Commit Graph

11942 Commits

Author SHA1 Message Date
Christoph M. Becker
c249f593ef 7.3.20 will be next 2020-05-26 10:53:22 +02:00
Christoph M. Becker
d4bd6fb491 Fix #79615: Wrong GIF header written in GD GIFEncode
The color resolution is expected in bits 4-6 of the packed fields byte
of the logical screen descriptor (byte 10 of the GIF data stream),
according to the specification[1], section 18.

[1] <https://www.w3.org/Graphics/GIF/spec-gif89a.txt>
2020-05-22 09:15:41 +02:00
Christoph M. Becker
d1cd489a53 Fix #79596: MySQL FLOAT truncates to int some locales
We must not do locale aware float to string conversion here; instead
we using our `snprintf()` implementation with the `F` specifier.
2020-05-15 09:09:41 +02:00
Christoph M. Becker
5bdb4ab786 Fix #79588: Boolean opcache settings ignore on/off values
We should display boolean INI settings as boolean.
2020-05-12 19:44:39 +02:00
Christoph M. Becker
bdba0cd3d2 Fix #79489: .user.ini does not inherit
On Windows, PATH_TRANSLATED may contain backslashes as well as slashes,
so we must not only check for `DEFAULT_SLASH`.
2020-05-12 11:47:47 +02:00
Christoph M. Becker
85e241c35c [ci skip] Update NEWS 2020-05-12 11:16:55 +02:00
Christoph M. Becker
f33cf52faf Fix #79566: Private SHM is not private on Windows
We map the POSIX semantics of `IPC_PRIVATE` by creating unnamed file
mapping objects on Windows.  While that is not particularly useful for
ext/shmop, which is the only bundled extension which uses `shmget()`,
it may be useful for external extensions.
2020-05-05 11:38:29 +02:00
Christoph M. Becker
c40a494406 Fix #79561: dns_get_record() fails with DNS_ALL
Since Windows has its own definitions of the `PHP_DNS_*` macros, we
have to use these when registering the PHP constants.
2020-05-04 22:59:38 +02:00
Nikita Popov
7c1316ec6a Fixed bug #79535
We did not allocate a cache slot for FETCH_CLASS. This is already
fixed on newer PHP versions.
2020-05-04 14:51:18 +02:00
Christoph M. Becker
54148fd686 Fix #79528: Different object of the same xml between 7.4.5 and 7.4.4
Revert "Fix #61597: SXE properties may lack attributes and content"

This reverts commit 7c081db885.
2020-05-01 12:37:39 +02:00
Christoph M. Becker
6998cc5029 Bump version 2020-04-28 09:10:50 +02:00
Christoph M. Becker
29968d8f99 Fix #79470: PHP incompatible with 3rd party file system on demand
We add support for Activision HSM (`IO_REPARSE_TAG_ACTIVISION_HSM`) and
VFS for Git (`IO_REPARSE_TAG_PROJFS`).  The latter fixes bug #78784.
2020-04-27 09:30:57 +02:00
Christoph M. Becker
ccca2c448d Fix #79503: Memory leak on duplicate metadata
Duplicate metadata can only happen if someone tampers with the phar, so
we can and should treat that as error.
2020-04-22 15:07:46 +02:00
Christoph M. Becker
fa10abd6d7 Fix #79491: Search for .user.ini extends up to root dir
The `start` parameter of `php_cgi_ini_activate_user_config` is supposed
to hold the byte offset of the doc root in the given `path`.  However,
the current expression which fixes a potential type incompatibility
will ever only evaluate to zero or one, because it uses the *logical*
and operator (`&&`).  Furthermore we notice that subtracting one from
`doc_root_len` is not necessary, so there is even no need for the
`start` parameter at all.
2020-04-20 10:56:36 +02:00
Joe Cai
94e09bfe55 Fix #79497: Fix php_openssl_subtract_timeval()
I stumbled upon this while debugging a strange issue with
stream_socket_client() where it randomly throws out errors when
the connection timeout is set to below 1s. The logic to calculate
time difference in php_openssl_subtract_timeval() is wrong when
a.tv_usec < b.tv_usec, causing connection errors before the timeout
is reached.
2020-04-20 10:25:54 +02:00
Nikita Popov
79a36ff7f3 Fixed bug #79477
Make sure to deindirect properties when creating array.
2020-04-15 11:21:05 +02:00
Christoph M. Becker
c4cdf1ae12 Add missing CVE 2020-04-14 18:18:18 +02:00
dinosaur
95eaccd0bb Fixed bug #79468
Close the stream filter resources when removing them from the stream.
2020-04-14 11:59:51 +02:00
Christoph M. Becker
8967588702 Add NEWS entries [ci skip] 2020-04-14 08:54:00 +02:00
Christoph M. Becker
efec22b7be Fix #78221: DOMNode::normalize() doesn't remove empty text nodes
If a text node is not followed by another text node, we remove it, if
its textContent is empty.
2020-04-07 13:04:14 +02:00
Nikita Popov
cf68bc413b Fixed bug #79434 2020-04-02 16:34:03 +02:00
Christoph M. Becker
cc3af6fdea Add NEWS entryc [ci skip] 2020-04-01 09:26:20 +02:00
Christoph M. Becker
33226c3a17 Next is 7.3.18 2020-03-31 10:22:55 +02:00
Christoph M. Becker
b510250b8e Fix #79413: session_create_id() fails for active sessions
The comment on `PS_VALIDATE_SID_FUNC(files)` is very clear that the
function is supposed to return `SUCCESS` if the session already exists.
So to detect a collision, we have to check for `SUCCESS`, not
`FAILURE`.

We also fix the wrong condition in session_regenerate_id() as well.
2020-03-31 08:38:23 +02:00
Christoph M. Becker
a681b12820 Fix #79427: Integer Overflow in shmop_open()
If `shm.shm_segsz > ZEND_LONG_MAX` the assignment to `shmop->size` a
few lines below would overflow, so we catch that early and bail out if
necessary.
2020-03-30 08:56:49 +02:00
Max Rees
04920645f1 Fix #79424 ext/zip: don't use gl_pathc after call to globfree
This breaks on Linux with the musl libc, since it zeroes out gl_pathc during
globfree.
2020-03-29 14:22:31 +02:00
Dmitry Stogov
65120cfc09 Fixed bug #79412 (Opcache chokes and uses 100% CPU on specific script). 2020-03-25 17:31:06 +03:00
Christian Schneider
c0840fec9c Fix bug #79410 (system() swallows last chunk if it is exactly 4095 bytes without newline)
Closes GH-5292.
2020-03-25 10:50:35 +01:00
Christoph M. Becker
32a2644305 Fix #79200: Some iconv functions cut Windows-1258
To cater to potentially state-dependent encodings, we have to reset the
conversion descriptor into its initial shift state to properly finish
the conversion.  Furthermore, state-dependent encodings may not show
progress when comparing `in_left` before and after the conversion; we
rather have to see whether `out_left` has decreased.  Also we have to
cater to the fact that the final potentially state resetting call does
not signal failure, but we still have to break respective loops
afterwards.
2020-03-23 14:12:37 +01:00
Christoph M. Becker
47c745555c Fix #79393: Null coalescing operator failing with SplFixedArray
We favor the KISS principle over optimization[1] – SPL is already
special enough.

[1] <352f3d4476 (r112498098)>ff
2020-03-23 13:29:25 +01:00
Remi Collet
51c57a9c67 NEWS 2020-03-20 11:16:08 +01:00
Nate Brunette
d70058a139 Fix #79396: DateTime hour incorrect during DST jump forward
When you attempt to set the time to a non-existent time occuring during
a DST jump forward, the hour does not move forward correctly.
2020-03-19 08:50:34 +01:00
Christoph M. Becker
9b8aa105ed Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2:
  Fix NEWS
2020-03-17 11:09:55 +01:00
Christoph M. Becker
6a4fff4682 Fix NEWS 2020-03-17 11:06:45 +01:00
Stanislav Malyshev
e71fa03107 [ci skip] Update NEWS 2020-03-16 22:40:00 -07:00
Stanislav Malyshev
c8d21d7728 [ci skip] Update NEWS 2020-03-15 19:38:31 -07:00
Christoph M. Becker
2b5fc8e325 Fix #79199: curl_copy_handle() memory leak
`curl_copy_handle()` already registers a new resource, so we must not
increase the refcount of the original resource.
2020-03-12 11:23:53 +01:00
Christoph M. Becker
7c081db885 Fix #61597: SXE properties may lack attributes and content
We must not treat a node as string if it has attributes, unless it is
an entity declaration which is always treated as string by simplexml.
2020-03-12 10:52:28 +01:00
Christoph M. Becker
53797c206a Fix #78210: Invalid pointer address
This is actually about three distinct issues:

* If an empty string is passed as $address to `stream_socket_sendto()`,
  the `sa` is not initialized, so we must not pass it as `addr` to
  `php_stream_xport_sendto()`.

* On POSIX, `recvfrom()` truncates messages which are too long to fit
  into the specified buffer (unless `MSG_PEEK` is given), discards the
  excessive bytes, and returns the buffer length.  On Windows, the same
  happens, but `recvfrom()` returns `SOCKET_ERROR` with the error code
  `WSAEMSGSIZE`.  We have to catch this for best POSIX compatibility.

* In `php_network_parse_network_address_with_port()`, we have to zero
  `in6` (not only its alias `sa`) to properly support IPv6.

Co-Authored-By: Nikita Popov <nikita.ppv@googlemail.com>
2020-03-11 11:30:15 +01:00
Christoph M. Becker
2462f2dab1 Fix #79364: When copy empty array, next key is unspecified
We must not forget to keep the `nNextFreeElement` when duplicating
empty arrays.
2020-03-11 08:54:05 +01:00
Christoph M. Becker
b84277297a Fix #75673: SplStack::unserialize() behavior
Even though `SplStack::unserialize()` is not supposed to be called on
an already constructed instance, it is probably better if the method
clears the stack before actually unserializing.
2020-03-06 09:09:49 +01:00
Christoph M. Becker
9dda3b9eb2 Next is 7.3.17 2020-03-03 10:19:31 +01:00
Christoph M. Becker
53140e5c56 Fix #79333: com_print_typeinfo() leaks memory
We have to free the `ansiname`s, regardless of whether they have been
put into the hashtable or not.

Since bug79299.phpt already shows the leak when run with a leak
checker, there is no need for another regression test.
2020-03-02 11:36:30 +01:00
Christoph M. Becker
2adf1c4d23 Fix #79332: php_istreams are never freed
Releasing the `com_dotnet_istream_wrapper` in `istream_destructor()` is
pointless, since `istream_destructor()` is only called when the
resource is going to be released.  This recursion is not a real issue,
though, since the resource is never exposed to userland, and has at
most refcount 1, so due to well defined unsigned integer underflow, it
never is released twice.  However, returning early in this case causes
a memory leak which needs to be fixed.
2020-03-02 10:45:37 +01:00
Nikita Popov
6c48da9a50 Fixed bug #79062
Back up the doc comment when performing heredoc scanahead.
2020-02-28 17:06:05 +01:00
Christoph M. Becker
6adb885966 Fix #79311: enchant_dict_suggest() fails on big endian architecture
For obvious reasons, we must not assign a `size_t` value to an `int`
variable using memcpy().  However, there is actually no need for the
intermediate `n_sugg_st` here, if we use the proper types in the first
place.

A regression test is not necessary, because dict_suggest.phpt already
exhibits the erroneous behavior on big endian architectures.
2020-02-28 15:43:44 +01:00
Christoph M. Becker
8654c32b58 Fix #64032: mysqli reports different client_version
While `mysqli_get_client_version()` calls `mysql_get_client_version()`
to retrieve the client version, `mysql::$client_version` is initialized
to `MYSQL_VERSION_ID`.  Both should match though, and since the former
is the more useful information, we fix `mysql::$client_version`.

We do not add a regression test, because it would usually succeed
anyway, and we already have several tests with respective `assert()`s.
2020-02-27 09:35:04 +01:00
Mark Plomer
8c6a7c3326 Fix #63206: Fully support error/exception_handler stacking, even with null or inside the handler
Always push the current user_error/exception_handler to the stack,
even when it is empty, so restore_error_handler() always works as
expected.

The user_error_handler is especially temporarily empty when we are inside
the error handler, which caused inconsistent behaviour before.
2020-02-25 12:43:42 +01:00
Miguel Xavier Penha Neto
d0d60503b5 Fixes #79265: Improper injection of Host header when using fopen for http requests
Check all occurrences of the string "host:" (and other headers),
not just the first one.
2020-02-24 09:50:32 +01:00
Christoph M. Becker
9e6358af36 Fix #79299: com_print_typeinfo prints duplicate variables
`lastid` has to retain its value during the traversal, so we move it to
an outer scope.

Patch contributed by Litiano Moura.
2020-02-23 23:31:36 +01:00