Fix bug #50293 and #81713: file path checking in OpenSSL functions

It introduces a single function to check file paths passed to OpenSSL
functions. It expands the path, check null bytes

Fix bug #50293 and #81713: file path checking in OpenSSL functions

It introduces a single function to check file paths passed to OpenSSL
functions. It expands the path, check null bytes and finally does
an open basedir check.

show more ...

Add string return type to __toString() of internal classes

Same as with userland classes, automatically add a string return
type to __toString() methods in internal classes, so the signa

Add string return type to __toString() of internal classes

Same as with userland classes, automatically add a string return
type to __toString() methods in internal classes, so the signature
is compatible with Stringable.

show more ...

Implement Stringable automatically for internal classes

Requiring all internal classes (including those from 3rd-party
extensions) to implement Stringable if they provide __toString()

Implement Stringable automatically for internal classes

Requiring all internal classes (including those from 3rd-party
extensions) to implement Stringable if they provide __toString()
is too error prone. Case in point, our _ZendTestClass test class
was not doing so, resulting in preloading test failures after
recent changes.

Instead we automatically implement Stringable, the same as we do
for userland classes. We still allow explicit implementations,
but ignore them (normally they would result in an error due to
duplicate interface implementation). Finally, we need to be
careful about not trying to implement Stringable on Stringable
itself.

In some cases this changes the interface order, in particular the
automatic Stringable implementation will now come first.

show more ...

Don't implement Stringable on traits

Traits do not support interfaces, so we should not implement
Stringable on them.

Also check the __toString() return type in the same way oth

Don't implement Stringable on traits

Traits do not support interfaces, so we should not implement
Stringable on them.

Also check the __toString() return type in the same way other
magic methods do, otherwise we would now miss the check in the
trait case.

show more ...

Fix bug #66719

While parent:: should inherit the called scope, it should only do
so if it is compatible. If there is no called scope, or it is not
a subtype of the scope, we should f

Fix bug #66719

While parent:: should inherit the called scope, it should only do
so if it is compatible. If there is no called scope, or it is not
a subtype of the scope, we should fall back to the scope.

show more ...

Create interned strings for internal union types

Just like for non-union types. These may be returned to userland
via reflection, and as such need to be interned.

Fix constant update for shadowed private property

Updating based on the properties info HT will miss private parent
properties that have been shadowed in the child class. Instead,
pe

Fix constant update for shadowed private property

Updating based on the properties info HT will miss private parent
properties that have been shadowed in the child class. Instead,
perform updating directly on the default properties table.

We can't do the same for static properties, because those don't
have a convenient way to look up the property type from the
property offset. However, I don't believe the problem exists for
static properties, because we're always going to be using the
property on the class it was declared on, while children only hold
INDIRECT references. As such, this should be covered by parent
class const updating.

Fixes oss-fuzz #35906.

show more ...

Add support for union types for internal functions

This closes the last hole in the supported types for internal
function arginfo types. It's now possible to represent unions of
mult

Add support for union types for internal functions

This closes the last hole in the supported types for internal
function arginfo types. It's now possible to represent unions of
multiple classes. This is done by storing them as TypeA|TypeB and
PHP will then convert this into an appropriate union type list.

Closes GH-6581.

show more ...

Export zend_is_callable_at_frame

Export the zend_is_callable_impl() function as
zend_is_callable_at_frame() for use by extension. As twose pointed
out, an extension may want to retri

Export zend_is_callable_at_frame

Export the zend_is_callable_impl() function as
zend_is_callable_at_frame() for use by extension. As twose pointed
out, an extension may want to retrieve fcc for a private method.

show more ...

Make constexpr compilation robust against multiple compilation

Instead of setting the old AST type to zero, replace the AST with
the compiled constexpr AST zval. This requires passing in

Make constexpr compilation robust against multiple compilation

Instead of setting the old AST type to zero, replace the AST with
the compiled constexpr AST zval. This requires passing in a
zend_ast** instead of a zend_ast*.

This allows compiling ASTs containing constexprs multiple times
-- the second time, the existing compiled representation will be
resused.

This means we no longer need to copy the attributes AST for
promoted properties.

show more ...

Initialize attributes for internal functions

Fixes a crash in Symfony SecurityBundle tests.

Declare array|int and object-of-class|int types in stubs

Closes GH-6081

Co-Authored-By: Nikita Popov <nikic@php.net>

Consolidate new union type ZPP macro names

They will now follow the canonical order of types. Older macros are
left intact due to maintaining BC.

Closes GH-6112

Improve error messages mentioning parameters instead of arguments

Closes GH-5999

Make null byte error a ValueError

Currently we treat paths with null bytes as a TypeError, which is
incorrect, and rather inconsistent, as we treat empty paths as
ValueError. We do t

Make null byte error a ValueError

Currently we treat paths with null bytes as a TypeError, which is
incorrect, and rather inconsistent, as we treat empty paths as
ValueError. We do this because the error is generated by zpp and
it's easier to always throw TypeError there.

This changes the zpp implementation to throw a TypeError only if
the type is actually wrong and throw ValueError for null bytes.
The error message is also split accordingly, to be more precise.

Closes GH-6094.

show more ...

Release call trampolines in zpp fcc

When using zpp 'f' or Z_PARAM_FUNC, if the fcc points to a call
trampoline release it immediately and force zend_call_function
to refetch it. This

Release call trampolines in zpp fcc

When using zpp 'f' or Z_PARAM_FUNC, if the fcc points to a call
trampoline release it immediately and force zend_call_function
to refetch it. This may require additional callability checks
if __call is used, but avoids the need to carefully free fcc
values in all internal functions -- in some cases this is not
simple, as a type error might be triggered by a later argument
in the same zpp call.

This fixes oss-fuzz #25390.

Closes GH-6073.

show more ...

Improve error_handing replacement functions

We explicitly skip calls to user_error_handler in EH_THROW mode

Closes GH-6050.

Rehash function table after disabling functions

To perform fast shutdown without full table cleanup we need all
internal functions to be in one continuous chunk. This was
violated wh

Rehash function table after disabling functions

To perform fast shutdown without full table cleanup we need all
internal functions to be in one continuous chunk. This was
violated when functions were deleted via disable_functions.

This drops the zend_disable_function() API in favor of
zend_disable_functions(), which disables the given list of
functions and performs the necessary rehash afterwards.

Also drop PG(disabled_functions), which is no longer used.

show more ...

Don't mark variadic functions as ZEND_FASTCALL

Variadic functions do not support the fastcall calling convention.

Improve type declarations for Zend APIs

Voidification of Zend API which always succeeded
Use bool argument types instead of int for boolean arguments
Use bool return type for functio

Improve type declarations for Zend APIs

Voidification of Zend API which always succeeded
Use bool argument types instead of int for boolean arguments
Use bool return type for functions which return true/false (1/0)
Use zend_result return type for functions which return SUCCESS/FAILURE as they don't follow normal boolean semantics

Closes GH-6002

show more ...

Remove useless same_zval function

Closes GH-6039.

Check variadic parameter for type and duplicate name

Set HAS_TYPE_HINTS flag if the variadic parameter is types as well,
and make sure it has a distinct name. This was previously missed,

Check variadic parameter for type and duplicate name

Set HAS_TYPE_HINTS flag if the variadic parameter is types as well,
and make sure it has a distinct name. This was previously missed,
because the variadic parameter is not part of num_args.

show more ...

Fix bug #78770

Refactor the zend_is_callable implementation to check callability
at a particular frame (this is an implementation detail for now,
but could be exposed in the API if u

Fix bug #78770

Refactor the zend_is_callable implementation to check callability
at a particular frame (this is an implementation detail for now,
but could be exposed in the API if useful). Pick the first parent
user frame as the one to check.

show more ...

Accept zend_object* in zend_update_property

Accept zend_object* in zend_unset_property