The bit counter update in PHP_GOSTUpdate() and PHP_SNEFRUUpdate() set the
low word one too high when it wrapped, and added at most one carry to the
high word per update. Snefru also computed the bit length of a single
update in 32 bits. The encoded message length, and thus the digest, was
wrong for inputs of 2^29 bytes or more. Compute the counter with 64-bit
arithmetic.
Closes GH-24555.
Headers required by the generated code (zend_attributes.h, zend_constants.h, zend_enum.h) are collected during generation and emitted as includes at the top of the arginfo file, with the same preprocessor conditions and PHP version guards as the code that needs them.
Removes the manual zend_attributes.h and zend_enum.h includes from sources that only needed them for the arginfo file they include.
php_hash_do_hash() hardcodes argument index 1 in the isfilename branch,
so hash_file() blames $algo for a null byte carried by $filename.
hash_file() is the only caller passing isfilename = 1, and its filename
is argument #2; php_hash_do_hash_hmac() already uses 2 for the same
check.
Co-authored-by: NickSdot <32384907+NickSdot@users.noreply.github.com>
hash_pbkdf2() sized the digest buffer with ceil((float) length / 2.0) and
the block count with ceil((float) digest_length / (float) ops->digest_size).
A float carries 24 bits of mantissa, so past 2^24 the conversion rounds and
both counts come out wrong: rounding up makes zend_bin2hex() write past the
end of the return string, rounding down leaves the tail of the string
uninitialized. hash_pbkdf2('md5', 'password', 'salt', 1, 268435473) writes
8 bytes out of bounds under ASAN.
Both counts are exact in integer arithmetic, so this replaces them with
round-up divisions, which also avoids the signed overflow with an output
length of PHP_INT_MAX. <math.h> had no other user in the file.
Close GH-23380
* ext/bz2: applied fixers to improve test robustness
* ext/calendar: applied fixers to improve test robustness
* ext/exif: applied fixers to improve test robustness
* ext/fileinfo: applied fixers to improve test robustness
* ext/filter: applied fixers to improve test robustness
* ext/ftp: applied fixers to improve test robustness
* ext/hash: applied fixers to improve test robustness
* ext/iconv: applied fixers to improve test robustness
* ext/ldap: applied fixers to improve test robustness
* ext/pcre: applied fixers to improve test robustness
* ext/posix: applied fixers to improve test robustness
* ext/readline: applied fixers to improve test robustness
* ext/shmop: applied fixers to improve test robustness
* ext/snmp: applied fixers to improve test robustness
* ext/sodium: applied fixers to improve test robustness
* ext/sqlite3: applied fixers to improve test robustness
* ext/sysvmsg: applied fixers to improve test robustness
* ext/sysvsem: applied fixers to improve test robustness
* ext/sysvshm: applied fixers to improve test robustness
* ext/tidy: applied fixers to improve test robustness
* ext/tokenizer: applied fixers to improve test robustness
* ext/zend_test: applied fixers to improve test robustness
* ext/zlib: applied fixers to improve test robustness
Followup-PR for #21724. Using the new API in #21724 to replace dependencies
on /ext/hash in
- ext/opcache/ZendAccelerator/
- ext/soap/php_http.c
- Zend/zend_system_id.c
In the following ext, there are independent implementation of bin2hex. This PR
also change them to directly using the new Zend API.
- ext/standard/string.c
- ext/hash/php_hash.h
A number of call sites lowercased a class/function/method name into a
temporary string solely to use it as a lookup key in the class table,
function table, module registry, etc., then released it. Replace those
with zend_hash_find_ptr_lc() / zend_hash_str_find_ptr_lc(), which
lowercase into a stack buffer (for short names), perform the lookup, and
free the temporary internally.
This removes the manual tolower + release boilerplate at 17 sites and
avoids a heap allocation for the common short-name case. No behavior
change.
XXH3_state_t requires 64-byte alignment for its acc, customSecret, and
buffer members, but php_hash_alloc_context() used ecalloc(), which only
guarantees alignof(max_align_t) (typically 16 bytes on x86_64). When heap
layout broke that assumption, xxhash's aligned loads segfaulted. Add a
context_align field to php_hash_ops; when set, php_hash_alloc_context()
over-allocates and manually aligns the returned pointer, storing the offset
for php_hash_free_context() to recover the original allocation.
Fixes GH-18173
Closes GH-21668
Cleaning up the manually constructed standard parameter errors to use existing Zend helpers in bulk. This enhance readability and align with how those errors have been thrown in most places.
The current function `CHECK_HEADER_ADD_INCLUDE()` automatically defines
`HAVE_<HEADER_NAME_H>` preprocessor macros, which makes it difficult to
sync with other build systems. Specially, if some `HAVE_` macro is used
in the code and this function defines this macro but Autotools doesn't.
The new `CHECK_HEADER()` function behaves similar except it doesn't
define the `HAVE_<HEADER_NAME_H>` preprocessor macro.
This removes the following unused compile definitions:
HAVE_ARGON2_H
HAVE_AVIF_H
HAVE_BZLIB_H
HAVE_CAPSTONE_CAPSTONE_H
HAVE_CURL_EASY_H
HAVE_DB_H
HAVE_DECODE_H
HAVE_DEPOT_H
HAVE_EDITLINE_READLINE_H
HAVE_ENCHANT_H
HAVE_ENCODE_H
HAVE_FFI_H
HAVE_FIREBIRD_INTERFACE_H
HAVE_FT2BUILD_H
HAVE_GD_H
HAVE_GLIB_H
HAVE_GMP_H
HAVE_HTTPD_H
HAVE_IBASE_H
HAVE_IR_IR_H
HAVE_KECCAKHASH_H
HAVE_LBER_H
HAVE_LDAP_H
HAVE_LIBEXSLT_EXSLT_H
HAVE_LIBINTL_H
HAVE_LIBPQ_FE_H
HAVE_LIBTIDY_TIDY_H
HAVE_LIBXML_PARSER_H
HAVE_LIBXML_TREE_H
HAVE_LIBXML_XMLWRITER_H
HAVE_LIBXSLT_XSLT_H
HAVE_LMDB_H
HAVE_MBSTRING_H
HAVE_MYSQL_H
HAVE_ONIGURUMA_H
HAVE_OPENSSL_SSL_H
HAVE_PNG_H
HAVE_SNMP_H
HAVE_SODIUM_H
HAVE_SQLITE3_H
HAVE_SQLITE3EXT_H
HAVE_SYBFRONT_H
HAVE_TIDY_H
HAVE_TIDY_TIDY_H
HAVE_TIDYBUFFIO_H
HAVE_TIMELIB_CONFIG_H
HAVE_UNICODE_USPOOF_H
HAVE_UNICODE_UTF_H
HAVE_XPM_H
HAVE_ZIP_H
HAVE_ZIPCONF_H
HAVE_ZLIB_H
The following compile definitions are defined explicitly:
- HAVE_ICONV_H
- HAVE_MSCOREE_H
- HAVE_SQL_H
- HAVE_SQLEXT_H
Additionally, the `SETUP_OPENSSL()` function doesn't accept the 6th
argument anymore.
ndossche