sqlite3 linkage issue on some systems/package combination fix.

Checking the version is not enough, the function might be available
but the symbols are not present still.

Closes

sqlite3 linkage issue on some systems/package combination fix.

Checking the version is not enough, the function might be available
but the symbols are not present still.

Closes GH-5993

show more ...

sqlite3: Fix possible use after free

Exception should be thrown before the db handle is destroyed.
The backtrace excerpt

==26628== Invalid read of size 4
==26628== at 0x5

sqlite3: Fix possible use after free

Exception should be thrown before the db handle is destroyed.
The backtrace excerpt

==26628== Invalid read of size 4
==26628== at 0x53C49E3: sqlite3_errmsg (in /usr/lib64/libsqlite3.so.0.8.6)
==26628== by 0x38C4E9: zim_sqlite3_open (sqlite3.c:142)
==26628== by 0x8977BF: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1618)
==26628== by 0x8F801E: execute_ex (zend_vm_execute.h:53824)
==26628== by 0x8FC0BB: zend_execute (zend_vm_execute.h:57920)
==26628== by 0x828F54: zend_execute_scripts (zend.c:1672)
==26628== by 0x793C2C: php_execute_script (main.c:2621)
==26628== by 0x8FEA44: do_cli (php_cli.c:964)
==26628== by 0x8FF9DC: main (php_cli.c:1359)

Signed-off-by: Anatol Belski <ab@php.net>

show more ...

Fix #79294: ::columnType() may fail after SQLite3Stmt::reset()

The fix for feature request #53466 did not properly handle resetting of
the corresponding statement; the problem with this

Fix #79294: ::columnType() may fail after SQLite3Stmt::reset()

The fix for feature request #53466 did not properly handle resetting of
the corresponding statement; the problem with this is that the
statement does not know about its result sets. But even if we could
fix this, the `complete` handling still appears to be brittle, since
the `sqlite3_column_type()`docs[1] state:

| If the SQL statement does not currently point to a valid row, or if
| the column index is out of range, the result is undefined.

Fortunately, we can use `sqlite3_data_count()` instead, since[2]:

| If prepared statement P does not have results ready to return (via
| calls to the sqlite3_column() family of interfaces) then
| sqlite3_data_count(P) returns 0.

Thus, we guard `SQLite3::columnType()` with `sqlite3_data_count()`, and
completely drop updating the `php_sqlite3_result_object.complete`
field, but keep it for ABI BC purposes.

[1] <https://www.sqlite.org/c3ref/column_blob.html>
[2] <https://www.sqlite.org/c3ref/data_count.html>

show more ...

Apply tidy formatting

Mostly reindent PHP scripts to spaces.

Report errors from stream read and write operations

The php_stream_read() and php_stream_write() functions now return
an ssize_t value, with negative results indicating failure. Function

Report errors from stream read and write operations

The php_stream_read() and php_stream_write() functions now return
an ssize_t value, with negative results indicating failure. Functions
like fread() and fwrite() will return false in that case.

As a special case, EWOULDBLOCK and EAGAIN on non-blocking streams
should not be regarded as error conditions, and be reported as
successful zero-length reads/writes instead. The handling of EINTR
remains unclear and is internally inconsistent (e.g. some code-paths
will automatically retry on EINTR, while some won't).

I'm landing this now to make sure the stream wrapper ops API changes
make it into 7.4 -- however, if the user-facing changes turn out to
be problematic we have the option of clamping negative returns to
zero in php_stream_read() and php_stream_write() to restore the
old behavior in a relatively non-intrusive manner.

show more ...

Implement SQLite extended result code functionality

Fix leak on sqlite3 open error

sqlite3_open creates the database object even if the operation
fails.

Implement SQLite3 backup API

Cheaper checks for exceptions thrown from __toString()

Allow exceptions in __toString()

RFC: https://wiki.php.net/rfc/tostring_exceptions

And convert some object to string conversion related recoverable
fatal errors into Error excep

Allow exceptions in __toString()

RFC: https://wiki.php.net/rfc/tostring_exceptions

And convert some object to string conversion related recoverable
fatal errors into Error exceptions.

Improve exception safety of internal code performing string
conversions.

show more ...

Replace ZVAL_COPY() and ZVAL_COPY_VALUE() for IS_OBJECT by cheaper macros

Fix bug #77967 - Bypassing open_basedir restrictions via file uris

Add RETURN_EMPTY_ARRAY() / RETVAL_EMPTY_ARRAY()

The usual wrappers around ZVAL_EMPTY_ARRAY()...

Avoid misc uninitialized variable warnings

SQLite3: add DEFENSIVE config for SQLite >= 3.26.0 as a mitigation strategy against potential security flaws

SQLite3: add DEFENSIVE config for SQLite >= 3.26.0 as a mitigation strategy against potential security flaws

Remove local variables

This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly

Remove local variables

This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly used by Vim and Emacs editors
yet with recent changes the once working definitions don't work
anymore in Vim without custom plugins or additional configuration.
Neither are these settings synced across the PHP code base.

A simpler and better approach is EditorConfig and fixing code
using some code style fixing tools in the future instead.

This patch also removes the so called modelines for Vim. Modelines
allow Vim editor specifically to set some editor configuration such as
syntax highlighting, indentation style and tab width to be set in the
first line or the last 5 lines per file basis. Since the php test
files have syntax highlighting already set in most editors properly and
EditorConfig takes care of the indentation settings, this patch removes
these as well for the Vim 6.0 and newer versions.

With the removal of local variables for certain editors such as
Emacs and Vim, the footer is also probably not needed anymore when
creating extensions using ext_skel.php script.

Additionally, Vim modelines for setting php syntax and some editor
settings has been removed from some *.phpt files. All these are
mostly not relevant for phpt files neither work properly in the
middle of the file.

show more ...

Remove yearly range from copyright notice

Implement SQLite3Stmt::getSQL method, returning the original statement SQL, eventually expanded

SQLite3: Separating parameters binding in a function

Require SQLite ≥ 3.7.4 for ext/sqlite3

`SQLite3::readOnly()` uses `sqlite3_stmt_readonly()` which is only
available as of libsqlite 3.7.4. For older SQLite3 versions we return
alway

Require SQLite ≥ 3.7.4 for ext/sqlite3

`SQLite3::readOnly()` uses `sqlite3_stmt_readonly()` which is only
available as of libsqlite 3.7.4. For older SQLite3 versions we return
always `false`, which can be confusing. Instead of sticking with this
behavior, or even undefining the method for old SQLite3 versions, we
lift the requirements to SQLite 3.7.4 (released on 2010-12-08),
according to a respective discussion[1].

Since pdo_sqlite doesn't use `sqlite3_stmt_readonly()`, we stick with
the minimum requirement of SQLite 3.5.0.

[1] <https://github.com/php/php-src/pull/3614>

show more ...

Handle potential sqlite3_bind_*() call failures

Since bug 77051 has been fixed, it is unlikely that any of the
`sqlite3_bind_*` calls will ever fail, but we add respective checks
no

Handle potential sqlite3_bind_*() call failures

Since bug 77051 has been fixed, it is unlikely that any of the
`sqlite3_bind_*` calls will ever fail, but we add respective checks
nonetheless, and call `php_sqlite3_error()` in case of bind failures.

show more ...

Fix #77051: Issue with re-binding on SQLite3

We have to call `sqlite3_reset()` before re-binding the parameters.

Deny (un)serialization of SQLite3, SQLite3Stmt and SQLite3Result

Serializing `SQLite3`, `SQLite3Stmt` and `SQLite3Result` instances is
possible but pointless, since unserializing results

Deny (un)serialization of SQLite3, SQLite3Stmt and SQLite3Result

Serializing `SQLite3`, `SQLite3Stmt` and `SQLite3Result` instances is
possible but pointless, since unserializing results in uninitialized
instances, which will bail out of any method call. Therefore, we deny
serialization and unserialization in the first place.

show more ...

Use ZEND_THIS macro to hide implementation details in extensions code.