Commit Graph

1340 Commits

Author SHA1 Message Date
Jakub Zelenka
f3c357c446
Merge branch 'PHP-8.1' 2022-08-29 22:34:48 +01:00
Jakub Zelenka
bf97b3649d
Merge branch 'PHP-8.0' into PHP-8.1 2022-08-29 22:33:02 +01:00
Jakub Zelenka
3503b1daa2
Fix bug #77780: "Headers already sent" when previous connection was aborted
This change primarily splits SAPI deactivation to module and destroy
parts. The reason is that currently some SAPIs might bail out
on deactivation. One of those SAPI is PHP-FPM that can bail out on
request end if for example the connection is closed by the client
(web sever). The problem is that in such case the resources are not
freed and some values reset. The most visible impact can have not
resetting the PG(headers_sent) which can cause erorrs in the next
request. One such issue is described in #77780 bug which this fixes
and is also cover by a test in this commit. It seems reasonable
to separate deactivation and destroying of the resource which means
that the bail out will not impact it.
2022-08-29 22:25:53 +01:00
Eric Norris
09237f6126
Update request startup error messages 2022-07-18 23:19:59 +01:00
Jakub Zelenka
922371f3b1
Do not send X-Powered-By if headers sent (#9039)
Co-authored-by: Eric Norris <erictnorris@gmail.com>
2022-07-18 18:01:05 +01:00
Mikhail Galanin
ffdf25a270
Add "error_log_mode" setting 2022-07-18 15:41:28 +01:00
Christoph M. Becker
31b02a13ab
Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix GH-8923: error_log on Windows can hold the file write lock
2022-07-12 13:39:55 +02:00
Christoph M. Becker
5a459f6783
Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix GH-8923: error_log on Windows can hold the file write lock
2022-07-12 13:38:35 +02:00
Christoph M. Becker
77e954afaa
Fix GH-8923: error_log on Windows can hold the file write lock
On Windows, closing a file which is locked may not immediately remove
the lock.  The `LockFileEx()` documentation states:

| Therefore, it is recommended that your process explicitly unlock all
| files it has locked when it terminates.

We comply, and also use the macro `LOCK_EX` instead of the magic number
`2`.

Closes GH-8925.
2022-07-12 13:36:20 +02:00
Christoph M. Becker
640c1c3a09
Merge branch 'PHP-8.1'
* PHP-8.1:
  Fix potential use after free in php_binary_init()
2022-06-20 12:03:47 +02:00
Christoph M. Becker
5f24b85fd2
Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix potential use after free in php_binary_init()
2022-06-20 12:02:31 +02:00
Heiko Weber
93a44f8c50
Fix potential use after free in php_binary_init()
Closes GH-8791.
2022-06-20 12:00:50 +02:00
Arnaud Le Blanc
efc8f0ebf8
Deprecate zend_atol() / add zend_ini_parse_quantity() (#7951)
Add zend_ini_parse_quantity() and deprecate zend_atol(), zend_atoi()

zend_atol() and zend_atoi() don't just do number parsing.
They also check for a 'K', 'M', or 'G' at the end of the string,
and multiply the parsed value out accordingly.

Unfortunately, they ignore any other non-numerics between the
numeric component and the last character in the string.
This means that numbers such as the following are both valid
and non-intuitive in their final output.

* "123KMG" is interpreted as "123G" -> 132070244352
* "123G " is interpreted as "123 " -> 123
* "123GB" is interpreted as "123B" -> 123
* "123 I like tacos." is also interpreted as "123." -> 123

Currently, in php-src these functions are used only for parsing ini values.

In this change we deprecate zend_atol(), zend_atoi(), and introduce a new
function with the same behavior, but with the ability to report invalid inputs
to the caller. The function's name also makes the behavior less unexpected:
zend_ini_parse_quantity().

Co-authored-by: Sara Golemon <pollita@php.net>
2022-06-17 14:12:53 +02:00
George Peter Banyard
5ba6ecd523
Minor refactoring of main/main.c and TSRM (#8608) 2022-05-24 08:34:55 +01:00
George Peter Banyard
265c88b9e7
Don't initialise pointers to zend_stat_t 2022-05-22 16:13:44 +01:00
George Peter Banyard
2ecd46f48f
Initialise zend_stat_t to fix MSAN build 2022-05-22 16:06:27 +01:00
Arnaud Le Blanc
0a5a761104 Merge branch 'PHP-8.1' 2022-05-06 15:29:21 +02:00
Arnaud Le Blanc
f07a08df5c
Fix unregistering ini entries of dynamically loaded extension (#8435)
Fixes GH-8185
2022-05-06 15:25:44 +02:00
George Peter Banyard
b5db594fd2
Refacto php_module_startup() (#8303)
It only ever uses at most 1 additional modules
2022-04-27 23:07:11 +01:00
Christoph M. Becker
1bd9890b20
Fix GH-8310: Registry settings are no longer recognized
`zend_file_handle->filename` is a `zend_string*` pointer now, so we
must not cast to `char*` but rather pass the underlying `char*`.

Closes GH-8313.
2022-04-06 17:33:30 +02:00
Bob Weinand
85b669e565 Merge branch 'PHP-8.0' into PHP-8.1 2022-03-01 14:54:09 +01:00
Bob Weinand
e6cf583160 Fix GH-8082: Prevent leaking memory on observed transient run_time_caches
This is achieved by tracking the observers on the run_time_cache (with a fixed amount of slots, 2 for each observer).
That way round, if the run_time_cache is freed all associated observer data is as well.

This approach has been chosen, as to avoid any ABI or API breakage.
Future versions may for example choose to provide a hookable API for run_time_cache freeing or similar.
2022-03-01 14:49:44 +01:00
Nikita Popov
26e424465c Fix bug #81598: Use C.UTF-8 as LC_CTYPE locale by default
Unfortunately, libedit is locale based and does not accept UTF-8
input when the C locale is used. This patch switches the default
locale to C.UTF-8 instead (if it is available). This makes libedit
work and I believe it shouldn't affect behavior of single-byte
locale-dependent functions that PHP otherwise uses.

Closes GH-7635.
2021-12-05 21:03:27 +01:00
Nikita Popov
6ebabaa50c Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix bug #81591: ignore_repeated_errors broken
2021-11-04 16:25:18 +01:00
Nikita Popov
4c171ed5eb Fix bug #81591: ignore_repeated_errors broken
We should suppress the error if the message is the same, not if
it's different. Apparently we had no test coverage for these
options.
2021-11-04 16:23:55 +01:00
Christoph M. Becker
f99c69fc2e
Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix #81518: Header injection via default_mimetype / default_charset
2021-10-14 12:23:43 +02:00
Christoph M. Becker
b7f3b67060
Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #81518: Header injection via default_mimetype / default_charset
2021-10-14 12:21:35 +02:00
Christoph M. Becker
365769366b
Fix #81518: Header injection via default_mimetype / default_charset
We forbid setting these INI options to values containing NUL bytes, CR
or LF.

Closes GH-7574.
2021-10-14 12:16:19 +02:00
Tim Starling
c96be7b8f2 Use ASCII lower case for misc case folding
Use ASCII case conversion instead of locale-dependent case conversion in
the following places:

* grapheme_stripos() and grapheme_strripos() in the "fast" path
* ldap_get_entries()
* oci_pconnect() for case folding of parameters when constructing a key
  into the connection or session pool
* SoapClient: case folding of function names
* get_meta_tags(): case conversion of property names
* http stream wrapper: header names
* phpinfo(): anchor names
* php_verror(): docref URLs
* rfc1867.c: Content-Type boundary parameter name
* streams.c: stream protocol names

Using locale-dependent case folding for these cases is either
unnecessary or actively incorrect. These functions could have
misbehaved when used with certain locales (e.g. Turkish).

Closes GH-7511.
2021-09-24 09:20:08 +02:00
Nikita Popov
1da5df8029 Don't enable rc_debug mode if module startup fails 2021-07-21 09:14:15 +02:00
Nikita Popov
efbb2198d4 Return value from ZEND_ATOL
Instead of assigning it as part of the macro itself, which makes
usage quite awkward.
2021-07-12 16:51:24 +02:00
Nikita Popov
2c59a6b241 Merge branch 'PHP-8.0'
* PHP-8.0:
  Fix bug #80728: Don't reset the timeout on ini deactivate
2021-06-29 16:37:43 +02:00
Nikita Popov
65bd8d281f Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix bug #80728: Don't reset the timeout on ini deactivate
2021-06-29 16:37:27 +02:00
Calvin Buckley
98a21d1dfb Fix bug #80728: Don't reset the timeout on ini deactivate
When the time limit for a script is changed, when the script ends,
its INI value will be reset. This calls the event handler for the
timeout change, which will unset then reset the timeout. However,
this is done even if the script is done executing, and say, the CGI
or CLI web server process is idle.

This is probably incorrect, but isn't a problem on most platforms,
because PHP uses a timer that only ticks when the process is active
(that is, executing code). Since when it's idle, it's blocking on
listen/read, it won't tick because nothing executes. However, on
platforms where only the real-time timer is supported, (Cygwin/PASE)
it ticks regardless of if PHP is even executing. This means that the
idle processes are subject to timeouts from the INI reset on script
end.

This makes it so the timer is never set if the state is deactivating.
Testing with the CLI web server indicates the timer no longer
spuriously activates under PASE.

Closes GH-6683.
2021-06-29 16:36:46 +02:00
Patrick Allaert
aff365871a Fixed some spaces used instead of tabs 2021-06-29 11:30:26 +02:00
Nikita Popov
291d8db7c5 Merge branch 'PHP-8.0'
* PHP-8.0:
  Fixed bug #81104
2021-06-08 14:34:08 +02:00
Nikita Popov
d29f15ce5f Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fixed bug #81104
2021-06-08 14:33:29 +02:00
Nikita Popov
d8165c2502 Fixed bug #81104
When the memory limit is restored during shutdown, we may still
be using a lot of memory. Ignore the failure at that point and
set it again after the MM is shut down, at which point memory
usage should be at its lowest point.
2021-06-08 14:31:55 +02:00
Nikita Popov
e9b005158f Fix output buffer discard on memory limit
Move this code directly into the error handler, and check the
heap->overflow flag. Discarding output here allows us to print
the normal memory limit message to standard output. Otherwise
nothing would be printed unless a different log medium was used,
which makes for a suboptimal debugging experience.
2021-05-31 16:30:36 +02:00
Nikita Popov
1aafed5e98 Remove zend_set_memory_limit_ex() API
This was added temporarily for the PHP-8.0 branch to avoid an
ABI break.
2021-05-31 15:27:46 +02:00
Nikita Popov
b4559e7ae4 Merge branch 'PHP-8.0'
* PHP-8.0:
  Fixed bug #81070
2021-05-31 15:24:29 +02:00
Nikita Popov
324ad2f42c Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fixed bug #81070

This is a non-trivial merge. To avoid an ABI break, a new
zend_set_memory_limit_ex() function is added.
2021-05-31 15:24:00 +02:00
Peter van Dommelen
1b3b5c94e5 Fixed bug #81070
When the memory limit is reduced using an `ini_set("memory_limit", ..)`
below the currently allocated memory, the out-of-memory check overflowed.
Instead of implementing additional checks during allocation,
`zend_set_memory_limit()` now validates the new memory limit. When
below the current memory usage the ini_set call will fail and throw
a warning.

This is part of GH-7040.
2021-05-31 15:18:58 +02:00
George Peter Banyard
c40231afbf
Mark various functions with void arguments.
This fixes a bunch of [-Wstrict-prototypes] warning,
because in C func() and func(void) have different semantics.
2021-05-12 14:55:53 +01:00
Michael Voříšek
3ccc0409ce Remove no longer used "log_errors_max_len" ini directive (#6838)
This is a re-application of the original match against master.
The patch was originally applied to master, then reverted from
there, incorrectly applied to PHP-8.0, reverted from there due
to ABI break, and now lands on master again. We can only hope
that it does not get reverted again ;)
2021-05-10 19:26:33 +02:00
Nikita Popov
090627048c Revert "Remove no longer used "log_errors_max_len" ini directive (#6838)"
This reverts commit d2d227e547.

This is an ABI break.
2021-05-08 20:54:53 +02:00
Ben Ramsey
b5d5d06ff3
Revert "Remove no longer used "log_errors_max_len" ini directive (#6838)"
This reverts commit cc2c810dcf.
2021-05-08 13:23:58 -05:00
Michael Voříšek
d2d227e547
Remove no longer used "log_errors_max_len" ini directive (#6838) 2021-05-08 13:05:13 -05:00
Michael Voříšek
cc2c810dcf
Remove no longer used "log_errors_max_len" ini directive (#6838) 2021-05-07 19:07:35 -05:00
KsaR
01b3fc03c3
Update http->https in license (#6945)
1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |
2021-05-06 12:16:35 +02:00