Commit Graph

6124 Commits

Author SHA1 Message Date
Arnaud Le Blanc
d1048a0869
Add zend_random_bytes(), zend_random_bytes_insecure() functions (#14054)
Co-authored-by: Tim Düsterhus <tim@bastelstu.be>
2024-06-12 17:27:01 +02:00
Peter Kokot
5d3fab9334
Sync #if/ifdef/defined (#14520)
These are either undefined or defined (to value 1):
- __DragonFly__
- __FreeBSD__
- HAS_MCAST_EXT
- HAVE_GETCWD
- HAVE_GETWD
- HAVE_GLIBC_ICONV
- HAVE_JIT
- HAVE_LCHOWN
- HAVE_NL_LANGINFO
- HAVE_RL_CALLBACK_READ_CHAR
- HAVE_RL_ON_NEW_LINE
- HAVE_SQL_EXTENDED_FETCH
- HAVE_UTIME

Follow up of GH-5526 (-Wundef)
2024-06-11 22:47:05 +02:00
Ilija Tovilo
da7bc2ea04
Merge branch 'PHP-8.3'
* PHP-8.3:
  Set SG(rfc1867_uploaded_files) to null after destroy
2024-06-10 23:03:49 +02:00
Ilija Tovilo
ad470a974d
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Set SG(rfc1867_uploaded_files) to null after destroy
2024-06-10 23:03:37 +02:00
Kévin Dunglas
c47d357db5
Set SG(rfc1867_uploaded_files) to null after destroy
Closes GH-14499
2024-06-10 23:02:56 +02:00
Niels Dossche
bcecbb59d3
Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix GH-11078: PHP Fatal error triggers pointer being freed was not allocated and malloc: double free for ptr errors
2024-06-10 19:40:03 +02:00
Niels Dossche
ccdd1c4e67
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-11078: PHP Fatal error triggers pointer being freed was not allocated and malloc: double free for ptr errors
2024-06-10 19:39:25 +02:00
Niels Dossche
bc558bf7a3
Fix GH-11078: PHP Fatal error triggers pointer being freed was not allocated and malloc: double free for ptr errors
Although the issue was demonstrated using Curl, the issue is purely in
the streams layer of PHP.

Full analysis is written in GH-11078 [1], but here is the brief version:
Here's what actually happens:
1) We're creating a FILE handle from a stream using the casting mechanism.
   This will create a cookie-based FILE handle using funopen.
2) We're reading stream data using fread from the userspace stream. This will
   temporarily set a buffer into a field _bf.base [2]. This buffer is now equal
   to the upload buffer that Curl allocated and note that that buffer is owned
   by Curl.
3) The fatal error occurs and we bail out from the fread function, notice how
   the reset code is never executed and so the buffer will still point to
   Curl's upload buffer instead of FILE's own buffer [3].
4) The resources are destroyed, this includes our opened stream and because the
   FILE handle is cached, it gets destroyed as well.
   In fact, the stream code calls through fclose on purpose in this case.
5) The fclose code frees the _bs.base buffer [4].
   However, this is not the buffer that FILE owns but the one that Curl owns
   because it isn't reset properly due to the bailout!
6) The objects are getting destroyed, and so the curl free logic is invoked.
   When Curl tries to gracefully clean up, it tries to free the buffer.
   But that buffer is actually already freed mistakingly by the C library!

This also explains why we can't reproduce it on Linux: this bizarre buffer
swapping only happens on macOS and BSD, not on Linux.

To solve this, we switch to an unbuffered mode for cookie-based FILEs.
This avoids any stateful problems related to buffers especially when the
bailout mechanism triggers. As streams have their own buffering
mechanism, I don't expect this to impact performance.

[1] https://github.com/php/php-src/issues/11078#issuecomment-2155616843
[2] 5e566be7a7/stdio/FreeBSD/fread.c (L102-L103)
[3] 5e566be7a7/stdio/FreeBSD/fread.c (L117)
[4] 5e566be7a7/stdio/FreeBSD/fclose.c (L66-L67)

Closes GH-14524.
2024-06-10 19:38:21 +02:00
Arnaud Le Blanc
b4325d6113
Improve randomness of uploaded file names and files created by tempnam()
Closes GH-14364
2024-06-10 15:37:51 +02:00
Peter Kokot
84a0da1574
Sync #if/ifdef/defined (#14508)
This syncs CPP macro conditions:
- _WIN32
- _WIN64
- HAVE_ALLOCA_H
- HAVE_ALPHASORT
- HAVE_ARPA_INET_H
- HAVE_CONFIG_H
- HAVE_DIRENT_H
- HAVE_DLFCN_H
- HAVE_GETTIMEOFDAY
- HAVE_LIBDL
- HAVE_POLL_H
- HAVE_PWD_H
- HAVE_SCANDIR
- HAVE_SYS_FILE_H
- HAVE_SYS_PARAM_H
- HAVE_SYS_SOCKET_H
- HAVE_SYS_TIME_H
- HAVE_SYS_TYPES_H
- HAVE_SYS_WAIT_H
- HAVE_UNISTD_H
- PHP_WIN32
- ZEND_WIN32

These are either undefined or defined to 1 in Autotools and Windows.

Follow up of GH-5526 (-Wundef).
2024-06-09 14:23:41 +02:00
Peter Kokot
da86eec3db
Sync #if/ifdef/defined (#14371)
These are either undefined or defined to value 1 in Autotools and
Windows:
- HAVE_COMMONCRYPTO_COMMONRANDOM_H
- HAVE_EXIF
- HAVE_FOPENCOOKIE
- HAVE_IF_NAMETOINDEX
- HAVE_LIBICONV
- HAVE_SOCKETS
- HAVE_STRUCT_STAT_ST_RDEV
- HAVE_STRUCT_TM_TM_GMTOFF
- HAVE_STRUCT_TM_TM_ZONE

Follow up of GH-5526 (-Wundef)
2024-06-07 23:45:17 +02:00
Gina Peter Banyard
a580d4a1c3 main/php_ini.c: use size_t type instead of int
This does unnecessary conversions
2024-06-06 16:18:23 +01:00
Gina Peter Banyard
25a5146180
Clean-up unused headers (#14365)
* ext/mbstring.c: clean-up headers and include intrinsics
2024-06-01 17:12:42 +01:00
Gina Peter Banyard
48d5ae98e7
ext/standard: Refactor exec.c public APIs to use zend_string pointers (#14353)
* Pull zend_string* from INI directive

* Ensure that mail.force_extra_parameters INI directive does not have any nul bytes

* ext/standard: Make php_escape_shell_cmd() take a zend_string* instead of char*

This saves on an expensive strlen() computation

* Convert E_ERROR to ValueError in php_escape_shell_cmd()

* ext/standard: Make php_escape_shell_arg() take a zend_string* instead of char*

This saves on an expensive strlen() computation

* Convert E_ERROR to ValueError in php_escape_shell_arg()
2024-05-29 10:59:17 +01:00
Peter Kokot
cb2c5de3db
Add PHP_SBINDIR (#13363)
The PHP_SBINDIR symbol was defined on *nix systems but never used. This
adds the constant similar to PHP_BINDIR also to PHP. On Windows it is
the value of prefix configuration when PHP was built (same value as
PHP_BINDIR).
2024-05-29 07:04:05 +02:00
Peter Kokot
2d66562e4b
Sync HAVE_IPV6 and HAVE_GETADDRINFO in #if/ifdef/defined (#14341)
Follow up of GH-5526 (-Wundef)
2024-05-28 11:52:25 +02:00
Cristian Rodríguez
8e62e2b829
Mark multple functions as static (#13864)
* Mark many functions as static

Multiple functions are missing the static qualifier.

* remove unused struct sigactions

struct sigaction act, old_term, old_quit, old_int;
all unused.

* optimizer: minXOR and maxXOR are unused
2024-05-22 13:11:46 +02:00
Pierrick Charron
c69c84a5f6
PHP-8.2 is now for PHP 8.2.21-dev 2024-05-21 14:32:07 -04:00
Eric Mann
eb7a574a8d
PHP-8.3 is now for PHP 8.3.9-dev 2024-05-21 07:48:56 -07:00
Niels Dossche
ba534e70e6
Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix undefined behaviour in fastcgi.c (#14269)
2024-05-19 22:57:08 +02:00
Niels Dossche
6bb6ff2adb
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix undefined behaviour in fastcgi.c (#14269)
2024-05-19 22:55:02 +02:00
Niels Dossche
ad5138a341
Fix undefined behaviour in fastcgi.c (#14269)
Arithmetic on NULL pointers is undefined.
2024-05-19 22:54:06 +02:00
Peter Kokot
04c417a35e
Remove unused always-enabled extension headers (#14042)
These were once used in these files but at this point aren't and are
only causing confusion whether file depends on additional extension.

- locale.h is added in main/SAPI.c for _ENABLE_PER_THREAD_LOCALE
2024-05-04 21:06:29 +02:00
David Carlier
0a134e5d85
Merge branch 'PHP-8.3' 2024-05-01 14:00:03 +01:00
David Carlier
ff6e3b6f76
Merge branch 'PHP-8.2' into PHP-8.3 2024-05-01 13:59:10 +01:00
David Carlier
74843947f4
sapi/cgi: fix buffer limit on windows.
MSDN recommends dropping the deprecated `read` in favor of `_read`.
Also, the buffer size limit is INT_MAX.

Close GH-14022
2024-05-01 13:58:53 +01:00
Peter Kokot
d26617f760
Remove unused PARSE_SESSION and PARSE_REQUEST (#14081)
These were removed via 0904dd3dc2.
2024-04-30 16:39:00 +02:00
Jakub Zelenka
bab75e1f5c
PHP 8.3 is now for PHP-8.3.8-dev 2024-04-23 19:27:29 +01:00
Sergey Panteleev
3b5321dffe
PHP-8.2 is now for PHP 8.2.20-dev 2024-04-23 17:22:54 +03:00
Gina Peter Banyard
e0f24ab3e3
Revert php_output_stack_* signature change
This was unintentional and meant to be done in a follow-up PR
2024-04-19 13:44:21 +01:00
Gina Peter Banyard
2447cb25c6
main/output.c: Refine int return type to bool or zend_result (#13997) 2024-04-19 10:46:40 +01:00
Arnaud Le Blanc
46b6ad6dae
Inline GDB scripts in the PHP binary (#13600)
This inlines .gdbinit and php_gdb.py in the .debug_gdb_scripts section of the PHP binary so that GDB can auto-load them regardless of the current directory or the availability of the PHP source code (albeit some functionalities of php_gdb.py currently rely on the source being available).
2024-04-16 15:10:01 +02:00
Niels Dossche
584a7b8e78
Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix GH-13931: Applying zero offset to null pointer in Zend/zend_opcode.c
2024-04-15 19:40:08 +02:00
Niels Dossche
550e0ceb79
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-13931: Applying zero offset to null pointer in Zend/zend_opcode.c
2024-04-15 19:39:59 +02:00
Niels Dossche
c3acfb1b57
Fix GH-13931: Applying zero offset to null pointer in Zend/zend_opcode.c
In the test cases, the compiler bails out due to a fatal error.
The data structures used by the compiler will contain stale values.
In particular, for the test case CG(loop_var_stack) will contain data.
The next compilation will incorrectly use elements from the previous
stack.
To solve this, we reset part of the compiler data structures.
We don't do a full re-initialization via init_compiler() because that will
also reset streams and resources.

Closes GH-13938.
2024-04-15 19:39:05 +02:00
Jakub Zelenka
ce4c8ab412
Merge branch 'PHP-8.3' 2024-04-14 14:27:49 +01:00
Jakub Zelenka
4dad74f250
Merge branch 'PHP-8.2' into PHP-8.3 2024-04-14 14:27:05 +01:00
Damian Wójcik
8421cfda61
Fix file_get_contents() on Windows fails with "errno=22 Invalid argument"
Closes GH-13948
2024-04-14 14:26:10 +01:00
Eric Mann
67fc53e1be
PHP-8.3 is now for PHP 8.3.7-dev 2024-04-10 08:45:14 -07:00
Ben Ramsey
7ca4300db8
Merge branch 'PHP-8.3' 2024-04-09 23:55:11 -05:00
Ben Ramsey
3d9941fd1e
Merge branch 'PHP-8.2' into PHP-8.3 2024-04-09 23:49:53 -05:00
Ben Ramsey
a9ffc447a4
Merge branch 'PHP-8.1' into PHP-8.2 2024-04-09 23:49:31 -05:00
Niels Dossche
093c08af25
Fix GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
The check happened too early as later code paths may perform more
mangling rules. Move the check downwards right before adding the actual
variable.
2024-04-09 23:37:06 -05:00
Niels Dossche
ae5220aed6
Avoid call to php_socket_errno() if possible (#13909)
This call is only necessary if ret < 0.
Note that I also had to reoder the checks for EWOULDBLOCK, EMSGSIZE, EAGAIN
to avoid a false positive GCC warning about a duplicate condition
(EAGAIN == EWOULDBLOCK on my system).
2024-04-08 19:53:01 +02:00
Arnaud Le Blanc
345580c5e8 Merge branch 'PHP-8.3'
* PHP-8.3:
  [ci skip] NEWS
  [ci skip] NEWS
  Fix cookie_seek_function_t signature under musl (#13890)
2024-04-08 15:03:37 +02:00
Arnaud Le Blanc
618eb3d468 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [ci skip] NEWS
  Fix cookie_seek_function_t signature under musl (#13890)
2024-04-08 15:02:32 +02:00
Arnaud Le Blanc
577b8ae422
Fix cookie_seek_function_t signature under musl (#13890)
Fixes GH-11678
2024-04-08 14:58:12 +02:00
Niels Dossche
b9a2533cb3
Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix gcc-14 Wcalloc-transposed-args warnings
2024-04-01 20:34:44 +02:00
Niels Dossche
e34c86ce1a
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix gcc-14 Wcalloc-transposed-args warnings
2024-04-01 20:34:37 +02:00
Cristian Rodríguez
18d70db091
Fix gcc-14 Wcalloc-transposed-args warnings
gcc-14 and later warns of inverted arguments in calloc or
calloc-like __alloc_size__ annotated functions.

Closes GH-13818.
2024-04-01 20:34:14 +02:00