diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c index 7b07c8240be0..32ab6b0e5090 100644 --- a/ext/pcre/php_pcre.c +++ b/ext/pcre/php_pcre.c @@ -1167,6 +1167,7 @@ PHPAPI void php_pcre_match_impl(pcre_cache_entry *pce, zend_string *subject_str, HashTable *marks = NULL; /* Array of marks for PREG_PATTERN_ORDER */ pcre2_match_data *match_data; PCRE2_SIZE start_offset2, orig_start_offset; + bool old_mdata_used; char *subject = ZSTR_VAL(subject_str); size_t subject_len = ZSTR_LEN(subject_str); @@ -1236,7 +1237,9 @@ PHPAPI void php_pcre_match_impl(pcre_cache_entry *pce, zend_string *subject_str, matched = 0; PCRE_G(error_code) = PHP_PCRE_NO_ERROR; - if (!mdata_used && num_subpats <= PHP_PCRE_PREALLOC_MDATA_SIZE) { + old_mdata_used = mdata_used; + if (!old_mdata_used && num_subpats <= PHP_PCRE_PREALLOC_MDATA_SIZE) { + mdata_used = true; match_data = mdata; } else { match_data = pcre2_match_data_create_from_pattern(pce->re, PCRE_G(gctx_zmm)); @@ -1433,6 +1436,7 @@ PHPAPI void php_pcre_match_impl(pcre_cache_entry *pce, zend_string *subject_str, if (match_data != mdata) { pcre2_match_data_free(match_data); } + mdata_used = old_mdata_used; /* Add the match sets to the output array and clean up */ if (match_sets) { @@ -1629,6 +1633,7 @@ PHPAPI zend_string *php_pcre_replace_impl(pcre_cache_entry *pce, zend_string *su size_t result_len; /* Length of result */ zend_string *result; /* Result of replacement */ pcre2_match_data *match_data; + bool old_mdata_used; /* Calculate the size of the offsets array, and allocate memory for it. */ num_subpats = pce->capture_count + 1; @@ -1642,7 +1647,9 @@ PHPAPI zend_string *php_pcre_replace_impl(pcre_cache_entry *pce, zend_string *su result_len = 0; PCRE_G(error_code) = PHP_PCRE_NO_ERROR; - if (!mdata_used && num_subpats <= PHP_PCRE_PREALLOC_MDATA_SIZE) { + old_mdata_used = mdata_used; + if (!old_mdata_used && num_subpats <= PHP_PCRE_PREALLOC_MDATA_SIZE) { + mdata_used = true; match_data = mdata; } else { match_data = pcre2_match_data_create_from_pattern(pce->re, PCRE_G(gctx_zmm)); @@ -1844,6 +1851,7 @@ PHPAPI zend_string *php_pcre_replace_impl(pcre_cache_entry *pce, zend_string *su if (match_data != mdata) { pcre2_match_data_free(match_data); } + mdata_used = old_mdata_used; return result; } @@ -2569,6 +2577,7 @@ PHPAPI void php_pcre_split_impl(pcre_cache_entry *pce, zend_string *subject_str, uint32_t num_subpats; /* Number of captured subpatterns */ zval tmp; pcre2_match_data *match_data; + bool old_mdata_used; char *subject = ZSTR_VAL(subject_str); no_empty = flags & PREG_SPLIT_NO_EMPTY; @@ -2595,7 +2604,9 @@ PHPAPI void php_pcre_split_impl(pcre_cache_entry *pce, zend_string *subject_str, goto last; } - if (!mdata_used && num_subpats <= PHP_PCRE_PREALLOC_MDATA_SIZE) { + old_mdata_used = mdata_used; + if (!old_mdata_used && num_subpats <= PHP_PCRE_PREALLOC_MDATA_SIZE) { + mdata_used = true; match_data = mdata; } else { match_data = pcre2_match_data_create_from_pattern(pce->re, PCRE_G(gctx_zmm)); @@ -2724,6 +2735,7 @@ PHPAPI void php_pcre_split_impl(pcre_cache_entry *pce, zend_string *subject_str, if (match_data != mdata) { pcre2_match_data_free(match_data); } + mdata_used = old_mdata_used; if (PCRE_G(error_code) != PHP_PCRE_NO_ERROR) { zval_ptr_dtor(return_value); @@ -2923,6 +2935,7 @@ PHPAPI void php_pcre_grep_impl(pcre_cache_entry *pce, zval *input, zval *return zend_ulong num_key; bool invert; /* Whether to return non-matching entries */ + bool old_mdata_used; pcre2_match_data *match_data; invert = flags & PREG_GREP_INVERT ? 1 : 0; @@ -2935,7 +2948,9 @@ PHPAPI void php_pcre_grep_impl(pcre_cache_entry *pce, zval *input, zval *return PCRE_G(error_code) = PHP_PCRE_NO_ERROR; - if (!mdata_used && num_subpats <= PHP_PCRE_PREALLOC_MDATA_SIZE) { + old_mdata_used = mdata_used; + if (!old_mdata_used && num_subpats <= PHP_PCRE_PREALLOC_MDATA_SIZE) { + mdata_used = true; match_data = mdata; } else { match_data = pcre2_match_data_create_from_pattern(pce->re, PCRE_G(gctx_zmm)); @@ -3001,6 +3016,8 @@ PHPAPI void php_pcre_grep_impl(pcre_cache_entry *pce, zval *input, zval *return pcre2_match_data_free(match_data); } + mdata_used = old_mdata_used; + if (PCRE_G(error_code) != PHP_PCRE_NO_ERROR) { zend_array_destroy(Z_ARR_P(return_value)); RETURN_FALSE; diff --git a/ext/pcre/tests/pcre_reentrancy.phpt b/ext/pcre/tests/pcre_reentrancy.phpt new file mode 100644 index 000000000000..5fe4071e4fe1 --- /dev/null +++ b/ext/pcre/tests/pcre_reentrancy.phpt @@ -0,0 +1,58 @@ +--TEST-- +PCRE re-entrancy: nested calls should not corrupt global match data +--EXTENSIONS-- +pcre +--FILE-- + +--EXPECT-- +Testing nested PCRE calls... +Outer match: a +Outer match: b +Outer match: c +string(3) "ABC" + +Testing deep nesting... +string(7) "SUCCESS" diff --git a/ext/pcre/tests/preg_match_all_negative_length_match.phpt b/ext/pcre/tests/preg_match_all_negative_length_match.phpt deleted file mode 100644 index b18007cd3256..000000000000 --- a/ext/pcre/tests/preg_match_all_negative_length_match.phpt +++ /dev/null @@ -1,10 +0,0 @@ ---TEST-- -preg_match_all() resource cleanup when \K in lookahead causes negative-length match ---FILE-- - ---EXPECTF-- -Warning: preg_match_all(): Compilation failed: \K is not allowed in lookarounds (but see PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK) at offset %d in %s -bool(false) diff --git a/ext/pcre/tests/preg_match_negative_length_match.phpt b/ext/pcre/tests/preg_match_negative_length_match.phpt deleted file mode 100644 index 221ea4fb9e54..000000000000 --- a/ext/pcre/tests/preg_match_negative_length_match.phpt +++ /dev/null @@ -1,10 +0,0 @@ ---TEST-- -preg_match() resource cleanup when \K in lookahead causes negative-length match ---FILE-- - ---EXPECTF-- -Warning: preg_match(): Compilation failed: \K is not allowed in lookarounds (but see PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK) at offset %d in %s -bool(false) diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c index 0f802bc128a2..fbbeeb0b433f 100644 --- a/ext/standard/basic_functions.c +++ b/ext/standard/basic_functions.c @@ -1745,7 +1745,10 @@ PHP_FUNCTION(highlight_file) } if (i) { - php_output_start_default(); + if (UNEXPECTED(php_output_start_default() != SUCCESS)) { + zend_throw_error(NULL, "Unable to start output handler"); + RETURN_THROWS(); + } } php_get_highlight_struct(&syntax_highlighter_ini); @@ -1780,7 +1783,10 @@ PHP_FUNCTION(php_strip_whitespace) Z_PARAM_PATH_STR(filename) ZEND_PARSE_PARAMETERS_END(); - php_output_start_default(); + if (UNEXPECTED(php_output_start_default() != SUCCESS)) { + zend_throw_error(NULL, "Unable to start output handler"); + RETURN_THROWS(); + } zend_stream_init_filename_ex(&file_handle, filename); zend_save_lexical_state(&original_lex_state); @@ -1817,7 +1823,10 @@ PHP_FUNCTION(highlight_string) ZEND_PARSE_PARAMETERS_END(); if (i) { - php_output_start_default(); + if (UNEXPECTED(php_output_start_default() != SUCCESS)) { + zend_throw_error(NULL, "Unable to start output handler"); + RETURN_THROWS(); + } } EG(error_reporting) = E_ERROR; diff --git a/ext/standard/tests/strings/gh20906_1.phpt b/ext/standard/tests/strings/gh20906_1.phpt new file mode 100644 index 000000000000..ccb0dfbee566 --- /dev/null +++ b/ext/standard/tests/strings/gh20906_1.phpt @@ -0,0 +1,25 @@ +--TEST-- +GH-20906 (Assertion failure when messing up output buffers) - php_strip_whitespace +--CREDITS-- +vi3tL0u1s +--FILE-- +getMessage(), "\n"; +} +?> +--EXPECTF-- +%a +Fatal error: php_strip_whitespace(): Cannot use output buffering in output buffering display handlers in %s on line %d diff --git a/ext/standard/tests/strings/gh20906_2.phpt b/ext/standard/tests/strings/gh20906_2.phpt new file mode 100644 index 000000000000..b3ea5cf6ef74 --- /dev/null +++ b/ext/standard/tests/strings/gh20906_2.phpt @@ -0,0 +1,21 @@ +--TEST-- +GH-20906 (Assertion failure when messing up output buffers) - highlight_file +--CREDITS-- +vi3tL0u1s +--FILE-- + +--EXPECTF-- +%a +Fatal error: highlight_file(): Cannot use output buffering in output buffering display handlers in %s on line %d diff --git a/ext/standard/tests/strings/gh20906_3.phpt b/ext/standard/tests/strings/gh20906_3.phpt new file mode 100644 index 000000000000..a26fc61bed65 --- /dev/null +++ b/ext/standard/tests/strings/gh20906_3.phpt @@ -0,0 +1,21 @@ +--TEST-- +GH-20906 (Assertion failure when messing up output buffers) - highlight_string +--CREDITS-- +vi3tL0u1s +--FILE-- + +--EXPECTF-- +%a +Fatal error: highlight_string(): Cannot use output buffering in output buffering display handlers in %s on line %d