Fix bug #81026 (PHP-FPM oob R/W in root process leading to priv escalation)

The main change is to store scoreboard procs directly to the variable sized
array rather than indirectly throu

Fix bug #81026 (PHP-FPM oob R/W in root process leading to priv escalation)

The main change is to store scoreboard procs directly to the variable sized
array rather than indirectly through the pointer.

Signed-off-by: Stanislav Malyshev <stas@php.net>

show more ...

Fix #81500: Interval serialization regression since 7.3.14 / 7.4.2

While it may not be desired, `DateInterval::$f` supports negative
values, at least with regard to calculations. We sti

Fix #81500: Interval serialization regression since 7.3.14 / 7.4.2

While it may not be desired, `DateInterval::$f` supports negative
values, at least with regard to calculations. We still need to guard
from assigning double values which are out of range for signed 64bit
integers (which would be undefined behavior). zend_dval_to_lval() does
this by returning `0` instead of triggering UB. This way we can avoid
setting the invalid marker, which doesn't work as expected anyway.

We must not do that only for unserialization, but also when the property
is set in the first place.

We need to adapt some of the existing tests wrt. this behavior. In
particular, we check for an arbitrary value in bug79015.phpt, to cater
to differences between 32bit and 64bit architectures.

Closes GH-7575.

show more ...

Fix #81518: Header injection via default_mimetype / default_charset

We forbid setting these INI options to values containing NUL bytes, CR
or LF.

Closes GH-7574.

Fix #81424: PCRE2 10.35 JIT performance regression

We backport the respective upstream fix[1] to our bundled pcre2lib plus
the follow-up fix[2] for a functional regression.

[1]

Fix #81424: PCRE2 10.35 JIT performance regression

We backport the respective upstream fix[1] to our bundled pcre2lib plus
the follow-up fix[2] for a functional regression.

[1] <https://github.com/PhilipHazel/pcre2/commit/dc5f96663597572f694147aeec3525003c351123>
[2] <https://github.com/PhilipHazel/pcre2/commit/e7af7efaa11f71b187b0432e9e60f18ba4d90a0c>

Closes GH-7573.

show more ...

Fixed bug #81494

Use the proper error reporting mechanism rather than throwing a
warning. This requires something of a hack because we don't have
direct access to the connection obje

Fixed bug #81494

Use the proper error reporting mechanism rather than throwing a
warning. This requires something of a hack because we don't have
direct access to the connection object at this point.

show more ...

Remove now superfluous tests due to changes in tzdata

Updated to version 2021.3 (2021c)

Fix failing PDO PgSQL test

This now prints an additional

> CONTEXT: unnamed portal parameter $1 = ''

on azure, presumably as a result of a version update or configuration

Fix failing PDO PgSQL test

This now prints an additional

> CONTEXT: unnamed portal parameter $1 = ''

on azure, presumably as a result of a version update or configuration
change. Strip this additional line from the error info, the same as
already done in one other place in the test.

show more ...

Bump config.guess/config.sub in all supported branches to support Apple Silicon

Bump config.guess/config.sub in all supported branches to support Apple Silicon

Fixed bug #54350

Don't allow calling fclose() on the stream while in the user
filter callback. This is basically the same protection as xp_ssl
streams use during callback invocations

Fixed bug #54350

Don't allow calling fclose() on the stream while in the user
filter callback. This is basically the same protection as xp_ssl
streams use during callback invocations.

There are more issues in this general area (e.g. stack overflow
on stream_filter_remove), but this addresses freeing the stream
during the filter callback invocation at least.

show more ...

Prepare branch for 7.4.26-dev

Add test for pg_put_line() and pg_end_copy()

Revert "Fix #81424: PCRE2 10.35 JIT performance regression"

This reverts commit a2471383fec332ae30827c7e3f4f9451420f1f0b.

Fixing the performance regression, apparently fixes a funct

Revert "Fix #81424: PCRE2 10.35 JIT performance regression"

This reverts commit a2471383fec332ae30827c7e3f4f9451420f1f0b.

Fixing the performance regression, apparently fixes a functional
regression[1], so we revert for now.

[1] <https://github.com/PhilipHazel/pcre2/issues/21>

Closes GH-7556.

show more ...

Disable failing FPM test

Test fails intermittently, e.g.:

https://dev.azure.com/phpazuredevops/PHP/_build/results?buildId=20597&view=ms.vss-test-web.build-test-results-tab&runId=475

Disable failing FPM test

Test fails intermittently, e.g.:

https://dev.azure.com/phpazuredevops/PHP/_build/results?buildId=20597&view=ms.vss-test-web.build-test-results-tab&runId=475324&resultId=115501&paneView=debug

Possibly this is because the two requests end up being processed
in sequence and no second process is spawned.

show more ...

Add the actual test for FPM prod idle timeout test with 6s sleep

Add FPM prod idle timeout test with 6s sleep

Fix #77978: Dirname ending in colon unzips to wrong dir

When making the relative path, we must not stop on a `:\` sequence in
the middle of the filename. This is only significant on Win

Fix #77978: Dirname ending in colon unzips to wrong dir

When making the relative path, we must not stop on a `:\` sequence in
the middle of the filename. This is only significant on Windows as it
may indicate an absolute filename, but this is already checked at the
beginning of the function.

Note that the bug and this patch affects all systems. However, on
Windows the file is no longer extracted at all, since Windows NTSF does
not allow filenames containing colons.

Closes GH-7528.

show more ...

Revert "Add FPM prod idle timeout test"

This reverts commit 08f52b1643d7a068e30c0abf5e1cad359f0eed06.

The newly added test fails.

[ci skip] Add missing NEWS

Add FPM prod idle timeout test

Fix #81490: ZipArchive::extractTo() may leak memory

We always need to free the CWD state.

Closes GH-7536.

Fix #81475: stream_isatty emits warning with attached stream wrapper

We must not issue warnings, if `show_err` is false.

Closes GH-7513.

Fix #80663: Recursive SplFixedArray::setSize() may cause double-free

We address the `::setSize(0)` case by setting `array->element = NULL`
and `array->size = 0` before we destroy the ele

Fix #80663: Recursive SplFixedArray::setSize() may cause double-free

We address the `::setSize(0)` case by setting `array->element = NULL`
and `array->size = 0` before we destroy the elements.

Co-authored-by: Tyson Andre <tyson.andre@uwaterloo.ca>

Closes GH-7503.

show more ...

Fix gdAlphaMax limit typo

Closes GH-7410.