[pull] master from php:master - #1232
Merged
Merged
Conversation
The index was cast to int before being handed to zip_get_name(), whose parameter is a zip_uint64_t, so any value with a non-zero upper half wrapped and selected the wrong entry: getNameIndex(1 << 32) returned the name of entry 0 instead of false. Cast to zip_uint64_t instead, letting libzip reject out of range indices.
When zip_open() failed the whole stat block was skipped, yet the function still returned 0. fstat() on a zip:// stream therefore succeeded with the zeroed statbuf it was given, reporting a zero size and no file type bits, instead of failing. Return -1 on that path. Close GH-23511
* PHP-8.4: ext/zip: php_zip_ops_stat() succeeds when the archive cannot be opened. ext/zip: ZipArchive::getNameIndex() index truncated to int.
* PHP-8.5: ext/zip: php_zip_ops_stat() succeeds when the archive cannot be opened. ext/zip: ZipArchive::getNameIndex() index truncated to int.
The OK packet message-length varint is read after the last bounds check, so a length-encoded integer at the end of a packet can advance p past header.size and even past the end of the 4096-byte command buffer. The old MIN(net_len, buf_len - (p - begin)) clamp then underflows and passes an unclamped attacker-controlled length to mnd_pestrndup(), reading heap memory beyond both the packet and its allocation. Reject a message length that extends past the payload, matching php_mysqlnd_auth_response_read() from GHSA-h35g-vwh6-m678; an audit found no further readers using the vulnerable buf_len clamp. Closes GH-23497
* PHP-8.4: [mysqlnd] Fix OK packet message length buffer over-read
* PHP-8.5: [mysqlnd] Fix OK packet message length buffer over-read
sxe_prop_dim_write() overwrote the element node with the first attribute node when resolving an SXE_ITER_ATTRLIST iterator, so xmlNewProp() targeted a non-element node and was skipped entirely when no attribute existed yet. Keep the element node in place and resolve only the attribute list start, so $x->attributes()["new"] = "v" creates the attribute like the symmetric $x["new"] path; property writes on the attributes() object share the fixed path while read/exists/unset handlers are unaffected by this defect. Closes GH-23500
* PHP-8.4: [SimpleXML] Fix creating new attributes via attributes() dimension write
* PHP-8.5: [SimpleXML] Fix creating new attributes via attributes() dimension write
collator_sort_with_sort_keys() ecalloc'd sortKeyBuf and sortKeyIndxBuf at DEF_SORT_KEYS_BUF_SIZE (1MiB) each on every call regardless of array size. sortKeyBuf now starts from zend_hash_num_elements() * 32 bytes, clamped to a 4KiB minimum and the previous 1MiB cap, and grows geometrically up to DEF_SORT_KEYS_BUF_INCREMENT. sortKeyIndxBuf is allocated exactly for the element count, dropping the index-buffer growth path. Sibling audit: DEF_SORT_KEYS* constants have no other users and collator_sort()/asort()/get_sort_key() already scale allocations.
The rset_field metadata reader trusted each length-encoded string size: a hostile server could send a length marker at the end of a field packet whose value exceeds the remaining payload, advancing p past header.size and past the command buffer before the next dereference, and recording attacker-controlled lengths on pointers outside the packet that later feed memcpy() into the field memory pool. Bound each metadata string by bailing once p leaves the payload and rejecting lengths larger than the remaining bytes, matching php_mysqlnd_auth_response_read() from GHSA-h35g-vwh6-m678; an audit found no other users of the READ_RSET_FIELD macro and the trailing default-value check never dereferences its length. Closes GH-23496
* PHP-8.4: [mysqlnd] Fix result set field metadata length buffer over-read
* PHP-8.5: [mysqlnd] Fix result set field metadata length buffer over-read
Calendar_get_debug_info() built a temporary IntlTimeZone wrapper zval via timezone_object_construct() and never released it, leaking one wrapper object per var_dump()/debug dump of an IntlCalendar. Release the wrapper with zval_ptr_dtor() after its debug info has been copied. Sibling audit: all other timezone_object_construct() call sites write into return_value and are refcount-managed; no other intl get_debug_info handler constructs temporary wrapper objects. Closes GH-23503
* PHP-8.4: [intl] Fix leak of time zone wrapper in Calendar debug info
* PHP-8.5: [intl] Fix leak of time zone wrapper in Calendar debug info
Reflected attribute writes such as className and id, classList mutations, and removeAttribute()/removeAttributeNS()/removeAttributeNode() modified attributes without bumping the document cache tag, so live HTMLCollection caches like getElementsByClassName() kept serving stale lengths and items. Invalidate the node list caches at every one of these mutation points. Sibling audit: Attr:: writes, setAttribute(), setAttributeNode() and setAttributeNS() already invalidate; php_dom_ns_compat_mark_attribute() only mirrors namespace declarations during reconciliation and is not user-visible. Closes GH-23501
* PHP-8.5: dom: invalidate node list caches on class attribute mutations
sdl_serialize_soap_body() counted j headerfaults per header but then serialized body->headers instead of tmp->headerfaults, writing N header records where j fault records were expected by sdl_deserialize_soap_body(), misaligning the cache stream and crashing on load whenever a soap:header carries headerfaults. Iterate tmp->headerfaults instead; sibling audit of the other serialize/deserialize loops in php_sdl.c found no further hash-mismatched iteration. Bump WSDL_CACHE_VERSION so existing on-disk caches are discarded. Closes GH-23502
* PHP-8.4: [SOAP] Fix WSDL cache corruption when header defines headerfaults
* PHP-8.5: [SOAP] Fix WSDL cache corruption when header defines headerfaults
Since str_starts_with is frameless, str_ends_with also should be frameless.
Normalize an empty URI to NULL in spec-following mode so xmlHasNsProp() matches null-namespace attributes, and skip XML_ATTRIBUTE_DECL results which cannot be wrapped as nodes. Closes GH-23498
* PHP-8.4: [DOM] Fix getNamedItemNS() with empty URI not matching null namespace # Conflicts: # ext/dom/namednodemap.c
* PHP-8.5: [DOM] Fix getNamedItemNS() with empty URI not matching null namespace
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )