Remove broken check in var_unserializer (#13852)

`end = *p+maxlen`, and pointer overflow is UB, so that means that a check
of the form `end < *p` will always be false because it can only

Remove broken check in var_unserializer (#13852)

`end = *p+maxlen`, and pointer overflow is UB, so that means that a check
of the form `end < *p` will always be false because it can only be true
on pointer overflow. In particular, the compiler simplifies this to
`maxlen < 0` which is always false because maxlen is unsigned.

show more ...

Zend/zend_types.h: deprecate zend_bool, zend_intptr_t, zend_uintptr_t (#10597)

These types are standard C99.

For compatibility with out-of-tree extensions, keep the typedefs
in

Zend/zend_types.h: deprecate zend_bool, zend_intptr_t, zend_uintptr_t (#10597)

These types are standard C99.

For compatibility with out-of-tree extensions, keep the typedefs
in main/php.h.

show more ...

Revert GH-10220

Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit ecc880f491d66081298a16634629f149459706a9.
This reverts commit 588a07

Revert GH-10220

Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit ecc880f491d66081298a16634629f149459706a9.
This reverts commit 588a07f7371ee2b5fac17de147926780e427fae6.
This reverts commit f377e15751d3aa48b69cd9bcc366ede7803d511f.
This reverts commit b4ba16fe189b109144aff669e11d81365160104b.
This reverts commit 694ec1deea36e366b28b6349a52be49824e1a1a8.
This reverts commit 6b34de8eba9f66882ae16e6073af28783670ac53.
This reverts commit aa1cd02a4367834026ea2205ea13a2f904455aa1.
This reverts commit 308fd311ea6fcf3094b448df7f2b264f08e4fe4f.
This reverts commit 16203b53e1822a37b6ba6f2ab198bb435d05fdad.
This reverts commit 738fb5ca5412f5e833a7fab82b11519e635a3357.
This reverts commit 9fdbefacd3c382d731aa175b7bdc002ec9cb2b30.
This reverts commit cd4a7c1d90562ebb5f89caf94d00d579631b9fbe.
This reverts commit 928685eba2b2f0ded90e7f78fd806ea164002f6e.
This reverts commit 01e5ffc85cd4357fd7b5b7ceefa29f2d10ca26b7.

show more ...

unserialize: Strictly check for `:{` at object start (#10214)

* unserialize: Strictly check for `:{` at object start

* unserialize: Update CVE tests

It's unlikely that the

unserialize: Strictly check for `:{` at object start (#10214)

* unserialize: Strictly check for `:{` at object start

* unserialize: Update CVE tests

It's unlikely that the object syntax error contributed to the actual CVE. The
CVE is rather caused by the incorrect object serialization data of the `C`
format. Add a second string without such a syntax error to ensure that path is
still executed as well to ensure the CVE is absent.

* Fix test expectation in gmp/tests/bug74670.phpt

No changes to the input required, because the test actually is intended to
verify the behavior for a missing `}`, it's just that the report position changed.

* NEWS

* UPGRADING

show more ...

ext/{standard,json,random,...}: add missing includes

Promote unserialize() notices to warning (#9629)

* Unserialize: Migrate "Unexpected end of serialized data" to E_WARNING

* Unserialize: Migrate "Error at offset %d of %d bytes" to E

Promote unserialize() notices to warning (#9629)

* Unserialize: Migrate "Unexpected end of serialized data" to E_WARNING

* Unserialize: Migrate "Error at offset %d of %d bytes" to E_WARNING

* Unserialize: Migrate "%s is returned from __sleep() multiple times" to E_WARNING

* Add NEWS for “Promote unserialize() notices to warning”

show more ...

Use function HT_IS_PACKED where it's missing (#9658)

Fix memory leak triggered by unsuccessful dynamic property unserialization

Closes GH-9468

Fix GH-9186 @strict-properties can be bypassed using unserialization (#9354)

* Emit deprecation warnings when adding dynamic properties to classes during unserialization - this will become a

Fix GH-9186 @strict-properties can be bypassed using unserialization (#9354)

* Emit deprecation warnings when adding dynamic properties to classes during unserialization - this will become an Error in php 9.0.
(Adding dynamic properties in other contexts was already a deprecation warning - the use case of unserialization was overlooked)
* Throw an error when attempting to add a dynamic property to a `readonly` class when unserializing
* Add new serialization methods `__serialize`/`__unserialize` for SplFixedArray to avoid creating deprecated dynamic
properties that would then be added to the backing fixed-size array
* Don't add named dynamic/declared properties (e.g. $obj->foo) of SplFixedArray to the backing array when unserializing
* Update tests to declare properties or to expect the deprecation warning
* Add news entry

Co-authored-by: Tyson Andre <tysonandre775@hotmail.com>

show more ...

Remove leftover zval_ptr_dtor

This should have been dropped as part of
a8254ed57685c134073f41251365dc901c1b0ab8.

Simplify unserialize_callback_func handling

Fix bug #81142 by adding zend_string_init_existing_interned()

Add a new interned string handler that fetches an interned string
if it exists, but does not create one if it does not (and

Fix bug #81142 by adding zend_string_init_existing_interned()

Add a new interned string handler that fetches an interned string
if it exists, but does not create one if it does not (and instead
returns a non-interned string).

This fixes bug #81142, by preventing the creating of new interned
strings for unserialized array keys.

Closes GH-7360.

show more ...

Add ZEND_ACC_NOT_SERIALIZABLE flag

This prevents serialization and unserialization of a class and its
children in a way that does not depend on the zend_class_serialize_deny
and zend

Add ZEND_ACC_NOT_SERIALIZABLE flag

This prevents serialization and unserialization of a class and its
children in a way that does not depend on the zend_class_serialize_deny
and zend_class_unserialize_deny handlers that will be going away
in PHP 9 together with the Serializable interface.

In stubs, `@not-serializable` can be used to set this flag.

This patch only uses the new flag for a handful of Zend classes,
converting the remainder is left for later.

Closes GH-7249.
Fixes bug #81111.

show more ...

Update http->https in license (#6945)

1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as

Update http->https in license (#6945)

1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |

show more ...

Add ZEND_CLASS_CONST_FLAGS() macro

And drop Z_ACCESS_FLAGS(). We no longer store *only* access flags
in these.

Use Fast Class Cache to speedup object unserialization

Avoid destructor call for LONG keys

Prevent call of var_push_dtor_value() on hot path.

When serialising object properties, they are oftet may override the
default values, however default values are most often scalars, inte

Prevent call of var_push_dtor_value() on hot path.

When serialising object properties, they are oftet may override the
default values, however default values are most often scalars, interned
strings or immutable arrays.

show more ...

unserialize() optimization

Implement enums

RFC: https://wiki.php.net/rfc/enumerations

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>

Closes GH-6489.

Speed up __sleep() and __wakeup() calls

Revert "Remove class validation. zend_lookup_class_ex() performs it anyway."

This reverts commit 61cf1355fd53b6556f0502510ba3e1efbd04d242.

Class name validation is only performed if

Revert "Remove class validation. zend_lookup_class_ex() performs it anyway."

This reverts commit 61cf1355fd53b6556f0502510ba3e1efbd04d242.

Class name validation is only performed if key is not passed. Here, lc_name is passed as key.

show more ...

Remove class validation. zend_lookup_class_ex() performs it anyway.

Initialize property to UNDEF on unserialize overwrite

The UNDEF marker here is important to prevent the creation of
a reference to the property currently being overwritten, which
wou

Initialize property to UNDEF on unserialize overwrite

The UNDEF marker here is important to prevent the creation of
a reference to the property currently being overwritten, which
would then leak.

This fixes oss-fuzz 6029559193534464, which was incorrectly
merged into oss-fuzz #30584 (which is reported at
https://github.com/google/oss-fuzz/issues/5211).

show more ...

Don't use unmangled name if property not found

This restores the previous behavior for this case. We'll continue
to use the mangled name, even if it does not correspond to a
declared

Don't use unmangled name if property not found

This restores the previous behavior for this case. We'll continue
to use the mangled name, even if it does not correspond to a
declared property.

This also fixes an assertion failure for the case of property
overwrite, as the add_new was not guaranteed to be "new" previously.

Fixes oss-fuzz #31045.

show more ...