209 Commits
Author SHA1 Message Date
ndossche 8867746907 Merge branch 'PHP-8.6'
* PHP-8.6:
  Fix use-after-free in Randomizer::shuffleArray() when the engine throws
2026-10-28 08:25:23 +01:00
ndossche 30bcf4bd89 Merge branch 'PHP-8.5' into PHP-8.6
* PHP-8.5:
  Fix use-after-free in Randomizer::shuffleArray() when the engine throws
2026-10-28 08:25:17 +01:00
ndossche dbd6ed433d Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  Fix use-after-free in Randomizer::shuffleArray() when the engine throws
2026-10-28 08:24:57 +01:00
Martin Mirchev 3a8bcb6d18 Fix use-after-free in Randomizer::shuffleArray() when the engine throws
php_array_data_shuffle() first compacts the holes of a packed array and
only then updates nNumUsed. When the engine threw in between, the stale
tail slots were still counted, so the moved values were released twice
when the copied array was destroyed. Update nNumUsed right after the
compaction.

Closes GH-24553.
2026-10-28 08:24:25 +01:00
Daniel Scherzer 825bf1b4aa Merge branch 'PHP-8.6'
* PHP-8.6:
  [`%pS` migration] Use `%pS` in ext/random (#23167)
2026-10-04 19:08:26 -07:00
Daniel Scherzer a05adf52a6 [%pS migration] Use %pS in ext/random (#23167) 2026-10-04 19:07:48 -07:00
Marc 37d0ef5a66 Zend: Remove zend_atomic.[ch] abstraction (#23927) 2026-09-29 16:30:30 +02:00
Tim Düsterhus c5e45a1767 tree-wide: Replace ZEND_STATIC_ASSERT() by static_assert() (#21228)
* tree-wide: Replace `ZEND_STATIC_ASSERT()` by `static_assert()`

* zend_portability: Remove `ZEND_STATIC_ASSERT()`
2026-09-25 12:21:01 +02:00
Noah Webber 5a9d50dc61 Fix typos, grammatical errors, and refactor misspelled local identifiers (#23803)
Correct typographical and grammatical mistakes across docs, comments, and build tools. Refactor local identifiers childrens to children in RecursiveFilterIterator and sav to saved_char in sapi_header_add_op.
2026-09-24 15:56:13 +02:00
eafcd68369 zend_API: Verify property types in object_properties_load() (#23639)
* zend_API: Verify property types in `object_properties_load()`

Fixes php/php-src#9708.

* zend_API: Fix various issues in `object_properties_load()`

Fixes Fixes php/php-src#9707.

Co-authored-by: Tim Düsterhus <tim@tideways-gmbh.com>

* NEWS

* random: Remove now-obsolete manual `$engine` type check in `Randomizer::__unserialize()`

* zend_API: Make `object_properties_load()` use `strict_types=1`

This is consistent with regular unserialization, which also performs strict
type checking.

Co-authored-by: Gina Peter Banyard <girgias@php.net>

* Block creation of readonly reference properties

Co-authored-by: Arnaud Le Blanc <365207+arnaud-lb@users.noreply.github.com>

---------

Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Gina Peter Banyard <girgias@php.net>
Co-authored-by: Arnaud Le Blanc <365207+arnaud-lb@users.noreply.github.com>
2026-09-15 20:09:44 +02:00
Dmytro Kulyk 67135cb97b gen_stub: Conditionally include zend_attributes.h to arginfo based on usage (#21570)
Headers required by the generated code (zend_attributes.h, zend_constants.h, zend_enum.h) are collected during generation and emitted as includes at the top of the arginfo file, with the same preprocessor conditions and PHP version guards as the code that needs them.

Removes the manual zend_attributes.h and zend_enum.h includes from sources that only needed them for the arginfo file they include.
2026-09-06 21:25:20 +02:00
NickSdot a5a94766b6 ext/random: applied fixers to improve test robustness 2026-08-01 17:25:44 +02:00
Weilin Du de6828f50a Remove several useless include <sys/param.h> (#22611)
None of these files have use the sys/param.h file.
2026-07-07 01:20:33 +08:00
henderkes 915318ed9c make all static extensions use TSRMG_STATIC
Closes GH-22277
2026-06-26 14:18:52 +02:00
Tim Düsterhus 69e023fd84 ext/*: Make X_from_obj(zend_object *obj) functions macros (#22183)
* ext/*: Make `X_from_obj(zend_object *obj)` functions macros

With the introduction of the `ZEND_CONTAINER_OF()` macro we can now preserve
whether or not the `zend_object *` is `const` when extracting the
class-specific struct. This change will allow to use `const zend_object *` in
more locations.

Changes performed with Coccinelle followed by some manual cleanup for comment
and whitespace formatting:

    @a@
    attribute name zend_always_inline;
    type T;
    identifier obj;
    identifier f;
    typedef zend_object;
    @@

     T* f(zend_object *obj) { return ZEND_CONTAINER_OF(obj, T, std); }
    + #define f(obj) ZEND_CONTAINER_OF(obj, T, std)

    @@
    identifier a.f;
    @@

    - f(...) { ... }

    @b@
    attribute name zend_always_inline;
    type T;
    identifier obj;
    identifier f;
    typedef zend_object;
    @@

     T* f(zend_object *obj) { return ZEND_CONTAINER_OF(obj, T, zo); }
    + #define f(obj) ZEND_CONTAINER_OF(obj, T, zo)

    @@
    identifier b.f;
    @@

    - f(...) { ... }

* sockets: Fix build

* odbc: Fix build
2026-06-01 10:21:03 +02:00
Tim Düsterhus 5212b816d2 zend_objects: Make old_object a const* in zend_objects_clone_members() (#22089)
* zend_objects: Make `old_object` a `const*` in `zend_objects_clone_members()`

* tree-wide: Make the original object `const` in `clone_obj` handlers
2026-05-19 14:16:03 +02:00
Tim Düsterhus ad7cce6527 zend_portability: Add ZEND_CONTAINER_OF() (#21903)
* zend_portability: Add `ZEND_CONTAINER_OF()`

* tree-wide: Use `ZEND_CONTAINER_OF()`

Changes made with Coccinelle:

    @@
    type T_container;
    identifier member;
    expression e;
    @@

    - (T_container *)(((char *)(e)) - offsetof(T_container, member))
    + ZEND_CONTAINER_OF(e, T_container, member)

    @@
    type T_container;
    identifier member;
    expression e;
    typedef uintptr_t;
    @@

    - (T_container *)(((uintptr_t)(e)) - offsetof(T_container, member))
    + ZEND_CONTAINER_OF(e, T_container, member)

    @@
    type T_container;
    identifier member;
    expression e;
    @@

    - (const T_container *)(((char *)(e)) - offsetof(T_container, member))
    + ZEND_CONTAINER_OF(e, T_container, member)

    @@
    type T_container;
    identifier member;
    expression e;
    typedef uintptr_t;
    @@

    - (const T_container *)(((uintptr_t)(e)) - offsetof(T_container, member))
    + ZEND_CONTAINER_OF(e, T_container, member)

* bcmath: Fix `get_bcmath_number_from_obj()` const-correctness

A follow-up change to the new `ZEND_CONTAINER_OF()` macro will preserve the
`const`-ness of the input pointer. By wrapping this macro inside a macro rather
an an inline function we can preserve the `const`-ness across all layers.

* zend_portability: Keep `const`-ness in `ZEND_CONTAINER_OF()`

* zend_portability: Add C++ version to `ZEND_CONTAINER_OF()`
2026-05-19 10:47:00 +02:00
Tim Düsterhus 7114314c5a tree-wide: Replace XtOffsetOf by its definition (#21899)
`offsetof()` is in `stddef.h` and thus always available. The extra macro is an
unnecessary layer of indirection.
2026-04-28 22:12:56 +02:00
Tim Düsterhus 11f0288c29 random: Drop leading _ from struct names (#21856) 2026-04-23 21:21:57 +02:00
Tim Düsterhus 21811294fa Merge branch 'PHP-8.5'
* PHP-8.5:
  Fix order in NEWS
  Fix GH-21731: Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state (#21732)
2026-04-12 19:53:59 +02:00
Tim Düsterhus 73eace2398 Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  Fix GH-21731: Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state (#21732)
2026-04-12 19:53:24 +02:00
Ilia Alshanetsky 1a428e528f Fix GH-21731: Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state (#21732)
The constructor rejects a seed that would leave the internal state
all zero, because xoshiro256** with zero state produces 0 on every
call forever. The unserialize callback didn't check the same
invariant. A caller feeding a crafted serialized payload through
__unserialize() ended up with a live engine that returned 0 from
every operation.

Match the constructor: reject the all-zero state from the unserialize
callback too. The Mt19937-aliased __unserialize() wrapper turns the
false return into the standard "Invalid serialization data" exception.

Closes GH-21731
2026-04-12 19:51:30 +02:00
Tim Düsterhus 7415c50472 Merge branch 'PHP-8.5'
* PHP-8.5:
  Fix GH-21730: Mt19937::__debugInfo() leaks state HashTable when the serialize callback fails (#21733)
2026-04-12 18:44:11 +02:00
Tim Düsterhus 46940a0444 Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  Fix GH-21730: Mt19937::__debugInfo() leaks state HashTable when the serialize callback fails (#21733)
2026-04-12 18:43:32 +02:00
Ilia Alshanetsky 5e6b90e2cc Fix GH-21730: Mt19937::__debugInfo() leaks state HashTable when the serialize callback fails (#21733)
Mt19937::__debugInfo() allocates a temporary HashTable with
array_init(&t), calls the engine's serialize callback, and then
inserts t into the return value. If the callback returns false, the
method throws and hits RETURN_THROWS() before inserting t, so the
HashTable leaks. PcgOneseq128XslRr64 and Xoshiro256StarStar alias
the same method and share the leak.

Niels Dossche fixed the same pattern in __serialize() via GH-20383
(720e006982). That cleanup didn't touch __debugInfo(). Apply the
same reordering here: insert t into return_value first, then let
the callback populate it. RETURN_THROWS() then unwinds the return
value cleanly.

The path is latent in stock PHP because the three built-in serialize
callbacks (mt19937, pcg, xoshiro) all return true, so no user code
reaches the leak today. I'm fixing it for symmetry with GH-20383 and
to keep the pattern from regressing if a future engine grows a
failing serialize path.

Closes GH-21730
2026-04-12 18:43:19 +02:00
Ben Ramsey 712d22d0db license-update: ext/random source headers
RFC: https://wiki.php.net/rfc/php_license_update
2026-04-11 21:20:54 -05:00
Peter Kokot 345bf38480 Install missing headers (#21125)
These are included in public headers and should therefore be also
installed.

Follow-up of d16e6f52a4
2026-02-04 17:10:53 +01:00
Arnaud Le Blanc d16e6f52a4 Generate C enums from internal enums, introduce Z_PARAM_ENUM() (#20917)
Update gen_stubs.php to generate C enums from internal enums, when the stub is annotated with @generate-c-enums. Enum values can be compared to the result of zend_enum_fetch_case_id(zend_object*).

The generated enums are added to separate files named {$extensionName}_decl.h, so that it's possible to include these from anywhere. _arginfo.h files would generate warnings if we tried to include them in a compilation unit that doesn't call the register_{$class} functions, for instance.

Introduce Z_PARAM_ENUM().

* Make ZEND_AST_CONST_ENUM_INIT a 4-children node

* Store enum case id in ZEND_AST_CONST_ENUM_INIT

* Store enum case id in instance

* Expose enum case_id internally

* Generate C enum for internal enums

* Introduce Z_PARAM_ENUM()

* Port extensions
2026-02-03 12:38:04 +01:00
Arnaud Le Blanc 65b4073922 Include the actual stub name in generated arginfo headers (#20993) 2026-01-21 20:57:00 +01:00
Weilin Du 4f793ba1c3 [skip ci] Fix duplicate words typos (GH-20800) 2025-12-31 02:22:09 +01:00
Niels Dossche 928af45bda Merge branch 'PHP-8.5'
* PHP-8.5:
  random: Fix memory leak when serialization fails (#20383)
2025-11-04 08:33:55 +01:00
Niels Dossche 7bc8ecb623 Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  random: Fix memory leak when serialization fails (#20383)
2025-11-04 08:33:44 +01:00
Niels Dossche 3c1c7a0fe4 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  random: Fix memory leak when serialization fails (#20383)
2025-11-04 08:33:31 +01:00
Niels DosscheandTim Düsterhus 720e006982 random: Fix memory leak when serialization fails (#20383)
Co-authored-by: Tim Düsterhus <timwolla@googlemail.com>
2025-11-04 08:32:22 +01:00
Niels Dossche b460062f70 random: Use ZVAL_EMPTY_ARRAY() for members in serialization (#20382) 2025-11-04 08:32:06 +01:00
Niels Dossche b59479ca33 Merge branch 'PHP-8.5'
* PHP-8.5:
  Fix Randomizer::__serialize() wrt INDIRECTs
2025-10-08 17:39:26 +02:00
Niels Dossche d0615d7a0d Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  Fix Randomizer::__serialize() wrt INDIRECTs
2025-10-08 17:39:20 +02:00
Niels Dossche bd84731f40 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix Randomizer::__serialize() wrt INDIRECTs
2025-10-08 17:39:14 +02:00
Niels Dossche c5fa7696e6 Fix Randomizer::__serialize() wrt INDIRECTs
First follow-up to GH-20102.
INDIRECTs must never get exposed to userland. The simple solution is to
duplicate the properties array.

Closes GH-20103.
2025-10-08 17:38:51 +02:00
Niels Dossche 57ce245e1e Reduce code bloat in arginfo by using specialised string releases (#20016)
* Reduce code bloat in arginfo by using specialised string releases

Comparing this patch to master (c7da728574),
with a plain configure command without any options:

```
   text	   data	    bss	    dec	    hex	filename
20683738	1592400	 137712	22413850	156021a	sapi/cli/php
20688522	1592400	 137712	22418634	15614ca	sapi/cli/php_old
```

We see a minor reduction of 0.023% in code size.

* Also use true for the other initialization line

* Also use specialized code for consts
2025-10-02 22:00:20 +02:00
Tim Düsterhus f08fe17a53 Merge branch 'PHP-8.4'
* PHP-8.4:
  zend_API: Do not overwrite `readonly` properties in `object_properties_load()` (#19767)
2025-09-09 19:36:00 +02:00
Tim Düsterhus 9b71c61632 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  zend_API: Do not overwrite `readonly` properties in `object_properties_load()` (#19767)
2025-09-09 19:34:32 +02:00
Tim Düsterhus 215ebbb8d5 zend_API: Do not overwrite readonly properties in object_properties_load() (#19767)
Fixes php/php-src#19765.
2025-09-09 19:33:45 +02:00
Tim Düsterhus fc467dcb64 random: Use ->default_object_handlers for engines (#19625) 2025-08-29 11:12:46 +02:00
DanielEScherzer 1eadf553f1 Arginfo: avoid using temporary zvals for initializing attribute values (#19141)
Instead of
* adding a zval on the stack
* initializing it
* copying the value to the attribute

Just initialize the value directly in the zend_attribute_arg
2025-07-21 13:33:51 -07:00
Daniel Scherzer 142e378618 Arginfo: add and use known strings for attribute values 2025-07-14 17:31:22 -07:00
DanielEScherzer 9225cb45ac Make zend_register_*_constant() functions return pointers, use them (#19029)
Have each of the specialized methods for registering a constant return a
pointer to the registered constant the same way that the generic
`zend_register_constant()` function does, and use those in the generated
arginfo files to avoid needing to search for a constant that was just
registered in order to add attributes to it.
2025-07-07 12:23:52 -07:00
Tim Düsterhus 4492a4219a random: Remove useless zend_string allocation in randomizer_common_init() (#19007) 2025-07-03 08:48:49 +02:00
Tim Düsterhus 1a4dfd5658 random: Fix error message formatting for Randomizer::getFloat() (#19008)
Error messages should not end with a `.`.
2025-07-02 13:58:05 +02:00
DanielEScherzer 171501b93f Replace @deprecated with #[\Deprecated] for internal constants (#18780)
Only covers constants declared via stub files, others will be handled
separately in a later commit.

Does not include the intl extension, since that had some errors relating to the
cpp code; that extension will be updated separately.
2025-06-26 11:27:15 -07:00