Skip to content

Commit 0291312

Browse files
dwgeblerdwgebler
committed
Merge branch 'master' of https://github.com/php/php-src into dave/allow-compat-il-flag
2 parents ee63845 + 8c00c91 commit 0291312

File tree

13 files changed

+94
-54
lines changed

13 files changed

+94
-54
lines changed

‎Zend/zend_object_handlers.h

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,9 +110,29 @@ typedef zend_array *(*zend_object_get_properties_for_t)(zend_object *object, zen
110110
typedef zend_function *(*zend_object_get_method_t)(zend_object **object, zend_string *method, const zval *key);
111111
typedef zend_function *(*zend_object_get_constructor_t)(zend_object *object);
112112

113-
/* Object maintenance/destruction */
114-
typedef void (*zend_object_dtor_obj_t)(zend_object *object);
113+
/* free_obj should release any resources the object holds, without freeing the
114+
* object structure itself. The object does not need to be in a valid state after
115+
* free_obj finishes running.
116+
*
117+
* free_obj will always be invoked, even if the object leaks or a fatal error
118+
* occurs. However, during shutdown it may be called once the executor is no
119+
* longer active, in which case execution of user code may be skipped.
120+
*/
115121
typedef void (*zend_object_free_obj_t)(zend_object *object);
122+
123+
/* dtor_obj is called before free_obj. The object must remain in a valid state
124+
* after dtor_obj finishes running. Unlike free_obj, it is run prior to
125+
* deactivation of the executor during shutdown, which allows user code to run.
126+
*
127+
* This handler is not guaranteed to be called (e.g. on fatal error), and as
128+
* such should not be used to release resources or deallocate memory. Furthermore,
129+
* releasing resources in this handler can break detection of memory leaks, as
130+
* cycles may be broken early.
131+
*
132+
* dtor_obj should be used *only* to call user destruction hooks, such as __destruct.
133+
*/
134+
typedef void (*zend_object_dtor_obj_t)(zend_object *object);
135+
116136
typedef zend_object* (*zend_object_clone_obj_t)(zend_object *object);
117137

118138
/* Get class name for display in var_dump and other debugging functions.

‎azure/community_job.yml

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -51,10 +51,7 @@ jobs:
5151
- script: |
5252
git clone https://github.com/laravel/framework.git --branch=master --depth=1
5353
cd framework
54-
#php7.3 /usr/bin/composer require "doctrine/dbal:^3.0" --no-interaction
55-
php7.3 /usr/bin/composer install --no-progress
56-
# Hack to disable a test that hangs on azure
57-
sed -i 's/PHP_OS/"Darwin"/' tests/Filesystem/FilesystemTest.php
54+
php7.4 /usr/bin/composer install --no-progress
5855
export USE_ZEND_ALLOC=0
5956
export ASAN_OPTIONS=exitcode=139
6057
php vendor/bin/phpunit
@@ -65,8 +62,8 @@ jobs:
6562
- script: |
6663
git clone https://github.com/symfony/symfony.git --depth=1
6764
cd symfony
68-
php7.3 /usr/bin/composer install --no-progress
69-
php7.3 ./phpunit install
65+
php7.4 /usr/bin/composer install --no-progress
66+
php7.4 ./phpunit install
7067
export USE_ZEND_ALLOC=0
7168
export USE_TRACKED_ALLOC=1
7269
export ASAN_OPTIONS=exitcode=139
@@ -96,14 +93,14 @@ jobs:
9693
export USE_ZEND_ALLOC=0
9794
export USE_TRACKED_ALLOC=1
9895
export ASAN_OPTIONS=exitcode=139
99-
php7.3 /usr/bin/composer install --no-progress
96+
php7.4 /usr/bin/composer install --no-progress
10097
php ./phpunit
10198
if [ $? -gt 128 ]; then
10299
exit 1
103100
fi
104101
displayName: 'Test PHPUnit'
105102
- script: |
106-
php7.3 /usr/bin/composer create-project symfony/symfony-demo symfony_demo --no-progress
103+
php7.4 /usr/bin/composer create-project symfony/symfony-demo symfony_demo --no-progress
107104
cd symfony_demo
108105
export USE_ZEND_ALLOC=0
109106
export USE_TRACKED_ALLOC=1

‎ext/curl/interface.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2018,6 +2018,7 @@ static inline int build_mime_structure_from_hash(php_curl *ch, zval *zpostfields
20182018
#endif
20192019

20202020
prop = zend_read_property(curl_CURLFile_class, Z_OBJ_P(current), "name", sizeof("name")-1, 0, &rv);
2021+
ZVAL_DEREF(prop);
20212022
if (Z_TYPE_P(prop) != IS_STRING) {
20222023
php_error_docref(NULL, E_WARNING, "Invalid filename for key %s", ZSTR_VAL(string_key));
20232024
} else {
@@ -2028,10 +2029,12 @@ static inline int build_mime_structure_from_hash(php_curl *ch, zval *zpostfields
20282029
}
20292030

20302031
prop = zend_read_property(curl_CURLFile_class, Z_OBJ_P(current), "mime", sizeof("mime")-1, 0, &rv);
2032+
ZVAL_DEREF(prop);
20312033
if (Z_TYPE_P(prop) == IS_STRING && Z_STRLEN_P(prop) > 0) {
20322034
type = Z_STRVAL_P(prop);
20332035
}
20342036
prop = zend_read_property(curl_CURLFile_class, Z_OBJ_P(current), "postname", sizeof("postname")-1, 0, &rv);
2037+
ZVAL_DEREF(prop);
20352038
if (Z_TYPE_P(prop) == IS_STRING && Z_STRLEN_P(prop) > 0) {
20362039
filename = Z_STRVAL_P(prop);
20372040
}

‎ext/opcache/shared_alloc_mmap.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ static int create_segments(size_t requested_size, zend_shared_segment ***shared_
5050
#endif
5151
#ifdef VM_MAKE_TAG
5252
/* allows tracking segments via tools such as vmmap */
53-
fd = VM_MAKE_TAG(251);
53+
fd = VM_MAKE_TAG(251U);
5454
#endif
5555
#ifdef MAP_HUGETLB
5656
size_t huge_page_size = 2 * 1024 * 1024;

‎ext/soap/php_sdl.c

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,8 @@ void sdl_restore_uri_credentials(sdlCtx *ctx)
313313
ctx->context = NULL;
314314
}
315315

316+
#define SAFE_STR(a) ((a)?((const char *)a):"")
317+
316318
static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
317319
{
318320
sdlPtr tmpsdl = ctx->sdl;
@@ -374,7 +376,7 @@ static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
374376
if (node_is_equal_ex(trav2, "schema", XSD_NAMESPACE)) {
375377
load_schema(ctx, trav2);
376378
} else if (is_wsdl_element(trav2) && !node_is_equal(trav2,"documentation")) {
377-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
379+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
378380
}
379381
trav2 = trav2->next;
380382
}
@@ -435,7 +437,7 @@ static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int include)
435437
soap_error0(E_ERROR, "Parsing WSDL: <service> has no name attribute");
436438
}
437439
} else if (!node_is_equal(trav,"documentation")) {
438-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
440+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
439441
}
440442
trav = trav->next;
441443
}
@@ -545,7 +547,7 @@ static sdlSoapBindingFunctionHeaderPtr wsdl_soap_binding_header(sdlCtx* ctx, xml
545547
}
546548
smart_str_free(&key);
547549
} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
548-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
550+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
549551
}
550552
trav = trav->next;
551553
}
@@ -647,7 +649,7 @@ static void wsdl_soap_binding_body(sdlCtx* ctx, xmlNodePtr node, char* wsdl_soap
647649
}
648650
smart_str_free(&key);
649651
} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
650-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
652+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
651653
}
652654
trav = trav->next;
653655
}
@@ -679,14 +681,14 @@ static HashTable* wsdl_message(sdlCtx *ctx, xmlChar* message_name)
679681
sdlParamPtr param;
680682

681683
if (trav->ns != NULL && strcmp((char*)trav->ns->href, WSDL_NAMESPACE) != 0) {
682-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected extensibility element <%s>", trav->name);
684+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected extensibility element <%s>", SAFE_STR(trav->name));
683685
}
684686
if (node_is_equal(trav,"documentation")) {
685687
trav = trav->next;
686688
continue;
687689
}
688690
if (!node_is_equal(trav,"part")) {
689-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
691+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
690692
}
691693
part = trav;
692694
param = emalloc(sizeof(sdlParam));
@@ -695,7 +697,7 @@ static HashTable* wsdl_message(sdlCtx *ctx, xmlChar* message_name)
695697

696698
name = get_attribute(part->properties, "name");
697699
if (name == NULL) {
698-
soap_error1(E_ERROR, "Parsing WSDL: No name associated with <part> '%s'", message->name);
700+
soap_error1(E_ERROR, "Parsing WSDL: No name associated with <part> '%s'", SAFE_STR(message->name));
699701
}
700702

701703
param->paramName = estrdup((char*)name->children->content);
@@ -737,9 +739,8 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
737739
zend_hash_init(&ctx.portTypes, 0, NULL, NULL, 0);
738740
zend_hash_init(&ctx.services, 0, NULL, NULL, 0);
739741

740-
load_wsdl_ex(this_ptr, struri, &ctx, 0);
741742
zend_try {
742-
743+
load_wsdl_ex(this_ptr, struri, &ctx, 0);
743744
schema_pass2(&ctx);
744745

745746
n = zend_hash_num_elements(&ctx.services);
@@ -766,7 +767,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
766767
continue;
767768
}
768769
if (!node_is_equal(trav,"port")) {
769-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
770+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
770771
}
771772

772773
port = trav;
@@ -805,7 +806,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
805806
}
806807
}
807808
if (trav2 != address && is_wsdl_element(trav2) && !node_is_equal(trav2,"documentation")) {
808-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
809+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
809810
}
810811
trav2 = trav2->next;
811812
}
@@ -907,7 +908,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
907908
continue;
908909
}
909910
if (!node_is_equal(trav2,"operation")) {
910-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav2->name);
911+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
911912
}
912913

913914
operation = trav2;
@@ -926,7 +927,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
926927
!node_is_equal(trav3,"output") &&
927928
!node_is_equal(trav3,"fault") &&
928929
!node_is_equal(trav3,"documentation")) {
929-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav3->name);
930+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav3->name));
930931
}
931932
trav3 = trav3->next;
932933
}
@@ -1104,7 +1105,7 @@ static sdlPtr load_wsdl(zval *this_ptr, char *struri)
11041105
}
11051106
}
11061107
} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
1107-
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", trav->name);
1108+
soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", SAFE_STR(trav->name));
11081109
}
11091110
trav = trav->next;
11101111
}

‎ext/soap/php_xml.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -197,7 +197,7 @@ xmlNsPtr node_find_ns(xmlNodePtr node)
197197

198198
int attr_is_equal_ex(xmlAttrPtr node, char *name, char *ns)
199199
{
200-
if (name == NULL || strcmp((char*)node->name, name) == 0) {
200+
if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 0)) {
201201
if (ns) {
202202
xmlNsPtr nsPtr = attr_find_ns(node);
203203
if (nsPtr) {
@@ -213,7 +213,7 @@ int attr_is_equal_ex(xmlAttrPtr node, char *name, char *ns)
213213

214214
int node_is_equal_ex(xmlNodePtr node, char *name, char *ns)
215215
{
216-
if (name == NULL || strcmp((char*)node->name, name) == 0) {
216+
if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 0)) {
217217
if (ns) {
218218
xmlNsPtr nsPtr = node_find_ns(node);
219219
if (nsPtr) {

‎ext/soap/tests/bug80672.phpt

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--TEST--
2+
Bug #80672 Null Dereference in SoapClient
3+
--SKIPIF--
4+
<?php require_once('skipif.inc'); ?>
5+
--FILE--
6+
<?php
7+
try {
8+
$client = new SoapClient(__DIR__ . "/bug80672.xml");
9+
$query = $soap->query(array('sXML' => 'something'));
10+
} catch(SoapFault $e) {
11+
print $e->getMessage();
12+
}
13+
?>
14+
--EXPECTF--
15+
SOAP-ERROR: Parsing WSDL: Unexpected WSDL element <>

‎ext/soap/tests/bug80672.xml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="ISO-8859-1"?>
2+
<soap:definitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
4+
xmlns:soap="http://schemas.xmlsoap.org/wsdl/">
5+
<![CDATA[test]]>
6+
</soap:definitions>

‎ext/standard/crc32.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ static inline int has_crc32_insn() {
4343
size_t reslen = sizeof(res);
4444
if (sysctlbyname("hw.optional.armv8_crc32", &res, &reslen, NULL, 0) < 0)
4545
res = 0;
46+
return res;
4647
# else
4748
res = 0;
4849
return res;

‎ext/standard/file.c

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -564,10 +564,6 @@ PHP_FUNCTION(file_get_contents)
564564
RETURN_FALSE;
565565
}
566566

567-
if (maxlen > INT_MAX) {
568-
php_error_docref(NULL, E_WARNING, "maxlen truncated from " ZEND_LONG_FMT " to %d bytes", maxlen, INT_MAX);
569-
maxlen = INT_MAX;
570-
}
571567
if ((contents = php_stream_copy_to_mem(stream, maxlen, 0)) != NULL) {
572568
RETVAL_STR(contents);
573569
} else {

‎ext/standard/streamsfuncs.c

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -458,10 +458,6 @@ PHP_FUNCTION(stream_get_contents)
458458
}
459459
}
460460

461-
if (maxlen > INT_MAX) {
462-
php_error_docref(NULL, E_WARNING, "Argument #2 ($maxlength) is truncated from " ZEND_LONG_FMT " to %d bytes", maxlen, INT_MAX);
463-
maxlen = INT_MAX;
464-
}
465461
if ((contents = php_stream_copy_to_mem(stream, maxlen, 0))) {
466462
RETURN_STR(contents);
467463
} else {

‎ext/zend_test/tests/observer_error_05.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ Observer: End handlers fire after a userland fatal error
66
zend_test.observer.enabled=1
77
zend_test.observer.observe_all=1
88
zend_test.observer.show_return_value=1
9+
--XFAIL--
10+
This is unsafe and fails on macos
911
--FILE--
1012
<?php
1113
set_error_handler(function ($errno, $errstr, $errfile, $errline) {

0 commit comments

Comments
 (0)