Upgrade security branches to Ubuntu 22.04

.github/actions/setup-mssql/action.yml

@@ -11,4 +11,4 @@ runs:
           -p 1433:1433 \
           --name sql1 \
           -h sql1 \
-          -d mcr.microsoft.com/mssql/server:2019-CU8-ubuntu-16.04
+          -d mcr.microsoft.com/mssql/server:2022-CU14-ubuntu-22.04

.github/actions/setup-x64/action.yml

@@ -7,7 +7,7 @@ runs:
         set -x
 
         sudo service slapd start
-        docker exec sql1 /opt/mssql-tools/bin/sqlcmd -S 127.0.0.1 -U SA -P "<YourStrong@Passw0rd>" -Q "create login pdo_test with password='password', check_policy=off; create user pdo_test for login pdo_test; grant alter, control to pdo_test;"
+        docker exec sql1 /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -C -P "<YourStrong@Passw0rd>" -Q "create login pdo_test with password='password', check_policy=off; create user pdo_test for login pdo_test; grant alter, control to pdo_test;"
         sudo locale-gen de_DE
 
         ./.github/scripts/setup-slapd.sh

.github/scripts/setup-slapd.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-set -ex
+set -e
 
 # Create TLS certificate
 sudo mkdir -p /etc/ldap/ssl
@@ -42,7 +42,9 @@ sudo sed -e 's|^\s*SLAPD_SERVICES\s*=.*$|SLAPD_SERVICES="ldap:/// ldaps:/// ldap
 # Configure LDAP database.
 DBDN=`sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config '(&(olcRootDN=*)(olcSuffix=*))' dn | grep -i '^dn:' | sed -e 's/^dn:\s*//'`;
 
-sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif
+if test -f "/etc/ldap/schema/ppolicy.ldif"; then
+  sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif
+fi
 
 sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// << EOF
 dn: $DBDN

.github/workflows/push.yml

@@ -68,7 +68,7 @@ jobs:
           - debug: false
             zts: true
     name: "LINUX_X64_${{ matrix.debug && 'DEBUG' || 'RELEASE' }}_${{ matrix.zts && 'ZTS' || 'NTS' }}"
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - name: git checkout
         uses: actions/checkout@v4

.github/workflows/root.yml

@@ -48,7 +48,7 @@ jobs:
     with:
       asan_ubuntu_version: ${{
         (((matrix.branch.version[0] == 8 && matrix.branch.version[1] >= 5) || matrix.branch.version[0] >= 9) && '24.04')
-        || '20.04' }}
+        || '22.04' }}
       branch: ${{ matrix.branch.ref }}
       community_verify_type_inference: ${{ (matrix.branch.version[0] == 8 && matrix.branch.version[1] >= 4) || matrix.branch.version[0] >= 9 }}
       libmysqlclient_with_mysqli: ${{ (matrix.branch.version[0] == 8 && matrix.branch.version[1] == 1) }}
@@ -57,8 +57,7 @@ jobs:
       run_macos_arm64: ${{ (matrix.branch.version[0] == 8 && matrix.branch.version[1] >= 4) || matrix.branch.version[0] >= 9 }}
       ubuntu_version: ${{
         (((matrix.branch.version[0] == 8 && matrix.branch.version[1] >= 5) || matrix.branch.version[0] >= 9) && '24.04')
-        || ((matrix.branch.version[0] == 8 && matrix.branch.version[1] >= 3) && '22.04')
-        || '20.04' }}
+        || '22.04' }}
       windows_version: ${{ ((matrix.branch.version[0] == 8 && matrix.branch.version[1] >= 4) || matrix.branch.version[0] >= 9) && '2022' || '2019' }}
       skip_symfony: ${{ matrix.branch.version[0] == 8 && matrix.branch.version[1] == 1 }}
       skip_wordpress: ${{ matrix.branch.version[0] == 8 && matrix.branch.version[1] == 1 }}

Zend/zend_portability.h

@@ -685,4 +685,28 @@ extern "C++" {
 # define ZEND_INDIRECT_RETURN
 #endif
 
+#define __ZEND_DO_PRAGMA(x) _Pragma(#x)
+#define _ZEND_DO_PRAGMA(x) __ZEND_DO_PRAGMA(x)
+#if defined(__clang__)
+# define ZEND_DIAGNOSTIC_IGNORED_START(warning) \
+	_Pragma("clang diagnostic push") \
+	_ZEND_DO_PRAGMA(clang diagnostic ignored warning)
+# define ZEND_DIAGNOSTIC_IGNORED_END \
+	_Pragma("clang diagnostic pop")
+#elif defined(__GNUC__)
+# define ZEND_DIAGNOSTIC_IGNORED_START(warning) \
+	_Pragma("GCC diagnostic push") \
+	_ZEND_DO_PRAGMA(GCC diagnostic ignored warning)
+# define ZEND_DIAGNOSTIC_IGNORED_END \
+	_Pragma("GCC diagnostic pop")
+#else
+# define ZEND_DIAGNOSTIC_IGNORED_START(warning)
+# define ZEND_DIAGNOSTIC_IGNORED_END
+#endif
+
+/** @deprecated */
+#define ZEND_CGG_DIAGNOSTIC_IGNORED_START ZEND_DIAGNOSTIC_IGNORED_START
+/** @deprecated */
+#define ZEND_CGG_DIAGNOSTIC_IGNORED_END ZEND_DIAGNOSTIC_IGNORED_END
+
 #endif /* ZEND_PORTABILITY_H */

ext/imap/php_imap.c

@@ -695,11 +695,9 @@ PHP_RINIT_FUNCTION(imap)
 }
 /* }}} */
 
-/* {{{ PHP_RSHUTDOWN_FUNCTION */
-PHP_RSHUTDOWN_FUNCTION(imap)
+static void free_errorlist(void)
 {
 	ERRORLIST *ecur = NIL;
-	STRINGLIST *acur = NIL;
 
 	if (IMAPG(imap_errorstack) != NIL) {
 		/* output any remaining errors at their original error level */
@@ -715,6 +713,11 @@ PHP_RSHUTDOWN_FUNCTION(imap)
 		mail_free_errorlist(&IMAPG(imap_errorstack));
 		IMAPG(imap_errorstack) = NIL;
 	}
+}
+
+static void free_stringlist(void)
+{
+	STRINGLIST *acur = NIL;
 
 	if (IMAPG(imap_alertstack) != NIL) {
 		/* output any remaining alerts at E_NOTICE level */
@@ -730,6 +733,13 @@ PHP_RSHUTDOWN_FUNCTION(imap)
 		mail_free_stringlist(&IMAPG(imap_alertstack));
 		IMAPG(imap_alertstack) = NIL;
 	}
+}
+
+/* {{{ PHP_RSHUTDOWN_FUNCTION */
+PHP_RSHUTDOWN_FUNCTION(imap)
+{
+	free_errorlist();
+	free_stringlist();
 	return SUCCESS;
 }
 /* }}} */

ext/imap/php_imap.h

@@ -47,7 +47,9 @@
 # endif
 
  /* these are used for quota support */
+ ZEND_DIAGNOSTIC_IGNORED_START("-Wstrict-prototypes")
 # include "c-client.h"	/* includes mail.h and rfc822.h */
+ ZEND_DIAGNOSTIC_IGNORED_END
 # include "imap4r1.h"	/* location of c-client quota functions */
 #else
 # include "mail.h"

ext/oci8/php_oci8_int.h

@@ -53,7 +53,9 @@
 /* }}} */
 
 #include "ext/standard/php_string.h"
+ZEND_DIAGNOSTIC_IGNORED_START("-Wstrict-prototypes")
 #include <oci.h>
+ZEND_DIAGNOSTIC_IGNORED_END
 
 extern int le_connection;
 extern int le_pconnection;

ext/opcache/jit/dynasm/dasm_x86.h

@@ -124,7 +124,14 @@ void dasm_free(Dst_DECL)
 void dasm_setupglobal(Dst_DECL, void **gl, unsigned int maxgl)
 {
   dasm_State *D = Dst_REF;
+#ifdef __GNUC__
+# pragma GCC diagnostic push
+# pragma GCC diagnostic ignored "-Warray-bounds"
+#endif
   D->globals = gl - 10;  /* Negative bias to compensate for locals. */
+#ifdef __GNUC__
+# pragma GCC diagnostic pop
+#endif
   DASM_M_GROW(Dst, int, D->lglabels, D->lgsize, (10+maxgl)*sizeof(int));
 }
 

ext/pdo/pdo_dbh.c

@@ -81,7 +81,7 @@ void pdo_raise_impl_error(pdo_dbh_t *dbh, pdo_stmt_t *stmt, const char *sqlstate
 		pdo_err = &stmt->error_code;
 	}
 
-	strncpy(*pdo_err, sqlstate, 6);
+	memcpy(*pdo_err, sqlstate, sizeof(pdo_error_type));
 
 	/* hash sqlstate to error messages */
 	msg = pdo_sqlstate_state_to_description(*pdo_err);

ext/pdo_oci/php_pdo_oci_int.h

@@ -14,7 +14,14 @@
   +----------------------------------------------------------------------+
 */
 
+#ifndef PHP_PDO_OCI_INT_H
+#define PHP_PDO_OCI_INT_H
+
+#include "zend_portability.h"
+
+ZEND_DIAGNOSTIC_IGNORED_START("-Wstrict-prototypes")
 #include <oci.h>
+ZEND_DIAGNOSTIC_IGNORED_END
 
 typedef struct {
 	const char *file;
@@ -105,3 +112,5 @@ enum {
 	PDO_OCI_ATTR_MODULE,
 	PDO_OCI_ATTR_CALL_TIMEOUT
 };
+
+#endif	/* PHP_PDO_OCI_INT_H */

ext/soap/php_encoding.c

@@ -2388,7 +2388,14 @@ static xmlNodePtr to_xml_array(encodeTypePtr type, zval *data, int style, xmlNod
 		if (style == SOAP_ENCODED) {
 			if (soap_version == SOAP_1_1) {
 				smart_str_0(&array_type);
-				if (strcmp(ZSTR_VAL(array_type.s),"xsd:anyType") == 0) {
+#if defined(__GNUC__) && __GNUC__ >= 11
+				ZEND_DIAGNOSTIC_IGNORED_START("-Wstringop-overread")
+#endif
+				bool is_xsd_any_type = strcmp(ZSTR_VAL(array_type.s),"xsd:anyType") == 0;
+#if defined(__GNUC__) && __GNUC__ >= 11
+				ZEND_DIAGNOSTIC_IGNORED_END
+#endif
+				if (is_xsd_any_type) {
 					smart_str_free(&array_type);
 					smart_str_appendl(&array_type,"xsd:ur-type",sizeof("xsd:ur-type")-1);
 				}