Skip to content

Commit 6976fb6

Browse files
bukkabukka
committed
Merge branch 'PHP-8.3' into PHP-8.4
2 parents bb4174e + ef2c459 commit 6976fb6

26 files changed

+1303
-187
lines changed

‎NEWS‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,8 @@ PHP NEWS
6868
(DanielEScherzer)
6969
. Fixed bug GH-17866 (zend_mm_heap corrupted error after upgrading from
7070
8.4.3 to 8.4.4). (nielsdos)
71+
. Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown
72+
causes Use-After-Free). (CVE-2024-11235) (ilutov)
7173

7274
- DOM:
7375
. Fixed bug GH-17609 (Typo in error message: Dom\NO_DEFAULT_NS instead of
@@ -94,6 +96,11 @@ PHP NEWS
9496
. Fixed bug GH-17704 (ldap_search fails when $attributes contains a
9597
non-packed array with numerical keys). (nielsdos, 7u83)
9698

99+
- LibXML:
100+
. Fixed GHSA-wg4p-4hqh-c3g9 (Reocurrence of #72714). (nielsdos)
101+
. Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header
102+
when requesting a redirected resource). (CVE-2025-1219) (timwolla)
103+
97104
- MBString:
98105
. Fixed bug GH-17503 (Undefined float conversion in mb_convert_variables).
99106
(cmb)
@@ -135,9 +142,17 @@ PHP NEWS
135142
- Streams:
136143
. Fixed bug GH-17650 (realloc with size 0 in user_filters.c). (nielsdos)
137144
. Fix memory leak on overflow in _php_stream_scandir(). (nielsdos)
145+
. Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit
146+
basic auth header). (CVE-2025-1736) (Jakub Zelenka)
147+
. Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location
148+
to 1024 bytes). (CVE-2025-1861) (Jakub Zelenka)
149+
. Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers
150+
without colon). (CVE-2025-1734) (Jakub Zelenka)
151+
. Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not
152+
handle folded headers). (CVE-2025-1217) (Jakub Zelenka)
138153

139154
- Windows:
140-
. Fixed phpize for Windows 11 (24H2). (Bob)
155+
. Fixed phpize for Windows 11 (24H2). (bwoebi)
141156
. Fixed GH-17855 (CURL_STATICLIB flag set even if linked with shared lib).
142157
(cmb)
143158

‎Zend/tests/ghsa-rwp7-7vc6-8477_001.phpt‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
--TEST--
2+
GHSA-rwp7-7vc6-8477: Use-after-free for ??= due to incorrect live-range calculation
3+
--FILE--
4+
<?php
5+
6+
class Foo {
7+
public function foo() {
8+
return $this;
9+
}
10+
11+
public function __set($name, $value) {
12+
throw new Exception('Hello');
13+
}
14+
}
15+
16+
$foo = new Foo();
17+
18+
try {
19+
$foo->foo()->baz ??= 1;
20+
} catch (Exception $e) {
21+
echo $e->getMessage();
22+
}
23+
24+
?>
25+
--EXPECT--
26+
Hello

‎Zend/tests/ghsa-rwp7-7vc6-8477_002.phpt‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
--TEST--
2+
GHSA-rwp7-7vc6-8477: Use-after-free for ??= due to incorrect live-range calculation
3+
--FILE--
4+
<?php
5+
6+
class Foo {
7+
public int $prop;
8+
9+
public function foo() {
10+
return $this;
11+
}
12+
}
13+
14+
$foo = new Foo();
15+
16+
try {
17+
$foo->foo()->prop ??= 'foo';
18+
} catch (Error $e) {
19+
echo $e->getMessage();
20+
}
21+
22+
?>
23+
--EXPECT--
24+
Cannot assign string to property Foo::$prop of type int

‎Zend/tests/ghsa-rwp7-7vc6-8477_003.phpt‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
--TEST--
2+
GHSA-rwp7-7vc6-8477: Use-after-free for ??= due to incorrect live-range calculation
3+
--FILE--
4+
<?php
5+
6+
class Foo {
7+
public int $prop;
8+
}
9+
10+
function newFoo() {
11+
return new Foo();
12+
}
13+
14+
try {
15+
newFoo()->prop ??= 'foo';
16+
} catch (Error $e) {
17+
echo $e->getMessage();
18+
}
19+
20+
?>
21+
--EXPECT--
22+
Cannot assign string to property Foo::$prop of type int

‎Zend/zend_opcode.c‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -940,6 +940,14 @@ static void zend_calc_live_ranges(
940940
opnum--;
941941
opline--;
942942

943+
/* SEPARATE always redeclares its op1. For the purposes of live-ranges,
944+
* its declaration is irrelevant. Don't terminate the current live-range
945+
* to avoid breaking special handling of COPY_TMP. */
946+
if (opline->opcode == ZEND_SEPARATE) {
947+
ZEND_ASSERT(opline->op1.var == opline->result.var);
948+
continue;
949+
}
950+
943951
if ((opline->result_type & (IS_TMP_VAR|IS_VAR)) && !is_fake_def(opline)) {
944952
uint32_t var_num = EX_VAR_TO_NUM(opline->result.var) - var_offset;
945953
/* Defs without uses can occur for two reasons: Either because the result is

‎ext/dom/tests/ghsa-p3x9-6h7p-cgfc_001.phpt‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
--TEST--
2+
GHSA-p3x9-6h7p-cgfc: libxml streams use wrong `content-type` header when requesting a redirected resource (Basic)
3+
--EXTENSIONS--
4+
dom
5+
--SKIPIF--
6+
<?php
7+
if (@!include "./ext/standard/tests/http/server.inc") die('skip server.inc not available');
8+
http_server_skipif();
9+
?>
10+
--FILE--
11+
<?php
12+
require "./ext/standard/tests/http/server.inc";
13+
14+
function genResponses($server) {
15+
$uri = 'http://' . stream_socket_get_name($server, false);
16+
yield "data://text/plain,HTTP/1.1 302 Moved Temporarily\r\nLocation: $uri/document.xml\r\nContent-Type: text/html;charset=utf-16\r\n\r\n";
17+
$xml = <<<'EOT'
18+
<!doctype html>
19+
<html>
20+
<head>
21+
<title>GHSA-p3x9-6h7p-cgfc</title>
22+
23+
<meta charset="utf-8" />
24+
<meta http-equiv="Content-type" content="text/html; charset=utf-8" />
25+
</head>
26+
27+
<body>
28+
<h1>GHSA-p3x9-6h7p-cgfc</h1>
29+
</body>
30+
</html>
31+
EOT;
32+
// Intentionally using non-standard casing for content-type to verify it is matched not case sensitively.
33+
yield "data://text/plain,HTTP/1.1 200 OK\r\nconteNt-tyPe: text/html; charset=utf-8\r\n\r\n{$xml}";
34+
}
35+
36+
['pid' => $pid, 'uri' => $uri] = http_server('genResponses', $output);
37+
$document = new \DOMDocument();
38+
$document->loadHTMLFile($uri);
39+
40+
$h1 = $document->getElementsByTagName('h1');
41+
var_dump($h1->length);
42+
var_dump($document->saveHTML());
43+
http_server_kill($pid);
44+
?>
45+
--EXPECT--
46+
int(1)
47+
string(266) "<!DOCTYPE html>
48+
<html>
49+
<head>
50+
<title>GHSA-p3x9-6h7p-cgfc</title>
51+
52+
<meta charset="utf-8">
53+
<meta http-equiv="Content-type" content="text/html; charset=utf-8">
54+
</head>
55+
56+
<body>
57+
<h1>GHSA-p3x9-6h7p-cgfc</h1>
58+
</body>
59+
</html>
60+
"

‎ext/dom/tests/ghsa-p3x9-6h7p-cgfc_002.phpt‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
--TEST--
2+
GHSA-p3x9-6h7p-cgfc: libxml streams use wrong `content-type` header when requesting a redirected resource (Missing content-type)
3+
--EXTENSIONS--
4+
dom
5+
--SKIPIF--
6+
<?php
7+
if (@!include "./ext/standard/tests/http/server.inc") die('skip server.inc not available');
8+
http_server_skipif();
9+
?>
10+
--FILE--
11+
<?php
12+
require "./ext/standard/tests/http/server.inc";
13+
14+
function genResponses($server) {
15+
$uri = 'http://' . stream_socket_get_name($server, false);
16+
yield "data://text/plain,HTTP/1.1 302 Moved Temporarily\r\nLocation: $uri/document.xml\r\nContent-Type: text/html;charset=utf-16\r\n\r\n";
17+
$xml = <<<'EOT'
18+
<!doctype html>
19+
<html>
20+
<head>
21+
<title>GHSA-p3x9-6h7p-cgfc</title>
22+
23+
<meta charset="utf-8" />
24+
<meta http-equiv="Content-type" content="text/html; charset=utf-8" />
25+
</head>
26+
27+
<body>
28+
<h1>GHSA-p3x9-6h7p-cgfc</h1>
29+
</body>
30+
</html>
31+
EOT;
32+
// Missing content-type in actual response.
33+
yield "data://text/plain,HTTP/1.1 200 OK\r\n\r\n{$xml}";
34+
}
35+
36+
['pid' => $pid, 'uri' => $uri] = http_server('genResponses', $output);
37+
$document = new \DOMDocument();
38+
$document->loadHTMLFile($uri);
39+
40+
$h1 = $document->getElementsByTagName('h1');
41+
var_dump($h1->length);
42+
var_dump($document->saveHTML());
43+
http_server_kill($pid);
44+
?>
45+
--EXPECT--
46+
int(1)
47+
string(266) "<!DOCTYPE html>
48+
<html>
49+
<head>
50+
<title>GHSA-p3x9-6h7p-cgfc</title>
51+
52+
<meta charset="utf-8">
53+
<meta http-equiv="Content-type" content="text/html; charset=utf-8">
54+
</head>
55+
56+
<body>
57+
<h1>GHSA-p3x9-6h7p-cgfc</h1>
58+
</body>
59+
</html>
60+
"

‎ext/dom/tests/ghsa-p3x9-6h7p-cgfc_003.phpt‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
--TEST--
2+
GHSA-p3x9-6h7p-cgfc: libxml streams use wrong `content-type` header when requesting a redirected resource (Reason with colon)
3+
--EXTENSIONS--
4+
dom
5+
--SKIPIF--
6+
<?php
7+
if (@!include "./ext/standard/tests/http/server.inc") die('skip server.inc not available');
8+
http_server_skipif();
9+
?>
10+
--FILE--
11+
<?php
12+
require "./ext/standard/tests/http/server.inc";
13+
14+
function genResponses($server) {
15+
$uri = 'http://' . stream_socket_get_name($server, false);
16+
yield "data://text/plain,HTTP/1.1 302 Moved Temporarily\r\nLocation: $uri/document.xml\r\nContent-Type: text/html;charset=utf-16\r\n\r\n";
17+
$xml = <<<'EOT'
18+
<!doctype html>
19+
<html>
20+
<head>
21+
<title>GHSA-p3x9-6h7p-cgfc</title>
22+
23+
<meta charset="utf-8" />
24+
<meta http-equiv="Content-type" content="text/html; charset=utf-8" />
25+
</head>
26+
27+
<body>
28+
<h1>GHSA-p3x9-6h7p-cgfc</h1>
29+
</body>
30+
</html>
31+
EOT;
32+
// Missing content-type in actual response.
33+
yield "data://text/plain,HTTP/1.1 200 OK: This is fine\r\n\r\n{$xml}";
34+
}
35+
36+
['pid' => $pid, 'uri' => $uri] = http_server('genResponses', $output);
37+
$document = new \DOMDocument();
38+
$document->loadHTMLFile($uri);
39+
40+
$h1 = $document->getElementsByTagName('h1');
41+
var_dump($h1->length);
42+
var_dump($document->saveHTML());
43+
http_server_kill($pid);
44+
?>
45+
--EXPECT--
46+
int(1)
47+
string(266) "<!DOCTYPE html>
48+
<html>
49+
<head>
50+
<title>GHSA-p3x9-6h7p-cgfc</title>
51+
52+
<meta charset="utf-8">
53+
<meta http-equiv="Content-type" content="text/html; charset=utf-8">
54+
</head>
55+
56+
<body>
57+
<h1>GHSA-p3x9-6h7p-cgfc</h1>
58+
</body>
59+
</html>
60+
"

0 commit comments

Comments
 (0)