Fix #81211: Symlinks are followed when creating PHAR archive

It is insufficient to check whether the `base` is contained in `fname`;
we also need to ensure that `fname` is properly separ

Fix #81211: Symlinks are followed when creating PHAR archive

It is insufficient to check whether the `base` is contained in `fname`;
we also need to ensure that `fname` is properly separated. And of
course, `fname` has to start with `base`.

show more ...

Add a few missing RETURN_THROWS();

Only PharFileInfo::compress() really needs it though.

Make Phar $fileNotFoundScript nullable

While "" is already treated the same way as absence, null is the
logically correct default here. Making this one argument non-nullable
is parti

Make Phar $fileNotFoundScript nullable

While "" is already treated the same way as absence, null is the
logically correct default here. Making this one argument non-nullable
is particularly pecular when considering that the preceding $alias
and $index arguments are both nullable.

show more ...

Fix #69279: Compressed ZIP Phar extractTo() creates garbage files

When extracting compressed files from an uncompressed Phar, we must not
use the direct file pointer, but rather get an u

Fix #69279: Compressed ZIP Phar extractTo() creates garbage files

When extracting compressed files from an uncompressed Phar, we must not
use the direct file pointer, but rather get an uncompressed file
pointer.

We also add a test to show that deflated and stored entries are
properly extracted.

This also fixes #79912, which appears to be a duplicate of #69279.

Co-authored-by: Anna Filina <afilina@gmail.com>

Closes GH-6599.

show more ...

Fix memory leak in Phar::webPhar() on Windows

Closes GH-6574.

Make compression_type nullable in a few more places

Missed that this was also used elsewhere...

Make Phar $format and $compression arguments nullable

Rather than using Greg's birthday, use null to indicate that the
existing format/compression should be retained. For the format

Make Phar $format and $compression arguments nullable

Rather than using Greg's birthday, use null to indicate that the
existing format/compression should be retained. For the format
simply using zero would be sufficient, but as the documentation
explicitly says that NULL is allowed here, we may as well make
that the truth.

show more ...

Consolidate new union type ZPP macro names

They will now follow the canonical order of types. Older macros are
left intact due to maintaining BC.

Closes GH-6112

Fix UNKNOWN default values in various extensions

Closes GH-6075

Promote warnings to exceptions in ext/phar

Closes GH-6008

Add another round of missing parameter types to stubs

Closes GH-5950

Fix ZPP order in ext/phar

[RFC] Only unserialize Phar metadata when getMetadata() is called

In other words, don't automatically unserialize when the magic
phar:// stream wrappers are used.
RFC: https://wiki.p

[RFC] Only unserialize Phar metadata when getMetadata() is called

In other words, don't automatically unserialize when the magic
phar:// stream wrappers are used.
RFC: https://wiki.php.net/rfc/phar_stop_autoloading_metadata

Also, change the signature from `getMetadata()`
to `getMetadata(array $unserialize_options = [])`.
Start throwing earlier if setMetadata() is called and serialization threw.

See https://externals.io/message/110856 and
https://bugs.php.net/bug.php?id=76774

This was refactored to add a phar_metadata_tracker for the following reasons:
- The way to properly copy a zval was previously implicit and undocumented
(e.g. is it a pointer to a raw string or an actual value)
- Avoid unnecessary serialization and unserialization in the most common case
- If a metadata value is serialized once while saving a new/modified phar file,
this allows reusing the same serialized string.
- Have as few ways to copy/clone/lazily parse metadata (etc.) as possible,
so that code changes can be limited to only a few places in the future.
- Performance is hopefully not a concern - copying a string should be faster
than unserializing a value, and metadata should be rare in most cases.

Remove unnecessary skip in a test(Compression's unused)

Add additional assertions about usage of persistent phars

Improve robustness of `Phar*->setMetadata()`

- Add sanity checks for edge cases freeing metadata, when destructors
or serializers modify the phar recursively.
- Typical use cases of php have phar.readonly=1 and would not be affected.

Closes GH-5855

show more ...

Call zpp_none in PharFileInfo::__destruct()

Using __destruct() with internal classes is dubious, but not so
simple to avoid here because the code extends SPL classes.

Remove proto comments from C files

Closes GH-5758

Fix leaks in Phar::webPhar()

Add ZVAL_OBJ_COPY macro

For the common ZVAL_OBJ + GC_ADDREF pattern.
This mirrors the existing ZVAL_STR_COPY API.

Add zend_call_known_function() API family

This adds the following APIs:

void zend_call_known_function(
zend_function *fn, zend_object *object, zend_class_entry *called_scope

Add zend_call_known_function() API family

This adds the following APIs:

void zend_call_known_function(
zend_function *fn, zend_object *object, zend_class_entry *called_scope,
zval *retval_ptr, int param_count, zval *params);

void zend_call_known_instance_method(
zend_function *fn, zend_object *object, zval *retval_ptr, int param_count, zval *params);
void zend_call_known_instance_method_with_0_params(
zend_function *fn, zend_object *object, zval *retval_ptr);
void zend_call_known_instance_method_with_1_params(
zend_function *fn, zend_object *object, zval *retval_ptr, zval *param);
void zend_call_known_instance_method_with_2_params(
zend_function *fn, zend_object *object, zval *retval_ptr, zval *param1, zval *param2);

These are used to perform a call if you already have the
zend_function you want to call. zend_call_known_function()
is the base API, the rest are just really thin wrappers around
it for the common case of instance method calls.

Closes GH-5692.

show more ...

Constify char * arguments of APIs

Closes GH-5676.

Fix [-Wundef] warning in PHAR extension

Generate method entries from stubs for curl, ffi, pdo, phar

Closes GH-5375

Fix # 79171: heap-buffer-overflow in phar_extract_file

We must not access memory outside of the allocated buffer.

Fix bug #79082 - Files added to tar with Phar::buildFromIterator have all-access permissions

Fix # 79171: heap-buffer-overflow in phar_extract_file

We must not access memory outside of the allocated buffer.

Fix bug #79082 - Files added to tar with Phar::buildFromIterator have all-access permissions