Fixed CURLOPT_TLSAUTH_TYPE is not treated as a string option.

Avoid dangling pointer in curl header.str

If buf_len is zero, this would leave behind a dangling pointer
to an already released header.str. Make sure this can't happen
by always over

Avoid dangling pointer in curl header.str

If buf_len is zero, this would leave behind a dangling pointer
to an already released header.str. Make sure this can't happen
by always overwriting the pointer.

Closes GH-7376.

show more ...

Fix curl_copy_handle() with CURLINFO_HEADER_OUT

The CURLOPT_DEBUGDATA will point to the old curl handle after
copying. Update it to point to the new handle.

We don't separately

Fix curl_copy_handle() with CURLINFO_HEADER_OUT

The CURLOPT_DEBUGDATA will point to the old curl handle after
copying. Update it to point to the new handle.

We don't separately store whether CURLINFO_HEADER_OUT is enabled,
so I'm doing this unconditionally. It should be harmless if
CURLOPT_DEBUGFUNCTION is not used.

show more ...

Mark resource-like objects as non-comparable

As these hold on to some internal resource, there can't be two
"equal" objects with different identity. Make sure the lack of
public prop

Mark resource-like objects as non-comparable

As these hold on to some internal resource, there can't be two
"equal" objects with different identity. Make sure the lack of
public properties doesn't result in these being treated as always
equal.

show more ...

Add missing derefs in CurlFile

As pointed out on GH-6456.

Fix #80595: Resetting POSTFIELDS to empty array breaks request

This is mainly to work around https://github.com/curl/curl/issues/6455,
but not building the mime structure for empty hasht

Fix #80595: Resetting POSTFIELDS to empty array breaks request

This is mainly to work around https://github.com/curl/curl/issues/6455,
but not building the mime structure for empty hashtables is a general
performance optimization, so we do not restrict it to affected cURL
versions (7.56.0 to 7.75.0).

The minor change to bug79033.phpt is unexpected, but should not matter
in practice.

Closes GH-6606.

show more ...

Retain reference to share handle from curl handle

Not keeping a reference will not result in use after free, because
curl protects against it, but it will result in a memory leak,
be

Retain reference to share handle from curl handle

Not keeping a reference will not result in use after free, because
curl protects against it, but it will result in a memory leak,
because curl_share_cleanup() will fail. We should make sure that
the share handle object stays alive as long as the curl handles
use it.

show more ...

Fixed bug #80121

The issue affected both CurlHandle and CurlMultiHandle. I'll have
to double check this for other resource->object conversions as well.

Make null byte error a ValueError

Currently we treat paths with null bytes as a TypeError, which is
incorrect, and rather inconsistent, as we treat empty paths as
ValueError. We do t

Make null byte error a ValueError

Currently we treat paths with null bytes as a TypeError, which is
incorrect, and rather inconsistent, as we treat empty paths as
ValueError. We do this because the error is generated by zpp and
it's easier to always throw TypeError there.

This changes the zpp implementation to throw a TypeError only if
the type is actually wrong and throw ValueError for null bytes.
The error message is also split accordingly, to be more precise.

Closes GH-6094.

show more ...

Private/public split curl header

To allow exporting the php_curl.h header containing curl class
entries, split off a separate curl_private.h header with all the
implementation detail

Private/public split curl header

To allow exporting the php_curl.h header containing curl class
entries, split off a separate curl_private.h header with all the
implementation details.

We may move or expose additional APIs in php_curl.h on an as-needed
basis.

show more ...

Remove some unnecessary HAVE_EXTNAME guards

A recurring pattern in old extension: Putting the whole source
code behind HAVE_EXTNAME. This is pointless, as the code is only
compiled i

Remove some unnecessary HAVE_EXTNAME guards

A recurring pattern in old extension: Putting the whole source
code behind HAVE_EXTNAME. This is pointless, as the code is only
compiled if the extension is enabled.

This removes a couple of them, but not all.

show more ...

Promote warnings to exceptions in ext/curl

Closes GH-5963

Accept zend_object in zend_read_property

Implement named parameters

From an engine perspective, named parameters mainly add three
concepts:

* The SEND_* opcodes now accept a CONST op2, which is the
argument nam

Implement named parameters

From an engine perspective, named parameters mainly add three
concepts:

* The SEND_* opcodes now accept a CONST op2, which is the
argument name. For now, it is looked up by linear scan and
runtime cached.
* This may leave UNDEF arguments on the stack. To avoid having
to deal with them in other places, a CHECK_UNDEF_ARGS opcode
is used to either replace them with defaults, or error.
* For variadic functions, EX(extra_named_params) are collected
and need to be freed based on ZEND_CALL_HAS_EXTRA_NAMED_PARAMS.

RFC: https://wiki.php.net/rfc/named_params

Closes GH-5357.

show more ...

Remove no_separation flag

Disallow separation in a number of callbacks

All of these clearly do not need separation support.

Remove proto comments from C files

Closes GH-5758

Don't accept objects instead of arrays in curl

This properly addresses the issue from bug #79741. Silently
interpreting objects as mangled property tables is almost
always a bad idea

Don't accept objects instead of arrays in curl

This properly addresses the issue from bug #79741. Silently
interpreting objects as mangled property tables is almost
always a bad idea.

Closes GH-5773.

show more ...

Fixed bug #79741

Add flag to forbid dynamic property creation on internal classes

While performing resource -> object migrations, we're adding
defensive classes that are final, non-serializable and non-c

Add flag to forbid dynamic property creation on internal classes

While performing resource -> object migrations, we're adding
defensive classes that are final, non-serializable and non-clonable
(unless they are, of course). This path adds a ZEND_ACC_NO_DYNAMIC_PROPERTIES
flag, that also forbids the creation of dynamic properties on these objects.
This is a subset of #3931 and targeted at internal usage only
(though may be extended to userland at some point in the future).

It's already possible to achieve this (what the removed
WeakRef/WeakMap code does), but there's some caveats: First, this
simple approach is only possible if the class has no declared
properties, otherwise it's necessary to special-case those
properties. Second, it's easy to make it overly strict, e.g. by
forbidding isset($obj->prop) as well. And finally, it requires a
lot of boilerplate code for each class.

Closes GH-5572.

show more ...

Also allow casting CurlMultiHandles

Allow casting CurlHandle to int

(int) $curlHandle will return spl_object_id($curlHandle). This
makes curl handle objects backwards compatible with code using
(int) $curlHandle to obt

Allow casting CurlHandle to int

(int) $curlHandle will return spl_object_id($curlHandle). This
makes curl handle objects backwards compatible with code using
(int) $curlHandle to obtain a resource ID.

Closes GH-5743.

show more ...

Fix UNKNOWN default values in ext/curl

Closes GH-5734

Remove the deprecated parameter of curl_version()

Convert CURL resources to objects

Closes GH-5402

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>