[pull] master from php:master - #1150
Merged
Merged
Conversation
The string formater supports custom format specifiers such as 'S' (zend_string*), but format strings using these specifiers do not pass the compiler's type checks that are performed on functions tagged with ZEND_ATTRIBUTE_FORMAT:
Zend/zend_compile.c: In function 'zend_compile_closure_binding':
Zend/zend_compile.c:8586:62: error: format '%S' expects argument of type 'wchar_t *', but argument 3 has type 'zend_string *' {aka 'struct _zend_string *'} [-Werror=format=]
8586 | zend_error_noreturn(E_COMPILE_ERROR, "Cannot use variable $%S twice", var_name);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~
| |
| zend_string * {aka struct _zend_string *}
As a result we can not use these specifiers without resorting to workarounds:
* Use variants of formatting functions that do not have ZEND_ATTRIBUTE_FORMAT [1]
* Or declare the format string separately [2]
Here I re-introduce %S as %pS. The compiler will only see a %p specifier followed by the ordinary literal character S, so it will be happy about an argument of type zend_string*.
This trick can be applied to more custom specifiers.
[1] https://github.com/php/php-src/blob/0b5d9801ec3b53e84388239a5b9f85d005318b64/Zend/zend_compile.c#L8586-L8587
[2] https://github.com/php/php-src/blob/edc169e7705d5e4411865e9be92b50e82be78f4e/Zend/zend_partial.c#L680
So that when the outputs are fixed the changes can be confirmed in tests
In addition to the fixes within the reflection extension, support for error strings with null bytes was added to `zend_throw_error()` and `zend_throw_exception_ex()`. The changes to `zend_throw_exception_ex()` are a partial backport of #16684.
…2983) Refactor out duplicate logic to make the code looks more sensible.
…xpected (#23001) * Zend: add tests for ZPP class-string specifier * Zend: handle non-string arguments for ZPP class-string specifier as expected This doesn't behave like any of the other specifiers, as it doesn't respect strict_types, emit a deprecation for null, or reject arrays
…2687) Covers the previously untested FAILURE branches where a userland save handler's write() or destroy() returns false during session_regenerate_id(), which should warn and return false while leaving the current session ID untouched.
* PHP-8.4: NEWS for PHP 8.4 GH-22905: avoid truncation on null bytes in reflection exceptions Reflection: Add regression tests for error messages with null bytes
* PHP-8.5: NEWS for PHP 8.5 NEWS for PHP 8.4 GH-22905: avoid truncation on null bytes in reflection exceptions Reflection: Add regression tests for error messages with null bytes
If the call fails, then the pointer remains uninitialized, and this triggers undefined behaviour or the reading of a dangling pointer. In my own tests this came out as a UAF. However, it seems not exploitable by an attacker as failure should be not controllable. It's worth pointing out that OpenSSL checks the return value in its own code that calls this function as well [1]. [1] https://github.com/openssl/openssl/blob/b2ecef451ccede07366023da4553f113f6e4fe71/apps/lib/apps.c#L3307-L3311
* PHP-8.4: [8.4] NEWS: fix misplaced tabs [skip ci]
* PHP-8.5: [8.4] NEWS: fix misplaced tabs [skip ci]
Adding a new more refined spoofchecker method in addition of the existing Spoofchecker::areConfusable which takes in account the text direction left to right and right to left, along with the Spoofchecker::LTR and Spoofchecker::RTL constants. The self and typed references tests are extended accordingly, guarded at runtime rather than through a SKIPIF, so that the older ICU releases keep their coverage. Close GH-13469
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )