Skip to content

Commit a019fbd

Browse files
nielsdosnielsdos
committed
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3: Fix GH-18309: ipv6 filter integer overflow Fix GH-18304: Changing the properties of a DateInterval through dynamic properties triggers a SegFault
2 parents 8a927c2 + 8849a53 commit a019fbd

File tree

16 files changed

+135
-11
lines changed

16 files changed

+135
-11
lines changed

‎NEWS

+5
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,15 @@ PHP NEWS
99
. Fixed bug GH-18209 (Use-after-free in extract() with EXTR_REFS). (ilutov)
1010
. Fixed bug GH-18268 (Segfault in array_walk() on object with added property
1111
hooks). (ilutov)
12+
. Fixed bug GH-18304 (Changing the properties of a DateInterval through
13+
dynamic properties triggers a SegFault). (nielsdos)
1214

1315
- DBA:
1416
. FIxed bug GH-18247 dba_popen() memory leak on invalid path. (David Carlier)
1517

18+
- Filter:
19+
. Fixed bug GH-18309 (ipv6 filter integer overflow). (nielsdos)
20+
1621
- GD:
1722
. Fixed imagecrop() overflow with rect argument with x/width y/heigh usage
1823
in gdImageCrop(). (David Carlier)

‎ext/date/php_date.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -4618,7 +4618,9 @@ static zval *date_interval_get_property_ptr_ptr(zend_object *object, zend_string
46184618
zend_string_equals_literal(name, "days") ||
46194619
zend_string_equals_literal(name, "invert") ) {
46204620
/* Fallback to read_property. */
4621-
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
4621+
if (cache_slot) {
4622+
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
4623+
}
46224624
ret = NULL;
46234625
} else {
46244626
ret = zend_std_get_property_ptr_ptr(object, name, type, cache_slot);

‎ext/date/tests/gh18304.phpt

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
--TEST--
2+
GH-18304 (Changing the properties of a DateInterval through dynamic properties triggers a SegFault)
3+
--CREDITS--
4+
orose-assetgo
5+
--FILE--
6+
<?php
7+
$di = new \DateInterval('P0Y');
8+
$field = 'd';
9+
$i = 1;
10+
$di->$field += $i;
11+
var_dump($di);
12+
?>
13+
--EXPECT--
14+
object(DateInterval)#1 (10) {
15+
["y"]=>
16+
int(0)
17+
["m"]=>
18+
int(0)
19+
["d"]=>
20+
int(1)
21+
["h"]=>
22+
int(0)
23+
["i"]=>
24+
int(0)
25+
["s"]=>
26+
int(0)
27+
["f"]=>
28+
float(0)
29+
["invert"]=>
30+
int(0)
31+
["days"]=>
32+
bool(false)
33+
["from_string"]=>
34+
bool(false)
35+
}

‎ext/dom/php_dom.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -362,7 +362,9 @@ static zval *dom_get_property_ptr_ptr(zend_object *object, zend_string *name, in
362362
return zend_std_get_property_ptr_ptr(object, name, type, cache_slot);
363363
}
364364

365-
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
365+
if (cache_slot) {
366+
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
367+
}
366368
return NULL;
367369
}
368370

‎ext/dom/tests/gh18304.phpt

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--TEST--
2+
GH-18304 (Changing the properties of a DateInterval through dynamic properties triggers a SegFault)
3+
--CREDITS--
4+
orose-assetgo
5+
--EXTENSIONS--
6+
dom
7+
--FILE--
8+
<?php
9+
$text = new \DOMText();
10+
$field = 'textContent';
11+
$text->$field .= 'hello';
12+
var_dump($text->$field);
13+
?>
14+
--EXPECT--
15+
string(5) "hello"

‎ext/filter/logical_filters.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -762,7 +762,8 @@ static int _php_filter_validate_ipv6(const char *str, size_t str_len, int ip[8])
762762
{
763763
int compressed_pos = -1;
764764
int blocks = 0;
765-
int num, n, i;
765+
unsigned int num, n;
766+
int i;
766767
char *ipv4;
767768
const char *end;
768769
int ip4elm[4];

‎ext/filter/tests/gh18309.phpt

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
--TEST--
2+
GH-18309 (ipv6 filter integer overflow)
3+
--EXTENSIONS--
4+
filter
5+
--FILE--
6+
<?php
7+
var_dump(filter_var('fffffffffffffffffffffffffffffffffffff::', FILTER_VALIDATE_IP, FILTER_FLAG_IPV6));
8+
?>
9+
--EXPECT--
10+
bool(false)

‎ext/pdo/pdo_stmt.c

+3-2
Original file line numberDiff line numberDiff line change
@@ -2489,9 +2489,10 @@ static zval *pdo_row_get_property_ptr_ptr(zend_object *object, zend_string *name
24892489
ZEND_IGNORE_VALUE(object);
24902490
ZEND_IGNORE_VALUE(name);
24912491
ZEND_IGNORE_VALUE(type);
2492-
ZEND_IGNORE_VALUE(cache_slot);
24932492

2494-
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
2493+
if (cache_slot) {
2494+
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
2495+
}
24952496
return NULL;
24962497
}
24972498

‎ext/simplexml/simplexml.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -639,7 +639,9 @@ static zval *sxe_property_get_adr(zend_object *object, zend_string *zname, int f
639639
SXE_ITER type;
640640
zval member;
641641

642-
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
642+
if (cache_slot) {
643+
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
644+
}
643645

644646
sxe = php_sxe_fetch_object(object);
645647
GET_NODE(sxe, node);

‎ext/simplexml/tests/gh18304.phpt

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
--TEST--
2+
GH-18304 (Changing the properties of a DateInterval through dynamic properties triggers a SegFault)
3+
--CREDITS--
4+
orose-assetgo
5+
--EXTENSIONS--
6+
simplexml
7+
--FILE--
8+
<?php
9+
$sxe = simplexml_load_string('<root><abc/></root>');
10+
$field = 'abc';
11+
$sxe->$field .= 'hello';
12+
var_dump($sxe->$field);
13+
?>
14+
--EXPECT--
15+
object(SimpleXMLElement)#3 (1) {
16+
[0]=>
17+
string(5) "hello"
18+
}

‎ext/snmp/snmp.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -1861,7 +1861,9 @@ static zval *php_snmp_get_property_ptr_ptr(zend_object *object, zend_string *nam
18611861
return zend_std_get_property_ptr_ptr(object, name, type, cache_slot);
18621862
}
18631863

1864-
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
1864+
if (cache_slot) {
1865+
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
1866+
}
18651867
return NULL;
18661868
}
18671869

‎ext/snmp/tests/gh18304.phpt

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--TEST--
2+
GH-18304 (Changing the properties of a DateInterval through dynamic properties triggers a SegFault)
3+
--CREDITS--
4+
orose-assetgo
5+
--EXTENSIONS--
6+
snmp
7+
--FILE--
8+
<?php
9+
$snmp = new SNMP(1, '127.0.0.1', 'community');
10+
$field = 'max_oids';
11+
$snmp->$field++;
12+
var_dump($snmp->$field);
13+
?>
14+
--EXPECT--
15+
int(1)

‎ext/spl/spl_array.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -863,7 +863,9 @@ static zval *spl_array_get_property_ptr_ptr(zend_object *object, zend_string *na
863863

864864
if ((intern->ar_flags & SPL_ARRAY_ARRAY_AS_PROPS) != 0
865865
&& !zend_std_has_property(object, name, ZEND_PROPERTY_EXISTS, NULL)) {
866-
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
866+
if (cache_slot) {
867+
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
868+
}
867869

868870
/* If object has offsetGet() overridden, then fallback to read_property,
869871
* which will call offsetGet(). */

‎ext/spl/tests/gh18304.phpt

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
--TEST--
2+
GH-18304 (Changing the properties of a DateInterval through dynamic properties triggers a SegFault)
3+
--CREDITS--
4+
orose-assetgo
5+
--FILE--
6+
<?php
7+
$ao = new ArrayObject(['abc' => 1]);
8+
$ao->setFlags(ArrayObject::ARRAY_AS_PROPS);
9+
$field = 'abc';
10+
$ao->$field++;
11+
var_dump($ao->$field);
12+
?>
13+
--EXPECT--
14+
int(2)

‎ext/xmlreader/php_xmlreader.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ zval *xmlreader_get_property_ptr_ptr(zend_object *object, zend_string *name, int
117117
xmlreader_prop_handler *hnd = zend_hash_find_ptr(&xmlreader_prop_handlers, name);
118118
if (hnd == NULL) {
119119
retval = zend_std_get_property_ptr_ptr(object, name, type, cache_slot);
120-
} else {
120+
} else if (cache_slot) {
121121
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
122122
}
123123

‎ext/zip/php_zip.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -889,8 +889,6 @@ static zval *php_zip_get_property_ptr_ptr(zend_object *object, zend_string *name
889889
zval *retval = NULL;
890890
zip_prop_handler *hnd = NULL;
891891

892-
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
893-
894892
obj = php_zip_fetch_object(object);
895893

896894
if (obj->prop_handler != NULL) {
@@ -899,6 +897,8 @@ static zval *php_zip_get_property_ptr_ptr(zend_object *object, zend_string *name
899897

900898
if (hnd == NULL) {
901899
retval = zend_std_get_property_ptr_ptr(object, name, type, cache_slot);
900+
} else if (cache_slot) {
901+
cache_slot[0] = cache_slot[1] = cache_slot[2] = NULL;
902902
}
903903

904904
return retval;

0 commit comments

Comments
 (0)