summaryrefslogtreecommitdiff
path: root/ext
Commit message (Collapse)AuthorAgeFilesLines
* Fix # 79171: heap-buffer-overflow in phar_extract_filephp-7.3.15PHP-7.3.15Christoph M. Becker2020-02-181-1/+1
| | | | | | We must not access memory outside of the allocated buffer. (cherry picked from commit 7df594b9437aa4f127581e4c88da99e7c41a9b14)
* Fix bug #79221 - Null Pointer Dereference in PHP Session Upload ProgressStanislav Malyshev2020-02-182-4/+51
| | | | (cherry picked from commit 409965fe1cfa013abd377a5b567e2d19aac163e8)
* Fix bug #79082 - Files added to tar with Phar::buildFromIterator have ↵Stanislav Malyshev2020-02-184-0/+65
| | | | | | all-access permissions (cherry picked from commit 6facfa59a5273a7084fabe13f215bb17215218c4)
* Fix #78090: bug45161.phpt takes forever to finishChristoph M. Becker2020-02-042-12/+10
| | | | | | Not all systems support the discard protocol (TCP port 9), and since there is no particular reason to use it, we switch to using actual server testing.
* Fix #79191: Error in SoapClient ctor disables DOMDocument::save()Christoph M. Becker2020-02-035-21/+73
| | | | | | | | | | | | | | The culprit is the too restrictive fix for bug #71536, which prevents `php_libxml_streams_IO_write()` from properly executing when unclean shutdown is flagged. A *more* suitable solution is to move the `xmlwriter_free_resource_ptr()` call from the `free_obj` handler to an added `dtor_obj` handler, to avoid to write to a closed stream in case of late object freeing. This makes the `EG(active)` guard superfluous. We also fix bug79029.phpt which has to use different variables for the three parts to actually check the original shutdown issue. Thanks to bwoebi and daverandom for helping to investigate this issue.
* Relax test expectationChristoph M. Becker2020-02-031-2/+2
| | | | | | | Since we're dealing with floating point numbers, precision issues may hit us, and actually it's not necessary to check for the exact number anyway, because it is not exact in the first place. Therefore, we relax the test expectations.
* Fix #79212: NumberFormatter::format() may detect wrong typeChristoph M. Becker2020-02-032-15/+33
| | | | | | | | | | | We have to convert to number *before* detecting the type, to cater to internal objects implementing `cast_object`. We also get rid of the fallback behavior of using `FORMAT_TYPE_INT32`, because that can no longer happen; after `convert_scalar_to_number_ex` the type is either `IS_LONG` or `IS_DOUBLE`. We cater explicitly to the `IS_ARRAY` case what also avoids triggering a type confusion when `::TYPE_INT64` is passed as `$type`.
* Fix #70078: XSL callbacks with nodes as parameter leak memoryChristoph M. Becker2020-01-302-1/+52
| | | | | | | | | The fix for bug #49634 solved a double-free by copying the node with `xmlDocCopyNodeList()`, but the copied node is later freed by calling `xmlFreeNode()` instead of `xmlFreeNodeList()`, thus leaking memory. However, there is no need to treat the node as node list, i.e. to copy also the node's siblings; just creating a recursive copy of the node with `xmlDocCopyNode()` is sufficient, while that also avoids the leak.
* Fix leak in DateTimeImmutable::modify()Nikita Popov2020-01-302-0/+13
|
* Add SKIPIF to test requiring mbregexNikita Popov2020-01-301-0/+2
|
* Fix mb_ord() crash if internal encoding not supportedNikita Popov2020-01-292-4/+9
| | | | | enc_name can be NULL here. Take the name from the mbfl_encoding instead.
* Reset MBREX(search_re) in RSHUTDOWNNikita Popov2020-01-291-0/+1
| | | | | | | | | | | | | | This is going to cause a segfault if reused in the next request. To illustrate the issue, run these two scripts in sequence with the built-in server: // script1.php mb_ereg_search_init('foobar'); mb_ereg_search('foo'); // script2.php var_dump(mb_ereg_search_init("foobar")); var_dump(mb_ereg_search_pos());
* Fix use of mb_ereg_search_getregs() after invalid patternNikita Popov2020-01-292-3/+22
| | | | | This segfaulted because we assumed that if there are matches, there must be a regular expression as well.
* Fix #76584: PharFileInfo::decompress not workingChristoph M. Becker2020-01-282-5/+53
| | | | We actually have to decompress, when told to do so.
* Fix bug #78323: Code 0 is returned on invalid optionsIvan Mikheykin2020-01-271-1/+1
| | | | | Set CLI exit code to 1 when invalid parameters are passed, and print error to stderr.
* Add CURLOPT CURLOPT_HTTP09_ALLOWED available since 7.64.0Florian Smeets2020-01-261-0/+7
|
* Make test independent of online XSD schemaChristoph M. Becker2020-01-242-1/+642
| | | | | | The test still needs to access <http://www.w3.org/2009/01/xml.xsd>, but at least we no longer depend on <http://x-road.eu/xsd/x-road.xsd>, which may be moved again.
* Yet another check for php_strip_tags_ex()Christoph M. Becker2020-01-241-1/+1
|
* Fix bug76348.phptNikita Popov2020-01-232-4/+5
| | | | | | | | Adjust for URL change in XSD file and mark as online test. Is it possible for use to store http://x-road.eu/xsd/xroad.xsd locally instead? Do relative file system paths work here? I'm not familiar with this.
* Fixed bug #78902liudaixiao2020-01-231-2/+0
|
* Add unit test for bug #78902Léopold Jacquot2020-01-231-0/+30
|
* Fixed bug #79151Nikita Popov2020-01-232-0/+29
| | | | | | Make sure we also NULL out next/prev of the removed element on pop/shift. This only matter is that element is still being referenced by an iterator.
* Merge branch 'PHP-7.2' into PHP-7.3Stanislav Malyshev2020-01-221-1/+1
|\ | | | | | | | | * PHP-7.2: More checks for php_strip_tags_ex
| * More checks for php_strip_tags_exStanislav Malyshev2020-01-221-2/+2
| |
* | Don't leak encoding_strChristoph M. Becker2020-01-221-0/+1
| |
* | Fix #79154: mb_convert_encoding() can modify $from_encodingChristoph M. Becker2020-01-222-5/+38
| | | | | | | | We must not modify arrays passed by value.
* | Fix #79145: openssl memory leakChristoph M. Becker2020-01-212-2/+26
| | | | | | | | | | | | We must increase the refcount of `return_value` only if `cert` is a resource; this is already done in `php_openssl_evp_from_zval()`, though.
* | Merge branch 'PHP-7.2' into PHP-7.3Stanislav Malyshev2020-01-206-5/+115
|\ \ | |/ | | | | | | | | | | | | * PHP-7.2: Update NEWS Fix bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`) Fix #79099: OOB read in php_strip_tags_ex Fix #79091: heap use-after-free in session_create_id()
| * Fix bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`)Stanislav Malyshev2020-01-202-5/+22
| |
| * Fix #79099: OOB read in php_strip_tags_exStanislav Malyshev2020-01-202-3/+35
| |
| * Fix #79091: heap use-after-free in session_create_id()Christoph M. Becker2020-01-202-0/+68
| | | | | | | | If the `new_id` is released, we must not use it again.
* | Fixed bug #79115Nikita Popov2020-01-172-0/+18
| |
* | Fix #79084: mysqlnd may fetch wrong column indexes with MYSQLI_BOTHChristoph M. Becker2020-01-133-6/+149
| | | | | | | | | | | | Column names can be numeric strings, so we have to make sure to insert the column values with the appropriate numeric keys, instead of adding them.
* | Fix test cases which fail on Windows debug buildsChristoph M. Becker2020-01-103-2/+4
| | | | | | | | | | | | | | | | We use the portable {TMP} instead of the hard-coded /tmp, and skip mysqli_debug_append.phpt on Windows, because unlinking the trace file while the connection is still open won't work there. (cherry picked from commit 60081ca20d5701111de5f94ae64909b1cc265f1e)
* | Fix test for Windows ZTS buildsChristoph M. Becker2020-01-111-0/+2
| | | | | | | | Cf. <https://bugs.php.net/bug.php?id=61685#1578672905>.
* | Fix #79078: Hypothetical use-after-free in curl_multi_add_handle()Christoph M. Becker2020-01-082-9/+11
| | | | | | | | | | To avoid this, we have to verify the handlers already in `curl_multi_add_handle()`, not only in `curl_multi_exec()`.
* | Revert "Extend CURLFile to support streams"Christoph M. Becker2020-01-065-146/+1
| | | | | | | | | | | | This reverts commit 17a9f1401aeb35fe1e3657b38102a410d151d42f, because this commit would break ABI, and also due to bug #79013. We keep the commit for PHP 7.4+, though.
* | Fix #54298: Using empty additional_headers adding extraneous CRLFChristoph M. Becker2020-01-062-1/+25
| | | | | | | | | | If the header string is empty, we pass `NULL` to `php_mail()` to avoid further checks on the string length.
* | Fix #79068: gdTransformAffineCopy() changes interpolation methodChristoph M. Becker2020-01-063-1/+22
| | | | | | | | | | We port <https://github.com/libgd/libgd/commit/9088591eae437358ee5b929adf82865e37e3001e>.
* | Fix #79067: gdTransformAffineCopy() may use unitialized valuesChristoph M. Becker2020-01-063-3/+20
| | | | | | | | | | We port <https://github.com/libgd/libgd/commit/7a06c1669c563917bc48c464521e3de962ddb4e8>.
* | Fix #78808: [LMDB] MDB_MAP_FULL: Environment mapsize limit reachedChristoph M. Becker2020-01-032-0/+41
| | | | | | | | | | | | | | We implement support for a fifth parameter, which allows to specify the mapsize. The parameter defaults to zero, in which case the compiled in default mapsize (usually 1048576) will be used. The mapsize should be a multiple of the page size of the OS.
* | Fix #79015: undefined-behavior in php_date.cChristoph M. Becker2020-01-032-5/+49
| | | | | | | | | | | | We check that the given microsecond fraction is in the valid range [0, 1000000[, and otherwise mark it as invalid. We also drop the useless do loop; a plain block is sufficient here.
* | Fix #79040: Warning Opcode handlers are unusable due to ASLRChristoph M. Becker2019-12-301-4/+5
| | | | | | | | | | | | | | We must not use the same shared memory OPcache instance for different SAPIs, since their memory layout is different. To avoid this, we add the SAPI name (truncated to at most 20 characters) to the names of the memory base file, the mutex and the file mapping.
* | Add missing skipif clauseChristoph M. Becker2019-12-281-0/+1
| |
* | Fix #79033: Curl timeout error with specific url and postChristoph M. Becker2019-12-282-4/+35
| | | | | | | | | | | | We must not set an empty mime structure as `CURLOPT_MIMEPOST`; instead we set it to `NULL` if `CURLOPT_POSTFIELDS` has been set to an empty array.
* | Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter).Xinchen Hui2019-12-253-7/+47
| | | | | | | | | | | | | | | | We backport the fix PHP 7.3, since this branch is affected as well. (cherry picked from commit b5e004379647bd1ebb75eb2eac8826fb6abdd3d8) (cherry picked from commit e36daa6927c05d2e687bb77495ef206cde118b33) (cherry picked from commit 2704ee6844c03348de9d15e74646d09007ef0f7c)
* | Fix #78982: pdo_pgsql returns dead persistent connectionSATO Kentaro2019-12-201-1/+1
| | | | | | | | Call PQconsumeInput() before PQstatus() to update the status.
* | Fix #78980: pgsqlGetNotify() overlooks dead connectionSATO Kentaro2019-12-201-2/+10
| | | | | | | | pgsqlGetNotify() didn't check result of PQconsumeInput().
* | Fix #74170: locale information change after mime_content_typeSergei Turchanov2019-12-204-16/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Some functions in libmagic (distributed with fileinfo extension) perform this sequence of calls: func() { setlocale(LC_TYPE, "C") .. do some work .. setlocale(LC_TYPE, "") } It effectively resets LC_TYPE if it that was set before the function call. To avoid manipulations with current locale at all, the problematic functions were modified to use locale-independent functions.
* | Fix #78402: pcntl_signal() misleading error messageSATO Kentaro2019-12-202-3/+6
| | | | | | | | | | An error message can be misleading when a handler passed to pcntl_signal() is not callable.
View Lorry Controller Status