Skip to content

Commit

Permalink
Allow comments between intersection types and by-ref params
Browse files Browse the repository at this point in the history
Fixes GH-10083
Closes GH-10125
  • Loading branch information
iluuu1994 committed Feb 2, 2023
1 parent 9e09782 commit f291d37
Show file tree
Hide file tree
Showing 4 changed files with 50 additions and 4 deletions.
1 change: 1 addition & 0 deletions NEWS
Expand Up @@ -22,6 +22,7 @@ PHP NEWS
(Dennis Buteyn)
. Fix bug GH-8821 (Improve line numbers for errors in constant expressions).
(ilutov)
. Fix bug GH-10083 (Allow comments between & and parameter). (ilutov)

- Exif:
. Removed unneeded codepaths in exif_process_TIFF_in_JPEG(). (nielsdos)
Expand Down
@@ -0,0 +1,13 @@
--TEST--
Intersection type parsing and by-ref parsing interaction with attributes
--FILE--
<?php

class Test {
public X& #[Comment]
Z $p;
}

?>
--EXPECTF--
Parse error: syntax error, unexpected token "#[" in %s on line %d
@@ -0,0 +1,26 @@
--TEST--
Intersection type and by-ref parameter parsing with comments
--FILE--
<?php

class Test {
function f1(A & /*
Comment // ** / / * * **/ B $p) {}
function f2(A & // Comment
B $p) {}
function f3(A & # Comment
B $p) {}
function f4(A & #
B $p) {}
function f6(A & /*
Comment // ** / / * * **/ $p) {}
function f7(A & // Comment
$p) {}
function f8(A & # Comment
$p) {}
function f9(A & #
$p) {}
}

?>
--EXPECT--
14 changes: 10 additions & 4 deletions Zend/zend_language_scanner.l
Expand Up @@ -1368,6 +1368,12 @@ TABS_AND_SPACES [ \t]*
TOKENS [;:,.|^&+-/*=%!~$<>?@]
ANY_CHAR [^]
NEWLINE ("\r"|"\n"|"\r\n")
OPTIONAL_WHITESPACE [ \n\r\t]*
MULTI_LINE_COMMENT "/*"([^*]*"*"+)([^*/][^*]*"*"+)*"/"
SINGLE_LINE_COMMENT "//".*[\n\r]
HASH_COMMENT "#"(([^[].*[\n\r])|[\n\r])
WHITESPACE_OR_COMMENTS ({WHITESPACE}|{MULTI_LINE_COMMENT}|{SINGLE_LINE_COMMENT}|{HASH_COMMENT})+
OPTIONAL_WHITESPACE_OR_COMMENTS ({WHITESPACE}|{MULTI_LINE_COMMENT}|{SINGLE_LINE_COMMENT}|{HASH_COMMENT})*

/* compute yyleng before each rule */
<!*> := yyleng = YYCURSOR - SCNG(yy_text);
Expand Down Expand Up @@ -1401,7 +1407,7 @@ NEWLINE ("\r"|"\n"|"\r\n")
RETURN_TOKEN(T_ATTRIBUTE);
}

<ST_IN_SCRIPTING>"yield"{WHITESPACE}"from"[^a-zA-Z0-9_\x80-\xff] {
<ST_IN_SCRIPTING>"yield"{WHITESPACE_OR_COMMENTS}"from"[^a-zA-Z0-9_\x80-\xff] {
yyless(yyleng - 1);
HANDLE_NEWLINES(yytext, yyleng);
RETURN_TOKEN_WITH_IDENT(T_YIELD_FROM);
Expand Down Expand Up @@ -1543,11 +1549,11 @@ NEWLINE ("\r"|"\n"|"\r\n")
* The enum keyword must be followed by whitespace and another identifier.
* This avoids the BC break of using enum in classes, namespaces, functions and constants.
*/
<ST_IN_SCRIPTING>"enum"{WHITESPACE}("extends"|"implements") {
<ST_IN_SCRIPTING>"enum"{WHITESPACE_OR_COMMENTS}("extends"|"implements") {
yyless(4);
RETURN_TOKEN_WITH_STR(T_STRING, 0);
}
<ST_IN_SCRIPTING>"enum"{WHITESPACE}[a-zA-Z_\x80-\xff] {
<ST_IN_SCRIPTING>"enum"{WHITESPACE_OR_COMMENTS}[a-zA-Z_\x80-\xff] {
yyless(4);
RETURN_TOKEN_WITH_IDENT(T_ENUM);
}
Expand Down Expand Up @@ -1869,7 +1875,7 @@ NEWLINE ("\r"|"\n"|"\r\n")
RETURN_TOKEN(T_SR);
}

<ST_IN_SCRIPTING>"&"[ \t\r\n]*("$"|"...") {
<ST_IN_SCRIPTING>"&"{OPTIONAL_WHITESPACE_OR_COMMENTS}("$"|"...") {
yyless(1);
RETURN_TOKEN(T_AMPERSAND_FOLLOWED_BY_VAR_OR_VARARG);
}
Expand Down

2 comments on commit f291d37

@dstogov
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This commit made a regression heap-buffer-overflow in master (oss-fuzz Issue 55793)

<?yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy&#
==1020181==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60700000b7b7 at pc 0x7f9370c4d949 bp 0x7ffc34c8d0f0 sp 0x7ffc34c8c8a0
READ of size 35 at 0x60700000b7b7 thread T0
    #0 0x7f9370c4d948 in __interceptor_memchr.part.0 (/usr/lib64/../lib64/libasan.so.8+0x4d948)
    #1 0x1eaa95a in zend_yytnamerr /home/dmitry/php/php-master/Zend/zend_language_parser.y:1680
    #2 0x1e8ceca in yysyntax_error /home/dmitry/php/php-master/Zend/zend_language_parser.c:3935
    #3 0x1ea8eb0 in zendparse /home/dmitry/php/php-master/Zend/zend_language_parser.c:8339
    #4 0x1eb22a0 in zend_compile Zend/zend_language_scanner.l:600
    #5 0x1eb2cb8 in compile_file Zend/zend_language_scanner.l:654
    #6 0x1568cc4 in phar_compile_file /home/dmitry/php/php-master/ext/phar/phar.c:3355
    #7 0x7f935c5fc3bd in opcache_compile_file /home/dmitry/php/php-master/ext/opcache/ZendAccelerator.c:1827
    #8 0x7f935c6018a3 in persistent_compile_file /home/dmitry/php/php-master/ext/opcache/ZendAccelerator.c:2171
    #9 0x20456f3 in zend_execute_scripts /home/dmitry/php/php-master/Zend/zend.c:1793
    #10 0x1dcff49 in php_execute_script /home/dmitry/php/php-master/main/main.c:2481
    #11 0x27af6d2 in do_cli /home/dmitry/php/php-master/sapi/cli/php_cli.c:964
    #12 0x27b1d2f in main /home/dmitry/php/php-master/sapi/cli/php_cli.c:1333
    #13 0x7f936d04a50f in __libc_start_call_main (/usr/lib64/../lib64/libc.so.6+0x2750f)
    #14 0x7f936d04a5c8 in __libc_start_main@GLIBC_2.2.5 (/usr/lib64/../lib64/libc.so.6+0x275c8)
    #15 0x608834 in _start (/home/dmitry/php/php-master/CGI-DEBUG-64/sapi/cli/php+0x608834)

@dstogov
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At the moment of this unexpected end of file error LANG_SCNG(yy_leng) contains length of the previous token.

Please sign in to comment.