Fix GH-13037: PharData incorrectly extracts zip file

The code currently assumes that the extra field length of the central
directory entry and the local entry are the same, but that's no

Fix GH-13037: PharData incorrectly extracts zip file

The code currently assumes that the extra field length of the central
directory entry and the local entry are the same, but that's not the
case. For example, the "Extended Timestamp extra field" differs in size
for local vs central directory entries. This causes the file contents
offset to be incorrect because it is based on the central directory
length instead of the local entry length. Fix it by reading the local
entry and getting the size from there as well as checking consistency
for the file name length.

Closes GH-13045.

show more ...

Fix GH-12532: PharData created from zip has incorrect timestamp

The datetime stored in the DOS time fields, which is what zip standard
uses, is local time without a timezone. There's an

Fix GH-12532: PharData created from zip has incorrect timestamp

The datetime stored in the DOS time fields, which is what zip standard
uses, is local time without a timezone. There's an extension to the zip
file format since '97 that allows storing a unix timestamp (in UTC) in
the header for both the central directory and the local entries.
This patch adds support for this.

Closes GH-12548.

show more ...

Fix GH-10766: PharData archive created with Phar::Zip format does not keep files metadata (datetime)

Due to an incorrect check, the datetime was never actually set.
To test this we need

Fix GH-10766: PharData archive created with Phar::Zip format does not keep files metadata (datetime)

Due to an incorrect check, the datetime was never actually set.
To test this we need to write the file using phar, but read the file
using a different method to not get a cached, or a value that's been
transformed twice and is therefore accidentally correct.

Closes GH-10769

show more ...

Remove useless php_stream_tell() call

Closes GH-10365.

Optimize stripos/stristr

Closes GH-7847
Closes GH-7852

Previously stripos/stristr would lowercase both the haystack and the
needle to reuse strpos. The approach in this PR i

Optimize stripos/stristr

Closes GH-7847
Closes GH-7852

Previously stripos/stristr would lowercase both the haystack and the
needle to reuse strpos. The approach in this PR is similar to strpos.
memchr is highly optimized so we're using it to search for the first
character of the needle in the haystack. If we find it we compare the
remaining characters of the needle manually.

The new implementation seems to perform about half as well as strpos (as
two memchr calls are necessary to find the next candidate).

show more ...

switch phar to use sha256 signature by default

phar: crc32: Extend and cleanup API for the new bulk crc32 functions

As suggested on the patch discussion, adding init/end macros. Plus,
prefixed the new functions with php_ to avoid pos

phar: crc32: Extend and cleanup API for the new bulk crc32 functions

As suggested on the patch discussion, adding init/end macros. Plus,
prefixed the new functions with php_ to avoid possible symbol conflicts.

Signed-off-by: Anatol Belski <ab@php.net>

show more ...

phar: use crc32 bulk method instead. (#6099)

phar: use crc32 bulk method instead.

Benefit from the hardware crc32 computing.

Signed-off-by: Frank Du <frank.du@intel.com>

Update http->https in license (#6945)

1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as

Update http->https in license (#6945)

1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |

show more ...

Merge branch 'PHP-8.0'

* PHP-8.0:
Fix #70091: Phar does not mark UTF-8 filenames in ZIP archives

Merge branch 'PHP-7.4' into PHP-8.0

* PHP-7.4:
Fix #70091: Phar does not mark UTF-8 filenames in ZIP archives

Fix #70091: Phar does not mark UTF-8 filenames in ZIP archives

The default encoding of filenames in a ZIP archive is IBM Code Page
437. Phar, however, only supports UTF-8 filenames. Th

Fix #70091: Phar does not mark UTF-8 filenames in ZIP archives

The default encoding of filenames in a ZIP archive is IBM Code Page
437. Phar, however, only supports UTF-8 filenames. Therefore we have
to mark filenames as being stored in UTF-8 by setting the general
purpose bit 11 (the language encoding flag).

The effect of not setting this bit for non ASCII filenames can be seen
in popular tools like 7-Zip and UnZip, but not when extracting the
archives via ext/phar (which is agnostic to the filename encoding), or
via ext/zip (which guesses the encoding). Thus we add a somewhat
brittle low-level test case.

Closes GH-6630.

show more ...

Replace zend_bool uses with bool

We're starting to see a mix between uses of zend_bool and bool.
Replace all usages with the standard bool type everywhere.

Of course, zend_bool

Replace zend_bool uses with bool

We're starting to see a mix between uses of zend_bool and bool.
Replace all usages with the standard bool type everywhere.

Of course, zend_bool is retained as an alias.

show more ...

Merge branch 'PHP-7.4' into PHP-8.0

* PHP-7.4:
Fix #77565: Incorrect locator detection in ZIP-based phars

Fix #77565: Incorrect locator detection in ZIP-based phars

We must not assume that the first end of central dir signature in a ZIP
archive actually designates the end of central director

Fix #77565: Incorrect locator detection in ZIP-based phars

We must not assume that the first end of central dir signature in a ZIP
archive actually designates the end of central directory record, since
the data in the archive may contain arbitrary byte patterns. Thus, we
better search from the end of the data, what is also slightly more
efficient.

There is, however, no way to detect the end of central directory
signature by searching from the end of the ZIP archive with absolute
certainty, since the signature could be part of the trailing comment.
To mitigate, we check that the comment length fits to the found
position, but that might still not be the correct position in rare
cases.

Closes GH-6507.

show more ...

Prevent double-free of Phar ZIP stream

We must not alias the closed stream to `phar_archive_data.fp`, and use
PHAR_ZIP_FAIL() for consistency with the rest of this function.

Clo

Prevent double-free of Phar ZIP stream

We must not alias the closed stream to `phar_archive_data.fp`, and use
PHAR_ZIP_FAIL() for consistency with the rest of this function.

Closes GH-6578.

show more ...

Fix #76929: zip-based phar does not respect phar.require_hash

Based on the patch provided by david at bamsoftware.

Closes GH-6517.

Merge branch 'PHP-7.4' into PHP-8.0

* PHP-7.4:
Fix #73809: Phar Zip parse crash - mmap fail

Fix #73809: Phar Zip parse crash - mmap fail

Phar signatures practically are of limited size; for the MD5 and SHA
hashes the size is fixed (at most 64 bytes for SHA512); for OpenSSL

Fix #73809: Phar Zip parse crash - mmap fail

Phar signatures practically are of limited size; for the MD5 and SHA
hashes the size is fixed (at most 64 bytes for SHA512); for OpenSSL
public keys there is no size limit in theory, but "64 KiB ought to be
good enough for anybody". So we check for that limit, to avoid fatal
errors due to out of memory conditions.

Since it is neither possible to have the signature compressed in the
ZIP archive, nor is it possible to manually add a signature via Phar,
we use ZipArchive to create a suitable archive for the test on the fly.

Closes GH-6474.

show more ...

[RFC] Only unserialize Phar metadata when getMetadata() is called

In other words, don't automatically unserialize when the magic
phar:// stream wrappers are used.
RFC: https://wiki.p

[RFC] Only unserialize Phar metadata when getMetadata() is called

In other words, don't automatically unserialize when the magic
phar:// stream wrappers are used.
RFC: https://wiki.php.net/rfc/phar_stop_autoloading_metadata

Also, change the signature from `getMetadata()`
to `getMetadata(array $unserialize_options = [])`.
Start throwing earlier if setMetadata() is called and serialization threw.

See https://externals.io/message/110856 and
https://bugs.php.net/bug.php?id=76774

This was refactored to add a phar_metadata_tracker for the following reasons:
- The way to properly copy a zval was previously implicit and undocumented
(e.g. is it a pointer to a raw string or an actual value)
- Avoid unnecessary serialization and unserialization in the most common case
- If a metadata value is serialized once while saving a new/modified phar file,
this allows reusing the same serialized string.
- Have as few ways to copy/clone/lazily parse metadata (etc.) as possible,
so that code changes can be limited to only a few places in the future.
- Performance is hopefully not a concern - copying a string should be faster
than unserializing a value, and metadata should be rare in most cases.

Remove unnecessary skip in a test(Compression's unused)

Add additional assertions about usage of persistent phars

Improve robustness of `Phar*->setMetadata()`

- Add sanity checks for edge cases freeing metadata, when destructors
or serializers modify the phar recursively.
- Typical use cases of php have phar.readonly=1 and would not be affected.

Closes GH-5855

show more ...

Fix #79797: Use of freed hash key in the phar_parse_zipfile function

We must not use heap memory after we freed it.

Fix #79797: Use of freed hash key in the phar_parse_zipfile function

We must not use heap memory after we freed it.

Fix build warnings

- switch from strncpy to memcpy for -Wstringop-truncation

Phar: Avoid negative zip dates

The zip date/time encoding format is incredibly stupid.

Update and fix remaining year ranges (2019)

This patch follows previous license year ranges updates. With new
approach source code files now have simplified headers with license
info

Update and fix remaining year ranges (2019)

This patch follows previous license year ranges updates. With new
approach source code files now have simplified headers with license
information without year ranges.

show more ...