Fix zend_get_property_info_for_slot() for lazy objects (#15855)

zend_get_property_info_for_slot(obj, slot) assumes that 'slot' belongs to 'obj', but that may not be the case for lazy proxies

Fix zend_get_property_info_for_slot() for lazy objects (#15855)

zend_get_property_info_for_slot(obj, slot) assumes that 'slot' belongs to 'obj', but that may not be the case for lazy proxies.

Fortunately, the property info is often already available in path when it is needed.

For other cases, I make zend_get_property_info_for_slot() aware of lazy objects, and add zend_get_property_info_for_slot_self() for cases where the 'slot' is known to belong to the object itself.

Fixes oss-fuzz #71446

show more ...

Lazy objects

RFC: https://wiki.php.net/rfc/lazy-objects

Closes GH-15019

Fix GH-13612: Corrupted memory in destructor with weak references

Inside `zend_object_std_dtor` the weakrefs are notified after the destruction
of properties already took place. In this

Fix GH-13612: Corrupted memory in destructor with weak references

Inside `zend_object_std_dtor` the weakrefs are notified after the destruction
of properties already took place. In this test case, the destructor of an anon
class will be invoked due to the property destruction. That class has a
weak reference to its parent. This means that the destructor can access
parent properties that already have been destroyed, resulting in a UAF.
Fix this by notifying the weakrefs at the start of the object's
destruction.

Closes GH-13613.

show more ...

Introduce Zend guard recursion protection

This PR introduces a new way of recursion protection in JSON, var_dump
and friends. It fixes issue in master for __debugInfo and also improves

Introduce Zend guard recursion protection

This PR introduces a new way of recursion protection in JSON, var_dump
and friends. It fixes issue in master for __debugInfo and also improves
perf for jsonSerializable in some cases. More info can be found in
GH-10020.

Closes GH-11812

show more ...

Allow readonly properties to be reinitialized once during cloning (#10389)

RFC: https://wiki.php.net/rfc/readonly_amendments

Revert GH-10300

Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit 68ada76f9a659745f572539b72afa06fa75a866f.
his reverts commit 45384c6

Revert GH-10300

Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit 68ada76f9a659745f572539b72afa06fa75a866f.
his reverts commit 45384c6e201eda9963e2fcc18946a9446230a2d6.
This reverts commit ef7fbfd71025f034b0bfcb413efd181ce798fc1b.
This reverts commit 9b9ea0d7c696f2990a159b2a2dafbc04547dc10f.
This reverts commit f15747c26be4a2330dc0cf3ea442f53f30f84cac.
This reverts commit e883ba93c40827fafd7868517eb48e04569f76ab.
This reverts commit 7e87551c3775d26e20b06a4032a00053db6452cc.
This reverts commit 921274d2b8966641a00c0a767ae40ba7187bdffc.
This reverts commit fc1f528e5e3ee45ab17ae8dcfad6a6422ff2002d.
This reverts commit 0961715cdafb5d39124667ff94f3b56453ce71f1.
This reverts commit a93f264526e1cdade71d887800c1c448c411bfdc.
This reverts commit 72dd94e1c6d29203b8f6473317f626e6d6d6fbdc.
This reverts commit 29b2dc89645e741f91cc920964432dccd2aaef14.
This reverts commit 05c7653bba7571852f5ce6fc0d220a1a829bc4c0.
This reverts commit 5190e5c260ee05e3f3c3d1168263a1a6637441d0.
This reverts commit 6b55bf228cb2da8705737d414f394950a92d8aae.
This reverts commit 184b4a12d3215d105720d005b31e365249e2eb21.
This reverts commit 4c31b7888a561e920fd3889ba8d99368f3c2d9e6.
This reverts commit d44e9680f080b4918cfed268b96f90ea35975617.
This reverts commit 4069a5c43f419d76e1254c8e49b4cad9968a408f.

show more ...

Zend/zend_objects: include cleanup

Revert "Store default object handlers alongside the class entry"

This reverts commit 9e6eab3c139b41dc976dd5305fd1a6e387e5e27f.

Reverted along a01dd9fedaecd2e5b95bc5c2e8d6542116addea

Revert "Store default object handlers alongside the class entry"

This reverts commit 9e6eab3c139b41dc976dd5305fd1a6e387e5e27f.

Reverted along a01dd9fedaecd2e5b95bc5c2e8d6542116addeae.

show more ...

Store default object handlers alongside the class entry

Object handlers being separate from class entries is a legacy inherited from PHP 5. Today it has little benefit to keep them separate:

Store default object handlers alongside the class entry

Object handlers being separate from class entries is a legacy inherited from PHP 5. Today it has little benefit to keep them separate: in fact, accessing object handlers usually requires not-so-safe hacks.
While it is possible to swap handlers in a custom installed create_object handler, this mostly is tedious, as well as it requires allocating the object handlers struct at runtime, possibly caching it etc..

This allows extensions, which intend to observe other classes to install their own class handlers.
The life cycle of internal classes may now be simply observed by swapping the class handlers in post_startup stage.
The life cycle of userland classes may be observed by iterating over the new classes in zend_compile_file and zend_compile_string and then swapping their handlers.

In general, this would also be a first step in directly tying the object handlers to classes. Especially given that I am not aware of any case where the object handlers would be different between various instances of a given class.

Signed-off-by: Bob Weinand <bobwei9@hotmail.com>

show more ...

Use more compact representation for packed arrays.

- for packed arrays we store just an array of zvals without keys.
- the elements of packed array are accessible throuf as ht->arPacked[

Use more compact representation for packed arrays.

- for packed arrays we store just an array of zvals without keys.
- the elements of packed array are accessible throuf as ht->arPacked[i]
instead of ht->arData[i]
- in addition to general ZEND_HASH_FOREACH_* macros, we introduced similar
familied for packed (ZEND_HASH_PACKED_FORECH_*) and real hashes
(ZEND_HASH_MAP_FOREACH_*)
- introduced an additional family of macros to access elements of array
(packed or real hashes) ZEND_ARRAY_ELEMET_SIZE, ZEND_ARRAY_ELEMET_EX,
ZEND_ARRAY_ELEMET, ZEND_ARRAY_NEXT_ELEMENT, ZEND_ARRAY_PREV_ELEMENT
- zend_hash_minmax() prototype was changed to compare only values

Because of smaller data set, this patch may show performance improvement
on some apps and benchmarks that use packed arrays. (~1% on PHP-Parser)

TODO:
- sapi/phpdbg needs special support for packed arrays (WATCH_ON_BUCKET).
- zend_hash_sort_ex() may require converting packed arrays to hash.

show more ...

Fixed use-after-free introduced by ca49e53670631ed9754810d7ec6d56ede0d06cca

Stop inserting fake frames on VM stack.

Now similar "fake" frames now materialized when fetching debug
backtraces. The patch also fixes few incorrect backtraces for generators
in *.p

Stop inserting fake frames on VM stack.

Now similar "fake" frames now materialized when fetching debug
backtraces. The patch also fixes few incorrect backtraces for generators
in *.phpt tests.

show more ...

Review the usage of apostrophes in error messages

Closes GH-5590

Change GC_COLLECTABLE flag into GC_NOT_COLLECTABLE to simplify GC_MAY_LEAK() check

Back up fake_scope in zend_call_function

We regularly find new places where we forgot to reset fake_scope.
Instead of having to handle this for each caller of zend_call_function()
an

Back up fake_scope in zend_call_function

We regularly find new places where we forgot to reset fake_scope.
Instead of having to handle this for each caller of zend_call_function()
and similar APIs, handle it directly in zend_call_function().

show more ...

Add zend_call_known_function() API family

This adds the following APIs:

void zend_call_known_function(
zend_function *fn, zend_object *object, zend_class_entry *called_scope

Add zend_call_known_function() API family

This adds the following APIs:

void zend_call_known_function(
zend_function *fn, zend_object *object, zend_class_entry *called_scope,
zval *retval_ptr, int param_count, zval *params);

void zend_call_known_instance_method(
zend_function *fn, zend_object *object, zval *retval_ptr, int param_count, zval *params);
void zend_call_known_instance_method_with_0_params(
zend_function *fn, zend_object *object, zval *retval_ptr);
void zend_call_known_instance_method_with_1_params(
zend_function *fn, zend_object *object, zval *retval_ptr, zval *param);
void zend_call_known_instance_method_with_2_params(
zend_function *fn, zend_object *object, zval *retval_ptr, zval *param1, zval *param2);

These are used to perform a call if you already have the
zend_function you want to call. zend_call_known_function()
is the base API, the rest are just really thin wrappers around
it for the common case of instance method calls.

Closes GH-5692.

show more ...

Merge branch 'PHP-7.4'

* PHP-7.4:
Fix bug #78226: Don't call __set() on uninitialized typed properties

Fix bug #78226: Don't call __set() on uninitialized typed properties

Assigning to an uninitialized typed property will no longer trigger
a call to __set(). However, calls to __set() are

Fix bug #78226: Don't call __set() on uninitialized typed properties

Assigning to an uninitialized typed property will no longer trigger
a call to __set(). However, calls to __set() are still triggered if
the property is explicitly unset().

This gives us both the behavior people generally expect, and still
allows ORMs to do lazy initialization by unsetting properties.

For PHP 8, we should fine a way to forbid unsetting of declared
properties entirely, and provide a different way to achieve lazy
initialization.

show more ...

Use ZEND_TYPE_IS_SET() when checking for property types

Instead of a simple if or 0 comparison. This would no longer work
if zend_type is a struct.

Merge branch 'PHP-7.4'

Merge branch 'PHP-7.3' into PHP-7.4

Merge branch 'PHP-7.2' into PHP-7.3

Don't destroy properties array with unset GC type

As the properties array can also be a GC root, it might have
already been destroyed.

Merge branch 'PHP-7.4'

* PHP-7.4:
zend_weakrefs

zend_weakrefs