Fix leak of call->extra_named_params on internal __call

Fixes GH-12835
Closes GH-12836

Merge branch 'PHP-8.1' into PHP-8.2

Fix invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC (#12768)

* fix segfault in `ZEND_BIND_STATIC`

In case a `ZEND_BIND_STATIC` is being executed, while

Fix invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC (#12768)

* fix segfault in `ZEND_BIND_STATIC`

In case a `ZEND_BIND_STATIC` is being executed, while the current chunk is full,
the `zend_array_dup()` call will trigger a OOM in ZendMM which will crash, as
the opline might be a dangling pointer.

* add missing test

* `assert()`ing seems easier than trying to make the compiler to not optimize

* moved from function call to INI setting, so we can use this in other places as well

* make `assert()` work no NDEBUG builds

* document magic number

* fix segfault in `ZEND_FUNC_GET_ARGS`

In case a `ZEND_FUNC_GET_ARGS` is being executed, while the current chunk is
full, the `zend_new_array()` call will trigger a OOM in ZendMM which will crash,
as the opline might be a dangling pointer.

---------

Co-authored-by: Florian Engelhardt <florian@engelhardt.tc>

show more ...

Fix use-after-free of name in var-var with malicious error handler

Fixes oss-fuzz #54325
Closes GH-12732

Fix use-after-free of name in var-var with malicious error handler

Fixes oss-fuzz #54325
Closes GH-12732

Merge branch 'PHP-8.1' into PHP-8.2

* PHP-8.1:
Fixed uninitialized EX(opline) access (possible Zend/tests/gh12073.phpt crash)

Fixed uninitialized EX(opline) access (possible Zend/tests/gh12073.phpt crash)

Merge branch 'PHP-8.1' into PHP-8.2

* PHP-8.1:
Keep consistent EG(current_execute_data) after return from generator (#11380)

Keep consistent EG(current_execute_data) after return from generator (#11380)

Merge branch 'PHP-8.1' into PHP-8.2

* PHP-8.1:
Allow FETCH_OBJ_W and FETCH_STATIC_PROP_W to return INDIRECT/UNDEF zval for uninitialized typed properties (#11048)

Allow FETCH_OBJ_W and FETCH_STATIC_PROP_W to return INDIRECT/UNDEF zval for uninitialized typed properties (#11048)

Merge branch 'PHP-8.1' into PHP-8.2

* PHP-8.1:
Fix strlen error message param name

Fix strlen error message param name

Revert "Remove useless UNEXPECTED around RETURN_VALUE_USED in specialized RETVAL handler"

This reverts commit 5b801612cb33d238a5dafbe04374dadc6e3a9f35.

Merge branch 'PHP-8.1' into PHP-8.2

* PHP-8.1:
Revert "Fix GH-10168: heap-buffer-overflow at zval_undefined_cv"

Revert "Fix GH-10168: heap-buffer-overflow at zval_undefined_cv"

This reverts commit 71ddede5655fe654002ae18af6a18e033f717287.

Merge branch 'PHP-8.1' into PHP-8.2

* PHP-8.1:
Fix GH-10168: heap-buffer-overflow at zval_undefined_cv

Fix GH-10168: heap-buffer-overflow at zval_undefined_cv

The problem is that we're using the variable_ptr in the opcode handler
*after* it has already been destroyed. The solution is to c

Fix GH-10168: heap-buffer-overflow at zval_undefined_cv

The problem is that we're using the variable_ptr in the opcode handler
*after* it has already been destroyed. The solution is to create a
specialised version of zend_assign_to_variable which takes in two
destination zval pointers.

Closes GH-10524

show more ...

Merge branch 'PHP-8.1' into PHP-8.2

* PHP-8.1:
[ci skip] NEWS
Fix GH-10248: Assertion `!(zval_get_type(&(*(property))) == 10)' failed.

Merge branch 'PHP-8.1' into PHP-8.2

* PHP-8.1:
Fix incorrect check condition in ZEND_YIELD

Fix incorrect check condition in ZEND_YIELD

The condition `UNEXPECTED(Z_TYPE_P(key)) == IS_REFERENCE` always
returned false, because `UNEXPECTED(expression)` always returns 0 or 1.
M

Fix incorrect check condition in ZEND_YIELD

The condition `UNEXPECTED(Z_TYPE_P(key)) == IS_REFERENCE` always
returned false, because `UNEXPECTED(expression)` always returns 0 or 1.
Move the parens so the comparison is executed properly.

Closes GH-10332.

show more ...

Merge branch 'PHP-8.1' into PHP-8.2

Fix GH-10072: PHP crashes when execute_ex is overridden and a __call trampoline is used from internal code

Don't check "fake" closures (fix assertion)

Fixes oss-fuzz #53078

Merge branch 'PHP-8.1' into PHP-8.2

* PHP-8.1:
[ci skip] NEWS
[ci skip] NEWS
Fix compilation warning
Fix crash when memory limit is exceeded during generator initiali

Merge branch 'PHP-8.1' into PHP-8.2

* PHP-8.1:
[ci skip] NEWS
[ci skip] NEWS
Fix compilation warning
Fix crash when memory limit is exceeded during generator initialization

show more ...