Fix GH-13931: Applying zero offset to null pointer in Zend/zend_opcode.c

In the test cases, the compiler bails out due to a fatal error.
The data structures used by the compiler will con

Fix GH-13931: Applying zero offset to null pointer in Zend/zend_opcode.c

In the test cases, the compiler bails out due to a fatal error.
The data structures used by the compiler will contain stale values.
In particular, for the test case CG(loop_var_stack) will contain data.
The next compilation will incorrectly use elements from the previous
stack.
To solve this, we reset part of the compiler data structures.
We don't do a full re-initialization via init_compiler() because that will
also reset streams and resources.

Closes GH-13938.

show more ...

Add the last few remaining constants to stubs (#13751)

Basically all constants are now declared via stubs. The rest of the constants are either deprecated (`SID` or `MHASH_*`) or out of inte

Add the last few remaining constants to stubs (#13751)

Basically all constants are now declared via stubs. The rest of the constants are either deprecated (`SID` or `MHASH_*`) or out of interest (`__COMPILER_HALT_OFFSET__` and `PHP_CLI_PROCESS_TITLE`).

show more ...

Fix missing syntax error message in cli-server router script

Fixes GH-13113
Closes GH-13275

Fix GH-13142: Undefined variable name is shortened when contains \0

Uses the new %S formatter and introduces the necessary changes and
helpers.

Introduce %S modifier and use it (#13168)

Fix GH-13097: Anonymous class reference in trigger_error / thrown Exception

Closes GH-13153.

Fix in-place modification of filename in php_message_handler_for_zend

php_strip_url_passwd modifies url in-place. We cannot assume from
php_message_handler_for_zend that data is a tempor

Fix in-place modification of filename in php_message_handler_for_zend

php_strip_url_passwd modifies url in-place. We cannot assume from
php_message_handler_for_zend that data is a temporary, modifiable string.

Fixes oss-fuzz #64209
Closes GH-12733

show more ...

Add php_version and php_version_id PHPAPI funcs (#11875)

Mostly, extensions will use `PHP_VERSION` and `PHP_VERSION_ID`
respectfully but sometimes they want to grab the version at run-ti

Add php_version and php_version_id PHPAPI funcs (#11875)

Mostly, extensions will use `PHP_VERSION` and `PHP_VERSION_ID`
respectfully but sometimes they want to grab the version at run-time
rather than at compile-time. For example, extensions which distribute
pre-built binaries may want this.

show more ...

More usage of known zend_str instead of C string (#11381)

Fix GH-11141: Could not open input file: should be sent to stderr

I grepped for php_printf cases in main/ and sapi/ and converted the
cases which clearly indicate errors to fprintf(stder

Fix GH-11141: Could not open input file: should be sent to stderr

I grepped for php_printf cases in main/ and sapi/ and converted the
cases which clearly indicate errors to fprintf(stderr, ...), like
suggested in the linked issue.

Closes GH-11163.

show more ...

[skip ci] Fix various typos and grammar issues (#11143)

Fix GH-10737: PHP 8.1.16 segfaults on line 597 of sapi/apache2handler/sapi_apache2.c

The TSRM keeps a hashtable mapping the thread IDs to the thread resource pointers.
It's possible that

Fix GH-10737: PHP 8.1.16 segfaults on line 597 of sapi/apache2handler/sapi_apache2.c

The TSRM keeps a hashtable mapping the thread IDs to the thread resource pointers.
It's possible that the thread disappears without us knowing, and then another thread
gets spawned some time later with the same ID as the disappeared thread.
Note that since it's a new thread the TSRM key pointer and cached pointer will be NULL.

The Apache request handler `php_handler()` will try to fetch some fields from the SAPI globals.
It uses a lazy thread resource allocation by calling `ts_resource(0);`.
This allocates a thread resource and sets up the TSRM pointers if they haven't been set up yet.

At least, that's what's supposed to happen. But since we are in a situation where the thread ID
still has the resources of the *old* thread associated in the hashtable,
the loop in `ts_resource_ex` will find that thread resource and assume the thread has been setup
already. But this is not the case since this thread is actually a new thread, just reusing the ID
of the old one, without any relation whatsoever to the old thread.
Because of this assumption, the TSRM pointers will not be setup, leading to a
NULL pointer dereference when trying to access the SAPI globals.

We can easily detect this scenario: if we're in the fallback path, and the pointer is NULL,
and we're looking for our own thread resource, we know we're actually reusing a thread ID.
In that case, we'll free up the old thread resources gracefully (gracefully because
there might still be resources open like database connection which need to be
shut down cleanly). After freeing the resources, we'll create the new resources for
this thread as if the stale resources never existed in the first place.
From that point forward, it is as if that situation never occurred.
The fact that this situation happens isn't that bad because a child process containing
threads will eventually be respawned anyway by the SAPI, so the stale thread resources
won't remain forever.

Note that we can't simply assign our own TSRM pointers to the existing
thread resource for our ID, since it was actually from a different thread
(just with the same ID!). Furthermore, the dynamically loaded extensions
have their own pointer, which is only set when their constructor is
called, so we'd have to call their constructor anyway...
I also tried to call the dtor and then the ctor again for those resources
on the pre-existing thread resource to reuse storage, but that didn't work properly
because other code doesn't expect something like that to happen, which breaks assumptions,
and this in turn caused Valgrind to (rightfully) complain about memory bugs.

Note 2: I also had to fix a bug in the core globals destruction because it
always assumed that the thread destroying them was the owning thread,
which on TSRM shutdown isn't always the case. A similar bug was fixed
recently with the JIT globals.

Closes GH-10863.

show more ...

Revert "Zend/zend_types.h: move `zend_rc_debug` to `zend_rc_debug.h`"

This reverts commit d6e95041e291f1f41e1da43e616c6354705464d3.

Use new ZSTR_INIT_LITERAL macro (#10879)

Implement GH-10854: TSRM should set a smarter value for expected_threads (#10867)

The tsrm_startup() function is currently always called with expected_threads = 1.
This means that the ha

Implement GH-10854: TSRM should set a smarter value for expected_threads (#10867)

The tsrm_startup() function is currently always called with expected_threads = 1.
This means that the hashtable used in the TSRM will only contain a single bucket,
and all thread resources will therefore be in the same linked list.
So it's not really a hashtable right now, even though it's supposed to be.

This patch adds a function tsrm_startup_ex() which takes the expected
thread count as an argument. It also keeps the tsrm_startup() function
so there are no BC breaks.

In the Apache SAPI we query how many threads we have, and pass that to
the tsrm_startup_ex() function.

show more ...

Zend/zend_types.h: move `zend_rc_debug` to `zend_rc_debug.h`

`zend_rc_debug` is not a type and does not really belong in
`zend_types.h`; this allows using `ZEND_RC_MOD_CHECK()` without

Zend/zend_types.h: move `zend_rc_debug` to `zend_rc_debug.h`

`zend_rc_debug` is not a type and does not really belong in
`zend_types.h`; this allows using `ZEND_RC_MOD_CHECK()` without
including the huge `zend_types.h` header and allows decoupling
circular header dependencies.

show more ...

zend_compiler, ...: use `uint8_t` instead of `zend_uchar` (#10621)

`zend_uchar` suggests that the value is an ASCII character, but here,
it's about very small integers. This is misleadi

zend_compiler, ...: use `uint8_t` instead of `zend_uchar` (#10621)

`zend_uchar` suggests that the value is an ASCII character, but here,
it's about very small integers. This is misleading, so let's use a
C99 integer instead.

On all architectures currently supported by PHP, `zend_uchar` and
`uint8_t` are identical. This change is only about code readability.

show more ...

Zend/zend_types.h: deprecate zend_bool, zend_intptr_t, zend_uintptr_t (#10597)

These types are standard C99.

For compatibility with out-of-tree extensions, keep the typedefs
in

Zend/zend_types.h: deprecate zend_bool, zend_intptr_t, zend_uintptr_t (#10597)

These types are standard C99.

For compatibility with out-of-tree extensions, keep the typedefs
in main/php.h.

show more ...

Introduce max_multipart_body_parts INI

This fixes GHSA-54hq-v5wp-fqgv DOS vulnerabality by limitting number of
parsed multipart body parts as currently all parts were always parsed.

Fix GH-8086: Introduce mail.mixed_lf_and_crlf INI

When this INI option is enabled, it reverts the line separator for
headers and message to LF which was a non conformant behavior in PHP

Fix GH-8086: Introduce mail.mixed_lf_and_crlf INI

When this INI option is enabled, it reverts the line separator for
headers and message to LF which was a non conformant behavior in PHP 7.
It is done because some non conformant MTAs fail to parse CRLF line
separator for headers and body.

This is used for mail and mb_send_mail functions.

show more ...

Revert GH-10220

Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit ecc880f491d66081298a16634629f149459706a9.
This reverts commit 588a07

Revert GH-10220

Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit ecc880f491d66081298a16634629f149459706a9.
This reverts commit 588a07f7371ee2b5fac17de147926780e427fae6.
This reverts commit f377e15751d3aa48b69cd9bcc366ede7803d511f.
This reverts commit b4ba16fe189b109144aff669e11d81365160104b.
This reverts commit 694ec1deea36e366b28b6349a52be49824e1a1a8.
This reverts commit 6b34de8eba9f66882ae16e6073af28783670ac53.
This reverts commit aa1cd02a4367834026ea2205ea13a2f904455aa1.
This reverts commit 308fd311ea6fcf3094b448df7f2b264f08e4fe4f.
This reverts commit 16203b53e1822a37b6ba6f2ab198bb435d05fdad.
This reverts commit 738fb5ca5412f5e833a7fab82b11519e635a3357.
This reverts commit 9fdbefacd3c382d731aa175b7bdc002ec9cb2b30.
This reverts commit cd4a7c1d90562ebb5f89caf94d00d579631b9fbe.
This reverts commit 928685eba2b2f0ded90e7f78fd806ea164002f6e.
This reverts commit 01e5ffc85cd4357fd7b5b7ceefa29f2d10ca26b7.

show more ...

main: add missing includes

Remove unnecessary usage of CONST_CS

Closes GH-9685.

Remove unnecessary ast eval bailout

We can just reset the filename_override to NULL in php_request_shutdown.

Closes GH-9805

Declare main constants in stubs - part 3 (#9731)