Skip to content

Commit ea72fe6

Browse files
danogdanog
committed
Merge remote-tracking branch 'origin/PHP-8.4' into asan_zend_alloc
2 parents 58d53e7 + 6685414 commit ea72fe6

File tree

15 files changed

+126
-48
lines changed

15 files changed

+126
-48
lines changed

‎NEWS‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ PHP NEWS
1313
. Fixed GH-18695 (zend_ast_export() - float number is not preserved).
1414
(Oleg Efimov)
1515
. Fix handling of references in zval_try_get_long(). (nielsdos)
16+
. Do not delete main chunk in zend_gc. (danog, Arnaud)
17+
. Fix compile issues with zend_alloc and some non-default options. (nielsdos)
1618

1719
- Curl:
1820
. Fix memory leak when setting a list via curl_setopt fails. (nielsdos)
@@ -31,16 +33,33 @@ PHP NEWS
3133
. Fix memory leak in intl_datetime_decompose() on failure. (nielsdos)
3234
. Fix memory leak in locale lookup on failure. (nielsdos)
3335

36+
- Opcache:
37+
. Fixed bug GH-18743 (Incompatibility in Inline TLS Assembly on Alpine 3.22).
38+
(nielsdos, Arnaud)
39+
40+
- ODBC:
41+
. Fix memory leak on php_odbc_fetch_hash() failure. (nielsdos)
42+
3443
- OpenSSL:
3544
. Fix memory leak of X509_STORE in php_openssl_setup_verify() on failure.
3645
(nielsdos)
3746
. Fixed bug #74796 (Requests through http proxy set peer name).
3847
(Jakub Zelenka)
3948

49+
- PDO ODBC:
50+
. Fix memory leak if WideCharToMultiByte() fails. (nielsdos)
51+
52+
- PDO Sqlite:
53+
. Fixed memory leak with Pdo_Sqlite::createCollation when the callback
54+
has an incorrect return type. (David Carlier)
55+
4056
- Phar:
4157
. Add missing filter cleanups on phar failure. (nielsdos)
4258
. Fixed bug GH-18642 (Signed integer overflow in ext/phar fseek). (nielsdos)
4359

60+
- PHPDBG:
61+
. Fix 'phpdbg --help' segfault on shutdown with USE_ZEND_ALLOC=0. (nielsdos)
62+
4463
- PGSQL:
4564
. Fix warning not being emitted when failure to cancel a query with
4665
pg_cancel_query(). (Girgias)

‎Zend/tests/gh18756.phpt‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
--TEST--
2+
Bug GH-18756: Zend MM may delete the main chunk
3+
--EXTENSIONS--
4+
zend_test
5+
--FILE--
6+
<?php
7+
8+
zend_test_gh18756();
9+
10+
?>
11+
==DONE==
12+
--EXPECT--
13+
==DONE==

‎Zend/zend_alloc.c‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2505,7 +2505,9 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
25052505
/* Make sure the heap free below does not use tracked_free(). */
25062506
heap->custom_heap._free = __zend_free;
25072507
}
2508+
#if ZEND_MM_STAT
25082509
heap->size = 0;
2510+
#endif
25092511
}
25102512

25112513
void (*shutdown)(bool, bool) = heap->custom_heap._shutdown;
@@ -3183,6 +3185,7 @@ static zend_always_inline zval *tracked_get_size_zv(zend_mm_heap *heap, void *pt
31833185
}
31843186

31853187
static zend_always_inline void tracked_check_limit(zend_mm_heap *heap, size_t add_size) {
3188+
#if ZEND_MM_STAT
31863189
if (add_size > heap->limit - heap->size && !heap->overflow) {
31873190
#if ZEND_DEBUG
31883191
zend_mm_safe_error(heap,
@@ -3194,6 +3197,7 @@ static zend_always_inline void tracked_check_limit(zend_mm_heap *heap, size_t ad
31943197
heap->limit, add_size);
31953198
#endif
31963199
}
3200+
#endif
31973201
}
31983202

31993203
static void *tracked_malloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
@@ -3208,7 +3212,9 @@ static void *tracked_malloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC
32083212
}
32093213

32103214
tracked_add(heap, ptr, size);
3215+
#if ZEND_MM_STAT
32113216
heap->size += size;
3217+
#endif
32123218
ZEND_ASAN_POISON_MEMORY_REGION(heap, sizeof(zend_mm_heap));
32133219
return ptr;
32143220
}
@@ -3221,7 +3227,9 @@ static void tracked_free(void *ptr ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) {
32213227
zend_mm_heap *heap = AG(mm_heap);
32223228
ZEND_ASAN_UNPOISON_MEMORY_REGION(heap, sizeof(zend_mm_heap));
32233229
zval *size_zv = tracked_get_size_zv(heap, ptr);
3230+
#if ZEND_MM_STAT
32243231
heap->size -= Z_LVAL_P(size_zv);
3232+
#endif
32253233
zend_hash_del_bucket(heap->tracked_allocs, (Bucket *) size_zv);
32263234
ZEND_ASAN_POISON_MEMORY_REGION(heap, sizeof(zend_mm_heap));
32273235
free(ptr);
@@ -3248,7 +3256,9 @@ static void *tracked_realloc(void *ptr, size_t new_size ZEND_FILE_LINE_DC ZEND_F
32483256

32493257
ptr = __zend_realloc(ptr, new_size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
32503258
tracked_add(heap, ptr, new_size);
3259+
#if ZEND_MM_STAT
32513260
heap->size += new_size - old_size;
3261+
#endif
32523262
ZEND_ASAN_UNPOISON_MEMORY_REGION(heap, sizeof(zend_mm_heap));
32533263
return ptr;
32543264
}

‎ext/odbc/php_odbc.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1463,6 +1463,7 @@ static void php_odbc_fetch_hash(INTERNAL_FUNCTION_PARAMETERS, int result_type)
14631463
if (rc == SQL_ERROR) {
14641464
odbc_sql_error(result->conn_ptr, result->stmt, "SQLGetData");
14651465
efree(buf);
1466+
zval_ptr_dtor(return_value);
14661467
RETURN_FALSE;
14671468
}
14681469

‎ext/opcache/jit/zend_jit_ir.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3458,15 +3458,15 @@ static void zend_jit_setup(bool reattached)
34583458

34593459
__asm__(
34603460
"leaq _tsrm_ls_cache@tlsgd(%%rip), %0\n"
3461-
: "=a" (ti));
3461+
: "=D" (ti));
34623462
tsrm_tls_offset = ti[1];
34633463
tsrm_tls_index = ti[0] * 8;
34643464
#elif defined(__FreeBSD__)
34653465
size_t *ti;
34663466

34673467
__asm__(
34683468
"leaq _tsrm_ls_cache@tlsgd(%%rip), %0\n"
3469-
: "=a" (ti));
3469+
: "=D" (ti));
34703470
tsrm_tls_offset = ti[1];
34713471
/* Index is offset by 1 on FreeBSD (https://github.com/freebsd/freebsd-src/blob/bf56e8b9c8639ac4447d223b83cdc128107cc3cd/libexec/rtld-elf/rtld.c#L5260) */
34723472
tsrm_tls_index = (ti[0] + 1) * 8;
@@ -3475,7 +3475,7 @@ static void zend_jit_setup(bool reattached)
34753475

34763476
__asm__(
34773477
"leaq _tsrm_ls_cache@tlsgd(%%rip), %0\n"
3478-
: "=a" (ti));
3478+
: "=D" (ti));
34793479
tsrm_tls_offset = ti[1];
34803480
tsrm_tls_index = ti[0] * 16;
34813481
#endif

‎ext/pdo_odbc/odbc_stmt.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,7 @@ static int pdo_odbc_ucs22utf8(pdo_stmt_t *stmt, int is_unicode, zval *result)
104104
zend_string *str = zend_string_alloc(ret, 0);
105105
ret = WideCharToMultiByte(CP_UTF8, 0, (LPCWSTR) Z_STRVAL_P(result), Z_STRLEN_P(result)/sizeof(WCHAR), ZSTR_VAL(str), ZSTR_LEN(str), NULL, NULL);
106106
if (ret == 0) {
107+
zend_string_efree(str);
107108
return PDO_ODBC_CONV_FAIL;
108109
}
109110

‎ext/pdo_sqlite/pdo_sqlite.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -346,6 +346,9 @@ static int php_sqlite_collation_callback(void *context, int string1_len, const v
346346

347347
zend_call_known_fcc(&collation->callback, &retval, /* argc */ 2, zargs, /* named_params */ NULL);
348348

349+
zval_ptr_dtor(&zargs[0]);
350+
zval_ptr_dtor(&zargs[1]);
351+
349352
if (!Z_ISUNDEF(retval)) {
350353
if (Z_TYPE(retval) != IS_LONG) {
351354
zend_string *func_name = get_active_function_or_method_name();
@@ -362,9 +365,6 @@ static int php_sqlite_collation_callback(void *context, int string1_len, const v
362365
}
363366
}
364367

365-
zval_ptr_dtor(&zargs[0]);
366-
zval_ptr_dtor(&zargs[1]);
367-
368368
return ret;
369369
}
370370

‎ext/pdo_sqlite/tests/subclasses/pdo_sqlite_createcollation_wrong_callback.phpt‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
--TEST--
2+
Pdo\Sqlite::createCollation() memory leaks on wrong callback return type
3+
--EXTENSIONS--
4+
pdo_sqlite
5+
--FILE--
6+
<?php
7+
8+
declare(strict_types=1);
9+
10+
$db = new Pdo\Sqlite('sqlite::memory:');
11+
12+
$db->exec("CREATE TABLE test (c string)");
13+
$db->exec("INSERT INTO test VALUES('youwontseeme')");
14+
$db->exec("INSERT INTO test VALUES('neither')");
15+
$db->createCollation('NAT', function($a, $b): string { return $a . $b; });
16+
17+
try {
18+
$db->query("SELECT c FROM test ORDER BY c COLLATE NAT");
19+
} catch (\TypeError $e) {
20+
echo $e->getMessage(), PHP_EOL;
21+
}
22+
?>
23+
--EXPECT--
24+
PDO::query(): Return value of the callback must be of type int, string returned

‎ext/standard/tests/file/copy_variation2-win32-mb.phpt‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -22,24 +22,24 @@ fclose($file_handle);
2222
$dest_files = array(
2323

2424
/* File names containing special(non-alpha numeric) characters */
25-
"_copy_variation2.tmp",
26-
"@copy_variation2.tmp",
27-
"#copy_variation2.tmp",
28-
"+copy_variation2.tmp",
29-
"?copy_variation2.tmp",
30-
">copy_variation2.tmp",
31-
"!copy_variation2.tmp",
32-
"&copy_variation2.tmp",
33-
"(copy_variation2.tmp",
34-
":copy_variation2.tmp",
35-
";copy_variation2.tmp",
36-
"=copy_variation2.tmp",
37-
"[copy_variation2.tmp",
38-
"^copy_variation2.tmp",
39-
"{copy_variation2.tmp",
40-
"|copy_variation2.tmp",
41-
"~copy_variation2.tmp",
42-
"\$copy_variation2.tmp"
25+
"_copy_variation2_mb.tmp",
26+
"@copy_variation2_mb.tmp",
27+
"#copy_variation2_mb.tmp",
28+
"+copy_variation2_mb.tmp",
29+
"?copy_variation2_mb.tmp",
30+
">copy_variation2_mb.tmp",
31+
"!copy_variation2_mb.tmp",
32+
"&copy_variation2_mb.tmp",
33+
"(copy_variation2_mb.tmp",
34+
":copy_variation2_mb.tmp",
35+
";copy_variation2_mb.tmp",
36+
"=copy_variation2_mb.tmp",
37+
"[copy_variation2_mb.tmp",
38+
"^copy_variation2_mb.tmp",
39+
"{copy_variation2_mb.tmp",
40+
"|copy_variation2_mb.tmp",
41+
"~copy_variation2_mb.tmp",
42+
"\$copy_variation2_mb.tmp"
4343
);
4444

4545
echo "Size of the source file before copy operation => ";
@@ -90,28 +90,28 @@ Size of the source file before copy operation => int(1500)
9090
-- Iteration 1 --
9191
Copy operation => bool(true)
9292
Existence of destination file => bool(true)
93-
Destination file name => %s/_copy_variation2.tmp
93+
Destination file name => %s/_copy_variation2_mb.tmp
9494
Size of source file => int(1500)
9595
Size of destination file => int(1500)
9696

9797
-- Iteration 2 --
9898
Copy operation => bool(true)
9999
Existence of destination file => bool(true)
100-
Destination file name => %s/@copy_variation2.tmp
100+
Destination file name => %s/@copy_variation2_mb.tmp
101101
Size of source file => int(1500)
102102
Size of destination file => int(1500)
103103

104104
-- Iteration 3 --
105105
Copy operation => bool(true)
106106
Existence of destination file => bool(true)
107-
Destination file name => %s/#copy_variation2.tmp
107+
Destination file name => %s/#copy_variation2_mb.tmp
108108
Size of source file => int(1500)
109109
Size of destination file => int(1500)
110110

111111
-- Iteration 4 --
112112
Copy operation => bool(true)
113113
Existence of destination file => bool(true)
114-
Destination file name => %s/+copy_variation2.tmp
114+
Destination file name => %s/+copy_variation2_mb.tmp
115115
Size of source file => int(1500)
116116
Size of destination file => int(1500)
117117

@@ -130,21 +130,21 @@ Existence of destination file => bool(false)
130130
-- Iteration 7 --
131131
Copy operation => bool(true)
132132
Existence of destination file => bool(true)
133-
Destination file name => %s/!copy_variation2.tmp
133+
Destination file name => %s/!copy_variation2_mb.tmp
134134
Size of source file => int(1500)
135135
Size of destination file => int(1500)
136136

137137
-- Iteration 8 --
138138
Copy operation => bool(true)
139139
Existence of destination file => bool(true)
140-
Destination file name => %s/&copy_variation2.tmp
140+
Destination file name => %s/&copy_variation2_mb.tmp
141141
Size of source file => int(1500)
142142
Size of destination file => int(1500)
143143

144144
-- Iteration 9 --
145145
Copy operation => bool(true)
146146
Existence of destination file => bool(true)
147-
Destination file name => %s/(copy_variation2.tmp
147+
Destination file name => %s/(copy_variation2_mb.tmp
148148
Size of source file => int(1500)
149149
Size of destination file => int(1500)
150150

@@ -157,35 +157,35 @@ Existence of destination file => bool(false)
157157
-- Iteration 11 --
158158
Copy operation => bool(true)
159159
Existence of destination file => bool(true)
160-
Destination file name => %s/;copy_variation2.tmp
160+
Destination file name => %s/;copy_variation2_mb.tmp
161161
Size of source file => int(1500)
162162
Size of destination file => int(1500)
163163

164164
-- Iteration 12 --
165165
Copy operation => bool(true)
166166
Existence of destination file => bool(true)
167-
Destination file name => %s/=copy_variation2.tmp
167+
Destination file name => %s/=copy_variation2_mb.tmp
168168
Size of source file => int(1500)
169169
Size of destination file => int(1500)
170170

171171
-- Iteration 13 --
172172
Copy operation => bool(true)
173173
Existence of destination file => bool(true)
174-
Destination file name => %s/[copy_variation2.tmp
174+
Destination file name => %s/[copy_variation2_mb.tmp
175175
Size of source file => int(1500)
176176
Size of destination file => int(1500)
177177

178178
-- Iteration 14 --
179179
Copy operation => bool(true)
180180
Existence of destination file => bool(true)
181-
Destination file name => %s/^copy_variation2.tmp
181+
Destination file name => %s/^copy_variation2_mb.tmp
182182
Size of source file => int(1500)
183183
Size of destination file => int(1500)
184184

185185
-- Iteration 15 --
186186
Copy operation => bool(true)
187187
Existence of destination file => bool(true)
188-
Destination file name => %s/{copy_variation2.tmp
188+
Destination file name => %s/{copy_variation2_mb.tmp
189189
Size of source file => int(1500)
190190
Size of destination file => int(1500)
191191

@@ -198,14 +198,14 @@ Existence of destination file => bool(false)
198198
-- Iteration 17 --
199199
Copy operation => bool(true)
200200
Existence of destination file => bool(true)
201-
Destination file name => %s/~copy_variation2.tmp
201+
Destination file name => %s/~copy_variation2_mb.tmp
202202
Size of source file => int(1500)
203203
Size of destination file => int(1500)
204204

205205
-- Iteration 18 --
206206
Copy operation => bool(true)
207207
Existence of destination file => bool(true)
208-
Destination file name => %s/$copy_variation2.tmp
208+
Destination file name => %s/$copy_variation2_mb.tmp
209209
Size of source file => int(1500)
210210
Size of destination file => int(1500)
211211
*** Done ***

‎ext/zend_test/test.c‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1576,3 +1576,13 @@ static PHP_FUNCTION(zend_test_create_throwing_resource)
15761576
zend_resource *res = zend_register_resource(NULL, le_throwing_resource);
15771577
ZVAL_RES(return_value, res);
15781578
}
1579+
1580+
static PHP_FUNCTION(zend_test_gh18756)
1581+
{
1582+
ZEND_PARSE_PARAMETERS_NONE();
1583+
1584+
zend_mm_heap *heap = zend_mm_startup();
1585+
zend_mm_gc(heap);
1586+
zend_mm_gc(heap);
1587+
zend_mm_shutdown(heap, true, false);
1588+
}

0 commit comments

Comments
 (0)