[pull] master from php:master#1113
Merged
Merged
Conversation
Fix #22447 xmlHasProp() matches an attribute by local name only, ignoring its namespace, whereas xmlAddChild()/xmlAddPrevSibling() dedup an incoming no-namespace attribute via xmlHasNsProp(..., NULL), which matches only attributes with no namespace. When both a no-namespace and a namespaced attribute share a local name, the pre-insertion check unlinked the wrong (namespaced) attribute, leaving libxml to free the still-wrapped no-namespace duplicate and producing a use-after-free at request shutdown. Use xmlHasNsProp(..., NULL) so the pre-insertion check matches libxml's internal duplicate detection, as advised by @nwellnhof. Close GH-22452
* PHP-8.4: ext/dom: fix UAF when setting an attribute colliding by local name.
* PHP-8.5: ext/dom: fix UAF when setting an attribute colliding by local name.
…andler() (#22764) Fixes GH-22763. The reproducer triggers an assertion failure in `zend_jit_use_reg()` because a var has `jit->ra[var].ref == IR_NULL` but `jit->ra[var].flags` doesn't contain `ZREG_LOAD`. This happens because of the following events: * An in-register variable is spilled to the VM stack frame by IR (IR_REG_SPILL_SPECIAL) * zend_jit_snapshot_handler() set the stack descriptor to .flags = ZREG_TYPE_ONLY, .reg = ZREG_NONE * During a subsequent call to zend_jit_snapshot_handler(), the reg is not IR_REG_SPILL_SPECIAL anymore, so .reg is set but .flags remains ZREG_TYPE_ONLY which is inconsistent * A side trace inherits from this stack descriptor * zend_jit_trace_deoptimization() doesn't set `jit->ra[var].ref` for this var because `.flags == ZREG_TYPE_ONLY`, which causes the assertion failure later Fix by removing irrelevant flags when setting reg in zend_jit_snapshot_handler().
* PHP-8.5: Clear ZREG_TYPE_ONLY flag for in-register vars in zend_jit_snapshot_handler() (#22764)
Preloading will try to evaluate class constants during compilation but evaluated FCCs are objects, which can not be persisted. Apply the same fix as for enums: Fail evaluation when compiling. Preloading will also reset CG(map_ptr_last) after compilation, which results in collisions if map ptrs were allocated during compilation. Move the ZEND_MAP_PTR_NEW() to the persist phase, as a shared map ptr is not necessary before that. Fixes GH-22782.
* PHP-8.5: Fix const expr support in preloading (#22783)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )