Skip to content

Commit a33d40d

Browse files
dstogovdstogov
committed
Merge branch 'master' into jit-dynasm
* master: Removed impossible condition fix bug related to php#865 Fix bug #69579 Fix bug #69579 update NEWS update NEWS Fixed bug #73126 Cannot pass parameter 1 by reference Limit size of result set for test query update NEWS PHP bug 67130: nextRowset should work with unfetched rows Move dtor before memory freed to avoid invalid read Fixed skip Skip failing FreeType tests for now
2 parents 4bd52cf + 42db690 commit a33d40d

19 files changed

+168
-30
lines changed

‎Zend/tests/traits/bug69579.phpt

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
--TEST--
2+
Bug #69579 (Internal trait double-free)
3+
--SKIPIF--
4+
<?php
5+
if (!PHP_DEBUG) die("skip only run in debug version");
6+
?>
7+
--FILE--
8+
<?php
9+
10+
class Bar{
11+
use _ZendTestTrait;
12+
}
13+
14+
$bar = new Bar();
15+
var_dump($bar->testMethod());
16+
// destruction causes a double-free and explodes
17+
18+
?>
19+
--EXPECT--
20+
bool(true)

‎Zend/tests/traits/get_declared_traits_001.phpt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ final class e { }
1212
var_dump(get_declared_traits());
1313

1414
?>
15-
--EXPECT--
16-
array(1) {
17-
[0]=>
15+
--EXPECTF--
16+
array(%d) {%A
17+
[%d]=>
1818
string(1) "c"
1919
}

‎Zend/tests/traits/get_declared_traits_002.phpt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ namespace test {
1313
}
1414

1515
?>
16-
--EXPECT--
17-
array(1) {
18-
[0]=>
16+
--EXPECTF--
17+
array(%d) {%A
18+
[%d]=>
1919
string(6) "test\c"
2020
}

‎Zend/tests/traits/get_declared_traits_003.phpt

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,15 @@ var_dump(get_declared_traits());
1313

1414
?>
1515
--EXPECTF--
16-
%astring(1) "a"
16+
array(%d) {%A
17+
[%d]=>
18+
string(1) "a"
1719
[%d]=>
1820
string(1) "d"
1921
[%d]=>
2022
string(1) "e"
2123
}
22-
array(1) {
23-
[0]=>
24+
array(%d) {%A
25+
[%d]=>
2426
string(1) "c"
2527
}

‎Zend/zend_builtin_functions.c

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
#if ZEND_DEBUG
3535
static zend_class_entry *zend_test_interface;
3636
static zend_class_entry *zend_test_class;
37+
static zend_class_entry *zend_test_trait;
3738
static zend_object_handlers zend_test_class_handlers;
3839
#endif
3940

@@ -306,6 +307,16 @@ static int zend_test_class_call_method(zend_string *method, zend_object *object,
306307
return 0;
307308
}
308309
/* }}} */
310+
311+
static ZEND_METHOD(_ZendTestTrait, testMethod) /* {{{ */ {
312+
RETURN_TRUE;
313+
}
314+
/* }}} */
315+
316+
static zend_function_entry zend_test_trait_methods[] = {
317+
ZEND_ME(_ZendTestTrait, testMethod, arginfo_zend__void, ZEND_ACC_PUBLIC)
318+
ZEND_FE_END
319+
};
309320
#endif
310321

311322
static const zend_function_entry builtin_functions[] = { /* {{{ */
@@ -403,6 +414,11 @@ ZEND_MINIT_FUNCTION(core) { /* {{{ */
403414
memcpy(&zend_test_class_handlers, zend_get_std_object_handlers(), sizeof(zend_object_handlers));
404415
zend_test_class_handlers.get_method = zend_test_class_method_get;
405416
zend_test_class_handlers.call_method = zend_test_class_call_method;
417+
418+
INIT_CLASS_ENTRY(class_entry, "_ZendTestTrait", zend_test_trait_methods);
419+
zend_test_trait = zend_register_internal_class(&class_entry);
420+
zend_test_trait->ce_flags |= ZEND_ACC_TRAIT;
421+
zend_declare_property_null(zend_test_trait, "testProp", sizeof("testProp")-1, ZEND_ACC_PUBLIC);
406422
#endif
407423

408424
return SUCCESS;

‎Zend/zend_hash.c

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -730,9 +730,6 @@ static zend_always_inline zval *_zend_hash_index_add_or_update_i(HashTable *ht,
730730
ht->pDestructor(&p->val);
731731
}
732732
ZVAL_COPY_VALUE(&p->val, pData);
733-
if ((zend_long)h >= (zend_long)ht->nNextFreeElement) {
734-
ht->nNextFreeElement = h < ZEND_LONG_MAX ? h + 1 : ZEND_LONG_MAX;
735-
}
736733
return &p->val;
737734
} else { /* we have to keep the order :( */
738735
goto convert_to_hash;

‎Zend/zend_inheritance.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1227,6 +1227,7 @@ static void zend_add_trait_method(zend_class_entry *ce, const char *name, zend_s
12271227
function_add_ref(fn);
12281228
new_fn = zend_arena_alloc(&CG(arena), sizeof(zend_op_array));
12291229
memcpy(new_fn, fn, sizeof(zend_op_array));
1230+
new_fn->common.fn_flags |= ZEND_ACC_ARENA_ALLOCATED;
12301231
fn = zend_hash_update_ptr(&ce->function_table, key, new_fn);
12311232
zend_add_magic_methods(ce, key, fn);
12321233
}

‎ext/com_dotnet/com_handlers.c

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -309,7 +309,6 @@ static union _zend_function *com_method_get(zend_object **object_ptr, zend_strin
309309
}
310310

311311
f.num_args = bindptr.lpfuncdesc->cParams;
312-
zend_set_function_arg_flags((zend_function*)&f);
313312

314313
ITypeInfo_ReleaseFuncDesc(TI, bindptr.lpfuncdesc);
315314
break;
@@ -335,15 +334,14 @@ static union _zend_function *com_method_get(zend_object **object_ptr, zend_strin
335334
}
336335
}
337336

338-
if (fptr) {
339-
/* save this method in the cache */
340-
if (!obj->method_cache) {
341-
ALLOC_HASHTABLE(obj->method_cache);
342-
zend_hash_init(obj->method_cache, 2, NULL, function_dtor, 0);
343-
}
344-
345-
zend_hash_update_mem(obj->method_cache, name, &f, sizeof(f));
337+
zend_set_function_arg_flags((zend_function*)&f);
338+
/* save this method in the cache */
339+
if (!obj->method_cache) {
340+
ALLOC_HASHTABLE(obj->method_cache);
341+
zend_hash_init(obj->method_cache, 2, NULL, function_dtor, 0);
346342
}
343+
344+
zend_hash_update_mem(obj->method_cache, name, &f, sizeof(f));
347345
}
348346

349347
if (fptr) {

‎ext/gd/tests/bug43073.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ Bug #43073 (TrueType bounding box is wrong for angle<>0) freetype < 2.4.10
77

88
include dirname(__FILE__) . '/func.inc';
99
if(version_compare(get_freetype_version(), '2.4.10') >= 0) die('skip for freetype < 2.4.10');
10+
11+
die('skip freetype issues');
1012
?>
1113
--FILE--
1214
<?php

‎ext/gd/tests/bug48801-mb.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ Bug #48801 (Problem with imagettfbbox) freetype < 2.4.10
77

88
include dirname(__FILE__) . '/func.inc';
99
if(version_compare(get_freetype_version(), '2.4.10') >= 0) die('skip for freetype < 2.4.10');
10+
11+
die('skip freetype issues');
1012
?>
1113
--FILE--
1214
<?php

‎ext/gd/tests/bug48801.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ Bug #48801 (Problem with imagettfbbox) freetype < 2.4.10
77

88
include dirname(__FILE__) . '/func.inc';
99
if(version_compare(get_freetype_version(), '2.4.10') >= 0) die('skip for freetype < 2.4.10');
10+
11+
die('skip freetype issues');
1012
?>
1113
--FILE--
1214
<?php

‎ext/pdo_dblib/dblib_driver.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@ static int dblib_handle_closer(pdo_dbh_t *dbh)
8383
pdo_dblib_db_handle *H = (pdo_dblib_db_handle *)dbh->driver_data;
8484

8585
if (H) {
86+
pdo_dblib_err_dtor(&H->err);
8687
if (H->link) {
8788
dbclose(H->link);
8889
H->link = NULL;
@@ -93,7 +94,6 @@ static int dblib_handle_closer(pdo_dbh_t *dbh)
9394
}
9495
pefree(H, dbh->is_persistent);
9596
dbh->driver_data = NULL;
96-
pdo_dblib_err_dtor(&H->err);
9797
}
9898
return 0;
9999
}

‎ext/pdo_dblib/dblib_stmt.c

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ static int pdo_dblib_stmt_dtor(pdo_stmt_t *stmt)
119119
return 1;
120120
}
121121

122-
static int pdo_dblib_stmt_next_rowset(pdo_stmt_t *stmt)
122+
static int pdo_dblib_stmt_next_rowset_no_cancel(pdo_stmt_t *stmt)
123123
{
124124
pdo_dblib_stmt *S = (pdo_dblib_stmt*)stmt->driver_data;
125125
pdo_dblib_db_handle *H = S->H;
@@ -142,6 +142,27 @@ static int pdo_dblib_stmt_next_rowset(pdo_stmt_t *stmt)
142142
return 1;
143143
}
144144

145+
static int pdo_dblib_stmt_next_rowset(pdo_stmt_t *stmt)
146+
{
147+
pdo_dblib_stmt *S = (pdo_dblib_stmt*)stmt->driver_data;
148+
pdo_dblib_db_handle *H = S->H;
149+
RETCODE ret = SUCCESS;
150+
151+
/* Ideally use dbcanquery here, but there is a bug in FreeTDS's implementation of dbcanquery
152+
* It has been resolved but is currently only available in nightly builds
153+
*/
154+
while (NO_MORE_ROWS != ret) {
155+
ret = dbnextrow(H->link);
156+
157+
if (FAIL == ret) {
158+
pdo_raise_impl_error(stmt->dbh, stmt, "HY000", "PDO_DBLIB: dbnextrow() returned FAIL");
159+
return 0;
160+
}
161+
}
162+
163+
return pdo_dblib_stmt_next_rowset_no_cancel(stmt);
164+
}
165+
145166
static int pdo_dblib_stmt_execute(pdo_stmt_t *stmt)
146167
{
147168
pdo_dblib_stmt *S = (pdo_dblib_stmt*)stmt->driver_data;
@@ -160,7 +181,7 @@ static int pdo_dblib_stmt_execute(pdo_stmt_t *stmt)
160181
return 0;
161182
}
162183

163-
ret = pdo_dblib_stmt_next_rowset(stmt);
184+
ret = pdo_dblib_stmt_next_rowset_no_cancel(stmt);
164185

165186
stmt->row_count = DBCOUNT(H->link);
166187
stmt->column_count = dbnumcols(H->link);

‎ext/pdo_dblib/tests/bug_45876.phpt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ require dirname(__FILE__) . '/config.inc';
99
<?php
1010
require dirname(__FILE__) . '/config.inc';
1111

12-
$stmt = $db->prepare("select ic1.* from information_schema.columns ic1");
12+
$stmt = $db->prepare("select top 1 ic1.* from information_schema.columns ic1");
1313
$stmt->execute();
1414
var_dump($stmt->getColumnMeta(0));
1515
$stmt = null;

‎ext/pdo_dblib/tests/bug_67130.phpt

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
--TEST--
2+
PDO_DBLIB: \PDOStatement::nextRowset() should succeed when all rows in current rowset haven't been fetched
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('pdo_dblib')) die('skip not loaded');
6+
require dirname(__FILE__) . '/config.inc';
7+
?>
8+
--FILE--
9+
<?php
10+
require dirname(__FILE__) . '/config.inc';
11+
12+
$stmt = $db->query('SELECT 1; SELECT 2; SELECT 3;');
13+
var_dump($stmt->fetch());
14+
var_dump($stmt->fetch());
15+
var_dump($stmt->nextRowset());
16+
var_dump($stmt->nextRowset());
17+
var_dump($stmt->fetch());
18+
var_dump($stmt->nextRowset());
19+
?>
20+
--EXPECT--
21+
array(2) {
22+
["computed"]=>
23+
int(1)
24+
[0]=>
25+
int(1)
26+
}
27+
bool(false)
28+
bool(true)
29+
bool(true)
30+
array(2) {
31+
["computed"]=>
32+
int(3)
33+
[0]=>
34+
int(3)
35+
}
36+
bool(false)

‎ext/spl/spl_iterators.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2038,13 +2038,14 @@ SPL_METHOD(RegexIterator, accept)
20382038

20392039
if (Z_TYPE(intern->current.data) == IS_UNDEF) {
20402040
RETURN_FALSE;
2041-
} else if (Z_TYPE(intern->current.data) == IS_ARRAY) {
2042-
RETURN_FALSE;
20432041
}
20442042

20452043
if (intern->u.regex.flags & REGIT_USE_KEY) {
20462044
subject = zval_get_string(&intern->current.key);
20472045
} else {
2046+
if (Z_TYPE(intern->current.data) == IS_ARRAY) {
2047+
RETURN_FALSE;
2048+
}
20482049
subject = zval_get_string(&intern->current.data);
20492050
}
20502051

‎ext/spl/tests/bug68128-USE_KEY.phpt

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
--TEST--
2+
Bug #68128 - RecursiveRegexIterator raises "Array to string conversion" notice
3+
--FILE--
4+
<?php
5+
6+
$arrayIterator = new ArrayIterator(array('key 1' => 'value 1', 'key 2' => ['value 2']));
7+
$regexIterator = new RegexIterator($arrayIterator, '/^key/', RegexIterator::MATCH, RegexIterator::USE_KEY);
8+
9+
foreach ($regexIterator as $key => $value) {
10+
var_dump($key, $value);
11+
}
12+
13+
?>
14+
--EXPECT--
15+
string(5) "key 1"
16+
string(7) "value 1"
17+
string(5) "key 2"
18+
array(1) {
19+
[0]=>
20+
string(7) "value 2"
21+
}

‎ext/spl/tests/iterator_053.phpt

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ bool(true)
5050
bool(true)
5151
bool(true)
5252
bool(true)
53-
bool(false)
53+
bool(true)
5454
bool(true)
5555
bool(true)
5656
bool(true)
@@ -124,7 +124,20 @@ array(2) {
124124
string(1) "4"
125125
}
126126
}
127-
bool(false)
127+
bool(true)
128+
int(5)
129+
array(2) {
130+
[0]=>
131+
array(1) {
132+
[0]=>
133+
string(1) "5"
134+
}
135+
[1]=>
136+
array(1) {
137+
[0]=>
138+
string(1) "5"
139+
}
140+
}
128141
bool(true)
129142
int(6)
130143
array(2) {

‎ext/standard/tests/strings/bug72663_2.phpt

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
--TEST--
22
Bug #72663: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded("session")) {
6+
die("skip");
7+
}
8+
?>
39
--FILE--
410
<?php
511

@@ -14,4 +20,4 @@ DONE
1420
Notice: session_decode(): Unexpected end of serialized data in %sbug72663_2.php on line %d
1521
array(0) {
1622
}
17-
DONE
23+
DONE

0 commit comments

Comments
 (0)