Fix #72146: Integer overflow on substr_replace

Adding two `zend_long`s may overflow, and casting `size_t` to
`zend_long` may truncate; we can avoid this here by enforcing unsigned
ar

Fix #72146: Integer overflow on substr_replace

Adding two `zend_long`s may overflow, and casting `size_t` to
`zend_long` may truncate; we can avoid this here by enforcing unsigned
arithmetic.

Closes GH-7240.

show more ...

Fixed bug #80958

Missing check after zval_try_get_string().

Closes GH-6871.

Avoid signed integer overflow in substr()

Perform negation after the (size_t) cast rather than before,
so as to avoid a signed integer overflow for PHP_INT_MIN.

Fixes oss-fuzz #

Avoid signed integer overflow in substr()

Perform negation after the (size_t) cast rather than before,
so as to avoid a signed integer overflow for PHP_INT_MIN.

Fixes oss-fuzz #31069.

show more ...

Avoid direct calls to zend_cpu_supports()

While the use of zend_cpu_supports_*() is only strictly necessary
inside ifunc resolvers, where the cpu state has not been initialized
yet,

Avoid direct calls to zend_cpu_supports()

While the use of zend_cpu_supports_*() is only strictly necessary
inside ifunc resolvers, where the cpu state has not been initialized
yet, we should prefer the compiler builtins in all cases.

show more ...

Don't throw for out of bounds offsets in strspn()

Make strspn($str1, $str2, $offset, $length) behaviorally
equivalent to strspn(substr($str1, $offset, $length), $str2)
by not throwin

Don't throw for out of bounds offsets in strspn()

Make strspn($str1, $str2, $offset, $length) behaviorally
equivalent to strspn(substr($str1, $offset, $length), $str2)
by not throwing for out of bounds offset.

There have been two reports that this change cause issues,
including bug #80285.

show more ...

Normalize substr() behavior

Make the behavior of substr(), mb_substr(), iconv_substr() and
grapheme_substr() consistent when it comes to the handling of
out of bounds offsets. substr

Normalize substr() behavior

Make the behavior of substr(), mb_substr(), iconv_substr() and
grapheme_substr() consistent when it comes to the handling of
out of bounds offsets. substr() will now always clamp out of
bounds offsets to the string boundary. Cases that previously
returned false will now return an empty string. This means that
substr() itself *always* returns a string now (like mb_substr()
already did before.)

Closes GH-6182.

show more ...

Check string bounds in strspn/strcspn

strspn/strcspn are string search functions, and as such should throw
ValueError on out-of-bounds offsets, just like strpos etc do.

Promote substr_replace warnings

The implementation here was pretty confused. In reality the only
error condition it has right now is that for a string input,
from & length cannot be

Promote substr_replace warnings

The implementation here was pretty confused. In reality the only
error condition it has right now is that for a string input,
from & length cannot be arrays.

The fact that the array lengths are the same was probably supposed
to be checked for the case of array input, as it wouldn't matter
otherwise.

show more ...

Promote a few remaining errors in ext/standard

Closes GH-6110

Declare array|int and object-of-class|int types in stubs

Closes GH-6081

Co-Authored-By: Nikita Popov <nikic@php.net>

Consolidate new union type ZPP macro names

They will now follow the canonical order of types. Older macros are
left intact due to maintaining BC.

Closes GH-6112

Add "const". Move constant strings to read-only memory.

Fix UNKNOWN default values in ext/standard

Closes GH-6026

Use ZPP instead of custom type checks

We can add these types as a native type declaration to stubs as a side-effect. Closes GH-6068

Clean up strtok implementation

Store the zend_string instead of performing a copy and storing
in a zval. Also make sure the string is released immediately if
it's no longer needed. F

Clean up strtok implementation

Store the zend_string instead of performing a copy and storing
in a zval. Also make sure the string is released immediately if
it's no longer needed. Finally, avoid null pointer offset UB if
no string has been set -- though I'm wondering if this case
shouldn't be generating a warning?

show more ...

Drop a spurious zend_string_release

This should have been dropped in the refactoring.

Clean up setlocale implementation

Factor out the core logic into a separate function and drop the
"clever" code that combines iteration through variadic arguments
and arrays.

Clean up setlocale implementation

Factor out the core logic into a separate function and drop the
"clever" code that combines iteration through variadic arguments
and arrays.

This fixes bug #79829 as a side effect.

show more ...

Remove php_my_setlocale workaround

This works around a macro-expansion issue that is no longer
relevant in PHP 8.

Fix #79986: str_ireplace bug with diacritics characters

`tolower()` returns an `int`, so we must not convert to `char` which
may be `signed` and as such may be subject to overflow (actua

Fix #79986: str_ireplace bug with diacritics characters

`tolower()` returns an `int`, so we must not convert to `char` which
may be `signed` and as such may be subject to overflow (actually,
implementation defined behavior).

Closes GH-6007

show more ...

Fixed bug #79951

One branch did not release tmp_replace_entry_str.

Also reduce the scope of some variables.

Fixed bug #79849

Closes GH-5853.

Fixed bug #79817

Use *_IND macros in a few places in string.c.

Remove proto comments from C files

Closes GH-5758

Clean up some unused code (and fix some comments) in build scripts

- Fix typo in build/php.m4

- Nothing uses HAVE_INTTYPES_H; so remove check for header file

- Nothing defi

Clean up some unused code (and fix some comments) in build scripts

- Fix typo in build/php.m4

- Nothing uses HAVE_INTTYPES_H; so remove check for header file

- Nothing defines ZEND_ACCONFIG_H_NO_C_PROTOS; so remove #ifndef

- `format_money` was removed in 2019, so <monetary.h> no longer needed

- Nothing uses HAVE_NETDB_H; so remove check for header file

- Nothing checks HAVE_TERMIOS_H; so remove check for header file

(This was actually added when Wez Furlong was adding the original implementation of
PTY support in `proc_open`, since replaced.)

- Nothing checks HAVE_SYS_AUXV_H; so remove check for header file

- PHP_BUILD_DATE variable is not used for anything, so remove it

This variable was added to the Makefile, but from there, was not used for anything.
The comments suggest it was intended to allow 'reproducible builds'. Presumably,
this means that if a bug is found in a PHP binary somewhere, one could look at the
Makefile which it was built from, see the date, and then could check the same
code version out from source control. But... there can easily be multiple commits
to the repo in the same day. Also, what makes us think that the Makefile which a
binary was built from will be easily available?

Besides, ext/standard/info.c already embeds the build date and time in each binary...
but it does it using `__DATE__` and `__TIME__` (see `php_print_info`).

- Nothing checks HAVE_FINITE; so don't check for function

- Grammar fix to comment in build/php.m4

- Nothing sets $php_ldflags_add_usr_lib variable in configure, so remove conditional

This was added in 2002, when Rasmus was having difficulty building PHP on some
host and needed to have /usr/lib in the rpath. It was never documented and
probably has never been used by anyone else.

show more ...

Add helper APIs for maybe-interned string creation

Add ZVAL_CHAR/RETVAL_CHAR/RETURN_CHAR as a shortcut for using
ZVAL_INTERNED_STRING and ZSTR_CHAR.

Add zend_string_init_fast()

Add helper APIs for maybe-interned string creation

Add ZVAL_CHAR/RETVAL_CHAR/RETURN_CHAR as a shortcut for using
ZVAL_INTERNED_STRING and ZSTR_CHAR.

Add zend_string_init_fast() as a helper for the empty string /
one char interned string / zend_string_init() pattern.

Also add corresponding ZVAL_STRINGL_FAST etc macros.

Closes GH-5684.

show more ...