[pull] master from php:master - #1199
Merged
Merged
Conversation
getSingletonPos() read str[i+2] after the last '-' or '_' in a locale, one byte past the NUL for strings such as "en-". Require i+2 to be inside the string before testing it for another separator. Output otherwise matches the unfixed parser unless that heap byte happens to be another separator, which is why GH-22498 was previously closed. Also audit getStrrtokenPos() and both callers, get_icu_value_internal() and get_private_subtags(); their bounds handling is already safe. Co-authored-by: Xuyang Zhang <119476662+kn1g78@users.noreply.github.com> Closes #23350
* PHP-8.4: Bound getSingletonPos before reading the next separator (#23350)
* PHP-8.5: Merge branch 'PHP-8.4' into PHP-8.5
When the last grapheme_str_split() group is short, ubrk_next() returns UBRK_DONE and the loop still advanced pstr by -1 - current. Skip that update when the iterator is done, matching the grapheme_strrev() fix. Other ubrk_next() loops in grapheme_string.c and grapheme_util.c were audited and already guard UBRK_DONE before using the position as an offset. Closes #23349
* PHP-8.4: Stop grapheme_str_split from using UBRK_DONE as a byte index (#23349)
* PHP-8.5: Merge branch 'PHP-8.4' into PHP-8.5
So SNMP tests can work on other platforms, except Windows.
* PHP-8.4: ext/snmp: Put XFAILs under SKIPIF section in tests (#23237)
* PHP-8.5: Merge branch 'PHP-8.4' into PHP-8.5
node_list_unlink() detaches attribute children that still have a PHP wrapper so libxml2 does not free them underneath it, but two exits abandoned the rest of the list: xmlUnlinkNode() clears node->next, and the XML_ENTITY_REF_NODE case broke out of the loop instead of only skipping the borrowed entity children. Anything past either exit was freed by xmlSetProp(), xmlSetNsProp() or xmlFreeProp() with a live wrapper still pointing at it. Fixes GH-23331 Closes GH-23337
* PHP-8.4: Fix GH-23331: UAF when an attribute child keeps a live wrapper
* PHP-8.5: Fix GH-23331: UAF when an attribute child keeps a live wrapper
dom_set_attribute_ns_modern() handed the element straight to xmlSetNsProp(), which frees the existing attribute's child list, so a live Dom\Text wrapper for one of those children was left pointing at freed memory. Unlink the wrapped children first, as dom_set_attribute_ns_legacy() already does. Closes GH-23348
* PHP-8.4: Fix UAF when setAttributeNS() frees a wrapped attribute child
* PHP-8.5: Fix UAF when setAttributeNS() frees a wrapped attribute child
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )