| #
4377a8ea |
| 16-Sep-2019 |
Nikita Popov |
Sanity-check array/object lengths during unserialization
Avoid OOM conditions in unserialize due to overly large array or
object length specifications. |
|
Revision tags: php-7.2.23RC1, php-7.3.10RC1, php-7.4.0RC1, php-7.1.32, php-7.2.22, php-7.3.9 |
|
| #
ca265eb5 |
| 23-Aug-2019 |
Christoph M. Becker |
Fix #78438: Corruption when __unserializing deeply nested structures
When storing two temporary variables for delayed __unserialize() calls,
we have to make sure that both fit into the s
Fix #78438: Corruption when __unserializing deeply nested structures
When storing two temporary variables for delayed __unserialize() calls,
we have to make sure that both fit into the same linked list element.
To that end we introduce the internal API `tmp_var` which allows to
reserve `num` slots in the same list element.
We also fix the `var_dtor_entries` struct definition to use the proper
size, namely `VAR_DTOR_ENTRIES_MAX`.
show more ...
|
| #
69ba2b98 |
| 22-Aug-2019 |
Christoph M. Becker |
Fix var_unserializer debug code
At least it now compiles and should be free of warnings. |
|
Revision tags: php-7.4.0beta4, php-7.2.22RC1, php-7.3.9RC1, php-7.4.0beta2, php-7.1.31, php-7.2.21, php-7.3.8, php-7.4.0beta1, php-7.2.21RC1, php-7.3.8RC1, php-7.4.0alpha3, php-7.3.7, php-7.2.20, php-7.4.0alpha2, php-7.3.7RC3, php-7.3.7RC2, php-7.2.20RC2, php-7.4.0alpha1, php-7.3.7RC1, php-7.2.20RC1, php-7.2.19, php-7.3.6, php-7.1.30, php-7.2.19RC1, php-7.3.6RC1, php-7.1.29, php-7.2.18, php-7.3.5, php-7.2.18RC1, php-7.3.5RC1 |
|
| #
e2ea0f10 |
| 09-Apr-2019 |
Nikita Popov |
Fix bug #77866: Port Serializable SPL classes to use __unserialize()
Payloads created using Serializable are still supported. |
| #
b870685c |
| 09-Apr-2019 |
Nikita Popov |
Fix leak on error in new serialization mechanism |
|
Revision tags: php-7.2.17, php-7.3.4, php-7.1.28, php-7.3.4RC1, php-7.2.17RC1, php-7.1.27, php-7.3.3, php-7.2.16, php-7.3.3RC1, php-7.2.16RC1, php-7.2.15, php-7.3.2, php-7.2.15RC1 |
|
| #
d373c11e |
| 22-Jan-2019 |
Nikita Popov |
Implement new custom object serialization mechanism
RFC: https://wiki.php.net/rfc/custom_object_serialization |
| #
9f6f6fe2 |
| 10-Mar-2019 |
c9s |
Remove function_table var from the caller
function_table var is not used in call_user_function macro anymore
hence replace the usage with NULL |
| #
0cf7de1c |
| 30-Jan-2019 |
Zeev Suraski |
Remove yearly range from copyright notice |
| #
89a4c172 |
| 22-Jan-2019 |
Nikita Popov |
Remove the "o" serialization format
We never generate the "o" format during serialization, so let's not
keep this unnecessary attack surface around. |
|
Revision tags: php-7.3.2RC1, php-5.6.40, php-7.1.26, php-7.3.1, php-7.2.14 |
|
| #
e219ec14 |
| 07-Jan-2019 |
Nikita Popov |
Implement typed properties
RFC: https://wiki.php.net/rfc/typed_properties_v2
This is a squash of PR #3734, which is a squash of PR #3313.
Co-authored-by: Bob Weinand <bobwe
Implement typed properties
RFC: https://wiki.php.net/rfc/typed_properties_v2
This is a squash of PR #3734, which is a squash of PR #3313.
Co-authored-by: Bob Weinand <bobwei9@hotmail.com>
Co-authored-by: Joe Watkins <krakjoe@php.net>
Co-authored-by: Dmitry Stogov <dmitry@zend.com>
show more ...
|
|
Revision tags: php-7.2.14RC1, php-7.3.1RC1 |
|
| #
db30e0ce |
| 13-Dec-2018 |
Dmitry Stogov |
Improve unserialize() |
| #
71f430cf |
| 12-Dec-2018 |
Dmitry Stogov |
Improve unserialize() |
|
Revision tags: php-5.6.39, php-7.1.25, php-7.2.13, php-7.0.33, php-7.3.0, php-7.1.25RC1, php-7.2.13RC1, php-7.3.0RC6, php-7.1.24, php-7.2.12, php-7.3.0RC5, php-7.1.24RC1, php-7.2.12RC1, php-7.3.0RC4, php-7.1.23, php-7.2.11, php-7.3.0RC3, php-7.1.23RC1, php-7.2.11RC1, php-7.3.0RC2 |
|
| #
dfa166e7 |
| 16-Sep-2018 |
Nikita Popov |
Remove unused ZEND_FILE_LINE in i_zval_ptr_dtor |
|
Revision tags: php-5.6.38, php-7.1.22, php-7.3.0RC1, php-7.2.10, php-7.0.32, php-7.1.22RC1, php-7.3.0beta3, php-7.2.10RC1, php-7.1.21, php-7.2.9, php-7.3.0beta2, php-7.1.21RC1, php-7.3.0beta1, php-7.2.9RC1, php-5.6.37, php-7.1.20, php-7.3.0alpha4, php-7.0.31, php-7.2.8, php-7.1.20RC1, php-7.2.8RC1, php-7.3.0alpha3 |
|
| #
8d3f8ca1 |
| 03-Jul-2018 |
Peter Kokot |
Remove unused Git attributes ident
The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
use
Remove unused Git attributes ident
The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
user who changed it.
In Git this functionality is different and can be done with Git attribute
ident. These need to be defined manually for each file in the
.gitattributes file and are afterwards replaced with 40-character
hexadecimal blob object name which is based only on the particular file
contents.
This patch simplifies handling of $Id$ keywords by removing them since
they are not used anymore.
show more ...
|
| #
b1214059 |
| 23-Jul-2018 |
Dmitry Stogov |
Use better destructor (key may be only IS_STRING or IS_LONG). |
| #
af341213 |
| 04-Jul-2018 |
Dmitry Stogov |
se zval_ptr_dtor_str() instead of zend_string_release_ex(Z_STR(*), 0) |
| #
a57b5e82 |
| 02-Jul-2018 |
Nikita Popov |
Merge branch 'PHP-7.2'
|
| #
09bb2527 |
| 02-Jul-2018 |
Nikita Popov |
Merge branch 'PHP-7.1' into PHP-7.2
|
| #
c793885b |
| 02-Jul-2018 |
Nikita Popov |
Fixed bug #74670
Validate that "C" serialization payload is followed by "}" prior to
calling the unserialize() handler. This mitigates issues caused by
unserialize() not correctly ha
Fixed bug #74670
Validate that "C" serialization payload is followed by "}" prior to
calling the unserialize() handler. This mitigates issues caused by
unserialize() not correctly handling strings that are not NUL
terminated. Making sure that there is a "}" at the end avoids the
problem.
show more ...
|
|
Revision tags: php-7.3.0alpha2, php-7.1.19, php-7.2.7, php-7.1.19RC1, php-7.3.0alpha1, php-7.2.7RC1, php-7.1.18, php-7.2.6, php-7.2.6RC1, php-7.1.18RC1 |
|
| #
13e9a471 |
| 03-May-2018 |
Pedro Magalhães |
Fix #76300 - Dont attempt to change visibility of a parent private |
| #
7d7b7e80 |
| 17-Jun-2018 |
Stanislav Malyshev |
Merge branch 'PHP-7.2'
* PHP-7.2:
Fix #76300 - Dont attempt to change visibility of a parent private
|
| #
d90c6f24 |
| 29-May-2018 |
Dmitry Stogov |
Removed useless zval_ptr_dtor() |
| #
5eb1f92f |
| 28-May-2018 |
Dmitry Stogov |
Use zend_string_release_ex() instread of zend_string_release() in places, where we sure about string persistence. |
| #
524f5245 |
| 08-May-2018 |
Dmitry Stogov |
Avoid useless checks, using zend_string_efree(), in cases where the string is known to be a temporary allocated zend_string. |
| #
2dca8671 |
| 03-May-2018 |
Pedro Magalhães |
Fix #76300 - Dont attempt to change visibility of a parent private |
