Introduce max_multipart_body_parts INI

This fixes GHSA-54hq-v5wp-fqgv DOS vulnerabality by limitting number of
parsed multipart body parts as currently all parts were always parsed.

Fix bug #77780: "Headers already sent" when previous connection was aborted

This change primarily splits SAPI deactivation to module and destroy
parts. The reason is that currently some

Fix bug #77780: "Headers already sent" when previous connection was aborted

This change primarily splits SAPI deactivation to module and destroy
parts. The reason is that currently some SAPIs might bail out
on deactivation. One of those SAPI is PHP-FPM that can bail out on
request end if for example the connection is closed by the client
(web sever). The problem is that in such case the resources are not
freed and some values reset. The most visible impact can have not
resetting the PG(headers_sent) which can cause erorrs in the next
request. One such issue is described in #77780 bug which this fixes
and is also cover by a test in this commit. It seems reasonable
to separate deactivation and destroying of the resource which means
that the bail out will not impact it.

show more ...

Fix GH-8923: error_log on Windows can hold the file write lock

On Windows, closing a file which is locked may not immediately remove
the lock. The `LockFileEx()` documentation states:

Fix GH-8923: error_log on Windows can hold the file write lock

On Windows, closing a file which is locked may not immediately remove
the lock. The `LockFileEx()` documentation states:

| Therefore, it is recommended that your process explicitly unlock all
| files it has locked when it terminates.

We comply, and also use the macro `LOCK_EX` instead of the magic number
`2`.

Closes GH-8925.

show more ...

Fix potential use after free in php_binary_init()

Closes GH-8791.

Fix GH-8082: Prevent leaking memory on observed transient run_time_caches

This is achieved by tracking the observers on the run_time_cache (with a fixed amount of slots, 2 for each observer)

Fix GH-8082: Prevent leaking memory on observed transient run_time_caches

This is achieved by tracking the observers on the run_time_cache (with a fixed amount of slots, 2 for each observer).
That way round, if the run_time_cache is freed all associated observer data is as well.

This approach has been chosen, as to avoid any ABI or API breakage.
Future versions may for example choose to provide a hookable API for run_time_cache freeing or similar.

show more ...

Fix bug #81591: ignore_repeated_errors broken

We should suppress the error if the message is the same, not if
it's different. Apparently we had no test coverage for these
options.

Fix #81518: Header injection via default_mimetype / default_charset

We forbid setting these INI options to values containing NUL bytes, CR
or LF.

Closes GH-7574.

Fix bug #80728: Don't reset the timeout on ini deactivate

When the time limit for a script is changed, when the script ends,
its INI value will be reset. This calls the event handler for

Fix bug #80728: Don't reset the timeout on ini deactivate

When the time limit for a script is changed, when the script ends,
its INI value will be reset. This calls the event handler for the
timeout change, which will unset then reset the timeout. However,
this is done even if the script is done executing, and say, the CGI
or CLI web server process is idle.

This is probably incorrect, but isn't a problem on most platforms,
because PHP uses a timer that only ticks when the process is active
(that is, executing code). Since when it's idle, it's blocking on
listen/read, it won't tick because nothing executes. However, on
platforms where only the real-time timer is supported, (Cygwin/PASE)
it ticks regardless of if PHP is even executing. This means that the
idle processes are subject to timeouts from the INI reset on script
end.

This makes it so the timer is never set if the state is deactivating.
Testing with the CLI web server indicates the timer no longer
spuriously activates under PASE.

Closes GH-6683.

show more ...

Fixed bug #81104

When the memory limit is restored during shutdown, we may still
be using a lot of memory. Ignore the failure at that point and
set it again after the MM is shut down

Fixed bug #81104

When the memory limit is restored during shutdown, we may still
be using a lot of memory. Ignore the failure at that point and
set it again after the MM is shut down, at which point memory
usage should be at its lowest point.

show more ...

Fixed bug #81070

When the memory limit is reduced using an `ini_set("memory_limit", ..)`
below the currently allocated memory, the out-of-memory check overflowed.
Instead of implemen

Fixed bug #81070

When the memory limit is reduced using an `ini_set("memory_limit", ..)`
below the currently allocated memory, the out-of-memory check overflowed.
Instead of implementing additional checks during allocation,
`zend_set_memory_limit()` now validates the new memory limit. When
below the current memory usage the ini_set call will fail and throw
a warning.

This is part of GH-7040.

show more ...

Revert "Remove no longer used "log_errors_max_len" ini directive (#6838)"

This reverts commit d2d227e54765a5de863c6608fd64e1228ab08108.

This is an ABI break.

Remove no longer used "log_errors_max_len" ini directive (#6838)

Fix #67792: HTTP Authorization schemes are treated as case-sensitive

We use `zend_binary_strncasecmp()` to avoid any locale issues, and
refactor. We also add a test case for Digest auth

Fix #67792: HTTP Authorization schemes are treated as case-sensitive

We use `zend_binary_strncasecmp()` to avoid any locale issues, and
refactor. We also add a test case for Digest authentication.

Closes GH-6900.

show more ...

Fix #80960: opendir() warning wrong info when failed on Windows

Firstly, we must not forget to set appropriate error codes for "manual"
checks in `virtual_file_ex()`.

Secondly,

Fix #80960: opendir() warning wrong info when failed on Windows

Firstly, we must not forget to set appropriate error codes for "manual"
checks in `virtual_file_ex()`.

Secondly, we must not call `php_error_docref2()` for warnings regarding
unary functions; thus, we introduce `php_win32_docref1_from_error()`.

Closes GH-6872.

show more ...

Fire open observer end handlers after a zend_bailout

Closes GH-6377

Strip trailing line breaks and periods from Windows error messages

PHP error messages should not contain line breaks, so we remove these
from the Windows specific error messages. We als

Strip trailing line breaks and periods from Windows error messages

PHP error messages should not contain line breaks, so we remove these
from the Windows specific error messages. We also remove trailing
periods for the same reason.

Closes GH-6423.

show more ...

Expose php_during_module_startup() and php_during_module_shutdown()

This can be handy when trying to determine if it is safe to access request globals amongst other things.

Closes G

Expose php_during_module_startup() and php_during_module_shutdown()

This can be handy when trying to determine if it is safe to access request globals amongst other things.

Closes GH-6265

show more ...

Check linker compatibility directly from HMODULE

Checking the linker compatibility with extranous `ImageLoad()` calls is
possible, but unnecessary, since the modules are either already l

Check linker compatibility directly from HMODULE

Checking the linker compatibility with extranous `ImageLoad()` calls is
possible, but unnecessary, since the modules are either already loaded
or loaded shortly afterwards, so that we can get the required
information directly from the module handles. And actually, doing
`ImageLoad()` as well as `LoadLibrary()` leaves a tiny room for a race
condition, because both functions will lookup the module in the search
path, so there is no *guarantee* that both are dealing with the same
module. Dropping the `ImageLoad()` calls also has the advantage to no
longer face the issue reported in bug #79557. A very minor additional
advantage is that we no longer have to link against Imagehlp.dll.

Furthermore, there is no need to check for CRT compatibility multiple
times, so we can simplify the signature of `php_win32_crt_compatible`,
and at the same time clean up main.c a bit.

These changes require to change the signature of the exported
`php_win32_image_compatible` and `php_win32_crt_compatible` functions,
which now expect a `HMODULE` and nothing, respectively, instead of the
module name.

show more ...

Add system ID entropy API

The `zend_system_id` is a (true global) system ID that fingerprints a process state. When extensions add engine hooks during MINIT/startup, entropy is added the sys

Add system ID entropy API

The `zend_system_id` is a (true global) system ID that fingerprints a process state. When extensions add engine hooks during MINIT/startup, entropy is added the system ID for each hook. This allows extensions to identify that changes have been made to the engine since the last PHP process restart.

Closes GH-5871

show more ...

Fix observer leak

Make sure to startup observer infrastructure before we register
the first observer...

Rename zend_error_notify APIs to zend_observer_error*

Simplify error type filter

Closes GH-6049.

Add zend_observer API

Closes GH-5857.

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>
Co-authored-by: Sammy Powers <sammyk@datadoghq.com>

Rehash function table after disabling functions

To perform fast shutdown without full table cleanup we need all
internal functions to be in one continuous chunk. This was
violated wh

Rehash function table after disabling functions

To perform fast shutdown without full table cleanup we need all
internal functions to be in one continuous chunk. This was
violated when functions were deleted via disable_functions.

This drops the zend_disable_function() API in favor of
zend_disable_functions(), which disables the given list of
functions and performs the necessary rehash afterwards.

Also drop PG(disabled_functions), which is no longer used.

show more ...

Improve type declarations for Zend APIs

Voidification of Zend API which always succeeded
Use bool argument types instead of int for boolean arguments
Use bool return type for functio

Improve type declarations for Zend APIs

Voidification of Zend API which always succeeded
Use bool argument types instead of int for boolean arguments
Use bool return type for functions which return true/false (1/0)
Use zend_result return type for functions which return SUCCESS/FAILURE as they don't follow normal boolean semantics

Closes GH-6002

show more ...