SAPI's should already been doing this on their own before, but the apache2handler doesn't get control over threads, so it didn't call ts_free_thread and therefore started leaking resources with the move of per-thread globals from heap storage to native __thread storage
In the CALL and TAILCALL VMs, opcode handlers called by function JIT
can return the next opline tagged with ZEND_VM_ENTER_BIT after invoking
a VM interrupt callback. Function JIT used that result directly as an
opcode pointer, causing invalid accesses when execution continued.
Check both bounds before narrowing the parse offset to int32_t. On 64-bit
systems, a value such as -4294967295 previously became 1 and parsing
started at the wrong position. Cover all three parse functions with a
regression test.
Closes#24781
php_array_data_shuffle() first compacts the holes of a packed array and
only then updates nNumUsed. When the engine threw in between, the stale
tail slots were still counted, so the moved values were released twice
when the copied array was destroyed. Update nNumUsed right after the
compaction.
Closes GH-24553.
exif_read_data() only reads the thumbnail if $read_thumbnail is true,
and exif_thumbnail() only scans the thumbnail for its dimensions if they
are requested, so the exif fuzzer never reached this code.
Follow-up to https://github.com/php/php-src/pull/24570#issuecomment-6375965729
The namespace node branch of php_xpath_eval() still created the parent
element with the DOMXPath's own dom, so with a foreign-doc callback node
the parent proxy referenced the wrong document. Use
dom_xpath_intern_for_doc() there too.
Close GH-24629
dasm_imm13() accepted some non-encodable constants and returned a bogus
encoding, so AND/OR/XOR with them computed a wrong result
(0x5555555555555554) or emitted an illegal instruction (0x200000003).
It also negated INT64_MIN in signed arithmetic. Backport the rewritten
dasm_imm13() from DynASM (LuaJIT a9981441), already in master via the
IR update.
Closes GH-24663.
The tracing guard checked IS_LONG instead of IS_STRING after ZVAL_DEREF,
passing a non-string to zend_hash_find(). The function JIT path checked
IS_STRING instead of IS_REFERENCE, so the deref fast path was dead.
Closes GH-24796.
When curl opaque objects are cloned, the curl handle was only updated if
the callback function wasn't null. However, the C handler in PHP remains
attached even if the callback was set to NULL (*). So we must
unconditionally update the callback data pointer to the new curl handle.
(*) We can't set the C handler to NULL unconditionally on stable branches
because that invokes a behaviour change (e.g. built in progress bar).
Closes GH-24760.
This was never called and resulted in this compiler warning:
```
./ext/opcache/ZendAccelerator.c:3720:15: warning: variable 'orig_post_shutdown_cb' set
but not used [-Wunused-but-set-global]
3720 | static void (*orig_post_shutdown_cb)(void);
| ^
```
Closes GH-24761.
* PHP-8.6:
fpm: fix _GET_str memory leaks and test headers_only status path
fpm: fix a use-after-free of scoreboard_p
fpm: fix potential null dereference in fpm_status_export_to_zval()
# Conflicts:
# NEWS
* PHP-8.5:
fpm: fix _GET_str memory leaks and test headers_only status path
fpm: fix a use-after-free of scoreboard_p
fpm: fix potential null dereference in fpm_status_export_to_zval()
* PHP-8.4:
fpm: fix _GET_str memory leaks and test headers_only status path
fpm: fix a use-after-free of scoreboard_p
fpm: fix potential null dereference in fpm_status_export_to_zval()
When a worker exits while one of its child processes still holds the
worker's stdout/stderr pipe open, the drain in fpm_child_close() gets
EAGAIN instead of EOF and leaves the fd open. fpm_child_close() then
closed the fd but kept its number in the child struct, so the postponed
free closed it (and removed its event) a second time. If a new worker
had been given the same fd number in the meantime, its pipe was closed
and every later write it made to stdio failed with EPIPE.
Remove the event and reset the fd to -1 when closing it in
fpm_child_close() so the postponed free cannot act on it again.
Closes GH-24056.
Co-authored-by: ndossche <7771979+ndossche@users.noreply.github.com>
Marc