Commit Graph

13382 Commits

Author SHA1 Message Date
Calvin Buckley
445d9502bf
Fix handling of single-key connection strings
A connection string may contain just a single key, but
PHP used ";" as the heuristic to detect if a string was a connection
string versus plain DSN. However, a single-key connection string
would get treated like a DSN name, i.e. "DSN=*LOCAL". This makes it
so that "=" is used, as a connection string must contain a key.

Closes GH-8748.
2022-06-13 14:41:50 +02:00
Remi Collet
62f64141ef
[ci skip] missing CVE 2022-06-10 14:31:48 +02:00
Jakub Zelenka
b765d4cd41 Fix bug #50293 and #81713: file path checking in OpenSSL functions
It introduces a single function to check file paths passed to OpenSSL
functions. It expands the path, check null bytes and finally does
an open basedir check.
2022-06-09 19:49:59 +01:00
Remi Collet
ae8c2bc1ce
NEWS for GH-8685 2022-06-03 07:54:36 +02:00
Yurun
df52903ee0 Closes GH-8626: Fix PDOStatement->execute() failed.
Then execute successfully, errorInfo() information is incorrect
2022-06-02 17:32:43 +01:00
Derick Rethans
d5e57268a9 Fixed bug #78139 (timezone_open accepts invalid timezone string argument). 2022-05-27 14:43:04 +01:00
Derick Rethans
d8590b1aff Merge remote-tracking branch 'derickr/bug74671-dst-c-format' into PHP-8.0 2022-05-27 14:23:38 +01:00
Derick Rethans
172b7345b1 Update NEWS 2022-05-26 15:18:33 +01:00
Sara Golemon
e05897fe5e
Bump for 8.0.21 2022-05-24 18:51:01 +00:00
David Carlier
e33de9dda8
Fix pcntl Haiku build
guarding SIGIO constant.

Closes GH-8612.
2022-05-24 14:59:50 +02:00
Christoph M. Becker
2a13304b2e
Fix GH-8538: SoapClient may strip parts of nmtokens
When stripping the namespace prefix, we can assume that this does not
contain any colons, while the rest of the name may contain colons.
Hence we must not use `strrchr()` but rather `strchr()` instead.

Closes GH-8543.
2022-05-23 16:49:12 +02:00
Ilija Tovilo
f0480eb4de
Fix undefined behavior in php_set_inet6_addr
Postfix `++` on `NULL` is undefined behavior

Closes GH-8607
2022-05-22 23:23:47 +02:00
Levi Morrison
fa78e17724 Stop closing stderr and stdout streams (#8569)
Extensions may (and do) write to stderr in mshutdown and similar. In
the best case, with the stderr stream closed, it's just swallowed.

However, some libraries will do things like try to detect color, and
these will outright fail and cause an error path to be taken.
2022-05-20 13:27:23 +02:00
robertnisipeanu
8735ae9d13
Fix GH-8578: Error on wrong parameter on SoapHeader constructor
Closes GH-8579.
2022-05-19 11:03:49 +02:00
Arnaud Le Blanc
5a39f4c7cc [ci skip] NEWS 2022-05-13 12:41:42 +02:00
Jakub Zelenka
23a2030438 Fix bug #72185: php-fpm writes empty fcgi record causing nginx 502
This issue might happen if there is change of the fcgi stream when
the buffer is full. Then the empty record is created which signals
end of stream which is incorrect.

The actual fix without a test was contributed by GitHub user @loveharmful
in GH-3198.
2022-05-10 21:36:55 +01:00
Derick Rethans
95f5f9d21d Adding missing NEWS entry 2022-05-05 15:25:35 +01:00
Christoph M. Becker
ad7b9f4e50
Fix GH-8235: iterator_count() may run indefinitely
We need to prevent integer overflow to eventually stop the iteration.

A test case doesn't appear sensible for this, because even on 32bit
architectures a respective test easily runs for a few minutes.

Closes GH-8447.
2022-05-03 12:57:58 +02:00
Remi Collet
2d4cc0eb83
[ci skip] NEWS 2022-05-02 14:50:16 +02:00
Jakub Zelenka
82dae61c04
Move FPM ACS fix NEWS entry to 8.0.20 2022-04-29 20:46:38 +01:00
David CARLIER
ef06f0f50b
Fix FPM ACL build check on MacOS
MacOS has got ACL support but without user/group support.
2022-04-29 20:39:22 +01:00
David Carlier
4bb0dd49d8
Haiku fix ZTS build disabling tsrm_ls_cache usage. 2022-04-26 14:16:38 +02:00
Gabriel Caruso
52a18a6620
Prepare for PHP 8.0.20 2022-04-26 10:17:50 +02:00
Christoph M. Becker
30f4c725cb
Fix GH-8218: ob_end_clean does not reset Content-Encoding header
The fix for GH-7953 introduced a regression by being to deliberate
adding the respective headers.  These must only be added, if the
handler starts, but is not finalizing.

Closes GH-8353.
2022-04-25 14:26:56 +02:00
Bob Weinand
2397e7685e Fix GH-8433: Assigning function pointers to structs in FFI leaks memory 2022-04-24 14:53:18 +02:00
Christoph M. Becker
f5d9e7c031
Fix GH-8364: msgfmt_format $values may not support references
We need to deref any references passed in the `$values` array.  While
we could handle this in the type switch, doing it right away in the
foreach loop makes that more explicit, and also circumvents the missing
range checks for integers which are not passed as int or double.

Closes GH-8407.
2022-04-24 12:43:08 +02:00
David Carlier
ff90d42b8b
Fix FPM kqueue handler fix remove callback typo
It avoids confusion on failed event.
2022-04-23 15:11:53 +01:00
George Peter Banyard
6186ecd436
Fix GH-8273: SplFileObject: key() returns wrong value 2022-04-23 13:56:38 +01:00
Ilija Tovilo
4d6965dcec
Add missing news entry for GH-8421 2022-04-23 11:21:51 +02:00
Jakub Zelenka
d8612fb6b7
Fix bug #77023: FPM cannot shutdown processes
This change introduces subsequent kill of the process when idle process quit
(SIGQUIT) does not succeed. It can happen in some situations and means that FPM
is not able to scale down in dynamic pm. Using SIGKILL fixes the issue.
2022-04-22 20:51:02 +01:00
Christoph M. Becker
1762a87932
Fix GH-8366: ArrayIterator may leak when calling __construct()
When we detach an iterator, we also have to delete it.

Closes GH-8374.
2022-04-15 19:05:18 +02:00
Derick Rethans
e38d300a70 Refactor code to avoid duplication 2022-04-14 10:32:10 +01:00
Jakub Zelenka
33bb201b3e
Fix bug #76003: FPM /status reports wrong number of active processe
The fix introduces early locking of scoreboard when it is updated
which prevents the race condition causing an incorrect number of
active processes being set.
2022-04-12 23:12:11 +01:00
ryancaicse
1a75269c8e
Move locks in TSRM.c to prevent races
Closes GH-8298.
2022-04-11 17:16:40 +02:00
Bernd Holzmüller
84c18f9f04
Preserve file-position when php://temp switches to temporary file
Closes GH-8333.
2022-04-11 12:31:22 +02:00
Christoph M. Becker
7c702b72f2
Fix GH-8267: MySQLi uses unsupported format specifier on Windows
Instead of using the unsupported `%I64u` and `%I64d` format specifiers
on Windows, we use the portable `PRIu64` and `PRId64` specifiers.

The `L64()` macro and the `my_longlong` typedef should be adapted as
well, as the `i64` literal suffix is still supported by MSVC, but using
`LL` or `ll` is recommended[1], and the standard `int64_t` is available
there anyway.  This is not urgent, though.

[1] <https://docs.microsoft.com/en-us/cpp/cpp/numeric-boolean-and-pointer-literals-cpp?view=msvc-170#integer-literals>

Closes GH-8268.
2022-04-07 17:03:15 +02:00
Christoph M. Becker
c2eafc29f5
Fix #81714: segfault when serializing finalized HashContext
We must not allow to serialize already finalized `HashContext`s, since
the internal context is already freed.  Since there is not much point
in serializing finalized `HashContext`s, we just bail out in that case.

Closes GH-8265.
2022-04-05 13:25:22 +02:00
Christoph M. Becker
43f3745abb
Bump version
Apparently, this has been forgotten when PHP 8.0.17RC1 and 8.0.18RC1
had been tagged.

We also fix the version of the fix for GH-8253, which didn't make it
into PHP 8.0.18RC1.
2022-04-05 13:19:02 +02:00
Bob Weinand
13649451c2 Fix GH-8289: Exceptions thrown within a yielded from iterator are not rethrown into the generator
This also fixes the fact that exception traces were not including the generator frame when thrown in a yielded from iterator.
2022-04-01 17:32:48 +02:00
Christoph M. Becker
0e6d6f83cc
Fix GH-8253: pg_insert() fails for references
We need to deref the values.

Closes GH-8262.
2022-03-29 10:51:19 +02:00
Christoph M. Becker
5a8622fe78
Fix result_type related stack corruption on LLP64 architectures
Integer parameters are stored in `zend_long` values, which have 64 bits
on LLP64, but `long` has only 32 bits there.

Adding a test might be overkill, because the broken behavior could
already be observed when running pg_select_001.phpt on Windows debug
builds, which report the stack corruption.

Closes GH-8263.
2022-03-28 18:27:44 +02:00
Christoph M. Becker
771dbdb319
Fix signedness confusion in php_filter_validate_domain()
As is, there is the possibility that integer underflow occurs, making
`_php_filter_validate_domain()` succeed for very long domain names.

Cf. <https://pwning.systems/posts/php_filter_var_shenanigans/>.
2022-03-28 14:00:22 +02:00
Christoph M. Becker
d0417ebc93
Fix GH-8208: mb_encode_mimeheader: $indent functionality broken
We also need to factor in the indent, when getting the encoder result.

Closes GH-8213.
2022-03-17 17:31:58 +01:00
Christoph M. Becker
ef29ddcc27
Fix GH-8068: mysqli_fetch_object creates inaccessible properties
When fetching into objects, we need to create object style hash tables,
i.e. where numeric column names are stored as string keys instead of
integer keys.  Instead of the slightly more efficient alternative to
create the desired hash table in the first place, we go for the more
readable implementation and convert the array style hash table using
`zend_symtable_to_proptable()`.

Co-authored-by: Kamil Tekiela <tekiela246@gmail.com>

Closes GH-8189.
2022-03-14 14:27:04 +01:00
Michael Voříšek
2b2aeb989e
Fix GH-8160: ZTS support on Alpine is broken
We need to export `__MUSL__` so that phpize builds can see the proper
macro, and also need to fix "_tsrm_ls_cache" usage for musl.

Closes GH-8180.
2022-03-11 14:39:39 +01:00
David Carlier
7eb972c456
Fix Solaris builds of ext/sockets
We enable the proper ancillary data handling layout and API.

Closes GH-7859.
2022-03-10 14:48:08 +01:00
Christoph M. Becker
1d9a1f9be3
Fix GH-8121: SplFileObject - seek and key with csv file inconsistent
First, we must not free the current line before we call
`spl_filesystem_file_read_csv()`, because then the `current_line` will
not be properly updated.  Since the EOF check is superfluous here, we
move that part of the code to the branch for subtypes.  This issue has
been introduced by the fix for bug 75917.

Second, we only must increase the `current_line` if we're not reading
ahead.  This issue has been introduced by the fix for bug 62004.

Closes GH-8138.
2022-03-08 16:54:02 +01:00
Tim Düsterhus
0d7e10c1a9 Fix memory leak of function attribute hash table (#8070)
==109253== 280 (56 direct, 224 indirect) bytes in 1 blocks are definitely lost in loss record 4 of 4
    ==109253==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
    ==109253==    by 0x6D9FA2: __zend_malloc (zend_alloc.c:3068)
    ==109253==    by 0x745138: zend_add_attribute (zend_attributes.c:226)
    ==109253==    by 0x6680D1: zend_add_parameter_attribute (zend_attributes.h:102)
    ==109253==    by 0x66B787: zm_startup_zend_test (test.c:478)
    ==109253==    by 0x7224CD: zend_startup_module_ex (zend_API.c:2202)
    ==109253==    by 0x72252C: zend_startup_module_zval (zend_API.c:2217)
    ==109253==    by 0x734288: zend_hash_apply (zend_hash.c:2011)
    ==109253==    by 0x722C30: zend_startup_modules (zend_API.c:2328)
    ==109253==    by 0x67409B: php_module_startup (main.c:2256)
    ==109253==    by 0x88EDDE: php_cli_startup (php_cli.c:409)
    ==109253==    by 0x890F61: main (php_cli.c:1334)
2022-03-07 22:05:40 +01:00
Bob Weinand
f095d2c91b Fix freeing of internal attribute arguments 2022-03-07 22:04:16 +01:00
David Carlier
8b15858c58
Fix GH-8142: Compilation error on cygwin
* pcntl: SIGPOLL/si_band is unsupported
* intl: enable the signal apis with `_POSIX_C_SOURCE`

Closes GH-8146.
2022-03-04 16:20:39 +01:00