Skip to content

Commit 3eb79e1

Browse files
ndosschendossche
committed
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3: Fix phpGH-17409: Assertion failure Zend/zend_hash.c:1730 NEWS Add comment Fix phpGH-16892: ini_parse_quantity() fails to parse inputs starting with 0x0b Fix phpGH-16886: ini_parse_quantity() fails to emit warning for 0x+0 Merge duplicate code blocks
2 parents e975c27 + a2a7287 commit 3eb79e1

File tree

6 files changed

+104
-18
lines changed

6 files changed

+104
-18
lines changed

‎NEWS‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ PHP NEWS
55
- Core:
66
. Fixed bug GH-17234 (Numeric parent hook call fails with assertion).
77
(nielsdos)
8+
. Fixed bug GH-16892 (ini_parse_quantity() fails to parse inputs starting
9+
with 0x0b). (nielsdos)
10+
. Fixed bug GH-16886 (ini_parse_quantity() fails to emit warning for 0x+0).
11+
(nielsdos)
812

913
- DOM:
1014
. Fixed bug GH-17397 (Assertion failure ext/dom/php_dom.c). (nielsdos)
@@ -35,6 +39,9 @@ PHP NEWS
3539
- PHPDBG:
3640
. Fix crashes in function registration + test. (nielsdos, Girgias)
3741

42+
- SimpleXML:
43+
. Fixed bug GH-17409 (Assertion failure Zend/zend_hash.c:1730). (nielsdos)
44+
3845
- SNMP:
3946
. Fixed bug GH-17330 (SNMP::setSecurity segfault on closed session).
4047
(David Carlier)

‎Zend/tests/zend_ini/gh16886.phpt‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
--TEST--
2+
GH-16886 (ini_parse_quantity() fails to emit warning for 0x+0)
3+
--FILE--
4+
<?php
5+
echo ini_parse_quantity('0x 0'), "\n";
6+
echo ini_parse_quantity('0x+0'), "\n";
7+
echo ini_parse_quantity('0x-0'), "\n";
8+
echo ini_parse_quantity('0b 0'), "\n";
9+
echo ini_parse_quantity('0b+0'), "\n";
10+
echo ini_parse_quantity('0b-0'), "\n";
11+
echo ini_parse_quantity('0o 0'), "\n";
12+
echo ini_parse_quantity('0o+0'), "\n";
13+
echo ini_parse_quantity('0o-0'), "\n";
14+
?>
15+
--EXPECTF--
16+
Warning: Invalid quantity "0x 0": no digits after base prefix, interpreting as "0" for backwards compatibility in %s on line %d
17+
0
18+
19+
Warning: Invalid quantity "0x+0": no digits after base prefix, interpreting as "0" for backwards compatibility in %s on line %d
20+
0
21+
22+
Warning: Invalid quantity "0x-0": no digits after base prefix, interpreting as "0" for backwards compatibility in %s on line %d
23+
0
24+
25+
Warning: Invalid quantity "0b 0": no digits after base prefix, interpreting as "0" for backwards compatibility in %s on line %d
26+
0
27+
28+
Warning: Invalid quantity "0b+0": no digits after base prefix, interpreting as "0" for backwards compatibility in %s on line %d
29+
0
30+
31+
Warning: Invalid quantity "0b-0": no digits after base prefix, interpreting as "0" for backwards compatibility in %s on line %d
32+
0
33+
34+
Warning: Invalid quantity "0o 0": no digits after base prefix, interpreting as "0" for backwards compatibility in %s on line %d
35+
0
36+
37+
Warning: Invalid quantity "0o+0": no digits after base prefix, interpreting as "0" for backwards compatibility in %s on line %d
38+
0
39+
40+
Warning: Invalid quantity "0o-0": no digits after base prefix, interpreting as "0" for backwards compatibility in %s on line %d
41+
0

‎Zend/tests/zend_ini/gh16892.phpt‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
--TEST--
2+
GH-16892 (ini_parse_quantity() fails to parse inputs starting with 0x0b)
3+
--FILE--
4+
<?php
5+
echo ini_parse_quantity('0x0b'), "\n";
6+
echo ini_parse_quantity('0xb'), "\n";
7+
echo ini_parse_quantity('-0x0B'), "\n";
8+
echo ini_parse_quantity('-0xB'), "\n";
9+
echo ini_parse_quantity('0x0beef'), "\n";
10+
echo ini_parse_quantity('0xbeef'), "\n";
11+
echo ini_parse_quantity('-0x0BEEF'), "\n";
12+
echo ini_parse_quantity('-0xBEEF'), "\n";
13+
?>
14+
--EXPECT--
15+
11
16+
11
17+
-11
18+
-11
19+
48879
20+
48879
21+
-48879
22+
-48879

‎Zend/zend_ini.c‎

Lines changed: 10 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -587,7 +587,7 @@ typedef enum {
587587
ZEND_INI_PARSE_QUANTITY_UNSIGNED,
588588
} zend_ini_parse_quantity_signed_result_t;
589589

590-
static const char *zend_ini_consume_quantity_prefix(const char *const digits, const char *const str_end) {
590+
static const char *zend_ini_consume_quantity_prefix(const char *const digits, const char *const str_end, int base) {
591591
const char *digits_consumed = digits;
592592
/* Ignore leading whitespace. */
593593
while (digits_consumed < str_end && zend_is_whitespace(*digits_consumed)) {++digits_consumed;}
@@ -598,17 +598,22 @@ static const char *zend_ini_consume_quantity_prefix(const char *const digits, co
598598
if (digits_consumed[0] == '0' && !isdigit(digits_consumed[1])) {
599599
/* Value is just 0 */
600600
if ((digits_consumed+1) == str_end) {
601-
return digits;
601+
return digits_consumed;
602602
}
603603

604604
switch (digits_consumed[1]) {
605605
case 'x':
606606
case 'X':
607607
case 'o':
608608
case 'O':
609+
digits_consumed += 2;
610+
break;
609611
case 'b':
610612
case 'B':
611-
digits_consumed += 2;
613+
if (base != 16) {
614+
/* 0b or 0B is valid in base 16, but not in the other supported bases. */
615+
digits_consumed += 2;
616+
}
612617
break;
613618
}
614619
}
@@ -696,19 +701,8 @@ static zend_ulong zend_ini_parse_quantity_internal(zend_string *value, zend_ini_
696701
return 0;
697702
}
698703
digits += 2;
699-
if (UNEXPECTED(digits == str_end)) {
700-
/* Escape the string to avoid null bytes and to make non-printable chars
701-
* visible */
702-
smart_str_append_escaped(&invalid, ZSTR_VAL(value), ZSTR_LEN(value));
703-
smart_str_0(&invalid);
704-
705-
*errstr = zend_strpprintf(0, "Invalid quantity \"%s\": no digits after base prefix, interpreting as \"0\" for backwards compatibility",
706-
ZSTR_VAL(invalid.s));
707-
708-
smart_str_free(&invalid);
709-
return 0;
710-
}
711-
if (UNEXPECTED(digits != zend_ini_consume_quantity_prefix(digits, str_end))) {
704+
/* STRTOULL may silently ignore a prefix of whitespace, sign, and base prefix, which would be invalid at this position */
705+
if (UNEXPECTED(digits == str_end || digits != zend_ini_consume_quantity_prefix(digits, str_end, base))) {
712706
/* Escape the string to avoid null bytes and to make non-printable chars
713707
* visible */
714708
smart_str_append_escaped(&invalid, ZSTR_VAL(value), ZSTR_LEN(value));

‎ext/simplexml/simplexml.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2138,8 +2138,8 @@ static void sxe_object_free_storage(zend_object *object)
21382138
sxe_object_free_iterxpath(sxe);
21392139

21402140
if (sxe->properties) {
2141-
zend_hash_destroy(sxe->properties);
2142-
FREE_HASHTABLE(sxe->properties);
2141+
ZEND_ASSERT(!(GC_FLAGS(sxe->properties) & IS_ARRAY_IMMUTABLE));
2142+
zend_hash_release(sxe->properties);
21432143
}
21442144
}
21452145
/* }}} */

‎ext/simplexml/tests/gh17409.phpt‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
--TEST--
2+
GH-17409 (Assertion failure Zend/zend_hash.c)
3+
--EXTENSIONS--
4+
simplexml
5+
--CREDITS--
6+
YuanchengJiang
7+
--FILE--
8+
<?php
9+
$root = simplexml_load_string('<?xml version="1.0"?>
10+
<root xmlns:reserved="reserved-ns">
11+
<child reserved:attribute="Sample" />
12+
</root>
13+
');
14+
// Need to use $GLOBALS such that simplexml object is destroyed
15+
var_dump(array_merge_recursive($GLOBALS, $GLOBALS)["root"]);
16+
?>
17+
--EXPECT--
18+
array(1) {
19+
["child"]=>
20+
array(0) {
21+
}
22+
}

0 commit comments

Comments
 (0)