Merge remote-tracking branch 'origin/PHP-7.4' into PHP-7.4

Author: johannes

.appveyor.yml

@@ -16,7 +16,7 @@ environment:
  PHP_BUILD_CACHE_BASE_DIR: c:\build-cache
  PHP_BUILD_OBJ_DIR: c:\obj
  PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
- PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0beta1
+ PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0beta3
  PHP_BUILD_CRT: vc15
  # ext and env setup for tests
  #MYSQL_TEST_PASSWD: Password12!

NEWS

@@ -92,4 +92,7 @@ PHP NEWS
 - Tidy:
  . Added TIDY_TAG_* constants for HTML5 elements. (cmb)
 
+- WDDX:
+ . Deprecated the WDDX extension. (cmb)
+
 <<< NOTE: Insert NEWS from last stable release here prior to actual release! >>>

UPGRADING

@@ -241,6 +241,9 @@ PHP 7.4 UPGRADE NOTES
  possible, but unserialization yielded unusable objects.
  . The @param notation can now also be used to denote SQL query parameters.
 
+- WDDX:
+ . The WDDX extension has been deprecated.
+
 - Zip:
  . The bundled libzip library has been removed. A system libzip >= 0.11 is now
  necessary to build the extension.
@@ -253,6 +256,14 @@ PHP 7.4 UPGRADE NOTES
  . MB_ONIGURUMA_VERSION specifies the version of the oniguruma library against
  which mbregex has been built.
 
+- Socket:
+ . Added FreeBSD-specific socket options:
+ . SO_LABEL
+ . SO_PEERLABEL
+ . SO_LISTENQLIMIT
+ . SO_LISTENQLEN
+ . SO_USER_COOKIE
+
 - Tidy:
  . TIDY_TAG_ARTICLE
  . TIDY_TAG_ASIDE

Zend/zend_constants.c

@@ -378,7 +378,9 @@ ZEND_API zval *zend_get_constant_ex(zend_string *cname, zend_class_entry *scope,
 ret_constant = NULL;
 } else {
 if (!zend_verify_const_access(c, scope)) {
-zend_throw_error(NULL, "Cannot access %s const %s::%s", zend_visibility_string(Z_ACCESS_FLAGS(c->value)), ZSTR_VAL(class_name), ZSTR_VAL(constant_name));
+if ((flags & ZEND_FETCH_CLASS_SILENT) == 0) {
+zend_throw_error(NULL, "Cannot access %s const %s::%s", zend_visibility_string(Z_ACCESS_FLAGS(c->value)), ZSTR_VAL(class_name), ZSTR_VAL(constant_name));
+}
 goto failure;
 }
 ret_constant = &c->value;

ext/date/php_date.c

@@ -5278,21 +5278,14 @@ PHP_METHOD(DatePeriod, __wakeup)
 /* {{{ date_period_read_property */
 static zval *date_period_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv)
 {
-zval *zv;
 if (type != BP_VAR_IS && type != BP_VAR_R) {
 zend_throw_error(NULL, "Retrieval of DatePeriod properties for modification is unsupported");
 return &EG(uninitialized_zval);
 }
 
 Z_OBJPROP_P(object); /* build properties hash table */
 
-zv = zend_std_read_property(object, member, type, cache_slot, rv);
-if (Z_TYPE_P(zv) == IS_OBJECT && Z_OBJ_HANDLER_P(zv, clone_obj)) {
-/* defensive copy */
-ZVAL_OBJ(zv, Z_OBJ_HANDLER_P(zv, clone_obj)(zv));
-}
-
-return zv;
+return zend_std_read_property(object, member, type, cache_slot, rv);
 }
 /* }}} */
 

ext/exif/exif.c

@@ -3378,6 +3378,10 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 break;
 
 case TAG_USERCOMMENT:
+EFREE_IF(ImageInfo->UserComment);
+ImageInfo->UserComment = NULL;
+EFREE_IF(ImageInfo->UserCommentEncoding);
+ImageInfo->UserCommentEncoding = NULL;
 ImageInfo->UserCommentLength = exif_process_user_comment(ImageInfo, &(ImageInfo->UserComment), &(ImageInfo->UserCommentEncoding), value_ptr, byte_count);
 break;
 

ext/exif/tests/bug77564/bug77564.jpg

@@ -0,0 +1,18 @@
+--TEST--
+Bug 77564 (Memory leak in exif_process_IFD_TAG)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+var_dump(exif_read_data(dirname(__FILE__) . '/bug77564.jpg'));
+?>
+DONE
+--EXPECTF--
+
+Warning: exif_read_data(bug77564.jpg): Illegal IFD offset in %sbug77564.php on line %d
+
+Warning: exif_read_data(bug77564.jpg): File structure corrupted in %sbug77564.php on line %d
+
+Warning: exif_read_data(bug77564.jpg): Invalid JPEG file in %sbug77564.php on line %d
+bool(false)
+DONE

ext/exif/tests/bug77564/bug77564.phpt

@@ -1138,10 +1138,16 @@ static void zend_ffi_cdata_write_dim(zval *object, zval *offset, zval *value) /*
 {
 zend_ffi_cdata *cdata = (zend_ffi_cdata*)Z_OBJ_P(object);
 zend_ffi_type *type = ZEND_FFI_TYPE(cdata->type);
-zend_long dim = zval_get_long(offset);
+zend_long dim;
 void *ptr;
 zend_ffi_flags is_const;
 
+if (offset == NULL) {
+zend_throw_error(zend_ffi_exception_ce, "Cannot add next element to object of type FFI\\CData");
+return;
+}
+
+dim = zval_get_long(offset);
 if (EXPECTED(type->kind == ZEND_FFI_TYPE_ARRAY)) {
 if (UNEXPECTED((zend_ulong)(dim) >= (zend_ulong)type->array.length)
  && (UNEXPECTED(dim < 0) || UNEXPECTED(type->array.length != 0))) {
@@ -5296,7 +5302,7 @@ void zend_ffi_add_bit_field(zend_ffi_dcl *struct_dcl, const char *name, size_t n
 zend_ffi_parser_error("wrong type of bit field '%.*s' at line %d", name ? name_len : sizeof("<anonymous>")-1, name ? name : "<anonymous>", FFI_G(line));
 }
 
-if (bits->kind == ZEND_FFI_VAL_INT32 || ZEND_FFI_VAL_INT64) {
+if (bits->kind == ZEND_FFI_VAL_INT32 || bits->kind == ZEND_FFI_VAL_INT64) {
 if (bits->i64 < 0) {
 zend_ffi_cleanup_dcl(field_dcl);
 zend_ffi_parser_error("negative width in bit-field '%.*s' at line %d", name ? name_len : sizeof("<anonymous>")-1, name ? name : "<anonymous>", FFI_G(line));
@@ -5310,7 +5316,7 @@ void zend_ffi_add_bit_field(zend_ffi_dcl *struct_dcl, const char *name, size_t n
 zend_ffi_cleanup_dcl(field_dcl);
 zend_ffi_parser_error("width of '%.*s' exceeds its type at line %d", name ? name_len : sizeof("<anonymous>")-1, name ? name : "<anonymous>", FFI_G(line));
 }
-} else if (ZEND_FFI_VAL_UINT32 || ZEND_FFI_VAL_UINT64) {
+} else if (bits->kind == ZEND_FFI_VAL_UINT32 || bits->kind == ZEND_FFI_VAL_UINT64) {
 if (bits->u64 == 0) {
 zend_ffi_cleanup_dcl(field_dcl);
 if (name) {

ext/ffi/ffi.c

@@ -0,0 +1,16 @@
+--TEST--
+FFI 042: Next array element
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--INI--
+ffi.enable=1
+--FILE--
+<?php
+$a = FFI::new("uint8_t[8]");
+$a[] = 0;
+?>
+--EXPECTF--
+Fatal error: Uncaught FFI\Exception: Cannot add next element to object of type FFI\CData in %s:3
+Stack trace:
+#0 {main}
+ thrown in %s on line 3