[pull] master from php:master - #1121
Merged
Merged
Conversation
Fixes GH-18985 Closes GH-22833 zend_compile_expr() and zend_compile_var() now restore CG(zend_lineno) after compilation of the node has finished. This makes the compiled lineno more predictable. Note that there are many cases left that are incorrect. For example: <?php return foo(); L0004 0000 INIT_FCALL_BY_NAME 0 string("foo") L0004 0001 T0 = DO_FCALL_BY_NAME L0004 0002 RETURN T0 L0007 0003 RETURN int(1) The zend_ast_create_n() functions set lineno to the lineno of the first non-null child. In this case that's foo(), even though it's not on the same line as return. What we'd need instead is backing up CG(zend_lineno) after the return keyword in the parser so we can restore it later. However, this would be a rather invasive change, given the same issue exists for many ast kinds, so a better solution might just be to re-commit e528762. I don't feel comfortable backporting this as a bug fix, but we might address the issue in a simpler, less comprehensive manner for older branches.
phpdbg watched every array element as a Bucket, but packed arrays store bare zvals and de-indirected stack variables aren't buckets, so reading Bucket.h/.key over-read the neighbour and a sibling write tripped a phantom break. Watch such elements as WATCH_ON_ZVAL and compare the type info first, reading the value union only for initialised slots so an uninitialised CV is never compared by value. A separate pre-existing bug crashed 32-bit: phpdbg_btree_insert_or_update linked each new node into the tree before initialising its child pointers, so a write to a node on a watched page faulted into the watchpoint handler, which walked the half-built node. Build the node fully, then publish it with a single store. Closes GH-22756
When a stream is freed from its resource destructor, the on-close write-filter flush runs the user filter callback while the stream's resource is already dtor'd (type == -1) and about to be freed. Exposing it through $this->stream let user code capture the dead resource in an exception backtrace, a use-after-free. Assign null when the resource is no longer live; the explicit fclose() flush still runs before the resource is closed, so live streams are unaffected. Fixes GH-15836 Closes GH-22503
* PHP-8.4: Don't expose a freed stream resource to user filters
* PHP-8.5: Don't expose a freed stream resource to user filters
create_segments() under HAVE_SHM_CREATE_LARGEPAGE stored the int return of getpagesizes() in a size_t and iterated with a size_t counter. On the getpagesizes() error return (-1) the size_t became SIZE_MAX, passing the > 0 guard, and the unsigned loop counter made i >= 0 always true, so the loop ran from a huge index and read far outside the 3-element shared_segment_sindexes array; even on success, if no returned page size divided requested_size the counter wrapped past 0. Capture the result in a signed int and iterate signed so the error return is rejected and the loop terminates. Closes GH-22429
* PHP-8.4: Fix OOB read in opcache POSIX largepage page-size selection
* PHP-8.5: Fix OOB read in opcache POSIX largepage page-size selection
In #21607 we introduce several inline helpers for raw C-string concatenation. This PR use them to refactor several manual C string construction.
* ftp: For single fd poll calls, use php_pollfd_for_ms * pgsql: Use php_pollfd_for_ms in compat shim This is only used on pre-libpq 17. * fastcgi: Use php_pollfd_for_ms for single fd This also handles the case where poll isn't available (does that even matter nowadays?) * io: Use php_pollfd_for_ms for single fd poll * cli: Convert to php_pollfd_for from select This is not a poll call, but it is functionally the same as one; convert it to the single fd polling function which is clearer to read.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )