Merge remote-tracking branch 'php/master'

Author: danog

.github/actions/configure-macos/action.yml

@@ -18,6 +18,7 @@ runs:
         export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:$BREW_OPT/libxslt/lib/pkgconfig"
         export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:$BREW_OPT/zlib/lib/pkgconfig"
         export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:$BREW_OPT/icu4c/lib/pkgconfig"
+        sed -i -e 's/Requires.private:.*//g' "$BREW_OPT/curl/lib/pkgconfig/libcurl.pc"
         ./buildconf --force
         ./configure \
           --enable-option-checking=fatal \

NEWS

@@ -16,6 +16,9 @@ PHP                                                                        NEWS
   . Added Dom\Element::$outerHTML. (nielsdos)
   . Added Dom\Element::insertAdjacentHTML(). (nielsdos)
 
+- Intl:
+  . Bumped ICU requirement to ICU >= 57.1. (cmb)
+
 - Output:
   . Fixed calculation of aligned buffer size. (cmb)
 

UPGRADING

@@ -29,6 +29,9 @@ PHP 8.5 UPGRADE NOTES
   . It is no longer possible to use "array" and "callable" as class alias names
     in class_alias().
 
+- Intl:
+  . The extension now requires at least ICU 57.1.
+
 - LDAP:
   . ldap_get_option() and ldap_set_option() now throw a ValueError when
     passing an invalid option.

build/php.m4

@@ -1779,7 +1779,7 @@ dnl
 dnl Common setup macro for ICU.
 dnl
 AC_DEFUN([PHP_SETUP_ICU],[
-  PKG_CHECK_MODULES([ICU], [icu-uc >= 50.1 icu-io icu-i18n])
+  PKG_CHECK_MODULES([ICU], [icu-uc >= 57.1 icu-io icu-i18n])
 
   PHP_EVAL_INCLINE([$ICU_CFLAGS])
   PHP_EVAL_LIBLINE([$ICU_LIBS], [$1])

ext/curl/config.w32

@@ -3,24 +3,13 @@
 ARG_WITH("curl", "cURL support", "no");
 
 if (PHP_CURL != "no") {
-	var ver_num = NaN;
-	var f = PHP_PHP_BUILD + "/include/curl/curlver.h";
-	if (FSO.FileExists(f)) {
-		var reg = /LIBCURL_VERSION_NUM\s+(0x[a-z0-9]+)/gi;
-		var m = reg.exec(file_get_contents(PHP_PHP_BUILD + "/include/curl/curlver.h"));
-		if (!!m && m.length >= 2) {
-			ver_num = parseInt(m[1]);
-		}
-	}
-
 	if (CHECK_LIB("libcurl_a.lib;libcurl.lib", "curl", PHP_CURL) &&
 		CHECK_HEADER_ADD_INCLUDE("curl/easy.h", "CFLAGS_CURL") &&
 		SETUP_OPENSSL("curl", PHP_CURL) >= 2 &&
 		CHECK_LIB("winmm.lib", "curl", PHP_CURL) &&
 		CHECK_LIB("wldap32.lib", "curl", PHP_CURL) &&
 		(((PHP_ZLIB=="no") && (CHECK_LIB("zlib_a.lib;zlib.lib", "curl", PHP_CURL))) ||
 			(PHP_ZLIB_SHARED && CHECK_LIB("zlib.lib", "curl", PHP_CURL)) || (PHP_ZLIB == "yes" && (!PHP_ZLIB_SHARED))) &&
-		!isNaN(ver_num) &&
 		(CHECK_LIB("normaliz.lib", "curl", PHP_CURL) &&
 		 CHECK_LIB("libssh2.lib", "curl", PHP_CURL) &&
 		 CHECK_LIB("nghttp2.lib", "curl", PHP_CURL))

ext/dom/dom_iterators.c

@@ -177,7 +177,7 @@ static void php_dom_iterator_move_forward(zend_object_iterator *iter) /* {{{ */
 		if (objmap->nodetype != XML_ENTITY_NODE &&
 			objmap->nodetype != XML_NOTATION_NODE) {
 			if (objmap->nodetype == DOM_NODESET) {
-				HashTable *nodeht = HASH_OF(&objmap->baseobj_zv);
+				HashTable *nodeht = Z_ARRVAL_P(&objmap->baseobj_zv);
 				zval *entry;
 				zend_hash_move_forward_ex(nodeht, &iterator->pos);
 				if ((entry = zend_hash_get_current_data_ex(nodeht, &iterator->pos))) {
@@ -275,7 +275,7 @@ zend_object_iterator *php_dom_get_iterator(zend_class_entry *ce, zval *object, i
 		if (objmap->nodetype != XML_ENTITY_NODE &&
 			objmap->nodetype != XML_NOTATION_NODE) {
 			if (objmap->nodetype == DOM_NODESET) {
-				nodeht = HASH_OF(&objmap->baseobj_zv);
+				nodeht = Z_ARRVAL_P(&objmap->baseobj_zv);
 				zend_hash_internal_pointer_reset_ex(nodeht, &iterator->pos);
 				if ((entry = zend_hash_get_current_data_ex(nodeht, &iterator->pos))) {
 					ZVAL_COPY(&iterator->curobj, entry);

ext/dom/nodelist.c

@@ -72,7 +72,7 @@ zend_long php_dom_get_nodelist_length(dom_object *obj)
 	}
 
 	if (objmap->nodetype == DOM_NODESET) {
-		HashTable *nodeht = HASH_OF(&objmap->baseobj_zv);
+		HashTable *nodeht = Z_ARRVAL_P(&objmap->baseobj_zv);
 		return zend_hash_num_elements(nodeht);
 	}
 
@@ -145,7 +145,7 @@ void php_dom_nodelist_get_item_into_zval(dom_nnodemap_object *objmap, zend_long
 				itemnode = php_dom_libxml_hash_iter(objmap, index);
 			} else {
 				if (objmap->nodetype == DOM_NODESET) {
-					HashTable *nodeht = HASH_OF(&objmap->baseobj_zv);
+					HashTable *nodeht = Z_ARRVAL_P(&objmap->baseobj_zv);
 					zval *entry = zend_hash_index_find(nodeht, index);
 					if (entry) {
 						ZVAL_COPY(return_value, entry);

ext/gd/gd.c

@@ -1358,24 +1358,6 @@ PHP_FUNCTION(imagetypes)
 }
 /* }}} */
 
-/* {{{ _php_ctx_getmbi */
-
-static int _php_ctx_getmbi(gdIOCtx *ctx)
-{
-	int i, mbi = 0;
-
-	do {
-		i = (ctx->getC)(ctx);
-		if (i < 0) {
-			return -1;
-		}
-		mbi = (mbi << 7) | (i & 0x7f);
-	} while (i & 0x80);
-
-	return mbi;
-}
-/* }}} */
-
 /* {{{ _php_image_type
  * Based on ext/standard/image.c
  */
@@ -1413,15 +1395,8 @@ static int _php_image_type(zend_string *data)
 		}
 	}
 
-	gdIOCtx *io_ctx;
-	io_ctx = gdNewDynamicCtxEx(8, ZSTR_VAL(data), 0);
-	if (io_ctx) {
-		if (_php_ctx_getmbi(io_ctx) == 0 && _php_ctx_getmbi(io_ctx) >= 0) {
-			io_ctx->gd_free(io_ctx);
-			return PHP_GDIMG_TYPE_WBM;
-		} else {
-			io_ctx->gd_free(io_ctx);
-		}
+	if (ZSTR_VAL(data)[0] == 0) {
+		return PHP_GDIMG_TYPE_WBM;
 	}
 
 	return -1;

ext/gd/tests/gh16771.phpt

@@ -0,0 +1,10 @@
+--TEST--
+GH-16771 (UBSan abort in ext/gd/libgd/gd.c:1372)
+--EXTENSIONS--
+gd
+--FILE--
+<?php
+$string_mb = base64_decode('5pel5pys6Kqe44OG44Kt44K544OIMzTvvJXvvJbml6XmnKzoqp7jg4bjgq3jgrnjg4g=');
+imagecreatefromstring($string_mb);
+--EXPECTF--
+Warning: imagecreatefromstring(): Data is not in a recognized format in %s on line %d