516 Commits
Author SHA1 Message Date
David Carlier 0520bac249 Merge branch 'PHP-8.5' into PHP-8.6
* PHP-8.5:
  Fix GH-23896: Assertion failure in zend_call_function() after a throwing deprecation
2026-09-30 05:23:23 +01:00
David Carlier e6775b3fcc Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  Fix GH-23896: Assertion failure in zend_call_function() after a throwing deprecation
2026-09-30 05:23:12 +01:00
lazerg a2cdb89100 Fix GH-23896: Assertion failure in zend_call_function() after a throwing deprecation
Since GH-21699, zend_is_callable_check_class() returns false without
setting error when the error handler throws on the self/parent/static
deprecation. zend_call_function() asserted that a failed callable check
always comes with an error message, so calling such a string callback
through call_user_function() (here unserialize_callback_func=parent::...)
aborts on debug builds.

When the check fails with no error, the exception from the handler is
already pending, so zend_call_function() now returns early without
throwing a second one, the same way it does when it is entered with an
exception.

Close GH-23903
2026-09-30 05:23:06 +01:00
David Carlier 2e34c09aa5 Merge branch 'PHP-8.5' into PHP-8.6
* PHP-8.5:
  Fix GH-23897: php:function() assertion after failed registerPHPFunctions()
2026-09-25 11:51:19 +01:00
David Carlier a8927bcb0a Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  Fix GH-23897: php:function() assertion after failed registerPHPFunctions()
2026-09-25 11:51:18 +01:00
David Carlier 6eb8d06b57 Fix GH-23897: php:function() assertion after failed registerPHPFunctions()
A registerPHPFunctions() call that threw on a non callable name had
already allocated the callback namespace, leaving it in
PHP_DOM_REG_FUNC_MODE_NONE. The next php:function() call dispatched into
it and tripped the MODE_SET assertion.

Close GH-23900
2026-09-25 11:49:59 +01:00
David Carlier 6db10b644c Merge branch 'PHP-8.5'
* PHP-8.5:
  ext/xsl: XSLTProcessor::importStylesheet() use-after-free during a transformation.
2026-09-18 21:02:12 +01:00
David Carlier db2d448da5 Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  ext/xsl: XSLTProcessor::importStylesheet() use-after-free during a transformation.
2026-09-18 21:01:54 +01:00
David Carlier b55c619356 ext/xsl: XSLTProcessor::importStylesheet() use-after-free during a transformation.
Fix #23730

Importing a stylesheet from a php:function callback freed the stylesheet
libxslt was still applying, and the transformation methods kept using the
stale pointer to save the result. The transformation depth is now tracked
on the object and importStylesheet() throws while it is non-zero.

Close GH-23737
2026-09-18 21:01:49 +01:00
Ilia Alshanetsky 0c913c2208 dom: report the xpath callback node list to the cycle collector (#23596)
php_dom_xpath_callbacks_get_gc() traced php_ns and namespaces but not
node_list, which holds the nodes handed to and returned from php:function
callbacks, so a cycle running DOMXPath to node_list to node and back was
invisible to the collector. XSLTProcessor shares the registry and is
affected whenever a transform does not reach its own node list cleanup,
which a callback suspending a Fiber achieves. Reporting the list also makes
it reachable while being torn down, so clean_node_list() detaches the table
before destroying it; otherwise a node destructor calling
gc_collect_cycles() has the collector read and write entries that
zend_hash_destroy() already freed.

Closes GH-23596
2026-09-10 06:51:22 -04:00
Dmytro Kulyk 67135cb97b gen_stub: Conditionally include zend_attributes.h to arginfo based on usage (#21570)
Headers required by the generated code (zend_attributes.h, zend_constants.h, zend_enum.h) are collected during generation and emitted as includes at the top of the arginfo file, with the same preprocessor conditions and PHP version guards as the code that needs them.

Removes the manual zend_attributes.h and zend_enum.h includes from sources that only needed them for the arginfo file they include.
2026-09-06 21:25:20 +02:00
Gina Peter Banyard ee908f5542 Zend: normalise behaviour around class name ZPP specifier (#23359)
Splitting the behavioural change of #23052 out into this and come up with something that is hopefully more sensible and consistent between fast and slow ZPP and the object or class_name Fast ZPP specifier.
2026-08-21 13:31:45 +01:00
Ilia Alshanetsky c8682fb61a Merge branch 'PHP-8.5'
* PHP-8.5:
  Fix use-after-free when __clone() retains the stylesheet copy
2026-08-10 15:15:51 -04:00
Ilia Alshanetsky 46b40957b1 Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  Fix use-after-free when __clone() retains the stylesheet copy
2026-08-10 15:15:26 -04:00
Ilia Alshanetsky 11047a7a66 Fix use-after-free when __clone() retains the stylesheet copy
importStylesheet() clones the stylesheet document and hands the copy to
libxslt, which owns it and frees it together with the stylesheet. The
clone goes through zend_objects_clone_members(), so a DOMDocument
subclass __clone() can retain the copy, or a node proxy into it, and
dereference freed memory once the processor is destroyed. Require the
clone to be exclusively owned before libxslt takes it.

Closes GH-23199
2026-08-10 15:04:54 -04:00
David Carlier 9073875eb9 ext/dom: Use-after-free with namespace nodes from XSLTProcessor::registerPHPFunctions().
Fix #22621

Namespace parents from an external document() were wrapped directly
instead of through the proxy factory, so they skipped the copy that
keeps non-main-document nodes alive. A DOMNameSpaceNode retained by
userland then dangled once xsltFreeTransformContext() freed the external
document. Route the namespace parent through the proxy factory too.

close GH-22623
2026-07-10 20:41:57 +01:00
Tim Düsterhus 69e023fd84 ext/*: Make X_from_obj(zend_object *obj) functions macros (#22183)
* ext/*: Make `X_from_obj(zend_object *obj)` functions macros

With the introduction of the `ZEND_CONTAINER_OF()` macro we can now preserve
whether or not the `zend_object *` is `const` when extracting the
class-specific struct. This change will allow to use `const zend_object *` in
more locations.

Changes performed with Coccinelle followed by some manual cleanup for comment
and whitespace formatting:

    @a@
    attribute name zend_always_inline;
    type T;
    identifier obj;
    identifier f;
    typedef zend_object;
    @@

     T* f(zend_object *obj) { return ZEND_CONTAINER_OF(obj, T, std); }
    + #define f(obj) ZEND_CONTAINER_OF(obj, T, std)

    @@
    identifier a.f;
    @@

    - f(...) { ... }

    @b@
    attribute name zend_always_inline;
    type T;
    identifier obj;
    identifier f;
    typedef zend_object;
    @@

     T* f(zend_object *obj) { return ZEND_CONTAINER_OF(obj, T, zo); }
    + #define f(obj) ZEND_CONTAINER_OF(obj, T, zo)

    @@
    identifier b.f;
    @@

    - f(...) { ... }

* sockets: Fix build

* odbc: Fix build
2026-06-01 10:21:03 +02:00
Tim Düsterhus ad7cce6527 zend_portability: Add ZEND_CONTAINER_OF() (#21903)
* zend_portability: Add `ZEND_CONTAINER_OF()`

* tree-wide: Use `ZEND_CONTAINER_OF()`

Changes made with Coccinelle:

    @@
    type T_container;
    identifier member;
    expression e;
    @@

    - (T_container *)(((char *)(e)) - offsetof(T_container, member))
    + ZEND_CONTAINER_OF(e, T_container, member)

    @@
    type T_container;
    identifier member;
    expression e;
    typedef uintptr_t;
    @@

    - (T_container *)(((uintptr_t)(e)) - offsetof(T_container, member))
    + ZEND_CONTAINER_OF(e, T_container, member)

    @@
    type T_container;
    identifier member;
    expression e;
    @@

    - (const T_container *)(((char *)(e)) - offsetof(T_container, member))
    + ZEND_CONTAINER_OF(e, T_container, member)

    @@
    type T_container;
    identifier member;
    expression e;
    typedef uintptr_t;
    @@

    - (const T_container *)(((uintptr_t)(e)) - offsetof(T_container, member))
    + ZEND_CONTAINER_OF(e, T_container, member)

* bcmath: Fix `get_bcmath_number_from_obj()` const-correctness

A follow-up change to the new `ZEND_CONTAINER_OF()` macro will preserve the
`const`-ness of the input pointer. By wrapping this macro inside a macro rather
an an inline function we can preserve the `const`-ness across all layers.

* zend_portability: Keep `const`-ness in `ZEND_CONTAINER_OF()`

* zend_portability: Add C++ version to `ZEND_CONTAINER_OF()`
2026-05-19 10:47:00 +02:00
Daniel Wolfe d71eadc035 ext/xsl: Update gh21496.phpt (#21928)
Skip test if simplexml extension is disabled.
2026-05-02 06:24:50 +01:00
Tim Düsterhus 7114314c5a tree-wide: Replace XtOffsetOf by its definition (#21899)
`offsetof()` is in `stddef.h` and thus always available. The extra macro is an
unnecessary layer of indirection.
2026-04-28 22:12:56 +02:00
Ben Ramsey 7dafb839c3 license-update: ext/xsl source headers
RFC: https://wiki.php.net/rfc/php_license_update
2026-04-11 21:20:54 -05:00
David Carlier d7c3b3ab49 Merge branch 'PHP-8.5'
* PHP-8.5:
  Fix GH-21600: Remove xsltCleanupGlobals call in ext/xsl MSHUTDOWN.
2026-04-04 20:33:34 +01:00
David Carlier ea7a136c97 Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  Fix GH-21600: Remove xsltCleanupGlobals call in ext/xsl MSHUTDOWN.
2026-04-04 20:33:23 +01:00
David Carlier 96e93e9f9d Fix GH-21600: Remove xsltCleanupGlobals call in ext/xsl MSHUTDOWN.
The call to xsltCleanupGlobals() during module shutdown can cause
a segfault in xmlHashFree() when freeing libxslt internal hash
tables. This is the same class of shutdown cleanup issue that led
to xmlCleanupParser() being removed from ext/libxml. The process
is about to exit and the OS will reclaim all memory, making the
explicit cleanup both unnecessary and harmful.

close GH-21610
2026-04-04 20:32:55 +01:00
David CARLIER 8df516c2cd ext/xsl: Remove dead code in importStylesheet and use direct property slot access for doXInclude and cloneDocument. (#21533)
The node and its document are validated before cloning, making
the subsequent NULL checks on nodep and newdoc redundant.

Use OBJ_PROP_NUM via XSL_DEFINE_PROP_ACCESSOR for doXInclude and
cloneDocument, avoiding zend_string allocation and property hash
lookup per call.
2026-03-26 22:54:51 +00:00
David Carlier 1655d57751 Merge branch 'PHP-8.5'
* PHP-8.5:
  Fix GH-21496: UAF in dom_objects_free_storage.
2026-03-25 19:42:32 +00:00
David Carlier 4b79bbbe54 Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  Fix GH-21496: UAF in dom_objects_free_storage.
2026-03-25 19:41:51 +00:00
David Carlier 26ab037d7c Fix GH-21496: UAF in dom_objects_free_storage.
Cloning a non-document DOM node creates a copy within the same
xmlDoc. importStylesheet then passes that original document to
xsltParseStylesheetDoc, which may strip and free nodes during
processing, invalidating PHP objects still referencing them.

Resolve the ownerDocument for non-document nodes and clone that
instead.

close GH-21500
2026-03-25 19:41:35 +00:00
Gina Peter Banyard 674473daa9 ext/xsl: add const qualifiers when iteration over a CE's parents (#21513)
And rename the variables to proper English.
2026-03-24 17:09:59 +00:00
ndossche 8b7c70da21 Merge branch 'PHP-8.5'
* PHP-8.5:
  Fix GH-21357: XSLTProcessor works with DOMDocument, but fails with Dom\XMLDocument
2026-03-11 22:31:39 +01:00
ndossche a3f486dfa3 Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  Fix GH-21357: XSLTProcessor works with DOMDocument, but fails with Dom\XMLDocument
2026-03-11 22:31:33 +01:00
ndossche 284fd7779d Fix GH-21357: XSLTProcessor works with DOMDocument, but fails with Dom\XMLDocument
Registering namespace after the parsing is too late because parsing can
fail due to attributes referencing namespaces.
So we have to register fake namespaces before the parsing.
However, the clone operation reconciles namespaces in the wrong way, so
we have to clone via an object.

Closes GH-21371.
2026-03-11 22:31:03 +01:00
Alexandre Daubois 11a95749b1 Convert more zend_parse_parameters_none() to fast ZPP (#21330) 2026-03-04 14:07:46 +01:00
Petr Sumbera ce1cadba29 Fix Solaris tests and add nightly CI job
Closes GH-20709
2026-03-04 10:12:03 +01:00
Peter Kokot f17c5ad83b Windows build: Add new function CHECK_HEADER() (#21191)
The current function `CHECK_HEADER_ADD_INCLUDE()` automatically defines
`HAVE_<HEADER_NAME_H>` preprocessor macros, which makes it difficult to
sync with other build systems. Specially, if some `HAVE_` macro is used
in the code and this function defines this macro but Autotools doesn't.

The new `CHECK_HEADER()` function behaves similar except it doesn't
define the `HAVE_<HEADER_NAME_H>` preprocessor macro.

This removes the following unused compile definitions:

HAVE_ARGON2_H
HAVE_AVIF_H
HAVE_BZLIB_H
HAVE_CAPSTONE_CAPSTONE_H
HAVE_CURL_EASY_H
HAVE_DB_H
HAVE_DECODE_H
HAVE_DEPOT_H
HAVE_EDITLINE_READLINE_H
HAVE_ENCHANT_H
HAVE_ENCODE_H
HAVE_FFI_H
HAVE_FIREBIRD_INTERFACE_H
HAVE_FT2BUILD_H
HAVE_GD_H
HAVE_GLIB_H
HAVE_GMP_H
HAVE_HTTPD_H
HAVE_IBASE_H
HAVE_IR_IR_H
HAVE_KECCAKHASH_H
HAVE_LBER_H
HAVE_LDAP_H
HAVE_LIBEXSLT_EXSLT_H
HAVE_LIBINTL_H
HAVE_LIBPQ_FE_H
HAVE_LIBTIDY_TIDY_H
HAVE_LIBXML_PARSER_H
HAVE_LIBXML_TREE_H
HAVE_LIBXML_XMLWRITER_H
HAVE_LIBXSLT_XSLT_H
HAVE_LMDB_H
HAVE_MBSTRING_H
HAVE_MYSQL_H
HAVE_ONIGURUMA_H
HAVE_OPENSSL_SSL_H
HAVE_PNG_H
HAVE_SNMP_H
HAVE_SODIUM_H
HAVE_SQLITE3_H
HAVE_SQLITE3EXT_H
HAVE_SYBFRONT_H
HAVE_TIDY_H
HAVE_TIDY_TIDY_H
HAVE_TIDYBUFFIO_H
HAVE_TIMELIB_CONFIG_H
HAVE_UNICODE_USPOOF_H
HAVE_UNICODE_UTF_H
HAVE_XPM_H
HAVE_ZIP_H
HAVE_ZIPCONF_H
HAVE_ZLIB_H

The following compile definitions are defined explicitly:

- HAVE_ICONV_H
- HAVE_MSCOREE_H
- HAVE_SQL_H
- HAVE_SQLEXT_H

Additionally, the `SETUP_OPENSSL()` function doesn't accept the 6th
argument anymore.
2026-03-03 20:06:40 +01:00
Arshid 6b92940363 ext/xls: Replace RETVAL_TRUE/RETVAL_FALSE with RETVAL_BOOL (#21278) 2026-02-23 16:01:51 +01:00
Arnaud Le Blanc 65b4073922 Include the actual stub name in generated arginfo headers (#20993) 2026-01-21 20:57:00 +01:00
Niels Dossche 57ce245e1e Reduce code bloat in arginfo by using specialised string releases (#20016)
* Reduce code bloat in arginfo by using specialised string releases

Comparing this patch to master (c7da728574),
with a plain configure command without any options:

```
   text	   data	    bss	    dec	    hex	filename
20683738	1592400	 137712	22413850	156021a	sapi/cli/php
20688522	1592400	 137712	22418634	15614ca	sapi/cli/php_old
```

We see a minor reduction of 0.023% in code size.

* Also use true for the other initialization line

* Also use specialized code for consts
2025-10-02 22:00:20 +02:00
Niels Dossche c1a6627417 Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  Fix NEWS order
  Fix GH-19988: zend_string_init with NULL pointer in simplexml (UB)
2025-09-29 16:08:56 +02:00
Niels Dossche 1bda46eb83 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix NEWS order
  Fix GH-19988: zend_string_init with NULL pointer in simplexml (UB)
2025-09-29 16:08:31 +02:00
Niels Dossche d94846c3b4 Fix GH-19988: zend_string_init with NULL pointer in simplexml (UB)
Normally, simplexml cannot import document nodes,
but xsl allows to circumvent this.
A document does not have a name, so we return the empty string
in that case.
While we could add an explicit check, we might as well switch
the macro to a form that would be more optimal anyway as many
tag names can be single characters.

The test was added in xsl because adding it in simplexml would
break out-of-tree builds of simplexml.

Closes GH-19990.
2025-09-29 16:07:34 +02:00
Daniel Scherzer 3f3a266a2b gen_stub: Infer constants' types from values (#19568)
Don't require `@var` with a type when the type can be inferred from a literal
value in the stub file.
2025-09-03 18:26:43 -07:00
Gina Peter Banyard 105c1e9896 tree: use zend_str_has_nul_byte() API (#19336) 2025-07-31 23:57:27 +01:00
DanielEScherzer ddd33fd7e4 Generated arginfo headers: combine preprocessor conditional blocks (2) (#18667)
When global constants' or class constants' availability is based on some
preprocessor condition, the generated arginfo header files wrap the
declarations in the preprocessor `#if` conditional blocks, one per declaration,
even if they are in the same conditional block based on comments in the stub
file. Instead of having multiple conditional blocks one after the other with
the same condition, combine them into a single conditional block.
2025-06-22 14:35:28 -07:00
Niels Dossche 77b6a795d3 Merge branch 'PHP-8.4'
* PHP-8.4:
  Fix using Dom\Node with Dom\XPath callbacks
2025-02-22 16:00:45 +01:00
Niels Dossche 7974c62873 Fix using Dom\Node with Dom\XPath callbacks
This code was introduced when the Dom\Node and DOMNode classes were
still aliases, so the type check was never updated.
We fix this by checking if the doc pointer follows the spec and pick the
right node CE based on that.

Closes GH-17888.
2025-02-22 16:00:39 +01:00
Niels Dossche daa94cf279 Implement request #30622: make $namespace parameter functional
This parameter never actually did anything and was forgotten about.
We solve this by detecting when we have a $namespace argument
(that won't conflict with the name argument) and creating a Clark
notation name out of it.

Closes GH-16123.
2024-09-30 20:34:51 +02:00
Máté Kocsis 8d12f666ae Fix registration of internal readonly child classes (#15459)
Currently, internal classes are registered with the following code:

INIT_CLASS_ENTRY(ce, "InternalClass", class_InternalClass_methods);
class_entry = zend_register_internal_class_ex(&ce, NULL);
class_entry->ce_flags |= ...;

This has worked well so far, except if InternalClass is readonly. It is because some inheritance checks are run by zend_register_internal_class_ex before ZEND_ACC_READONLY_CLASS is added to ce_flags.

The issue is fixed by adding a zend_register_internal_class_with_flags() zend API function that stubs can use from now on. This function makes sure to add the flags before running any checks. Since the new API is not available in lower PHP versions, gen_stub.php has to keep support for the existing API for PHP 8.3 and below.
2024-08-24 12:36:54 +02:00
Peter Kokot 2cbde5ae77 Autotools: Use a no-op command in PKG_CHECK_MODULES (#15562)
Instead of using a space for the "do nothing" command in the
PKG_CHECK_MODULES 2nd argument when libexslt is not found, the no-op
command ":" is perhaps a bit clearer and is in most cases used in such
scenarios and macro arguments.
2024-08-23 22:35:59 +02:00
Peter Kokot 687eb9125a Autotools: Remove dependency related errors (#15344)
- ext/dom
- ext/xsl

These use the PHP_ADD_EXTENSION_DEP macro which throws error when one of
the dependencies is disabled or not configured properly.

For example:
    ./configure --disable-all --enable-dom

or
    ./configure --disable-all --with-xsl

Will throw default PHP dependency error info, when using
PHP_ADD_EXTENSION_DEP.

These errors were once done when PHP_ADD_EXTENSION_DEP macro wasn't yet
available.
2024-08-11 17:39:31 +02:00