Commit Graph

50073 Commits

Author SHA1 Message Date
Christoph M. Becker
844a2dd6ac Fix #79986: str_ireplace bug with diacritics characters
`tolower()` returns an `int`, so we must not convert to `char` which
may be `signed` and as such may be subject to overflow (actually,
implementation defined behavior).

Closes GH-6007
2020-08-24 11:08:48 +02:00
Christoph M. Becker
fcd26ffcc3 Fix #80002: calc free space for new interned string is wrong
We need to calculate the free size in bytes.

Patch contributed by t-matsuno.

Closes GH-6024
2020-08-24 11:03:19 +02:00
Andy Postnikov
b2a33ab06b Fix #80007: Potential type confusion in unixtojd() parameter parsing
Also it fixes test on 32-bit armv7 and x86
- Test unixtojd() function : error conditions [ext/calendar/tests/unixtojd_error1.phpt]

Closes GH-6033
2020-08-22 12:30:04 +02:00
Matteo Beccati
f7c43b8c72 Fix #47021: SoapClient stumbles over WSDL delivered with "Transfer-Encoding: chunked" 2020-08-18 18:10:39 +02:00
Christoph M. Becker
1ae80f8c92 Fix HTTP response status code 2020-08-18 08:33:45 +02:00
Nikita Popov
f6d7af21a3 Null terminate the sodium_crypto_kx_keypair() result 2020-08-14 15:51:31 +02:00
Ahmed Abdou
2fe2e5b48f Fix #64705 errorInfo property of PDOException is null when PDO::__construct() fails
PDO driver constructors are throwing PdoException without setting
errorInfo, so create a new reusable function that throws exceptions
for PDO and will also set the errorInfo. Use this function in
pdo_mysql, pdo_sqlite, and pdo_pgsql.
2020-08-11 17:12:48 +02:00
Nawarian
2fa4ca95db Fix bug #75785 by attempt switching endianness on Maker's Note
Different manufacturer models may come with a
different endianness (motorola/intel) format. In
order to avoid a big refactor and a gigantic lookup
table, this commit simply attempts to switch the
endianness and proceed when values are acceptable.

Closes GH-5849.
2020-08-11 16:26:34 +02:00
Christoph M. Becker
dc108feab8 Fix #48585: com_load_typelib holds reference, fails on second call
Whether the type library is cached is actually irrelevant here; what
matters is that the symbols are imported, and since these are not
cached, we have to import them for every request.  And we cannot cache
the symbols, because the import depends on the current codepage, but
the codepage is a `PHP_INI_ALL` setting.
2020-08-11 11:26:50 +02:00
Nikita Popov
9d9dffe60a Fixed bug #79951
One branch did not release tmp_replace_entry_str.

Also reduce the scope of some variables.
2020-08-11 10:33:59 +02:00
Nikita Popov
4723bd4ffa Check the correct list
This was supposed to check mx_list, not weight_list... oops.
2020-08-10 21:52:36 +02:00
Nikita Popov
a06eed0c0e Fix bug #79944
Only return true from dns_get_mx if we actually found any MX record.
2020-08-10 20:42:50 +02:00
Christoph M. Becker
0af3f49312 Fix #79922: Crash after multiple calls to xml_parser_free()
We must not call `zend_list_delete()` in resource closer functions
exposed to userland, because decreasing the refcount there leads to
use-after-free scenarios.  In this case, commit 4a42fbb worked for
typical use-cases where `xml_parser_free()` has been called exactly
once for the resource, because there is an internal zval (`->index`)
referencing the same resource which already increased the refcount by
one.  However, when `xml_parser_free()` is called multiple times on the
same XML parser resource, the resource would be freed prematurely.

Instead we forcefully close the resource in `xml_parser_free()`.  We
also could decrease the refcount of the resource there, but that would
require to call `xml_parser_free()` which is somewhat uncommon, and
would be particularly bad wrt. PHP 8 where that function is a NOP, and
as such doesn't have to be called.  So we do no longer increase the
refcount of the resource when copying it to the internal zval, and let
the usualy refcounting semantics take care of the resource destruction.

[1] <http://git.php.net/?p=php-src.git;a=commit;h=4a42fbbbc73aad7427aef5c89974d1833636e082>
2020-08-10 12:23:44 +02:00
Florian Engelhardt
5be670265b Fix bug #70574: Move files to proper locale dir
Closes GH-5940.
2020-08-07 14:37:27 +02:00
Nikita Popov
6a1bd57df5 Fix memory leak on socket_sendmsg() / socket_recvmsg() error 2020-08-05 16:41:40 +02:00
Nikita Popov
da786a22af Fixed bug #79930
We're inserting src_zval, so that's what we should addref.
2020-08-05 15:43:41 +02:00
David Carlier
12db8b90a7 Fix iov_base pointer type for illumos
These systems has two versions of the iovec interface dependent on
compiler flags passed, the legacy version causing little build issue.

Closes GH-5939.
2020-08-05 15:17:51 +02:00
Stanislav Malyshev
5b29af5c78 Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2:
  Fix #79877: getimagesize function silently truncates after a null byte
  Fix #79797: Use of freed hash key in the phar_parse_zipfile function
2020-08-02 23:56:37 -07:00
Christoph M. Becker
ff577b04c0 Fix #79877: getimagesize function silently truncates after a null byte
We have to check for NUL bytes if `getimagesize()` has been called.
2020-08-02 15:33:24 -07:00
Christoph M. Becker
7355ab8176 Fix #79797: Use of freed hash key in the phar_parse_zipfile function
We must not use heap memory after we freed it.
2020-08-02 15:31:29 -07:00
Christoph M. Becker
d95c53834c Amendment to OPcache base file removal
We fix the erroneous segment size.  We also keep the segment pointer at
the allocated address, but increase the position instead.
2020-07-29 18:44:08 +02:00
Nikita Popov
57ad5b3432 Consider op1 literal of FETCH_OBJ_R
FETCH_OBJ_R may have an op1 CONST operand, even though it will
always error. We should take this into account when compacting
literals.
2020-07-29 17:04:23 +02:00
Nikita Popov
99c48a2477 Fix test 2020-07-29 15:04:05 +02:00
twosee
0b8c83f593 Handle bindto error
Closes GH-5903.
2020-07-29 17:46:27 +08:00
Christoph M. Becker
9a744c66e7 Fix #73060: php failed with error after temp folder cleaned up
Instead of storing the mapping base address and the address of
`execute_ex()` in a separate file in the temporary folder, we store
them right at the beginning of the memory mapping.
2020-07-29 10:07:23 +02:00
Christoph M. Becker
c756f82c02 Fix #79806: realpath() erroneously resolves link to link
After resolving reparse points, the path still may be a reparse point;
in that case we have to resolve that reparse point as well.
2020-07-28 13:55:22 +02:00
Paweł Tomulik
efe6d96b45 fix memory leaks in ext/ldap/ldap.c 2020-07-28 10:23:10 +02:00
Christoph M. Becker
1aeff522b8 Revert "Fix #79806: realpath() erroneously resolves link to link"
This reverts commit d5b59b4303.
2020-07-27 17:50:41 +02:00
Christoph M. Becker
d5b59b4303 Fix #79806: realpath() erroneously resolves link to link
After resolving reparse points, the path still may be a reparse point;
in that case we have to resolve that reparse point as well.
2020-07-27 15:08:39 +02:00
Christoph M. Becker
6b99a8be4d Fix brittle test
This test fails occasionally due to timing issues, because the session
file may have been unlinked by the first `session_start()`'s GC.  We
adapt the test expectation to this reality.
2020-07-22 20:45:56 +02:00
Christoph M. Becker
b2e3fd1e69 Fix #63527: DCOM does not work with Username, Password parameter
We must not mix multibyte and wide character strings in the
`COAUTHIDENTITY` structure.  Using wide character strings throughout
would have the advantage that the remote connection can be established
regardless of the code page of the server, but that would more likely
break BC, so we just drop the wide character string conversion of the
username.
2020-07-20 14:43:29 +02:00
Andy Postnikov
2c57378bd3 Fix bug #78008: dns_check_record() always return true on Alpine
- free handle before return result
- cleaned up remaining usage of MAXPACKET
- update dns_get_mx() to use the same approach

Closes GH-5854.
2020-07-15 15:10:19 +02:00
Evgeny Stepanischev
ce149b0cb8 Fixed bug #79849
Closes GH-5853.
2020-07-14 12:41:43 +02:00
twosee
f0b2c2cb98 Fixed BC break of php_debug_zval_dump
It introduced by fixing bug #79830
2020-07-11 18:30:28 +08:00
twosee
56dec3cc73 Fixed bug #79830 introduced by fixing bug #79821
This also fixes memory error in debug_zval_dump and var_export.
2020-07-11 14:37:25 +08:00
twosee
150504e6b1 Fixed bug #79821
HashTable was reallocated (zend_hash_packed_grow) during php_var_dump, so we should call GC_ADDREF to make SEPARATE_ARRAY work.

Closes GH-5837.
2020-07-11 06:14:22 +08:00
Nikita Popov
a72c53a070 Fixed bug #79817
Use *_IND macros in a few places in string.c.
2020-07-10 14:06:41 +02:00
Paweł Tomulik
23ef0a1285 Fix some memory bugs in ldap.c 2020-07-09 18:35:00 +02:00
XXiang
3d5de7d746 Fix bug #79787
Closes GH-5807.
2020-07-08 11:20:58 +02:00
Nikita Popov
e6160e99d8 Report len as -1 instead of INT_MAX
Per docs it should be -1. And would be on 32-bit systems, but
not on 64-bit systems.

(cherry picked from commit 39111585a2)
2020-07-08 10:38:11 +02:00
Christoph M. Becker
7f3bc64287 Fix #70362: Can't copy() large 'data://' with open_basedir
open_basedir is only relevant for plain files, so there is no need to
check it for other URL wrappers.
2020-06-30 10:46:53 +02:00
Christoph M. Becker
a385cfa7ad Fix #63208: BSTR to PHP string conversion not binary safe
A `BSTR` is similar to a `zend_string`; it stores the length of the
string just before the actual string, and thus the string may contain
NUL bytes.  However, `php_com_olestring_to_string()` is supposed to
deal with arbitrary `OLECHAR*`s which may not be `BSTR`s, so we
introduce `php_com_bstr_to_string()` and use it for the only case where
we actually have to deal with `BSTR`s which may contain NUL bytes.

Contrary to `php_com_olestring_to_string()` we return a `zend_string`,
so we can save the re-allocation when converting to a `zval`.

We also cater to `php_com_string_to_olestring()` not being binary safe,
with basically the same fix we did for `php_com_olestring_to_string()`.
2020-06-29 19:05:02 +02:00
Christoph M. Becker
816b4c1235 Fix #79756: finfo_file crash (FILEINFO_MIME)
If `ctime` or `asctime` return `NULL`, we must not attempt to copy the
buffer, but rather return `NULL` as well.
2020-06-29 17:45:28 +02:00
Nikita Popov
43cd3f6814 Fixed bug #79741 2020-06-26 12:28:39 +02:00
Christoph M. Becker
e94126aac7 Fix #55857: ftp_size on large files
`atol()` returns a `long` which is not the same as `zend_long` on
LLP64; we use `ZEND_ATOL()` instead.

There is no need for a new test case, since filesize_large.phpt already
tests for that behavior; unfortunately, the FTP test suite relies on
`pcntl_fork()` and therefore cannot be run on Windows.
2020-06-23 15:57:24 +02:00
Böszörményi Zoltán
6aff9a50ca Fixed bug #79570
Use the same logic for getgrgid_r, getpwnam_r and getpwuid_r
as for getgrnam_r in #75696

Closes GH-5740.
2020-06-19 17:31:28 +02:00
Nikita Popov
32f377b0b9 Fixed bug #79710
Make sure we don't use zresource after the stream has been destroyed.
2020-06-19 10:46:26 +02:00
Christoph M. Becker
5621c5faf8 Fix #79687: Sony picture - PHP Warning - Make, Model, MakerNotes
Even if the length of a maker note does not match our expectations
(either because the maker note is corrupted, or because our
expectations do not quite match reality), there is no need to let
parsing fail; we can still go on parsing the other meta information.
2020-06-13 18:30:57 +02:00
Christoph M. Becker
86e1f0ea11 Fix #79676: imagescale adds black border with IMG_BICUBIC
We have to loop over all image pixels to avoid the black border.  This
is also done in external libgd in `_gdScaleOneAxis` and `_gdScalePass`.
2020-06-12 14:05:54 +02:00
Christoph M. Becker
eadd980706 Fix #62890: default_socket_timeout=-1 causes connection to timeout
While unencrypted connections ignore negative timeouts, SSL/TLS
connections did not special case that, and so always failed due to
timeout.
2020-06-09 16:45:34 +02:00