Fix performance for Bcmath numbers with trailing zeros

.gitattributes

@@ -22,6 +22,7 @@
 # Collapse generated files within a pull request.
 **/*_arginfo.h linguist-generated
 /Zend/zend_vm_execute.h linguist-generated
+/Zend/zend_vm_handlers.h linguist-generated
 /Zend/zend_vm_opcodes.[ch] linguist-generated
 
 # The OSS fuzz files are bunary

CODEOWNERS

@@ -11,6 +11,7 @@
 *.stub.php @kocsismate
 /.github @iluuu1994 @TimWolla
 /build/gen_stub.php @kocsismate
+/ext/bcmath @Girgias
 /ext/curl @adoy
 /ext/date @derickr
 /ext/dba @Girgias

NEWS

@@ -2,6 +2,16 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.3.0beta2
 
+- DOM:
+  . Fix DOMEntity field getter bugs. (nielsdos)
+  . Fix incorrect attribute existence check in DOMElement::setAttributeNodeNS.
+    (nielsdos)
+  . Fix DOMCharacterData::replaceWith() with itself. (nielsdos)
+  . Fix empty argument cases for DOMParentNode methods. (nielsdos)
+
+- Core:
+  . Fixed oss-fuzz #60741 (Leak in open_basedir). (ilutov)
+
 - FFI:
   . Fix leaking definitions when using FFI::cdef()->new(...). (ilutov)
 

UPGRADING.INTERNALS

@@ -70,6 +70,8 @@ PHP 8.3 INTERNALS UPGRADE NOTES
 * _php_stream_dirent now has an extra d_type field that is used to store the
   directory entry type. This can be used to avoid additional stat calls for
   types when the type is already known.
+* zend_std_get_properties_for now calls the cast_object handler when casting
+  objects to arrays.
 
 ========================
 2. Build system changes

Zend/Optimizer/block_pass.c

@@ -174,8 +174,10 @@ static void zend_optimize_block(zend_basic_block *block, zend_op_array *op_array
 					 && opline->opcode != ZEND_MATCH
 					 && zend_optimizer_update_op1_const(op_array, opline, &c)) {
 						VAR_SOURCE(op1) = NULL;
-						literal_dtor(&ZEND_OP1_LITERAL(src));
-						MAKE_NOP(src);
+						if (!zend_bitset_in(used_ext, VAR_NUM(src->result.var))) {
+							literal_dtor(&ZEND_OP1_LITERAL(src));
+							MAKE_NOP(src);
+						}
 						++(*opt_count);
 					} else {
 						zval_ptr_dtor_nogc(&c);
@@ -197,8 +199,10 @@ static void zend_optimize_block(zend_basic_block *block, zend_op_array *op_array
 				ZVAL_COPY(&c, &ZEND_OP1_LITERAL(src));
 				if (zend_optimizer_update_op2_const(op_array, opline, &c)) {
 					VAR_SOURCE(op2) = NULL;
-					literal_dtor(&ZEND_OP1_LITERAL(src));
-					MAKE_NOP(src);
+					if (!zend_bitset_in(used_ext, VAR_NUM(src->result.var))) {
+						literal_dtor(&ZEND_OP1_LITERAL(src));
+						MAKE_NOP(src);
+					}
 					++(*opt_count);
 				} else {
 					zval_ptr_dtor_nogc(&c);

Zend/Zend.m4

@@ -169,7 +169,6 @@ int main(void) {
     return f((uintptr_t)&local) ? 0 : 1;
 }
 ]])], [
-  AC_DEFINE([ZEND_STACK_GROWS_DOWNWARDS], 1, [Define if the stack grows downwards])
   AC_DEFINE([ZEND_CHECK_STACK_LIMIT], 1, [Define if checking the stack limit is supported])
   AC_MSG_RESULT(yes)
 ], [
@@ -355,6 +354,9 @@ if test "$ZEND_GCC_GLOBAL_REGS" != "no"; then
 #elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__aarch64__)
 # define ZEND_VM_FP_GLOBAL_REG "x27"
 # define ZEND_VM_IP_GLOBAL_REG "x28"
+#elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__riscv) && __riscv_xlen == 64
+# define ZEND_VM_FP_GLOBAL_REG "x18"
+# define ZEND_VM_IP_GLOBAL_REG "x19"
 #else
 # error "global register variables are not supported"
 #endif

Zend/tests/oss_fuzz_60741.phpt

@@ -0,0 +1,9 @@
+--TEST--
+oss-fuzz #60741: Leak in open_basedir
+--INI--
+open_basedir="{TMP}"
+--FILE--
+<?php
+ini_set('open_basedir', ini_get('open_basedir'));
+?>
+--EXPECT--

Zend/zend.c

@@ -1271,29 +1271,11 @@ void zend_call_destructors(void) /* {{{ */
 }
 /* }}} */
 
-static void zend_release_open_basedir(void)
-{
-	/* Release custom open_basedir config, this needs to happen before ini shutdown */
-	if (PG(open_basedir)) {
-		zend_ini_entry *ini_entry = zend_hash_str_find_ptr(EG(ini_directives), "open_basedir", strlen("open_basedir"));
-		/* ini_entry->modified is unreliable, it might also be set when on_update has failed. */
-		if (ini_entry
-		 && ini_entry->modified
-		 && ini_entry->value != ini_entry->orig_value) {
-			efree(PG(open_basedir));
-			PG(open_basedir) = NULL;
-		}
-	}
-}
-
 ZEND_API void zend_deactivate(void) /* {{{ */
 {
 	/* we're no longer executing anything */
 	EG(current_execute_data) = NULL;
 
-	/* Needs to run before zend_ini_deactivate(). */
-	zend_release_open_basedir();
-
 	zend_try {
 		shutdown_scanner();
 	} zend_end_try();

Zend/zend_call_stack.c

@@ -104,7 +104,7 @@ static bool zend_call_stack_is_main_thread(void) {
 # endif
 }
 
-# ifdef HAVE_PTHREAD_GETATTR_NP
+# if defined(HAVE_PTHREAD_GETATTR_NP) && defined(HAVE_PTHREAD_ATTR_GETSTACK)
 static bool zend_call_stack_get_linux_pthread(zend_call_stack *stack)
 {
 	pthread_attr_t attr;
@@ -145,12 +145,12 @@ static bool zend_call_stack_get_linux_pthread(zend_call_stack *stack)
 
 	return true;
 }
-# else /* HAVE_PTHREAD_GETATTR_NP */
+# else /* defined(HAVE_PTHREAD_GETATTR_NP) && defined(HAVE_PTHREAD_ATTR_GETSTACK) */
 static bool zend_call_stack_get_linux_pthread(zend_call_stack *stack)
 {
 	return false;
 }
-# endif /* HAVE_PTHREAD_GETATTR_NP */
+# endif /* defined(HAVE_PTHREAD_GETATTR_NP) && defined(HAVE_PTHREAD_ATTR_GETSTACK) */
 
 static bool zend_call_stack_get_linux_proc_maps(zend_call_stack *stack)
 {
@@ -251,14 +251,13 @@ static bool zend_call_stack_is_main_thread(void)
 	return is_main == -1 || is_main == 1;
 }
 
-# if defined(HAVE_PTHREAD_ATTR_GET_NP) && defined(HAVE_PTHREAD_ATTR_GET_STACK)
+# if defined(HAVE_PTHREAD_ATTR_GET_NP) && defined(HAVE_PTHREAD_ATTR_GETSTACK)
 static bool zend_call_stack_get_freebsd_pthread(zend_call_stack *stack)
 {
 	pthread_attr_t attr;
 	int error;
 	void *addr;
 	size_t max_size;
-	size_t guard_size;
 
 	/* pthread will return bogus values for the main thread */
 	ZEND_ASSERT(!zend_call_stack_is_main_thread());
@@ -285,12 +284,12 @@ static bool zend_call_stack_get_freebsd_pthread(zend_call_stack *stack)
 	pthread_attr_destroy(&attr);
 	return false;
 }
-# else /* defined(HAVE_PTHREAD_ATTR_GET_NP) && defined(HAVE_PTHREAD_ATTR_GET_STACK) */
+# else /* defined(HAVE_PTHREAD_ATTR_GET_NP) && defined(HAVE_PTHREAD_ATTR_GETSTACK) */
 static bool zend_call_stack_get_freebsd_pthread(zend_call_stack *stack)
 {
 	return false;
 }
-# endif /* defined(HAVE_PTHREAD_ATTR_GET_NP) && defined(HAVE_PTHREAD_ATTR_GET_STACK) */
+# endif /* defined(HAVE_PTHREAD_ATTR_GET_NP) && defined(HAVE_PTHREAD_ATTR_GETSTACK) */
 
 static bool zend_call_stack_get_freebsd_sysctl(zend_call_stack *stack)
 {

Zend/zend_execute.c

@@ -64,6 +64,9 @@
 # elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__aarch64__)
 #  define ZEND_VM_FP_GLOBAL_REG "x27"
 #  define ZEND_VM_IP_GLOBAL_REG "x28"
+#elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__riscv) && __riscv_xlen == 64
+#  define ZEND_VM_FP_GLOBAL_REG "x18"
+#  define ZEND_VM_IP_GLOBAL_REG "x19"
 # endif
 #endif
 

Zend/zend_object_handlers.c

@@ -1975,6 +1975,16 @@ ZEND_API HashTable *zend_std_get_properties_for(zend_object *obj, zend_prop_purp
 			}
 			ZEND_FALLTHROUGH;
 		case ZEND_PROP_PURPOSE_ARRAY_CAST:
+			if (obj->handlers->cast_object != std_object_handlers.cast_object) {
+				zval result;
+				if (obj->handlers->cast_object(obj, &result, IS_ARRAY) == SUCCESS) {
+					return Z_ARRVAL(result);
+				}
+				if (EG(exception)) {
+					return NULL;
+				}
+			}
+			ZEND_FALLTHROUGH;
 		case ZEND_PROP_PURPOSE_SERIALIZE:
 		case ZEND_PROP_PURPOSE_VAR_EXPORT:
 		case ZEND_PROP_PURPOSE_JSON: