From a38418777f65780d9d622197677e90567690fc07 Mon Sep 17 00:00:00 2001 From: Ilija Tovilo Date: Sun, 3 May 2026 20:03:18 +0200 Subject: [PATCH] GHSA-m8rr-4c36-8gq4: Consistently pass unsigned char to ctype.h functions Fixes GHSA-m8rr-4c36-8gq4 Fixes CVE-2026-7258 --- Zend/zend_compile.c | 2 +- Zend/zend_ini.c | 6 +++--- Zend/zend_operators.c | 8 ++++---- Zend/zend_virtual_cwd.c | 10 +++++----- Zend/zend_virtual_cwd.h | 2 +- ext/com_dotnet/com_extension.c | 4 ++-- ext/date/lib/parse_date.c | 10 +++++----- ext/date/lib/parse_date.re | 10 +++++----- ext/date/lib/parse_iso_intervals.c | 4 ++-- ext/date/lib/parse_iso_intervals.re | 4 ++-- ext/date/lib/timelib.c | 2 +- ext/filter/logical_filters.c | 10 +++++----- ext/ftp/ftp.c | 10 +++++----- ext/gd/libgd/gd_xbm.c | 2 +- ext/imap/php_imap.c | 2 +- ext/intl/locale/locale_methods.c | 2 +- ext/mbstring/mbstring.c | 4 ++-- ext/mbstring/php_mbregex.c | 2 +- ext/pcre/php_pcre.c | 4 ++-- ext/pdo/pdo.c | 2 +- ext/pdo/pdo_sql_parser.re | 2 +- ext/pdo/pdo_stmt.c | 2 +- ext/standard/dl.c | 2 +- ext/standard/exec.c | 2 +- ext/standard/file.c | 2 +- ext/standard/filters.c | 2 +- ext/standard/formatted_print.c | 8 ++++---- ext/standard/ftp_fopen_wrapper.c | 12 ++++++------ ext/standard/html.c | 4 ++-- ext/standard/math.c | 6 +++--- ext/standard/metaphone.c | 18 ++++++++--------- ext/standard/quot_print.c | 8 ++++---- ext/standard/scanf.c | 10 +++++----- ext/standard/soundex.c | 2 +- ext/standard/string.c | 14 +++++++------- ext/standard/strnatcmp.c | 30 ++++++++++++++--------------- ext/standard/type.c | 2 +- ext/standard/url.c | 20 +++++++++---------- ext/standard/url_scanner_ex.re | 6 +++--- ext/standard/versioning.c | 16 +++++++-------- main/SAPI.c | 6 +++--- main/fopen_wrappers.c | 6 +++--- main/php_ini.c | 2 +- main/php_ini_builder.c | 2 +- main/php_variables.c | 4 ++-- main/rfc1867.c | 12 ++++++------ main/snprintf.c | 14 +++++++------- main/spprintf.c | 14 +++++++------- main/streams/streams.c | 4 ++-- main/streams/transports.c | 2 +- sapi/cli/php_cli_server.c | 2 +- sapi/fpm/fpm/fpm_conf.c | 4 ++-- sapi/litespeed/lsapi_main.c | 4 ++-- sapi/litespeed/lsapilib.c | 6 +++--- sapi/phpdbg/phpdbg_cmd.c | 4 ++-- sapi/phpdbg/phpdbg_prompt.c | 2 +- sapi/phpdbg/phpdbg_utils.c | 10 +++++----- win32/sendmail.c | 6 +++--- 58 files changed, 186 insertions(+), 186 deletions(-) Index: php-7.4.33/Zend/zend_compile.c =================================================================== --- php-7.4.33.orig/Zend/zend_compile.c +++ php-7.4.33/Zend/zend_compile.c @@ -1772,7 +1772,7 @@ ZEND_API size_t zend_dirname(char *path, /* Note that on Win32 CWD is per drive (heritage from CP/M). * This means dirname("c:foo") maps to "c:." or "c:" - which means CWD on C: drive. */ - if ((2 <= len) && isalpha((int)((unsigned char *)path)[0]) && (':' == path[1])) { + if ((2 <= len) && isalpha((unsigned char)path[0]) && (':' == path[1])) { /* Skip over the drive spec (if any) so as not to change */ path += 2; len_adjust += 2; Index: php-7.4.33/Zend/zend_operators.c =================================================================== --- php-7.4.33.orig/Zend/zend_operators.c +++ php-7.4.33/Zend/zend_operators.c @@ -2804,8 +2804,8 @@ ZEND_API int ZEND_FASTCALL zend_binary_s len = MIN(len1, len2); while (len--) { - c1 = zend_tolower((int)*(unsigned char *)s1++); - c2 = zend_tolower((int)*(unsigned char *)s2++); + c1 = zend_tolower((unsigned char)*(s1++)); + c2 = zend_tolower((unsigned char)*(s2++)); if (c1 != c2) { return c1 - c2; } @@ -2825,8 +2825,8 @@ ZEND_API int ZEND_FASTCALL zend_binary_s } len = MIN(length, MIN(len1, len2)); while (len--) { - c1 = zend_tolower((int)*(unsigned char *)s1++); - c2 = zend_tolower((int)*(unsigned char *)s2++); + c1 = zend_tolower((unsigned char)*(s1++)); + c2 = zend_tolower((unsigned char)*(s2++)); if (c1 != c2) { return c1 - c2; } Index: php-7.4.33/Zend/zend_virtual_cwd.c =================================================================== --- php-7.4.33.orig/Zend/zend_virtual_cwd.c +++ php-7.4.33/Zend/zend_virtual_cwd.c @@ -201,7 +201,7 @@ void virtual_cwd_main_cwd_init(uint8_t r main_cwd_state.cwd_length = strlen(cwd); #ifdef ZEND_WIN32 if (main_cwd_state.cwd_length >= 2 && cwd[1] == ':') { - cwd[0] = toupper(cwd[0]); + cwd[0] = toupper((unsigned char)cwd[0]); } #endif main_cwd_state.cwd = strdup(cwd); @@ -279,7 +279,7 @@ CWD_API char *virtual_getcwd_ex(size_t * *length = state->cwd_length+1; retval = (char *) emalloc(*length+1); memcpy(retval, state->cwd, *length); - retval[0] = toupper(retval[0]); + retval[0] = toupper((unsigned char)retval[0]); retval[*length-1] = DEFAULT_SLASH; retval[*length] = '\0'; return retval; @@ -1120,7 +1120,7 @@ CWD_API int virtual_file_ex(cwd_state *s if (resolved_path[start] == 0) { goto verify; } - resolved_path[start] = toupper(resolved_path[start]); + resolved_path[start] = toupper((unsigned char)resolved_path[start]); start++; } resolved_path[start++] = DEFAULT_SLASH; @@ -1128,13 +1128,13 @@ CWD_API int virtual_file_ex(cwd_state *s if (resolved_path[start] == 0) { goto verify; } - resolved_path[start] = toupper(resolved_path[start]); + resolved_path[start] = toupper((unsigned char)resolved_path[start]); start++; } resolved_path[start++] = DEFAULT_SLASH; } else if (IS_ABSOLUTE_PATH(resolved_path, path_length)) { /* skip DRIVE name */ - resolved_path[0] = toupper(resolved_path[0]); + resolved_path[0] = toupper((unsigned char)resolved_path[0]); resolved_path[2] = DEFAULT_SLASH; start = 3; } Index: php-7.4.33/Zend/zend_virtual_cwd.h =================================================================== --- php-7.4.33.orig/Zend/zend_virtual_cwd.h +++ php-7.4.33/Zend/zend_virtual_cwd.h @@ -84,7 +84,7 @@ typedef unsigned short mode_t; #define IS_UNC_PATH(path, len) \ (len >= 2 && IS_SLASH(path[0]) && IS_SLASH(path[1])) #define IS_ABSOLUTE_PATH(path, len) \ - (len >= 2 && (/* is local */isalpha(path[0]) && path[1] == ':' || /* is UNC */IS_SLASH(path[0]) && IS_SLASH(path[1]))) + (len >= 2 && (/* is local */isalpha((unsigned char)(path)[0]) && path[1] == ':' || /* is UNC */IS_SLASH(path[0]) && IS_SLASH(path[1]))) #else #ifdef HAVE_DIRENT_H Index: php-7.4.33/ext/com_dotnet/com_extension.c =================================================================== --- php-7.4.33.orig/ext/com_dotnet/com_extension.c +++ php-7.4.33/ext/com_dotnet/com_extension.c @@ -241,11 +241,11 @@ static PHP_INI_MH(OnTypeLibFileUpdate) } /* Remove leading/training white spaces on search_string */ - while (isspace(*typelib_name)) {/* Ends on '\0' in worst case */ + while (isspace((unsigned char)*typelib_name)) {/* Ends on '\0' in worst case */ typelib_name ++; } ptr = typelib_name + strlen(typelib_name) - 1; - while ((ptr != typelib_name) && isspace(*ptr)) { + while ((ptr != typelib_name) && isspace((unsigned char)*ptr)) { *ptr = '\0'; ptr--; } Index: php-7.4.33/ext/date/lib/parse_date.re =================================================================== --- php-7.4.33.orig/ext/date/lib/parse_date.re +++ php-7.4.33/ext/date/lib/parse_date.re @@ -477,7 +477,7 @@ static timelib_sll timelib_get_nr(char * static void timelib_skip_day_suffix(char **ptr) { - if (isspace(**ptr)) { + if (isspace((unsigned char)**ptr)) { return; } if (!timelib_strncasecmp(*ptr, "nd", 2) || !timelib_strncasecmp(*ptr, "rd", 2) ||!timelib_strncasecmp(*ptr, "st", 2) || !timelib_strncasecmp(*ptr, "th", 2)) { @@ -742,7 +742,7 @@ static timelib_long timelib_parse_tz_cor char *begin = *ptr, *end; timelib_long tmp; - while (isdigit(**ptr) || **ptr == ':') { + while (isdigit((unsigned char)**ptr) || **ptr == ':') { ++*ptr; } end = *ptr; @@ -784,7 +784,7 @@ static timelib_long timelib_parse_tz_min } ++*ptr; - while (isdigit(**ptr)) { + while (isdigit((unsigned char)**ptr)) { ++*ptr; } @@ -1837,10 +1837,10 @@ timelib_time* timelib_strtotime(char *s, in.errors->error_messages = NULL; if (len > 0) { - while (isspace(*s) && s < e) { + while (isspace((unsigned char)*s) && s < e) { s++; } - while (isspace(*e) && e > s) { + while (isspace((unsigned char)*e) && e > s) { e--; } } Index: php-7.4.33/ext/date/lib/parse_iso_intervals.re =================================================================== --- php-7.4.33.orig/ext/date/lib/parse_iso_intervals.re +++ php-7.4.33/ext/date/lib/parse_iso_intervals.re @@ -341,10 +341,10 @@ void timelib_strtointerval(char *s, size in.errors->error_messages = NULL; if (len > 0) { - while (isspace(*s) && s < e) { + while (isspace((unsigned char)*s) && s < e) { s++; } - while (isspace(*e) && e > s) { + while (isspace((unsigned char)*e) && e > s) { e--; } } Index: php-7.4.33/ext/date/lib/timelib.c =================================================================== --- php-7.4.33.orig/ext/date/lib/timelib.c +++ php-7.4.33/ext/date/lib/timelib.c @@ -123,7 +123,7 @@ void timelib_time_tz_abbr_update(timelib TIMELIB_TIME_FREE(tm->tz_abbr); tm->tz_abbr = timelib_strdup(tz_abbr); for (i = 0; i < tz_abbr_len; i++) { - tm->tz_abbr[i] = toupper(tz_abbr[i]); + tm->tz_abbr[i] = toupper((unsigned char)tz_abbr[i]); } } Index: php-7.4.33/ext/filter/logical_filters.c =================================================================== --- php-7.4.33.orig/ext/filter/logical_filters.c +++ php-7.4.33/ext/filter/logical_filters.c @@ -519,21 +519,21 @@ static int _php_filter_validate_domain(c } /* First char must be alphanumeric */ - if(*s == '.' || (hostname && !isalnum((int)*(unsigned char *)s))) { + if(*s == '.' || (hostname && !isalnum((unsigned char)*s))) { return 0; } while (s < e) { if (*s == '.') { /* The first and the last character of a label must be alphanumeric */ - if (*(s + 1) == '.' || (hostname && (!isalnum((int)*(unsigned char *)(s - 1)) || !isalnum((int)*(unsigned char *)(s + 1))))) { + if (*(s + 1) == '.' || (hostname && (!isalnum((unsigned char)s[-1]) || !isalnum((unsigned char)s[1])))) { return 0; } /* Reset label length counter */ i = 1; } else { - if (i > 63 || (hostname && *s != '-' && !isalnum((int)*(unsigned char *)s))) { + if (i > 63 || (hostname && *s != '-' && !isalnum((unsigned char)*s))) { return 0; } @@ -560,9 +560,9 @@ static int is_userinfo_valid(zend_string const char *valid = "-._~!$&'()*+,;=:"; const char *p = ZSTR_VAL(str); while (p - ZSTR_VAL(str) < ZSTR_LEN(str)) { - if (isalpha(*p) || isdigit(*p) || strchr(valid, *p)) { + if (isalpha((unsigned char)*p) || isdigit((unsigned char)*p) || strchr(valid, *p)) { p++; - } else if (*p == '%' && p - ZSTR_VAL(str) <= ZSTR_LEN(str) - 3 && isdigit(*(p+1)) && isxdigit(*(p+2))) { + } else if (*p == '%' && p - ZSTR_VAL(str) <= ZSTR_LEN(str) - 3 && isdigit((unsigned char)p[1]) && isxdigit((unsigned char)p[2])) { p += 3; } else { return 0; Index: php-7.4.33/ext/ftp/ftp.c =================================================================== --- php-7.4.33.orig/ext/ftp/ftp.c +++ php-7.4.33/ext/ftp/ftp.c @@ -513,7 +513,7 @@ ftp_raw(ftpbuf_t *ftp, const char *cmd, array_init(return_value); while (ftp_readline(ftp)) { add_next_index_string(return_value, ftp->inbuf); - if (isdigit(ftp->inbuf[0]) && isdigit(ftp->inbuf[1]) && isdigit(ftp->inbuf[2]) && ftp->inbuf[3] == ' ') { + if (isdigit((unsigned char)ftp->inbuf[0]) && isdigit((unsigned char)ftp->inbuf[1]) && isdigit((unsigned char)ftp->inbuf[2]) && ftp->inbuf[3] == ' ') { return; } } @@ -867,7 +867,7 @@ ftp_pasv(ftpbuf_t *ftp, int pasv) return 0; } /* parse out the IP and port */ - for (ptr = ftp->inbuf; *ptr && !isdigit(*ptr); ptr++); + for (ptr = ftp->inbuf; *ptr && !isdigit((unsigned char)*ptr); ptr++); n = sscanf(ptr, "%lu,%lu,%lu,%lu,%lu,%lu", &b[0], &b[1], &b[2], &b[3], &b[4], &b[5]); if (n != 6) { return 0; @@ -1178,7 +1178,7 @@ ftp_mdtm(ftpbuf_t *ftp, const char *path return -1; } /* parse out the timestamp */ - for (ptr = ftp->inbuf; *ptr && !isdigit(*ptr); ptr++); + for (ptr = ftp->inbuf; *ptr && !isdigit((unsigned char)*ptr); ptr++); n = sscanf(ptr, "%4u%2u%2u%2u%2u%2u", &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec); if (n != 6) { return -1; @@ -1382,13 +1382,13 @@ ftp_getresp(ftpbuf_t *ftp) } /* Break out when the end-tag is found */ - if (isdigit(ftp->inbuf[0]) && isdigit(ftp->inbuf[1]) && isdigit(ftp->inbuf[2]) && ftp->inbuf[3] == ' ') { + if (isdigit((unsigned char)ftp->inbuf[0]) && isdigit((unsigned char)ftp->inbuf[1]) && isdigit((unsigned char)ftp->inbuf[2]) && ftp->inbuf[3] == ' ') { break; } } /* translate the tag */ - if (!isdigit(ftp->inbuf[0]) || !isdigit(ftp->inbuf[1]) || !isdigit(ftp->inbuf[2])) { + if (!isdigit((unsigned char)ftp->inbuf[0]) || !isdigit((unsigned char)ftp->inbuf[1]) || !isdigit((unsigned char)ftp->inbuf[2])) { return 0; } Index: php-7.4.33/ext/gd/libgd/gd_xbm.c =================================================================== --- php-7.4.33.orig/ext/gd/libgd/gd_xbm.c +++ php-7.4.33/ext/gd/libgd/gd_xbm.c @@ -193,7 +193,7 @@ void gdImageXbmCtx(gdImagePtr image, cha } else { for (i=0; i= 0x7f) /* validate a modified-base64 character */ -#define B64CHAR(c) (isalnum(c) || (c) == '+' || (c) == ',') +#define B64CHAR(c) (isalnum((unsigned char)(c)) || (c) == '+' || (c) == ',') /* map the low 64 bits of `n' to the modified-base64 characters */ #define B64(n) ("ABCDEFGHIJKLMNOPQRSTUVWXYZ" \ Index: php-7.4.33/ext/intl/locale/locale_methods.c =================================================================== --- php-7.4.33.orig/ext/intl/locale/locale_methods.c +++ php-7.4.33/ext/intl/locale/locale_methods.c @@ -1216,7 +1216,7 @@ static int strToMatch(const char* str ,c if( *str == '-' ){ *retstr = '_'; } else { - *retstr = tolower(*str); + *retstr = tolower((unsigned char)*str); } str++; retstr++; Index: php-7.4.33/ext/mbstring/mbstring.c =================================================================== --- php-7.4.33.orig/ext/mbstring/mbstring.c +++ php-7.4.33/ext/mbstring/mbstring.c @@ -1176,7 +1176,7 @@ static char *php_mb_rfc1867_getword(cons static char *php_mb_rfc1867_getword_conf(const zend_encoding *encoding, char *str) /* {{{ */ { - while (*str && isspace(*(unsigned char *)str)) { + while (*str && isspace((unsigned char)*str)) { ++str; } @@ -1192,7 +1192,7 @@ static char *php_mb_rfc1867_getword_conf } else { char *strend = str; - while (*strend && !isspace(*(unsigned char *)strend)) { + while (*strend && !isspace((unsigned char)*strend)) { ++strend; } return php_mb_rfc1867_substring_conf(encoding, str, strend - str, 0); Index: php-7.4.33/ext/mbstring/php_mbregex.c =================================================================== --- php-7.4.33.orig/ext/mbstring/php_mbregex.c +++ php-7.4.33/ext/mbstring/php_mbregex.c @@ -777,7 +777,7 @@ static inline void mb_regex_substitute( continue; } if (name_end[0] == delim) break; - if (maybe_num && !isdigit(name_end[0])) maybe_num = 0; + if (maybe_num && !isdigit((unsigned char)name_end[0])) maybe_num = 0; name_end++; } p = name_end + 1; Index: php-7.4.33/ext/pcre/php_pcre.c =================================================================== --- php-7.4.33.orig/ext/pcre/php_pcre.c +++ php-7.4.33/ext/pcre/php_pcre.c @@ -622,7 +622,7 @@ PHPAPI pcre_cache_entry* pcre_get_compil /* Parse through the leading whitespace, and display a warning if we get to the end without encountering a delimiter. */ - while (isspace((int)*(unsigned char *)p)) p++; + while (isspace((unsigned char)*p)) p++; if (*p == 0) { if (key != regex) { zend_string_release_ex(key, 0); @@ -636,7 +636,7 @@ PHPAPI pcre_cache_entry* pcre_get_compil /* Get the delimiter and display a warning if it is alphanumeric or a backslash. */ delimiter = *p++; - if (isalnum((int)*(unsigned char *)&delimiter) || delimiter == '\\') { + if (isalnum((unsigned char)delimiter) || delimiter == '\\') { if (key != regex) { zend_string_release_ex(key, 0); } Index: php-7.4.33/ext/pdo/pdo.c =================================================================== --- php-7.4.33.orig/ext/pdo/pdo.c +++ php-7.4.33/ext/pdo/pdo.c @@ -262,7 +262,7 @@ PDO_API int php_pdo_parse_data_source(co } } - while (i < data_source_len && isspace(data_source[i])) { + while (i < data_source_len && isspace((unsigned char)data_source[i])) { i++; } Index: php-7.4.33/ext/pdo/pdo_sql_parser.re =================================================================== --- php-7.4.33.orig/ext/pdo/pdo_sql_parser.re +++ php-7.4.33/ext/pdo/pdo_sql_parser.re @@ -111,7 +111,7 @@ PDO_API int pdo_parse_params(pdo_stmt_t if (t == PDO_PARSER_BIND) { ptrdiff_t len = s.cur - s.tok; - if ((inquery < (s.cur - len)) && isalnum(*(s.cur - len - 1))) { + if ((inquery < (s.cur - len)) && isalnum((unsigned char)s.cur[-len - 1])) { continue; } query_type |= PDO_PLACEHOLDER_NAMED; Index: php-7.4.33/ext/pdo/pdo_stmt.c =================================================================== --- php-7.4.33.orig/ext/pdo/pdo_stmt.c +++ php-7.4.33/ext/pdo/pdo_stmt.c @@ -210,7 +210,7 @@ int pdo_stmt_describe_columns(pdo_stmt_t switch (stmt->dbh->desired_case) { case PDO_CASE_UPPER: while (*s != '\0') { - *s = toupper(*s); + *s = toupper((unsigned char)*s); s++; } break; Index: php-7.4.33/ext/standard/dl.c =================================================================== --- php-7.4.33.orig/ext/standard/dl.c +++ php-7.4.33/ext/standard/dl.c @@ -85,7 +85,7 @@ PHPAPI void *php_load_shlib(char *path, size_t i = strlen(err); (*errp)=estrdup(err); php_win32_error_msg_free(err); - while (i > 0 && isspace((*errp)[i-1])) { (*errp)[i-1] = '\0'; i--; } + while (i > 0 && isspace((unsigned char)(*errp)[i-1])) { (*errp)[i-1] = '\0'; i--; } } else { (*errp) = estrdup(""); } Index: php-7.4.33/ext/standard/file.c =================================================================== --- php-7.4.33.orig/ext/standard/file.c +++ php-7.4.33/ext/standard/file.c @@ -2118,7 +2118,7 @@ PHPAPI void php_fgetcsv(php_stream *stre inc_len = (bptr < limit ? (*bptr == '\0' ? 1 : php_mblen(bptr, limit - bptr)): 0); if (inc_len == 1) { char *tmp = bptr; - while ((*tmp != delimiter) && isspace((int)*(unsigned char *)tmp)) { + while ((*tmp != delimiter) && isspace((unsigned char)*tmp)) { tmp++; } if (*tmp == enclosure) { Index: php-7.4.33/ext/standard/filters.c =================================================================== --- php-7.4.33.orig/ext/standard/filters.c +++ php-7.4.33/ext/standard/filters.c @@ -1090,7 +1090,7 @@ static php_conv_err_t php_conv_qprint_de goto out; } - if (!isxdigit((int) *ps)) { + if (!isxdigit(*ps)) { err = PHP_CONV_ERR_INVALID_SEQ; goto out; } Index: php-7.4.33/ext/standard/formatted_print.c =================================================================== --- php-7.4.33.orig/ext/standard/formatted_print.c +++ php-7.4.33/ext/standard/formatted_print.c @@ -440,13 +440,13 @@ php_formatted_print(zval *z_format, zval PRINTF_DEBUG(("sprintf: first looking at '%c', inpos=%d\n", *format, format - Z_STRVAL_P(z_format))); - if (isalpha((int)*format)) { + if (isalpha((unsigned char)*format)) { width = precision = 0; argnum = currarg++; } else { /* first look for argnum */ temppos = format; - while (isdigit((int)*temppos)) temppos++; + while (isdigit((unsigned char)*temppos)) temppos++; if (*temppos == '$') { argnum = php_sprintf_getnumber(&format, &format_len); @@ -489,7 +489,7 @@ php_formatted_print(zval *z_format, zval /* after modifiers comes width */ - if (isdigit((int)*format)) { + if (isdigit((unsigned char)*format)) { PRINTF_DEBUG(("sprintf: getting width\n")); if ((width = php_sprintf_getnumber(&format, &format_len)) < 0) { efree(result); @@ -507,7 +507,7 @@ php_formatted_print(zval *z_format, zval format++; format_len--; PRINTF_DEBUG(("sprintf: getting precision\n")); - if (isdigit((int)*format)) { + if (isdigit((unsigned char)*format)) { if ((precision = php_sprintf_getnumber(&format, &format_len)) < 0) { efree(result); php_error_docref(NULL, E_WARNING, "Precision must be greater than zero and less than %d", INT_MAX); Index: php-7.4.33/ext/standard/ftp_fopen_wrapper.c =================================================================== --- php-7.4.33.orig/ext/standard/ftp_fopen_wrapper.c +++ php-7.4.33/ext/standard/ftp_fopen_wrapper.c @@ -81,8 +81,8 @@ static inline int get_ftp_result(php_str { buffer[0] = '\0'; /* in case read fails to read anything */ while (php_stream_gets(stream, buffer, buffer_size-1) && - !(isdigit((int) buffer[0]) && isdigit((int) buffer[1]) && - isdigit((int) buffer[2]) && buffer[3] == ' ')); + !(isdigit((unsigned char)buffer[0]) && isdigit((unsigned char)buffer[1]) && + isdigit((unsigned char)buffer[2]) && buffer[3] == ' ')); return strtol(buffer, NULL, 10); } /* }}} */ @@ -234,7 +234,7 @@ static php_stream *php_ftp_fopen_connect #define PHP_FTP_CNTRL_CHK(val, val_len, err_msg) { \ unsigned char *s = (unsigned char *) val, *e = (unsigned char *) s + val_len; \ while (s < e) { \ - if (iscntrl(*s)) { \ + if (iscntrl((unsigned char)*s)) { \ php_stream_wrapper_log_error(wrapper, options, err_msg, val); \ goto connect_errexit; \ } \ @@ -346,14 +346,14 @@ static unsigned short php_fopen_do_pasv( /* parse pasv command (129, 80, 95, 25, 13, 221) */ tpath = tmp_line; /* skip over the "227 Some message " part */ - for (tpath += 4; *tpath && !isdigit((int) *tpath); tpath++); + for (tpath += 4; *tpath && !isdigit((unsigned char)*tpath); tpath++); if (!*tpath) { return 0; } /* skip over the host ip, to get the port */ hoststart = tpath; for (i = 0; i < 4; i++) { - for (; isdigit((int) *tpath); tpath++); + for (; isdigit((unsigned char)*tpath); tpath++); if (*tpath != ',') { return 0; } @@ -838,7 +838,7 @@ static int php_stream_ftp_url_stat(php_s struct tm tm, tmbuf, *gmt; time_t stamp; - while ((size_t)(p - tmp_line) < sizeof(tmp_line) && !isdigit(*p)) { + while ((size_t)(p - tmp_line) < sizeof(tmp_line) && !isdigit((unsigned char)*p)) { p++; } Index: php-7.4.33/ext/standard/html.c =================================================================== --- php-7.4.33.orig/ext/standard/html.c +++ php-7.4.33/ext/standard/html.c @@ -753,8 +753,8 @@ static inline int process_numeric_entity /* strtol allows whitespace and other stuff in the beginning * we're not interested */ - if ((hexadecimal && !isxdigit(**buf)) || - (!hexadecimal && !isdigit(**buf))) { + if ((hexadecimal && !isxdigit((unsigned char)**buf)) || + (!hexadecimal && !isdigit((unsigned char)**buf))) { return FAILURE; } Index: php-7.4.33/ext/standard/math.c =================================================================== --- php-7.4.33.orig/ext/standard/math.c +++ php-7.4.33/ext/standard/math.c @@ -863,9 +863,9 @@ PHPAPI int _php_math_basetozval(zval *ar e = s + Z_STRLEN_P(arg); /* Skip leading whitespace */ - while (s < e && isspace(*s)) s++; + while (s < e && isspace((unsigned char)*s)) s++; /* Skip trailing whitespace */ - while (s < e && isspace(*(e-1))) e--; + while (s < e && isspace((unsigned char)e[-1])) e--; if (e - s >= 2) { if (base == 16 && s[0] == '0' && (s[1] == 'x' || s[1] == 'X')) s += 2; @@ -1160,7 +1160,7 @@ PHPAPI zend_string *_php_math_number_for tmpbuf = strpprintf(0, "%.*F", dec, d); if (tmpbuf == NULL) { return NULL; - } else if (!isdigit((int)ZSTR_VAL(tmpbuf)[0])) { + } else if (!isdigit((unsigned char)ZSTR_VAL(tmpbuf)[0])) { return tmpbuf; } Index: php-7.4.33/ext/standard/metaphone.c =================================================================== --- php-7.4.33.orig/ext/standard/metaphone.c +++ php-7.4.33/ext/standard/metaphone.c @@ -83,7 +83,7 @@ static const char _codes[26] = }; -#define ENCODE(c) (isalpha(c) ? _codes[((toupper(c)) - 'A')] : 0) +#define ENCODE(c) (isalpha((unsigned char)(c)) ? _codes[((toupper((unsigned char)(c))) - 'A')] : 0) #define isvowel(c) (ENCODE(c) & 1) /* AEIOU */ @@ -107,17 +107,17 @@ static const char _codes[26] = * accesssing the array directly... */ /* Look at the next letter in the word */ -#define Next_Letter (toupper(word[w_idx+1])) +#define Next_Letter (toupper((unsigned char)word[w_idx+1])) /* Look at the current letter in the word */ -#define Curr_Letter (toupper(word[w_idx])) +#define Curr_Letter (toupper((unsigned char)word[w_idx])) /* Go N letters back. */ -#define Look_Back_Letter(n) (w_idx >= n ? toupper(word[w_idx-n]) : '\0') +#define Look_Back_Letter(n) (w_idx >= n ? toupper((unsigned char)word[w_idx-n]) : '\0') /* Previous letter. I dunno, should this return null on failure? */ #define Prev_Letter (Look_Back_Letter(1)) /* Look two letters down. It makes sure you don't walk off the string. */ -#define After_Next_Letter (Next_Letter != '\0' ? toupper(word[w_idx+2]) \ +#define After_Next_Letter (Next_Letter != '\0' ? toupper((unsigned char)word[w_idx+2]) \ : '\0') -#define Look_Ahead_Letter(n) (toupper(Lookahead((char *) word+w_idx, n))) +#define Look_Ahead_Letter(n) (toupper((unsigned char)Lookahead((char *) word+w_idx, n))) /* Allows us to safely look ahead an arbitrary # of letters */ @@ -161,7 +161,7 @@ static char Lookahead(char *word, size_t #define Phone_Len (p_idx) /* Note is a letter is a 'break' in the word */ -#define Isbreak(c) (!isalpha(c)) +#define Isbreak(c) (!isalpha((unsigned char)(c))) /* {{{ metaphone */ @@ -196,7 +196,7 @@ static int metaphone(unsigned char *word /*-- The first phoneme has to be processed specially. --*/ /* Find our first letter */ - for (; !isalpha(Curr_Letter); w_idx++) { + for (; !isalpha((unsigned char)Curr_Letter); w_idx++) { /* On the off chance we were given nothing but crap... */ if (Curr_Letter == '\0') { End_Phoned_Word @@ -280,7 +280,7 @@ static int metaphone(unsigned char *word */ /* Ignore non-alphas */ - if (!isalpha(Curr_Letter)) + if (!isalpha((unsigned char)Curr_Letter)) continue; /* Drop duplicates, except CC */ Index: php-7.4.33/ext/standard/quot_print.c =================================================================== --- php-7.4.33.orig/ext/standard/quot_print.c +++ php-7.4.33/ext/standard/quot_print.c @@ -219,11 +219,11 @@ PHP_FUNCTION(quoted_printable_decode) switch (str_in[i]) { case '=': if (str_in[i + 1] && str_in[i + 2] && - isxdigit((int) str_in[i + 1]) && - isxdigit((int) str_in[i + 2])) + isxdigit((unsigned char)str_in[i + 1]) && + isxdigit((unsigned char)str_in[i + 2])) { - ZSTR_VAL(str_out)[j++] = (php_hex2int((int) str_in[i + 1]) << 4) - + php_hex2int((int) str_in[i + 2]); + ZSTR_VAL(str_out)[j++] = (php_hex2int((unsigned char)str_in[i + 1]) << 4) + + php_hex2int((unsigned char)str_in[i + 2]); i += 3; } else /* check for soft line break according to RFC 2045*/ { k = 1; Index: php-7.4.33/ext/standard/scanf.c =================================================================== --- php-7.4.33.orig/ext/standard/scanf.c +++ php-7.4.33/ext/standard/scanf.c @@ -345,7 +345,7 @@ PHPAPI int ValidateFormat(char *format, goto xpgCheckDone; } - if ( isdigit( (int)*ch ) ) { + if ( isdigit( (unsigned char)*ch ) ) { /* * Check for an XPG3-style %n$ specification. Note: there * must not be a mixture of XPG3 specs and non-XPG3 specs @@ -664,9 +664,9 @@ PHPAPI int php_sscanf_internal( char *st /* * If we see whitespace in the format, skip whitespace in the string. */ - if ( isspace( (int)*ch ) ) { + if ( isspace( (unsigned char)*ch ) ) { sch = *string; - while ( isspace( (int)sch ) ) { + while ( isspace( (unsigned char)sch ) ) { if (*string == '\0') { goto done; } @@ -817,7 +817,7 @@ literal: if (!(flags & SCAN_NOSKIP)) { while (*string != '\0') { sch = *string; - if (! isspace((int)sch) ) { + if (! isspace((unsigned char)sch) ) { break; } string++; @@ -843,7 +843,7 @@ literal: end = string; while (*end != '\0') { sch = *end; - if ( isspace( (int)sch ) ) { + if ( isspace( (unsigned char)sch ) ) { break; } end++; Index: php-7.4.33/ext/standard/soundex.c =================================================================== --- php-7.4.33.orig/ext/standard/soundex.c +++ php-7.4.33/ext/standard/soundex.c @@ -74,7 +74,7 @@ PHP_FUNCTION(soundex) /* BUG: should also map here accented letters used in non */ /* English words or names (also found in English text!): */ /* esstsett, thorn, n-tilde, c-cedilla, s-caron, ... */ - code = toupper((int)(unsigned char)str[i]); + code = toupper((unsigned char)str[i]); if (code >= 'A' && code <= 'Z') { if (_small == 0) { /* remember first valid char */ Index: php-7.4.33/ext/standard/string.c =================================================================== --- php-7.4.33.orig/ext/standard/string.c +++ php-7.4.33/ext/standard/string.c @@ -3773,9 +3773,9 @@ PHPAPI void php_stripcslashes(zend_strin case 'f': *target++='\f'; nlen--; break; case '\\': *target++='\\'; nlen--; break; case 'x': - if (source+1 < end && isxdigit((int)(*(source+1)))) { + if (source+1 < end && isxdigit((unsigned char)source[1])) { numtmp[0] = *++source; - if (source+1 < end && isxdigit((int)(*(source+1)))) { + if (source+1 < end && isxdigit((unsigned char)source[1])) { numtmp[1] = *++source; numtmp[2] = '\0'; nlen-=3; @@ -4636,7 +4636,7 @@ static void php_hebrev(INTERNAL_FUNCTION do { if (block_type == _HEB_BLOCK_TYPE_HEB) { - while ((isheb((int)*(tmp+1)) || _isblank((int)*(tmp+1)) || ispunct((int)*(tmp+1)) || (int)*(tmp+1)=='\n' ) && block_end block_start) { + while ((_isblank((int)*tmp) || ispunct((unsigned char)*tmp)) && *tmp!='/' && *tmp!='-' && block_end > block_start) { tmp--; block_end--; } @@ -5113,7 +5113,7 @@ int php_tag_find(char *tag, size_t len, done =1; break; default: - if (!isspace((int)c)) { + if (!isspace((unsigned char)c)) { if (state == 0) { state=1; } @@ -5215,7 +5215,7 @@ state_0: if (in_q) { break; } - if (isspace(*(p + 1)) && !allow_tag_spaces) { + if (isspace((unsigned char)p[1]) && !allow_tag_spaces) { *(rp++) = c; break; } @@ -5262,7 +5262,7 @@ state_1: if (in_q) { break; } - if (isspace(*(p + 1)) && !allow_tag_spaces) { + if (isspace((unsigned char)p[1]) && !allow_tag_spaces) { goto reg_char_1; } depth++; Index: php-7.4.33/ext/standard/strnatcmp.c =================================================================== --- php-7.4.33.orig/ext/standard/strnatcmp.c +++ php-7.4.33/ext/standard/strnatcmp.c @@ -41,12 +41,12 @@ compare_right(char const **a, char const both numbers to know that they have the same magnitude, so we remember it in BIAS. */ for(;; (*a)++, (*b)++) { - if ((*a == aend || !isdigit((int)(unsigned char)**a)) && - (*b == bend || !isdigit((int)(unsigned char)**b))) + if ((*a == aend || !isdigit((unsigned char)**a)) && + (*b == bend || !isdigit((unsigned char)**b))) return bias; - else if (*a == aend || !isdigit((int)(unsigned char)**a)) + else if (*a == aend || !isdigit((unsigned char)**a)) return -1; - else if (*b == bend || !isdigit((int)(unsigned char)**b)) + else if (*b == bend || !isdigit((unsigned char)**b)) return +1; else if (**a < **b) { if (!bias) @@ -69,12 +69,12 @@ compare_left(char const **a, char const /* Compare two left-aligned numbers: the first to have a different value wins. */ for(;; (*a)++, (*b)++) { - if ((*a == aend || !isdigit((int)(unsigned char)**a)) && - (*b == bend || !isdigit((int)(unsigned char)**b))) + if ((*a == aend || !isdigit((unsigned char)**a)) && + (*b == bend || !isdigit((unsigned char)**b))) return 0; - else if (*a == aend || !isdigit((int)(unsigned char)**a)) + else if (*a == aend || !isdigit((unsigned char)**a)) return -1; - else if (*b == bend || !isdigit((int)(unsigned char)**b)) + else if (*b == bend || !isdigit((unsigned char)**b)) return +1; else if (**a < **b) return -1; @@ -107,27 +107,27 @@ PHPAPI int strnatcmp_ex(char const *a, s ca = *ap; cb = *bp; /* skip over leading zeros */ - while (leading && ca == '0' && (ap+1 < aend) && isdigit((int)(unsigned char)*(ap+1))) { + while (leading && ca == '0' && (ap+1 < aend) && isdigit((unsigned char)ap[1])) { ca = *++ap; } - while (leading && cb == '0' && (bp+1 < bend) && isdigit((int)(unsigned char)*(bp+1))) { + while (leading && cb == '0' && (bp+1 < bend) && isdigit((unsigned char)bp[1])) { cb = *++bp; } leading = 0; /* Skip consecutive whitespace */ - while (isspace((int)(unsigned char)ca)) { + while (isspace(ca)) { ca = *++ap; } - while (isspace((int)(unsigned char)cb)) { + while (isspace(cb)) { cb = *++bp; } /* process run of digits */ - if (isdigit((int)(unsigned char)ca) && isdigit((int)(unsigned char)cb)) { + if (isdigit(ca) && isdigit(cb)) { fractional = (ca == '0' || cb == '0'); if (fractional) @@ -151,8 +151,8 @@ PHPAPI int strnatcmp_ex(char const *a, s } if (fold_case) { - ca = toupper((int)(unsigned char)ca); - cb = toupper((int)(unsigned char)cb); + ca = toupper(ca); + cb = toupper(cb); } if (ca < cb) Index: php-7.4.33/ext/standard/type.c =================================================================== --- php-7.4.33.orig/ext/standard/type.c +++ php-7.4.33/ext/standard/type.c @@ -121,7 +121,7 @@ PHP_FUNCTION(intval) char *strval = Z_STRVAL_P(num); size_t strlen = Z_STRLEN_P(num); - while (isspace(*strval) && strlen) { + while (isspace((unsigned char)*strval) && strlen) { strval++; strlen--; } Index: php-7.4.33/ext/standard/url.c =================================================================== --- php-7.4.33.orig/ext/standard/url.c +++ php-7.4.33/ext/standard/url.c @@ -124,7 +124,7 @@ PHPAPI php_url *php_url_parse_ex2(char c p = s; while (p < e) { /* scheme = 1*[ lowalpha | digit | "+" | "-" | "." ] */ - if (!isalpha(*p) && !isdigit(*p) && *p != '+' && *p != '.' && *p != '-') { + if (!isalpha((unsigned char)*p) && !isdigit((unsigned char)*p) && *p != '+' && *p != '.' && *p != '-') { if (e + 1 < ue && e < binary_strcspn(s, ue, "?#")) { goto parse_port; } else if (s + 1 < ue && *s == '/' && *(s + 1) == '/') { /* relative-scheme URL */ @@ -153,7 +153,7 @@ PHPAPI php_url *php_url_parse_ex2(char c * correctly parse things like a.com:80 */ p = e + 1; - while (p < ue && isdigit(*p)) { + while (p < ue && isdigit((unsigned char)*p)) { p++; } @@ -193,7 +193,7 @@ PHPAPI php_url *php_url_parse_ex2(char c p = e + 1; pp = p; - while (pp < ue && pp - p < 6 && isdigit(*pp)) { + while (pp < ue && pp - p < 6 && isdigit((unsigned char)*pp)) { pp++; } @@ -434,12 +434,12 @@ static int php_htoi(char *s) int value; int c; - c = ((unsigned char *)s)[0]; + c = (unsigned char)s[0]; if (isupper(c)) c = tolower(c); value = (c >= '0' && c <= '9' ? c - '0' : c - 'a' + 10) * 16; - c = ((unsigned char *)s)[1]; + c = (unsigned char)s[1]; if (isupper(c)) c = tolower(c); value += c >= '0' && c <= '9' ? c - '0' : c - 'a' + 10; @@ -553,8 +553,8 @@ PHPAPI size_t php_url_decode(char *str, if (*data == '+') { *dest = ' '; } - else if (*data == '%' && len >= 2 && isxdigit((int) *(data + 1)) - && isxdigit((int) *(data + 2))) { + else if (*data == '%' && len >= 2 && isxdigit((unsigned char) *(data + 1)) + && isxdigit((unsigned char) *(data + 2))) { #ifndef CHARSET_EBCDIC *dest = (char) php_htoi(data + 1); #else @@ -649,8 +649,8 @@ PHPAPI size_t php_raw_url_decode(char *s char *data = str; while (len--) { - if (*data == '%' && len >= 2 && isxdigit((int) *(data + 1)) - && isxdigit((int) *(data + 2))) { + if (*data == '%' && len >= 2 && isxdigit((unsigned char) *(data + 1)) + && isxdigit((unsigned char) *(data + 2))) { #ifndef CHARSET_EBCDIC *dest = (char) php_htoi(data + 1); #else @@ -716,7 +716,7 @@ no_name_header: c = *p; *p = '\0'; s = p + 1; - while (isspace((int)*(unsigned char *)s)) { + while (isspace((unsigned char)*s)) { s++; } Index: php-7.4.33/ext/standard/url_scanner_ex.re =================================================================== --- php-7.4.33.orig/ext/standard/url_scanner_ex.re +++ php-7.4.33/ext/standard/url_scanner_ex.re @@ -87,7 +87,7 @@ static int php_ini_on_update_tags(zend_i *val++ = '\0'; for (q = key; *q; q++) { - *q = tolower(*q); + *q = tolower((unsigned char)*q); } keylen = q - key; str = zend_string_init(key, keylen, 1); @@ -136,7 +136,7 @@ static int php_ini_on_update_hosts(zend_ char *q; for (q = key; *q; q++) { - *q = tolower(*q); + *q = tolower((unsigned char)*q); } keylen = q - key; if (keylen > 0) { @@ -456,7 +456,7 @@ static inline void handle_tag(STD_PARA) } smart_str_appendl(&ctx->tag, start, YYCURSOR - start); for (i = 0; i < ZSTR_LEN(ctx->tag.s); i++) - ZSTR_VAL(ctx->tag.s)[i] = tolower((int)(unsigned char)ZSTR_VAL(ctx->tag.s)[i]); + ZSTR_VAL(ctx->tag.s)[i] = tolower((unsigned char)ZSTR_VAL(ctx->tag.s)[i]); /* intentionally using str_find here, in case the hash value is set, but the string val is changed later */ if ((ctx->lookup_data = zend_hash_str_find_ptr(ctx->tags, ZSTR_VAL(ctx->tag.s), ZSTR_LEN(ctx->tag.s))) != NULL) { ok = 1; Index: php-7.4.33/ext/standard/versioning.c =================================================================== --- php-7.4.33.orig/ext/standard/versioning.c +++ php-7.4.33/ext/standard/versioning.c @@ -47,8 +47,8 @@ php_canonicalize_version(const char *ver * s/([^\d\.])([^\D\.])/$1.$2/g; * s/([^\D\.])([^\d\.])/$1.$2/g; */ -#define isdig(x) (isdigit(x)&&(x)!='.') -#define isndig(x) (!isdigit(x)&&(x)!='.') +#define isdig(x) (isdigit((unsigned char)(x))&&(x)!='.') +#define isndig(x) (!isdigit((unsigned char)(x))&&(x)!='.') #define isspecialver(x) ((x)=='-'||(x)=='_'||(x)=='+') lq = *(q - 1); @@ -61,7 +61,7 @@ php_canonicalize_version(const char *ver *q++ = '.'; } *q++ = *p; - } else if (!isalnum(*p)) { + } else if (!isalnum((unsigned char)*p)) { if (lq != '.') { *q++ = '.'; } @@ -154,17 +154,17 @@ php_version_compare(const char *orig_ver if ((n2 = strchr(p2, '.')) != NULL) { *n2 = '\0'; } - if (isdigit(*p1) && isdigit(*p2)) { + if (isdigit((unsigned char)*p1) && isdigit((unsigned char)*p2)) { /* compare element numerically */ l1 = strtol(p1, NULL, 10); l2 = strtol(p2, NULL, 10); compare = ZEND_NORMALIZE_BOOL(l1 - l2); - } else if (!isdigit(*p1) && !isdigit(*p2)) { + } else if (!isdigit((unsigned char)*p1) && !isdigit((unsigned char)*p2)) { /* compare element names */ compare = compare_special_version_forms(p1, p2); } else { /* mix of names and numbers */ - if (isdigit(*p1)) { + if (isdigit((unsigned char)*p1)) { compare = compare_special_version_forms("#N#", p2); } else { compare = compare_special_version_forms(p1, "#N#"); @@ -182,13 +182,13 @@ php_version_compare(const char *orig_ver } if (compare == 0) { if (n1 != NULL) { - if (isdigit(*p1)) { + if (isdigit((unsigned char)*p1)) { compare = 1; } else { compare = php_version_compare(p1, "#N#"); } } else if (n2 != NULL) { - if (isdigit(*p2)) { + if (isdigit((unsigned char)*p2)) { compare = -1; } else { compare = php_version_compare("#N#", p2); Index: php-7.4.33/main/SAPI.c =================================================================== --- php-7.4.33.orig/main/SAPI.c +++ php-7.4.33/main/SAPI.c @@ -195,7 +195,7 @@ static void sapi_read_post_data(void) *p = 0; break; default: - *p = tolower(*p); + *p = tolower((unsigned char)*p); break; } } @@ -704,10 +704,10 @@ SAPI_API int sapi_header_op(sapi_header_ header_line = estrndup(header_line, header_line_len); /* cut off trailing spaces, linefeeds and carriage-returns */ - if (header_line_len && isspace(header_line[header_line_len-1])) { + if (header_line_len && isspace((unsigned char)header_line[header_line_len - 1])) { do { header_line_len--; - } while(header_line_len && isspace(header_line[header_line_len-1])); + } while(header_line_len && isspace((unsigned char)header_line[header_line_len - 1])); header_line[header_line_len]='\0'; } Index: php-7.4.33/main/fopen_wrappers.c =================================================================== --- php-7.4.33.orig/main/fopen_wrappers.c +++ php-7.4.33/main/fopen_wrappers.c @@ -493,7 +493,7 @@ PHPAPI zend_string *php_resolve_path(con } /* Don't resolve paths which contain protocol (except of file://) */ - for (p = filename; isalnum((int)*p) || *p == '+' || *p == '-' || *p == '.'; p++); + for (p = filename; isalnum((unsigned char)*p) || *p == '+' || *p == '-' || *p == '.'; p++); if ((*p == ':') && (p - filename > 1) && (p[1] == '/') && (p[2] == '/')) { wrapper = php_stream_locate_url_wrapper(filename, &actual_path, STREAM_OPEN_FOR_INCLUDE); if (wrapper == &php_plain_files_wrapper) { @@ -529,7 +529,7 @@ PHPAPI zend_string *php_resolve_path(con /* Check for stream wrapper */ int is_stream_wrapper = 0; - for (p = ptr; isalnum((int)*p) || *p == '+' || *p == '-' || *p == '.'; p++); + for (p = ptr; isalnum((unsigned char)*p) || *p == '+' || *p == '-' || *p == '.'; p++); if ((*p == ':') && (p - ptr > 1) && (p[1] == '/') && (p[2] == '/')) { /* .:// or ..:// is not a stream wrapper */ if (p[-1] != '.' || p[-2] != '.' || p - 2 != ptr) { @@ -598,7 +598,7 @@ PHPAPI zend_string *php_resolve_path(con actual_path = trypath; /* Check for stream wrapper */ - for (p = trypath; isalnum((int)*p) || *p == '+' || *p == '-' || *p == '.'; p++); + for (p = trypath; isalnum((unsigned char)*p) || *p == '+' || *p == '-' || *p == '.'; p++); if ((*p == ':') && (p - trypath > 1) && (p[1] == '/') && (p[2] == '/')) { wrapper = php_stream_locate_url_wrapper(trypath, &actual_path, STREAM_OPEN_FOR_INCLUDE); if (!wrapper) { Index: php-7.4.33/main/php_ini.c =================================================================== --- php-7.4.33.orig/main/php_ini.c +++ php-7.4.33/main/php_ini.c @@ -42,7 +42,7 @@ char *tmp = path; \ while (*tmp) { \ if (*tmp == '\\') *tmp = '/'; \ - else *tmp = tolower(*tmp); \ + else *tmp = tolower((unsigned char)*tmp); \ tmp++; \ } \ } Index: php-7.4.33/main/php_variables.c =================================================================== --- php-7.4.33.orig/main/php_variables.c +++ php-7.4.33/main/php_variables.c @@ -196,7 +196,7 @@ PHPAPI void php_register_variable_ex(cha ip++; index_s = ip; - if (isspace(*ip)) { + if (isspace((unsigned char)*ip)) { ip++; } if (*ip==']') { @@ -513,7 +513,7 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_defaul if (arg == PARSE_COOKIE) { /* Remove leading spaces from cookie names, needed for multi-cookie header where ; can be followed by a space */ - while (isspace(*var)) { + while (isspace((unsigned char)*var)) { var++; } if (var == val || *var == '\0') { Index: php-7.4.33/main/rfc1867.c =================================================================== --- php-7.4.33.orig/main/rfc1867.c +++ php-7.4.33/main/rfc1867.c @@ -421,7 +421,7 @@ static int multipart_buffer_headers(mult } /* space in the beginning means same header */ - if (!isspace(line[0])) { + if (!isspace((unsigned char)line[0])) { value = strchr(line, ':'); } @@ -437,7 +437,7 @@ static int multipart_buffer_headers(mult } *value = '\0'; - do { value++; } while (isspace(*value)); + do { value++; } while (isspace((unsigned char)*value)); key = estrdup(line); smart_string_appends(&buf_value, value); @@ -534,7 +534,7 @@ static char *substring_conf(char *start, static char *php_ap_getword_conf(const zend_encoding *encoding, char *str) { - while (*str && isspace(*str)) { + while (*str && isspace((unsigned char)*str)) { ++str; } @@ -550,7 +550,7 @@ static char *php_ap_getword_conf(const z } else { char *strend = str; - while (*strend && !isspace(*strend)) { + while (*strend && !isspace((unsigned char)*strend)) { ++strend; } return substring_conf(str, strend - str, 0); @@ -817,7 +817,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ goto fileupload_done; } - while (isspace(*cd)) { + while (isspace((unsigned char)*cd)) { ++cd; } @@ -825,7 +825,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ { char *key = NULL, *word = pair; - while (isspace(*cd)) { + while (isspace((unsigned char)*cd)) { ++cd; } Index: php-7.4.33/main/snprintf.c =================================================================== --- php-7.4.33.orig/main/snprintf.c +++ php-7.4.33/main/snprintf.c @@ -391,7 +391,7 @@ PHPAPI char * php_conv_fp(register char /* * Check for Infinity and NaN */ - if (isalpha((int)*p)) { + if (isalpha((unsigned char)*p)) { *len = strlen(p); memcpy(buf, p, *len + 1); *is_negative = FALSE; @@ -538,11 +538,11 @@ typedef struct buf_area buffy; #define NUM( c ) ( c - '0' ) #define STR_TO_DEC( str, num ) \ - num = NUM( *str++ ) ; \ - while ( isdigit((int)*str ) ) \ + num = NUM( *(str)++ ) ; \ + while ( isdigit((unsigned char)*(str) ) ) \ { \ num *= 10 ; \ - num += NUM( *str++ ) ; \ + num += NUM( *(str)++ ) ; \ } /* @@ -646,7 +646,7 @@ static int format_converter(register buf /* * Try to avoid checking for flags, width or precision */ - if (isascii((int)*fmt) && !islower((int)*fmt)) { + if (isascii((unsigned char)*fmt) && !islower((unsigned char)*fmt)) { /* * Recognize flags: -, #, BLANK, + */ @@ -668,7 +668,7 @@ static int format_converter(register buf /* * Check if a width was specified */ - if (isdigit((int)*fmt)) { + if (isdigit((unsigned char)*fmt)) { STR_TO_DEC(fmt, min_width); adjust_width = YES; } else if (*fmt == '*') { @@ -688,7 +688,7 @@ static int format_converter(register buf if (*fmt == '.') { adjust_precision = YES; fmt++; - if (isdigit((int)*fmt)) { + if (isdigit((unsigned char)*fmt)) { STR_TO_DEC(fmt, precision); } else if (*fmt == '*') { precision = va_arg(ap, int); Index: php-7.4.33/main/spprintf.c =================================================================== --- php-7.4.33.orig/main/spprintf.c +++ php-7.4.33/main/spprintf.c @@ -152,12 +152,12 @@ #define NUM(c) (c - '0') #define STR_TO_DEC(str, num) do { \ - num = NUM(*str++); \ - while (isdigit((int)*str)) { \ + num = NUM(*(str)++); \ + while (isdigit((unsigned char)*(str))) {\ num *= 10; \ - num += NUM(*str++); \ + num += NUM(*(str)++); \ if (num >= INT_MAX / 10) { \ - while (isdigit((int)*str++)); \ + while (isdigit((unsigned char)*(str)++)); \ break; \ } \ } \ @@ -246,7 +246,7 @@ static void xbuf_format_converter(void * /* * Try to avoid checking for flags, width or precision */ - if (isascii((int)*fmt) && !islower((int)*fmt)) { + if (isascii((unsigned char)*fmt) && !islower((unsigned char)*fmt)) { /* * Recognize flags: -, #, BLANK, + */ @@ -268,7 +268,7 @@ static void xbuf_format_converter(void * /* * Check if a width was specified */ - if (isdigit((int)*fmt)) { + if (isdigit((unsigned char)*fmt)) { STR_TO_DEC(fmt, min_width); adjust_width = YES; } else if (*fmt == '*') { @@ -288,7 +288,7 @@ static void xbuf_format_converter(void * if (*fmt == '.') { adjust_precision = YES; fmt++; - if (isdigit((int)*fmt)) { + if (isdigit((unsigned char)*fmt)) { STR_TO_DEC(fmt, precision); } else if (*fmt == '*') { precision = va_arg(ap, int); Index: php-7.4.33/main/streams/streams.c =================================================================== --- php-7.4.33.orig/main/streams/streams.c +++ php-7.4.33/main/streams/streams.c @@ -1750,7 +1750,7 @@ static inline int php_stream_wrapper_sch unsigned int i; for(i = 0; i < protocol_len; i++) { - if (!isalnum((int)protocol[i]) && + if (!isalnum((unsigned char)protocol[i]) && protocol[i] != '+' && protocol[i] != '-' && protocol[i] != '.') { @@ -1830,7 +1830,7 @@ PHPAPI php_stream_wrapper *php_stream_lo return (php_stream_wrapper*)((options & STREAM_LOCATE_WRAPPERS_ONLY) ? NULL : &php_plain_files_wrapper); } - for (p = path; isalnum((int)*p) || *p == '+' || *p == '-' || *p == '.'; p++) { + for (p = path; isalnum((unsigned char)*p) || *p == '+' || *p == '-' || *p == '.'; p++) { n++; } Index: php-7.4.33/main/streams/transports.c =================================================================== --- php-7.4.33.orig/main/streams/transports.c +++ php-7.4.33/main/streams/transports.c @@ -95,7 +95,7 @@ PHPAPI php_stream *_php_stream_xport_cre } } - for (p = name; isalnum((int)*p) || *p == '+' || *p == '-' || *p == '.'; p++) { + for (p = name; isalnum((unsigned char)*p) || *p == '+' || *p == '-' || *p == '.'; p++) { n++; } Index: php-7.4.33/sapi/cli/php_cli_server.c =================================================================== --- php-7.4.33.orig/sapi/cli/php_cli_server.c +++ php-7.4.33/sapi/cli/php_cli_server.c @@ -668,7 +668,7 @@ static int sapi_cli_server_register_entr if (key[i] == '-') { key[i] = '_'; } else { - key[i] = toupper(key[i]); + key[i] = toupper((unsigned char)key[i]); } } spprintf(&real_key, 0, "%s_%s", "HTTP", key); Index: php-7.4.33/sapi/fpm/fpm/fpm_conf.c =================================================================== --- php-7.4.33.orig/sapi/fpm/fpm/fpm_conf.c +++ php-7.4.33/sapi/fpm/fpm/fpm_conf.c @@ -875,7 +875,7 @@ static int fpm_conf_process_all_pools() } for (i = 0; i < strlen(status); i++) { - if (!isalnum(status[i]) && status[i] != '/' && status[i] != '-' && status[i] != '_' && status[i] != '.' && status[i] != '~') { + if (!isalnum((unsigned char)status[i]) && status[i] != '/' && status[i] != '-' && status[i] != '_' && status[i] != '.' && status[i] != '~') { zlog(ZLOG_ERROR, "[pool %s] the status path '%s' must contain only the following characters '[alphanum]/_-.~'", wp->config->name, status); return -1; } @@ -898,7 +898,7 @@ static int fpm_conf_process_all_pools() } for (i = 0; i < strlen(ping); i++) { - if (!isalnum(ping[i]) && ping[i] != '/' && ping[i] != '-' && ping[i] != '_' && ping[i] != '.' && ping[i] != '~') { + if (!isalnum((unsigned char)ping[i]) && ping[i] != '/' && ping[i] != '-' && ping[i] != '_' && ping[i] != '.' && ping[i] != '~') { zlog(ZLOG_ERROR, "[pool %s] the ping path '%s' must containt only the following characters '[alphanum]/_-.~'", wp->config->name, ping); return -1; } Index: php-7.4.33/sapi/litespeed/lsapi_main.c =================================================================== --- php-7.4.33.orig/sapi/litespeed/lsapi_main.c +++ php-7.4.33/sapi/litespeed/lsapi_main.c @@ -1738,12 +1738,12 @@ PHP_FUNCTION(litespeed_response_headers) len = p - h->header; if (p && len > 0 && len < LSAPI_RESP_HTTP_HEADER_MAX) { memmove( headerBuf, h->header, len ); - while( len > 0 && (isspace( headerBuf[len-1])) ) { + while( len > 0 && (isspace((unsigned char)headerBuf[len - 1])) ) { --len; } headerBuf[len] = 0; if ( len ) { - while( isspace(*++p)); + while(isspace((unsigned char)*++p)); add_assoc_string_ex(return_value, headerBuf, len, p); } } Index: php-7.4.33/sapi/litespeed/lsapilib.c =================================================================== --- php-7.4.33.orig/sapi/litespeed/lsapilib.c +++ php-7.4.33/sapi/litespeed/lsapilib.c @@ -2199,7 +2199,7 @@ static char * GetHeaderVar( LSAPI_Reques while(( pKey < pKeyEnd )&&( *p )) { - char ch = toupper( *pKey ); + char ch = toupper( (unsigned char)*pKey ); if ((ch != *p )||(( *p == '_' )&&( ch != '-'))) break; ++p; ++pKey; @@ -2383,7 +2383,7 @@ int LSAPI_ForeachHeader_r( LSAPI_Request if ( ch == '-' ) *p++ = '_'; else - *p++ = toupper( ch ); + *p++ = toupper( (unsigned char)ch ); } *p = 0; keyLen += 5; @@ -2628,7 +2628,7 @@ int LSAPI_ParseSockAddr( const char * pB if ( !pBind ) return -1; - while( isspace( *pBind ) ) + while(isspace( (unsigned char)*pBind ) ) ++pBind; strncpy(achAddr, pBind, 255); Index: php-7.4.33/sapi/phpdbg/phpdbg_cmd.c =================================================================== --- php-7.4.33.orig/sapi/phpdbg/phpdbg_cmd.c +++ php-7.4.33/sapi/phpdbg/phpdbg_cmd.c @@ -785,9 +785,9 @@ PHPDBG_API char *phpdbg_read_input(char #endif } - if (buffer && isspace(*buffer)) { + if (buffer && isspace((unsigned char)*buffer)) { char *trimmed = buffer; - while (isspace(*trimmed)) + while (isspace((unsigned char)*trimmed)) trimmed++; trimmed = estrdup(trimmed); Index: php-7.4.33/sapi/phpdbg/phpdbg_prompt.c =================================================================== --- php-7.4.33.orig/sapi/phpdbg/phpdbg_prompt.c +++ php-7.4.33/sapi/phpdbg/phpdbg_prompt.c @@ -221,7 +221,7 @@ static void phpdbg_line_init(char *cmd, state->line++; - while (cmd_len > 0L && isspace(cmd[cmd_len-1])) { + while (cmd_len > 0L && isspace((unsigned char)cmd[cmd_len-1])) { cmd_len--; } Index: php-7.4.33/sapi/phpdbg/phpdbg_utils.c =================================================================== --- php-7.4.33.orig/sapi/phpdbg/phpdbg_utils.c +++ php-7.4.33/sapi/phpdbg/phpdbg_utils.c @@ -85,10 +85,10 @@ PHPDBG_API int phpdbg_is_numeric(const c return 0; for (; *str; str++) { - if (isspace(*str) || *str == '-') { + if (isspace((unsigned char)*str) || *str == '-') { continue; } - return isdigit(*str); + return isdigit((unsigned char)*str); } return 0; } /* }}} */ @@ -99,7 +99,7 @@ PHPDBG_API int phpdbg_is_empty(const cha return 1; for (; *str; str++) { - if (isspace(*str)) { + if (isspace((unsigned char)*str)) { continue; } return 0; @@ -202,12 +202,12 @@ PHPDBG_API char *phpdbg_trim(const char const char *p = str; char *new = NULL; - while (p && isspace(*p)) { + while (p && isspace((unsigned char)*p)) { ++p; --len; } - while (*p && isspace(*(p + len -1))) { + while (*p && isspace((unsigned char)p[len - 1])) { --len; } Index: php-7.4.33/win32/sendmail.c =================================================================== --- php-7.4.33.orig/win32/sendmail.c +++ php-7.4.33/win32/sendmail.c @@ -57,7 +57,7 @@ efree(response); \ } \ } -#define SMTP_SKIP_SPACE(str) { while (isspace(*str)) { str++; } } +#define SMTP_SKIP_SPACE(str) { while (isspace((unsigned char)*(str))) { (str)++; } } char seps[] = " ,\t\n"; @@ -724,7 +724,7 @@ static int PostHeader(char *RPath, char headers_lc_len = strlen(headers_lc); for (i = 0; i < headers_lc_len; i++) { - headers_lc[i] = tolower(headers_lc[i]); + headers_lc[i] = tolower((unsigned char)headers_lc[i]); } } @@ -852,7 +852,7 @@ return 0; /* Resolve the servers IP */ /* - if (!isdigit(PW32G(mail_host)[0])||!gethostbyname(PW32G(mail_host))) + if (!isdigit((unsigned char)PW32G(mail_host)[0])||!gethostbyname(PW32G(mail_host))) { return (FAILED_TO_RESOLVE_HOST); }