Skip to content

Commit d469621

Browse files
edorianedorian
committed
Merge remote-tracking branch 'security/PHP-8.5.1-security' into PHP-8.5.1
* security/PHP-8.5.1-security: intl: Fix tests for icu update Suppress libxml deprecations Update NEWS with info about security issues Fix GHSA-www2-q4fc-65wf Fix GHSA-h96m-rvf9-jgm2 Fix GHSA-8xr5-qppj-gvwj: PDO quoting result null deref
2 parents 631b364 + b8b7add commit d469621

File tree

13 files changed

+154
-19
lines changed

13 files changed

+154
-19
lines changed

‎ext/dom/document.c‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1595,12 +1595,16 @@ PHP_METHOD(DOMDocument, save)
15951595
libxml_doc_props const* doc_props = dom_get_doc_props_read_only(intern->document);
15961596
bool format = doc_props->formatoutput;
15971597
if (options & LIBXML_SAVE_NOEMPTYTAG) {
1598+
ZEND_DIAGNOSTIC_IGNORED_START("-Wdeprecated-declarations")
15981599
saveempty = xmlSaveNoEmptyTags;
15991600
xmlSaveNoEmptyTags = 1;
1601+
ZEND_DIAGNOSTIC_IGNORED_END
16001602
}
16011603
zend_long bytes = intern->document->handlers->dump_doc_to_file(file, docp, format, (const char *) docp->encoding);
16021604
if (options & LIBXML_SAVE_NOEMPTYTAG) {
1605+
ZEND_DIAGNOSTIC_IGNORED_START("-Wdeprecated-declarations")
16031606
xmlSaveNoEmptyTags = saveempty;
1607+
ZEND_DIAGNOSTIC_IGNORED_END
16041608
}
16051609
if (bytes == -1) {
16061610
RETURN_FALSE;
@@ -1641,10 +1645,14 @@ static void dom_document_save_xml(INTERNAL_FUNCTION_PARAMETERS, zend_class_entry
16411645

16421646
/* Save libxml2 global, override its value, and restore after saving (don't move me or risk breaking the state
16431647
* w.r.t. the implicit return in DOM_GET_OBJ). */
1648+
ZEND_DIAGNOSTIC_IGNORED_START("-Wdeprecated-declarations")
16441649
old_xml_save_no_empty_tags = xmlSaveNoEmptyTags;
16451650
xmlSaveNoEmptyTags = (options & LIBXML_SAVE_NOEMPTYTAG) ? 1 : 0;
1651+
ZEND_DIAGNOSTIC_IGNORED_END
16461652
res = intern->document->handlers->dump_node_to_str(docp, node, format, (const char *) docp->encoding);
1653+
ZEND_DIAGNOSTIC_IGNORED_START("-Wdeprecated-declarations")
16471654
xmlSaveNoEmptyTags = old_xml_save_no_empty_tags;
1655+
ZEND_DIAGNOSTIC_IGNORED_END
16481656
} else {
16491657
int converted_options = XML_SAVE_AS_XML;
16501658
if (options & XML_SAVE_NO_DECL) {
@@ -1655,10 +1663,14 @@ static void dom_document_save_xml(INTERNAL_FUNCTION_PARAMETERS, zend_class_entry
16551663
}
16561664

16571665
/* Save libxml2 global, override its value, and restore after saving. */
1666+
ZEND_DIAGNOSTIC_IGNORED_START("-Wdeprecated-declarations")
16581667
old_xml_save_no_empty_tags = xmlSaveNoEmptyTags;
16591668
xmlSaveNoEmptyTags = (options & LIBXML_SAVE_NOEMPTYTAG) ? 1 : 0;
1669+
ZEND_DIAGNOSTIC_IGNORED_END
16601670
res = intern->document->handlers->dump_doc_to_str(docp, converted_options, (const char *) docp->encoding);
1671+
ZEND_DIAGNOSTIC_IGNORED_START("-Wdeprecated-declarations")
16611672
xmlSaveNoEmptyTags = old_xml_save_no_empty_tags;
1673+
ZEND_DIAGNOSTIC_IGNORED_END
16621674
}
16631675

16641676
if (!res) {

‎ext/dom/xml_serializer.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1097,7 +1097,10 @@ static int dom_xml_serialize_element_node(
10971097
/* 14. If ns is the HTML namespace, and the node's list of children is empty, and the node's localName matches
10981098
* any one of the following void elements: ... */
10991099
if (element->children == NULL) {
1100-
if (xmlSaveNoEmptyTags) {
1100+
ZEND_DIAGNOSTIC_IGNORED_START("-Wdeprecated-declarations")
1101+
int saveNoEmptyTags = xmlSaveNoEmptyTags;
1102+
ZEND_DIAGNOSTIC_IGNORED_END
1103+
if (saveNoEmptyTags) {
11011104
/* Do nothing, use the <x></x> closing style. */
11021105
} else if (php_dom_ns_is_fast(element, php_dom_ns_is_html_magic_token)) {
11031106
size_t name_length = strlen((const char *) element->name);

‎ext/intl/tests/msgfmt_format_intlcalendar_variant4.phpt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,4 @@ echo "msgf2: ", $msgf->format(array($time, 'date')), " ",
2929
?>
3030
--EXPECTF--
3131
Deprecated: Calling IntlGregorianCalendar::__construct() with more than 2 arguments is deprecated, use either IntlGregorianCalendar::createFromDate() or IntlGregorianCalendar::createFromDateTime() instead in %s on line %d
32-
quinta-feira, 17 de maio de 2012 5:35:36 da tarde ptlis
32+
quinta-feira, 17 de maio de 2012 5:35:36 %r(da tarde|p.m.)%r ptlis

‎ext/intl/tests/timezone_getDisplayName_variant4.phpt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,12 @@ var_dump($lsb->getDisplayName(false, IntlTimeZone::DISPLAY_SHORT_COMMONLY_USED))
1919
var_dump($lsb->getDisplayName(false, IntlTimeZone::DISPLAY_GENERIC_LOCATION));
2020

2121
?>
22-
--EXPECT--
23-
string(3) "GMT"
22+
--EXPECTF--
23+
string(%d) "%r(GMT|GMT\+0)%r"
2424
string(30) "Western European Standard Time"
2525
string(13) "Portugal Time"
2626
string(21) "Western European Time"
2727
string(5) "+0000"
28-
string(3) "GMT"
29-
string(3) "GMT"
28+
string(%d) "%r(GMT|GMT\+00:00)%r"
29+
string(%d) "%r(GMT|GMT\+0)%r"
3030
string(13) "Portugal Time"

‎ext/libxml/libxml.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -813,9 +813,12 @@ static xmlParserInputPtr php_libxml_external_entity_loader(const char *URL,
813813
} else {
814814
/* make stream not being closed when the zval is freed */
815815
GC_ADDREF(stream->res);
816+
817+
ZEND_DIAGNOSTIC_IGNORED_START("-Wdeprecated-declarations")
816818
pib->context = stream;
817819
pib->readcallback = php_libxml_streams_IO_read;
818820
pib->closecallback = php_libxml_streams_IO_close;
821+
ZEND_DIAGNOSTIC_IGNORED_END
819822

820823
ret = xmlNewIOInputStream(context, pib, enc);
821824
if (ret == NULL) {

‎ext/pdo/pdo_sql_parser.re‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -300,6 +300,12 @@ safe:
300300
}
301301

302302
plc->quoted = stmt->dbh->methods->quoter(stmt->dbh, buf, param_type);
303+
if (plc->quoted == NULL) {
304+
/* bork */
305+
ret = -1;
306+
strncpy(stmt->error_code, stmt->dbh->error_code, 6);
307+
goto clean_up;
308+
}
303309
}
304310
}
305311

‎ext/pdo_pgsql/tests/ghsa-8xr5-qppj-gvwj.phpt‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
--TEST--
2+
#GHSA-8xr5-qppj-gvwj: NULL Pointer Derefernce for failed user input quoting
3+
--EXTENSIONS--
4+
pdo
5+
pdo_pgsql
6+
--SKIPIF--
7+
<?php
8+
require_once dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
9+
require_once dirname(__FILE__) . '/config.inc';
10+
PDOTest::skip();
11+
?>
12+
--FILE--
13+
<?php
14+
require_once dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
15+
require_once dirname(__FILE__) . '/config.inc';
16+
$db = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
17+
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
18+
$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, true);
19+
20+
$sql = "SELECT * FROM users where username = :username";
21+
$stmt = $db->prepare($sql);
22+
23+
$p1 = "alice\x99";
24+
var_dump($stmt->execute(['username' => $p1]));
25+
26+
?>
27+
--EXPECT--
28+
bool(false)

‎ext/standard/array.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4272,7 +4272,7 @@ static zend_always_inline void php_array_merge_wrapper(INTERNAL_FUNCTION_PARAMET
42724272
uint32_t argc, i;
42734273
zval *src_entry;
42744274
HashTable *src, *dest;
4275-
uint32_t count = 0;
4275+
uint64_t count = 0;
42764276

42774277
ZEND_PARSE_PARAMETERS_START(0, -1)
42784278
Z_PARAM_VARIADIC('+', args, argc)
@@ -4292,6 +4292,11 @@ static zend_always_inline void php_array_merge_wrapper(INTERNAL_FUNCTION_PARAMET
42924292
count += zend_hash_num_elements(Z_ARRVAL_P(arg));
42934293
}
42944294

4295+
if (UNEXPECTED(count >= HT_MAX_SIZE)) {
4296+
zend_throw_error(NULL, "The total number of elements must be lower than %u", HT_MAX_SIZE);
4297+
RETURN_THROWS();
4298+
}
4299+
42954300
if (argc == 2) {
42964301
zval *ret = NULL;
42974302

‎ext/standard/basic_functions.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -561,7 +561,7 @@ PHP_FUNCTION(inet_pton)
561561
char buffer[17];
562562

563563
ZEND_PARSE_PARAMETERS_START(1, 1)
564-
Z_PARAM_STRING(address, address_len)
564+
Z_PARAM_PATH(address, address_len)
565565
ZEND_PARSE_PARAMETERS_END();
566566

567567
memset(buffer, 0, sizeof(buffer));
@@ -593,7 +593,7 @@ PHP_FUNCTION(ip2long)
593593
struct in_addr ip;
594594

595595
ZEND_PARSE_PARAMETERS_START(1, 1)
596-
Z_PARAM_STRING(addr, addr_len)
596+
Z_PARAM_PATH(addr, addr_len)
597597
ZEND_PARSE_PARAMETERS_END();
598598

599599
if (addr_len == 0 || inet_pton(AF_INET, addr, &ip) != 1) {
@@ -2139,8 +2139,8 @@ PHP_FUNCTION(getservbyname)
21392139
struct servent *serv;
21402140

21412141
ZEND_PARSE_PARAMETERS_START(2, 2)
2142-
Z_PARAM_STR(name)
2143-
Z_PARAM_STRING(proto, proto_len)
2142+
Z_PARAM_PATH_STR(name)
2143+
Z_PARAM_PATH(proto, proto_len)
21442144
ZEND_PARSE_PARAMETERS_END();
21452145

21462146

@@ -2183,7 +2183,7 @@ PHP_FUNCTION(getservbyport)
21832183

21842184
ZEND_PARSE_PARAMETERS_START(2, 2)
21852185
Z_PARAM_LONG(port)
2186-
Z_PARAM_STRING(proto, proto_len)
2186+
Z_PARAM_PATH(proto, proto_len)
21872187
ZEND_PARSE_PARAMETERS_END();
21882188

21892189
serv = getservbyport(htons((unsigned short) port), proto);
@@ -2210,7 +2210,7 @@ PHP_FUNCTION(getprotobyname)
22102210
struct protoent *ent;
22112211

22122212
ZEND_PARSE_PARAMETERS_START(1, 1)
2213-
Z_PARAM_STRING(name, name_len)
2213+
Z_PARAM_PATH(name, name_len)
22142214
ZEND_PARSE_PARAMETERS_END();
22152215

22162216
ent = getprotobyname(name);

‎ext/standard/dns.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -382,7 +382,7 @@ PHP_FUNCTION(dns_check_record)
382382
#endif
383383

384384
ZEND_PARSE_PARAMETERS_START(1, 2)
385-
Z_PARAM_STRING(hostname, hostname_len)
385+
Z_PARAM_PATH(hostname, hostname_len)
386386
Z_PARAM_OPTIONAL
387387
Z_PARAM_STR(rectype)
388388
ZEND_PARSE_PARAMETERS_END();
@@ -829,7 +829,7 @@ PHP_FUNCTION(dns_get_record)
829829
bool raw = 0;
830830

831831
ZEND_PARSE_PARAMETERS_START(1, 5)
832-
Z_PARAM_STRING(hostname, hostname_len)
832+
Z_PARAM_PATH(hostname, hostname_len)
833833
Z_PARAM_OPTIONAL
834834
Z_PARAM_LONG(type_param)
835835
Z_PARAM_ZVAL(authns)
@@ -1067,7 +1067,7 @@ PHP_FUNCTION(dns_get_mx)
10671067
#endif
10681068

10691069
ZEND_PARSE_PARAMETERS_START(2, 3)
1070-
Z_PARAM_STRING(hostname, hostname_len)
1070+
Z_PARAM_PATH(hostname, hostname_len)
10711071
Z_PARAM_ZVAL(mx_list)
10721072
Z_PARAM_OPTIONAL
10731073
Z_PARAM_ZVAL(weight_list)

0 commit comments

Comments
 (0)