Stop using reserved names

Remove unused arguments from _external_entity_ref_handler()

Fix bug #81481 (xml_get_current_byte_index limited to 32-bit numbers on 64-bit builds) (#14845)

The return value is long in both expat and expat2 (with XML_LARGE_SIZE
not set).

Fix GH-14834: Error installing PHP when --with-pear is used

libxml2 2.13 makes changes to how the parsing state is set, update our
code accordingly. In particular, it started reporting e

Fix GH-14834: Error installing PHP when --with-pear is used

libxml2 2.13 makes changes to how the parsing state is set, update our
code accordingly. In particular, it started reporting entities within
attributes, while it should only report entities inside text nodes.

Closes GH-14837.

show more ...

Stop setting parse options directly

Setting this directly will be deprecated in libxml2 2.14.

Stop relying on lastError directly

Reading this directly will become deprecated in libxml2 2.14.

Stop relying on the sax2 flag directly

Setting this directly will become deprecated in libxml2 2.14.

Port XML_GetCurrentByteIndex to public APIs

This is necessary to avoid a deprecation break in libxml2 2.14.x.

Backport libxml2 2.13.2 fixes (#14816)

Backproted from https://github.com/php/php-src/pull/14789

Avoid pointless duplication in _end_element_handler

Remove unused code from xml/compat.c

Fix compilation on libxml2 2.13

Fix GH-14637: memory leak after failed heap allocation due to mem limit. (#14641)

Use size_t for string lengths in ext/xml compat layer (#12808)

This is _not_ exploitable right now because libxml guarantees right now
a maximum string length of 1M bytes. But if that li

Use size_t for string lengths in ext/xml compat layer (#12808)

This is _not_ exploitable right now because libxml guarantees right now
a maximum string length of 1M bytes. But if that limit were to ever
change this could overflow in the future leading to exploits.
Again, not exploitable right now, but just making it more future-proof.

show more ...

Sanitize libxml2 globals before parsing

Fixes GHSA-3qrf-m4j2-pcrr.

To parse a document with libxml2, you first need to create a parsing context.
The parsing context contains par

Sanitize libxml2 globals before parsing

Fixes GHSA-3qrf-m4j2-pcrr.

To parse a document with libxml2, you first need to create a parsing context.
The parsing context contains parsing options (e.g. XML_NOENT to substitute
entities) that the application (in this case PHP) can set.
Unfortunately, libxml2 also supports providing default set options.
For example, if you call xmlSubstituteEntitiesDefault(1) then the XML_NOENT
option will be added to the parsing options every time you create a parsing
context **even if the application never requested XML_NOENT**.

Third party extensions can override these globals, in particular the
substitute entity global. This causes entity substitution to be
unexpectedly active.

Fix it by setting the parsing options to a sane known value.
For API calls that depend on global state we introduce
PHP_LIBXML_SANITIZE_GLOBALS() and PHP_LIBXML_RESTORE_GLOBALS().
For other APIs that work directly with a context we introduce
php_libxml_sanitize_parse_ctxt_options().

show more ...

Merge branch 'PHP-8.0'

* PHP-8.0:
Fix #81351: xml_parse may fail, but has no error code

Merge branch 'PHP-7.4' into PHP-8.0

* PHP-7.4:
Fix #81351: xml_parse may fail, but has no error code

Fix #81351: xml_parse may fail, but has no error code

The fix for bug #73151[1] cured the symptoms, but not the root cause,
namely xmlParse() must not be called recursively. Since that

Fix #81351: xml_parse may fail, but has no error code

The fix for bug #73151[1] cured the symptoms, but not the root cause,
namely xmlParse() must not be called recursively. Since that bugfix
also messed up the error handling, we basically revert it (but also
simplify the return), and then prevent calling the parser recursively.

[1] <https://github.com/php/php-src/pull/2166/commits/f2a8a8c068995a5d780882c556cedd53bce3827d>

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>

Closes GH-7363.

show more ...

Fixed some spaces used instead of tabs

Update http->https in license (#6945)

1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as

Update http->https in license (#6945)

1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |

show more ...

Remove mention of PHP major version in Copyright headers

Closes GH-4732.

Remove local variables

This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly

Remove local variables

This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly used by Vim and Emacs editors
yet with recent changes the once working definitions don't work
anymore in Vim without custom plugins or additional configuration.
Neither are these settings synced across the PHP code base.

A simpler and better approach is EditorConfig and fixing code
using some code style fixing tools in the future instead.

This patch also removes the so called modelines for Vim. Modelines
allow Vim editor specifically to set some editor configuration such as
syntax highlighting, indentation style and tab width to be set in the
first line or the last 5 lines per file basis. Since the php test
files have syntax highlighting already set in most editors properly and
EditorConfig takes care of the indentation settings, this patch removes
these as well for the Vim 6.0 and newer versions.

With the removal of local variables for certain editors such as
Emacs and Vim, the footer is also probably not needed anymore when
creating extensions using ext_skel.php script.

Additionally, Vim modelines for setting php syntax and some editor
settings has been removed from some *.phpt files. All these are
mostly not relevant for phpt files neither work properly in the
middle of the file.

show more ...

Remove yearly range from copyright notice

Merge branch 'PHP-7.3'

* PHP-7.3:
Fix #71592: External entity processing never fails

Fix #71592: External entity processing never fails

If the callback set via `xml_set_external_entity_ref_handler()` returns
a falsy value, parsing is supposed to stop and the error number

Fix #71592: External entity processing never fails

If the callback set via `xml_set_external_entity_ref_handler()` returns
a falsy value, parsing is supposed to stop and the error number set to
`XML_ERROR_EXTERNAL_ENTITY_HANDLING`. This is already correctly done
by the libexpat binding, but the libxml2 binding ignores the return
value. We fix this by calling `xmlStopParser()` which is available as
of libxml 2.1.0[1] (PHP-7.1 requires at least libxml 2.6.11 anyway),
and setting the desired `errNo` ourselves.

[1] <http://xmlsoft.org/news.html>

show more ...