mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-27 11:53:33 +08:00
Code Issues Packages Projects Releases Wiki Activity
6d59640980
php-src/NEWS

1335 lines
51 KiB
Plaintext
Raw Normal View History

remove BOM from NEWS
2015-07-21 22:36:36 +08:00
PHP NEWS
Please add in any changes/bug fixes you've made - we need to keep a details ChangeLog...
1999-07-23 07:54:54 +08:00
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
PHP-8.2 is now for PHP 8.2.14-dev
2023-11-07 22:12:19 +08:00
?? ??? ????, PHP 8.2.14
Fix GH-12635: Test bug69398.phpt fails with ICU 74.1 ICU 74.1 contains new locale data that breaks the test. Split the test based on the version number to resolve the issue. Closes GH-12653.
2023-11-11 21:15:23 +08:00
- Intl:
. Fixed bug GH-12635 (Test bug69398.phpt fails with ICU 74.1). (nielsdos)
Fix GH-12628: The gh11374 test fails on Alpinelinux Closes GH-12636.
2023-11-08 15:39:05 +08:00
- PCRE:
. Fixed bug GH-12628 (The gh11374 test fails on Alpinelinux). (nielsdos)
Fix memory leak in standard syslog device handling The BG(syslog_device) is leaked in RINIT. Closes GH-12501
2023-10-24 03:36:01 +08:00
- Standard:
. Fix memory leak in syslog device handling. (danog)
Fix GH-12621: browscap segmentation fault when configured in the vhost The temporary HashTable has a destructor that releases the string held by the entry's value. However, browscap_intern_str(_ci) only incremented the refcount for the reference created by the return value. As the HashTable is only used during parsing, we don't need to manage the reference count of the value anyway, so get rid of the destructor. This is triggerable in two cases: - When using php_admin_value to set the ini at the activation stage - When running out of space for the opcache-interned strings Closes GH-12634.
2023-11-09 03:06:18 +08:00
. Fixed bug GH-12621 (browscap segmentation fault when configured in the
vhost). (nielsdos)
Fix GH-12655: proc_open() does not take into account references in the descriptor array Closes GH-12658.
2023-11-13 01:43:35 +08:00
. Fixed bug GH-12655 (proc_open() does not take into account references
in the descriptor array). (nielsdos)
PHP-8.2 is now for PHP 8.2.14-dev
2023-11-07 22:12:19 +08:00
Fix GH-12633: sqlite3_defensive.phpt fails with sqlite 3.44.0 Removes 'PRAGMA writable_schema;'. From sqlite changelog https://www.sqlite.org/releaselog/3_44_0.html: > The SQLITE_DBCONFIG_DEFENSIVE setting now prevents PRAGMA writable_schema > from being turned on. > Previously writable_schema could be turned on, but would not actually allow > the schema to be writable. Now it simply cannot be turned on. Closes GH-12636.
2023-11-09 09:04:10 +08:00
- SQLite3:
. Fixed bug GH-12633 (sqlite3_defensive.phpt fails with sqlite 3.44.0).
(SakiTakamachi)
NEWS
2023-11-14 21:56:59 +08:00
- Zip:
. Fixed bug GH-12661 (Inconsistency in ZipArchive::addGlob remove_path Option
Behavior). (Remi)
PHP-8.2 is now for PHP 8.2.14-dev
2023-11-07 22:12:19 +08:00
23 Nov 2023, PHP 8.2.13
PHP-8.2 is now for PHP 8.2.13-dev
2023-10-10 23:45:26 +08:00
Fix use-after-free of constant name The constant name is usually interend. Without opcache, compilation always interns strings. Without opcache, compilation does not intern (new) strings, but persisting of script does. If a script is not stored in shm the constant name will not be interned. The building of enum backing stores was missing a addref for the constant name, leading to a double-free when releasing constants and backing stores of enums. Fixes GH-12366 Closes GH-12405
2023-10-11 00:47:58 +08:00
- Core:
. Fixed double-free of non-interned enum case name. (ilutov)
Fixed a bug in zend_memnistr with single character needle Fixes GH-12457 Closes GH-12458
2023-10-17 21:23:31 +08:00
. Fixed bug GH-12457 (Incorrect result of stripos with single character
needle). (SakiTakamachi)
Fix double-free of doc_comment when overriding static property via trait When redeclaring an overridden static property with a trait we're removing the property from the class. However, because the property itself does not belong to the class we must not free its associated data. This issue is exposed by 9a250cc9d6 in PHP 8.3+ because duplicate static properties in traits are no longer skipped, but redeclared. Fixes GH-12468
2023-10-19 06:47:59 +08:00
. Fixed bug GH-12468 (Double-free of doc_comment when overriding static
property via trait). (ilutov)
[ci skip] NEWS
2023-10-28 21:04:13 +08:00
. Fixed segfault caused by weak references to FFI objects. (sj-i)
[ci skip] NEWS
2023-10-29 19:20:31 +08:00
. Fixed max_execution_time: don't delete an unitialized timer. (Kévin Dunglas)
Fix GH-12558 Escape \N in generated stubs (#12562)
2023-10-31 17:06:56 +08:00
. Fixed bug GH-12558 (Arginfo soft-breaks with namespaced class return type
if the class name starts with N). (kocsismate)
PHP-8.2 is now for PHP 8.2.13-dev
2023-10-10 23:45:26 +08:00
Fix registerNodeClass with abstract class crashing This always results in a segfault when trying to instantiate, so this never worked. At least throw an error instead of segfaulting to prevent developers from being confused. Closes GH-12420.
2023-10-12 02:51:52 +08:00
- DOM:
. Fix registerNodeClass with abstract class crashing. (nielsdos)
Fix null pointer dereferences in case of allocation failure Closes GH-12506.
2023-10-24 16:09:40 +08:00
. Add missing NULL pointer error check. (icy17)
Fix validation logic of php:function() callbacks in dom and xsl Two issues: - Assumed that at least 1 argument (function name) was provided. - Incorrect error path for the non-callable case. Closes GH-12593.
2023-11-02 08:35:21 +08:00
. Fix validation logic of php:function() callbacks. (nielsdos)
Fix registerNodeClass with abstract class crashing This always results in a segfault when trying to instantiate, so this never worked. At least throw an error instead of segfaulting to prevent developers from being confused. Closes GH-12420.
2023-10-12 02:51:52 +08:00
Fix GH-11121: ReflectionFiber segfault Closes GH-12391. Co-authored-by: Aaron Piotrowski <aaron@trowski.com>
2023-10-09 16:46:55 +08:00
- Fiber:
. Fixed bug GH-11121 (ReflectionFiber segfault). (danog, trowski, bwoebi)
Fix GH-12232: FPM: segfault dynamically loading extension without opcache Also fixes incorrect assertion in ini init that php_dl is always temporary. Closes GH-12277
2023-09-23 05:02:19 +08:00
- FPM:
Fix GH-9921: Loading ext in FPM config does not register module handlers Closes GH-12377
2023-10-07 20:59:40 +08:00
. Fixed bug GH-9921 (Loading ext in FPM config does not register module
handlers). (Jakub Zelenka)
Fix GH-12232: FPM: segfault dynamically loading extension without opcache Also fixes incorrect assertion in ini init that php_dl is always temporary. Closes GH-12277
2023-09-23 05:02:19 +08:00
. Fixed bug GH-12232 (FPM: segfault dynamically loading extension without
opcache). (Jakub Zelenka)
Fix bug #76922: FastCGI terminates conn after FCGI_GET_VALUES Closes GH-12387
2023-10-09 05:21:31 +08:00
. Fixed bug #76922 (FastCGI terminates conn after FCGI_GET_VALUES).
(Jakub Zelenka)
Fix GH-12232: FPM: segfault dynamically loading extension without opcache Also fixes incorrect assertion in ini init that php_dl is always temporary. Closes GH-12277
2023-09-23 05:02:19 +08:00
ext/intl: change when the locale is invalid for the 8.1/8.2 serie. does not throws an exception as it's considered as a too string change, but the code user still needs to double check.
2023-10-30 21:42:50 +08:00
- Intl:
. Removed the BC break on IntlDateFormatter::construct which threw an
exception with an invalid locale. (David Carlier)
Report warning if JIT cannot be enabled Closes GH-12404
2023-10-10 23:11:01 +08:00
- Opcache:
. Added warning when JIT cannot be enabled. (danog)
[ci skip] NEWS Entry for 90f2e7607a.
2023-10-11 23:17:11 +08:00
. Fixed bug GH-8143 (Crashes in zend_accel_inheritance_cache_find since
upgrading to 8.1.3 due to corrupt on-disk file cache). (turchanov)
PHP-8.1 is now for PHP 8.1.26-dev
2023-10-11 04:54:03 +08:00
Fix GH-12489: Missing sigbio creation checking in openssl_cms_verify Closes GH-12490
2023-10-21 22:16:32 +08:00
- OpenSSL:
[ci skip] NEWS
2023-10-25 01:35:55 +08:00
. Fixed bug GH-12489 (Missing sigbio creation checking in openssl_cms_verify).
(Jakub Zelenka)
Fix GH-12489: Missing sigbio creation checking in openssl_cms_verify Closes GH-12490
2023-10-21 22:16:32 +08:00
Fix GH-11374: Different preg_match result with -d pcre.jit=0 This is a backport of https://github.com/PCRE2Project/pcre2/pull/300. Closes GH-12439.
2023-10-15 05:48:00 +08:00
- PCRE:
. Fixed bug GH-11374 (Backport upstream fix, Different preg_match result
with -d pcre.jit=0). (mvorisek)
Fix GH-12392: Segmentation fault on SoapClient::__getTypes There are two issues: - UAF because the hashmap resized while being iterated over, yet the local variables used internally in the macros are not updated. - The hashmap being iterated over is modified: entries are deleted after other entries have been added. This causes the deletion to fail sometimes because indices of buckets have shifted. Fix it by using a while loop iteration and HashPosition position tracker instead. Issue exists on PHP 8.1 too, but is much harder to trigger. The test file reproduces the issue reliably on PHP 8.2 and up. Closes GH-12409.
2023-10-11 06:11:16 +08:00
- SOAP:
. Fixed bug GH-12392 (Segmentation fault on SoapClient::__getTypes).
(nielsdos)
Fix bug #66150: SOAP WSDL cache race condition causes Segmentation Fault When we have two processes both trying to cache a WSDL, they might start writing the data to the same temporary file, causing file corruption due to the race condition. Fix this by creating a temporary file first, and then moving it to the final location. If moving fails then we know another process finished caching first. This also fixes #67617 as a consequence of its implementation. Closes GH-12469.
2023-10-19 04:20:50 +08:00
. Fixed bug #66150 (SOAP WSDL cache race condition causes Segmentation
Fault). (nielsdos)
. Fixed bug #67617 (SOAP leaves incomplete cache file on ENOSPC). (nielsdos)
Fix incorrect uri check in SOAP caching If i == 0 then the check will compare 0 bytes. We are supposed to check if the uri is identical. Closes GH-12479.
2023-10-19 22:41:29 +08:00
. Fix incorrect uri check in SOAP caching. (nielsdos)
Merge branch 'PHP-8.1' into PHP-8.2 * PHP-8.1: Fix segfault and assertion failure with refcounted props and arrays Fix incorrect uri check in SOAP caching Fix bug #66150: SOAP WSDL cache race condition causes Segmentation Fault
2023-10-20 00:32:01 +08:00
. Fix segfault and assertion failure with refcounted props and arrays.
(nielsdos)
Fix incorrect dtor for persistent sdl->encoders Closes GH-12515.
2023-10-25 02:20:05 +08:00
. Fix potential crash with an edge case of persistent encoders. (nielsdos)
Fix bug #75306: Memleak in SoapClient Setting the stream context via php_stream_context_to_zval() will increase the reference count. So if the new context is created, then it will end up with a reference count of 2 while it should be 1. Credits to cmb for the analysis. I arrived at the same patch as he did. Closes GH-12523.
2023-10-19 02:18:40 +08:00
. Fixed bug #75306 (Memleak in SoapClient). (nielsdos)
PHP-8.1 is now for PHP 8.1.26-dev
2023-10-11 04:54:03 +08:00
Fix bug #75708: getimagesize with "&$imageinfo" fails on StreamWrappers Closes GH-12444
2023-09-24 04:03:31 +08:00
- Streams:
. Fixed bug #75708 (getimagesize with "&$imageinfo" fails on StreamWrappers).
(Jakub Zelenka)
Fix null pointer dereferences in case of allocation failure Closes GH-12506.
2023-10-24 16:09:40 +08:00
- XMLReader:
. Add missing NULL pointer error check. (icy17)
- XMLWriter:
. Add missing NULL pointer error check. (icy17)
Add missing module dependency for xsl This module cannot work without the DOM extension. Closes GH-12441.
2023-10-15 06:13:57 +08:00
- XSL:
. Add missing module dependency. (nielsdos)
Fix validation logic of php:function() callbacks in dom and xsl Two issues: - Assumed that at least 1 argument (function name) was provided. - Incorrect error path for the non-callable case. Closes GH-12593.
2023-11-02 08:35:21 +08:00
. Fix validation logic of php:function() callbacks. (nielsdos)
Add missing module dependency for xsl This module cannot work without the DOM extension. Closes GH-12441.
2023-10-15 06:13:57 +08:00
PHP-8.2 is now for PHP 8.2.13-dev
2023-10-10 23:45:26 +08:00
26 Oct 2023, PHP 8.2.12
PHP-8.2 is now for PHP 8.2.12-dev
2023-09-12 19:53:56 +08:00
Fix GH-12207 memory leak of doc blocks of static properties When declaring the same static property with a doc block in a class and in a trait, the doc block of the property in the class is leaked. While at it, possibly fix doc comment for internal classes. Close GH-12238
2023-09-18 20:28:39 +08:00
- Core:
. Fixed bug GH-12207 (memory leak when class using trait with doc block).
(rioderelfte)
Fix GH-12215: Module entry being overwritten causes type errors in ext/dom (<= PHP 8.3) When we try to load an extension multiple times, we still overwrite the type, module number, and handle. If the module number is used to indicate module boundaries (e.g. in reflection and in dom, see e.g. dom_objects_set_class_ex), then all sorts of error can happen. In the case of ext/dom, OP's error happens because the following happens: - The property handler is set up incorrectly in dom_objects_set_class_ex() because the wrong module number is specified. The class highest in the hierarchy is DOMNode, so the property handler is incorrectly set to that of DOMNode instead of DOMDocument. - The documentElement property doesn't exist on DOMNode, it only exists on DOMDocument, so it tries to read using zend_std_read_property(). As there is no user property called documentElement, that read operation returns an undef value. However, the type is still checked, resulting in the strange exception. Closes GH-12219.
2023-09-15 23:15:11 +08:00
. Fixed bug GH-12215 (Module entry being overwritten causes type errors in
ext/dom). (nielsdos)
Fix GH-12273 - configure __builtin_cpu_init() check __builtin_cpu_init() is documented as having a void return type. It happens to return int on gcc, but is void on clang. Close GH-122274
2023-09-23 00:11:22 +08:00
. Fixed bug GH-12273 (__builtin_cpu_init check). (Freaky)
Fix #80092: ZTS + preload = segfault on shutdown After preloading has executed, the executor globals for class_table and function_table are still referring to the values during preloading. If no request happens after that then these values will remain dangling pointers. If then the -v option on CLI or -h option (and possibly others) on CGI is provided, there is a double free. Fix it by nulling the pointers explicitly after preloading has finished to fix it for all SAPIs. Closes GH-12311.
2023-09-28 04:16:43 +08:00
. Fixed bug #80092 (ZTS + preload = segfault on shutdown). (nielsdos)
Fix GH-12207 memory leak of doc blocks of static properties When declaring the same static property with a doc block in a class and in a trait, the doc block of the property in the class is leaked. While at it, possibly fix doc comment for internal classes. Close GH-12238
2023-09-18 20:28:39 +08:00
php_cli_server: ensure single date header is present Currently the PHP Development Server appends a Date header in the response, despite already set from user code. Added a check condition before append the header, and a test file. Closes GH-12363.
2023-10-05 15:36:18 +08:00
- CLI:
. Ensure a single Date header is present. (coppolafab)
Fix GH-11997: ctype_alnum 5 times slower in PHP 8.1 or greater Currently, a common function is used where a function pointer gets passed to check the character class type. If we instead use a macro, the macro version of these character class type checkers can be used. While this gives only a minor speed-up for glibc-based systems, on Alpine this gives a multi-facor speed-up This is essentially a manual revert of dc80ea7e38. Full discussion in GH-11997. Closes GH-12300.
2023-09-26 02:00:53 +08:00
- CType:
. Fixed bug GH-11997 (ctype_alnum 5 times slower in PHP 8.1 or greater).
(nielsdos)
Restore old namespace reconciliation behaviour The xmlDOMWrapReconcileNamespaces method we used to fix the namespace corruption issues in 8.1.21/8.2.8 caused regressions. Primarily, there is a similar corruption that the xmlReconciliateNs method used to have in which a namespace is suddenly shifted (SAML-Toolkits/php-saml#562) and the side-effect of removing redundant namespaces causes problems when a specific serialization is required. Closes GH-12308.
2023-09-28 04:32:01 +08:00
- DOM:
. Restore old namespace reconciliation behaviour. (nielsdos)
Fix GH-8996: DOMNode serialization on PHP ^8.1 PHP 8.1 introduced a seemingly unintentional BC break in ca94d55a19 by blocking the (un)serialization of DOM objects. This was done because the serialization never really worked and just resulted in an empty object, which upon unserialization just resulted in an object that you can't use. Users can however implement their own serialization methods, but the commit made that impossible as the ACC flag gets passed down to the child class. An approach was tried in #10307 with a new ACC flag to selectively allow serialization with subclasses if they implement the right methods. However, that was found to be too ad hoc. Instead, let's abuse how the __sleep and __wakeup methods work to throw the exception instead. If the child class implements the __serialize / __unserialize method, then the throwing methods won't be called. Similarly, if the child class implements __sleep and __wakeup, then they're overridden and it doesn't matter that they throw. For the user, this PR has the exact same behaviour for (sub)classes that don't implement the serialization methods: an exception will be thrown. For code that previously implemented subclasses with these methods, this approach will make that code work again. This approach should be both BC preserving and unbreak user's code. Closes GH-12388. For the test: Co-authored-by: wazelin <contact@sergeimikhailov.com>
2023-10-09 06:15:54 +08:00
. Fixed bug GH-8996 (DOMNode serialization on PHP ^8.1). (nielsdos)
Restore old namespace reconciliation behaviour The xmlDOMWrapReconcileNamespaces method we used to fix the namespace corruption issues in 8.1.21/8.2.8 caused regressions. Primarily, there is a similar corruption that the xmlReconciliateNs method used to have in which a namespace is suddenly shifted (SAML-Toolkits/php-saml#562) and the side-effect of removing redundant namespaces causes problems when a specific serialization is required. Closes GH-12308.
2023-09-28 04:32:01 +08:00
NEWS: Added note about #11891 [ci skip] Signed-off-by: Anatol Belski <ab@php.net>
2023-10-01 01:18:25 +08:00
- Fileinfo:
. Fixed bug GH-11891 (fileinfo returns text/xml for some svg files). (usarise)
[skip ci] Fix NEWS entry
2023-09-14 19:16:43 +08:00
- Filter:
. Fix explicit FILTER_REQUIRE_SCALAR with FILTER_CALLBACK (ilutov)
PHP-8.2 is now for PHP 8.2.12-dev
2023-09-12 19:53:56 +08:00
Fix GH-12186: segfault copying/cloning a finalized HashContext Closes GH-12186. Closes GH-12187.
2023-09-12 19:36:20 +08:00
- Hash:
. Fixed bug GH-12186 (segfault copying/cloning a finalized HashContext).
(MaxSem)
Fix GH-12243, segfault on IntlDateFormatter::construct with dateType set to UDAT_PATTERN but not timeType. udat_open expects its timeStyle's argument to be set to UDAT_PATTERN when dateStyle is, regardless if there an actual pattern or not. Close GH-12245
2023-09-20 01:47:29 +08:00
- Intl:
. Fixed bug GH-12243 (segfault on IntlDateFormatter::construct).
(David Carlier)
Fix GH-12282: IntlDateFormatter::construct should throw an exception is the locale field has an invalid value. Close GH-12282
2023-09-23 20:32:53 +08:00
. Fixed bug GH-12282 (IntlDateFormatter::construct should throw an exception
on an invalid locale). (David Carlier)
Fix GH-12243, segfault on IntlDateFormatter::construct with dateType set to UDAT_PATTERN but not timeType. udat_open expects its timeStyle's argument to be set to UDAT_PATTERN when dateStyle is, regardless if there an actual pattern or not. Close GH-12245
2023-09-20 01:47:29 +08:00
Fix GH-12297: PHP Startup: Invalid library (maybe not a PHP library) 'mysqlnd.so' in Unknown on line On some configurations, the COMPILE_DL_MYSQLND must come from config.h. If it isn't set, the get_module function won't be exposed, resulting in a failure when trying to load the library. It's the same issue ext/fileinfo had a while back that was fixed in b0ba368d5. Closes GH-12299.
2023-09-26 01:38:42 +08:00
- MySQLnd:
. Fixed bug GH-12297 (PHP Startup: Invalid library (maybe not a PHP library)
'mysqlnd.so' in Unknown on line). (nielsdos)
Invalidate path even if the file was deleted Closes GH-12323
2023-09-29 22:57:13 +08:00
- Opcache:
. Fixed opcache_invalidate() on deleted file. (mikhainin)
Fix GH-12380: JIT+private array property access inside closure accesses private property in child class For private fields, the scope has to be taken into account, otherwise the property info may come from the wrong ce. Closes GH-12381.
2023-10-08 05:46:29 +08:00
. Fixed bug GH-12380 (JIT+private array property access inside closure
accesses private property in child class). (nielsdos)
Invalidate path even if the file was deleted Closes GH-12323
2023-09-29 22:57:13 +08:00
Fix GH-11956: PCRE regular expressions with JIT enabled gives different result The code in the attached test used to work correctly in PHP 8.0, but not in 8.1+. This is because PHP 8.1+ uses a more modern version of pcre2 than PHP 8.0, and that pcre2 versions has a regression. While upgrading pcre2lib seems to be only done for the master branch, it is possible to backport upstream fixes to stable branches. This has been already done in the past in for JIT regressions [1], so it is not unprecedented. We backport the upstream pcre2 fix [2]. [1] https://github.com/php/php-src/commit/788a701e222 [2] https://github.com/PCRE2Project/pcre2/pull/135 Closes GH-12108.
2023-09-03 02:24:39 +08:00
- PCRE:
. Fixed bug GH-11956 (Backport upstream fix, PCRE regular expressions with
JIT enabled gives different result). (nielsdos)
Fix GH-12170: Can't use xpath with comments in SimpleXML Closes GH-12177.
2023-09-12 01:54:54 +08:00
- SimpleXML:
. Fixed bug GH-12170 (Can't use xpath with comments in SimpleXML). (nielsdos)
Fix GH-12223: Entity reference produces infinite loop in var_dump/print_r Closes GH-12223.
2023-09-16 20:18:33 +08:00
. Fixed bug GH-12223 (Entity reference produces infinite loop in
var_dump/print_r). (nielsdos)
Fix GH-12167 and GH-12169: Unable to get comment or processing instruction contents in SimpleXML Closes GH-12289.
2023-09-24 05:07:30 +08:00
. Fixed bug GH-12167 (Unable to get processing instruction contents in
SimpleXML). (nielsdos)
. Fixed bug GH-12169 (Unable to get comment contents in SimpleXML).
(nielsdos)
Fix GH-12170: Can't use xpath with comments in SimpleXML Closes GH-12177.
2023-09-12 01:54:54 +08:00
Fix GH-12190: stream_context_create with address and port at 0. Prior to the 8.1 rewrite, inet_aton was used for ipv4 addresses therefore addresses like `0` passed. For the bindto's case where both ip and port are set as such, we discard the address binding. Close GH-12195
2023-09-13 05:45:24 +08:00
- Streams:
. Fixed bug GH-12190 (binding ipv4 address with both address and port at 0).
(David Carlier)
Fix return type of stub of xml_parse_into_struct() Closes GH-12253.
2023-09-21 02:49:10 +08:00
- XML:
. Fix return type of stub of xml_parse_into_struct(). (nielsdos)
Fix memory leak when calling xml_parse_into_struct() twice Closes GH-12254.
2023-09-21 02:51:42 +08:00
. Fix memory leak when calling xml_parse_into_struct() twice. (nielsdos)
Fix return type of stub of xml_parse_into_struct() Closes GH-12253.
2023-09-21 02:49:10 +08:00
Fix type error on XSLTProcessor::transformToDoc return value with SimpleXML The return type is wrong. You can also use this method with SimpleXML. In fact, PHP provides a way that even third party libraries can hook into its XML handling. Therefore, we cannot even use the SimpleXML|DOMDocument|false union type as third party extensions may extend the possibilities. Broke in 8.1 in 1b35056a33. Closes GH-12315.
2023-09-29 05:49:42 +08:00
- XSL:
. Fix type error on XSLTProcessor::transformToDoc return value with
SimpleXML. (nielsdos)
PHP-8.2 is now for PHP 8.2.12-dev
2023-09-12 19:53:56 +08:00
28 Sep 2023, PHP 8.2.11
PHP-8.2 is now for PHP 8.2.11-dev
2023-08-16 04:08:52 +08:00
Fix segfault in format_default_value due to unexpected enum/object Evaluating constants at comptime can result in arrays that contain objects. This is problematic for printing the default value of constant ASTs containing objects, because we don't actually know what the constructor arguments were. Avoid this by not propagating array constants. Fixes GH-11937 Closes GH-11947
2023-08-12 22:11:29 +08:00
- Core:
. Fixed bug GH-11937 (Constant ASTs containing objects). (ilutov)
On riscv64 require libatomic if actually needed clang and newer gcc releases support byte-sized atomic accesses on riscv64 through inline builtins. In both cases the hard dependency on libatomic added by GH-11321 isn't useful. Stop using AC_CHECK_LIB() which is too naive to notice that libatomic isn't needed. Instead, PHP_CHECK_FUNC() will retry the check with -latomic if required. Closes GH-11790
2023-08-29 01:47:19 +08:00
. Fixed bug GH-11790 (On riscv64 require libatomic if actually needed).
(Jeremie Courreges-Anglas)
Fix GH-11876: ini_parse_quantity() accepts invalid quantities Closes GH-11910
2023-08-08 17:44:04 +08:00
. Fixed bug GH-11876: ini_parse_quantity() accepts invalid quantities.
(Girgias)
Fix freeing of incompletely initialized closures Addref to relevant fields before allocating any memory. Also only set/remove the ZEND_ACC_HEAP_RT_CACHE flag after allocating memory. Fixes GH-12073 Closes GH-12074
2023-08-29 22:53:38 +08:00
. Fixed bug GH-12073 (Segfault when freeing incompletely initialized
closures). (ilutov)
Prevents double call to internal iterator rewind handler Closes GH-12060 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-08-28 00:18:34 +08:00
. Fixed bug GH-12060 (Internal iterator rewind handler is called twice).
(ju1ius)
Fix zend_separate_if_call_and_write for FUNC_ARGs Fixes GH-12102 Closees GH-12140
2023-09-06 19:22:59 +08:00
. Fixed bug GH-12102 (Incorrect compile error when using array access on TMP
value in function call). (ilutov)
Fix segfault in format_default_value due to unexpected enum/object Evaluating constants at comptime can result in arrays that contain objects. This is problematic for printing the default value of constant ASTs containing objects, because we don't actually know what the constructor arguments were. Avoid this by not propagating array constants. Fixes GH-11937 Closes GH-11947
2023-08-12 22:11:29 +08:00
Fix memory leak when setting an invalid DOMDocument encoding Because the failure path did not release the string, there was a memory leak. As the only valid types for this function are IS_NULL and IS_STRING, we and IS_NULL is always rejected in practice, solve the issue by not using a function that increments the refcount in the first place. Closes GH-12002.
2023-08-20 05:54:53 +08:00
- DOM:
. Fix memory leak when setting an invalid DOMDocument encoding. (nielsdos)
ext/iconv: fix build for netbsd. NetBSD still adopts the old iconv signature for buffer inputs. The next release will too so we can assume it will remain that way for a while. Close GH-12001
2023-08-20 02:20:01 +08:00
- Iconv:
. Fixed build for NetBSD which still uses the old iconv signature.
(David Carlier)
Fixed bug GH-12020: intl_get_error_message() broken after MessageFormatter::formatMessage() fails Passing NULL as the pointer to intl_error* will use the global error stack. This is what we need to do instead of pushing it onto the temporary format object that is released.
2023-09-03 07:59:20 +08:00
- Intl:
. Fixed bug GH-12020 (intl_get_error_message() broken after
MessageFormatter::formatMessage() fails). (Girgias)
Fix implicit/explicit port in mysqlnd
2023-03-24 21:52:20 +08:00
- MySQLnd:
. Fixed bug GH-10270 (Invalid error message when connection via SSL fails:
"trying to connect via (null)"). (Kamil Tekiela)
PHP-8.1 is now for PHP 8.1.24-dev
2023-08-16 03:09:58 +08:00
Fix memory leak with failed SQLPrepare Closes GH-12095 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-09-01 02:25:46 +08:00
- ODBC:
. Fixed memory leak with failed SQLPrepare. (NattyNarwhal)
Fix persistent procedural ODBC connections not getting closed Like oci8, procedural ODBC uses an apply function on the hash list to enumerate persistent connections and close the specific one. However, this function take zvals, not resources. However, it was getting casted as such, causing it to interpret the pointer incorrectly. This could have caused other issues, but mostly manifested as failing to close the connection even fi it matched. The function now takes a zval and gets the resource from that. In addition, it also removes the cast of the function pointer and moves casting to the function body, to avoid possible confusion like this in refactors again. It also cleans up style and uses constants in the function body. Closes GH-12132 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-09-01 03:14:30 +08:00
. Fixed persistent procedural ODBC connections not getting closed.
(NattyNarwhal)
Fix memory leak with failed SQLPrepare Closes GH-12095 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-09-01 02:25:46 +08:00
Fix #52751: XPath processing-instruction() function is not supported. Closes GH-12165.
2023-09-10 03:17:02 +08:00
- SimpleXML:
. Fixed bug #52751 (XPath processing-instruction() function is not
supported). (nielsdos)
Fix GH-11972: RecursiveCallbackFilterIterator regression in 8.1.18 When you do an assignment between two zvals (no, not zval*), you copy all fields. This includes the additional u2 data. So that means for example the Z_NEXT index gets copied, which in some cases can therefore cause a cycle in zend_hash lookups. Instead of doing an assignment, we should be doing a ZVAL_COPY (or ZVAL_COPY_VALUE for non-refcounting cases). This avoids copying u2. Closes GH-12086.
2023-08-31 03:25:03 +08:00
- SPL:
. Fixed bug GH-11972 (RecursiveCallbackFilterIterator regression in 8.1.18).
(nielsdos)
Fix GH-11878: SQLite3 callback functions cause a memory leak with a callable array In this test file, the free_obj handler is called with a refcount of 2, caused by the fact we do a GC_ADDREF() to increase its refcount while its refcount is still 1 because the Foo object hasn't been destroyed yet (due to the cycle caused by the sqlite function callback). Solve this by introducing a get_gc handler. Closes GH-11881.
2023-09-09 01:56:36 +08:00
- SQLite3:
. Fixed bug GH-11878 (SQLite3 callback functions cause a memory leak with
a callable array). (nielsdos, arnaud-lb)
PHP-8.2 is now for PHP 8.2.11-dev
2023-08-16 04:08:52 +08:00
31 Aug 2023, PHP 8.2.10
PHP-8.2 is now for PHP 8.2.10-dev
2023-07-18 19:02:43 +08:00
Fix GH-11716: cli server crashes on SIGINT when compiled with ZEND_RC_DEBUG=1 Closes GH-11757.
2023-07-21 19:25:50 +08:00
- CLI:
. Fixed bug GH-11716 (cli server crashes on SIGINT when compiled with
ZEND_RC_DEBUG=1). (nielsdos)
Fix GH-10964: Improve `man` page about the built-in server Closes GH-11857.
2023-08-02 22:02:00 +08:00
. Fixed bug GH-10964 (Improve man page about the built-in server).
(Alexandre Daubois)
Fix GH-11716: cli server crashes on SIGINT when compiled with ZEND_RC_DEBUG=1 Closes GH-11757.
2023-07-21 19:25:50 +08:00
Fix GH-11416: Crash with DatePeriod when uninitialised objects are passed in (PHP 8.2+)
2023-08-09 23:06:46 +08:00
- Date:
. Fixed bug GH-11416 (Crash with DatePeriod when uninitialised objects are
passed in). (Derick)
fix: handle the GNU specific version of strerror_r Close GH-11882
2023-08-06 00:03:46 +08:00
- Core:
. Fixed strerror_r detection at configuration time. (Kévin Dunglas)
Fix various bugs related to DNF types - GH-11958: DNF types in trait properties do not get bound properly - GH-11883: Memory leak in zend_type_release() for non-arena allocated DNF types - Internal trait bound to userland class would not be arena allocated - Property DNF types were not properly deep copied during lazy loading Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com> Co-authored-by: ju1ius <jules.bernable@gmail.com>
2023-08-15 05:34:56 +08:00
. Fixed trait typed properties using a DNF type not being correctly bound.
(Girgias)
. Fixed trait property types not being arena allocated if copied from
an internal trait. (Girgias)
. Fixed deep copy of property DNF type during lazy class load.
(Girgias, ilutov)
. Fixed memory freeing of DNF types for non arena allocated types.
(Girgias, ju1ius)
fix: handle the GNU specific version of strerror_r Close GH-11882
2023-08-06 00:03:46 +08:00
Fix DOMEntity field getter bugs - publicId could crash PHP if none was provided - notationName never worked The fields of this classs were untested. This new test file changes that. Closes GH-11779.
2023-07-24 05:39:33 +08:00
- DOM:
. Fix DOMEntity field getter bugs. (nielsdos)
Fix incorrect attribute existence check in DOMElement::setAttributeNodeNS() Closes GH-11776.
2023-07-23 20:59:32 +08:00
. Fix incorrect attribute existence check in DOMElement::setAttributeNodeNS.
(nielsdos)
Fix DOMCharacterData::replaceWith() with itself Previously, when replacing the node with itself (or contained within itself), the node disappeared. Closes GH-11770.
2023-07-23 03:47:09 +08:00
. Fix DOMCharacterData::replaceWith() with itself. (nielsdos)
Fix empty argument cases for DOMParentNode methods Closes GH-11768.
2023-07-23 01:05:09 +08:00
. Fix empty argument cases for DOMParentNode methods. (nielsdos)
Fix GH-11791: Wrong default value of DOMDocument::xmlStandalone At one point this was changed from a bool to an int in libxml2, with negative values meaning it is unspecified. Because it is cast to a bool this therefore returned true instead of the expected false. Closes GH-11793.
2023-07-26 03:09:47 +08:00
. Fixed bug GH-11791 (Wrong default value of DOMDocument::xmlStandalone).
(nielsdos)
Fix json_encode result on DOMDocument According to https://www.php.net/manual/en/class.domdocument: When using json_encode() on a DOMDocument object the result will be that of encoding an empty object. But this was broken in 8.1. The output was `{"config": null}`. That's because the config property is defined with a default value of NULL, hence it was included. The other properties are not included because they don't have a default property, and nothing is ever written to their backing field. Hence, the JSON encoder excludes them. Similarly, `(array) $doc` would yield the same `config` key in the array. Closes GH-11840.
2023-07-31 23:57:53 +08:00
. Fix json_encode result on DOMDocument. (nielsdos)
Fix manually calling __construct() on DOM classes Closes GH-11894.
2023-08-06 22:49:02 +08:00
. Fix manually calling __construct() on DOM classes. (nielsdos)
Fix GH-11830: ParentNode methods should perform their checks upfront Closes GH-11887.
2023-08-06 03:27:02 +08:00
. Fixed bug GH-11830 (ParentNode methods should perform their checks
upfront). (nielsdos)
Fix viable next sibling search for replaceWith Closes GH-11888.
2023-08-06 03:53:45 +08:00
. Fix viable next sibling search for replaceWith. (nielsdos)
Fix segfault when DOMParentNode::prepend() is called when the child disappears Closes GH-11906.
2023-08-08 03:16:33 +08:00
. Fix segfault when DOMParentNode::prepend() is called when the child
disappears. (nielsdos)
Fix DOMEntity field getter bugs - publicId could crash PHP if none was provided - notationName never worked The fields of this classs were untested. This new test file changes that. Closes GH-11779.
2023-07-24 05:39:33 +08:00
Fix leaking definitions on FFI::cdef()->new() Previously, FFI_G(symbols) and FFI_G(tags) were never cleaned up when calling new on an existing object. However, if cdef() is called without parameters these globals are NULL and might be created when new() creates new definitions. These would then be discarded without freeing them. Closes GH-11751
2023-07-20 19:28:02 +08:00
- FFI:
. Fix leaking definitions when using FFI::cdef()->new(...). (ilutov)
PHP-8.1 is now for PHP-8.1.23-dev
2023-07-19 05:30:49 +08:00
Merge branch 'PHP-8.1' into PHP-8.2 * PHP-8.1: Fix hash_pbkdf2 options parameter
2023-07-19 01:23:10 +08:00
- Hash:
. Fix use-of-uninitialized-value in hash_pbkdf2(), fix missing $options
parameter in signature. (ilutov)
PHP-8.2 is now for PHP 8.2.10-dev
2023-07-18 19:02:43 +08:00
Fix GH-11440: authentication to a sha256_password account fails over SSL This is similar to bug #78680, but that bug wasn't really fixed in all places. This is the only remaining place. Closes GH-11444.
2023-06-13 05:42:11 +08:00
- MySQLnd:
. Fixed bug GH-11440 (authentication to a sha256_password account fails over
SSL). (nielsdos)
Fix GH-11438: mysqlnd fails to authenticate with sha256_password accounts using passwords longer than 19 characters https://dev.mysql.com/doc/dev/mysql-server/latest/page_caching_sha2_authentication_exchanges.html tells us that the nonce used in this authentication method is 20 bytes long. However, we might receive additional scramble data in php_mysqlnd_greet_read not used in this method. On my test setup, I received 21 bytes (20 bytes + '\0'). This resulted in the xor computation to incorrectly include the NUL byte. Every password of at least 20 characters therefore failed to authenticate using this method. Looking at mysql-server source code also seems to reveal that it always uses a fixed number of scramble bytes [1]. [1] https://github.com/mysql/mysql-server/blob/ea7087d885006918ad54458e7aad215b1650312c/sql/auth/sha2_password.cc#L1078-L1079 Closes GH-11445. Co-authored-by: Kamil Tekiela <tekiela246@gmail.com>
2023-06-13 05:47:42 +08:00
. Fixed bug GH-11438 (mysqlnd fails to authenticate with sha256_password
accounts using passwords longer than 19 characters).
(nielsdos, Kamil Tekiela)
Fix MySQL Statement has a empty query result when the response field has changed, also Segmentation fault Closes GH-11551.
2023-06-28 16:29:31 +08:00
. Fixed bug GH-11550 (MySQL Statement has a empty query result when
the response field has changed, also Segmentation fault).
(Yurunsoft)
Fix error checking in mysqlnd Closes GH-11925
2023-08-10 01:09:54 +08:00
. Fixed invalid error message "Malformed packet" when connection is dropped.
(Kamil Tekiela)
Fix GH-11440: authentication to a sha256_password account fails over SSL This is similar to bug #78680, but that bug wasn't really fixed in all places. This is the only remaining place. Closes GH-11444.
2023-06-13 05:42:11 +08:00
Fix GH-11715: opcache.interned_strings_buffer either has no effect or opcache_get_status() / phpinfo() is wrong There are a couple of oddities. 1) The interned strings buffer comprises the whole hashtable datastructure. Therefore, it seems that the interned strings buffer size is the size of only said table. However, in the current code it also includes the size of the zend_accel_shared_globals. 2) ZCSG(interned_strings).end is computed starting from the accelerator globals struct itself. I would expect it to start from the part where the interned strings table starts. 3) When computing the used size, it is done using ZCSG(interned_strings).end - ZCSG(interned_strings).start. However, this does not include the uin32_t slots array because ZCSG(interned_strings).start pointers after that array. This patch corrrects these 3 points. Closes GH-11717.
2023-07-17 08:34:49 +08:00
- Opcache:
. Fixed bug GH-11715 (opcache.interned_strings_buffer either has no effect or
opcache_get_status() / phpinfo() is wrong). (nielsdos)
Check if restart is pending before trying to lock SHM This reduces lock contention when Opcache restart is scheduled but not yet started. Closes GH-11805
2023-07-27 19:54:29 +08:00
. Avoid adding an unnecessary read-lock when loading script from shm if
restart is in progress. (mikhainin)
Fix GH-11715: opcache.interned_strings_buffer either has no effect or opcache_get_status() / phpinfo() is wrong There are a couple of oddities. 1) The interned strings buffer comprises the whole hashtable datastructure. Therefore, it seems that the interned strings buffer size is the size of only said table. However, in the current code it also includes the size of the zend_accel_shared_globals. 2) ZCSG(interned_strings).end is computed starting from the accelerator globals struct itself. I would expect it to start from the part where the interned strings table starts. 3) When computing the used size, it is done using ZCSG(interned_strings).end - ZCSG(interned_strings).start. However, this does not include the uin32_t slots array because ZCSG(interned_strings).start pointers after that array. This patch corrrects these 3 points. Closes GH-11717.
2023-07-17 08:34:49 +08:00
Revert the fix for GH-11498 People relied on manually waiting for children, but the fix for GH-11498 broke this. Fixing this in PHP is fundamentally incompatible with doing the wait loop in userland. This reverts to the old behaviour. Closes GH-11863.
2023-08-03 03:08:52 +08:00
- PCNTL:
. Revert behaviour of receiving SIGCHLD signals back to the behaviour
before 8.1.22. (nielsdos)
Fix #81992: SplFixedArray::setSize() causes use-after-free Upon resizing, the elements are destroyed from lower index to higher index. When an element refers to an object with a destructor, it can refer to a lower (i.e. already destroyed) element, causing a uaf. Set refcounted zvals to NULL after destroying them to avoid a uaf. Closes GH-11959.
2023-08-14 07:41:54 +08:00
- SPL:
. Fixed bug #81992 (SplFixedArray::setSize() causes use-after-free).
(nielsdos)
Prevent int overflow on $decimals in number_format Closes GH-11714. Closes GH-11649.
2023-07-17 02:03:01 +08:00
- Standard:
. Prevent int overflow on $decimals in number_format. (Marc Bennewitz)
Fix off-by-one bug when truncating tempnam prefix The tempnam documentation currently states that "Only the first 63 characters of the prefix are used, the rest are ignored". However when the prefix is 64 characters-long, the current implementation fails to strip the last character, diverging from the documented behavior. This patch fixes the implementation so it matches the documented behavior for that specific case where the prefix is 64 characters long. Closes GH-11870 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-08-04 09:27:49 +08:00
. Fixed bug GH-11870 (Fix off-by-one bug when truncating tempnam prefix)
(athos-ribeiro)
Prevent int overflow on $decimals in number_format Closes GH-11714. Closes GH-11649.
2023-07-17 02:03:01 +08:00
PHP-8.2 is now for PHP 8.2.10-dev
2023-07-18 19:02:43 +08:00
03 Aug 2023, PHP 8.2.9
PHP-8.2 is now for PHP 8.2.9-dev
2023-06-20 22:25:30 +08:00
Fix GH-11522: PHP version check fails with '-' separator Remove php version suffix from '-' separator. Closes GH-11524.
2023-06-24 22:30:57 +08:00
- Build:
[ci skip] NEWS
2023-07-10 22:01:52 +08:00
. Fixed bug GH-11522 (PHP version check fails with '-' separator).
(SVGAnimate)
Fix GH-11522: PHP version check fails with '-' separator Remove php version suffix from '-' separator. Closes GH-11524.
2023-06-24 22:30:57 +08:00
Fix interrupted CLI output causing the process to exit When writing the output in the CLI is interrupted by a signal, the writing will fail in sapi_cli_single_write(), causing an exit later in sapi_cli_ub_write(). This was the other part of the issue in GH-11498. The solution is to restart the write if an EINTR has been observed. Closes GH-11510.
2023-06-23 06:07:46 +08:00
- CLI:
. Fix interrupted CLI output causing the process to exit. (nielsdos)
Fix mis-compilation of by-reference nullsafe operator Fixes oss-fuzz #60011 Closes GH-11540 Co-authored-by: Dmitry Stogov <dmitry@zend.com> Co-authored-by: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
2023-06-27 01:08:52 +08:00
- Core:
. Fixed oss-fuzz #60011 (Mis-compilation of by-reference nullsafe operator).
(ilutov)
Fix trailing if element JMP lineno Having this lineno on the same last compiled element can lead to an incorrectly covered line number. if (true) { if (false) { echo 'Never executed'; } } else { } The echo will be reported as covered because the JMP from the if (true) branch to the end of the else branch has the same lineno as the echo. This is lacking a test because zend_dump.c does not have access to ctx->debug_level and I don't think it's worth adjusting all the cases. Closes GH-11598
2023-07-05 19:16:32 +08:00
. Fixed line number of JMP instruction over else block. (ilutov)
Fix use-of-uninitialized-value with ??= on assert Normally, PHP evaluates all expressions in offsets (property or array), as well as the right hand side of assignments before actually fetching the offsets. This is well explained in this blog post. https://www.npopov.com/2017/04/14/PHP-7-Virtual-machine.html#writes-and-memory-safety For ??= we have a bit of a problem in that the rhs must only be evaluated if the lhs is null or undefined. Thus, we have to first compile the lhs with BP_VAR_IS, conditionally run the rhs and then re-fetch the lhs with BP_VAR_W to to make sure the offsets are valid if they have been invalidated. However, we don't want to just re-evaluate the entire lhs because it may contain side-effects, as in $array[$x++] ??= 42;. In this case, we don't want to re-evaluate $x++ because it would result in writing to a different offset than was previously tested. The same goes for function calls, like $array[foo()] ??= 42;, where the second call to foo() might result in a different value. PHP behaves correctly in these cases. This is implemented by memoizing sub-expressions in the lhs of ??= and reusing them when compiling the lhs for the second time. This is done for any expression that isn't a variable, i.e. anything that can (potentially) be written to. Unfortunately, this also means that function calls are considered writable due to their return-by-reference semantics, and will thus not be memoized. The expression foo()['bar'] ??= 42; will invoke foo() twice. Even worse, foo(bar()) ??= 42; will call both foo() and bar() twice, but foo(bar() + 1) ??= 42; will only call foo() twice. This is likely not by design, and was just overlooked in the implementation. The RFC does not specify how function calls in the lhs of the coalesce assignment behaves. This should probably be improved in the future. Now, the problem this commit actually fixes is that ??= may memoize expressions inside assert() function calls that may not actually execute. This is not only an issue when using the VAR in the second expression (which would usually also be skipped) but also when freeing the VAR. For this reason, it is not safe to memoize assert() sub-expressions. There are two possible solutions: 1. Don't memoize any sub-expressions of assert(), meaning they will execute twice. 2. Throw a compile error. Option 2 is not quite simple, because we can't disallow all memoization inside assert(), as that would break assertions like assert($array[foo()] ??= 'bar');. Code like this is highly unlikely (and dubious) but possible. In this case, we would need to make sure that a memoized value could not be used across the assert boundary it was created in. The complexity for this is not worthwhile. So we opt for option 1 and disable memoization immediately inside assert(). Fixes GH-11580 Closes GH-11581
2023-07-03 20:59:13 +08:00
. Fixed use-of-uninitialized-value with ??= on assert. (ilutov)
Fix double-compilation of arrow-function We transform the arrow function by nesting the expression into a return statement. If we compile the arrow function twice this would be done twice, leading to a compile assertion. Fix oss-fuzz #60411 Closes GH-11632
2023-07-08 19:00:23 +08:00
. Fixed oss-fuzz #60411 (Fix double-compilation of arrow-functions). (ilutov)
zend_gdb disable gdb detection for FreeBSD < 11. ref PR: https://github.com/php/php-src/pull/11599. Close GH-11646
2023-07-09 17:48:01 +08:00
. Fixed build for FreeBSD before the 11.0 releases. (David Carlier)
Fix mis-compilation of by-reference nullsafe operator Fixes oss-fuzz #60011 Closes GH-11540 Co-authored-by: Dmitry Stogov <dmitry@zend.com> Co-authored-by: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
2023-06-27 01:08:52 +08:00
Fix crash when an invalid callback function is passed to CURLMOPT_PUSHFUNCTION Previously this caused a SIGABRT. Closes GH-11639.
2023-07-09 00:30:28 +08:00
- Curl:
. Fix crash when an invalid callback function is passed to
CURLMOPT_PUSHFUNCTION. (nielsdos)
[ci skip] Add forgotten NEWS entry
2023-06-23 23:50:41 +08:00
- Date:
. Fixed bug GH-11368 (Date modify returns invalid datetime). (Derick)
Fix bug GH-11600: Can't parse time strings which include (narrow) non-breaking space characters
2023-07-11 23:29:04 +08:00
. Fixed bug GH-11600 (Can't parse time strings which include (narrow)
non-breaking space characters). (Derick)
[ci skip] Update NEWS
2023-08-03 20:13:01 +08:00
. Fixed bug GH-11854 (DateTime:createFromFormat stopped parsing datetime with
extra space). (nielsdos, Derick)
[ci skip] Add forgotten NEWS entry
2023-06-23 23:50:41 +08:00
Fix GH-11625: DOMElement::replaceWith() doesn't replace node with DOMDocumentFragment but just deletes node or causes wrapping <></> depending on libxml2 version Depending on the libxml2 version, the behaviour is either to not render the fragment correctly, or to wrap it inside <></>. Fix it by unpacking fragments manually. This has the side effect that we need to move the unlinking check in the replacement function to earlier because the empty child list is now possible in non-error cases. Also fixes a mistake in the linked list management. Closes GH-11627.
2023-07-08 05:13:56 +08:00
- DOM:
. Fixed bug GH-11625 (DOMElement::replaceWith() doesn't replace node with
DOMDocumentFragment but just deletes node or causes wrapping <></>
depending on libxml2 version). (nielsdos)
NEWS: Add note for #11298 [ci skip] Signed-off-by: Anatol Belski <ab@php.net>
2023-07-02 00:57:46 +08:00
- Fileinfo:
. Fixed bug GH-11298 (finfo returns wrong mime type for xz files). (Anatol)
Fix context option check for "overwrite" in FTP Use zend_is_true() to read value of FTP context option "overwrite". Closes GH-11332.
2023-05-28 09:47:27 +08:00
- FTP:
. Fix context option check for "overwrite". (JonasQuinten)
Fix GH-10562: Memory leak and invalid state with consecutive ftp_nb_fget When the user does not fully consume the data stream, but instead opens a new one, a memory leak occurs. Moreover, the state is invalid: when more commands arrive they'll be handled out-of-sync because the state of the client does not match what the server is doing. This leads to all sorts of weirdness, for example: Warning: ftp_nb_fget(): OK. Fix it by gracefully closing the old data stream when a new data stream is started. Closes GH-11606.
2023-07-07 03:07:52 +08:00
. Fixed bug GH-10562 (Memory leak and invalid state with consecutive
ftp_nb_fget). (nielsdos)
Fix context option check for "overwrite" in FTP Use zend_is_true() to read value of FTP context option "overwrite". Closes GH-11332.
2023-05-28 09:47:27 +08:00
Fix most external GD 2.3.3 compatibility * ext/gd/tests/bug45799.phpt: tweak to work with external gd. The expected output from this test contains an extra newline with gd-2.3.3 from the system (Gentoo). Adding a whitespace wildcard takes care of it, and the test still passes with the bundled version of gd. * ext/gd/tests: external gd-2.3.3 compatibility. Support for the legacy "gd" image format was removed from gd-2.3.3 upstream: https://github.com/libgd/libgd/blob/master/CHANGELOG.md#233---2021-09-12 Several tests for the gd extension utilize that format, and naturally fail when gd-2.3.3 from the system is used. This commit skips those tests when the version of gd is at least 2.3.3. * ext/gd/tests/bug73159.phpt: skip with external gd >= 2.3.3 This test uses the imagegd2() function to check that https://github.com/libgd/libgd/issues/289 is fixed. When an external gd without support for the "gd" format is used, no error is thrown, but a nonsense result is printed: this is normal. The corresponding upstream test is disabled in that situation; it's not expected to work. This commit skips the corresponding PHP test under the same circumstances to fix a test failure with external gd >= 2.3.3. * ext/gd/tests/bug73155.phpt: skip with external gd >= 2.3.3 This test uses the imagegd2() function to check that https://github.com/libgd/libgd/issues/309 is fixed. When an external gd without support for the "gd" format is used, no error is thrown, but a nonsense result is printed: this is normal. The corresponding upstream test is disabled in that situation; it's not expected to work. This commit skips the corresponding PHP test under the same circumstances to fix a test failure with external gd >= 2.3.3. * ext/gd/tests/bug73157.phpt: skip with external gd >= 2.3.3 This test ensures that the third (chunk_size) parameter to imagegd2() is respected when a fourth parameter is also given. However, when an external gd without support for the "gd" format is used, the call to imagegd2() does not really work at all. It doesn't fail, but it produces an "image" with a nonsense chunk size. To avoid failures when an external gd >= 2.3.3 is used, we skip the test entirely in that case. * ext/gd/tests/bug77973.phpt: accept lowercase "Invalid" This test fails with an external gd because the test expects "Invalid" where upstream gd says "invalid". This commit tweaks the expected output to accept an arbitrary character in the i/I position. * ext/gd/tests/bug39780_extern.phpt: update for external gd-2.3.3. Since there are no CI runs with external gd, I can only assume that this test has fallen out-of-date due to changes in PHP itself. I've tweaked the expected output (only slightly) so that the test passes with both gd-2.3.2 and gd-2.3.3. * ext/gd/tests/bug66356.phpt: update expected output for external gd. Newer (external) versions of GD start their error messages with lowercase characters, whereas this test is expecting them in uppercase. A single-character wildcard now supports both formats. * ext/gd/tests/imagegd_truecolor.phpt: skip with external gd >= 2.3.3. This test uses the imagegd() function, but the "gd" format has been disabled by default in upstream gd-2.3.3. We still get some kind of image data back from the call to imagegd(), but its "signature", "truecolor", and "size" no longer match the expected values. This commit skips the test when an external gd >= 2.3.3 is used. * ext/gd/tests/createfromwbmp2_extern.phpt: update for external gd-2.3.3. * ext/gd/tests/libgd00086_extern.phpt: update for external gd-2.3.3. Since there are no CI runs with external gd, I can only assume that this test has fallen out-of-date due to changes in PHP itself. I've tweaked the expected output (only slightly) so that the test passes with both gd-2.3.2 and gd-2.3.3. * ext/gd/tests/bug77272.phpt: update expected output for external gd. Newer (external) versions of GD start their error messages with lowercase characters, whereas this test is expecting them in uppercase. A single-character wildcard now supports both formats. * ext/gd/tests/bug77479.phpt: update for newer external gd. This test fails with gd-2.3.3 (at least) due to minor capitalization and whitespace issues. We add some wildcards to account for the difference. Closes GH-11257. Closes GH-11262. Closes GH-11264. Closes GH-11280.
2023-05-17 20:59:53 +08:00
- GD:
. Fix most of the external libgd test failures. (Michael Orlitzky)
ext/intl: Fix memory leak in MessageFormatter::format() Closes GH-11658
2023-07-10 18:23:49 +08:00
- Intl:
. Fix memory leak in MessageFormatter::format() on failure. (Girgias)
NEWS Signed-off-by: Ben Ramsey <ramsey@php.net>
2023-08-01 05:00:57 +08:00
- Libxml:
. Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading
in XML without enabling it). (CVE-2023-3823) (nielsdos, ilutov)
Fix GH-11300: license issue: restricted unicode license headers Closes GH-11572.
2023-07-02 00:34:40 +08:00
- MBString:
. Fix GH-11300 (license issue: restricted unicode license headers).
(nielsdos)
Fix GH-10914: OPCache with Enum and Callback functions results in segmentation fault See linked issue for analysis. Closes GH-11675.
2023-07-11 22:39:25 +08:00
- Opcache:
. Fixed bug GH-10914 (OPCache with Enum and Callback functions results in
segmentation fault). (nielsdos)
Prevent potential deadlock if accelerated globals cannot be allocated Not sure if this is possible to hit in practice, zend_accel_error_noreturn doesn't return so the unlock isn't called. Other callsites that use both zend_accel_error_noreturn and zend_shared_alloc_unlock first perform the unlocking. Closes GH-11718.
2023-07-17 08:44:35 +08:00
. Prevent potential deadlock if accelerated globals cannot be allocated.
(nielsdos)
Fix GH-10914: OPCache with Enum and Callback functions results in segmentation fault See linked issue for analysis. Closes GH-11675.
2023-07-11 22:39:25 +08:00
Fix GH-11498: SIGCHLD is not always returned from proc_open Linux, and maybe other unixes, may merge multiple standard signals into a single one. This causes issues when keeping track of process IDs. Solve this by manually checking which children are dead using waitpid(). Test case is based on taka-oyama's test code. Closes GH-11509.
2023-06-23 06:04:07 +08:00
- PCNTL:
. Fixed bug GH-11498 (SIGCHLD is not always returned from proc_open).
(nielsdos)
Fix GH-11587 PDO::ATTR_STRINGIFY_FETCHES should return strings even in if PDO::ATTR_EMULATE_PREPARES is enabled This also includes a fix for the MySQL ND driver to actually respect the user decided behaviour. Closes GH-11622 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-07-07 20:32:43 +08:00
- PDO:
Merge branch 'PHP-8.1' into PHP-8.2 * PHP-8.1: Fix GH-11587 PDO::ATTR_STRINGIFY_FETCHES should return strings even in if PDO::ATTR_EMULATE_PREPARES is enabled
2023-07-17 14:09:13 +08:00
. Fix GH-11587 (After php8.1, when PDO::ATTR_EMULATE_PREPARES is true
Fix GH-11587 PDO::ATTR_STRINGIFY_FETCHES should return strings even in if PDO::ATTR_EMULATE_PREPARES is enabled This also includes a fix for the MySQL ND driver to actually respect the user decided behaviour. Closes GH-11622 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-07-07 20:32:43 +08:00
and PDO::ATTR_STRINGIFY_FETCHES is true, decimal zeros are no longer
filled). (SakiTakamachi)
Fix GH-11492: Make test failure: ext/pdo_sqlite/tests/bug_42589.phpt Closes GH-11494.
2023-06-21 08:02:15 +08:00
- PDO SQLite:
. Fix GH-11492 (Make test failure: ext/pdo_sqlite/tests/bug_42589.phpt).
(KapitanOczywisty, CViniciusSDias)
Add missing check on EVP_VerifyUpdate() in phar util Closes GH-11640.
2023-07-09 02:17:04 +08:00
- Phar:
. Add missing check on EVP_VerifyUpdate() in phar util. (nielsdos)
NEWS Signed-off-by: Ben Ramsey <ramsey@php.net>
2023-08-01 05:00:57 +08:00
. Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()).
(CVE-2023-3824) (nielsdos)
Add missing check on EVP_VerifyUpdate() in phar util Closes GH-11640.
2023-07-09 02:17:04 +08:00
Merge branch 'PHP-8.1' into PHP-8.2 * PHP-8.1: Fix GH-9669: phpdbg -h options doesn't list the -z option
2023-07-08 01:17:35 +08:00
- PHPDBG:
. Fixed bug GH-9669 (phpdbg -h options doesn't list the -z option). (adsr)
Remove session ID set through REQUEST_URI
2023-06-18 04:49:53 +08:00
- Session:
. Removed broken url support for transferring session ID. (ilutov)
Fix serialization of RC1 objects appearing in object graph twice Previously, if an object had RC1 it would never be recorded in php_serialize_data.ht because it was assumed that it could not be encountered again. This assumption is incorrect though as the object itself may be saved inside an array with RCn. This results in a new instance of the object, instead of a second reference to the same object. This is solved by tracking these objects in php_serialize_data.ht. To retain performance, track if the current object resides in a potentially nested RCn array. If not, and if the object is RC1 itself it may be omitted from php_serialize_data.ht. Additionally, we may treat the array root itself as RC1 because it may not appear in the object graph again without recursion. Recursive arrays are still somewhat broken even with this change, as the tracking of the array only happens when the reference is encountered, thus resulting in a -> a' -> a' for a self recursive array a -> a. Recursive arrays have limited support in serialize anyway, so we ignore this case for now. Co-authored-by: Dmitry Stogov <dmitry@zend.com> Co-authored-by: Martin Hoch <martin@littlerobot.de> Closes GH-11349 Closes GH-11305
2023-05-23 23:39:17 +08:00
- Standard:
. Fix serialization of RC1 objects appearing in object graph twice. (ilutov)
Fix various bugs related to DNF types - GH-11958: DNF types in trait properties do not get bound properly - GH-11883: Memory leak in zend_type_release() for non-arena allocated DNF types - Internal trait bound to userland class would not be arena allocated - Property DNF types were not properly deep copied during lazy loading Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com> Co-authored-by: ju1ius <jules.bernable@gmail.com>
2023-08-15 05:34:56 +08:00
[ci skip] Update NEWS for c3ccc36 Fix in Streams moved from 8.2.10 to 8.2.9
2023-07-19 18:35:18 +08:00
- Streams:
. Fixed bug GH-11735 (Use-after-free when unregistering user stream wrapper
from itself). (ilutov)
Fix serialization of RC1 objects appearing in object graph twice Previously, if an object had RC1 it would never be recorded in php_serialize_data.ht because it was assumed that it could not be encountered again. This assumption is incorrect though as the object itself may be saved inside an array with RCn. This results in a new instance of the object, instead of a second reference to the same object. This is solved by tracking these objects in php_serialize_data.ht. To retain performance, track if the current object resides in a potentially nested RCn array. If not, and if the object is RC1 itself it may be omitted from php_serialize_data.ht. Additionally, we may treat the array root itself as RC1 because it may not appear in the object graph again without recursion. Recursive arrays are still somewhat broken even with this change, as the tracking of the array only happens when the reference is encountered, thus resulting in a -> a' -> a' for a self recursive array a -> a. Recursive arrays have limited support in serialize anyway, so we ignore this case for now. Co-authored-by: Dmitry Stogov <dmitry@zend.com> Co-authored-by: Martin Hoch <martin@littlerobot.de> Closes GH-11349 Closes GH-11305
2023-05-23 23:39:17 +08:00
Fix replaced error handling in SQLite3Stmt::__construct The error handling is replaced using zend_replace_error_handling(), but when SQLITE3_CHECK_INITIALIZED() returns early, the old error handling isn't restored. In the past, SQLITE3_CHECK_INITIALIZED() threw a warning when the check failed. This was replaced a few years ago with an error exception. So we can fix the bug by just removing the replacing error handling as it accomplishes nothing anymore. Closes GH-11607.
2023-07-07 04:02:56 +08:00
- SQLite3:
. Fix replaced error handling in SQLite3Stmt::__construct. (nielsdos)
Fix GH-11548 (Argument corruption when calling XMLReader::open or XMLReader::XML non-statically with observer active)
2023-06-30 21:18:37 +08:00
- XMLReader:
. Fix GH-11548 (Argument corruption when calling XMLReader::open or
XMLReader::XML non-statically with observer active). (Bob)
PHP-8.2 is now for PHP 8.2.9-dev
2023-06-20 22:25:30 +08:00
06 Jul 2023, PHP 8.2.8
PHP-8.2 is now for PHP 8.2.8-dev
2023-05-24 04:56:58 +08:00
Fix bug GH-11246 cli/get_set_process_title Fail to clobber_error only when the argv is a non-contiguous area Don't increment the end_of_error if a non-contiguous area is encountered in environ Closes GH-11247
2023-05-16 08:37:42 +08:00
- CLI:
. Fixed bug GH-11246 (cli/get_set_process_title fails on MacOS).
(James Lucas)
Fix GCC 12 compilation on riscv64 Close GH-11321
2023-05-26 02:26:28 +08:00
- Core:
. Fixed build for the riscv64 architecture/GCC 12. (Daniil Gentili)
Fix GH-11433: Unable to set CURLOPT_ACCEPT_ENCODING to NULL Closes GH-11446.
2023-06-13 05:58:34 +08:00
- Curl:
. Fixed bug GH-11433 (Unable to set CURLOPT_ACCEPT_ENCODING to NULL).
(nielsdos)
Fix GH-11455: Segmentation fault with custom object date properties Closes GH-11473.
2023-06-18 19:33:15 +08:00
- Date:
. Fixed bug GH-11455 (Segmentation fault with custom object date properties).
(nielsdos)
Fix GH-11288 and GH-11289 and GH-11290 and GH-9142: DOMExceptions and segfaults with replaceWith This replaces the implementation of before and after with one following the spec very strictly, instead of trying to figure out the state we're in by looking at the pointers. Also relaxes the condition on text node copying to prevent working on a stale node pointer. Closes GH-11299.
2023-05-23 05:50:06 +08:00
- DOM:
. Fixed bugs GH-11288 and GH-11289 and GH-11290 and GH-9142 (DOMExceptions
and segfaults with replaceWith). (nielsdos)
Fix GH-10234: Setting DOMAttr::textContent results in an empty attribute value We can't directly call xmlNodeSetContent, because it might encode the string through xmlStringLenGetNodeList for types XML_DOCUMENT_FRAG_NODE, XML_ELEMENT_NODE, XML_ATTRIBUTE_NODE. In these cases we need to use a text node to avoid the encoding. For the other cases, we *can* rely on xmlNodeSetContent because it is either a no-op, or handles the content without encoding and clears the properties field if needed. The test was taken from the issue report, for the test: Co-authored-by: ThomasWeinert <thomas@weinert.info> Closes GH-10245.
2023-01-07 02:51:49 +08:00
. Fixed bug GH-10234 (Setting DOMAttr::textContent results in an empty
attribute value). (nielsdos)
Fix return value in stub file for DOMNodeList::item Not explicitly documenting the possibility of returning DOMElement causes the Intelephense linter (a popular PHP linter with ~9 million downloads: https://marketplace.visualstudio.com/items?itemName=bmewburn.vscode-intelephense-client) to think this code is bad: $xp->query("whatever")->item(0)->getAttribute("foo"); DOMNode does not have getAttribute (while DOMElement does). Documenting the DOMElement return type should fix Intelephense's linter. Closes GH-11342.
2023-05-29 22:53:00 +08:00
. Fix return value in stub file for DOMNodeList::item. (divinity76)
Fix spec compliance error for DOMDocument::getElementsByTagNameNS Spec link: https://dom.spec.whatwg.org/#concept-getelementsbytagnamens Spec says we should match any namespace when '*' is provided. This was however not the case: elements that didn't have a namespace were not returned. This patch fixes the error by modifying the namespace check. Closes GH-11343.
2023-05-30 00:36:02 +08:00
. Fix spec compliance error with '*' namespace for
DOMDocument::getElementsByTagNameNS. (nielsdos)
Fix DOMElement::append() and DOMElement::prepend() hierarchy checks We could end up in an invalid hierarchy, resulting in infinite loops and eventual crashes if we don't check for the DOM hierarchy validity. Closes GH-11344.
2023-05-30 04:29:50 +08:00
. Fix DOMElement::append() and DOMElement::prepend() hierarchy checks.
(nielsdos)
Fix GH-11347: Memory leak when calling a static method inside an xpath query It's a type confusion bug. `zend_make_callable` may change the function name of the fci to become an array, causing a crash in debug mode on `zval_ptr_dtor_str(&fci.function_name);` in `dom_xpath_ext_function_php`. On a production build it doesn't crash but only causes a leak, because the array elements are not destroyed, only the array container itself is. We can use the nogc variant because it cannot contain cycles, the potential array can only contain 2 strings. Closes GH-11350.
2023-05-30 23:20:04 +08:00
. Fixed bug GH-11347 (Memory leak when calling a static method inside an
xpath query). (nielsdos)
Fix bug #67440: append_node of a DOMDocumentFragment does not reconcile namespaces The test was amended from the original issue report. For the test: Co-authored-by: php@deep-freeze.ca The problem is that the regular dom_reconcile_ns() only works on a single node. We actually have to reconciliate the whole tree in case a fragment was added. This also required to move some code around such that this special case could be handled separately. Closes GH-11362.
2023-06-03 22:41:44 +08:00
. Fixed bug #67440 (append_node of a DOMDocumentFragment does not reconcile
namespaces). (nielsdos)
Fix bug #81642: DOMChildNode::replaceWith() bug when replacing a node with itself Closes GH-11363.
2023-06-03 23:54:37 +08:00
. Fixed bug #81642 (DOMChildNode::replaceWith() bug when replacing a node
with itself). (nielsdos)
Fix bug #77686: Removed elements are still returned by getElementById From the moment an ID is created, libxml2's behaviour is to cache that element, even if that element is not yet attached to the document. Similarly, only upon destruction of the element the ID is actually removed by libxml2. Since libxml2 has such behaviour deeply ingrained in the library, and uses the cache for various purposes, it seems like a bad idea and lost cause to fight it. Instead, we'll simply walk the tree upwards to check if the node is attached to the document. Closes GH-11369.
2023-06-04 21:13:37 +08:00
. Fixed bug #77686 (Removed elements are still returned by getElementById).
(nielsdos)
Fix #70359 and #78577: segfaults with DOMNameSpaceNode * Fix type confusion and parent reference * Manually manage the lifetime of the parent * Add regression tests * Break out to a helper, and apply the use-after-free fix to xpath Closes GH-11402.
2023-06-09 03:22:20 +08:00
. Fixed bug #70359 (print_r() on DOMAttr causes Segfault in
php_libxml_node_free_list()). (nielsdos)
. Fixed bug #78577 (Crash in DOMNameSpace debug info handlers). (nielsdos)
Fix lifetime issue with getAttributeNodeNS() It's the same issue that I fixed previously in GH-11402, but in a different place. Closes GH-11422.
2023-06-11 04:48:16 +08:00
. Fix lifetime issue with getAttributeNodeNS(). (nielsdos)
Fix "invalid state error" with cloned namespace declarations Closes GH-11429.
2023-06-12 05:44:58 +08:00
. Fix "invalid state error" with cloned namespace declarations. (nielsdos)
Fix bug #55294 and #47530 and #47847: namespace reconciliation issues We'll use the DOM wrapper version of libxml2 instead of the regular one. It's conforming to the behaviour we expect of DOM. Most of this patch is tests. I based and extended the tests on the code attached with the aforementioned bug reports. Therefore the credits for the tests: Co-authored-by: hilse at web dot de Co-authored-by: robin2008 at altruists dot org Co-authored-by: sgunderson at bigfoot dot com We'll also change the searching point of the internal reconciliation to start at the top of the added tree to avoid redundant work now that the function is changed. Closes GH-11454.
2023-06-15 03:49:31 +08:00
. Fixed bug #55294 and #47530 and #47847 (various namespace reconciliation
issues). (nielsdos)
Fix #80332: Completely broken array access functionality with DOMNamedNodeMap The problem is the usage of zval_get_long(). In particular, if the string is non-numeric the result of zval_get_long() will be 0 without giving an error or warning. This is misleading for users: users get the impression that they can use strings to access the map because it coincidentally works for the first item (which is at index 0). Of course, this fails with any other index which causes confusion and bugs. This patch adds proper support for using string offsets while accessing the map. It does so by detecting if it's a non-numeric string, and then using the getNamedItem() method instead of item(). I had to split up the array access implementation code for DOMNodeList and DOMNamedNodeMap first to be able to do this. Closes GH-11468.
2023-06-18 02:52:52 +08:00
. Fixed bug #80332 (Completely broken array access functionality with
DOMNamedNodeMap). (nielsdos)
Fix GH-11288 and GH-11289 and GH-11290 and GH-9142: DOMExceptions and segfaults with replaceWith This replaces the implementation of before and after with one following the spec very strictly, instead of trying to figure out the state we're in by looking at the pointers. Also relaxes the condition on text node copying to prevent working on a stale node pointer. Closes GH-11299.
2023-05-23 05:50:06 +08:00
Fix allocation loop in zend_shared_alloc_startup() The break is outside the if, so if it succeeds or not this will always stop after the first loop iteration instead of trying more allocators if the first one fails. Closes GH-11306.
2023-05-24 01:50:09 +08:00
- Opcache:
. Fix allocation loop in zend_shared_alloc_startup(). (nielsdos)
Access violation when ALLOC_FALLBACK fixed Close GH-11312
2023-05-24 23:23:27 +08:00
. Access violation on smm_shared_globals with ALLOC_FALLBACK. (KoudelkaB)
Fix GH-11336: php still tries to unlock the shared memory ZendSem with opcache.file_cache_only=1 but it was never locked I chose to check for the value of lock_file instead of checking the file_cache_only, because it is probably a little bit faster and we're going to access the lock_file variable anyway. It's also more generic. Closes GH-11341.
2023-05-29 22:39:58 +08:00
. Fixed bug GH-11336 (php still tries to unlock the shared memory ZendSem
with opcache.file_cache_only=1 but it was never locked). (nielsdos)
Fix allocation loop in zend_shared_alloc_startup() The break is outside the if, so if it succeeds or not this will always stop after the first loop iteration instead of trying more allocators if the first one fails. Closes GH-11306.
2023-05-24 01:50:09 +08:00
Fix bug GH-9356: Incomplete SAN validation of IPv6 address IPv6 addresses are valid entries in subjectAltNames. Certificate Authorities may issue certificates including IPv6 addresses except if they fall within addresses in the RFC 4193 range. Google and CloudFlare provide IPv6 addresses in their DNS over HTTPS services. Internal CAs do not have those restrictions and can issue Unique local addresses in certificates. Closes GH-11145
2023-04-28 09:02:49 +08:00
- OpenSSL:
. Fixed bug GH-9356 Incomplete validation of IPv6 Address fields in
subjectAltNames (James Lucas, Jakub Zelenka).
Fix preg_replace_callback_array() pattern validation Closes GH-11301
2023-05-23 19:55:50 +08:00
- PCRE:
. Fix preg_replace_callback_array() pattern validation. (ilutov)
ext/pgsql: fix PGtrace invalid free issue. disable trace when closing the connection, is a no op if there is no stream attached to it. Close GH-11403
2023-06-09 05:52:49 +08:00
- PGSQL:
. Fixed intermittent segfault with pg_trace. (David Carlier)
Fix cross-compilation check in phar generation for FreeBSD FreeBSD's shell is very POSIX strict. This patch makes sure it works correctly under FreeBSD too. Closes GH-11441.
2023-06-13 01:19:11 +08:00
- Phar:
. Fix cross-compilation check in phar generation for FreeBSD. (peter279k)
Fix GH-11338: SplFileInfo empty getBasename with more than one slash Regressed in 13e4ce386bb7. Closes GH-11340.
2023-05-29 22:16:01 +08:00
- SPL:
. Fixed bug GH-11338 (SplFileInfo empty getBasename with more than one
slash). (nielsdos)
Fix access on NULL pointer in array_merge_recursive() Closes GH-11303
2023-05-23 18:10:27 +08:00
- Standard:
. Fix access on NULL pointer in array_merge_recursive(). (ilutov)
Fix exception handling in array_multisort() Closes GH-11302
2023-05-23 15:54:54 +08:00
. Fix exception handling in array_multisort(). (ilutov)
PHP-8.2 is now for PHP 8.2.8-dev
2023-05-24 04:56:58 +08:00
Fix GH-11451: Invalid associative array containing duplicate keys It used the "add_new" variant which assumes the key doesn't already exist. But in case of duplicate keys we have to take the last result. Closes GH-11453.
2023-06-15 02:37:03 +08:00
- SQLite3:
. Fixed bug GH-11451 (Invalid associative array containing duplicate
keys). (nielsdos)
[skip ci] Fix release date of PHP 8.2.7
2023-05-25 11:41:36 +08:00
08 Jun 2023, PHP 8.2.7
PHP-8.2 is now for PHP 8.2.7-dev
2023-04-25 23:33:13 +08:00
Allow aliasing namespaces containing reserved class names This reverts commit b9f7123c5e4ccdc3c381ab949ff01e3c14f3465c. Fixes GH-11152 Closes GH-11153
2023-04-28 17:40:44 +08:00
- Core:
. Fixed bug GH-11152 (Unable to alias namespaces containing reserved class
names). (ilutov)
Fix GH-9068: Conditional jump or move depends on uninitialised value(s) This patch preserves the scratch registers of the SysV x86-64 ABI by storing them to the stack and restoring them later. We need to do this to prevent the registers of the caller from being corrupted. The reason these get corrupted is because the compiler is unaware of the Valgrind replacement function and thus makes assumptions about the original function regarding registers which are not true for the replacement function. For implementation I used a GCC and Clang attribute. A more general approach would be to use inline assembly but that's also less portable and quite hacky. This attributes is supported since GCC 7.x, but the target option is only supported since 11.x. For Clang the target option does not matter. Closes GH-10221.
2023-05-03 03:21:01 +08:00
. Fixed bug GH-9068 (Conditional jump or move depends on uninitialised
value(s)). (nielsdos)
Fix GH-11189: Exceeding memory limit in zend_hash_do_resize leaves the array in an invalid state There are more places in zend_hash.c where the resize happened after some values on the HashTable struct were set. I reordered them all, but writing a test for these would rely on the particular amount of bytes allocated at given points in time.
2023-05-05 18:00:32 +08:00
. Fixed bug GH-11189 (Exceeding memory limit in zend_hash_do_resize leaves
the array in an invalid state). (Bob)
Fix compilation error on old GCC versions In older versions of GCC (<=4.5) designated initializers would not accept member names nested inside anonymous structures. Instead, we need to use a positional member wrapped in {}. Fixes GH-11063 Closes GH-11212
2023-05-10 02:09:42 +08:00
. Fixed bug GH-11063 (Compilation error on old GCC versions). (ingamedeo)
Fix GH-11222: foreach by-ref may jump over keys during a rehash Signed-off-by: Bob Weinand <bobwei9@hotmail.com>
2023-05-10 22:44:29 +08:00
. Fixed bug GH-11222 (foreach by-ref may jump over keys during a rehash).
(Bob)
Allow aliasing namespaces containing reserved class names This reverts commit b9f7123c5e4ccdc3c381ab949ff01e3c14f3465c. Fixes GH-11152 Closes GH-11153
2023-04-28 17:40:44 +08:00
Fix GH-11281: DateTimeZone::getName() does not include seconds in offset If the seconds portion is non-zero, include the seconds in the output. Closes GH-11282.
2023-05-20 07:19:28 +08:00
- Date:
. Fixed bug GH-11281 (DateTimeZone::getName() does not include seconds in
offset). (nielsdos)
Fix GH-10834: exif_read_data() cannot read smaller stream wrapper chunk sizes php_stream_read() may return less than the requested amount of bytes by design. This patch introduces a static function for exif which reads from the stream in a loop until all the requested bytes are read. For the test: Co-authored-by: dotpointer Closes GH-10924.
2023-03-24 23:01:52 +08:00
- Exif:
. Fixed bug GH-10834 (exif_read_data() cannot read smaller stream wrapper
chunk sizes). (nielsdos)
Fix GH-10461: Postpone FPM child freeing in event loop This is to prevent after free accessing of the child event that might happen when child is killed and the message is delivered at that same time. Also fixes GH-10889 and properly fixes GH-8517 that was not previously fixed correctly.
2023-04-15 23:07:09 +08:00
- FPM:
. Fixed bug GH-10461 (PHP-FPM segfault due to after free usage of
child->ev_std(out|err)). (Jakub Zelenka)
Fix bug #64539: FPM status - query_string not properly JSON encoded Closes GH-11050
2023-04-10 21:15:57 +08:00
. Fixed bug #64539 (FPM status page: query_string not properly JSON encoded).
(Jakub Zelenka)
FPM: Fix memory leak for invalid primary script file handle Closes GH-11088
2023-04-16 22:54:45 +08:00
. Fixed memory leak for invalid primary script file handle. (Jakub Zelenka)
Fix GH-10461: Postpone FPM child freeing in event loop This is to prevent after free accessing of the child event that might happen when child is killed and the message is delivered at that same time. Also fixes GH-10889 and properly fixes GH-8517 that was not previously fixed correctly.
2023-04-15 23:07:09 +08:00
Fix GH-11180: hash_file() appears to be restricted to 3 arguments Closes GH-11198.
2023-05-07 00:23:24 +08:00
- Hash:
. Fixed bug GH-11180 (hash_file() appears to be restricted to 3 arguments).
(nielsdos)
Fix GH-11160: Few tests failed building with new libxml 2.11.0 It's possible to categorise the failures into 2 categories: - Changed error message. In this case we either duplicate the test and modify the error message. Or if the change in error message is small, we use the EXPECTF matchers to make the test compatible with both old and new versions of libxml2. - Missing warnings. This is caused by a change in libxml2 where the parser started using SAX APIs internally [1]. In this case the error_type passed to php_libxml_internal_error_handler() changed from PHP_LIBXML_ERROR to PHP_LIBXML_CTX_WARNING because it internally started to use the SAX handlers instead of the generic handlers. However, for the SAX handlers the current input stack is empty, so nothing is actually printed. I fixed this by falling back to a regular warning without a filename & line number reference, which mimicks the old behaviour. Furthermore, this change now also shows an additional warning in a test which was previously hidden. [1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/9a82b94a94bd310db426edd453b0f38c6c8f69f5 Closes GH-11162.
2023-04-30 03:07:50 +08:00
- LibXML:
. Fixed bug GH-11160 (Few tests failed building with new libxml 2.11.0).
(nielsdos)
Fix segfault in mb_strrpos/mb_strripos with ASCII encoding and negative offset We're setting the encoding from PHP_FUNCTION(mb_strpos), but mbfl_strpos would discard it, setting it to mbfl_encoding_pass, making zend_memnrstr fail due to a null-pointer exception. Fixes GH-11217 Closes GH-11220
2023-05-10 20:12:27 +08:00
- MBString:
. Fix bug GH-11217 (Segfault in mb_strrpos / mb_strripos when using negative
offset and ASCII encoding). (ilutov)
Fix incorrect match default branch optimization Fixes GH-11134 Closes GH-11135
2023-04-26 17:55:23 +08:00
- Opcache:
. Fixed bug GH-11134 (Incorrect match default branch optimization). (ilutov)
Fix too wide OR and AND range inference There is a typo which causes the AND and OR range inference to infer a wider range than necessary. Fix this typo. There are many ranges for which the inference is too wide, I just picked one for AND and one for OR that I found through symbolic execution. In this example test, the previous range inferred for test_or was [-27..-1] instead of [-20..-1]. And the previous range inferred for test_and was [-32..-25] instead of [-28..-25]. Closes GH-11170.
2023-05-01 07:54:23 +08:00
. Fixed too wide OR and AND range inference. (nielsdos)
Fix delayed early binding class redeclaration error If we bind the class to the runtime slot even if we're not the ones who have performed early binding we'll miss the redeclaration error in the ZEND_DECLARE_CLASS_DELAYED handler. Closes GH-11226
2023-05-11 06:25:21 +08:00
. Fixed missing class redeclaration error with OPcache enabled. (ilutov)
Fix GH-11245 (In some specific cases SWITCH with one default statement will cause segfault) The block optimizer pass allows the use of sources of the preceding block if the block is a follower and not a target. This causes issues when trying to remove FREE instructions: if the source is not in the block of the FREE, then the FREE and source are still removed. Therefore the other successor blocks, which must consume or FREE the temporary, will still contain the FREE opline. This opline will now refer to a temporary that doesn't exist anymore, which most of the time results in a crash. For these kind of non-local scenarios, we'll let the SSA based optimizations handle those cases. Closes GH-11251.
2023-05-17 00:03:47 +08:00
. Fixed bug GH-11245 (In some specific cases SWITCH with one default
statement will cause segfault). (nielsdos)
PHP-8.2 is now for PHP 8.2.7-dev
2023-04-25 23:33:13 +08:00
Fix maximum argument count of pcntl_forkx() Closes GH-11199.
2023-05-07 00:26:57 +08:00
- PCNTL:
. Fixed maximum argument count of pcntl_forkx(). (nielsdos)
Fix ZPP of pg_lo_export() Closes GH-11132
2023-04-26 05:20:39 +08:00
- PGSQL:
. Fixed parameter parsing of pg_lo_export(). (kocsismate)
Fix GH-11099: Generating phar.php during cross-compile can't be done Closes GH-11243.
2023-05-16 00:31:57 +08:00
- Phar:
. Fixed bug GH-11099 (Generating phar.php during cross-compile can't be
done). (peter279k)
Fix GH-8426: make test fail while soap extension build If you build soap as a shared object, then these tests fail on non-Windows, or when the PHP install hasn't been make install-ed yet, but is executed from the development directory. Closes GH-11211.
2023-05-09 05:37:12 +08:00
- Soap:
Update NEWS
2023-06-07 06:10:06 +08:00
. Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random
[ci skip] add CVE in NEWS
2023-06-22 14:06:11 +08:00
bytes in HTTP Digest authentication for SOAP).
(CVE-2023-3247) (nielsdos, timwolla)
Fix GH-8426: make test fail while soap extension build If you build soap as a shared object, then these tests fail on non-Windows, or when the PHP install hasn't been make install-ed yet, but is executed from the development directory. Closes GH-11211.
2023-05-09 05:37:12 +08:00
. Fixed bug GH-8426 (make test fail while soap extension build). (nielsdos)
Fix GH-11178: Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18) Dynamic property case in zend_get_property_info() can return NULL for prop info. This was not handled. Closes GH-11182.
2023-05-03 02:53:22 +08:00
- SPL:
. Fixed bug GH-11178 (Segmentation fault in spl_array_it_get_current_data
(PHP 8.1.18)). (nielsdos)
Propagate STREAM_DISABLE_OPEN_BASEDIR src flag to php_stream_stat_path_ex Otherwise we can get open_basedir warnings from the stat call while still performing the actual copy. Fixes GH-11138 Closes GH-11156
2023-04-29 00:04:47 +08:00
- Standard:
. Fixed bug GH-11138 (move_uploaded_file() emits open_basedir warning for
source file). (ilutov)
Fix GH-11274: POST/PATCH request via file_get_contents + stream_context_create switches to GET after a HTTP 308 redirect RFC 7231 states that status code 307 should keep the POST method upon redirect. RFC 7538 does the same for code 308. Although it's not mandated by the RFCs that PATCH is also kept (we can choose), it seems like keeping PATCH will be the most consistent and understandable behaviour. This patch also changes an existing test because it was testing for the wrong behaviour. Closes GH-11275.
2023-05-19 18:55:39 +08:00
. Fixed bug GH-11274 (POST/PATCH request switches to GET after a HTTP 308
redirect). (nielsdos)
Propagate STREAM_DISABLE_OPEN_BASEDIR src flag to php_stream_stat_path_ex Otherwise we can get open_basedir warnings from the stat call while still performing the actual copy. Fixes GH-11138 Closes GH-11156
2023-04-29 00:04:47 +08:00
Fix GH-11175 and GH-11177: Stream socket timeout undefined behaviour A negative value like -1 may overflow and cause incorrect results in the timeout variable, which causes an immediate timeout. As this is caused by undefined behaviour the exact behaviour depends on the compiler, its version, and the platform. A large overflow is also possible, if an extremely large timeout value is passed we also set an indefinite timeout. This is because the timeout value is at least a 64-bit number and waiting for UINT64_MAX/1000000 seconds is waiting about 584K years. Closes GH-11183.
2023-05-03 05:45:50 +08:00
- Streams:
Fix GH-10031: [Stream] STREAM_NOTIFY_PROGRESS over HTTP emitted irregularly for last chunk of data It's possible that the server already sent in more data than just the headers. Since the stream only accepts progress increments after the headers are processed, the already read data is never added to the process. We account for this by adjusting the progress counter by the difference of already read header data and the body. For the test: Co-authored-by: aetonsi <18366087+aetonsi@users.noreply.github.com> Closes GH-10492.
2023-02-03 07:00:42 +08:00
. Fixed bug GH-10031 ([Stream] STREAM_NOTIFY_PROGRESS over HTTP emitted
irregularly for last chunk of data). (nielsdos)
Fix GH-11175 and GH-11177: Stream socket timeout undefined behaviour A negative value like -1 may overflow and cause incorrect results in the timeout variable, which causes an immediate timeout. As this is caused by undefined behaviour the exact behaviour depends on the compiler, its version, and the platform. A large overflow is also possible, if an extremely large timeout value is passed we also set an indefinite timeout. This is because the timeout value is at least a 64-bit number and waiting for UINT64_MAX/1000000 seconds is waiting about 584K years. Closes GH-11183.
2023-05-03 05:45:50 +08:00
. Fixed bug GH-11175 (Stream Socket Timeout). (nielsdos)
. Fixed bug GH-11177 (ASAN UndefinedBehaviorSanitizer when timeout = -1
passed to stream_socket_accept/stream_socket_client). (nielsdos)
PHP-8.2 is now for PHP 8.2.7-dev
2023-04-25 23:33:13 +08:00
11 May 2023, PHP 8.2.6
PHP-8.2 is now for PHP 8.2.6-dev
2023-03-29 05:27:17 +08:00
Unary minus const expression consistency - of 0.0 should result in -0.0 Closes GH-10978
2023-03-30 19:22:52 +08:00
- Core:
. Fix inconsistent float negation in constant expressions. (ilutov)
Fix GH-8841: php-cli core dump calling a badly formed function It's actually not php-cli specific, nor SAPI specific. We should delay the registration of the function into the function table until after the compilation was successful, otherwise the function is mistakingly registered and a NULL dereference will happen when trying to call it. I based my test of Nikita's test, so credits to him for the test: https://github.com/php/php-src/pull/8933#issuecomment-1259881008 Closes GH-10989.
2023-04-01 20:25:38 +08:00
. Fixed bug GH-8841 (php-cli core dump calling a badly formed function).
(nielsdos)
Fix GH-10737: PHP 8.1.16 segfaults on line 597 of sapi/apache2handler/sapi_apache2.c The TSRM keeps a hashtable mapping the thread IDs to the thread resource pointers. It's possible that the thread disappears without us knowing, and then another thread gets spawned some time later with the same ID as the disappeared thread. Note that since it's a new thread the TSRM key pointer and cached pointer will be NULL. The Apache request handler `php_handler()` will try to fetch some fields from the SAPI globals. It uses a lazy thread resource allocation by calling `ts_resource(0);`. This allocates a thread resource and sets up the TSRM pointers if they haven't been set up yet. At least, that's what's supposed to happen. But since we are in a situation where the thread ID still has the resources of the *old* thread associated in the hashtable, the loop in `ts_resource_ex` will find that thread resource and assume the thread has been setup already. But this is not the case since this thread is actually a new thread, just reusing the ID of the old one, without any relation whatsoever to the old thread. Because of this assumption, the TSRM pointers will not be setup, leading to a NULL pointer dereference when trying to access the SAPI globals. We can easily detect this scenario: if we're in the fallback path, and the pointer is NULL, and we're looking for our own thread resource, we know we're actually reusing a thread ID. In that case, we'll free up the old thread resources gracefully (gracefully because there might still be resources open like database connection which need to be shut down cleanly). After freeing the resources, we'll create the new resources for this thread as if the stale resources never existed in the first place. From that point forward, it is as if that situation never occurred. The fact that this situation happens isn't that bad because a child process containing threads will eventually be respawned anyway by the SAPI, so the stale thread resources won't remain forever. Note that we can't simply assign our own TSRM pointers to the existing thread resource for our ID, since it was actually from a different thread (just with the same ID!). Furthermore, the dynamically loaded extensions have their own pointer, which is only set when their constructor is called, so we'd have to call their constructor anyway... I also tried to call the dtor and then the ctor again for those resources on the pre-existing thread resource to reuse storage, but that didn't work properly because other code doesn't expect something like that to happen, which breaks assumptions, and this in turn caused Valgrind to (rightfully) complain about memory bugs. Note 2: I also had to fix a bug in the core globals destruction because it always assumed that the thread destroying them was the owning thread, which on TSRM shutdown isn't always the case. A similar bug was fixed recently with the JIT globals. Closes GH-10863.
2023-03-16 04:18:37 +08:00
. Fixed bug GH-10737 (PHP 8.1.16 segfaults on line 597 of
[ci skip] UPDATE NEWS ElliotNB helped me a lot debugging this by constantly testing the patches. It is only fair that he is mentioned too, as I couldn't have solved it without his help.
2023-04-12 04:17:47 +08:00
sapi/apache2handler/sapi_apache2.c). (nielsdos, ElliotNB)
Fix GH-11028: Heap Buffer Overflow in zval_undefined_cv. For analysis see https://github.com/php/php-src/issues/11028#issuecomment-1508460440 Closes GH-11083.
2023-04-08 21:23:58 +08:00
. Fixed bug GH-11028 (Heap Buffer Overflow in zval_undefined_cv.). (nielsdos)
Fix incorrect CG(memoize_mode) state after bailout in ??= Fixes GH-11108 Closes GH-11109
2023-04-20 21:41:50 +08:00
. Fixed bug GH-11108 (Incorrect CG(memoize_mode) state after bailout in ??=).
(ilutov)
Unary minus const expression consistency - of 0.0 should result in -0.0 Closes GH-10978
2023-03-30 19:22:52 +08:00
Add NEWS entry
2023-04-18 20:48:29 +08:00
- Date:
. Fixed bug where the diff() method would not return the right result around
DST changeover for date/times associated with a timezone identifier. (Derick)
Import timelib 2022.07 to address OSS fuzz issue
2023-04-21 18:29:56 +08:00
. Fixed out-of-range bug when converting to/from around the LONG_MIN unix
timestamp. (Derick)
Add NEWS entry
2023-04-18 20:48:29 +08:00
[ci skip] NEWS
2023-03-31 03:41:11 +08:00
- DOM:
. Fixed bug #80602 (Segfault when using DOMChildNode::before()).
(Nathan Freeman)
Fix incorrect error handling in dom_zvals_to_fragment() Discovered this pre-existing problem while testing GH-10682. Note: this problem existed *before* that PR. * Not all paths throw a hierarchy request error * xmlFreeNode must be used instead of xmlFree for the fragment to also free its children. * Free up nodes that couldn't be added when xmlAddChild fails. I unified the error handling code that's exactly the same with a goto to prevent at least some of such problems in the future. Closes GH-10981.
2023-03-31 03:28:09 +08:00
. Fixed incorrect error handling in dom_zvals_to_fragment(). (nielsdos)
PHP-8.1 is now for PHP 8.1.19-dev
2023-03-30 08:51:20 +08:00
Fix GH-9397: exif read : warnings and errors : Potentially invalid endianess, Illegal IFD size and Undefined index Don't misinterpret DJI info maker note as DJI maker note. The DJI and DJI info maker note both share the "DJI" make string. This caused the current code to try to interpret the DJI info maker note as a DJI maker note. However, the DJI info maker note requires custom parsing. Therefore, the misinterpretation actually caused the current code to believe that there was an unrecoverable error in the IFD for the maker note by returning false in the maker note parser. This in turn caused the inability to parse other EXIF metadata. This patch adds the identification of the DJI info maker note so that it cannot be misinterpreted. Since we don't implement custom parsing, it achieves this by setting the tag list to a special marker value (in this case the NULL pointer). When this marker value is detected, the function will just skip parsing the maker note and return true. Therefore, the other code will believe that the IFD is not corrupt. This approach is similar to handing an unrecognised maker note type (see the loop on top of exif_process_IFD_in_MAKERNOTE() which also returns true and treats it as a string). The end result of this patch is that the DJI info maker note is considered as unknown to the caller of exif_process_IFD_in_MAKERNOTE(), and therefore that the other EXIF metadata can be parsed successfully. Also fix debug output typos in exif. Closes GH-10470.
2023-01-30 06:32:52 +08:00
- Exif:
. Fixed bug GH-9397 (exif read : warnings and errors : Potentially invalid
endianess, Illegal IFD size and Undefined index). (nielsdos)
[ci skip] NEWS for 11071
2023-04-18 17:46:18 +08:00
- Intl:
. Fixed bug GH-11071 (TZData version not displayed anymore). (Remi)
Fix incorrect zval type_flags in preg_replace_callback_array() for immutable arrays The ZVAL_ARR macro always set the zval type_info to IS_ARRAY_EX, even if the hash table is immutable. Since in preg_replace_callback_array() we can return the passed array directly, and that passed array can be immutable, we need to reset the type_flags to keep the VM from performing ref-counting on the array. Fixes GH-10968 Closes GH-10970
2023-03-29 20:37:52 +08:00
- PCRE:
. Fixed bug GH-10968 (Segfault in preg_replace_callback_array()). (ilutov)
Fix GH-10983: State-dependant segfault in ReflectionObject::getProperties This is a variant of GH-10200, but in a different place. Basically, simplexml may create a properties table that's packed instead of associative. But the macro that was used to loop over the properties table assumed that it was always associative. Replace it by the macro that figures it out automatically which one of the two it is. For test: Co-authored-by: jnvsor Closes GH-10984.
2023-03-31 06:27:30 +08:00
- Reflection:
. Fixed bug GH-10983 (State-dependant segfault in
ReflectionObject::getProperties). (nielsdos)
Handle indirect zvals and use up-to-date properties in SplFixedArray::__serialize Closes GH-10925.
2023-03-25 02:18:28 +08:00
- SPL:
. Handle indirect zvals and use up-to-date properties in
SplFixedArray::__serialize. (nielsdos)
Fix GH-10990: mail() throws TypeError after iterating over $additional_headers array by reference We should dereference the values, otherwise references don't work. Closes GH-10991.
2023-04-01 21:02:30 +08:00
- Standard:
. Fixed bug GH-10990 (mail() throws TypeError after iterating over
$additional_headers array by reference). (nielsdos)
Support enums in array_unique Fixes GH-9775 Closes GH-11015
2023-04-05 00:19:19 +08:00
. Fixed bug GH-9775 (Duplicates returned by array_unique when using enums).
(ilutov)
Fix GH-10990: mail() throws TypeError after iterating over $additional_headers array by reference We should dereference the values, otherwise references don't work. Closes GH-10991.
2023-04-01 21:02:30 +08:00
Fix GH-10406: feof() behavior change for UNIX based socket resources This change restores the old behaviour for the server socket streams that don't support IO. This is now stored in the stream flags so it can be later used to do some other decisions and possibly introduce some better error reporting. Closes GH-10877
2023-03-19 03:38:01 +08:00
- Streams:
. Fixed bug GH-10406 (feof() behavior change for UNIX based socket
resources). (Jakub Zelenka)
PHP-8.2 is now for PHP 8.2.6-dev
2023-03-29 05:27:17 +08:00
[skip ci] Fix PHP 8.2.5 release date in NEWS
2023-03-31 11:29:56 +08:00
13 Apr 2023, PHP 8.2.5
PHP-8.2 is now for PHP 8.2.5-dev
2023-02-28 23:15:20 +08:00
[ci skip] NEWS
2023-03-03 18:46:16 +08:00
- Core:
. Added optional support for max_execution_time in ZTS/Linux builds
(Kévin Dunglas)
Fix GH-10709: UAF in recursive AST evaluation Fixes https://oss-fuzz.com/testcase-detail/6445949468934144 Closes GH-10718
2023-02-27 20:47:57 +08:00
. Fixed use-after-free in recursive AST evaluation. (ilutov)
Fix GH-8646: Memory leak PHP FPM 8.1 Fixes GH-8646 See https://github.com/php/php-src/issues/8646 for thorough discussion. Interned strings that hold class entries can get a corresponding slot in map_ptr for the CE cache. map_ptr works like a bump allocator: there is a counter which increases to allocate the next slot in the map. For class name strings in non-opcache we have: - on startup: permanent + interned - on request: interned For class name strings in opcache we have: - on startup: permanent + interned - on request: either not interned at all, which we can ignore because they won't get a CE cache entry or they were already permanent + interned or we get a new permanent + interned string in the opcache persistence code Notice that the map_ptr layout always has the permanent strings first, and the request strings after. In non-opcache, a request string may get a slot in map_ptr, and that interned request string gets destroyed at the end of the request. The corresponding map_ptr slot can thereafter never be used again. This causes map_ptr to keep reallocating to larger and larger sizes. We solve it as follows: We can check whether we had any interned request strings, which only happens in non-opcache. If we have any, we reset map_ptr to the last permanent string. We can't lose any permanent strings because of map_ptr's layout. Closes GH-10783.
2023-03-05 06:22:05 +08:00
. Fixed bug GH-8646 (Memory leak PHP FPM 8.1). (nielsdos)
Re-add some CTE functions that were removed from being CTE by a mistake These functions were accidentally removed from being CTE in GH-7780. This patch brings them back. Closes GH-10768.
2023-03-04 06:58:26 +08:00
. Re-add some CTE functions that were removed from being CTE by a mistake.
(mvorisek)
Remove CTE flag from array_diff_ukey(), which was added by mistake This was accidentally added in GH-7780, but since it takes a callable argument, this flag is useless on this function. Closes GH-10859.
2023-03-16 00:20:26 +08:00
. Remove CTE flag from array_diff_ukey(), which was added by mistake.
(mvorisek)
Fix GH-10801: Named arguments in CTE functions cause a segfault Fixes GH-10801 Named arguments are not supported by the constant evaluation routine, in the sense that they are ignored. This causes two issues: - It causes a crash because not all oplines belonging to the call are removed, which results in SEND_VA{L,R} which should've been removed. - It causes semantic issues (demonstrated in the test case). This case never worked anyway, leading to crashes or incorrect behaviour, so just prevent CTE of calls with named parameters for now. We can choose to support it later, but introducing support for this in a stable branch seems too dangerous. This patch does not change the removal of SEND_* opcodes in remove_call because the crash bug can't be triggered anymore with this patch as there are no named parameters anymore and no variadic CTE functions exist. Closes GH-10811.
2023-03-09 05:49:41 +08:00
. Fixed bug GH-10801 (Named arguments in CTE functions cause a segfault).
(nielsdos)
Fix GH-8789 and GH-10015: Fix ZTS zend signal crashes due to NULL globals Fixes GH-8789. Fixes GH-10015. This is one small part of the underlying bug for GH-10737, as in my attempts to reproduce the issue I constantly hit this crash easily. (The fix for the other underlying issue for that bug will follow soon.) It's possible that a signal arrives at a thread that never handled a PHP request before. This causes the signal globals to dereference a NULL pointer because the TSRM pointers for the thread aren't set up to point to the thread resources yet. PR GH-9766 previously fixed this for master by ignoring the signal if the thread didn't handle a PHP request yet. While this fixes the crash bug, I think the solution is suboptimal for 3 reasons: 1) The signal is ignored and a message is printed saying there is a bug. However, this is not a bug at all. For example in Apache, the signal set up happens on child process creation, and the thread resource creation happens lazily when the first request is handled by the thread. Hence, the fact that the thread resources aren't set up yet is not actually buggy behaviour. 2) I believe since it was believed to be buggy behaviour, that fix was only applied to master, so 8.1 & 8.2 keep on crashing. 3) We can do better than ignoring the signal. By just acting in the same way as if the signals aren't active. This means we need to take the same path as if the TSRM had already shut down. Closes GH-10861.
2023-03-16 05:28:08 +08:00
. Fixed bug GH-8789 (PHP 8.0.20 (ZTS) zend_signal_handler_defer crashes on
apache). (nielsdos)
. Fixed bug GH-10015 (zend_signal_handler_defer crashes on apache shutdown).
(nielsdos)
Fix NUL byte in exception string terminating Exception::__toString() Fixes GH-10810 Closes GH-10873
2023-03-18 02:35:58 +08:00
. Fixed bug GH-10810 (Fix NUL byte terminating Exception::__toString()).
(ilutov)
Reset EG(trampoline).op_array.last_var that FFI may modify Closes GH-10916
2023-03-24 03:30:56 +08:00
. Fix potential memory corruption when mixing __callStatic() and FFI. (ilutov)
PHP-8.2 is now for PHP 8.2.5-dev
2023-02-28 23:15:20 +08:00
Fix GH-10747: Private and protected properties in serialized Date* objects throw
2023-03-09 19:15:58 +08:00
- Date:
. Fixed bug GH-10747 (Private and protected properties in serialized Date*
objects throw). (Derick)
Fix GH-10611: fpm_env_init_main leaks environ Closes GH-10618.
2023-02-19 03:41:26 +08:00
- FPM:
. Fixed bug GH-10611 (fpm_env_init_main leaks environ). (nielsdos)
Destroy file_handle in fpm_main If it's not in the CG(open_files) list, we need to destroy the file handle ourselves. Co-authored-by: Jakub Zelenka <bukka@php.net> Closes GH-10707.
2023-02-26 20:21:37 +08:00
. Destroy file_handle in fpm_main. (Jakub Zelenka, nielsdos)
Fix bug #74129: Incorrect SCRIPT_NAME with apache ProxyPassMatch This happens when there are spaces are in the path info. The reason is that Apache decodes the path info part in the SCRIPT_NAME as per CGI RFC. FPM tries to strip path info from the SCRIPT_NAME but the comparison is done against SCRIPT_FILENAME which is not decoded. For that to work we have to decode it before comparison if there is any encoded character. Closes GH-10869
2023-03-13 03:30:16 +08:00
. Fixed bug #74129 (Incorrect SCRIPT_NAME with apache ProxyPassMatch when
spaces are in path). (Jakub Zelenka)
Fix GH-10611: fpm_env_init_main leaks environ Closes GH-10618.
2023-02-19 03:41:26 +08:00
Propagate success status of ftp_close() to userland The docs say that this function returns true on success, and false on error. This function always returns true in the current implementation because the success return value from ftp_close() is never propagated to userland. This affects one test: since the test server exits after an invalid login, the ftp close correctly fails (because the server has gone away).
2023-03-03 18:24:32 +08:00
- FTP:
. Propagate success status of ftp_close(). (nielsdos)
Fix GH-10521: ftp_get/ftp_nb_get resumepos offset is maximum 10GB The char arrays were too small for a long on 64-bit systems, which resulted in cutting off the string at the end with a NUL byte. Use a size of MAX_LENGTH_OF_LONG to fix this issue instead of a fixed size of 11 chars. Closes GH-10525.
2023-02-07 05:53:29 +08:00
. Fixed bug GH-10521 (ftp_get/ftp_nb_get resumepos offset is maximum 10GB).
(nielsdos)
Propagate success status of ftp_close() to userland The docs say that this function returns true on success, and false on error. This function always returns true in the current implementation because the success return value from ftp_close() is never propagated to userland. This affects one test: since the test server exits after an invalid login, the ftp close correctly fails (because the server has gone away).
2023-03-03 18:24:32 +08:00
ext/imap/config.m4: -Werror=implicit-function-declaration compatibility. The recent clang-16 throws errors for implicitly defined functions by default. In many ./configure tests, an undefined function (which is "implicitly defined" when you try to call it) is undefined because it really does not exist. But in one case, utf8_to_mutf7() is undefined because we forgot to include the header that defines it. This commit updates the test for utf8_to_mutf7: * We now include the header (c-client.h) that defines it. * A "checking... yes/no" message was added to the test. * The test was switched from PHP_IMAP_TEST_BUILD to AC_COMPILE_IFELSE. This was the easiest way to avoid a return-type mismatch that runs afoul of -Werror=implicit-int. * CPPFLAGS is temporarily amended with the -I flag needed to find c-client.h. Fixes GH-10947. Closes GH-10948 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-03-26 22:30:57 +08:00
- IMAP:
. Fix build failure with Clang 16. (orlitzky)
Fix GH-8979: Possible Memory Leak with SSL-enabled MySQL connections The stream context inside `mysqlnd_vio::enable_ssl()` is leaking. In particular: when `php_stream_context_set()` get called the refcount of `context` is increased by 1, which means that `context` will now have a refcount of 2. Later on we remove the context from the stream by calling `php_stream_context_set(stream, NULL)` but that leaves our `context` with a refcount of 1, and therefore it's never destroyed. In my test case this yielded a leak of 1456 bytes per connection (but could be more depending on your settings ofc). Annoyingly, Valgrind doesn't find it because the context is still in the `EG(regular_list)` and will thus be destroyed at the end of the request. However, I still think this bug needs to be fixed because as the users in the issue report already mentioned: there can be long-running PHP scripts. Fix it by decreasing the refcount to transfer the ownership. Closes GH-10909.
2023-03-23 04:49:37 +08:00
- MySQLnd:
. Fixed bug GH-8979 (Possible Memory Leak with SSL-enabled MySQL
connections). (nielsdos)
Fix GH-10728: opcache capstone header's inclusion. Remove capstone include folder. For most of the supported systems it worked fine somehow despite the pkg-config --cflags, but is always include it even on Linux. Closes GH-10732.
2023-03-01 03:14:46 +08:00
- Opcache:
. Fixed build for macOS to cater with pkg-config settings. (David Carlier)
Fix GH-8065: opcache.consistency_checks > 0 causes segfaults in PHP >= 8.1.5 in fpm context Disable opcache.consistency_checks. This feature does not work right now and leads to memory leaks and other problems. For analysis and discussion see GH-8065. In GH-10624 it was decided to disable the feature to prevent problems for end users. If end users which to get some consistency guarantees, they can rely on opcache.protect_memory. Closes GH-10798.
2023-03-07 04:06:54 +08:00
. Fixed bug GH-8065 (opcache.consistency_checks > 0 causes segfaults in
PHP >= 8.1.5 in fpm context). (nielsdos)
Fix GH-10728: opcache capstone header's inclusion. Remove capstone include folder. For most of the supported systems it worked fine somehow despite the pkg-config --cflags, but is always include it even on Linux. Closes GH-10732.
2023-03-01 03:14:46 +08:00
Add missing error check on PEM_write_bio_PKCS7() Closes GH-10752.
2023-03-05 03:10:10 +08:00
- OpenSSL:
. Add missing error checks on file writing functions. (nielsdos)
Fix GH-10908: Bus error with PDO Firebird on RPI with 64 bit kernel and 32 bit userland The alignment of sqldata is in most cases only the basic alignment, so the code type-puns it to a larger type, it *can* crash due to the misaligned access. This is only an issue for types > 4 bytes because every sensible system requires an alignment of at least 4 bytes for allocated data. Even though this patch uses memcpy, the compiler is smart enough to optimise it to something more efficient, especially on x86. This is just the usual approach to solve these alignment problems. Actually, unaligned memory access is undefined behaviour, so even on x86 platforms, where the bug doesn't cause a crash, this can be problematic. Furthermore, even though the issue talks about a 64-bit kernel and 32-bit userspace, this doesn't necessarily need to be the case to trigger this crash. Test was Co-authored-by: rvk01 Closes GH-10920.
2023-03-24 05:53:18 +08:00
- PDO Firebird:
. Fixed bug GH-10908 (Bus error with PDO Firebird on RPI with 64 bit kernel
and 32 bit userland). (nielsdos)
Fix GH-10766: PharData archive created with Phar::Zip format does not keep files metadata (datetime) Due to an incorrect check, the datetime was never actually set. To test this we need to write the file using phar, but read the file using a different method to not get a cached, or a value that's been transformed twice and is therefore accidentally correct. Closes GH-10769
2023-03-04 07:04:02 +08:00
- Phar:
. Fixed bug GH-10766 (PharData archive created with Phar::Zip format does
not keep files metadata (datetime)). (nielsdos)
Add missing error checks on EVP_MD_CTX_create() and EVP_VerifyInit() The first one returns NULL on error, and the second one returns 0 on error. These weren't checked. Closes GH-10762.
2023-03-03 22:17:21 +08:00
. Add missing error checks on EVP_MD_CTX_create() and EVP_VerifyInit().
(nielsdos)
Fix GH-10766: PharData archive created with Phar::Zip format does not keep files metadata (datetime) Due to an incorrect check, the datetime was never actually set. To test this we need to write the file using phar, but read the file using a different method to not get a cached, or a value that's been transformed twice and is therefore accidentally correct. Closes GH-10769
2023-03-04 07:04:02 +08:00
Merge branch 'PHP-8.1' into PHP-8.2 * PHP-8.1: Fix missing and inconsistent error check on SQLAllocHandle
2023-03-16 04:38:12 +08:00
- PDO ODBC:
. Fixed missing and inconsistent error checks on SQLAllocHandle. (nielsdos)
ext/psql: pg_meta_data, extended mode, fix typo for pseudo typtype. Closes GH-10865.
2023-03-17 03:28:07 +08:00
- PGSQL:
. Fixed typo in the array returned from pg_meta_data (extended mode).
(David Carlier)
Fix GH-10519: Array Data Address Reference Issue We need to carry around a reference to the underlying Bucket to be able to modify it by reference. Closes GH-10749 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-03-02 21:15:56 +08:00
- SPL:
. Fixed bug GH-10519 (Array Data Address Reference Issue). (Nathan Freeman)
Fix GH-10907: Unable to serialize processed SplFixedArrays in PHP 8.2.4 The properties table can also contain numeric entries after a rebuild of the table based on the array. Since the array can only contain numeric entries, and the properties table can contain a mix of both, we'll add the numeric entries from the array and only the string entries from the properties table. To implement this we simply check if the key from the properties table is a string. Closes GH-10921.
2023-03-23 03:44:54 +08:00
. Fixed bug GH-10907 (Unable to serialize processed SplFixedArrays in
PHP 8.2.4). (nielsdos)
[skip ci] Add NEWS entry
2023-03-25 23:26:18 +08:00
. Fixed bug GH-10844 (ArrayIterator allows modification of readonly props).
(ilutov)
Fix GH-10519: Array Data Address Reference Issue We need to carry around a reference to the underlying Bucket to be able to modify it by reference. Closes GH-10749 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-03-02 21:15:56 +08:00
Fix GH-10885: Leaking stream_socket_server context `php_stream_context_set` already increases the refcount. Closes GH-10886
2023-03-20 19:08:13 +08:00
- Standard:
. Fixed bug GH-10885 (stream_socket_server context leaks). (ilutov)
Fix GH-10052: Browscap crashes PHP 8.1.12 on request shutdown (apache2) get_browser() implements a lazy parse system for the browscap INI configuration. There are two possible moments when a browscap configuration can be loaded: during module startup or during request. In case of module startup, the strings are persistent strings, while for the request they are not. The INI parser must therefore know whether to create persistent or non-persistent strings. It does this by looking at CG(ini_parser_unbuffered_errors). If that value is 1 it's persistent, otherwise non-persistent. Note that this also controls how the errors are reported: if it's 1 then the errors are sent to stderr, otherwise we get E_WARNINGs. Currently, a hardcoded value of 1 is always used for that CG value in browscap_read_file(). This means we'll always create persistent strings *and* we'll not report parse errors correctly as E_WARNINGs. We fix both the crash and the lack of warnings by passing the value of persistent instead of a hardcoded 1. This is also in line with how other INI parsing code is called in ext/standard: they also make sure that during request a value of 0 is passed. Closes GH-10883.
2023-03-20 05:11:09 +08:00
. Fixed bug GH-10052 (Browscap crashes PHP 8.1.12 on request shutdown
(apache2)). (nielsdos)
Fix buffer-overflow in php_fgetcsv() with \0 delimiter and enclosure Fixes oss-fuzz #57392 Closes GH-10923
2023-03-24 22:19:58 +08:00
. Fixed oss-fuzz #57392 (Buffer-overflow in php_fgetcsv() with \0 delimiter
and enclosure). (ilutov)
Fix undefined behaviour in unpack() atoi()'s return value is actually undefined when an underflow or overflow occurs. For example on 32-bit on my system the overflow test which inputs "h2147483648" results in repetitions==2147483647 and on 64-bit this gives repetitions==-2147483648. The reason the test works on 32-bit is because there's a second undefined behaviour problem: in case 'h' when repetitions==2147483647, we add 1 and divide by 2. This is signed-wrap undefined behaviour and accidentally triggers the overflow check like we wanted to. Avoid all this trouble and use strtol with explicit error checking. This also fixes a semantic bug where repetitions==INT_MAX would result in the overflow check to trigger, even though there is no overflow. Closes GH-10943.
2023-03-26 03:56:17 +08:00
. Fixed undefined behaviour in unpack(). (nielsdos)
Fix GH-10885: Leaking stream_socket_server context `php_stream_context_set` already increases the refcount. Closes GH-10886
2023-03-20 19:08:13 +08:00
PHP-8.2 is now for PHP 8.2.5-dev
2023-02-28 23:15:20 +08:00
16 Mar 2023, PHP 8.2.4
PHP-8.2 is now for PHP 8.2.3-dev
2023-01-18 01:55:22 +08:00
Fix incorrect check condition in ZEND_YIELD The condition `UNEXPECTED(Z_TYPE_P(key)) == IS_REFERENCE` always returned false, because `UNEXPECTED(expression)` always returns 0 or 1. Move the parens so the comparison is executed properly. Closes GH-10332.
2023-01-16 06:15:40 +08:00
- Core:
. Fixed incorrect check condition in ZEND_YIELD. (nielsdos)
[ci skip] NEWS (#10442)
2023-01-25 06:19:21 +08:00
. Fixed incorrect check condition in type inference. (nielsdos)
Fix incorrect check in zend_internal_call_should_throw() This debug code is part of arginfo validation. This validation will never trigger properly because the OR operation makes the first if always true. Fix it by changing to an AND. Closes GH-10417 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-23 04:51:52 +08:00
. Fix incorrect check in zend_internal_call_should_throw(). (nielsdos)
[ci skip] NEWS
2023-01-28 02:37:27 +08:00
. Fixed overflow check in OnUpdateMemoryConsumption. (nielsdos)
. Fixed bug GH-9916 (Entering shutdown sequence with a fiber suspended in a
Generator emits an unavoidable fatal error or crashes). (Arnaud)
[ci skip] NEWS
2023-01-29 00:18:12 +08:00
. Fixed bug GH-10437 (Segfault/assertion when using fibers in shutdown
function after bailout). (trowski)
[ci skip] NEWS (#10586)
2023-02-15 03:27:29 +08:00
. Fixed SSA object type update for compound assignment opcodes. (nielsdos)
Update NEWS with scanner and parser build fixes
2023-02-18 00:36:43 +08:00
. Fixed language scanner generation build. (Daniel Black)
Fix incorrect type for return value of zend_update_static_property_ex() zend_update_static_property_ex() returns a zend_result, but the return value is stored here in a bool. A bool is unsigned on my system, so in case zend_update_static_property_ex() returns FAILURE (== -1) this gets converted to 1 instead. This is not a valid zend_result value. This means that (transitive) callers could mistakingly think the function succeeded while it did in fact not succeed. Fix it by changing the type to zend_result. Closes GH-10691.
2023-02-24 23:53:20 +08:00
. Fixed zend_update_static_property() calling zend_update_static_property_ex()
misleadingly with the wrong return type. (nielsdos)
[skip ci] Add github reference to bug fix in NEWS
2023-02-25 03:44:47 +08:00
. Fix bug GH-10570 (Fixed unknown string hash on property fetch with integer
constant name). (nielsdos)
Fix GH-10692: PHP crashes on Windows when an inexistent filename is executed Fixes GH-10692 php_fopen_primary_script() does not initialize all fields of zend_file_handle. So when it fails and when fastcgi is true, the zend_destroy_file_handle() function will try to free uninitialized pointers, causing a segmentation fault. Fix it by zero-initializing file handles just like the zend_stream_init_fp() counterpart does. Closes GH-10697.
2023-02-25 20:42:45 +08:00
. Fixed php_fopen_primary_script() call resulted on zend_destroy_file_handle()
freeing dangling pointers on the handle as it was uninitialized. (nielsdos)
[ci skip] NEWS (#10442)
2023-01-25 06:19:21 +08:00
ext/curl: suppress -Wdeprecated-declarations Closes GH-10531.
2023-02-07 19:16:03 +08:00
- Curl:
. Fixed deprecation warning at compile time. (Max Kellermann)
Fixed bug GH-10270 Unable to return CURL_READFUNC_PAUSE in readfunc callback Closes GH-10607 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-02-17 12:53:05 +08:00
. Fixed bug GH-10270 (Unable to return CURL_READFUNC_PAUSE in readfunc
callback). (Pierrick Charron)
ext/curl: suppress -Wdeprecated-declarations Closes GH-10531.
2023-02-07 19:16:03 +08:00
Merge remote-tracking branch 'derickr/GH-10152-serialise-datetime' into PHP-8.2
2023-01-31 20:53:29 +08:00
- Date:
Merge remote-tracking branch 'derickr/GH-10447-p-format-specifier' into PHP-8.1
2023-01-31 20:59:03 +08:00
. Fix GH-10447 ('p' format specifier does not yield 'Z' for 00:00). (Derick)
Merge remote-tracking branch 'derickr/GH-10152-serialise-datetime' into PHP-8.2
2023-01-31 20:53:29 +08:00
. Fix GH-10152 (Custom properties of Date's child classes are not
serialised). (Derick)
[ci skip] NEWS (#10442)
2023-01-25 06:19:21 +08:00
- FFI:
. Fixed incorrect bitshifting and masking in ffi bitfield. (nielsdos)
PHP-8.2 is now for PHP 8.2.3-dev
2023-01-18 01:55:22 +08:00
Sync boost/context assembly files for fibers Fixes GH-10398 The stack was misaligned upon entering the trampoline function [1], this causes a CPU trap when the SSE instruction is executed to copy data from the stack. This was fixed upstream [2]. This commit syncs all upstream changes from the boost/context assembly files to our copy. [1] https://github.com/php/php-src/pull/10407#issuecomment-1404180877 [2] https://github.com/boostorg/context/pull/219 Closes GH-10407.
2023-01-22 03:49:31 +08:00
- Fiber:
. Fixed assembly on alpine x86. (nielsdos)
Fix colletion of unfinished function call in fibers Fixes GH-10496. Co-authored-by: Bob Weinand <bobwei9@hotmail.com>
2023-02-11 01:07:34 +08:00
. Fixed bug GH-10496 (segfault when garbage collector is invoked inside of
fiber). (Bob, Arnaud)
Sync boost/context assembly files for fibers Fixes GH-10398 The stack was misaligned upon entering the trampoline function [1], this causes a CPU trap when the SSE instruction is executed to copy data from the stack. This was fixed upstream [2]. This commit syncs all upstream changes from the boost/context assembly files to our copy. [1] https://github.com/php/php-src/pull/10407#issuecomment-1404180877 [2] https://github.com/boostorg/context/pull/219 Closes GH-10407.
2023-01-22 03:49:31 +08:00
Fix GH-10315: FPM unknown child alert not valid This changes the log level for an unknown child during wait as this is not unuasual if FPM master has pid 1 and also possible in some cases for higher pid processes. Based on that and the fact that this is not really a problem, there is just a debug level message emitted for pid 1 and for higher pid a warning is emitted. Closes GH-10319
2023-01-15 00:55:16 +08:00
- FPM:
. Fixed bug GH-10315 (FPM unknown child alert not valid). (Jakub Zelenka)
Fix GH-10385: FPM successful config test early exit This introduces an enum `fpm_init_return_status` to propagate the status up to fpm_main. This also makes the code clearer by not using magic integer return numbers. Closes GH-10388
2023-01-21 05:17:27 +08:00
. Fixed bug GH-10385 (FPM successful config test early exit). (nielsdos)
Fix GH-10315: FPM unknown child alert not valid This changes the log level for an unknown child during wait as this is not unuasual if FPM master has pid 1 and also possible in some cases for higher pid processes. Based on that and the fact that this is not really a problem, there is just a debug level message emitted for pid 1 and for higher pid a warning is emitted. Closes GH-10319
2023-01-15 00:55:16 +08:00
Implement GMP::__construct() Implements a proper constructor for GMP as discussed in both GH-10158 and https://externals.io/message/119216. Fixes GH-10155 Closes GH-10225 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-05 07:28:36 +08:00
- GMP:
. Properly implement GMP::__construct(). (nielsdos)
Fix GH-10647: Spoofchecker isSuspicious/areConfusable methods error code's argument. Closes GH-10653.
2023-02-22 00:13:25 +08:00
- Intl:
. Fixed bug GH-10647 (Spoolchecker isSuspicious/areConfusable methods
error code's argument always returning NULL0. (Nathan Freeman)
Update NEWS with scanner and parser build fixes
2023-02-18 00:36:43 +08:00
- JSON:
. Fixed JSON scanner and parser generation build.
(Daniel Black, Jakub Zelenka)
ext/mbstring: fix new_value length check Commit 8bbd0952e5bba88 added a check rejecting empty strings; in the merge commiot 379d9a1cfc6462 however it was changed to a NULL check, one that did not make sense because ZSTR_VAL() is guaranteed to never be NULL; the length check was accidently removed by that merge commit. This bug was found by GCC's -Waddress warning: ext/mbstring/mbstring.c:748:27: warning: the comparison will always evaluate as ‘true’ for the address of ‘val’ will never be NULL [-Waddress] 748 | if (!new_value || !ZSTR_VAL(new_value)) { | ^ Closes GH-10532 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-02-07 19:26:19 +08:00
- MBString:
. ext/mbstring: fix new_value length check. (Max Kellermann)
Fix GH-10627: mb_convert_encoding crashes PHP on Windows Fixes GH-10627 The php_mb_convert_encoding() function can return NULL on error, but this case was not handled, which led to a NULL pointer dereference and hence a crash. Closes GH-10628 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-02-20 04:43:34 +08:00
. Fix bug GH-10627 (mb_convert_encoding crashes PHP on Windows). (nielsdos)
ext/mbstring: fix new_value length check Commit 8bbd0952e5bba88 added a check rejecting empty strings; in the merge commiot 379d9a1cfc6462 however it was changed to a NULL check, one that did not make sense because ZSTR_VAL() is guaranteed to never be NULL; the length check was accidently removed by that merge commit. This bug was found by GCC's -Waddress warning: ext/mbstring/mbstring.c:748:27: warning: the comparison will always evaluate as ‘true’ for the address of ‘val’ will never be NULL [-Waddress] 748 | if (!new_value || !ZSTR_VAL(new_value)) { | ^ Closes GH-10532 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-02-07 19:26:19 +08:00
Fix incorrect page_size check The current check always evaluated to false because if `!page_size` is true, then `page_size & (page_size - 1)` equals `0 & (0 - 1)` which is always 0. The if condition is meant to check if page_size is zero or not a power of two, thus we must change the AND to an OR to fix this issue. Closes GH-10427 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-24 05:11:08 +08:00
- Opcache:
. Fix incorrect page_size check. (nielsdos)
Fix missing readonly modification error with inc/dec in JIT Closes GH-10746
2023-03-02 08:09:36 +08:00
. Fix readonly modification check when using inc/dec operators on readonly
property with JIT. (ilutov)
Fix incorrect page_size check The current check always evaluated to false because if `!page_size` is true, then `page_size & (page_size - 1)` equals `0 & (0 - 1)` which is always 0. The if condition is meant to check if page_size is zero or not a power of two, thus we must change the AND to an OR to fix this issue. Closes GH-10427 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-24 05:11:08 +08:00
Fix incorrect error checking in php_openssl_set_server_dh_param() SSL_CTX_set_tmp_dh() and SSL_CTX_set0_tmp_dh_pkey() return 1 on success and 0 on error. But only < 0 was checked which means that errors were never caught. Closes GH-10705.
2023-02-26 06:39:00 +08:00
- OpenSSL:
. Fixed php_openssl_set_server_dh_param() DH params errors handling. (nielsdos)
Update NEWS
2023-02-07 23:28:50 +08:00
- PDO OCI:
. Fixed bug #60994 (Reading a multibyte CLOB caps at 8192 chars).
(Michael Voříšek)
Fix GH-10715: phpdbg heap buffer overflow -- by misuse of the option "--run" Fixes GH-10715 When a string starting with a NUL character is passed to phpdbg_vprint(), the vasprintf() will return that 0 characters have been printed. This causes msglen == 0. When phpdbg_process_print() is called with a message of length 0, the -1 to check for '\n' will perform an out of bounds read. Since nothing is printed anyway for msglen == 0, it seems best to just skip the printing routine for this case. Closes GH-10720.
2023-02-28 02:44:42 +08:00
- PHPDBG:
. Fixed bug GH-10715 (heap buffer overflow on --run option misuse). (nielsdos)
Fix GH-10672 (pg_lo_open segfaults in the strict_types mode) We need to use the proper ZPP qualifier for zend_string Closes GH-10677
2023-02-23 13:35:39 +08:00
- PGSQL:
. Fix GH-10672 (pg_lo_open segfaults in the strict_types mode). (girgias)
Fix incorrect check in phar tar parsing The entry.flags was used to check whether the entry has the directory flag. The flags however were masked to only contain the permissions. We need to check the mode, before the permission masking, instead of the flags to check whether it is a directory. Closes GH-10464 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-28 07:07:35 +08:00
- Phar:
. Fix incorrect check in phar tar parsing. (nielsdos)
random: Do not trust arc4random_buf() on glibc (#10390) This effectively reverts #8984. As discussed in #10327 which will enable the use of the getrandom(2) syscall on NetBSD instead of relying on the userland arc4random_buf(), the CSPRNG should prioritize security over speed [1] and history has shown that userland implementations unavoidably fall short on the security side. In fact the glibc implementation is a thin wrapper around the syscall due to security concerns and thus does not provide any benefit over just calling getrandom(2) ourselves. Even without any performance optimizations the CSPRNG should be plenty fast for the vast majority of applications, because they often only need a few bytes of randomness to generate a session ID. If speed is desired, the OO API offers faster, but non-cryptographically secure engines.
2023-01-24 01:21:42 +08:00
- Random:
. Fix GH-10390 (Do not trust arc4random_buf() on glibc). (timwolla)
Merge branch 'PHP-8.1' into PHP-8.2 - PHP-8.1: Fix GH-10292 1st param of mt_srand() has UNKNOWN default on PHP <8.3
2023-01-25 02:42:53 +08:00
. Fix GH-10292 (Made the default value of the first param of srand() and
Fix GH-10292 1st param of mt_srand() has UNKNOWN default on PHP <8.3 Closes GH-10429
2023-01-25 02:00:41 +08:00
mt_srand() unknown). (kocsismate)
random: Do not trust arc4random_buf() on glibc (#10390) This effectively reverts #8984. As discussed in #10327 which will enable the use of the getrandom(2) syscall on NetBSD instead of relying on the userland arc4random_buf(), the CSPRNG should prioritize security over speed [1] and history has shown that userland implementations unavoidably fall short on the security side. In fact the glibc implementation is a thin wrapper around the syscall due to security concerns and thus does not provide any benefit over just calling getrandom(2) ourselves. Even without any performance optimizations the CSPRNG should be plenty fast for the vast majority of applications, because they often only need a few bytes of randomness to generate a session ID. If speed is desired, the OO API offers faster, but non-cryptographically secure engines.
2023-01-24 01:21:42 +08:00
[ci skip] NEWS
2023-02-20 06:48:39 +08:00
- Reflection:
. Fixed bug GH-10623 (Reflection::getClosureUsedVariables opcode fix with
variadic arguments). (nielsdos)
Fix segfault when using ReflectionFiber (fixes #10439) Closes GH-10478
2023-02-23 02:39:10 +08:00
. Fix Segfault when using ReflectionFiber suspended by an internal function.
(danog)
[ci skip] NEWS
2023-02-20 06:48:39 +08:00
Propagate errors correctly in ps_files_cleanup_dir() In SessionHandler::gc, we use a virtual call to PS(default_mod)->s_gc to call the gc implementation. That return value is checked against FAILURE (-1). One of the call targets of PS(default_mod)->s_gc is ps_gc_files(). ps_gc_files() calls to ps_files_cleanup_dir(). The latter function has some error checks and outputs a notice if something goes wrong. In cases of errors, the function returns 0. This means that the check in SessionHandler::gc will misinterpret this as a success and report that 0 files have been *successfully* cleaned up. Fix it by returning -1 to indicate something *did* go wrong. Closes GH-10644.
2023-02-21 18:40:41 +08:00
- Session:
. Fixed ps_files_cleanup_dir() on failure code paths with -1 instead of 0 as
the latter was considered success by callers. (nielsdos).
Fix GH-8086: Introduce mail.mixed_lf_and_crlf INI When this INI option is enabled, it reverts the line separator for headers and message to LF which was a non conformant behavior in PHP 7. It is done because some non conformant MTAs fail to parse CRLF line separator for headers and body. This is used for mail and mb_send_mail functions.
2022-12-30 23:09:48 +08:00
- Standard:
[ci skip] NEWS (#10561)
2023-02-11 07:18:50 +08:00
. Fixed bug GH-8086 (Introduce mail.mixed_lf_and_crlf INI). (Jakub Zelenka)
Fix GH-10292 1st param of mt_srand() has UNKNOWN default on PHP <8.3 Closes GH-10429
2023-01-25 02:00:41 +08:00
. Fixed bug GH-10292 (Made the default value of the first param of srand() and
mt_srand() unknown). (kocsismate)
Fix incorrect check in cs_8559_5 in map_from_unicode() The condition `code == 0x0450 || code == 0x045D` is always false because of an incorrect range check on code. According to the BMP coverage in the encoding spec for ISO-8859-5 (https://encoding.spec.whatwg.org/iso-8859-5-bmp.html) the range of valid characters is 0x0401 - 0x045F (except for 0x040D, 0x0450, 0x045D). The current check has an upper bound of 0x044F instead of 0x045F. Fix this by changing the upper bound. Closes GH-10399 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-21 20:50:36 +08:00
. Fix incorrect check in cs_8559_5 in map_from_unicode(). (nielsdos)
Avoid crash for reset/end/next/prev() on ffi classes (#9711) (And any PECLs returning `zend_empty_array` in the handler->get_properties overrides) Closes GH-9697 This is similar to the fix used in d9651a941915eb5fb5ad557090b65256fd8509b6 for array_walk. This should make it safer for php-src (and PECLs, long-term) to return the empty immutable array in `handler->get_properties` to avoid wasting memory. See https://github.com/php/php-src/issues/9697#issuecomment-1273613175 The only possible internal iterator position for the empty array is at the end of the empty array (nInternalPointer=0). The `zend_hash*del*` helpers will always set nInternalPointer to 0 when an array becomes empty, regardless of previous insertions/deletions/updates to the array.
2023-02-03 22:17:33 +08:00
. Fix bug GH-9697 for reset/end/next/prev() attempting to move pointer of
properties table for certain internal classes such as FFI classes
[skip ci] Update NEWS with bugfixes backported from 8.1
2023-02-21 22:29:02 +08:00
. Fix incorrect error check in browsecap for pcre2_match(). (nielsdos)
Fix GH-8086: Introduce mail.mixed_lf_and_crlf INI When this INI option is enabled, it reverts the line separator for headers and message to LF which was a non conformant behavior in PHP 7. It is done because some non conformant MTAs fail to parse CRLF line separator for headers and body. This is used for mail and mb_send_mail functions.
2022-12-30 23:09:48 +08:00
[ci skip] NEWS (#10561)
2023-02-11 07:18:50 +08:00
- Streams:
. Fixed bug GH-10370 (File corruption in _php_stream_copy_to_stream_ex when
using copy_file_range). (nielsdos)
[ci skip] NEWS
2023-02-11 23:28:51 +08:00
. Fixed bug GH-10548 (copy() fails on cifs mounts because of incorrect
copy_file_range() len). (nielsdos)
[ci skip] NEWS (#10561)
2023-02-11 07:18:50 +08:00
Fix memory leaks in ext-tidy We must not instantiate the object prior checking error conditions Moreover, we need to release the HUGE amount of memory for files which are over 4GB when throwing a ValueError Closes GH-10545
2023-02-08 22:52:40 +08:00
- Tidy:
. Fix memory leaks when attempting to open a non-existing file or a file over
4GB. (Girgias)
[skip ci] Update NEWS with bugfixes backported from 8.1
2023-02-21 22:29:02 +08:00
. Add missing error check on tidyLoadConfig. (nielsdos)
Fix memory leaks in ext-tidy We must not instantiate the object prior checking error conditions Moreover, we need to release the HUGE amount of memory for files which are over 4GB when throwing a ValueError Closes GH-10545
2023-02-08 22:52:40 +08:00
Fix incorrect string length for output_handler in zlib ini code The length of "output_handler" is supposed to be passed, but as sizeof is used, the resulting number includes the NUL character, so the length is off-by-one. Subtract one to pass the correct length. Closes GH-10667.
2023-02-23 02:36:37 +08:00
- Zlib:
. Fixed output_handler directive value's length which counted the string
terminator. (nieldos)
Merge branch 'PHP-8.1' into PHP-8.2
2023-02-14 19:00:20 +08:00
14 Feb 2023, PHP 8.2.3
PHP-8.1 is now for PHP 8.1.17-dev
2023-02-14 03:16:07 +08:00
- Core:
. Fixed bug #81744 (Password_verify() always return true with some hash).
(CVE-2023-0567). (Tim Düsterhus)
. Fixed bug #81746 (1-byte array overrun in common path resolve code).
(CVE-2023-0568). (Niels Dossche)
Fix missing colon in NEWS
2023-02-14 18:46:48 +08:00
- SAPI:
Update NEWS
2023-02-14 18:23:59 +08:00
. Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart
Fix incorrect character in NEWS
2023-02-14 18:33:56 +08:00
request body). (CVE-2023-0662) (Jakub Zelenka)
PHP-8.1 is now for PHP 8.1.15-dev
2022-12-08 01:29:37 +08:00
PHP-8.2 is now for PHP 8.2.3-dev
2023-01-18 01:55:22 +08:00
02 Feb 2023, PHP 8.2.2
PHP-8.2 is now for PHP 8.2.2-dev
2022-12-14 08:29:29 +08:00
Fix GH-10200: zif_get_object_vars: Assertion `!(((__ht)->u.flags & (1<<2)) != 0)' failed. This occurs because the array of properties is a single element with an integer key, not an associative array. Therefore it is a packed array and thus the assumption the iteration macro makes is invalid. This restores the behaviour of PHP<8.2. Closes GH-10209 Co-authored-by: Deltik <deltik@gmx.com> Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-02 22:34:03 +08:00
- Core:
. Fixed bug GH-10200 (zif_get_object_vars:
Assertion `!(((__ht)->u.flags & (1<<2)) != 0)' failed). (nielsdos)
Fix GH-10251: Assertion `(flag & (1<<3)) == 0' failed. zend_get_property_guard previously assumed that at least "str" has a pre-computed hash. This is not always the case, for example when a string is created by bitwise operations, its hash is not set. Instead of forcing a computation of the hashes, drop the hash comparison. Closes GH-10254 Co-authored-by: Changochen <changochen1@gmail.com> Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-07 20:49:24 +08:00
. Fix GH-10251 (Assertion `(flag & (1<<3)) == 0' failed). (nielsdos)
[ci skip] NEWS
2023-01-13 19:29:51 +08:00
. Fix GH-10240 (Assertion failure when adding more than 2**30 elements to an
unpacked array). (Arnaud)
. Fix GH-9735 (Fiber stack variables do not participate in cycle collector).
(Arnaud)
Fix GH-9675: Re-adjust run_time_cache init for internal enum methods Closes GH-10143.
2022-12-21 19:23:58 +08:00
. Fix GH-9675 (Broken run_time_cache init for internal enum methods).
(Petar Obradović, Bob)
[ci skip] NEWS
2023-01-20 23:54:49 +08:00
. Fix GH-10248 (Assertion `!(zval_get_type(&(*(property))) == 10)' failed).
(nielsdos)
Fix GH-10200: zif_get_object_vars: Assertion `!(((__ht)->u.flags & (1<<2)) != 0)' failed. This occurs because the array of properties is a single element with an integer key, not an associative array. Therefore it is a packed array and thus the assumption the iteration macro makes is invalid. This restores the behaviour of PHP<8.2. Closes GH-10209 Co-authored-by: Deltik <deltik@gmx.com> Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-02 22:34:03 +08:00
Fix bug #77106: Missing separator in FPM FastCGI errors
2022-11-30 05:47:53 +08:00
- FPM:
. Fixed bug #77106 (Missing separator in FPM FastCGI errors). (Jakub Zelenka)
Fix GH-9981: FPM does not reset fastcgi.error_header
2022-12-23 02:32:16 +08:00
. Fixed bug GH-9981 (FPM does not reset fastcgi.error_header).
(Jakub Zelenka)
Fix bug #68591: Configuration test does not perform UID lookups Addition check in fpm config test to verify existence of user, group, listen.owner and listen.group. Closes GH-10165
2022-12-24 03:24:57 +08:00
. Fixed bug #68591 (Configuration test does not perform UID lookups).
(Jakub Zelenka)
Fix ASAN reported leak in FPM config test This happens because config test does not shutdown SAPI. In addition this commit also fixes few failures when running FPM tests under root. Closes GH-10296
2023-01-12 19:55:14 +08:00
. Fixed memory leak when running FPM config test. (Jakub Zelenka)
Fix bug #67244: Wrong owner:group for listening unix socket Update FPM www.conf to reflect the actual logic
2023-01-13 18:31:01 +08:00
. Fixed bug #67244 (Wrong owner:group for listening unix socket).
(Jakub Zelenka)
Fix bug #77106: Missing separator in FPM FastCGI errors
2022-11-30 05:47:53 +08:00
Handle exceptions from __toString in XXH3's initialization The initialization routine for XXH3 was not prepared for exceptions from seed. Fix this by using try_convert_to_string. For discussion, please see: GH-10305 Closes GH-10352 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-17 05:33:06 +08:00
- Hash:
. Handle exceptions from __toString in XXH3's initialization (nielsdos)
Fix GH-10112: LDAP\Connection::__construct() refers to ldap_create() There is no `ldap_create()`, but rather `ldap_connect()`. Closes GH-10115.
2022-12-16 19:16:38 +08:00
- LDAP:
. Fixed bug GH-10112 (LDAP\Connection::__construct() refers to ldap_create()).
(cmb)
PHP-8.2 is now for PHP 8.2.2-dev
2022-12-14 08:29:29 +08:00
[ci skip] NEWS
2022-12-21 21:55:53 +08:00
- Opcache:
. Fix inverted bailout value in zend_runtime_jit() (Max Kellermann).
Initialize ping_auto_globals_mask to prevent undefined behaviour Closes GH-10121
2022-12-17 23:02:55 +08:00
. Fix access to uninitialized variable in accel_preload(). (nielsdos)
ext/opcache/jit: handle zend_jit_find_trace() failures Commit 6c25413 added the flag ZEND_JIT_EXIT_INVALIDATE which resets the trace handlers in zend_jit_trace_exit(), but forgot to consider that on ZEND_JIT_TRACE_STOP_LINK, this changed handler gets passed to zend_jit_find_trace(), causing it to fail, either by returning 0 (results in bogus data) or by aborting due to ZEND_UNREACHABLE(). In either case, this crashes the PHP process. I'm not quite sure how to fix this multi-threading problem properly; my suggestion is to just fail the zend_jit_trace() call. After all, the whole ZEND_JIT_EXIT_INVALIDATE fix was about reloading modified scripts, so there's probably no point in this pending zend_jit_trace() call.
2022-12-22 20:02:52 +08:00
. Fix zend_jit_find_trace() crashes. (Max Kellermann)
ext/opcache/jit/zend_jit_trace: add missing lock for EXIT_INVALIDATE Commit 6c254131831 added the flag ZEND_JIT_EXIT_INVALIDATE which resets the trace handlers in zend_jit_trace_exit(), but forgot to lock the shared memory section. This could cause another worker process who still saw the ZEND_JIT_TRACE_JITED flag to schedule ZEND_JIT_TRACE_STOP_LINK, but when it arrived at the ZEND_JIT_DEBUG_TRACE_STOP, the handler was already reverted by the first worker process and thus zend_jit_find_trace() fails. This in turn generated a bogus jump offset in the JITed code, crashing the PHP process.
2022-12-20 05:35:22 +08:00
. Added missing lock for EXIT_INVALIDATE in zend_jit_trace_exit. (Max Kellermann)
[ci skip] NEWS
2022-12-21 21:55:53 +08:00
Fix wrong flags check for compression method in phar_object.c I found this issue using static analysis tools, it reported that the condition was always false. We can see that flags is assigned in the switch statement above, but a mistake was made in the comparison. Closes GH-10328 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-15 22:05:36 +08:00
- Phar:
. Fix wrong flags check for compression method in phar_object.c (nielsdos)
Fix undefined behaviour in phpdbg_load_module_or_extension If zend_register_module_ex were to return NULL, then module_entry will be set to NULL, and the if's body will load module_entry->name. Since module_entry is NULL, loading the name would cause a NULL pointer dereference. However, since a NULL pointer dereference is undefined behaviour, the compiler is free to remove the check. Fix it by using *name instead of module_entry->name. Closes GH-10157 Signed-off-by: George Peter Banyard <girgias@php.net>
2022-12-23 04:03:45 +08:00
- PHPDBG:
. Fix undefined behaviour in phpdbg_load_module_or_extension(). (nielsdos)
Fix null pointer dereference of param When the validation logic for param->type was added, the logic did not account for the case where param could be NULL. The existing code did take that into account as can be seen in the `if (param)` check below. Furthermore, phpdbg_set_breakpoint_expression even calls phpdbg_create_conditional_break with param == NULL. Fix it by placing the validation logic inside a NULL check.
2022-12-27 04:43:53 +08:00
. Fix NULL pointer dereference in phpdbg_create_conditional_breal(). (nielsdos)
Fix GH-9710: phpdbg memory leaks by option "-h" Closes GH-10237 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-06 05:11:15 +08:00
. Fix GH-9710: phpdbg memory leaks by option "-h" (nielsdos)
Fix phpdbg segmentation fault in case of malformed input If you were to enter "w $>" the function would crash with a segmentation fault because last_index is still NULL at that point. Fix it by checking for NULL and erroring out if it is. Closes GH-10353 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-17 06:09:58 +08:00
. Fix phpdbg segmentation fault in case of malformed input (nielsdos)
Fix undefined behaviour in phpdbg_load_module_or_extension If zend_register_module_ex were to return NULL, then module_entry will be set to NULL, and the if's body will load module_entry->name. Since module_entry is NULL, loading the name would cause a NULL pointer dereference. However, since a NULL pointer dereference is undefined behaviour, the compiler is free to remove the check. Fix it by using *name instead of module_entry->name. Closes GH-10157 Signed-off-by: George Peter Banyard <girgias@php.net>
2022-12-23 04:03:45 +08:00
Fix memory leak in posix_ttyname() Closes GH-10190
2022-12-30 23:11:09 +08:00
- Posix:
. Fix memory leak in posix_ttyname() (girgias)
random: Fix check before closing `random_fd` (#10247) If, for whatever reason, the random_fd has been assigned file descriptor `0` it previously failed to close during module shutdown, thus leaking the descriptor.
2023-01-07 21:03:13 +08:00
- Random:
. Fixed bug GH-10247 (Theoretical file descriptor leak for /dev/urandom). (timwolla)
Fix GH-10187: Segfault in stripslashes() with arm64 Closes GH-10188 Co-authored-by: todeveni <toni.viemero@iki.fi> Signed-off-by: George Peter Banyard <girgias@php.net>
2022-12-30 21:31:40 +08:00
- Standard:
. Fix GH-10187 (Segfault in stripslashes() with arm64). (nielsdos)
unserialize: Strictly check for `:{` at object start (#10214) * unserialize: Strictly check for `:{` at object start * unserialize: Update CVE tests It's unlikely that the object syntax error contributed to the actual CVE. The CVE is rather caused by the incorrect object serialization data of the `C` format. Add a second string without such a syntax error to ensure that path is still executed as well to ensure the CVE is absent. * Fix test expectation in gmp/tests/bug74670.phpt No changes to the input required, because the test actually is intended to verify the behavior for a missing `}`, it's just that the report position changed. * NEWS * UPGRADING
2023-01-13 02:55:54 +08:00
. Fixed bug GH-10214 (Incomplete validation of object syntax during
unserialize()). (timwolla)
Fix substr_replace with slots in repl_ht being UNDEF The check that was supposed to check whether the array slot was UNDEF was wrong and never triggered. This resulted in a replacement with the empty string or the wrong string instead of the correct one. The correct check pattern can be observed higher up in the function's code. Closes GH-10323 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-15 04:01:22 +08:00
. Fix substr_replace with slots in repl_ht being UNDEF. (nielsdos)
Fix GH-10187: Segfault in stripslashes() with arm64 Closes GH-10188 Co-authored-by: todeveni <toni.viemero@iki.fi> Signed-off-by: George Peter Banyard <girgias@php.net>
2022-12-30 21:31:40 +08:00
Fix missing check for xmlTextWriterEndElement xmlTextWriterEndElement returns -1 if the call fails. There was already a check for retval, but the return value wasn't assigned to retval. The other caller of xmlTextWriterEndElement is in xmlwriter_write_element_ns, which does the check correctly. Closes GH-10324 Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-15 06:38:38 +08:00
- XMLWriter
. Fix missing check for xmlTextWriterEndElement (nielsdos)
Fix GH-10187: Segfault in stripslashes() with arm64 Closes GH-10188 Co-authored-by: todeveni <toni.viemero@iki.fi> Signed-off-by: George Peter Banyard <girgias@php.net>
2022-12-30 21:31:40 +08:00
PHP-8.2 is now for PHP 8.2.2-dev
2022-12-14 08:29:29 +08:00
05 Jan 2023, PHP 8.2.1
[ci skip] Update NEWS for PHP 8.2.0
2022-11-08 14:24:02 +08:00
Fix GH-9905: constant() behaves inconsistent when class is undefined Directly referring to a constant of an undefined throws an exception; there is not much point in `constant()` raising a fatal error in this case. Closes GH-9907.
2022-11-09 00:13:35 +08:00
- Core:
. Fixed bug GH-9905 (constant() behaves inconsistent when class is undefined).
(cmb)
[ci skip] Fix GH-9918: License information for xxHash is not included in README.REDIST.BINS file Closes GH-9919.
2022-11-08 13:42:39 +08:00
. Fixed bug GH-9918 (License information for xxHash is not included in
README.REDIST.BINS file). (Akama Hitoshi)
Fix GH-9890: OpenSSL legacy providers not available on Windows We need to copy the provider DLLs from the dependency package to the PHP distribution. Closes GH-9894.
2022-11-05 02:39:07 +08:00
. Fixed bug GH-9890 (OpenSSL legacy providers not available on Windows). (cmb)
Fix GH-9650: Can't initialize heap: [0x000001e7] Closes GH-9721.
2022-11-14 22:16:31 +08:00
. Fixed bug GH-9650 (Can't initialize heap: [0x000001e7]). (Michael Voříšek)
Avoid undefined behavior in Windows ftok(3) emulation `.nFileIndexHigh` is a unsigned 32bit number. Casting that to `__int64` and shifting left by 32bits triggers undefined behavior if the most significant bit of `.nFileIndexHigh` is set. We could avoid that by casting to `(__uint64)`, but in that case the whole clause doesn't have an effect anymore, so we drop it altogether. Closes GH-9958.
2022-11-15 22:37:32 +08:00
. Fixed potentially undefined behavior in Windows ftok(3) emulation. (cmb)
Fix GH-9769: Misleading error message for unpacking of objects Only arrays can be unpacked in constant expressions. Closes GH-9776.
2022-11-17 23:32:33 +08:00
. Fixed GH-9769 (Misleading error message for unpacking of objects). (jhdxr)
PHP-8.1 is now for PHP 8.1.14-dev
2022-11-09 00:57:34 +08:00
Merge branch 'PHP-8.1' into PHP-8.2 * PHP-8.1: Fix GH-9949: Partial content on incomplete POST request
2022-12-13 22:22:39 +08:00
- Apache:
. Fixed bug GH-9949 (Partial content on incomplete POST request). (cmb)
Fixed GH-9699, GH-9866, and GH-9880 (problems with diff); and GH-9700 (greedy tzid parsing)
2022-11-30 23:47:43 +08:00
[ci skip] Fix NEWS FPM entries
2022-11-23 02:47:24 +08:00
- FPM:
. Fixed bug GH-9959 (Solaris port event mechanism is still broken after bug
#66694). (Petr Sumbera)
. Fixed bug #68207 (Setting fastcgi.error_header can result in a WARNING).
(Jakub Zelenka)
Fix bug #80669: FPM numeric user fails to set groups
2022-11-22 05:03:44 +08:00
. Fixed bug #80669 (FPM numeric user fails to set groups). (Jakub Zelenka)
Fix GH-8517: FPM child pointer can be potentially uninitialized There might be a moment when the child log event is executed after freeing a child. That could possibly happen if the child output is triggered at the same as the terminating of the child. Then the output event could be potentially processed after the terminating event which would cause this kind of issue. The issue might got more visible after introducing the log_stream on a child because it is more likely that this cannot be dereferenced after free. However it is very hard to reproduce this issue so there is no test for this. The fix basically prevents passing a child pointer and instead passes the child PID and then looks the child up by the PID when it is being processed. This is obviously slower but it is a safe way to do it and the slow down should not be hopefully visible in a way that it would overload a master process.
2022-08-28 21:58:42 +08:00
. Fixed bug GH-8517 (Random crash of FPM master process in
fpm_stdio_child_said). (Jakub Zelenka)
[ci skip] Fix NEWS FPM entries
2022-11-23 02:47:24 +08:00
Add a new imap_is_open() function to check that a connection object is still valid
2022-12-13 17:03:11 +08:00
- Imap:
. Fixed bug GH-10051 (IMAP: there's no way to check if a IMAP\Connection is
still open). (Girgias)
[ci skip] NEWS
2022-11-13 20:40:45 +08:00
- MBString:
. Fixed bug GH-9535 (The behavior of mb_strcut in mbstring has been changed in
PHP8.1). (Nathan Freeman)
[ci skip] NEWS
2022-11-25 21:37:43 +08:00
- Opcache:
. Fixed bug GH-9968 (Segmentation Fault during OPCache Preload).
(Arnaud, michdingpayc)
Fix GH-9997: OpenSSL engine clean up segfault
2022-11-25 02:29:44 +08:00
- OpenSSL:
. Fixed bug GH-9997 (OpenSSL engine clean up segfault). (Jakub Zelenka)
Fix GH-9064: PHP fails to build if openssl was built with no-ec
2022-11-25 20:49:12 +08:00
. Fixed bug GH-9064 (PHP fails to build if openssl was built with --no-ec).
(Jakub Zelenka)
Fix GH-10000: Test failures when OpenSSL compiled with no-dsa
2022-11-25 22:02:03 +08:00
. Fixed bug GH-10000 (OpenSSL test failures when OpenSSL compiled with
no-dsa). (Jakub Zelenka)
Fix GH-9997: OpenSSL engine clean up segfault
2022-11-25 02:29:44 +08:00
Fix GH-9890: OpenSSL legacy providers not available on Windows We need to copy the provider DLLs from the dependency package to the PHP distribution. Closes GH-9894.
2022-11-05 02:39:07 +08:00
- Pcntl:
[ci skip] NEWS
2022-11-13 18:07:46 +08:00
. Fixed bug GH-9298 (Signal handler called after rshutdown leads to crash).
(Erki Aring)
Fix GH-9971: Incorrect NUMERIC value returned from PDO_Firebird Dialect 1 databases store and transfer `NUMERIC(15,2)` values as doubles, which we need to cater to in `firebird_stmt_get_col()` to avoid `ZEND_ASSUME(0)` to ever be triggered, since that may result in undefined behavior. Since adding a regression test would require to create a dialect 1 database, we go without it. Closes GH-10021.
2022-11-29 22:32:46 +08:00
- PDO_Firebird:
. Fixed bug GH-9971 (Incorrect NUMERIC value returned from PDO_Firebird).
(cmb)
[ci skip] Add missing CVE in NEWS
2023-01-04 03:27:16 +08:00
- PDO/SQLite:
. Fixed bug #81740 (PDO::quote() may return unquoted string). (CVE-2022-31631)
(cmb)
Fix GH-9932: Discards further characters for session name. As those are converted, it s better to make aware of the code caller of the naming inadequacy. Closes GH-9940.
2022-11-15 20:27:44 +08:00
- Session:
. Fixed GH-9932 (session name silently fails with . and [). (David Carlier)
Fix GH-9883 SplFileObject::__toString() reads next line We need to overwrite the __toString magic method for SplFileObject, similarly to how DirectoryIterator overwrites it Moreover, the custom cast handler is useless as we define __toString methods, so use the standard one instead. Closes GH-9912
2022-11-09 23:24:30 +08:00
- SPL:
. Fixed GH-9883 (SplFileObject::__toString() reads next line). (Girgias)
Fix GH-10011 (Trampoline autoloader will get reregistered and cannot be unregistered) There are two issues to resolve: 1. The FCC is not refetch when trying to unregister a trampoline 2. Comparing the function pointer of trampolines is meaningless as they are reallocated, thus we need to compare the name of the function Found while working on GH-8294 Closes GH-10033
2022-12-02 09:23:48 +08:00
. Fixed GH-10011 (Trampoline autoloader will get reregistered and cannot be
unregistered). (Girgias)
Fix GH-9883 SplFileObject::__toString() reads next line We need to overwrite the __toString magic method for SplFileObject, similarly to how DirectoryIterator overwrites it Moreover, the custom cast handler is useless as we define __toString methods, so use the standard one instead. Closes GH-9912
2022-11-09 23:24:30 +08:00
Fix #81742: open_basedir bypass in SQLite3 by using file URI A previous fix[1] was not sufficient to catch all potential file URIs, because the patch did not cater to URL encoding. Properly parsing and decoding the URI may yield a different result than the handling of SQLite3, so we play it safe, and reject any file URIs if open_basedir is configured. [1] <https://bugs.php.net/bug.php?id=77967> Closes GH-10018.
2022-12-05 23:26:02 +08:00
- SQLite3:
. Fixed bug #81742 (open_basedir bypass in SQLite3 by using file URI). (cmb)
Merge branch 'PHP-8.1' into PHP-8.2 * PHP-8.1: Fix Windows shmget() wrt. IPC_PRIVATE
2022-12-13 22:48:58 +08:00
- TSRM:
. Fixed Windows shmget() wrt. IPC_PRIVATE. (Tyson Andre)
[ci skip] Update PHP 8.2.0 new release date
2022-11-23 10:55:35 +08:00
08 Dec 2022, PHP 8.2.0
[ci skip] Update NEWS for PHP 8.2.0 beta1
2022-07-06 00:09:39 +08:00
[ci skip] NEWS
2022-07-10 21:18:51 +08:00
- CLI:
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Fixed bug #81496 (Server logs incorrect request method). (lauri)
[ci skip] NEWS
2022-07-10 21:18:51 +08:00
. Updated the mime-type table for the builtin-server. (Ayesh Karunaratne)
Allow to not close stream on rscr dtor in php cli sapi
2022-06-20 21:14:29 +08:00
. Fixed potential overflow for the builtin server via the
PHP_CLI_SERVER_WORKERS environment variable. (yiyuaner)
. Fixed GH-8575 by changing STDOUT, STDERR and STDIN to not close on resource
destruction. (Jakub Zelenka)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Implement built-in web server responding without body to HEAD request on
a static resource. (Vedran Miletic, Marin Martuslovic)
. Implement built-in web server responding with HTTP status 405 to
DELETE/PUT/PATCH request on a static resource.
(Vedran Miletic, Marin Martuslovic)
. Fixed bug GH-9709 (Null pointer dereference with -w/-s options).
(Adam Saponara)
Reduce memory allocated by var_export, json_encode, serialize, and other (#8902) smart_str uses an over-allocated string to optimize for append operations. Functions that use smart_str tend to return the over-allocated string directly. This results in unnecessary memory usage, especially for small strings. The overhead can be up to 231 bytes for strings smaller than that, and 4095 for other strings. This can be avoided for strings smaller than `4096 - zend_string header size - 1` by reallocating the string. This change introduces `smart_str_trim_to_size()`, and calls it in `smart_str_extract()`. Functions that use `smart_str` are updated to use `smart_str_extract()`. Fixes GH-8896
2022-07-08 20:47:46 +08:00
Fix GH-8750: Can not create VT_ERROR variant type We add support for creating `VT_ERROR` variants via `__construct()`, and allow casting to int via `variant_cast()` and `variant_set_type()`. We do not, however, allow type conversion by other means, to avoid otherwise easily introduced type confusion. VB(A) also only allows explicit type conversion. We also introduce `DISP_E_PARAMNOTFOUND` which might be the most important `scode` for this purpose, since this allows to skip optional parameters in method calls. Closes GH-8886.
2022-06-21 23:30:42 +08:00
- COM:
. Fixed bug GH-8750 (Can not create VT_ERROR variant type). (cmb)
Add IBT support for fiber Indirect Branch Tracking (IBT) is part of Intel's Control-Flow Enforcement Technology (CET). IBT is hardware based, forward edge Control-Flow-Integrity mechanism where any indirect CALL/JMP must target an ENDBR instruction or suffer #CP. This commit adds IBT support for fiber: 1. Add endbr32/64 in assembly 2. Inform compiler jump_fcontext may return via indirect branch Furthermore: gcc support CET since v8.1 and set it to default since gcc 11. That is, the ELF header of sapi/cli/php has a property named IBT. However, such property is lost since PHP8.1 because the assembly introduced by Fiber. This commit also fixes this. Closes GH-8339 Signed-off-by: Chen, Hu <hu1.chen@intel.com> Co-authored-by: Christoph M. Becker <cmbecker69@gmx.de>
2022-04-26 16:58:22 +08:00
- Core:
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Fixed bug #81380 (Observer may not be initialized properly). (krakjoe)
. Fixed bug GH-7771 (Fix filename/lineno of constant expressions). (ilutov)
. Fixed bug GH-7792 (Improve class type in error messages). (ilutov)
. Support huge pages on MacOS. (David CARLIER)
Fix RC=1 references of declared properties when casting objects to arrays Fixes GH-8655. Closes GH-8737.
2022-06-09 16:48:52 +08:00
. Fixed bug GH-8655 (Casting an object to array does not unwrap refcount=1
references). (Nicolas Grekas)
Fix GH-8661: Nullsafe in coalesce triggers undefined variable warning Closes GH-8690
2022-06-02 23:15:55 +08:00
. Fixed bug GH-8661 (Nullsafe in coalesce triggers undefined variable
warning). (ilutov)
Allow arbitrary const expressions in backed enums Closes GH-7821 Closes GH-8190 Closes GH-8418
2022-03-11 05:35:01 +08:00
. Fixed bug GH-7821 and GH-8418 (Allow arbitrary const expressions in backed
enums). (ilutov)
Fix lineno in backtrace of multi-line function calls Closes GH-8810 Closes GH-8818
2022-06-17 22:20:28 +08:00
. Fixed bug GH-8810 (Incorrect lineno in backtrace of multi-line function
calls). (ilutov)
main/streams/plain_wrapper: skip lseek(SEEK_CUR) for newly opened files A file that has just been opened is known to be at offset zero, and the lseek(SEEK_CUR) system call to determine the current offset can be skipped. Closes #8540.
2022-04-29 11:22:53 +08:00
. Optimised code path for newly created file with the stream plain wrapper. (Max Kellermann)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Uses safe_perealloc instead of perealloc for the
ZEND_PTR_STACK_RESIZE_IF_NEEDED to avoid possible overflows. (David Carlier)
. Reduced the memory footprint of strings returned by var_export(),
json_encode(), serialize(), iconv_*(), mb_ereg*(), session_create_id(),
http_build_query(), strstr(), Reflection*::__toString(). (Arnaud)
. Fixed bug GH-8995 (WeakMap object reference offset causing TypeError).
(Tobias Bachert)
. Added error_log_mode ini setting. (Mikhail Galanin)
. Updated request startup messages. (Eric Norris)
. Fixed bug GH-7900 (Arrow function with never return type compile-time
errors). (ilutov)
. Fixed incorrect double to long casting in latest clang. (zeriyoshi)
. Added support for defining constants in traits. (sj-i)
. Stop incorrectly emitting false positive deprecation notice alongside
unsupported syntax fatal error for `"{$g{'h'}}"`. (TysonAndre)
. Fix unexpected deprecated dynamic property warning, which occurred when
exit() in finally block after an exception was thrown without catching.
(Twosee)
. Fixed bug GH-9323 (Crash in ZEND_RETURN/GC/zend_call_function)
(Tim Starling)
. Fixed bug GH-9227 (Trailing dots and spaces in filenames are ignored).
(cmb)
. Fixed bug GH-9285 (Traits cannot be used in readonly classes).
(kocsismate)
. Fixed bug GH-9186 (@strict-properties can be bypassed using
unserialization). (kocsismate)
. Fixed bug GH-9500 (Using dnf type with parentheses after readonly keyword
results in a parse error). (ilutov)
. Fixed bug GH-9516 ((A&B)|D as a param should allow AB or D. Not just A).
(Girgias)
. Fixed observer class notify with Opcache file_cache_only=1. (ilutov)
. Fixes segfault with Fiber on FreeBSD i386 architecture. (David Carlier)
. Fixed bug GH-9655 (Pure intersection types cannot be implicitly nullable)
(Girgias)
. Fixed bug GH-9589 (dl() segfaults when module is already loaded). (cmb,
Arnaud)
. Fixed bug GH-9752 (Generator crashes when interrupted during argument
evaluation with extra named params). (Arnaud)
. Fixed bug GH-9801 (Generator crashes when memory limit is exceeded during
initialization). (Arnaud)
. Fixed a bug with preloaded enums possibly segfaulting. (Bob)
. Fixed bug GH-9823 (Don’t reset func in zend_closure_internal_handler).
(Florian Sowade)
. Fixed potential NULL pointer dereference Windows shm*() functions. (cmb)
. Fix target validation for internal attributes with constructor property
promotion. (kooldev)
. Fixed bug GH-9750 (Generator memory leak when interrupted during argument
evaluation. (Arnaud)
The PHP-8.1 branch is now for 8.1.0RC4
2021-09-29 05:28:33 +08:00
Introduce CURLOPT_XFERINFOFUNCTION `CURLOPT_XFERINFOFUNCTION` is available as of cURL 7.32.0, and supersedes `CURLOPT_PROGRESSFUNCTION` which is still supported by latest cURL, though. Closes GH-7823.
2021-12-24 18:14:48 +08:00
- Curl:
. Added support for CURLOPT_XFERINFOFUNCTION. (David Carlier)
Add CURLOPT_MAXFILESIZE_LARGE option Like other *LARGE options, it takes a 64 bit value. Closes GH-8557.
2022-05-15 19:01:50 +08:00
. Added support for CURLOPT_MAXFILESIZE_LARGE. (David Carlier)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Added new constants from cURL 7.62 to 7.80. (Pierrick)
. New function curl_upkeep(). (Pierrick)
Introduce CURLOPT_XFERINFOFUNCTION `CURLOPT_XFERINFOFUNCTION` is available as of cURL 7.32.0, and supersedes `CURLOPT_PROGRESSFUNCTION` which is still supported by latest cURL, though. Closes GH-7823.
2021-12-24 18:14:48 +08:00
GH-8458: DateInterval::createFromDateString does not throw non-relative items are present
2022-05-05 19:15:44 +08:00
- Date:
. Fixed GH-8458 (DateInterval::createFromDateString does not throw if
non-relative items are present). (Derick)
[ci skip] Update NEWS
2022-05-20 18:18:49 +08:00
. Fixed bug #52015 (Allow including end date in DatePeriod iterations)
(Daniel Egeberg, Derick)
Add "N" and "o" format specifiers to idate()
2021-12-29 23:38:45 +08:00
. idate() now accepts format specifiers "N" (ISO Day-of-Week) and "o" (ISO
Year). (Pavel Djundik)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Fixed bug GH-8730 (DateTime::diff miscalculation is same time zone of
different type). (Derick)
. Fixed bug GH-8964 (DateTime object comparison after applying delta less
than 1 second). (Derick)
. Fixed bug GH-9106: (DateInterval 1.5s added to DateTimeInterface is rounded
down since PHP 8.1.0). (Derick)
. Fixed bug #75035 (Datetime fails to unserialize "extreme" dates).
(Derick)
. Fixed bug #80483 (DateTime Object with 5-digit year can't unserialized).
(Derick)
. Fixed bug #81263 (Wrong result from DateTimeImmutable::diff). (Derick)
. Fixed bug GH-9431 (DateTime::getLastErrors() not returning false when no
errors/warnings). (Derick)
. Fixed bug with parsing large negative numbers with the @ notation. (Derick)
- DBA:
. Fixed LMDB driver hanging when attempting to delete a non-existing key
(Girgias)
. Fixed LMDB driver memory leak on DB creation failure (Girgias)
. Fixed GH-8856 (dba: lmdb: allow to override the MDB_NOSUBDIR flag). (Girgias)
- FFI:
. Fixed bug GH-9090 (Support assigning function pointers in FFI). (Adam
Saponara)
- Fileinfo:
. Fixed bug GH-8805 (finfo returns wrong mime type for woff/woff2 files).
(Anatol)
- Filter:
. Added FILTER_FLAG_GLOBAL_RANGE to filter Global IPs. (vnsavage)
GH-8458: DateInterval::createFromDateString does not throw non-relative items are present
2022-05-05 19:15:44 +08:00
FPM: Emit error for invalid port setting
2022-03-19 23:16:07 +08:00
- FPM:
. Emit error for invalid port setting. (David Carlier)
Add extra check for FPM proc dumpable on SELinux based systems The deny_ptrace is a OS runtime setting and is off by default, at least on workstations flavors (fedora) however it might be different on production servers.
2021-11-13 02:38:55 +08:00
. Added extra check for FPM proc dumpable on SELinux based systems.
(David Carlier)
Support fpm_get_socket_listening_queue on macOS Using TCP_CONNECTION_INFO socket option.
2022-04-09 22:08:41 +08:00
. Added support for listening queue on macOS. (David Carlier)
Update NEWS and www.conf with listen.backlog default change
2022-04-23 20:25:08 +08:00
. Changed default for listen.backlog on Linux to -1. (Cristian Rodríguez)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Added listen.setfib pool option to set route FIB on FreeBSD. (David Carlier)
. Added access.suppress_path pool option to filter access log entries.
(Mark Gallagher)
. Fixed on fpm scoreboard occasional warning on acquisition failure.
(Felix Wiedemann)
. Fixed bug GH-9754 (SaltStack (using Python subprocess) hangs when running
php-fpm 8.1.11). (Jakub Zelenka)
FPM: Emit error for invalid port setting
2022-03-19 23:16:07 +08:00
Fix datetime format string to follow POSIX spec in ftp_mdtm() Closes GH-8259
2022-03-28 10:48:30 +08:00
- FTP:
. Fix datetime format string to follow POSIX spec in ftp_mdtm(). (Jihwan Kim)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
- GD:
. Fixed bug #81739: OOB read due to insufficient input validation in
imageloadfont(). (CVE-2022-31630) (cmb)
- GMP:
. Fixed bug GH-9308 (GMP throws the wrong error when a GMP object is passed
to gmp_init()). (Girgias)
- Hash:
. Fixed bug #81738: buffer overflow in hash_update() on long parameter.
(CVE-2022-37454) (nicky at mouha dot be)
Fix compilation on RHEL 7 ppc64le (gcc 4.8) Fixes GH-10077 Closes GH-10078
2021-12-01 06:19:38 +08:00
. Fixed bug GH-10077: Fix compilation on RHEL 7 ppc64le. (Mattias Ellert)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
intl: Update grandfathered and redundant language tags Closes GH-7641.
2021-11-11 14:26:04 +08:00
- Intl:
. Update all grandfathered language tags with preferred values
Fix GH-7939: Cannot unserialize IntlTimeZone objects As it is now, `IntlTimeZone`, `IntlCalendar` and `IntlDateFormatter` and some other intl class instances can be serialized, but the representation is meaningless, and unserialization yields uninitialized/ unusable objects. To prevent users from noticing this too late, we deny serialization of such objects in the first place. Closes GH-7945.
2022-01-20 18:30:35 +08:00
. Fixed GH-7939 (Cannot unserialize IntlTimeZone objects). (cmb)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Fixed build for ICU 69.x and onwards. (David Carlier)
. Declared Transliterator::$id as readonly to unlock subclassing it. (Nicolas
Grekas)
. Fixed bug GH-9421 (Incorrect argument number for ValueError in NumberFormatter).
(Girgias)
- MBString:
. Fixed bug GH-9248 (Segmentation fault in mb_strimwidth()). (cmb)
- mysqli:
. Fixed bug GH-9841 (mysqli_query throws warning despite using
silenced error mode). (Kamil Tekiela)
- MySQLnd:
. Fixed potential heap corruption due to alignment mismatch. (cmb)
intl: Update grandfathered and redundant language tags Closes GH-7641.
2021-11-11 14:26:04 +08:00
Add oci8.prefetch_lob_size
2021-11-12 14:59:22 +08:00
- OCI8:
. Added oci8.prefetch_lob_size directive to tune LOB query performance
Oracle Client 10g is no longer supported Thus, we drop respective config option for Windows.
2021-12-12 19:31:07 +08:00
. Support for building against Oracle Client libraries 10.1 and 10.2 has been
dropped. Oracle Client libraries 11.2 or newer are now required.
Add oci8.prefetch_lob_size
2021-11-12 14:59:22 +08:00
Quote when adding to connection string in (PDO_)ODBC Because the UID= and PWD= values are appended to the SQLDriverConnect case when credentials are passed, we have to append them to the string in case users are relying on this behaviour. However, they must be quoted, or the arguments will be invalid (or possibly more injected). This means users had to quote arguments or append credentials to the raw connection string themselves. It seems that ODBC quoting rules are consistent enough (and that Microsoft trusts them enough to encode into the .NET BCL) that we can actually check if the string is already quoted (in case a user is already quoting because of this not being fixed), and if not, apply the appropriate ODBC quoting rules. This is because the code exists in main/, and are shared between both ODBC extensions, so it doesn't make sense for it to only exist in one or the other. There may be a better spot for it. Closes GH-8307.
2022-04-22 23:04:47 +08:00
- ODBC:
[ci skip] Improve latest NEWS entries to point to actual bug report
2022-05-27 23:00:16 +08:00
. Fixed bug GH-8300 (User input not escaped when building connection string).
(Calvin Buckley)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Fixed bug GH-9347 (Current ODBC liveness checks may be inadequate). (Calvin
Buckley)
- Opcache:
. Allocate JIT buffer close to PHP .text segemnt to allow using direct
IP-relative calls and jumps.
(Su Tao, Wang Xue, Chen Hu, Lizhen Lizhen, Dmitry)
. Added initial support for JIT performance profiling generation
for macOs Instrument. (David Carlier)
. Fixed bug GH-8030 (Segfault with JIT and large match/switch statements).
(Arnaud)
. Added JIT support improvement for macOs for segments and executable permission
bit handling. (David Carlier)
. Added JIT buffer allocation near the .text section on FreeNSD. (David Carlier)
. Fixed bug GH-9371 (Crash with JIT on mac arm64)
(jdp1024/David Carlier)
. Fixed bug GH-9259 (opcache.interned_strings_buffer setting integer
overflow). (Arnaud)
. Added indirect call reduction for jit on x86 architectures. (wxue1)
- OPcache:
. Fixed bug GH-9164 (Segfault in zend_accel_class_hash_copy).
(Arnaud, Sergei Turchanov)
- OpenSSL:
. Discard poll calls on socket when no timeout/non blocking/MSG_DONTWAIT. (Max Kellermann)
. Fixed bug GH-9310 (SSL local_cert and local_pk do not respect
open_basedir). (Jakub Zelenka)
. Implement FR #76935 ("chacha20-poly1305" is an AEAD but does not work like
AEAD). (Jakub Zelenka)
. Added openssl_cipher_key_length function. (Jakub Zelenka)
. Fixed bug GH-9517 (Compilation error openssl extension related to PR
GH-9366). (Jakub Zelenka)
. Fixed missing clean up of OpenSSL engine list - attempt to fix GH-8620.
(Jakub Zelenka)
. Fixed bug GH-8430 (OpenSSL compiled with no-md2, no-md4 or no-rmd160 does
not build). (Jakub Zelenka, fsbruva)
- PCNTL:
. Fixed pcntl_(get|set)priority error handling for MacOS. (Juan Morales)
- PCRE:
. Implemented FR #77726 (Allow null character in regex patterns). (tobil4sk)
. Updated bundled libpcre to 10.40. (cmb)
- PDO:
. Fixed bug GH-9818 (Initialize run time cache in PDO methods).
(Florian Sowade)
- PDO_Firebird:
. Fixed bug GH-8576 (Bad interpretation of length when char is UTF-8). (cmb)
Quote when adding to connection string in (PDO_)ODBC Because the UID= and PWD= values are appended to the SQLDriverConnect case when credentials are passed, we have to append them to the string in case users are relying on this behaviour. However, they must be quoted, or the arguments will be invalid (or possibly more injected). This means users had to quote arguments or append credentials to the raw connection string themselves. It seems that ODBC quoting rules are consistent enough (and that Microsoft trusts them enough to encode into the .NET BCL) that we can actually check if the string is already quoted (in case a user is already quoting because of this not being fixed), and if not, apply the appropriate ODBC quoting rules. This is because the code exists in main/, and are shared between both ODBC extensions, so it doesn't make sense for it to only exist in one or the other. There may be a better spot for it. Closes GH-8307.
2022-04-22 23:04:47 +08:00
Fix #80909: crash with persistent connections in PDO_ODBC When we have a complex connection string (more than a DSN), PHP appends a UID and PWD if none are present and a username and password are called, so SQLDriverConnect works as expected. However, it seems spprintf doesn't allocate with persistence if required. As a result, it'll be considering leaking and crash PHP on free when a persistent connection is used. Closes GH-8110.
2022-02-18 02:40:56 +08:00
- PDO_ODBC:
. Fixed bug #80909 (crash with persistent connections in PDO_ODBC). (Calvin
Buckley)
[ci skip] Improve latest NEWS entries to point to actual bug report
2022-05-27 23:00:16 +08:00
. Fixed bug GH-8300 (User input not escaped when building connection string).
(Calvin Buckley)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Fixed bug GH-9347 (Current ODBC liveness checks may be inadequate). (Calvin
Buckley)
. Fixed bug GH-9372 (HY010 when binding overlong parameter). (cmb)
- PDO_PGSQL:
. Fixed bug GH-9411 (PgSQL large object resource is incorrectly closed).
(Yurunsoft)
- Random:
. Added new random extension. (Go Kudo)
. Fixed bug GH-9067 (random extension is not thread safe). (cmb)
. Fixed bug GH-9055 (segmentation fault if user engine throws). (timwolla)
. Fixed bug GH-9066 (signed integer overflow). (zeriyoshi)
. Fixed bug GH-9083 (undefined behavior during shifting). (timwolla)
. Fixed bug GH-9088, GH-9056 (incorrect expansion of bytes when
generating uniform integers within a given range). (timwolla)
. Fixed bug GH-9089 (Fix memory leak on Randomizer::__construct()
call twice). (zeriyoshi)
. Fixed bug GH-9212 (PcgOneseq128XslRr64::jump() should not allow negative
$advance). (Anton Smirnov)
. Changed Mt19937 to throw a ValueError instead of InvalidArgumentException
for invalid $mode. (timwolla)
. Splitted Random\Randomizer::getInt() (without arguments) to
Random\Randomizer::nextInt(). (zeriyoshi)
. Fixed bug GH-9235 (non-existant $sequence parameter in stub for
PcgOneseq128XslRr64::__construct()). (timwolla)
. Fixed bug GH-9190, GH-9191 (undefined behavior for MT_RAND_PHP when
handling large ranges). (timwolla)
. Fixed bug GH-9249 (Xoshiro256StarStar does not reject the invalid
all-zero state). (timwolla)
. Removed redundant RuntimeExceptions from Randomizer methods. The
exceptions thrown by the engines will be exposed directly. (timwolla)
. Added extension specific Exceptions/Errors (RandomException, RandomError,
BrokenRandomEngineError). (timwolla)
. Fixed bug GH-9415 (Randomizer::getInt(0, 2**32 - 1) with Mt19937
always returns 1). (timwolla)
. Fixed Randomizer::getInt() consistency for 32-bit engines. (timwolla)
. Fixed bug GH-9464 (build on older macOs releases). (David Bohman)
. Fixed bug GH-9839 (Pre-PHP 8.2 output compatibility for non-mt_rand()
functions for MT_RAND_PHP). (timwolla)
Fix #80909: crash with persistent connections in PDO_ODBC When we have a complex connection string (more than a DSN), PHP appends a UID and PWD if none are present and a username and password are called, so SQLDriverConnect works as expected. However, it seems spprintf doesn't allocate with persistence if required. As a result, it'll be considering leaking and crash PHP on free when a persistent connection is used. Closes GH-8110.
2022-02-18 02:40:56 +08:00
Add ReflectionFunction::isAnonymous() Closes GH-8499.
2022-05-05 21:51:20 +08:00
- Reflection:
. Added ReflectionFunction::isAnonymous(). (Nicolas Grekas)
Add ReflectionMethod::hasPrototype method Closes GH-8487.
2022-05-04 19:21:37 +08:00
. Added ReflectionMethod::hasPrototype(). (Ollie Read)
Better return types for `getBackingType` (#8687) The only backing types for Enums are int and string. The proper return type for ReflectionEnum::getBackingType() is thus null|ReflectionNamedType. See also https://github.com/php/doc-en/pull/1608 Closes GH-8687
2022-06-03 00:13:21 +08:00
. Narrow ReflectionEnum::getBackingType() return type to ReflectionNamedType.
(SamMousa)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Fixed bug GH-8932 (ReflectionFunction provides no way to get the called
class of a Closure). (cmb, Nicolas Grekas)
Add ReflectionFunction::isAnonymous() Closes GH-8499.
2022-05-05 21:51:20 +08:00
[ci skip] Order NEWS sections alphabetically
2022-05-16 21:30:07 +08:00
- Session:
. Fixed bug GH-7787 (Improve session write failure message for user error
handlers). (ilutov)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Fixed GH-9200 (setcookie has an obsolete expires date format). (timwolla)
. Fixed GH-9584 (Avoid memory corruption when not unregistering custom session
handler). (ilutov)
. Fixed bug GH-9583 (session_create_id() fails with user defined save handler
that doesn't have a validateId() method). (Girgias)
- SOAP:
. Fixed bug GH-9720 (Null pointer dereference while serializing the response).
(cmb)
[ci skip] Order NEWS sections alphabetically
2022-05-16 21:30:07 +08:00
Add TCP_NOTSENT_LOWAT socket option Can be used to limit the amount of unsent data per socket. Closes GH-8559.
2022-05-16 00:43:20 +08:00
- Sockets:
. Added TCP_NOTSENT_LOWAT socket option. (David Carlier)
Add SO_MEMINFO socket option for gathering socket related info
2022-04-21 04:06:47 +08:00
. Added SO_MEMINFO socket option. (David Carlier)
[ci skip] NEWS, UPGRADING
2022-05-27 20:06:53 +08:00
. Added SO_RTABLE socket option (OpenBSD), equivalent of SO_MARK (Linux).
(David Carlier)
. Added TCP_KEEPALIVE, TCP_KEEPIDLE, TCP_KEEPINTVL, TCP_KEEPCNT socket
options. (David Carlier)
Implements socket ancillary data on FreeBSD. (#7708) using LOCAL_CREDS_PERSISTENT/SCM_CREDS2 instead so we also get the send process id.
2022-06-02 21:08:03 +08:00
. Added ancillary data support for FreeBSD. (David Carlier)
Implements ancillary data on NetBSD. With the couple LOCAL_CREDS/SCM_CREDS, in this system we get all the infos needed (included the process id). Closes GH-8700.
2022-06-04 03:43:09 +08:00
. Added ancillary data support for NetBSD. (David Carlier)
Add `SO_BPF_EXTENSIONS` flag to socket. Returns the supported bpf extensions from the kernel. Linux only. Closes GH-8713.
2022-06-06 14:18:53 +08:00
. Added SO_BPF_EXTENSIONS socket option. (David Carlier)
Add `SO_SETFIB` FreeBSD socket option constant. Aims to set the route table. Closes #8742.
2022-06-10 04:34:44 +08:00
. Added SO_SETFIB socket option. (David Carlier)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Added TCP_CONGESTION socket option. (David Carlier)
. Added SO_ZEROCOPY/MSG_ZEROCOPY options. (David Carlier)
. Added SOL_FILTER socket option for Solaris. (David Carlier)
. Fixed socket constants regression as of PHP 8.2.0beta3. (Bruce Dou)
Add TCP_NOTSENT_LOWAT socket option Can be used to limit the amount of unsent data per socket. Closes GH-8559.
2022-05-16 00:43:20 +08:00
Add sodium_crypto_stream_xchacha20_xor_ic() There are many use-cases where a PHP user is currently using sodium_compat's implementation of this low-level XChaCha20 API. For example, multi-part message processing (in low-memory settings) for a ciphertext that was encrypted with XChaCha20-Poly1305 (rather than the secretstream API). Adding this function to ext/sodium offers better performance and lowers users' memory usage with the polyfill, and ensures that users coming from other languages that provide libsodium bindings have a more consistent experience with our bindings. This is a win-win. This patch follows the libsodium precedent of adding functions instead of optional parameters to existing functions. The parameter order is also consistent with the C API. https://doc.libsodium.org/advanced/stream_ciphers/xchacha20#usage Closes GH-8276.
2022-03-30 15:45:47 +08:00
- Sodium:
. Added sodium_crypto_stream_xchacha20_xor_ic(). (Scott)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
- SPL:
. Uses safe_erealloc instead of erealloc to handle heap growth
for the SplHeap::insert method to avoid possible overflows. (David Carlier)
. Widen iterator_to_array() and iterator_count()'s $iterator parameter to
iterable. (timwolla)
. Fixed bug #69181 (READ_CSV|DROP_NEW_LINE drops newlines within fields).
(cmb)
. Fixed bug #65069 (GlobIterator incorrect handling of open_basedir check).
(Jakub Zelenka)
Allow user to change SQLITE_DEFENSIVE if needed Closes GH-8200.
2022-03-15 03:09:20 +08:00
- SQLite3:
. Changed sqlite3.defensive from PHP_INI_SYSTEM to PHP_INI_USER. (bohwaz)
Report wireless network interfaces on Windows too There is no particular reason to exclude wireless network interfaces from the results of `net_get_interfaces()` on Windows, especially since `getifaddrs(3)` includes these as well. Closes GH-7718.
2021-12-05 11:59:18 +08:00
- Standard:
. net_get_interfaces() also reports wireless network interfaces on Windows.
(Yurun)
Implement php_handle_avif() using libavifinfo See #80828 and the internals@ mailing list discussion at https://externals.io/message/116543 Use libavifinfo's AvifInfoGetFeaturesStream() in php_handle_avif() to get the width, height, bit depth and channel count from an AVIF payload. Implement stream reading/skipping functions and data struct. Use libavifinfo's AvifInfoIdentifyStream() in php_is_image_avif(). Update the expected features read from "test1pix.avif" in getimagesize.phpt. Closes GH-7711.
2021-12-16 03:00:24 +08:00
. Finished AVIF support in getimagesize(). (Yannis Guyon)
Optimize stripos/stristr Closes GH-7847 Closes GH-7852 Previously stripos/stristr would lowercase both the haystack and the needle to reuse strpos. The approach in this PR is similar to strpos. memchr is highly optimized so we're using it to search for the first character of the needle in the haystack. If we find it we compare the remaining characters of the needle manually. The new implementation seems to perform about half as well as strpos (as two memchr calls are necessary to find the next candidate).
2021-12-29 19:51:18 +08:00
. Fixed bug GH-7847 (stripos with large haystack has bad performance).
(ilutov)
Added: [zend_]memory_reset_peak_usage() (#8151)
2022-03-04 20:24:08 +08:00
. New function memory_reset_peak_usage(). (Patrick Allaert)
Fix parse_url(): can not recognize port without scheme Closes GH-7844.
2021-12-30 21:25:34 +08:00
. Fixed parse_url(): can not recognize port without scheme. (pandaLIU)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Deprecated utf8_encode() and utf8_decode(). (Rowan Tommins)
. Fixed the crypt_sha256/512 api build with clang > 12. (David Carlier)
. Uses safe_erealloc instead of erealloc to handle options in getopt
to avoid possible overflows. (David Carlier)
. Implemented FR GH-8924 (str_split should return empty array for empty
string). (Michael Vorisek)
. Added ini_parse_quantity function to convert ini quantities shorthand
notation to int. (Dennis Snell)
. Enable arc4random_buf for Linux glibc 2.36 and onwards
for the random_bytes. (Cristian Rodriguez)
. Uses CCRandomGenerateBytes instead of arc4random_buf on macOs. (David Carlier).
. Fixed bug #65489 (glob() basedir check is inconsistent). (Jakub Zelenka)
. Fixed GH-9200 (setcookie has an obsolete expires date format). (Derick)
. Fixed GH-9244 (Segfault with array_multisort + array_shift). (cmb)
. Fixed bug GH-9296 (`ksort` behaves incorrectly on arrays with mixed keys).
(Denis Vaksman)
. Marked crypt()'s $string parameter as #[\SensitiveParameter]. (timwolla)
. Fixed bug GH-9464 (build on older macOs releases). (David Bohman)
. Fixed bug GH-9518 (Disabling IPv6 support disables unrelated constants).
(cmb)
. Revert "Fixed parse_url(): can not recognize port without scheme."
(andypost)
Report wireless network interfaces on Windows too There is no particular reason to exclude wireless network interfaces from the results of `net_get_interfaces()` on Windows, especially since `getifaddrs(3)` includes these as well. Closes GH-7718.
2021-12-05 11:59:18 +08:00
[ci skip] Order NEWS sections alphabetically
2022-05-16 21:30:07 +08:00
- Streams:
. Set IP_BIND_ADDRESS_NO_PORT if available when connecting to remote host.
(Cristian Rodríguez)
Fix stream_wrapper_unregister() resource leak Closes GH-8548 Closes GH-8587
2022-05-20 01:27:14 +08:00
. Fixed bug GH-8548 (stream_wrapper_unregister() leaks memory). (ilutov)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Discard poll calls on socket when no timeout/non blocking/MSG_DONTWAIT. (Max Kellermann)
. Fixed bug GH-9316 ($http_response_header is wrong for long status line).
(cmb, timwolla)
. Fixed bug GH-9590 (stream_select does not abort upon exception or empty
valid fd set). (Arnaud)
. Fixed bug GH-9653 (file copy between different filesystems). (David Carlier)
. Fixed bug GH-9779 (stream_copy_to_stream fails if dest in append mode).
(Jakub Zelenka)
- Windows:
. Added preliminary support for (cross-)building for ARM64. (Yun Dou)
- XML:
. Added libxml_get_external_entity_loader() function. (Tim Starling)
[ci skip] Order NEWS sections alphabetically
2022-05-16 21:30:07 +08:00
Add ZipArchive::clearError, getStreamIndex and getStreamName methods public function clearError(): void {} public function getStreamIndex(int $index, int $flags = 0) {} public function getStreamName(string $name, int $flags = 0) {} ZipArchive::getStream is kept for BC See https://github.com/pierrejoye/php_zip/issues/20
2021-10-05 22:27:03 +08:00
- Zip:
. add ZipArchive::clearError() method
. add ZipArchive::getStreamName() method
. add ZipArchive::getStreamIndex() method
Build ext/zip as shared library by default on Windows This allows users to use PECL/zip, which is well maintained and often brings new features which are not yet available in ext/zip, as drop-in replacement for the official Windows php-src builds. Closes GH-8549.
2022-05-13 20:59:12 +08:00
. On Windows, the Zip extension is now built as shared library (DLL) by
default. (cmb)
PHP-8.2 is now for PHP 8.2.1-dev and prepare NEWS for 8.2.0
2022-11-09 02:26:35 +08:00
. Implement fseek for zip stream when possible with libzip 1.9.1. (Remi)
Reference in New Issue Copy Permalink