Skip to content

Commit d49f243

Browse files
TimWollaTimWolla
committed
Merge branch 'master' into closure-in-cost-expr
2 parents 51bdab2 + 5882da2 commit d49f243

29 files changed

+358
-58
lines changed

‎Zend/tests/gh16799.phpt‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
--TEST--
2+
GH-16799 (Assertion failure at Zend/zend_vm_execute.h)
3+
--FILE--
4+
<?php
5+
set_error_handler(function($_, $m) { throw new Exception($m); });
6+
class Test {
7+
static function test() {
8+
call_user_func("static::ok");
9+
}
10+
static function ok() {
11+
}
12+
}
13+
Test::test();
14+
?>
15+
--EXPECTF--
16+
Fatal error: Uncaught Exception: Use of "static" in callables is deprecated in %s:%d
17+
Stack trace:
18+
#0 %s(%d): {closure:%s:%d}(8192, 'Use of "static"...', %s, %d)
19+
#1 %s(%d): Test::test()
20+
#2 {main}
21+
thrown in %s on line %d

‎Zend/zend_vm_def.h‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3918,6 +3918,16 @@ ZEND_VM_HANDLER(118, ZEND_INIT_USER_CALL, CONST, CONST|TMPVAR|CV, NUM)
39183918
function_name = GET_OP2_ZVAL_PTR(BP_VAR_R);
39193919
if (zend_is_callable_ex(function_name, NULL, 0, NULL, &fcc, &error)) {
39203920
ZEND_ASSERT(!error);
3921+
3922+
/* Deprecation can be emitted from zend_is_callable_ex(), which can
3923+
* invoke a user error handler and throw an exception.
3924+
* For the CONST and CV case we reuse the same exception block below
3925+
* to make sure we don't increase VM size too much. */
3926+
if (!(OP2_TYPE & (IS_TMP_VAR|IS_VAR)) && UNEXPECTED(EG(exception))) {
3927+
FREE_OP2();
3928+
HANDLE_EXCEPTION();
3929+
}
3930+
39213931
func = fcc.function_handler;
39223932
object_or_called_scope = fcc.called_scope;
39233933
if (func->common.fn_flags & ZEND_ACC_CLOSURE) {

‎Zend/zend_vm_execute.h‎

Lines changed: 30 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎ext/calendar/gregor.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,11 @@ void SdnToGregorian(
162162

163163
/* Calculate the year and day of year (1 <= dayOfYear <= 366). */
164164
temp = ((temp % DAYS_PER_400_YEARS) / 4) * 4 + 3;
165+
166+
if (century > ((INT_MAX / 100) - (temp / DAYS_PER_4_YEARS))) {
167+
goto fail;
168+
}
169+
165170
year = (century * 100) + (temp / DAYS_PER_4_YEARS);
166171
dayOfYear = (temp % DAYS_PER_4_YEARS) / 4 + 1;
167172

‎ext/calendar/tests/gh16834.phpt‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
--TEST--
2+
GH-16834 (cal_from_jd from julian_day argument)
3+
--EXTENSIONS--
4+
calendar
5+
--SKIPIF--
6+
<?php if (PHP_INT_SIZE != 8) die("skip for 64bit platforms only"); ?>
7+
--FILE--
8+
<?php
9+
var_dump(cal_from_jd(076545676543223, CAL_GREGORIAN));
10+
?>
11+
--EXPECTF--
12+
array(9) {
13+
["date"]=>
14+
string(5) "0/0/0"
15+
["month"]=>
16+
int(0)
17+
["day"]=>
18+
int(0)
19+
["year"]=>
20+
int(0)
21+
["dow"]=>
22+
int(%d)
23+
["abbrevdayname"]=>
24+
string(3) "%s"
25+
["dayname"]=>
26+
string(9) "%s"
27+
["abbrevmonth"]=>
28+
string(0) ""
29+
["monthname"]=>
30+
string(0) ""
31+
}

‎ext/curl/config.w32‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,13 @@
33
ARG_WITH("curl", "cURL support", "no");
44

55
if (PHP_CURL != "no") {
6-
var ver_num = NaN;
7-
var f = PHP_PHP_BUILD + "/include/curl/curlver.h";
8-
if (FSO.FileExists(f)) {
9-
var reg = /LIBCURL_VERSION_NUM\s+(0x[a-z0-9]+)/gi;
10-
var m = reg.exec(file_get_contents(PHP_PHP_BUILD + "/include/curl/curlver.h"));
11-
if (!!m && m.length >= 2) {
12-
ver_num = parseInt(m[1]);
13-
}
14-
}
15-
166
if (CHECK_LIB("libcurl_a.lib;libcurl.lib", "curl", PHP_CURL) &&
177
CHECK_HEADER_ADD_INCLUDE("curl/easy.h", "CFLAGS_CURL") &&
188
SETUP_OPENSSL("curl", PHP_CURL) >= 2 &&
199
CHECK_LIB("winmm.lib", "curl", PHP_CURL) &&
2010
CHECK_LIB("wldap32.lib", "curl", PHP_CURL) &&
2111
(((PHP_ZLIB=="no") && (CHECK_LIB("zlib_a.lib;zlib.lib", "curl", PHP_CURL))) ||
2212
(PHP_ZLIB_SHARED && CHECK_LIB("zlib.lib", "curl", PHP_CURL)) || (PHP_ZLIB == "yes" && (!PHP_ZLIB_SHARED))) &&
23-
!isNaN(ver_num) &&
2413
(CHECK_LIB("normaliz.lib", "curl", PHP_CURL) &&
2514
CHECK_LIB("libssh2.lib", "curl", PHP_CURL) &&
2615
CHECK_LIB("nghttp2.lib", "curl", PHP_CURL))

‎ext/curl/interface.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1936,7 +1936,10 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue
19361936
zend_string *str = zval_get_tmp_string(zvalue, &tmp_str);
19371937
#if LIBCURL_VERSION_NUM >= 0x075500 /* Available since 7.85.0 */
19381938
if ((option == CURLOPT_PROTOCOLS_STR || option == CURLOPT_REDIR_PROTOCOLS_STR) &&
1939-
(PG(open_basedir) && *PG(open_basedir)) && php_memnistr(ZSTR_VAL(str), "file", sizeof("file") - 1, ZSTR_VAL(str) + ZSTR_LEN(str)) != NULL) {
1939+
(PG(open_basedir) && *PG(open_basedir))
1940+
&& (php_memnistr(ZSTR_VAL(str), "file", sizeof("file") - 1, ZSTR_VAL(str) + ZSTR_LEN(str)) != NULL
1941+
|| php_memnistr(ZSTR_VAL(str), "all", sizeof("all") - 1, ZSTR_VAL(str) + ZSTR_LEN(str)) != NULL)) {
1942+
zend_tmp_string_release(tmp_str);
19401943
php_error_docref(NULL, E_WARNING, "The FILE protocol cannot be activated when an open_basedir is set");
19411944
return FAILURE;
19421945
}

‎ext/curl/tests/gh16802.phpt‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
--TEST--
2+
GH-16802 (open_basedir bypass using curl extension)
3+
--EXTENSIONS--
4+
curl
5+
--SKIPIF--
6+
<?php
7+
$curl_version = curl_version();
8+
if ($curl_version['version_number'] < 0x075500) {
9+
die("skip: blob options not supported for curl < 7.85.0");
10+
}
11+
?>
12+
--INI--
13+
open_basedir=/nowhere
14+
--FILE--
15+
<?php
16+
$ch = curl_init("file:///etc/passwd");
17+
curl_setopt($ch, CURLOPT_PROTOCOLS_STR, "all");
18+
curl_setopt($ch, CURLOPT_PROTOCOLS_STR, "ftp,all");
19+
curl_setopt($ch, CURLOPT_PROTOCOLS_STR, "all,ftp");
20+
curl_setopt($ch, CURLOPT_PROTOCOLS_STR, "all,file,ftp");
21+
var_dump(curl_exec($ch));
22+
?>
23+
--EXPECTF--
24+
Warning: curl_setopt(): The FILE protocol cannot be activated when an open_basedir is set in %s on line %d
25+
26+
Warning: curl_setopt(): The FILE protocol cannot be activated when an open_basedir is set in %s on line %d
27+
28+
Warning: curl_setopt(): The FILE protocol cannot be activated when an open_basedir is set in %s on line %d
29+
30+
Warning: curl_setopt(): The FILE protocol cannot be activated when an open_basedir is set in %s on line %d
31+
bool(false)

‎ext/dom/node.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -906,6 +906,7 @@ static void dom_node_insert_before_legacy(zval *return_value, zval *ref, dom_obj
906906
}
907907

908908
if (child->doc == NULL && parentp->doc != NULL) {
909+
xmlSetTreeDoc(child, parentp->doc);
909910
dom_set_document_ref_pointers(child, intern->document);
910911
}
911912

@@ -1212,6 +1213,7 @@ static void dom_node_replace_child(INTERNAL_FUNCTION_PARAMETERS, bool modern)
12121213
}
12131214

12141215
if (newchild->doc == NULL && nodep->doc != NULL) {
1216+
xmlSetTreeDoc(newchild, nodep->doc);
12151217
dom_set_document_ref_pointers(newchild, intern->document);
12161218
}
12171219

@@ -1320,6 +1322,7 @@ static void dom_node_append_child_legacy(zval *return_value, dom_object *intern,
13201322
}
13211323

13221324
if (child->doc == NULL && nodep->doc != NULL) {
1325+
xmlSetTreeDoc(child, nodep->doc);
13231326
dom_set_document_ref_pointers(child, intern->document);
13241327
}
13251328

@@ -2412,7 +2415,7 @@ PHP_METHOD(DOMNode, getRootNode)
24122415
}
24132416
/* }}} */
24142417

2415-
/* {{{ URL: https://dom.spec.whatwg.org/#dom-node-comparedocumentposition (last check date 2023-07-24)
2418+
/* {{{ URL: https://dom.spec.whatwg.org/#dom-node-comparedocumentposition (last check date 2024-11-17)
24162419
Since:
24172420
*/
24182421

‎ext/dom/tests/gh16777_1.phpt‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
--TEST--
2+
GH-16777 (Calling the constructor again on a DOM object after it is in a document causes UAF)
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
$text = new DOMText('my value');
8+
$doc = new DOMDocument();
9+
$doc->appendChild($text);
10+
$text->__construct('my new value');
11+
$doc->appendChild($text);
12+
echo $doc->saveXML();
13+
$dom2 = new DOMDocument();
14+
try {
15+
$dom2->appendChild($text);
16+
} catch (DOMException $e) {
17+
echo $e->getMessage(), "\n";
18+
}
19+
?>
20+
--EXPECT--
21+
<?xml version="1.0"?>
22+
my value
23+
my new value
24+
Wrong Document Error

0 commit comments

Comments
 (0)