Commit Graph

1923 Commits

Author SHA1 Message Date
Ilija Tovilo
e3179a0955
Merge branch 'PHP-8.2'
* PHP-8.2:
  Fix GH-10168: heap-buffer-overflow at zval_undefined_cv
2023-02-08 01:21:28 +01:00
Ilija Tovilo
972a5a02bd
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-10168: heap-buffer-overflow at zval_undefined_cv
2023-02-08 01:12:03 +01:00
Niels Dossche
71ddede565
Fix GH-10168: heap-buffer-overflow at zval_undefined_cv
The problem is that we're using the variable_ptr in the opcode handler
*after* it has already been destroyed. The solution is to create a
specialised version of zend_assign_to_variable which takes in two
destination zval pointers.

Closes GH-10524
2023-02-08 01:06:50 +01:00
Ilija Tovilo
47ed1904ef
Fix use-after-free in write_property when object is released
Fixes GH-10169
Closes GH-10179
2023-02-02 20:03:50 +01:00
Ilija Tovilo
35a36b13e5
Fix comp-time and constant evaluation of dynamic class constant fetch
Fixes GH-10486
Fixes oss-fuzz #55436
Fixes oss-fuzz #55472
Closes GH-10487
2023-02-02 19:18:17 +01:00
Ilija Tovilo
02bd52b5a8
Implement dynamic class const fetch
https://wiki.php.net/rfc/dynamic_class_constant_fetch

Closes GH-9793
2023-01-26 16:46:34 +01:00
George Peter Banyard
3fe8b090d3
Merge branch 'PHP-8.2'
* PHP-8.2:
  Fix incorrect check in zend_internal_call_should_throw()
  Fix incorrect check in cs_8559_5 in map_from_unicode()
  Fix incorrect page_size check
2023-01-25 00:12:32 +00:00
Niels Dossche
972c74c300
Fix incorrect check in zend_internal_call_should_throw()
This debug code is part of arginfo validation. This validation will
never trigger properly because the OR operation makes the first if
always true. Fix it by changing to an AND.

Closes GH-10417

Signed-off-by: George Peter Banyard <girgias@php.net>
2023-01-25 00:12:13 +00:00
Máté Kocsis
7936c8085e
Fix GH-8329 Print true/false instead of bool in error and debug messages (#8385) 2023-01-23 10:52:14 +01:00
Niels Dossche
0801c567dc Fix GH-10248: Assertion `!(zval_get_type(&(*(property))) == 10)' failed.
The assertion failure was triggered in a debug code-path that validates
property types for internal classes.
zend_verify_internal_read_property_type was called with retval being a
reference, which is not allowed because that function eventually calls to
i_zend_check_property_type, which does not expect a reference.
The non-debug code-path already takes into account that retval can be a
reference, as it optionally dereferences retval.

Add a dereference in zend_verify_internal_read_property_type just before
the call to zend_verify_property_type, which is how other callers often
behave as well.
2023-01-20 16:40:15 +01:00
Christoph M. Becker
c8955c078a
Revert GH-10220
Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit ecc880f491.
This reverts commit 588a07f737.
This reverts commit f377e15751.
This reverts commit b4ba16fe18.
This reverts commit 694ec1deea.
This reverts commit 6b34de8eba.
This reverts commit aa1cd02a43.
This reverts commit 308fd311ea.
This reverts commit 16203b53e1.
This reverts commit 738fb5ca54.
This reverts commit 9fdbefacd3.
This reverts commit cd4a7c1d90.
This reverts commit 928685eba2.
This reverts commit 01e5ffc85c.
2023-01-16 12:27:33 +01:00
Arnaud Le Blanc
ba091ab3c7 Merge branch 'PHP-8.2'
* PHP-8.2:
  [ci skip] NEWS
  Reduce HT_MAX_SIZE to account for the max load factor of 0.5 (#10242)
  GC fiber unfinished executions (#9810)
2023-01-13 12:31:12 +01:00
Arnaud Le Blanc
d89408075f Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Reduce HT_MAX_SIZE to account for the max load factor of 0.5 (#10242)
  GC fiber unfinished executions (#9810)
2023-01-13 12:28:21 +01:00
Arnaud Le Blanc
4fb149390a
GC fiber unfinished executions (#9810) 2023-01-13 12:04:28 +01:00
Max Kellermann
ecc880f491 Zend/zend_execute: include cleanup 2023-01-10 14:19:03 +00:00
Max Kellermann
0caef56ed6 Zend/zend_execute: make several pointers const 2023-01-04 12:59:16 +00:00
Arnaud Le Blanc
a11c8a3039
Limit stack size (#9104) 2022-12-16 17:44:26 +01:00
Arnaud Le Blanc
02ed12240e Merge branch 'PHP-8.2'
* PHP-8.2:
  [ci skip] NEWS
  [ci skip] NEWS
  [ci skip] NEWS
  Fix generator memory leaks when interrupted during argument evaluation (#9756)
2022-11-04 16:06:42 +01:00
Arnaud Le Blanc
34a85fbea0 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  [ci skip] NEWS
  [ci skip] NEWS
  Fix generator memory leaks when interrupted during argument evaluation (#9756)
2022-11-04 16:02:04 +01:00
Arnaud Le Blanc
4011657719 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  [ci skip] NEWS
  Fix generator memory leaks when interrupted during argument evaluation (#9756)
2022-11-04 15:59:14 +01:00
Arnaud Le Blanc
5d1f3e047c
Fix generator memory leaks when interrupted during argument evaluation (#9756) 2022-11-04 15:55:55 +01:00
Bob Weinand
56d2c76249 Merge branch 'PHP-8.2' 2022-10-26 12:23:04 +02:00
Florian Sowade
b9474bf385 Don’t report arginfo violations on fake closures (#9823) 2022-10-26 12:21:41 +02:00
George Peter Banyard
7715e3a2c9 Merge branch 'PHP-8.2' 2022-09-13 11:14:08 +01:00
George Peter Banyard
5bfceae770 Only check classes in intersection type if the type might be valid
Closes GH-9522
2022-09-13 11:10:32 +01:00
George Peter Banyard
fbbada1f81 Merge branch 'PHP-8.2' 2022-09-10 11:41:25 +01:00
George Peter Banyard
c70a8281e3 Use DNF intersection type check also for simple intersection types 2022-09-10 11:39:22 +01:00
George Peter Banyard
9286101da4 Fix GH-9516: (A&B)|D as a param should allow AB or D. Not just A.
The issue was that we didn't compute enough cache slots for DNF types.
Nor progressed throught the CE's in the cache slot, meaning we were only checking if the value passed
satisfied the first type of the nested intersection type.
2022-09-10 11:34:32 +01:00
George Peter Banyard
80315edd58 Introduce PROGRESS_CACHE_SLOT() macro 2022-09-10 11:34:11 +01:00
Ilija Tovilo
4842edeae4
Improve magic __get and property type inconsistency error message
Fixes GH-9388
Closes GH-9436
2022-09-08 11:07:29 +02:00
Bob Weinand
dc5475c191 Save previous observer on the VM stack
This avoids a possible significant performance penalty, when some leaf function was observed, deep in the stack.
As a side effect, we are not iterating over prev_execute_data anymore and thus, non-observed fake frames, possibly on stack, cannot have any impact on the observer anymore (especially within zend_observer_fcall_end_all).

Saving the previous observer happens now directly on the VM stack. If there is any observer, function frames are allocated an extra zval (the last temporary), which will, on observed frames, contain the previous observed frame address.
2022-08-04 17:16:27 +02:00
Bob Weinand
625f164963 Include internal functions in the observer API
There are two main motivations to this:
a) The logic for handling internal and userland observation can be unified.
b) Unwinding of observed functions on a bailout does notably not include observers. Even if users of observers were to ensure such handling themselves, it would be impossible to retain the relative ordering - either the user has to unwind all internal observed frames before the automatic unwinding (zend_observer_fcall_end_all) or afterwards, but not properly interleaved.

Signed-off-by: Bob Weinand <bobwei9@hotmail.com>
2022-07-30 19:20:55 +02:00
Ilija Tovilo
7aadbcb8f4
GH-8344 Fetch properties of enums in const expressions 2022-07-18 23:52:28 +02:00
Rowan Tommins
af15923bc3
Extend deprecation notices to is_callable($foo) and callable $foo
Implements https://wiki.php.net/rfc/partially-supported-callables-expand-deprecation-notices
so that uses of "self" and "parent" in is_callable() and callable
type constraints now raise a deprecation notice, independent of the
one raised when and if the callable is actually invoked.

A new flag is added to the existing check_flags parameter of
zend_is_callable / zend_is_callable_ex, for use in internal calls
that would otherwise repeat the notice multiple times. In particular,
arguments to internal function calls are checked first based on
arginfo, and then again during ZPP, so the former suppresses the
deprecation notice.

Some existing tests which raised this deprecation have been updated
to avoid the syntax, but the existing version retained for maximum
regression coverage until it is made an error.

With thanks to Juliette Reinders Folmer for the RFC and initial
investigation.

Closes GH-8823.
2022-07-14 17:07:42 +02:00
George Peter Banyard
f905590764
Add support for Disjoint Normal Form (DNF) types (#8725)
RFC: https://wiki.php.net/rfc/dnf_types

This allows to combine union and intersection types together in the following form (A&B)|(X&Y)|T but not of the form (X|A)&(Y|B) or (X|A)&(Y|B)|T.

* Improve union type parsing

Co-authored-by: Sara Golemon <pollita@php.net>
2022-07-08 11:30:23 +01:00
Ilija Tovilo
40908b10fc
Merge branch 'PHP-8.1'
* PHP-8.1:
  Disallow assigning reference to  unset readonly property
2022-07-01 12:20:32 +02:00
Ilija Tovilo
110573726b
Disallow assigning reference to unset readonly property
Closes GH-7942
Closes GH-8188
2022-07-01 12:16:32 +02:00
Joe Rowell
89688b115d
Add function exposing HAVE_GCC_GLOBAL_REGS (#8359) 2022-06-08 12:32:30 +01:00
George Peter Banyard
b40ae80804
Convert iterable into an internal alias for Traversable|array (#7309)
This does a compile time transformation of ``iterable`` into ``Traversable|array`` which simplifies some of the LSP variance handling.

The arginfo generation script from stubs is updated to produce a union type when it encounters the type ``iterable``
Extension functions which do not regenerate the arginfo, or write them manually are still supported by mimicking the compile time transformation while registering the function.

Type Reflection is preserved for single ``iterable`` (and ``?iterable``) to produce a ReflectionNamedType with name ``iterable``, however usage of ``iterable`` in union types will be converted to ``array|Traversable``
2022-06-07 13:35:34 +01:00
Levi Morrison
280fd680c8
Make vm_interrupt and timed_out atomic (#8327)
This is done by adding a new zend_atomic_bool type. The type
definition is only available for compiler alignment and size info; it
should be treated as opaque and only the zend_atomic_bool_* family of
functions should be used.

Note that directly using atomic_bool is complicated. All C++ compilers
stdlibs that I checked typedef atomic_bool to std::atomic<bool>, which
can't be used in an extern "C" section, and there's at least one usage
of this in core, and probably more outside of it.

So, instead use platform specific functions, preferring compiler
intrinsics.
2022-06-01 09:43:25 -06:00
Max Kellermann
8620788c2a Zend/zend_execute: remove duplicate deinitialization code
This code duplication was introduced by commit 85f35a8fc1 ("Separate
unspecializeble code of INCLIDE_OR_EVAL into helper functions") for no
obvious reason.
2022-04-02 17:42:49 +02:00
Max Kellermann
b9e895bca0
Replace memcmp() with zend_string functions (#8216)
* ext/oci8: use zend_string_equals()

Eliminate duplicate code.

* main/php_variables: use zend_string_equals_literal()

Eliminate duplicate code.

* Zend/zend_string: add zend_string_equals_cstr()

Allows eliminating duplicate code.

* Zend, ext/{opcache,standard}, main/output: use zend_string_equals_cstr()

Eliminate duplicate code.

* Zend/zend_string: add zend_string_starts_with()

* ext/{opcache,phar,spl,standard}: use zend_string_starts_with()

This adds missing length checks to several callers, e.g. in
cache_script_in_shared_memory().  This is important when the
zend_string is shorter than the string parameter, when memcmp()
happens to check backwards; this can result in an out-of-bounds memory
access.
2022-03-31 16:27:58 +02:00
Dmitry Stogov
107997e58e Merge branch 'PHP-8.1'
* PHP-8.1:
  Prevent array modification if it's captured by user error handler during index conversion
2022-02-01 17:23:32 +03:00
Dmitry Stogov
718478377b Prevent array modification if it's captured by user error handler during
index conversion

Fixes oss-fuzz #44235
2022-02-01 17:22:18 +03:00
Dmitry Stogov
aab52968a3 micro-optimization 2021-12-23 18:31:45 +03:00
Dmitry Stogov
79fac32d6b Don't call zend_attach/detach_symbol_table() for op_arrays without local variables 2021-12-16 17:37:01 +03:00
Dmitry Stogov
623b3fc83f Merge branch 'PHP-8.1'
* PHP-8.1:
  Move common code into helper
2021-12-14 15:32:20 +03:00
Dmitry Stogov
b16fc350a4 Move common code into helper 2021-12-14 15:31:53 +03:00
Dmitry Stogov
1959bbfc1b Merge branch 'PHP-8.1'
* PHP-8.1:
  Combine ADDREF/DELREF
2021-12-13 22:54:57 +03:00
Dmitry Stogov
1e56b64759 Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Combine ADDREF/DELREF
2021-12-13 22:54:45 +03:00