History log of /php-src/ext/zend_test/test.stub.php (Results 1 – 25 of 102)
Revision (<<< Hide revision tags) (Show revision tags >>>) Date Author Comments
(<<< Hide modified files)
(Show modified files >>>)
# e643129b 02-Nov-2024 Niels Dossche <7771979+nielsdos@users.noreply.github.com>

Fix GH-16628: FPM logs are getting corrupted with this log statement

zlog_buf_prefix() can return a larger length than what actually was
written due to its use of snprintf(). The code in

Fix GH-16628: FPM logs are getting corrupted with this log statement

zlog_buf_prefix() can return a larger length than what actually was
written due to its use of snprintf(). The code in
zlog_stream_prefix_ex() does not take this into account, other callers
do. What ends up happening then is that stream->length is set to the
length as if snprintf() was able to write all bytes, causing
stream->length to become larger than stream->buf.size, causing a
segfault.

In case the buffer was too small we try with a larger buffer up to a
limit of zlog_limit. This makes sure that the stream length will remain
bounded by the buffer size.

This also adds assertions to make the programmer intent clear and catch
this more easily in debug builds.

Closes GH-16680.

show more ...


# e715dd0a 05-Oct-2024 Niels Dossche <7771979+nielsdos@users.noreply.github.com>

Fixed GH-16233: Observer segfault when calling user function in internal function via trampoline

In the test, I have an internal `__call` function for `_ZendTestMagicCallForward` that calls

Fixed GH-16233: Observer segfault when calling user function in internal function via trampoline

In the test, I have an internal `__call` function for `_ZendTestMagicCallForward` that calls the global function with name `$name` via `call_user_function`.
Note that observer writes the pointer to the previously observed frame in the last temporary of the new call frame (`*prev_observed_frame`).

The following happens:
First, we call `$test->callee`, this will be handled via a trampoline with T=2 for the two arguments. The call frame is allocated at this point. This call frame is not observed because it has `ZEND_ACC_CALL_VIA_TRAMPOLINE` set. Next we use `ZEND_CALL_TRAMPOLINE` to call the trampoline, this reuses the stack frame allocated earlier with T=2, but this time it is observed. The pointer to the previous frame is written outside of the call frame because `T` is too small (should be 3). We are now in the internal function `_ZendTestMagicCallForward::__call` where we call the global function `callee`. This will push a new call frame which will overlap `*prev_observed_frame`. This value gets overwritten by `zend_init_func_execute_data` when `EX(opline)` is set because `*prev_observed_frame` overlaps with `EX(opline)`. From now on, `*prev_observed_frame` is corrupted. When `zend_observer_fcall_end` is called this will result in reading wrong value `*prev_observed_frame` into `current_observed_frame`. This causes issues in `zend_observer_fcall_end_all` leading to the segfault we observe.

Despite function with `ZEND_ACC_CALL_VIA_TRAMPOLINE` not being observed, the reuse of call frames makes problems when `T` is not large enough.
To fix this, we make sure to add 1 to `T` if `ZEND_OBSERVER_ENABLED` is true.

Closes GH-16252.

show more ...


# 72c87469 02-Jul-2024 Benjamin Eberlei

RFC: Add `#[\Deprecated]` Attribute (#11293)

see https://wiki.php.net/rfc/deprecated_attribute

Co-authored-by: Tim Düsterhus <tim@tideways-gmbh.com>
Co-authored-by: Ilija Tovilo

RFC: Add `#[\Deprecated]` Attribute (#11293)

see https://wiki.php.net/rfc/deprecated_attribute

Co-authored-by: Tim Düsterhus <tim@tideways-gmbh.com>
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>

show more ...


# 1ff277de 25-Jun-2024 Arnaud Le Blanc

Fix is_zend_ptr() for huge blocks (#14626)

is_zend_ptr() expected zend_mm_heap.huge_list to be circular, but it's in fact NULL-terminated. It could crash when at least one huge block exists

Fix is_zend_ptr() for huge blocks (#14626)

is_zend_ptr() expected zend_mm_heap.huge_list to be circular, but it's in fact NULL-terminated. It could crash when at least one huge block exists and the ptr did not belong to any block.

show more ...


# a1ea4640 19-Jun-2024 Tim Düsterhus

gen_stub: Intern the parameter name string for named arguments in internal attributes (#14595)

This is necessary because `zend_get_attribute_object()` will use the persistent
string with

gen_stub: Intern the parameter name string for named arguments in internal attributes (#14595)

This is necessary because `zend_get_attribute_object()` will use the persistent
string with the parameter name as the index for a newly created non-persistent
HashTable, which is not legal.

As parameter names are expected to be short-ish, reasonably common terms and
need to sit around in memory anyways, we might as well make them an interned
string, circumstepping the issue without needing to duplicate the parameter
name into a non-persistent string.

show more ...


# bc558bf7 09-Jun-2024 Niels Dossche <7771979+nielsdos@users.noreply.github.com>

Fix GH-11078: PHP Fatal error triggers pointer being freed was not allocated and malloc: double free for ptr errors

Although the issue was demonstrated using Curl, the issue is purely in

Fix GH-11078: PHP Fatal error triggers pointer being freed was not allocated and malloc: double free for ptr errors

Although the issue was demonstrated using Curl, the issue is purely in
the streams layer of PHP.

Full analysis is written in GH-11078 [1], but here is the brief version:
Here's what actually happens:
1) We're creating a FILE handle from a stream using the casting mechanism.
This will create a cookie-based FILE handle using funopen.
2) We're reading stream data using fread from the userspace stream. This will
temporarily set a buffer into a field _bf.base [2]. This buffer is now equal
to the upload buffer that Curl allocated and note that that buffer is owned
by Curl.
3) The fatal error occurs and we bail out from the fread function, notice how
the reset code is never executed and so the buffer will still point to
Curl's upload buffer instead of FILE's own buffer [3].
4) The resources are destroyed, this includes our opened stream and because the
FILE handle is cached, it gets destroyed as well.
In fact, the stream code calls through fclose on purpose in this case.
5) The fclose code frees the _bs.base buffer [4].
However, this is not the buffer that FILE owns but the one that Curl owns
because it isn't reset properly due to the bailout!
6) The objects are getting destroyed, and so the curl free logic is invoked.
When Curl tries to gracefully clean up, it tries to free the buffer.
But that buffer is actually already freed mistakingly by the C library!

This also explains why we can't reproduce it on Linux: this bizarre buffer
swapping only happens on macOS and BSD, not on Linux.

To solve this, we switch to an unbuffered mode for cookie-based FILEs.
This avoids any stateful problems related to buffers especially when the
bailout mechanism triggers. As streams have their own buffering
mechanism, I don't expect this to impact performance.

[1] https://github.com/php/php-src/issues/11078#issuecomment-2155616843
[2] https://github.com/apple-open-source-mirror/Libc/blob/5e566be7a7047360adfb35ffc44c6a019a854bea/stdio/FreeBSD/fread.c#L102-L103
[3] https://github.com/apple-open-source-mirror/Libc/blob/5e566be7a7047360adfb35ffc44c6a019a854bea/stdio/FreeBSD/fread.c#L117
[4] https://github.com/apple-open-source-mirror/Libc/blob/5e566be7a7047360adfb35ffc44c6a019a854bea/stdio/FreeBSD/fclose.c#L66-L67

Closes GH-14524.

show more ...


# 51379d66 06-Jun-2024 Gina Peter Banyard

Zend: Add object_init_with_constructor() API (#14440)

This will instantiate the object and execute its constructor with the given parameters.


# ebd1a366 13-May-2024 Niels Dossche <7771979+nielsdos@users.noreply.github.com>

Fix GH-14215: Cannot use FFI::load on CRLF header file with apache2handler

Some modules may reset _fmode, which causes mangling of line endings.
Always be explicit like we do in other pl

Fix GH-14215: Cannot use FFI::load on CRLF header file with apache2handler

Some modules may reset _fmode, which causes mangling of line endings.
Always be explicit like we do in other places where the native open call
is used.

Closes GH-14218.

show more ...


# b5ffac7f 30-Apr-2024 Tim Düsterhus

Add ReflectionClassConstant::isDeprecated() (#14086)

This is in preparation for php/php-src#11293 and for consistency with
ReflectionConstant::isDeprecated() that was added in php/php-sr

Add ReflectionClassConstant::isDeprecated() (#14086)

This is in preparation for php/php-src#11293 and for consistency with
ReflectionConstant::isDeprecated() that was added in php/php-src#13669.

show more ...


# f2e199e8 25-Feb-2024 Máté Kocsis

Implement "support doc comments for internal classes and functions" (#13266)

Fixes #13130


# f203edd3 30-Nov-2023 Ilija Tovilo

Fix leak of call->extra_named_params on internal __call

Fixes GH-12835
Closes GH-12836


# 78fba9cb 08-Nov-2023 Niels Dossche <7771979+nielsdos@users.noreply.github.com>

Fix GH-12628: The gh11374 test fails on Alpinelinux

Closes GH-12636.


# d4e40dc0 31-Oct-2023 Máté Kocsis

Fix GH-12558 Escape \N in generated stubs (#12562)


# 13d3564a 28-Aug-2023 Remi Collet

Fix #12063 convert PHP single-quote to C double-quote string


# c934e241 26-Dec-2022 Máté Kocsis

Fix GH-9967 Add support for generating custom function, class const, and property attributes in stubs


# 3e0e7e3f 24-Aug-2023 ju1ius

releases property attributes of internal classes (#11980)

* adds test case for internal class property attribute

* releases property attributes of internal classes


# 7f1c3bf0 18-Aug-2023 ju1ius

Adds support for DNF types in internal functions and properties (#11969)

Note that this does not add support for items generated by gen_stubs,
only for items registered dynamically via

Adds support for DNF types in internal functions and properties (#11969)

Note that this does not add support for items generated by gen_stubs,
only for items registered dynamically via the Zend API.

Closes GH-10120

show more ...


# 02a80c5b 14-Aug-2023 George Peter Banyard

Fix various bugs related to DNF types

- GH-11958: DNF types in trait properties do not get bound properly
- GH-11883: Memory leak in zend_type_release() for non-arena allocated DNF typ

Fix various bugs related to DNF types

- GH-11958: DNF types in trait properties do not get bound properly
- GH-11883: Memory leak in zend_type_release() for non-arena allocated DNF types
- Internal trait bound to userland class would not be arena allocated
- Property DNF types were not properly deep copied during lazy loading

Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: ju1ius <jules.bernable@gmail.com>

show more ...


# 65a02f48 02-Aug-2023 George Peter Banyard

ext/zend_test: Move object handler test objects to their own file (#11852)


# 62228a25 31-Jul-2023 Niels Dossche <7771979+nielsdos@users.noreply.github.com>

Disable global state test on Windows

It looks like the config.w32 uses CHECK_HEADER_ADD_INCLUDE to add the include
path to libxml into the search path.
That doesn't happen in zend-te

Disable global state test on Windows

It looks like the config.w32 uses CHECK_HEADER_ADD_INCLUDE to add the include
path to libxml into the search path.
That doesn't happen in zend-test.
To add to the Windows trouble, libxml is statically linked in, ext/libxml can
only be built statically but ext/zend-test can be built both statically and
dynamically.
So the regression tests won't work in all possible configurations anyway on Windows.
All of this is no problem on Linux because it just uses dynamic linking
and pkg-config, without any magic.

Signed-off-by: Ben Ramsey <ramsey@php.net>

show more ...


# c283c3ab 15-Jul-2023 Niels Dossche <7771979+nielsdos@users.noreply.github.com>

Sanitize libxml2 globals before parsing

Fixes GHSA-3qrf-m4j2-pcrr.

To parse a document with libxml2, you first need to create a parsing context.
The parsing context contains par

Sanitize libxml2 globals before parsing

Fixes GHSA-3qrf-m4j2-pcrr.

To parse a document with libxml2, you first need to create a parsing context.
The parsing context contains parsing options (e.g. XML_NOENT to substitute
entities) that the application (in this case PHP) can set.
Unfortunately, libxml2 also supports providing default set options.
For example, if you call xmlSubstituteEntitiesDefault(1) then the XML_NOENT
option will be added to the parsing options every time you create a parsing
context **even if the application never requested XML_NOENT**.

Third party extensions can override these globals, in particular the
substitute entity global. This causes entity substitution to be
unexpectedly active.

Fix it by setting the parsing options to a sane known value.
For API calls that depend on global state we introduce
PHP_LIBXML_SANITIZE_GLOBALS() and PHP_LIBXML_RESTORE_GLOBALS().
For other APIs that work directly with a context we introduce
php_libxml_sanitize_parse_ctxt_options().

show more ...


# 9bcdf219 31-Mar-2023 Ilija Tovilo

Resolve open_basedir paths on ini update

Closes GH-10987


# d8696f92 17-Jul-2023 George Peter Banyard

[RFC] Path to Saner Increment/Decrement operators (#10358)

* Add behavioural tests for incdec operators

* Add support to ++/-- for objects castable to _IS_NUMBER

* Add str_

[RFC] Path to Saner Increment/Decrement operators (#10358)

* Add behavioural tests for incdec operators

* Add support to ++/-- for objects castable to _IS_NUMBER

* Add str_increment() function

* Add str_decrement() function

RFC: https://wiki.php.net/rfc/saner-inc-dec-operators

Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Arnaud Le Blanc <arnaud.lb@gmail.com>

show more ...


# 7b355e8d 04-Jul-2023 Ilija Tovilo

Revert "Merge branch 'PHP-8.2'"

This reverts commit 45a3f178dc226b69f5d72f10285bc2ad139b2c1c, reversing
changes made to b2a54bc6af4bf645b5bb2601621c12b31bfbff0c.


# d7ab0ff0 03-Jul-2023 Máté Kocsis

Fix GH-9967 Add support for generating custom function, class const, and property attributes in stubs


12345