SUCCESS` if the session already exists.
So to detect a collision, we have to check for `SUCCESS`, not
`FAILURE`.
We also fix the wrong condition in session_regenerate_id() as well.
It seems like on many filesystems nlink for directories is the
number of subdirectories (plus two, due to . and ..). However,
this is not a POSIX requirement, and some filesystems don't
implement it this way. This seems to be the case for whatever is
used on the Travis AArch64 builders now.
Since `DateTimeZone` does not implement a `compare_objects` handler,
nor has any properties, two `DateTimeZone` instances always compare as
being equal, even if they designate totally different timezones. Even
worse, after calling `var_dump()` on these objects, the actual
comparison may yield a correct result.
We therefore introduce a `compare_objects` handlers, which prevents
different behavior before/after `var_dump()`, and which allows us to
clearly define the intended semantics.
The skip message must start with the word 'skip', otherwise the test will not be skipped.
*Before:*
Running selected tests.
TEST 1/1 [ext/com_dotnet/tests/bug79332.phpt]
========DIFF========
001+ Fatal error: Uncaught Error: Class 'COMPersistHelper' not found in /srv/php/ext/com_dotnet/tests/bug79332.php:2
001- A com_exception has been thrown
002+ Stack trace:
003+ #0 {main}
004+ thrown in /srv/php/ext/com_dotnet/tests/bug79332.php on line 2
========DONE========
FAIL Bug #79332 (php_istreams are never freed) [ext/com_dotnet/tests/bug79332.phpt]
*After:*
Running selected tests.
SKIP Bug #79332 (php_istreams are never freed) [ext/com_dotnet/tests/bug79332.phpt] reason: com_dotnet extension not available
To cater to potentially state-dependent encodings, we have to reset the
conversion descriptor into its initial shift state to properly finish
the conversion. Furthermore, state-dependent encodings may not show
progress when comparing `in_left` before and after the conversion; we
rather have to see whether `out_left` has decreased. Also we have to
cater to the fact that the final potentially state resetting call does
not signal failure, but we still have to break respective loops
afterwards.
We add Windows support to four existing test cases, extract some useful
utility functions, and use them to simplify further test cases.
We also remove the Windows specific code from preload.inc, since
preloading isn't supported on Windows anyway.
This is actually about three distinct issues:
* If an empty string is passed as $address to `stream_socket_sendto()`,
the `sa` is not initialized, so we must not pass it as `addr` to
`php_stream_xport_sendto()`.
* On POSIX, `recvfrom()` truncates messages which are too long to fit
into the specified buffer (unless `MSG_PEEK` is given), discards the
excessive bytes, and returns the buffer length. On Windows, the same
happens, but `recvfrom()` returns `SOCKET_ERROR` with the error code
`WSAEMSGSIZE`. We have to catch this for best POSIX compatibility.
* In `php_network_parse_network_address_with_port()`, we have to zero
`in6` (not only its alias `sa`) to properly support IPv6.
Co-Authored-By: Nikita Popov <nikita.ppv@googlemail.com>
Even though `SplStack::unserialize()` is not supposed to be called on
an already constructed instance, it is probably better if the method
clears the stack before actually unserializing.
Unfortunately, some Webservers (e.g. IIS) do not implement the (F)CGI
specifications correctly wrt. chunked uploads (i.e. Transfer-encoding:
chunked), but instead pass -1 as CONTENT_LENGTH to the CGI
application. However, our (F)CFI SAPIs (i.e. cgi and cgi-fcgi) do not
support this.
Therefore we try to retrieve the stream size in advance and pass it to
`curl_mime_data_cb()` to prevent libcurl from doing chunked uploads.
This is basically the same approach that `curl_mime_filedata()`
implements, except that we are keeping already opened streams open for
the `read_cb()`.
Some commits missed to update the patch file, so we're catching up on
this.
To generally make this easier, we back-port generate_patch.sh from
PHP-7.4, where we now also generate magic.h from magic.h.in.
We have to free the `ansiname`s, regardless of whether they have been
put into the hashtable or not.
Since bug79299.phpt already shows the leak when run with a leak
checker, there is no need for another regression test.
Releasing the `com_dotnet_istream_wrapper` in `istream_destructor()` is
pointless, since `istream_destructor()` is only called when the
resource is going to be released. This recursion is not a real issue,
though, since the resource is never exposed to userland, and has at
most refcount 1, so due to well defined unsigned integer underflow, it
never is released twice. However, returning early in this case causes
a memory leak which needs to be fixed.
For obvious reasons, we must not assign a `size_t` value to an `int`
variable using memcpy(). However, there is actually no need for the
intermediate `n_sugg_st` here, if we use the proper types in the first
place.
A regression test is not necessary, because dict_suggest.phpt already
exhibits the erroneous behavior on big endian architectures.
While `mysqli_get_client_version()` calls `mysql_get_client_version()`
to retrieve the client version, `mysql::$client_version` is initialized
to `MYSQL_VERSION_ID`. Both should match though, and since the former
is the more useful information, we fix `mysql::$client_version`.
We do not add a regression test, because it would usually succeed
anyway, and we already have several tests with respective `assert()`s.
Always push the current user_error/exception_handler to the stack,
even when it is empty, so restore_error_handler() always works as
expected.
The user_error_handler is especially temporarily empty when we are inside
the error handler, which caused inconsistent behaviour before.
The fix for feature request #53466 did not properly handle resetting of
the corresponding statement; the problem with this is that the
statement does not know about its result sets. But even if we could
fix this, the `complete` handling still appears to be brittle, since
the `sqlite3_column_type()`docs[1] state:
| If the SQL statement does not currently point to a valid row, or if
| the column index is out of range, the result is undefined.
Fortunately, we can use `sqlite3_data_count()` instead, since[2]:
| If prepared statement P does not have results ready to return (via
| calls to the sqlite3_column() family of interfaces) then
| sqlite3_data_count(P) returns 0.
Thus, we guard `SQLite3::columnType()` with `sqlite3_data_count()`, and
completely drop updating the `php_sqlite3_result_object.complete`
field, but keep it for ABI BC purposes.
[1] <https://www.sqlite.org/c3ref/column_blob.html>
[2] <https://www.sqlite.org/c3ref/data_count.html>
Firstly, we must not rely on `stmt->column_count` when freeing the
driver specific column values, but rather store the column count in
the driver data. Since the column count is a `short`, 16 bit are
sufficient, so we can store it in reserved bits of `pdo_odbc_stmt`.
Furthermore, we must not allocate new column value storage when the
statement is not executed, but rather when the column value storage has
not been allocated.
Finally, we have to introduce a driver specific `cursor_closer` to
avoid that `::closeCursor()` calls `odbc_stmt_next_rowset()` which then
frees the column value storage, because it may be still needed for
bound columns.
* PHP-7.3:
Fix # 79171: heap-buffer-overflow in phar_extract_file
Fix bug #79082 - Files added to tar with Phar::buildFromIterator have all-access permissions
Fix bug #79221 - Null Pointer Dereference in PHP Session Upload Progress
Mark bug76348.phpt as online test
Fix bug #79082 - Files added to tar with Phar::buildFromIterator have all-access permissions
Fix bug #79221 - Null Pointer Dereference in PHP Session Upload Progress
* PHP-7.2:
Mark bug76348.phpt as online test
Fix bug #79082 - Files added to tar with Phar::buildFromIterator have all-access permissions
Fix bug #79221 - Null Pointer Dereference in PHP Session Upload Progress
The primary motivation to have each test worker running its own console
is to allow the windows_mb_path tests to run in parallel. A nice side
effect is that this also prevents changing the code page of the
tester's console window (which can even cause its font to be changed).
To be able to do so, we introduce the `create_new_console` option for
`proc_open()`, which might occasionally be useful for other purposes
than testing.
To be able to see changes done only with `SetEnvironmentVariable()`, we
have to use `GetEnvironmentStrings()` instead of `environ`, because the
latter sees only changes done with `putenv()`.
For best backward compatibility we're using `GetEnvironmentStringsA()`;
switching to the wide string version likely makes sense for master,
though.
Cherry-picked the fix(not sure why this wasn't merged to 7.4) for:
Fixed bug #77589 (Core dump using parse_ini_string with numeric sections)
Section name should not be typed(NULL, FALSE, TRUE etc)
Conflicts:
Zend/zend_ini_scanner.c
If the `VT_ARRAY` is empty, i.e. its upperbound is less than its lower
bound, we must not call `php_com_safearray_get_elem()`, because that
function throws in this case.
variant objects have no (declared) properties, so the `get_properties`
handlers returns a pointer to constant storage for efficiency reasons.
This pointer must not be returned from the `get_gc` handler, though;
instead we set up an own `get_gc` handler and return NULL from it, to
signal that there are no properties to collect.
Because a `HRESULT` is a `LONG`[1], no special treatment is required on
x86 platforms to get appropriate values. On x64 platforms we prefer
positive values, what we could accomplish by casting the `HRESULT`
value to `ULONG` and then to `zend_long`, but since the current
behavior is correct and the performance improvement is negligible, we
defer that to master.
[1] <https://docs.microsoft.com/en-us/windows/win32/winprog/windows-data-types#hresult>
PCRE only validates the string starting from the start offset
(minus maximum look-behind, but let's ignore that), so we can
only remember that the string is fully valid UTF-8 is the original
start offset is zero.
We need not just the whole string to be UTF-8, but the start
position to be on a character boundary as well. Check this by
looking for a continuation byte.
To cater to `curl_copy_handle()` of cURL handles with attached
`CURLFile`s, we must not attach the opened stream, because the stream
may not be seekable, so that we could rewind, when the same stream is
going to be uploaded multiple times. Instead, we're opening the stream
lazily in the read callback.
Since `curl_multi_perfom()` processes easy handles asynchronously, we
have no control of the operation sequence. Since duplicated cURL
handles may be used with multi handles, we cannot use a single arg
structure, but actually have to rebuild the whole mime structure on
handle duplication and attach this to the new handle.
In order to better test this behavior, we extend the test responder to
print the size of the upload, and patch the existing tests accordingly.
Not all systems support the discard protocol (TCP port 9), and since
there is no particular reason to use it, we switch to using actual
server testing.
The culprit is the too restrictive fix for bug #71536, which prevents
`php_libxml_streams_IO_write()` from properly executing when unclean
shutdown is flagged. A *more* suitable solution is to move the
`xmlwriter_free_resource_ptr()` call from the `free_obj` handler to an
added `dtor_obj` handler, to avoid to write to a closed stream in case
of late object freeing. This makes the `EG(active)` guard superfluous.
We also fix bug79029.phpt which has to use different variables for the
three parts to actually check the original shutdown issue.
Thanks to bwoebi and daverandom for helping to investigate this issue.
Since we're dealing with floating point numbers, precision issues may
hit us, and actually it's not necessary to check for the exact number
anyway, because it is not exact in the first place. Therefore, we
relax the test expectations.
We have to convert to number *before* detecting the type, to cater to
internal objects implementing `cast_object`.
We also get rid of the fallback behavior of using `FORMAT_TYPE_INT32`,
because that can no longer happen; after `convert_scalar_to_number_ex`
the type is either `IS_LONG` or `IS_DOUBLE`. We cater explicitly to
the `IS_ARRAY` case what also avoids triggering a type confusion when
`::TYPE_INT64` is passed as `$type`.
Unlink the current stack frame before freeing CVs or extra args.
This means it will no longer show up in back traces that are
generated during CV destruction.
We already did this prior to destructing the object/closure,
presumably for the same reason.
The following commit introduces a cross-compilation failure:
93c728b77c
"Try to control ZEND_MM_ALIGNED_SIZE type"
br-arm-full/build/php-7.4.2/Zend/zend_alloc.h:30:38:
error: missing binary operator before token "8"
^
br-arm-full/build/php-7.4.2/ext/opcache/ZendAccelerator.c:1380:7:
note: in expansion of macro ‘ZEND_MM_ALIGNMENT’
Closes GH-5128.
The fix for bug #49634 solved a double-free by copying the node with
`xmlDocCopyNodeList()`, but the copied node is later freed by calling
`xmlFreeNode()` instead of `xmlFreeNodeList()`, thus leaking memory.
However, there is no need to treat the node as node list, i.e. to copy
also the node's siblings; just creating a recursive copy of the node
with `xmlDocCopyNode()` is sufficient, while that also avoids the leak.
I replaced it with a multiplication overflow check in
18599f9c52. However, we need both,
because the code for restoring the number can't handle numbers
with many leading zeros right now and I don't feel like teaching it.
This is going to cause a segfault if reused in the next request.
To illustrate the issue, run these two scripts in sequence with
the built-in server:
// script1.php
mb_ereg_search_init('foobar');
mb_ereg_search('foo');
// script2.php
var_dump(mb_ereg_search_init("foobar"));
var_dump(mb_ereg_search_pos());
Don't mix strlen() and ZSTR_LEN(). If the encoding contains a
NULL byte, this will overflow the buffer.
NULL bytes will still make this behave oddly because the consuming
code will cut off the string there, but let's address that in master...
The YYERROR_VERBOSE macro will no longer be supported in Bison 3.6.
It was superseded by the "%error-verbose" directive in Bison 1.875
(2003-01-01). Bison 2.6 (2012-07-19) clearly announced that support
for YYERROR_VERBOSE would be removed. Note that since Bison 3.0
(2013-07-25), "%error-verbose" is deprecated in favor of "%define
parse.error verbose".
Closes GH-5125.
In this case warning_count may be non-zero, but php_get_warnings()
may still return no warnings. In this case we should return false
rather than returning a corrupted mysqli_warning object.
The fix for bug #78929 disabled the conversion of spaces in cookie
values to plus signs, but failed to adapt `php_setcookie()`
accordingly, so that it uses raw URL encoding as well.
This is already supported by non Windows builds for libzip >= 1.3.1,
and since we're using at least libzip 1.4.0 on Windows, we should
support it there as well.
Always operate on copies of the functions, so we don't reference
temporary trait methods that have gone out of scope.
This could be more efficient, but doing an allocated copy only when
strictly necessary turned out to be somewhat tricky.
We need to extend the hash table before performing raw append
operations.
This doesn't matter if preloading happens in the same process,
as the tables will be large enough to hold all entries as a
side-effect of the preloading process. However, if preloading
happens in a different process, we need to reserve space here.
auth_plugin_data_len here is 21, including the trailing null byte.
Directly use SCRAMBLE_LENGTH instead. Also add a sanity check that
the provided scramble is long enough.
Adjust for URL change in XSD file and mark as online test.
Is it possible for use to store http://x-road.eu/xsd/xroad.xsd
locally instead? Do relative file system paths work here?
I'm not familiar with this.
While basic support for MSVCRT debugging has been added long
ago[1], the leak checking is not usable for the test suite, because we
are no longer calling `xmlCleanupParser()` on RSHUTDOWN of
ext/libxml[2], and therefore a few bogus leaks are reported whenever
ext/libxml is unloaded.
We therefore ignore memory leaks for this case. We introduce
`ZEND_IGNORE_LEAKS_BEGIN()` and `ZEND_IGNORE_LEAKS_END()` to keep
those ignores better readable, and also because these *might* be
useful for other leak checkers as well.
We also explicitly free the `zend_handlers_table` and the `p5s` to
avoid spurious leak reports.
[1] <http://git.php.net/?p=php-src.git;a=commit;h=d756e1db2324c1f4ab6f9b52e329959ce6a02bc3>
[2] <http://git.php.net/?p=php-src.git;a=commit;h=8742276eb3905eb97a585417000c7b8df85006d4>
In the buildconf and configure batch files, Windows' cscript utility was being
run without the /e:jscript flag. This works on systems that have not had the
default .js file association changed, but if .js has been re-associated to
(say) an IDE, the batch files fail with the error message:
Input Error: There is no script engine for file extension ".js".
Remove the check of PHP_OPENSSL inside SETUP_OPENSSL. It's the
responsibility of the caller to determine whether they want to
enable openssl or not. This makes SSL detection in IMAP work,
which uses a different option.
Additionally also clarify that --with-openssl-dir cannot actually
be used to specify an OpenSSL directory -- these options just
serve as a way to enable OpenSSL in extensions without also
enabling the OpenSSL extension. They need to be renamed to
something clearer in master.
Closes GH-5091.
FTP functionality isn't enabled by default and not listed as a disabled
extension in the `php.ini` file either.
This should spare a few googles to anyone needing FTP functionality in PHP.
Closes GH-5084.
This is a backport of fcdc0a6db0
to the PHP-7.3 branch. We need to make sure that OnUpdateString
is also called for a NULL value, otherwise the reset of the encoding
at the end of the request will not work.
I believe I already tried to land this before once, but it didn't
actually end up on the PHP-7.3 branch due to a push conflict that
I only noticed just now.
ASan instrumentation does not support the MSVC debug runtime, but still
it does not make sense to enable optimizations for such builds, since
they are not meant for production usage anyway, and although memory
corruption issues are still found in optimized builds, the generated
diagnostics are close to being useless, and apparently sometimes even
outright wrong. Therefore, we disable all optimizations for ASan
instrumented builds.
We also introduce and use `ZEND_WIN32_NEVER_INLINE` for ASan enabled
builds to avoid inlining of functions, so we get even better
diagnostics.
We must not assume that the size of a function's return value is at
most `sizeof(ffi_arg)`, but rather have to use the size which already
has been determined for the return type if it is larger than
`sizeof(ffi_arg)`.
To be able to have a regression test, we export the required test
function from the zend-test extension, and make sure that the test
can be run on different platforms regardless of whether zend-tests was
built statically or dynamically.
These test cases have recently been adjusted to work with MySQL 8[1],
but some older, but still supported database versions, such as MySQL
5.6, still need the password to be sent hashed, so we fall back to
using `PASSWORD()`, if the `SET PASSWORD` query fails without it.
[1] <http://git.php.net/?p=php-src.git;a=commit;h=b0efd18f7844da29931737b8a1cf461c7493e168>.
We use the portable {TMP} instead of the hard-coded /tmp, and skip
mysqli_debug_append.phpt on Windows, because unlinking the trace file
while the connection is still open won't work there.
(cherry picked from commit 60081ca20d)
Depending on the libcurl version and perhaps configuration, it may show
additional info (due to `CURLOPT_VERBOSE` being activated), which we
have to ignore, to avoid spurious test failures.
Due to ASLR restrictions, preloading on Windows does not work with
any code that has preloading dependencies on internal classes.
This effectively makes it unusable for any non-trivial codebase.
Instead of pretending like preloading is going to work, only to
make people realize that it really doesn't once they get beyond
a dummy example, we disable support for preloading on Windows
entirely.
Closes GH-4999.
Previously this generated a notice, but would likely generate an
Error when unserializing.
Now we treat it with the same distinction as direct property
accesses, i.e. referencing an unset/undefined normal property
stays a notice, while a typed property becomes an Error exception.
This fixed bug #79002.
Closes GH-5050.
We implement support for a fifth parameter, which allows to specify the
mapsize. The parameter defaults to zero, in which case the compiled in
default mapsize (usually 1048576) will be used. The mapsize should be
a multiple of the page size of the OS.
This test fails intermittently due to taskill reporting failure to kill
the process (because it already has been terminated). We increase the
sleep time, to hopefully prevent that from happening again.
We check that the given microsecond fraction is in the valid range
[0, 1000000[, and otherwise mark it as invalid. We also drop the
useless do loop; a plain block is sufficient here.
This causes a warning on GCC 9 and is unnecessary to boot: We
only use "cwd" for the open_basedir check, so we can just as well
pass in the original string.
This is a backport of fcdc0a6db0
to the PHP-7.3 branch. We need to make sure that OnUpdateString
is also called for a NULL value, otherwise the reset of the encoding
at the end of the request will not work.
Fix file cache serialization of property types. I'm changing the
overall type serialization format to perform additional adjustments
in order to yield a plausible pointer for zend_type, rather than
using an entirely separate serialization format, as was previously
done. That would have been annoying to extend to the case of CE
pointers.
If the script was serialized as file_cache_only (thus non-immutable)
and then gets unserialized into SHM, we need to allocate a new
run_time_cache slot and can't use the serialized arena pointer.
Instead of populating a hashtable of property names and then
directly serializing.
This has the advantage of a) detecting duplicate properties more
precisely and b) gives us the ability to discard values without
rewriting the serialization string after the fact for GH-5027.
These stats are used to check whether the file exists -- they
should not generate errors. Having the flag set is particularly
important for custom stream wrappers.
We must not use the same shared memory OPcache instance for different
SAPIs, since their memory layout is different. To avoid this, we add
the SAPI name (truncated to at most 20 characters) to the names of the
memory base file, the mutex and the file mapping.
This reverts commit b8ef7c35ab.
See bug #79031. The semantics of serialize locking aren't quite
correct right now, and the use of the lock in this particular
place makes us hit the issue in a common case. I'm reverting this
commit for PHP 7.4 and will try to fix this properly for PHP 8,
as I believe it will require ABI breakage.
The fact that conn->unix_socket is set does not mean that a Unix
socket is actually in use -- this member is set in a default
configuration.
Instead check whether a unix_socket stream ops is used.
The behavior of this is very dependent on the MySQL vendor, MySQL
version and MySQL configuration, in particular the
explicit_defaults_for_timestamp variable.
I don't think it's worthwhile to try and model this exactly, so
drop the test.
We backport the fix PHP 7.3, since this branch is affected as well.
(cherry picked from commit b5e0043796)
(cherry picked from commit e36daa6927)
(cherry picked from commit 2704ee6844)
As of PHP 7.3.0, unlinking files with open handles is possible on
Windows, but these file entries are still blocked until all open
handles are closed. Since this test doesn't require to write to the
same file, we use three separate files.
We also add the missing skip check for XMLReader.
We no longer try to retrieve the filename of a given stream when
fstat'ing, because this is very slow. Since we neither didn't do that
in PHP 7.3 and earlier, we regard this as sensible trade-off.
Don't report EAGAIN/EWOULDBLOCK as errors for fwrite on
non-blocking socket streams. This matches behavior for fread,
as well as behavior for plain file streams.
Closes GH-5026.
Some functions in libmagic (distributed with fileinfo extension) perform this sequence of calls:
func() {
setlocale(LC_TYPE, "C")
.. do some work ..
setlocale(LC_TYPE, "")
}
It effectively resets LC_TYPE if it that was set before the function call.
To avoid manipulations with current locale at all, the problematic functions
were modified to use locale-independent functions.
We need to make sure that op_data is only freed after populating
result, as op_data may be the only thing holding the value in the
case of an overloaded assignment.
This reverts the code to how it looked like in 7.3.
Finally blocks in generators may be invoked during shutdown, in
which case we don't have a stack frame. Similar to what
zend_call_function does, we still need to rethrow these exceptions,
otherwise they will be hidden (and leak).
`php_stream_write()` returns `-1` on failure now, which has to be
catered to by `SplFileObject::fputcsv()` which still is supposed to
return `false` on failure.
We need to update the value even if new_value is NULL. In particular,
it should be reset back to NULL after each request if the setting was
not specified on startup. Otherwise we leave dangling pointers.
* 'PHP-7.4' of git.php.net:php-src:
Remove DateTime class registration test
Fixed bug #78973
Fixed bug #78961 (erroneous optimization of re-assigned $GLOBALS)
* PHP-7.3:
Fixed bug #78910Fix#78878: Buffer underflow in bc_shift_addsub
Fix test
Fix#78862: link() silently truncates after a null byte on Windows
Fix#78863: DirectoryIterator class silently truncates after a null byte
Fix#78943: mail() may release string with refcount==1 twice
* PHP-7.2:
Fixed bug #78910Fix#78878: Buffer underflow in bc_shift_addsub
Fix test
Fix#78862: link() silently truncates after a null byte on Windows
Fix#78863: DirectoryIterator class silently truncates after a null byte
Since the constructor of DirectoryIterator and friends is supposed to
accepts paths (i.e. strings without NUL bytes), we must not accept
arbitrary strings.
Since we need `headers_lc` as well as `headers_trim` in the following,
we do not release the former even if they are the same string, to avoid
complicating the release logic even more.
A new test case is not necessary, since we already have
mail_basic_alt2-win32.phpt and others.
Also generate a fatal error if a collision occurs in zend_compile.
This is not perfect, because collisions might still be introduced
via opcache, if one file is included multiple times during a request,
invalidate in the meantime and recompiled by different processes.
This still needs to be addressed, but this patch fixes the much
more common case of collisions occuring when opcache is not used.
Fixes bug #78903.
We switch the cookie value parsing function from `php_url_decode()` to
`php_raw_url_decode()`, so that cookie values are now parsed according
to RFC 6265, section 4.1.1. We also refactor to remove duplicate code
without changing the execution flow.
We need to make sure that trait methods with static variables
allocate a separate MAP slot for the static variables pointer,
rather than working in-place.
I wasn't able to create a simple reproducer for this. General approach
is the same as for anonymous classes: If the key is already used, reuse
the old definition.
GCC complained about potentially uninitialized __orig_bailout,
even though the variable has an initializer. This warning was
quite persistent, I was only able to avoid it by using a separate
function.
Am I missing something?
Formerly, the error message was like:
| Can't preload unlinked class MyException: Internal parent (Windows
| only limitation)Exception
Now it's like:
| Can't preload unlinked class MyException: Windows can't link to
| internal parent Exception
During preloading, check that all classes that have been included
as part of the preload script itself (rather than through opcache_compile_file)
can actually be preloaded, i.e. satisfy Windows restrictions, have
resolved initializers and resolved property types. When resolving
initializers and property types, also autoload additional classes.
Because of this, the resolution runs in a loop.
Due to former restrictions of the libcurl API, curl multipart/formdata
file uploads supported only proper files. However, as of curl 7.56.0
the new `curl_mime_*()` API is available (and already supported by
PHP[1]), which allows us to support arbitrary *seekable* streams, which
is generally desirable, and particularly resolves issues with the
transparent Unicode and long part support on Windows (see bug #77711).
Note that older curl versions are still supported, but CURLFile is
still restricted to proper files in this case.
[1] <http://git.php.net/?p=php-src.git;a=commit;h=a83b68ba56714bfa06737a61af795460caa4a105>
(cherry picked from commit c68dc6b5e3)
As of curl 7.56.0, `curl_formadd()` is deprecated in favor of
`curl_mime_*()`, so we use the latter if available.
(cherry picked from commit a83b68ba56)
When we change back the bucket key on a class linking failure,
make sure to reload the bucket pointer, as the class table may
have been reallocated in the meantime.
Also remove a bogus bucket key change in anon class registration:
We don't actually rename the class in this case anymore, the RTD
key is already the final name.
We already changed the behavior for __set() in f1848a4. However, it
seems that this is also a problem for all the other property magic,
see bug #78904.
This commit makes the behavior of all the property magic consistent:
Magic will not be triggered for uninitialized typed properties, only
explicitly unset() ones. This brings behavior more in line how
non-typed properties behave and avoids WTF.
Closes GH-4974.
The "return" in the for loop should have been a break on the switch,
otherwise the result is just ignored... but because it prevents
evaluation of the other operand, it also violates the invariant that
everything has been constant evaluated, resulting in an assertion
failure.
The for loop isn't correct in any case though, because it's not legal
to determine the result based on just the second operand, as the
first one may have a side-effect that cannot be optimized away.
After taking a more detailed look at our commonly failing timeout
tests... turns out that most of them are useless as written and
don't test what they're supposed to.
This PR has a couple of changes:
* Tests for timeout in while/for/foreach should just have the loop
as an infinite loop. Calling into something like busy_wait means
that we just end up always testing whatever busy_wait does.
* Tests for timeouts in calls need to be based on something like
sleep, otherwise we'd have to introduce a loop, and we'd end up
testing timeout of the looping structure instead. Using sleep only
works on Windows, because that's the only system where sleep counts
towards the timeout. As such, many of those tests are now Windows only.
* Removed some tests where I don't see a good way to test what they're
supposed to test. E.g. how can we test a timeout in eval() specifically?
The shutdown function tests are marked as XFAIL, as we are currently
missing a timeout check in call_user_function. I believe that's a
legitimate issue.
Closes GH-4969.
First, make sure the tests are skipped if we connect via unix
socket, as we can't use SSL in that case.
Second, use a cipher that is not blacklisted in current MySQL
versions.
The problem is newer binutils will no longer default to --copy-dt-needed-entries but use --no-copy-dt-needed-entries instead. So all libraries needed *must* be provided.
Workarounds (either one works)
1) Add "-Wl,--copy-dt-needed-entries" to LDFLAGS to bring back the old behavior of the linker
2) Add "-lz" to list of libraries to be added
In "ext/mysqlnd/mysqlnd_protocol_frame_codec.c" when the "zlib.h" header is included should also trigger adding '-lz' to the list of libraries.
We add the `is_seekable` member to `php_stdio_stream_data`, and prefer
that over `is_pipe`, since the latter is simply a misnomer. We keep
`is_pipe` for now for Windows only, though, because we need special
support for pipes there. We also fix the misaligned bitfield which
formerly took 33 bit.
When normalizing tags to check whether they are contained in the set
of allowable tags, we must not strip slashes, unless they come
immediately after the opening `<`, or immediately before the closing
`>`.
If we're constructing extended-length paths (i.e. paths prefixed with
`\\?\`), we have to replace all forward slashes with backward slashes,
because the former are not supported by Windows for extended-length
paths.
The more efficient and likely cleaner alternative solution would be to
cater to this in `php_win32_ioutil_normalize_path_w()` by always
replacing forward slashes, but that might break existing code. It
might be sensible to change that for `master`, though.
This partially reverts commit c55d09c2f5,
because `MB_ONIGURUMA_VERSION` is only available as of PHP 7.4.0, so
that change made no sense for PHP-7.3; we keep it for PHP-7.4, though.
We also stick with the modification to bug78633.phpt.
Apparently, bug 78633 has now really been fixed; the former fix only
catered to the buffer overflow, but yielded a wrong result. Also,
the order of the named captures has been fixed.
We no longer protect GC during the destroy phase, so we need to
deal with buffer reallocation.
Note that the implementation of spl_SplObjectStorage_free_storage
will call the destructor of SplObjectStorage, and free the instance properties,
which I think is what caused the root buffer to be reallocated.
(`current` is a pointer for an index within the root buffer?)
This fixes bug #78811 for me.
Closes GH-4935
Apparently, this has not been tested for a long time, and might be a
refactoring relict. Anyhow, we have to pass the context to
`GIFNextPixel` as well.
We noticed the BC break when testing `curl_setopt()`, and hadn't interpreted
this note as affecting internal functions in general, so this adds a sub-bullet
to note that.
This overlaps a bit with the previous bullet, but since I don't know exactly
which operations were in mind at the time, I've elected to preserve them both.
Bits are cheap.
And `$x = !$x`
Noticed while working on GH-4912
The included test would not emit undefined variable errors in php 8.0
with opcache enabled. The command used:
```
php -d zend_extension=opcache.so --no-php-ini -d error_reporting=E_ALL \
-d opcache.file_cache= -d opcache.enable_cli=1 test.php
```
Postpone signal delivery while spawning children.
Prevent the following case:
- Reload (reexec) is in progress.
- New master is forking to start enough children for pools
where `pm` is not `on-demand`.
- Another `SIGUSR2` is received by the master process.
- Master process switches to reloading state.
- Some child has not set its own signal handlers.
- `SIGQUIT` and `SIGTERM` sent by master process are caught
by signal handler set by master process and so they are ignored.
- A child is running, it has no reason to finish
Before pull request #4465 this scenario could cause deadlock,
however with 0ed6c37140 reload finishes after `SIGKILL`.
Use sigprocmask() around fork() to avoid race of delivery signal to children
and setting of own signal handlers.
Fixes bug #76601
Opcache stores `opline->handler`s in shared memory. These pointers are
invalid, if the main PHP DLL is loaded at another base address due to
ASLR. We therefore store the address of `execute_ex` in the mmap base
file, and check on startup whether it matches its current address. If
not, we fall back on the file cache if enabled, and bail out otherwise.
This still does not address cases where the opline handler is located
inside of another DLL (e.g. for some profilers, debuggers), but there
seems to be no general solution for now.
(cherry picked from commit 8ba10b8fbc)
We use the portable {TMP} instead of the hard-coded /tmp, and skip
mysqli_debug_append.phpt on Windows, because unlinking the trace file
while the connection is still open won't work there.
Clear the OpenSSL error queue before performing SSL stream operations.
As we don't control all code that could possibly be using OpenSSL,
we can't rely on the error queue being empty.
Time flies, so obviously the reported uptime may differ a bit (as
already occasionally noticed on CI); we cater to that by allowing a
delay of up to one second.
This reverts commit edccf32f7f.
This was reported to cause issues for as yet unknown reasons in
bug #78769. As this was intended as code cleanup, revert this from
7.4 at least. May reapply it to master later.
The string held by the zend_type may be released if the property
type gets resolved to a CE. I initially wanted to fix this by
storing a zend_type* instead (so the property type resolution
propagates to the ReflectionType), but decided against this in
light of upcoming union types support, where we also need to
represent parts of the union, and will not have a single zend_type*
we can reference.
These were checking whether the instruction set is supported by
the host CPU, however they were only used to condition on whether
this instruction set is targeted at all. It would still use dynamic
dispatch (e.g. based on ifunc resolvers) to select the actual
implementation. Whether the target is guaranteed to support the
instruction set without dispatch is determined based on pre-defined
macros like __SSE2__.
This removes the configure-time builtin cpu checks to remove
confusion. Additionally this allows targeting an architecture that
is newer than the host architecture.
First, the limitation already doesn't trigger if you copy the whole
file (i.e. use copy() or stream_copy_to_stream() and don't specify
a length). This happens because length will be 0 at the time of the
check and only later calculated based on the file size. This means
that we're already completely blowing the length limit for what is
likely the most common case, and it doesn't seem like anyone complained
about that.
Second, the premise of the code comment ("to avoid runaway swapping")
seems incorrect to me. Because this performs a file-backed non-private
mmap, no swap backing is needed for the mapping. Concerns over "memory
usage" are also misplaced, as this is a virtual mapping.
Use the shared empty array from ZVAL_EMPTY_ARRAY
For code that created an 10 arrays of 100000 empty arrays
(has the same result with `$assoc=true` and `{}`)
- This is the worst-case comparison, but I'd expect 0-length arrays to be fairly
common in regular data for json_decode
- The parser implementation was using function pointers so that third party
extension developers could reuse the json parser for their own
data structures, etc. (I think).
This PR is meant to let those third party extensions continue working
without changes.
Before this patch: In 0.126 seconds: added 97.99 MiB
After this patch: In 0.096 seconds: added 41.99 MiB
```php
<?php
$json = '[' . str_repeat('[],', 100000) . "null]";
$start_memory = memory_get_usage();
$start_time = microtime(true);
$result = [];
for ($i = 0; $i < 10; $i++) {
$result[] = json_decode($json);
}
$end_memory = memory_get_usage();
$end_time = microtime(true);
// Before this patch: In 0.126 seconds: added 97.99 MiB
// After this patch: In 0.096 seconds: added 41.99 MiB
printf("In %.3f seconds: added %.2f MiB\n", $end_time - $start_time, ($end_memory - $start_memory)/1000000);
// For objects
$json = '[' . str_repeat('{},', 100000) . "null]";
$start_memory = memory_get_usage();
$start_time = microtime(true);
for ($i = 0; $i < 10; $i++) {
$result[] = json_decode($json, true);
}
$end_memory = memory_get_usage();
$end_time = microtime(true);
// Before this patch: In 0.126 seconds: added 97.99 MiB
// After this patch: In 0.096 seconds: added 41.99 MiB
printf("In %.3f seconds: added %.2f MiB (objects decoded as arrays) \n", $end_time - $start_time, ($end_memory - $start_memory)/1000000);
```
Closes GH-4861.
To work around the limitation of the current rudimentary vectorcall
support in our patched libffi, we forbid yet unsupported declarations,
i.e. float/double parameters at certain positions (SIMD vector types
and HVA types are not supported anyway).
When getting the properties of a DatePeriod instance we have to retain
the proper classes, and when restoring a DatePeriod instance we have to
cater to DateTimeImmutable instances as well.
NULL out the execute_data before destroying it, otherwise GC may
trigger while the execute_data is partially destroyed, resulting
in double-frees.
The handling of call stack unfreezing is a bit awkward because it's
a ZEND_API function, so we can't change the signature.
For some reason FD 120 seems to exist on macos quite often, while
FD 12 did not... Let's try an even larger number, otherwise we
should just drop this test.
We need to install a number of additional packages that are installed
by default on the AMD64 workers.
We also have to manually set up the MySQL user.
For now we don't set up Postgres -- if anyone wants to figure that
out, it would be great ;)
Log redirections in compile.sh are removed, because /dev/stdout is
not accessible. We don't see to use this anyway.
Assigning to an uninitialized typed property will no longer trigger
a call to __set(). However, calls to __set() are still triggered if
the property is explicitly unset().
This gives us both the behavior people generally expect, and still
allows ORMs to do lazy initialization by unsetting properties.
For PHP 8, we should fine a way to forbid unsetting of declared
properties entirely, and provide a different way to achieve lazy
initialization.
instanceof_function() requires linked classes. I'm not reusing
unlinked_instanceof() here, because it performs class loading,
which wouldn't be right here, I think.
Parent interfaces are copied into the interface list during
inheritance, so there's no need to perform a recursive check.
Only exception are instanceof checks performed during inheritance
itself. However, we already have unlinked_instanceof for this
purpose, it just needs to be taught to handle this case.
Closes GH-4857.
instanceof_class does not need to check for a NULL pointer in the
first iteration -- passing NULL to this function is illegal.
instanceof_interface does not need to use instanceof_class(), it
only has to check whether the CEs match exactly. There is no way
for an interface to appear inside "parent", it will always be in
"interfaces" only.
The instanceof_interface_only() function was dead code (always
returned zero).
Clarify that the last parameter indicates whether the passed CE
is interface or class and rewrite the code in terms of assertions.
I'm not totally sure, but I have a strong suspicion that the fact
that this produces an error is an artifact of undefined cast behavior
(which will yield INDVAL on x86 but saturate on ARM). INF seems to
be the only value that results in an error even on x86 (variations
like -INF or NAN succeed).
It might make sense to just remove this test entirely, but for now
let's skip it on non-x86.
This stat property seems to be somewhat unreliable depending on the
filesystem. On Travis ARM64 CI a much larger payload is required
to get this value to increase.
Noticed while working on union types: We do not load argument and
return types during type checks, but we do load property types.
I'm normalizing the behavior towards the existing status quo (not
loading), though we may consider loading everywhere (all types,
and instanceof) in order to properly support class aliases.
Fix PHP-FPM failure in the case of concurrent reload attempts.
Postpone signal delivery to the fpm master process till proper signal
handlers are set. Prevent the following case:
- Running master process receives `SIGUSR2` and performs `execvp()`.
- Another `SIGUSR2` is arrived before signal handlers are set.
- Master process dies.
- Requests to the HTTP server handled by PHP-fpm can not be served
any more.
Block some signals using `sigprocmask()` before `execvp()` and early
in the `main()` function. Unblock signals as soon as proper
handlers are set.
Fixes bug #74083
`write_dimension` object handlers have to be able to handle `NULL`
`offset`s; for now we simply throw an exception instead of following
the `NULL` pointer.
Emitting errors is fairly expensive, to the point that parsing
a file with a huge number of invalid tags can take seconds.
Generating ten thousand errors is unlikely to help anybody, but
constitutes a potential DOS vector.
Update array access syntax deprecated in line 175 and 204
Deprecated: Array and string offset access syntax with curly braces is deprecated in /home/alex/php/hello/ext_skel.php on line 175
Deprecated: Array and string offset access syntax with curly braces is deprecated in /home/alex/php/hello/ext_skel.php on line 204
Property types are invariant, but may still have to load classes in
order to check for class aliases. This class loading should follow
the same rules as all other variance checks, rather than just
loading unconditionally.
This change integrates property type invariance checks into the
variance system as a new obligation type, and prevent early binding
if the type check cannot be performed.
This goes in the reverse direction of 4463acb951.
After looking around a bit, it seems that we already check for
Z_ISERROR_P() on the get_property_ptr_ptr return value in other places.
So do this in zend_fetch_property_address() as well, and also make
sure that EG(error_zval) is indeed returned on exception in
get_property_ptr_ptr.
In particular, this fixes the duplicate exceptions that we used to
get because first get_property_ptr_ptr threw one and then
read_property throws the same exception again.
Relying on setting ERROR if an exception happened during the
property address fetch is both a bit fragile and may pessimize
other codepaths that will check for exceptions in the VM. Adding
an extra exception check instead, which should also allow us to
drop the use of ERROR in this area in master.
As of PHP 7.4.0, the `get_property_ptr_ptr` handler is mandatory; we
implement it to always return `NULL`, which is equivalent to not
setting the handler in former versions.
We add a portable and faster test case than what has been presented in
the bug ticket.
After fixing the int->double coercion case, this is already verified
at compile-time, so there is no need to redo this type check on
every call.
Only perform the type check every time for the case of AST default
values.
Previously if the "non well formed" notice was converted into an
exception we'd still end up executing the function.
Also drop the now unnecessary EG(exception) checks in the engine.
Additionally remote a bogus exception in zend_is_callable: It
should only be writing to error, but not directly throwing.
A new function `pcre_get_compiled_regex_cache_ex()` is introduced,
which allows to compile regexp pattern using the "C" locale instead
of a current locale.
This will be needed to replace setlocale() usage in fileinfo,
which is not thread-safe.
Make sure the initialize the result of FETCH_OBJ_UNSET operations.
I'm using a NULL value rather than ERROR here, because the latter
no longer exists in master.
This makes the stream opening actually fail, and avoids assertion
failures when we tokenize with EG(exception) set.
Also avoid throwing an additional warning after an exception has
already been thrown.
`remove_path` points to the given string, so we must not modify it.
Instead we use a duplicate, if we need the modification.
We may want to switch to `zend_string`s in master.
Usually it will already fail when opening, but reads can also
fail since PHP 7.4, in which case we still need to place the
file handle in open_files to make sure the destructor will run
on it.
* pack() only requires one argument
* stream_context_set_option() only requires two arguments
* ReflectionMethod::getClosure() accepts no args for static methods
* DOMDocument::createProcessingInstruction() only requires one arg
* DOMImplementation::createDocument() only requires two arguments
* DOMDocument::importNode() only requires one arg
* mysql_get_client_version() doesn't accept any args,
despite what the docs say...
Otherwise we would try to access an array element of `false`, which
issues a notice as of PHP 7.4.0. This would happen, for instance, for
bug63447_001.phpt if CGI is not available.
The default depth is large enough to cause stack overflows in
msan builds, though apparently only on old clang versions. Avoiding
a stack overflow there requires making the depth *much* smaller,
less than 1000. As I don't think that's reasonable for all the other
setups where 4k works fine, I'm just dropping this part of the test.
This test is somewhat fragile in that it depends on how well a
particular regex is optimized. Apparently on 6.9.1 this regex
would hit the default retry_limit of 1000000 already. I'm limiting
this to 6.9.3 because that's the version that works for me.
This is very similar to the existing mbstring.regex_stack_limit,
but for backtracking. The default value matches pcre.backtrack_limit.
Only used on libonig >= 2.8.0.
This originally manifested as a leak in oss-fuzz #18000. The following
is a reduced test case:
<?php
[
5 => 1,
"foo" > 1,
" " => "" == 0
];
<<<BAR
$x
BAR;
Because this particular error condition did not return T_ERROR,
EG(exception) was set while performing binary operation constant
evaluation, which checks exceptions for cast failures.
Instead of adding this indirect test case, I'm adding an assertion
that the lexer has to return T_ERROR if EG(exception) is set.
Print a more informative message that indicates that this is
likely a permission issue, and also indicate that pcre.jit=0
can be used to work around it.
Also automatically disable the JIT, so that this message is
only shown once.
See bug #78630.
I'm going for a very conservative fix here, where the previous
logic is restored for the case where an object is passed to
method_exists(). We might want to check against EG(scope) instead,
but this seems like a safer choice.
This means that behavior in PHP 7.4 changes only for
method_exists('C', 'privateMethodNotOnC'), which should be sensible.
stream_get-line repeatedly calls php_stream_fill_read_buffer until
enough data is accumulated in buffer. However, when stream contains
filters attached to it, then each call to fill buffer essentially
resets buffer read/write pointers and new data is written over old.
This causes stream_get_line to skip parts of data from stream
This patch fixes such behavior, so fill buffer call will append.
Not NULLing the static_variables pointer for shadow methods during
static var shutdown would be a way to avoid this leak, but unless
there's evidence that inherited private methods with static vars are
actually a common use-case, I don't think we should keep this kind
of fragile edge-case optimization.
Fixes OSS-Fuzz #17875.
To retain legacy behavior I decided to add an option to control request
termination logic. If request_terminate_timeout_track_finished is set,
then request will be tracked for time limits even after
fastcgi_finish_request was called.
This patch depends on the fix provided in BUG 78469 (otherwise php-fpm
workers listening on named pipes on Windows will be erroneously terminated)
(PR #4636)
Add a max_depth option to unserialize and an unserialize_max_depth
ini setting, which can be used to control the depth limit. The
default value is 4096.
This option is intended to prevent stack overflows during the
unserialization of deeply nested structures.
This fixes bug #78549 and addresses oss-fuzz #17581, #17589, #17664,
and #17788.
Around a quarter of all strings in array tokens would have a string that's one
character long (e.g. ` `, `\`, `1`)
For parsing a large number of php files,
The memory increase dropped from 378374248 to 369535688 (2.5%)
Closes GH-4753.
rename_variation2.tmp is ... unsurprisingly ... already used by
rename_variation2.phpt. Alternatively it could be placed in the
directory that the test creates, but maybe this is intended to
test cross-directory renames, so I'll leave it.
Resources used as array keys are generally handled by throwing a
notice and converting the resource to the resource handle. The only
exception is the [$resource => null] syntax, where this was treated
as an illegal offset type instead. However, this also only happened
for VM evaluations, the AST evaluator did handle resources correctly.
Code coverage reports (`make lcov`), since commit eef8522 (7.4 branch),
generates incorrect coverage and emits warnings. Simplifying the
Makefile.gcov file has the side-effect of resolving the issue.
Processing sapi/cli/php_http_parser.gcda
php-src/lcov_data/sapi/cli/php_http_parser.gcda:stamp mismatch with notes file
geninfo: WARNING: gcov did not create any files for php-src/lcov_data/sapi/cli/php_http_parser.gcda!
...
Processing ext/mbstring/mb_gpc.gcda
php-src/lcov_data/ext/mbstring/mb_gpc.gcda:stamp mismatch with notes file
geninfo: WARNING: gcov did not create any files for php-src/lcov_data/ext/mbstring/mb_gpc.gcda!
Closes: https://bugs.php.net/bug.php?id=52718.
See also: https://bugs.php.net/bug.php?id=78288.
If count is ZEND_LONG_MIN the count-- loop underflows. This is
ultimately harmless, but results in a ubsan warning.
Fix this by adding a sanity check that the count isn't negative,
because that doesn't make sense...
This fixes two issues:
* Negative the value in an unsigned type to avoid signed overflow.
* Treat -0 as 0 rather than an invalid number that gets converted
to ZEND_LONG_MIN.
This fixes two leaks related to duplicate tags, as well as a leak
of zero-length FMT_(S)BYTE with non-null value. This can show up
for MAKERNOTE values where the original length is non-zero, but
the first character is a null byte.
mb_decode_numericentity() accepts a fourth optional parameter, which is
unused, however. Since this parameter doesn't do any harm, and to avoid
the small BC break, we're keeping this parameter for PHP 7, but adjust
the arginfo.
For PHP 8, we will remove this parameter.
This issue was recently introduced in c739023a50,
when the restriction that components>0 has been relaxed. We now need
to make sure that any tags that expect at least one component check
that this is the case.
Don't use <value> type for JSON tokens that don't have a value
and remove the errlex productions -- we're going to get an
unexpected token error anyway, there's no need to handle these
explicitly.
This also removes the awkward workarounds for the unused value
warnings.
This is intended to fix the primary issue from bug #77260.
Prior to macOS 10.14 multiple MAP_JIT segments were not permitted,
leading to mmap failures and corresponding "no more memory" errors
on macOS 10.13.
libsodium measures the memory cost in bytes, while password_hash() and
friends expect kibibyte values. We have to properly map between these
scales not only when calling libsodium functions, but also when
checking for allowed values.
We also refactor to rid the code duplication.
To clean up the mess here a bit, check for invalid octal digits
with an explicit loop instead of mixing this into the string to
number conversion.
Also clean up some type usage.
The ZEND_ALLOCATOR() macro compares against constants that are
larger than the unsigned short type, resulting in warnings on
clang. Avoid this by explicitly casting to size_t.
This makes sure that we use compiler builtins when they are
available and thus avoid ubsan warnings in clang.
And also reindent the fallback implementation.
zend_emit_op_data may reallocate the op_array, so the assignment
of the RETURNS_FUNCTION flag may happen on an outdated opline.
Restructure the code a bit to set the flag before calling
zend_emit_op_data().
When calling free_result_buffers(), also free field metadata and
restore the mempool state to what it was before any allocations
have been made. Remove the mempool save/restore logic for the
inner result set as this is now handled on a higher level.
This is a fix for symfony/symfony#32995.
The behavior is:
* Throwing exception when loading parent/interface is allowed
(and we will also throw one if the class is simply not found).
* If this happens, the bucket key for the class is reset, so
it's possibly to try registering the same class again.
* However, if the class has already been used due to a variance
obligation, the exception is upgraded to a fatal error, as we
cannot safely unregister the class stub anymore.
The requirements for parent/interface are difference than for the
variance checks in type declarations. The latter can work on fully
unlinked classes, but the former need inheritance to be essentially
finished, only variance checks may still be outstanding.
Adding a new flag for this because we have lots of space, but we
could also represent these "inheritance states" more compactly in
the future.
Perform PHPUnit installation under php7.3 -- which will also make
it work on master.
Also properly resolve the tty issue by specifying excluded groups
during the test run.
The state returned by `sodium_crypto_generichash_init()` has to be
regarded as opaque byte string; neither its size nor its exact
structure are fixed, and actually vary for diffent libsodium versions.
Therefore we drop the test altogether.
microtime() doesn't return an array,
and gettimeofday() doesn't return a string.
See _php_gettimeofday in microtime.c (mode is non-zero for gettimeofday)
Most bundled libraries in PHP code already include license information
in the dedicated README.REDIST.BINS file. Instead of complicating
documentation files more this patch only updates the PCRE license info
in the readme file.
The newest version we're checking (libssldap50) seems to be about
15 years out of date. We could add support for libssldap60 (also
unmainted, but more recent), but given how nobody has expressed any
interest in this, I'm going ahead and dropping this code.
Split the default and custom path case. If the default is used,
assume that the library must be on the default include and lib path.
Only check that the version is appropriate.
Something similar is needed for ldap, but the checking code is much
more complex there, so I'm only adding a workaround for now.
We need to make sure that the function is fully compiled before we
calculate the stack size. There already was a check for directly
recursive calls, but the same issue exists with indirectly recursive
calls.
I'm using DONE_PASS_TWO as the indication that the function is
fully compiled.
There are two related changes here:
1. Also check for S_ISCHR/FILE_TYPE_CHAR when checking for pipes, so
that we detect ttys as well, which are also not seekable.
2. Always set position=-1 (i.e. ftell will return false) when a pipe
is detected. Previously position=0 was sometimes used, depending on
whether we're on Windows/Linux and whether the FD or FILE codepath
was used.
The exception mechanism assumes that exceptions from DO_FCALL are
already happening after the function call. This means that we are
currently leaking the passed arguments, and I think we can also
corrupt the VM stack due to incorrect frame linking in some cases
(there are assertion failures if the VM stack page size is reduced).
Instead handle the stack frame freeing manually for this special
case.
(excluding spl_autoload)
spl_object_id() is of the most interest to me,
since I frequently call it in an application.
This includes false/null types caused by wrong argument types and wrong argument
counts.
I can't rule out iterator_to_array returning null in spl_iterator_apply,
so leave MAY_BE_NULL in.
With review comments by nikic:
Co-Authored-By: Nikita Popov <nikita.ppv@googlemail.com>
When stored procedures are called, the "final result set is a status
result that includes no result set". Calling `::nextRowset()` on the
actual last result set should return FALSE, since there is actually no
further result set to be processed.
It can return false if the resource type is wrong.
```
php > var_export(hash_update_stream(hash_init('md5'),
imagecreate(1,1)));
Warning: hash_update_stream(): supplied resource is not a valid stream
resource in php shell code on line 1
false
```
The return types were initially added in
c88ffa9a56
fcgi_accept_request function is supposed to call a FastCGI implementation's
on_accept hook when entering an "accepting" stage (that is right before
calling "accept"). This hook implementation (fpm_request_accepting) updates
a worker state to an "accepting" state which is effectively an "Idle" state,
and updates counters on the scoreboard of the corresponding pool (idle++,
active--).
But this is not done when listening for client connections on a named pipe on
Windows platform. In that case a combination of
ConnectNamedPipe/WaitForSingleObject is used (to be able to catch in_shutdown
as far as I understand), but it is nonetheless functionally equivalent to
"accept" call. Also by not calling on_hook neither a worker's state is updated
to "accepting" state nor scoreboard counters are updated.
Run some open-source projects through an aggressive debug
configuration with asan and ubsan. We don't care about test results,
only check that we don't assert or crash.
Currently testing laravel, symfony and amp.
When building PHP outside of the source tree:
mkdir custom-build-dir
cd custom-build-dir
../path/to/php-src/configure
The directories need to be manually created including the pear directory
so the pear installation PHAR file doesn't need to be downloaded from
the remote location.
Closes GH-4639
While we don't need to give this method separate static vars, we
do still need to perform an addref, as there will be a corresponding
delref in the dtor.
The properties HT may be a GC root itself, so we need to remove it.
I'm not sure this issue actually applies to PHP 7.2, but committing
it there to be safe. As seen from the test case, the handling here
is rather buggy on 7.2.
These flags have been deprecated in glibc 2.28, so we also
deprecate them in PHP.
As we can't deprecate constants, we can only check for their use
in socket_addrinfo_lookup().
This can also return an array. See
https://www.php.net/manual/en/function.time-nanosleep.php#refsect1-function.time-nanosleep-returnvalues
> If the delay was interrupted by a signal, an associative array will be
returned with the components:
>
> - seconds - number of seconds remaining in the delay
> - nanoseconds - number of nanoseconds remaining in the delay
Sending a SIGUSR1 to the below program would trigger this behavior.
```
pcntl_signal(\SIGUSR1, function ($signo, $signinfo) {
echo "Handling a signal $signo\n";
});
echo "Sleeping for 100 seconds\n";
var_export(time_nanosleep(100, 0));
```
The incomplete signature existed since c88ffa9a5.
No phpt tests existed for time_nanosleep returning an array
Due to overflows in the memory limit checks, we were missing cases
where the allocation size was close to the address space size, and
caused an OOM condition rather than a memory limit error.
Only deprecate unbinding of $this from a closure if $this is
syntactically used within the closure.
This is desired to support Laravel's macro system, see laravel/framework#29482.
This should still allow us to implement the performance improvements
we're interested in for PHP 8, without breaking existing use-cases.
Also remove the hack where scope is set to NULL in order to make
free_internal_arg_info work. Instead explicitly call it for class
methods.
This fixes the asan build for Zend/tests/bug77494.phpt.
This allows us to drop the intermediate allocation for
spl_pqueue_elem.
This fixes GC for SplPriorityQueue, because we can now directly
return a well-formed GC child buffer.
As of PHP 7.3.0, the rules regarding the heredoc and nowdoc closing
identifier have been relaxed. While formerly, the closing identifier
was required to be placed at the beginning of a line and to be
immediately followed by (a semicolon and) a line break, it may now be
preceeded by whitespace, and may be followed by any non-word character.
We adjust the recognition logic respectively.
When storing two temporary variables for delayed __unserialize() calls,
we have to make sure that both fit into the same linked list element.
To that end we introduce the internal API `tmp_var` which allows to
reserve `num` slots in the same list element.
We also fix the `var_dtor_entries` struct definition to use the proper
size, namely `VAR_DTOR_ENTRIES_MAX`.
We must not assume that any file which is not a directory is a regular
file. Therefore we employ `GetFileType()` in this case to properly
distinguish between character special, FIFO special and regular files.
As of Windows 1903, when the OneDrive on-demand feature is enabled, the
OneDrive folder is reported as reparse point by `FindFirstFile()`, but
trying to get information about the reparse point using
`DeviceIoControl()` fails with `ERROR_NOT_A_REPARSE_POINT`. We work
around this problem by falling back to `GetFileInformationByHandle()`
if that happens, but only if the reparse point is reported as cloud
reparse point, and only if PHP is running on Windows 1903 or later.
The patch has been developed in collaboration with ab@php.net.
We should keep an eye on the somewhat quirky OneDrive behavior, since
it might change again in a future Windows release.
In PHP 7.3 shadow properties are no longer duplicated. Make sure we
only release them if the property was defined on the parent class,
which means that it changed from private->shadow, which is where
duplication does happen.
This removes an incorrect optimization (I think this code used to be
necessary to properly handle references in the Serializable based
implementation, but now this code just avoids an array duplication
in a way that is not sound).
For objects with destructors, we will now only call the destructor
in the initial GC run, and remove any nested data. The object is
marked purple so it will be considered a root for the next GC run,
at which point it will be fully destroyed, if possible.
GC counts change on a number of tests, as the objects now get
destroyed later.
This is likely going to end up interned lateron at some point
when the new_name is referenced somewhere. However, it may be
that there are some uses that do not get interned before that.
In this case we will intern a string that already have zval
users, without updating the refcounted flag on those zvals.
In particular this can happen with something like [Foo::class],
where Foo is an imported symbol. The string it resolves to won't
get interned right away, but may be interned later.
use Foo as Bar;
$x = [Bar::class];
var_dump(Bar::X);
debug_zval_dump($x); // Will show negative refcount
class Foo {
const X = 1;
}
However, this doesn't really fix the root cause, there are probably
other situations where something similar can occur.
Checking for the exact linker version appears to be too restrictive; it
should be fine if the tens match.
We also refactor to avoid repeating ourselves.
The fix for bug #78241 assumed that `time_t` would always be 64bit, but
actually is 32bit for x86. We therefore enforce 64bit arithmetic to
avoid wrapping.
(cherry picked from commit bf242d58e7)
When the strip tags state machine has been flattened, an if statement
has mistakenly been treated as else if. We fix this, and also simplify
a bit right away.
The fdatasync check has been removed since PHP 5.3.
The Solaris fix was introduced via
8d63360fc4
and is today no longer relevant since the sqlite library is neither
bundled in php-src anymore neither the check needs to be done via the
PHP build system.
Closes GH-4485
Make sure that fpm_event_add calls inside a timer callback work by
unregistering the event from the queue before invoking its callback.
The read timeout in tester.inc is increased because the added test
needs two seconds (one for SIGTERM, one for SIGKILL) until the
reload succeeds, so we should wait longer than that for a response.
Argument unpacking may need to create references inside the array
that is being unpacked. However, it currently can only do this
if a plain variable is unpacked, not for any nested accesses,
because the value is fetched for read. Resolve this by fetching
the operands for RW.
We have to properly clean up in case phar_flush() is failing.
We also make the expectation of the respective test case less liberal
to avoid missing such bugs in the future.
There are a few parts here:
* opcache should not be blocking signals while invoking compile_file,
otherwise signals may remain blocked on a compile error. While at
it, also protect SHM memory during compile_file.
* We should deactivate Zend signals at the end of the request, to make
sure that we gracefully recover from a missing unblock and signals
don't remain blocked forever.
* We don't use a critical section in deactivation, because it should
not be necessary. Additionally we want to clean up the signal queue,
if it is non-empty.
* Enable SIGG(check) in debug builds so we notice issues in the future.
The smart branch logic assumed b->start refers to the old offsets,
while b->start was already adjusted to the new offsets at this
point. Delay the change until later.
When performing a constant visibility check during compilation we
might be dealing with unlinked classes and as such should account
for the possibility of unresolved parents.
Even if we know the file size, we still need to read in a loop in
case the read call returns an incomplete result.
This was less of an issue previously because we did not use the
"one large read" approach for non-plain stream wrappers.
These two files have been: "UTF-8 Unicode (with BOM) text".
By applying `dos2unix` on these files the BOM has been removed.
I checked the whole source code with dos2unix:
These were the only two text files affected.
This was added in 7.1 when add_assoc_string mistakenly accepted
a char* rather than const char* parameter and is no longer needed.
We can use SSL_CIPHER_get_version() directly.
Make sure we deref the OBJ_IS result, because we store it in a TMP
var, which is not allowed to contain references and will cause
assertion failures in the unspecialized VM.
This also partially reverts fd463a9a60,
which merged the TMP and VAR specializations of COALESCE to work
around this bug.
An alternative would be to change the result type of OBJ_IS back
to VAR.
By avoiding unused variable opline warnings. Also clean up the
replacement of ZEND_VM_SPEC -- we were sometimes treating it as
an always-defined constant with a value (what it actually is) and
sometimes as a conditionally defined constant (which it isn't, but
which still worked thanks to the specializer). Switch to only
treating it as a constant with a value.
Symbols are not used in the current code.
Also remove not needed ocijdbc8 library addition and checks whcih were
removed also via b8e1d4d4e5 so Oracle 8
is no longer supported.
Closes GH-4454
The php_stream_read() and php_stream_write() functions now return
an ssize_t value, with negative results indicating failure. Functions
like fread() and fwrite() will return false in that case.
As a special case, EWOULDBLOCK and EAGAIN on non-blocking streams
should not be regarded as error conditions, and be reported as
successful zero-length reads/writes instead. The handling of EINTR
remains unclear and is internally inconsistent (e.g. some code-paths
will automatically retry on EINTR, while some won't).
I'm landing this now to make sure the stream wrapper ops API changes
make it into 7.4 -- however, if the user-facing changes turn out to
be problematic we have the option of clamping negative returns to
zero in php_stream_read() and php_stream_write() to restore the
old behavior in a relatively non-intrusive manner.
epoll event backend does not guarantee that child input/output events
are reported before SIGCHILD due to finished worker. While a bunch of
events received by epoll is being processed, child-related structures
may be removed before dispatching of an I/O event for the same child.
The result may be attempt to access to memory region allocated for
another purpose, segfault of the master process, and unavailable web
sites.
Postpone processing of SIGCHILD events till other events in the same
bunch are processed.
Fix Bug #62418 php-fpm master process crashes
Fix Bug #65398 Race condition between SIGCHLD and child stdout/stderr event leads to segfault
Fix Bug #75112 php-fpm crashing, hard to reproduce
Fix Bug #77114 php-fpm master segfaults in fpm_event_epoll_wait/fpm_event_fire
Fix Bug #77185 Use-after-free in FPM master event handling
First step when creating the `configure` script is currently using
make. This is helpful when developing buildsystem to only rebuild
`configure` and `main/php_config.h.in` files when one of the *.m4
or configure.ac file changes and saves the developer time a little.
Realistically however, it is not needed that much considering the
times of several seconds to fully rebuild the configure script and
configuration header. The next step when running the `configure`
script is much more time consuming so performance on buildconf
level is a bit questionable and won't be noticed on today's
systems.
Additionally:
- buildconf now removes cache and all targets and uses -f option on
the first step i.e. autoconf. The autoheader does not need the -f
option in this case.
Closes GH-4437
- HAVE_NET_SNMP removed via cab643f615
- HAVE_CRYPTO_AEAD_AES256GCM ad120c5ae9
- Remove HAVE_FREETDS and HAVE_LIBDNET_STUB (not used in current
extension; copy paste from other removed extensions)
Closes GH-4448
1. falls in an infinite loop because PHP engine's inconsistent state, now override the ITIMER_PROF to 0.1 second, clean shutdown must finish before that.
2. generate too much error log, we completely disable "error_reporting" before calling php_request_shutdown().
- when $status is boolean, E_NOTICE appears and tests fail
- opcache is never enabled on these tests anyway.
- Add opcache.revalidate_freq=0 to testing script
Instead of checking this in the tests files it can be used directly in
the main testing script. Also this fixes failed tests.
- Use opcache_invalidate() instead of sleep() delay in some tests. Some
delays are still used since the opcache_invalidate seems to be buggy
and not working as expected.
Closes GH-4392
Oniguruma is exclusively used by ext/mbstring, and only if mbregex is
enabled. Therefore it is unnecessary and confusing to have Oniguruma
related config stuff scattered elsewhere.
While we're at it, we also remove the referral to the bundled libonig
which is removed as of PHP 7.4.0, and the duplicated call to
`PHP_INSTALL_HEADERS()`.
The classic Windows console only supports the Unicode BMP, so it can't
handle the LIGHTNING MOOD character (U+1F5F2). It also seems that
common fonts do not support the LIGHTNING (U+2607) character, so a
general removal is appropriate.
However, Windows is already "ready for the future"[1], but PHP for
Windows is not (yet).
[1] <https://devblogs.microsoft.com/commandline/windows-command-line-unicode-and-utf-8-output-text-buffer/>
ext/win32std is unmaintained for years, so it is highly unlikely that
it is available. We therefore use regedit instead to register the
event source. We also remove the bundled syslog.reg, since it is of no
use, unless generated for the respective installation.
Used in php-src the past and today removed and not used anymore:
- HAVE_CURL_EASY_STRERROR
- HAVE_CURL_MULTI_STRERROR
- HAVE_NEW_MIME2TEXT
- HAVE_MBSTR_CN
- HAVE_MBSTR_JA
- HAVE_MBSTR_KR
- HAVE_MBSTR_RU
- HAVE_MBSTR_TW
Part of oniguruma which doesn't use these anymore
- NOT_RUBY
- HAVE_STDARG_PROTOTYPES
Unused:
- HAVE_MPIR
Closes GH-4427
Formerly, there was at most a single OPcache instance per user and the
so called system ID (which is determined from the PHP version).
Sometimes multiple OPcaches might be desired, though, particularly for
unrelated CLI scripts, which may even be necessary (e.g. for our test
suite in parallel mode).
We therefore introduce a new INI directive `opcache.cache_id` which
allows to configure independent OPcache instances for the same user.
We also use `GetUserNameW()` instead of `php_win32_get_username()`,
because the latter retrieves the user name encoded in the
`default_charset`, which can obviously yield different results for
different charsets, leading to OPcache "incompatibilities". Slightly
worse, some characters may not even be encodeable in the
`default_charset` and would be replaced by question marks, which could
result in different users sharing the same OPcache.
We also refactor, and re-use existing APIs to avoid duplicated code.
This reverts commit cc44bad1f6, since its
assumptions were not correct. Actually, the classic event logging is
still used by PHP, because Windows 7 is still to be supported for a
while. Without the respective registry entries, the event log entries
show an error message regarding missing ID descriptions.
Thanks to ab@php.net for hinting at this!
Obviously, the part depending on ext/win32std has still to be
overhauled, and further improvements are conceivable; we will address
this in due course.
By adding a flag to avoid forced fstat for includes. The two fstats
will happen back to back and we don't care about a possible
invalidation.
I was hoping to move this higher up in the stack and make the
ISREG check somewhere in fsizer of fixup, but this doesn't really
seem to be possible. E.g. an FP stdin handle will not be a regular
file but of course needs to be allowed. Additionally custom stream
wrappers may not implement this functionality.
If we're including a file via PHP streams, we're not going to trust
the reported file size anyway and populate in a loop -- so don't
bother determining the file size in the first place. Only do this
for non-tty HANDLE_FP now, which is the only case where this
information was used.
Disable buffering in PHP streams, to avoid storing and copying the
file contents twice.
This will call stream_set_option() on custom stream wrapper as
well, so the method needs to be implemented to avoid a warning.
- yp_get_default_domain was part of ext/yp
- functions checks produce HAVE_function_name symbols. These checks are
currently not used in php-src neither in the extensions out there.
- Removed symbols because they are not used in the code:
- HAVE_GCVT
- HAVE_PUTENV
- HAVE_PUTENV
- HAVE_SETVBUF
- HAVE_TEMPNAM
- HAVE_SIN (sin is also defined in C89 standard)
- HAVE_SETSOCKOPT
- HAVE_LOCKF
- HAVE_ISASCII
- HAVE_YP_GET_DEFAULT_DOMAIN (and other yp extension related unused checks)
- HAVE_LINK
- HAVE_USLEEP is already defined in Windows configuration header
- HAVE_LIBBIND has not been used in php-src for a while anymore
- HAVE_GETHOSTNAME is duplicated in Windows configuration header
Closes GH-4417
Using mmap() is unsafe under concurrent modification. If the file
is truncated, access past the end of the file may occur, which will
generate a SIGBUS error. Even if the length does not change, the
contents may, which is a situation that the lexer certainly is not
prepared to deal with either.
Reproduce with test.php:
<?php
file_put_contents(__DIR__ . '/test.tpl',
'AAA<?php $string = "' .
str_repeat('A', mt_rand(1, 256 * 1024)) .
'"; ?>BBB' . "\r\n");
require_once __DIR__ . '/test.tpl';
And:
for ((n=0;n<100;n++)); do sapi/cli/php test.php & done
Instead of handling shebang lines by adjusting the file pointer in
individual SAPIs, move the handling into the lexer, where this is
both a lot simpler and more robust. Whether the shebang should be
skipped is controlled by CG(skip_shebang) -- we might want to do
that in more cases.
This fixed bugs #60677 and #78066.
Since mysqlnd is solely developed in the php-src repository, it makes
not much sense to have its own version number, particularly since
nobody cares to update it. Therefore we use PHP's version number, but
stick with the "mysqlnd" prefix which can be important to distinguish
the mysqli driver (libmysqlclient vs. mysqlnd).
On this benchmark:
function simple_string_escape() {
$a = "test'asd'asd'' asd\'\"asdfasdf";
for($i=0; $i<512; $i++) {
$a .= chr($i%256);
}
for ($i = 0; $i < 100000; $i++) {
if ($a === stripslashes(addslashes($a)))
$a .= chr($i%256);
else {
echo "error at i=".$i."\n";
return;
}
}
}
the execution time goes from 21.619s to 8.139s (165% speedup) on an A1 Graviton instance.
When removing the characters that need escaping, i.e., this benchmark:
function simple_string() {
$a = "testasdasd asdasdfasdf";
for ($i = 0; $i < 10000; $i++) {
if ($a === stripslashes(addslashes($a)))
$a .= "test dedeasdf";
else {
echo "error at i=".$i."\n";
return;
}
}
}
the execution time goes from 2.932s down to 0.516s (468% speedup) on an A1 Graviton instance.
New opcache directives have been added recently which are returned
if using `ini_get_all('zend opcache')` but are not listed in the
directives if using `opcache_get_configuration()`. This fix adds
those missing directives as well as if `opcache.mmap_base` is used
instead of `opcache.lockfile_path`. Also adds a test to ensure the
directives match with both methods of fetching.
The undef PTHREADS converts to define if thread safety is configured.
This step is already done by pthreads m4 macros from TSRM so this now
removes duplicated PTHREADS defines from php_config.h.
This test does not work on Windows, if the child process has OPcache
enabled via php.ini, since TEMP is not set in the environment, so
OPcache can't find the base address file, and terminates the childs.
To avoid this (and potentially some other issues regarding missing
environment variables, such as PATH), we force the child process to
ignore any ini files.
The fix for bug #78241 assumed that `time_t` would always be 64bit, but
actually is 32bit for x86. We therefore enforce 64bit arithmetic to
avoid wrapping.
- Checks and defines are not relevant for files that include it anymore
- Some code is not used anymore
- Defines are a bit duplicated in zend_portability.h and TSRM.h file
- MAXPATHLEN defs moved to zend_virtual_cwd.h
This adds support for doing something like:
[1 => ['pipe', 'w'], 2 => ['redirect', 1]]
This will make descriptor 2 on the child end a dup'd descriptor 1.
This is mainly useful in conjunction with shell-less mode, because
we don't have an easy way to do "2>&1" there.
Additionally we support:
[1 => ['pipe', 'w'], 2 => ['null']]
Which would be the same as a >/dev/null or >nul redirect, depending
on platform.
export() methods were implemented in a roundabout way, where they
would call Reflection::export(), which would then call __toString().
Cut out the middleman by directly calling __toString().
The test currently assumes that we'll first read the data of
stdout and stderr and then see eof on stdout and stderr. However
we could also read stdout, see eof on stdout, read stderr and see
eof on stderr, depending on timing.
Avoid output ordering issues by collecting events into a per-pipe
array, so interleaving is not visible.
The time goes from 0.838s down to 0.029s (a 28x speedup) on a Graviton A1
instance and the following benchmark:
function simple_crc32() {
$a = "foo";
for ($i = 0; $i < 10000; $i++) {
crc32($a);
$a .= "o".$i;
}
}
Instead of patching configuration headers template generated by
the given tools - autoheader, this moves patching these symbols to
the configure step before creating and invoking the config.status
and before the configuration header file is generated from the
patched template.
Closes GH-4374
When cleaning nops in the dfa pass, we were always keeping the
smart branch inhibiting nop that occurs directly before the jump
instruction. However, as we skip unreachable blocks entirely, it
may happen that we need to keep a nop that occurs further back,
prior to the unreachable blocks. Account for that case now.
We should really do something about the smart branch situation,
this is very fragile...
No notice is thrown for list() accesses, because we did not come
to an agreement regarding patterns like
while ([$key, $value] = yield $it->next()) { ... }
where silent null access may be desirable.
No effort is made to suppress multiple notices in access chains
likes $x[0][0][0], because the technical complexity this causes
does not seem worthwhile.
RFC: https://wiki.php.net/rfc/notice-for-non-valid-array-container
- Git is used for moving existing extensions to PECL
- PHP versions with the PHP 7.4 examples
- Some minor tweaks here and there
- Mention re2c also
- Mention Docker image as a helper tool
And don't return null for rc=1 references. Leave it to the user
to decide whether or not they want to consider these as references
or not.
Fixes bug #78263.
Changes:
- Coding style fixes
- ${1+"$@"} replaced with "$@" [1]
- EXTRA_MODULE_PTRS variable is not used anymore
- awk tool defined via environment variable
- srcdir determined automatically from the genif.sh location
[1] https://www.in-ulm.de/~mascheck/various/bourne_args/
Closes GH-4372
Another stab in the dark to fix the intermittent failures of timeout
tests on macos CI: We're using ITIMER_PROF, which means that the
timer counts against user+system time. The "busy" wait loop counts
against real time. Currently it calls microtime() on every iteration.
If that call is implemented as a syscall rather than going through
vDSO or commpage we might be seeing many context switches here which
drive up the real time, but not user or system time.
See if making the loop busier and calling microtime() less helps the
situation.
These are part of the C89 and on today's systems not needed to be
checked anymore. This removes symbols HAVE_SIGNAL and HAVE_STRERROR.
- http://port70.net/~nsz/c/c89/c89-draft.html
- locale.h is also part of C89 but will be removed per request in PHP 8
This simplifies the libmagic patch:
- in upstream the HAVE_STRERROR check has been removed
- in upstream library the HAVE_SIGNAL_H has been removed
- indentations syncs with the upstream library
- some irrelevant changes removed from the patch (log comment), upstream
has this correctly logged already so no need to patch the comment.
Closes GH-4298
While it is already possible to *set* CFLAGS and LDFLAGS (actually all
variables) from the environment for `nmake` (by passing the `/E`
option), it is not possible to *add* any (C|LD)FLAGS, which can be
useful in some cases. Instead of allowing this for `nmake`, we add
support for additional custom (C|LD)FLAGS to `configure`, similar to
how that works on Linux, so one could actually write:
````
set CFLAGS=foo & set LDFLAGS=bar & configure
````
This also allows us to use these flags during configure.
Although TsHashTable and the according API are supposed to easily make
a HashTable thread-safe, they do not; for instance, there can be race
conditions between finding and updating entries. We therefore avoid
the usage of TsHashTable in favor of a HashTable with our own mutex
management.
The patch has been provided by krakjoe@php.net; I only did some minor
fixes and tweaks.
- Variables php_abs_top_srcdir php_abs_top_builddir are no longer used.
- ZEND_EXT_TYPE is always zend_extension and variable is no longer used.
Closes GH-4378
This simplifies TSRM build steps a bit and avoids doing unnecessary
steps:
- The `PTHREADS_CHECK_COMPILE` can called inside the for loops only
since this is only where the `$pthreads_checked` variable is used.
- Assigning variables can be then done only in the configure.ac
once.
- use `m4_include()` instead of the `sinclude()` in the middle of
the build steps.
- The `$threads_result` variable is not used in the code or in
extensions.
This test hangs on Windows for ~10 minutes as of commit 30019f4, so we
temporarily skip it. The issue will be investigated by Joe and myself
in due course.
Conditional function declaration may be referenced by functions or
classes that have been preloaded, so we should not move them back
to scripts.
What we probably should be doing though is to discard conditional
functions that are not used in the optimizer. This is probably
reasonably common for polyfills, where we will be able to const-eval
the conditions and drop the BBs declaring the functions, but won't
delete the function declarations themselves.
LITERAL_VALUE with related literals cannot be merged, avoid inserting
them in the literals hash in the first place. Otherwise we may end up
inserting the same key multiple times. We may also miss merging
opportunities due to the duplicate keys.
Check whether there is a parent/interface/trait method with the same
name and only then require the type to be known. This reduces the
number of cases where this triggers in practice a lot.
The output of the three handles may be interleaved. We already have
curl_basic_018.phpt which uses curl_multi_getcontent() and thus
has predictable output. As such, I'm dropping this test altogether.
`time_t` defaults to `_time64` (which is 64bit signed) even on x86, but
`Int32x32To64()` truncates it to signed 32bit. We replace the macro
with the "manual" calculation.
This adds the Autoconf's --enable-option-checking=fatal option so
when non existing option from the PHP's configure options is used
a fatal error happens.
Instead of building a custom macro for checking configure options,
Autoconf 2.62+ already outputs a warning at the beginning and the end
of the output of configure script. It automatically detects correct
and wrong options better.
This is related also to bug #55634.
So now instead a better way is the default Autoconf approach:
This outputs a warning at the beginning and end of the configure output:
./configure --with-non-existing
This results in fatal error:
./configure --non-existing
configure: error: unrecognized option: `--non-existing'
Try `./configure --help' for more information
The `--enable-option-checking=fatal` results in fatal error for all non
existing options:
./configure --with-non-existing --enable-option-checking=fatal
configure: error: unrecognized options: --with-non-existing
Closes GH-4348
opcache incorrectly handles PHAR files when opcache.validate_permission
option enabled, because it calls
access("phar://path-to/file.phar/path/inside.php", R_OK);
rather than
access("path-to/file.phar", R_OK)
This uses a separate job template, because msan requires all used
libraries (apart from glibc) to be instrumented, so we can't link
any external libraries unless we recompile them. As such, we need
a much more minimal configure.
This test is easily tripped by former test runs with other PHP
versions. To avoid such false positives, we check that there is at
least one respective OPcache file, and that all found OPcache user ID
folders have exactly 32 hexadecimal digits.
This macro is not needed anymore. The AC_PROG_CC is done in the main
configure.ac file and the ranlib check is done by the bundled libtool
macros.
Closes GH-4339
The following functions don't need to be checked anymore since the
they are not used across the code or the symbols aren't used anymore:
- cuserid (not used)
- lrand48 (not used and removed via
6d6ef7aacc)
- random (check is not used)
- srand48 (not used)
- srandom (not used)
- strdup (check is not used)
and the unused check symbols:
- HAVE_CUSERID
- HAVE_LRAND48
- HAVE_RANDOM
- HAVE_SRAND48
- HAVE_SRANDOM
- HAVE_STRDUP
Closes GH-4338
The result of this check is to whether to define the HAVE_CMSGHDR symbol
or not. The HAVE_CMSGHDR is never used in the code and it has been
removed via 90289924c0.
Closes GH-4337
It would be great if this were fully initialized, but it's not
really a problem either (as long as we don't care about reproducible
file cache), so ignore this for now.
This has been sporadically failing on macos for a while. We've tried
a couple of things (using int arithmetic, normalizing to gettimeofday),
but this issue remains. I'm adding some tolerance to the test to
avoid CI failures.
Removed unused checks:
- mbsinit check removed, HAVE_MBSINIT removed (not used in php-src)
- mempcpy check removed, HAVE_MEMPCPY removed (not used in php-src anymore since
560ed89bfb which uses PHP's own implementation)
- strpncpy check removed, added via a8c9e893b6 and
not used.
- setpgid check removed since HAVE_SETPGID is not used
Moved to a central configure.ac:
- fpclass
- mbrlen moved to configure.ac (since the HAVE_MBRLEN is used accross the php-src)
- sigprocmask
- getcwd
- getwd
- glob
- strfmon
- nice
Duplicated checks removed:
- gethostname
- getlogin
- getpwuid_r
- socketpair
- mprotect check simplified
These were part of the following decomissioned extensions:
- PHP_SYBASE part of the sybase extension
- PHP_MSQL_* part of the msql extension
- PHP_APACHE_* symbols were used in apache and apache_hooks sapis
- PHP_FHTTPD_* symbols part of old sapi/fhttpd
- PHP_MYSQL_* symbols were part of the legacy mysql extension
- Remove PHP_ORACLE_* symbols
These were part of the obsolete oracle extension that was moved to PECL
via f35af61ef8.
- PHP_OCI8_SHARED_LIBADD and PHP_OCI8_DIR were removed via
c33f88ccb0
And other are not used anywhere across the php-src codebase
The limits.h header is part of the C89 and is today available
everywhere. There is no need to check for presence of this header
anymore.
The timelib has already been patched upstream via
aae5907cb7
PHP extensions out there shouldn't rely on symbols defined during the
build anyway and neither they do on this particular symbol anymore.
Just marking them as no_sanitize("memory") is unforunately not
sufficient, as the function still gets instrumented -- the attribute
only disables reporting.
Also adds an --asan flag to run-tests.php to setup all the necessary
environment variables. Some tests are marked as skipped because they
are incompatible with asan or too slow.
I'm basing this on the DEBUG_ZTS build, which seems to give us the
most mileage.
Available under -DZEND_TRACK_ARENA_ALLOC. This will use the system
allocator combined with arena checkpointing & release semantics
and allows analyzing arena usage under asan/valgrind.
I've sacrificed the duplicate arena implementation in mysqlnd, as
the integration with mysqlnd alloc is not worth the code duplication
to me.
In this case the progarm will be executed directly, without a shell.
On Linux the arguments are passed directly to execvp and no escaping
is necessary. On Windows we construct a command string using escaping
with the default Windows command-line argument parsing method described
at https://docs.microsoft.com/en-us/cpp/cpp/parsing-cpp-command-line-arguments.
Apart from avoiding the issue of argument escaping, passing an array
and bypassing shell has the advantage of allowing proper signal
delivery to the opened process (rather than the shell).
The actual leak is observed in ext/pdo_mysql/tests/bug_74376.phpt.
The persistent connection leaks because a refcount decrement on a
result is missed. The refcount decrement is missed because
free_result_contents is used, rather than free_result.
Looking at other uses of free_result_contents, it looks like they
could also suffer from this problem. Apart from one case,
free_result_contents is always used to release the result entirely
(I've adjusted the one differing case to only free meta), so I'm
moving most of the logic from free_result into free_result_contents.
The only difference is now that free_result will skip_result first.
If we're testing ini settings that cause startup failures, we'll
never get to that SKIPIF block...
Also change settings2param to return a value instead of modifying
(to a different type no less!) in place.
The strcoll function is defined in the C89 standard and should be
on today's systems always available via the <string.h> header.
https://port70.net/~nsz/c/c89/c89-draft.html#4.11.4.3
- Remove also SKIPIF strcoll check in test
The hash extension is always available since PHP-7.4. The symbol
HAVE_HASH_EXT is kept for BC reasons and removed in PHP-8.0.
This patch also removes the PHAR_HASH_OK since it is no longer
relevant.
In particular, make sure that everything using zmm is released
before zmm is shut down. phpdbg currently gets away with this,
because either a) its custom handlers are used and no auto-free
happens or b) the system allocator is used and no auto-free happens.
With the tracking allocator for asan this no longer works.
In this case we will use the system allocator, but still remember
all allocations and free them the same way that Zend MM does. This
allows us to accurately model leak behavior.
Enabled using USE_ZEND_ALLOC=0 USE_TRACKED_ALLOC=1.
As of libenchant 1.6.0 there is enchant_get_version()[1], so we use it,
if available, to show the actual enchant version in the PHP info. We
also drop the fake ENCHANT_VERSION_STRING altogether, but stick with
showing version 1.5.x if at least HAVE_ENCHANT_BROKER_SET_PARAM is
defined.
Future scope: we may consider requiring enchant 1.6.0 (or later), since
this has been released in April 2010, and likely is available
everywhere.
[1] <https://www.abisource.com/projects/enchant/>
Streams will be freed in an unpredictable order during shutdown.
Ignore explicit calls to php_stream_close() entirely to avoid
use-after-free -- instead let the stream resource destructor
deal with it. We have to account for a few special cases:
* Enclosed streams should be freed, as the resource destructor
will forward to the enclosing stream.
* Stream cookies also directly free streams, because we delegate
to the cookie destruction if one exists.
* Mysqlnd also directly frees streams, because it explicitly
removes stream resources (because mysqlnd!)
Some headers were checked multiple times in the main configure.ac file
and in the bundled extensions or SAPIs themselves. Also many of these
checks are then used accross other extensions or SAPIs so a central
configure.ac makes most sense for these checks.
This patch removes warnings when lexer and parser files are already
generated. For example, when downloading a PHP release. Realistically,
it is not so trivial to rebuild lexer and parser files without removing
them first. And considering that tarballs don't have cleaning tools
such as Git, this would require manual removali.
Related also to https://bugs.gentoo.org/593278
When tests are run concurrently using the -j option there might be a
change of failure and writing to the same directory from both tests.
Use test filenames for generated temp dirs
Fails for me locally due to different number of warnings with
different messages. Rather than adding more wildcards I'm dropping
this test entirely, as it doesn't seem to test anything particularly
useful.
(cherry picked from commit 84333cad67)
It seems that this code has a peculiar interpretation of "len",
where it actually points to the last character, not one past it.
So we need +1 here for that extra char and another +1 for the
terminating null byte.
This test is failing on AppVeyor almost all of the time, so splitting
it seems appropriate. This also allows us to rid php_cli_server_stop()
which was only used by this test case.
We add PHP bindings for libgd's features to read TGA files, which are
available as of libgd 2.1.0.
As PHP's bundled libgd doesn't yet include the respective features of the
external libgd, we add these.
Since TGA has no easily recognizable file signature, we don't add TGA
support for imagecreatefromstring() or getimagesize() and friends.
For some reason, when using GCC with address sanitizer, dlopen
is available without -ldl, but dlsym still needs it. Explicitly check
dlsym so we add the library.
symtable_cache_ptr now points to the first unused symtable_cache
entry, rahter than the last used one. This avoids taking a pointer
to the minus first element of the array, which is UB. Instead we
take a pointer to the end plus one, which is not UB.
The arena allocator has no problem with zero-size allocations (and
will just return the same pointer for each in this case), so just
do that to avoid null pointers.
With opcache.protect_memory=1 enabled, the XML-RPC extension causes a
segfault on PHP 7.2 as it is modifying the recursion counter of objects
it touches, without first checking if they are immutable or not.
This doesn't affect 7.3+
The use of gettimeofday in time_sleep_until is technically incorrect, it's not possible
to use gettimeofday in this way reliably on any platform: It relies on operating system
global structures, which may be modified by any other process on the system at any time.
While in practice, users may be ignoring this flaw, it entirely depends on the other software
running on the system to which the application is deployed, there is no possible way to write
a test that will always pass on any system, therefore it must be marked XFAIL.
I've refactored based on the original bug report, related bugs, and commits
to php-src that were related to them.
It is supposed to be testing windows specific behaviour related to non-blocking pipes,
nevertheless the test runs everywhere.
As this test doesn't check differences in times before and after
operations, it doesn't actually verify anything and just wastes
30 seconds of test time.
As we already have other tests that do check how stat times change,
I'm removing it entirely.
The result of zval_get_string() needs to be released. In some places
where it is inconvenient to manage, I went back to convert_to_string.
It is safe in those places due to existing array separations.
Also fix a preexisting leak when getting controls, the previous
value was not destroyed.
This reverts commit bdcef51bcb.
It seems that pkg-config support for libargon2 is still flaky:
* No pc file on Alpine.
* Custom builds of released libargon2 versions create a broken
pc file. This is fixed in master, but not released.
Go back to the old detection code for now.
Also add PHP_TEST_EXTRA_ARGS environment variable, which allows
to pass on -c, -d etc flags provided by run-tests.php. Otherwise
we won't get the built-in server to run with opcache.
libcurl may link against 7 different ssl libraries, all of which
are thread-safe -- apart from openssl, of course. We check for
openssl and register locking callbacks in that case, but we should
not warn if any other library is used.
Bug #78898: call_user_func(['parent', ...]) fails while other succeed
--FILE--
<?php
class A
{
protected function _x()
{
echo "a";
}
public function __call($methodName, array $arguments)
{
throw new Exception("Unknown method.");
}
}
class B extends A
{
public function x()
{
parent::_x();
call_user_func('parent::_x');
call_user_func(['parent', '_x']);
}
}
$b = new B;
$b->x();
?>
--EXPECT--
aaa
Loaded 100 of 2310 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Derick Rethans