- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Jakub Zelenka <bukka@php.net>
Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
Headers required by the generated code (zend_attributes.h, zend_constants.h, zend_enum.h) are collected during generation and emitted as includes at the top of the arginfo file, with the same preprocessor conditions and PHP version guards as the code that needs them.
Removes the manual zend_attributes.h and zend_enum.h includes from sources that only needed them for the arginfo file they include.
php_json_encode_array() reads a hooked property into a local zval and
bails out when an exception is pending. The get hook can publish its
return value into that zval and then throw while its frame is freed,
for example from the destructor of one of its locals, so the bailout
leaks the value until request shutdown. Destroy it on the way out, the
way the other failure exit already does.
Closes GH-22919
Instead of tracking columns during lexing, which costs performance for
something that will only be required in the unexpected failure path, we now
only track the line numbers and calculate the column on demand when an error
occurs.
As part of this we also fix GH-22487 by adjusting the logic to report the
column based on the (UTF-8) column in the source, instead of treating
`\uXXXX` escapes as a single column, which users will need to count manually
instead of being able to rely on their editor or `mb_substr()` or similar.
[tim: (re)written the commit message]
Co-authored-by: Tim Düsterhus <tim@bastelstu.be>
php_json_encode_serializable_object() holds a raw pointer to the object
across the jsonSerialize() call, then reads its recursion guard and
compares the returned value's identity against it. A user error handler
triggered from jsonSerialize() can drop the last reference to the object,
for example by nulling a reference that aliases the encoded array slot,
freeing it before those reads and causing a use-after-free.
Hold a reference on the object across the call. The array path already
guards against this with a ZVAL_COPY; the JsonSerializable object path
did not. Same use-after-free class as GH-21024 in var_dump().
This will make it both easier to consume the error information and reduce the
chance for mistakes when settings errors, because not every field will need to
be set manually.
The functions that have been removed as part of this change were added in
master only, thus removing those is not an API change between the latest stable
(PHP 8.5) and this PR.
Fixesphp/php-src#22420.
`tmp` can only ever be non-undef if there's a hooked object property, which is
already an `UNEXPECTED()` case. Keep track of whether this case is hit or not
to avoid needlessly calling `zval_ptr_dtor()`.
For:
<?php
$len = 0;
for ($i = 0; $i < 3_000_000; $i++) {
$len += strlen(json_encode(array_fill(0, 20, [])));
}
var_dump($len);
This is ~1.02 faster for a gcc 13.3 release build on a Intel(R) Core(TM)
i7-1365U.
Benchmark 1: /tmp/bench/before /tmp/bench/test6.php
Time (mean ± σ): 762.7 ms ± 3.2 ms [User: 758.5 ms, System: 2.8 ms]
Range (min … max): 759.2 ms … 769.3 ms 10 runs
Benchmark 2: /tmp/bench/after /tmp/bench/test6.php
Time (mean ± σ): 748.3 ms ± 9.0 ms [User: 744.3 ms, System: 3.1 ms]
Range (min … max): 740.8 ms … 766.2 ms 10 runs
Summary
/tmp/bench/after /tmp/bench/test6.php ran
1.02 ± 0.01 times faster than /tmp/bench/before /tmp/bench/test6.php
Instead of using a boolean flag to check for each element whether or not it is
the first, we just unconditionally append a comma after each element and then
remove the last comma at the end.
For:
<?php
$len = 0;
for ($i = 0; $i < 3_000_000; $i++) {
$len += strlen(json_encode(array_fill(0, 20, [])));
}
var_dump($len);
This is ~1.06 faster for a gcc 13.3 release build on a Intel(R) Core(TM)
i7-1365U.
Benchmark 1: /tmp/bench/before /tmp/bench/test6.php
Time (mean ± σ): 819.6 ms ± 2.8 ms [User: 816.4 ms, System: 2.4 ms]
Range (min … max): 816.9 ms … 825.0 ms 10 runs
Benchmark 2: /tmp/bench/after /tmp/bench/test6.php
Time (mean ± σ): 770.8 ms ± 5.8 ms [User: 766.6 ms, System: 2.9 ms]
Range (min … max): 765.3 ms … 785.8 ms 10 runs
Summary
/tmp/bench/after /tmp/bench/test6.php ran
1.06 ± 0.01 times faster than /tmp/bench/before /tmp/bench/test6.php
On s390x the stack is smaller and/or the object dtor code uses more stack,
which causes the destruction of deeply nested objects to crash in these
tests. Here I ensure that objects are released one by one at the end of the
tests to avoid recursive dtor.
Closes GH-16561
Fixes GH-16528
The JSON encoder is recursive, and it's far from easy to make it
iterative. Add a cheap stack limit check to prevent a segfault.
This uses the PHP_JSON_ERROR_DEPTH error code that already talks about
the stack depth. Previously this was only used for the $depth argument.
Closes GH-16059.
When a class (or enum) has no methods, rather than using an array that only
contains `ZEND_FE_END`, use `NULL` for the functions. The implementation of
class registration for internal classes, `do_register_internal_class()` in
zend_API.c, already skips classes where the functions are `NULL`. By removing
these unneeded arrays, we can reduce the size of the header files, while also
removing an unneeded call to zend_register_functions() for each internal class
with no extra methods.
Currently, internal classes are registered with the following code:
INIT_CLASS_ENTRY(ce, "InternalClass", class_InternalClass_methods);
class_entry = zend_register_internal_class_ex(&ce, NULL);
class_entry->ce_flags |= ...;
This has worked well so far, except if InternalClass is readonly. It is because some inheritance checks are run by zend_register_internal_class_ex before ZEND_ACC_READONLY_CLASS is added to ce_flags.
The issue is fixed by adding a zend_register_internal_class_with_flags() zend API function that stubs can use from now on. This function makes sure to add the flags before running any checks. Since the new API is not available in lower PHP versions, gen_stub.php has to keep support for the existing API for PHP 8.3 and below.
* Include from build dir first
This fixes out of tree builds by ensuring that configure artifacts are included
from the build dir.
Before, out of tree builds would preferably include files from the src dir, as
the include path was defined as follows (ignoring includes from ext/ and sapi/) :
-I$(top_builddir)/main
-I$(top_srcdir)
-I$(top_builddir)/TSRM
-I$(top_builddir)/Zend
-I$(top_srcdir)/main
-I$(top_srcdir)/Zend
-I$(top_srcdir)/TSRM
-I$(top_builddir)/
As a result, an out of tree build would include configure artifacts such as
`main/php_config.h` from the src dir.
After this change, the include path is defined as follows:
-I$(top_builddir)/main
-I$(top_builddir)
-I$(top_srcdir)/main
-I$(top_srcdir)
-I$(top_builddir)/TSRM
-I$(top_builddir)/Zend
-I$(top_srcdir)/Zend
-I$(top_srcdir)/TSRM
* Fix extension include path for out of tree builds
* Include config.h with the brackets form
`#include "config.h"` searches in the directory containing the including-file
before any other include path. This can include the wrong config.h when building
out of tree and a config.h exists in the source tree.
Using `#include <config.h>` uses exclusively the include path, and gives
priority to the build dir.
The --no-generation-date flag is a common re2c flag used in all re2c
invocations. This adds the 2nd optional argument to PHP_PROG_RE2C M4
macro in BC manner to set the default re2c command-line options and sets
the default RE2C_FLAGS similarly on Windows.
Ilija Tovilo