Commit Graph

1888 Commits

Author SHA1 Message Date
Ilija Tovilo
40908b10fc
Merge branch 'PHP-8.1'
* PHP-8.1:
  Disallow assigning reference to  unset readonly property
2022-07-01 12:20:32 +02:00
Ilija Tovilo
110573726b
Disallow assigning reference to unset readonly property
Closes GH-7942
Closes GH-8188
2022-07-01 12:16:32 +02:00
Joe Rowell
89688b115d
Add function exposing HAVE_GCC_GLOBAL_REGS (#8359) 2022-06-08 12:32:30 +01:00
George Peter Banyard
b40ae80804
Convert iterable into an internal alias for Traversable|array (#7309)
This does a compile time transformation of ``iterable`` into ``Traversable|array`` which simplifies some of the LSP variance handling.

The arginfo generation script from stubs is updated to produce a union type when it encounters the type ``iterable``
Extension functions which do not regenerate the arginfo, or write them manually are still supported by mimicking the compile time transformation while registering the function.

Type Reflection is preserved for single ``iterable`` (and ``?iterable``) to produce a ReflectionNamedType with name ``iterable``, however usage of ``iterable`` in union types will be converted to ``array|Traversable``
2022-06-07 13:35:34 +01:00
Levi Morrison
280fd680c8
Make vm_interrupt and timed_out atomic (#8327)
This is done by adding a new zend_atomic_bool type. The type
definition is only available for compiler alignment and size info; it
should be treated as opaque and only the zend_atomic_bool_* family of
functions should be used.

Note that directly using atomic_bool is complicated. All C++ compilers
stdlibs that I checked typedef atomic_bool to std::atomic<bool>, which
can't be used in an extern "C" section, and there's at least one usage
of this in core, and probably more outside of it.

So, instead use platform specific functions, preferring compiler
intrinsics.
2022-06-01 09:43:25 -06:00
Max Kellermann
8620788c2a Zend/zend_execute: remove duplicate deinitialization code
This code duplication was introduced by commit 85f35a8fc1 ("Separate
unspecializeble code of INCLIDE_OR_EVAL into helper functions") for no
obvious reason.
2022-04-02 17:42:49 +02:00
Max Kellermann
b9e895bca0
Replace memcmp() with zend_string functions (#8216)
* ext/oci8: use zend_string_equals()

Eliminate duplicate code.

* main/php_variables: use zend_string_equals_literal()

Eliminate duplicate code.

* Zend/zend_string: add zend_string_equals_cstr()

Allows eliminating duplicate code.

* Zend, ext/{opcache,standard}, main/output: use zend_string_equals_cstr()

Eliminate duplicate code.

* Zend/zend_string: add zend_string_starts_with()

* ext/{opcache,phar,spl,standard}: use zend_string_starts_with()

This adds missing length checks to several callers, e.g. in
cache_script_in_shared_memory().  This is important when the
zend_string is shorter than the string parameter, when memcmp()
happens to check backwards; this can result in an out-of-bounds memory
access.
2022-03-31 16:27:58 +02:00
Dmitry Stogov
107997e58e Merge branch 'PHP-8.1'
* PHP-8.1:
  Prevent array modification if it's captured by user error handler during index conversion
2022-02-01 17:23:32 +03:00
Dmitry Stogov
718478377b Prevent array modification if it's captured by user error handler during
index conversion

Fixes oss-fuzz #44235
2022-02-01 17:22:18 +03:00
Dmitry Stogov
aab52968a3 micro-optimization 2021-12-23 18:31:45 +03:00
Dmitry Stogov
79fac32d6b Don't call zend_attach/detach_symbol_table() for op_arrays without local variables 2021-12-16 17:37:01 +03:00
Dmitry Stogov
623b3fc83f Merge branch 'PHP-8.1'
* PHP-8.1:
  Move common code into helper
2021-12-14 15:32:20 +03:00
Dmitry Stogov
b16fc350a4 Move common code into helper 2021-12-14 15:31:53 +03:00
Dmitry Stogov
1959bbfc1b Merge branch 'PHP-8.1'
* PHP-8.1:
  Combine ADDREF/DELREF
2021-12-13 22:54:57 +03:00
Dmitry Stogov
1e56b64759 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Combine ADDREF/DELREF
2021-12-13 22:54:45 +03:00
Dmitry Stogov
c787f42ceb Combine ADDREF/DELREF 2021-12-13 22:38:23 +03:00
Dmitry Stogov
d9926a109d Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix array clobering by user error handler
2021-12-13 15:20:24 +03:00
Dmitry Stogov
76075823e7 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix array clobering by user error handler
2021-12-13 15:20:16 +03:00
Dmitry Stogov
cbc0b1afeb Fix array clobering by user error handler
Fixes oss-fuzz #42234
2021-12-13 14:59:30 +03:00
Dmitry Stogov
90e5eed9db Merge branch 'PHP-8.1'
* PHP-8.1:
  Separate "cold" code
2021-12-07 11:47:01 +03:00
Dmitry Stogov
08f1d470fb Separate "cold" code 2021-12-07 11:46:32 +03:00
Dmitry Stogov
fe1f613b75 Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix use after free because of data clobbering by user error handler
2021-12-06 13:09:26 +03:00
Dmitry Stogov
5459ed4c2f Fix use after free because of data clobbering by user error handler
Fixes oss-fuzz #41692
2021-12-06 13:08:27 +03:00
Dmitry Stogov
1195ab8969 Merge branch 'PHP-8.1'
* PHP-8.1:
  Add test
  ws
  Fix array object clobbering by user error handler
2021-12-03 13:41:12 +03:00
Dmitry Stogov
731ce6be01 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix array object clobbering by user error handler
2021-12-03 13:36:33 +03:00
Dmitry Stogov
1d054b3fa7 Fix array object clobbering by user error handler
Fixes oss-fuss #41605 and #41610
2021-12-03 13:35:28 +03:00
Dmitry Stogov
da0d4bf7fc Merge branch 'PHP-8.1'
* PHP-8.1:
  Add missing zend_string_release_ex(tmp, 0) and cleanup
2021-12-02 11:22:24 +03:00
Dmitry Stogov
b9ff359a99 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Add missing zend_string_release_ex(tmp, 0) and cleanup
2021-12-02 11:21:04 +03:00
Dmitry Stogov
37ac707cac Add missing zend_string_release_ex(tmp, 0) and cleanup
- use GC_DELREF() instead of zend_string_release_ex()
- add expectations for exceptional cases
- replace IS_ARRAY_IMMUTABLE by IS_STR_INTERNED
2021-12-02 11:18:08 +03:00
Dmitry Stogov
17fac12ed4 Merge branch 'PHP-8.1'
* PHP-8.1:
  Fixed ext/bz2/tests/005.phpt test failure introduesed by 09547c64c2
2021-12-02 10:35:44 +03:00
Dmitry Stogov
4eaba3e2ed Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fixed ext/bz2/tests/005.phpt test failure introduesed by 09547c64c2
2021-12-02 10:34:14 +03:00
Dmitry Stogov
df16da3697 Fixed ext/bz2/tests/005.phpt test failure introduesed by 09547c64c2 2021-12-02 10:32:45 +03:00
Dmitry Stogov
2384112ec8 Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix clobering of operand by error handler in assignment to string offset (optimization and JIT support)
2021-12-02 01:22:27 +03:00
Dmitry Stogov
c8dca00d15 Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix clobering of operand by error handler in assignment to string offset
2021-12-02 01:22:15 +03:00
Dmitry Stogov
e833e5cfa0 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix clobering of operand by error handler in assignment to string offset (optimization and JIT support)
2021-12-02 01:20:48 +03:00
Dmitry Stogov
4595a57e99 Fix clobering of operand by error handler in assignment to string offset (optimization and JIT support) 2021-12-02 01:20:17 +03:00
Dmitry Stogov
9786eac9a3 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix clobering of operand by error handler in assignment to string offset
2021-12-02 00:46:27 +03:00
Dmitry Stogov
09547c64c2 Fix clobering of operand by error handler in assignment to string offset
In some cases new code requires two reallocations insead of one.

Fixes oss-fuzz #31716, #36196, #39739 and #40002
2021-12-02 00:24:05 +03:00
Dmitry Stogov
bdf6779c7d Merge branch 'PHP-8.1'
* PHP-8.1:
  Use proper functions
2021-12-01 22:45:26 +03:00
Dmitry Stogov
10cfe9f13b Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Use proper functions
2021-12-01 22:45:15 +03:00
Dmitry Stogov
9f6ab78610 Use proper functions 2021-12-01 22:43:19 +03:00
Dmitry Stogov
db806d70ed Merge branch 'PHP-8.1'
* PHP-8.1:
  Fixed crash in ZEND_ASSIGN_DIM_OP because of array cloberring by user error handler
2021-11-30 23:34:50 +03:00
Dmitry Stogov
b594a95a2f Fixed crash in ZEND_ASSIGN_DIM_OP because of array cloberring by user error handler
Fixes oss-fuzz #36214
2021-11-30 23:33:34 +03:00
Dmitry Stogov
532f2ca7ff Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix crash after indirect modification of string by user error handler
2021-11-30 16:10:11 +03:00
Dmitry Stogov
afd881718e Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix crash after indirect modification of string by user error handler
2021-11-30 16:09:58 +03:00
Dmitry Stogov
df434f056f Fix crash after indirect modification of string by user error handler
Fixes oss-fuzz #39346
2021-11-30 16:07:38 +03:00
Nikita Popov
16e9e666ba Encode string offset error reason in extended_value
For FETCH_DIM_W etc encode the context it is being used in
(dim, obj, ref or incdec) so we can throw an appropriate error
message for invalid string offset use, in a way that does not
require inspecting neighboring opcodes. The implementation is
similar to the flags used for FETCH_OBJ.

This means that we do not have to be careful about preserving
following opcodes during optimization.

Closes GH-7599.
2021-10-21 09:52:09 +02:00
Nikita Popov
a38bad87d5 Consolidate UNSET_DIM handling for string offset error
The immediate error here is the nested indexing in write context,
the fact that it's ultimately wrapped in an unset() doesn't matter.
Same as $str[0][0] += 1 will throw "Cannot use string offset as an
array", so should this case.
2021-10-20 13:05:38 +02:00
Nikita Popov
ca7a11c9cf Consolidate string offset by reference errors
Use the same error message for all scenarios where a reference to
a string offset is acquired.
2021-10-20 13:00:48 +02:00
Nikita Popov
a58201369c Remove impossible cases from string offset error handling
As far as I can see, these cases should not be reachable.
2021-10-20 12:51:42 +02:00