Implement memory handling correctness fixes (#2016)

* Guard field path pop against empty path

Add an early return in phongo_field_path_pop when the path has no
elements to decrement. The function previously assumed callers
maintained push/pop balance, which makes the helper fragile under
future error-recovery edits.

* Match PHP semantics for Int64 bit-shift operators

ZEND_SL and ZEND_SR previously delegated directly to the C shift
operators without bounding the shift amount. Match the behaviour of
PHP's native integer shift handlers: throw ArithmeticError on negative
shift counts, return 0 (or -1 for arithmetic right-shift of a negative
value) when the count is at or above the operand width, and use an
unsigned cast for the left-shift to avoid relying on signed shift
semantics.

* Propagate failure from phongo_zval_to_bson_value_ex

Have the helper return whether the conversion populated the destination
bson_value_t and forward that result through phongo_zval_to_bson_value.
The IS_ARRAY/IS_OBJECT branch previously returned true unconditionally,
which is misleading when an exception was thrown inside the inner
encoder.

* Halt BSON traversal on exception during bsonUnserialize

The document and array visitors call into userland bsonUnserialize() but
did not consult EG(exception) before inserting the resulting object
into the parent container. When bsonUnserialize() throws, abort the
traversal cleanly and propagate the exception instead of attaching a
partially-constructed object to the parent.

* Use a digest of the URI in the persistent client cache key

The cache key produced by phongo_manager_make_client_hash previously
contained the raw connection string. Replace it with a SHA-1 digest of
the URI so the key remains a stable per-URI identifier without
embedding the connection string verbatim into long-lived process
storage.

* Handle empty field path in phongo_field_path_as_string

When all entries in field_path->elements are NULL, the loop appends
nothing and the trailing '.' overwrite would land before the start of
the allocated buffer. Branch on whether the loop wrote anything before
trimming the trailing separator.

* Drop tautological sparsity upper-bound check

The condition sparsity > INT64_MAX is always false because sparsity is
declared as int64_t. Remove the dead branch and keep the meaningful
sparsity < 0 guard.

* Use size_t for BSON data lengths in zval converters

Change phongo_bson_data_to_zval and phongo_bson_data_to_zval_ex to
accept size_t lengths instead of int, matching the unsigned width
expected by libbson's reader API. Existing callers pass uint32_t from
bson_iter_document, so the widening is implicit.

* Use size_t for pattern and flags lengths in phongo_regex_t

Bring phongo_regex_t in line with the other string-carrying structs in
this file, which already use size_t for length fields. Removes a
silent narrowing of the size_t parameter accepted by phongo_regex_init.

* Route phongo_regex_new through phongo_regex_init

phongo_regex_new (used when decoding a Regex from BSON) previously
copied the pattern and flags directly without sorting the flags
alphabetically, while phongo_regex_init does. This caused two Regex
instances representing the same pattern and flags to compare unequal
depending on which path constructed them. Defer to phongo_regex_init
to keep the canonicalisation in one place.

* Validate UTF-8 in scalar phongo_zval_to_bson_value path

The IS_STRING branch wrote the PHP string verbatim into the
bson_value_t without checking that it was valid UTF-8, while the
phongo_bson_append document-encoding path already validates. Match the
existing pattern so that invalid UTF-8 is rejected with an exception
in both code paths.

* Surface scope encoding errors from phongo_javascript_init

When phongo_zval_to_bson throws while encoding the scope, release the
already-allocated code buffer and the partially-written scope BSON,
and report failure to the caller. Previously the function returned
true even though intern was left in an inconsistent state.

* Free existing buffers before re-init in BSON value classes

phongo_binary_init, phongo_regex_init, and phongo_javascript_init
overwrote heap-owned struct members without freeing what was already
there. Re-init the slots cleanly so a second call (e.g. from a
subclass that invokes parent::__unserialize twice) does not leak the
prior allocation. As part of this, hoist the regex flags null-byte
check above the pattern allocation so a flag rejection can no longer
leave a stray pattern buffer behind.

* Address PR 2016 review feedback

- Restructure phongo_javascript_init to stage the new code/scope buffers
  in temporaries and only swap them into the object once both steps have
  succeeded, so a failure during scope encoding no longer leaves the
  object with a freed code pointer and a stale code_len.
- Declare hash as an extension dependency in config.m4 and config.w32
  now that phongo_client.c uses ext/hash for SHA-256, so non-default and
  shared builds link cleanly.
- Test coverage for the new Int64 shift-bound and bson_value UTF-8
  validation paths is intentionally deferred to a follow-up.
- Drop hex conversion in phongo_manager_make_client_hash: use the raw
  32-byte SHA-256 digest directly as the uri key in the serialized
  args array — PHP strings are binary-safe so the serialization output
  is still a stable, unique cache key
- Add tests for Int64 shift-by-negative (ArithmeticError) and
  shift-count-at-or-above-64 (clamp to 0 / -1)
- Add test for invalid UTF-8 in a scalar comment string passed to
  BulkWrite::__construct(), covering the scalar path in
  phongo_zval_to_bson_value

* Update regex for matching client hashes

Author: alcaeus

config.m4

@@ -480,6 +480,7 @@ if test "$PHP_MONGODB" != "no"; then
   PHP_SUBST(MONGODB_SHARED_LIBADD)
 
   PHP_ADD_EXTENSION_DEP(mongodb, date)
+  PHP_ADD_EXTENSION_DEP(mongodb, hash)
   PHP_ADD_EXTENSION_DEP(mongodb, json)
   PHP_ADD_EXTENSION_DEP(mongodb, spl)
   PHP_ADD_EXTENSION_DEP(mongodb, standard)

config.w32

@@ -75,6 +75,7 @@ ARG_WITH("mongodb-client-side-encryption", "MongoDB: Enable client-side encrypti
 
 if (PHP_MONGODB != "no") {
   ADD_EXTENSION_DEP("mongodb", "date", false);
+  ADD_EXTENSION_DEP("mongodb", "hash", false);
   ADD_EXTENSION_DEP("mongodb", "standard", false);
   ADD_EXTENSION_DEP("mongodb", "json", false);
   ADD_EXTENSION_DEP("mongodb", "spl", false);

src/BSON/Binary.c

@@ -51,6 +51,10 @@ static bool phongo_binary_init(phongo_binary_t* intern, const char* data, size_t
 		return false;
 	}
 
+	if (intern->data) {
+		efree(intern->data);
+	}
+
 	intern->data     = estrndup(data, data_len);
 	intern->data_len = data_len;
 	intern->type     = (uint8_t) type;

src/BSON/Int64.c

@@ -443,12 +443,20 @@ static zend_result phongo_int64_do_operation_ex(zend_uchar opcode, zval* result,
 
 		case ZEND_SL:
 			PHONGO_GET_INT64(value2, op2);
-			OPERATION_RESULT_INT64(value1 << value2);
+			if (value2 < 0) {
+				zend_throw_exception(zend_ce_arithmetic_error, "Bit shift by negative number", 0);
+				return FAILURE;
+			}
+			OPERATION_RESULT_INT64(value2 >= 64 ? 0 : (int64_t) ((uint64_t) value1 << value2));
 			return SUCCESS;
 
 		case ZEND_SR:
 			PHONGO_GET_INT64(value2, op2);
-			OPERATION_RESULT_INT64(value1 >> value2);
+			if (value2 < 0) {
+				zend_throw_exception(zend_ce_arithmetic_error, "Bit shift by negative number", 0);
+				return FAILURE;
+			}
+			OPERATION_RESULT_INT64(value2 >= 64 ? (value1 < 0 ? -1 : 0) : value1 >> value2);
 			return SUCCESS;
 
 		case ZEND_POW:

src/BSON/Javascript.c

@@ -30,6 +30,9 @@ zend_class_entry* phongo_javascript_ce;
  * be thrown on error. */
 static bool phongo_javascript_init(phongo_javascript_t* intern, const char* code, size_t code_len, zval* scope)
 {
+	char*   new_code  = NULL;
+	bson_t* new_scope = NULL;
+
 	if (scope && Z_TYPE_P(scope) != IS_OBJECT && Z_TYPE_P(scope) != IS_ARRAY && Z_TYPE_P(scope) != IS_NULL) {
 		phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT, "Expected scope to be array or object, %s given", zend_get_type_by_const(Z_TYPE_P(scope)));
 		return false;
@@ -40,16 +43,32 @@ static bool phongo_javascript_init(phongo_javascript_t* intern, const char* code
 		return false;
 	}
 
-	intern->code     = estrndup(code, code_len);
-	intern->code_len = code_len;
+	new_code = estrndup(code, code_len);
 
 	if (scope && (Z_TYPE_P(scope) == IS_OBJECT || Z_TYPE_P(scope) == IS_ARRAY)) {
-		intern->scope = bson_new();
-		phongo_zval_to_bson(scope, PHONGO_BSON_NONE, intern->scope, NULL);
-	} else {
-		intern->scope = NULL;
+		new_scope = bson_new();
+		phongo_zval_to_bson(scope, PHONGO_BSON_NONE, new_scope, NULL);
+
+		if (EG(exception)) {
+			efree(new_code);
+			bson_destroy(new_scope);
+			return false;
+		}
 	}
 
+	/* Commit the new state only after all fallible steps have succeeded so a
+	 * failure leaves the object's previous contents untouched. */
+	if (intern->code) {
+		efree(intern->code);
+	}
+	if (intern->scope) {
+		bson_destroy(intern->scope);
+	}
+
+	intern->code     = new_code;
+	intern->code_len = code_len;
+	intern->scope    = new_scope;
+
 	return true;
 }
 

src/BSON/Regex.c

@@ -42,14 +42,23 @@ static bool phongo_regex_init(phongo_regex_t* intern, const char* pattern, size_
 		phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT, "Pattern cannot contain null bytes");
 		return false;
 	}
+
+	if (flags && strlen(flags) != (size_t) flags_len) {
+		phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT, "Flags cannot contain null bytes");
+		return false;
+	}
+
+	if (intern->pattern) {
+		efree(intern->pattern);
+	}
+	if (intern->flags) {
+		efree(intern->flags);
+	}
+
 	intern->pattern     = estrndup(pattern, pattern_len);
 	intern->pattern_len = pattern_len;
 
 	if (flags) {
-		if (strlen(flags) != (size_t) flags_len) {
-			phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT, "Flags cannot contain null bytes");
-			return false;
-		}
 		intern->flags     = estrndup(flags, flags_len);
 		intern->flags_len = flags_len;
 		/* Ensure flags are alphabetized upon initialization */
@@ -296,10 +305,6 @@ void phongo_regex_init_ce(INIT_FUNC_ARGS)
 bool phongo_regex_new(zval* object, const char* pattern, const char* flags)
 {
 	PHONGO_INTERN_INIT_EX(regex, object);
-	intern->pattern_len = strlen(pattern);
-	intern->pattern     = estrndup(pattern, intern->pattern_len);
-	intern->flags_len   = strlen(flags);
-	intern->flags       = estrndup(flags, intern->flags_len);
 
-	return true;
+	return phongo_regex_init(intern, pattern, strlen(pattern), flags, strlen(flags));
 }

src/MongoDB/ClientEncryption.c

@@ -856,7 +856,7 @@ static mongoc_client_encryption_encrypt_range_opts_t* phongo_clientencryption_en
 	if (php_array_existsc(options, "sparsity")) {
 		int64_t sparsity = php_array_fetchc_long(options, "sparsity");
 
-		if (sparsity < 0 || sparsity > INT64_MAX) {
+		if (sparsity < 0) {
 			phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT, "Expected \"sparsity\" range option to be a positive 64-bit integer, %" PRId64 " given", sparsity);
 			goto cleanup;
 		}

src/phongo_bson.c

@@ -115,7 +115,11 @@ char* phongo_field_path_as_string(phongo_field_path* field_path)
 		ptr++;
 	}
 
-	ptr[-1] = '\0';
+	if (ptr == path) {
+		path[0] = '\0';
+	} else {
+		ptr[-1] = '\0';
+	}
 
 	return path;
 }
@@ -205,6 +209,10 @@ bool phongo_field_path_push(phongo_field_path* field_path, const char* element,
 
 bool phongo_field_path_pop(phongo_field_path* field_path)
 {
+	if (field_path->size == 0) {
+		return false;
+	}
+
 	phongo_field_path_ensure_allocation(field_path, field_path->size);
 
 	field_path->elements[field_path->size]      = NULL;
@@ -783,6 +791,15 @@ static bool phongo_bson_visit_document(const bson_iter_t* iter ARG_UNUSED, const
 			object_init_ex(&obj, obj_ce);
 
 			zend_call_method_with_1_params(Z_OBJ_P(&obj), NULL, NULL, BSON_UNSERIALIZE_FUNC_NAME, NULL, &state.zchild);
+
+			if (EG(exception)) {
+				zval_ptr_dtor(&obj);
+				zval_ptr_dtor(&state.zchild);
+				phongo_bson_state_dtor(&state);
+				phongo_field_path_pop(parent_state->field_path);
+				return true;
+			}
+
 			zval_ptr_dtor(&state.zchild);
 			ZVAL_COPY_VALUE(&state.zchild, &obj);
 
@@ -859,6 +876,15 @@ static bool phongo_bson_visit_array(const bson_iter_t* iter ARG_UNUSED, const ch
 
 			object_init_ex(&obj, state.field_type.ce);
 			zend_call_method_with_1_params(Z_OBJ_P(&obj), NULL, NULL, BSON_UNSERIALIZE_FUNC_NAME, NULL, &state.zchild);
+
+			if (EG(exception)) {
+				zval_ptr_dtor(&obj);
+				zval_ptr_dtor(&state.zchild);
+				phongo_bson_state_dtor(&state);
+				phongo_field_path_pop(parent_state->field_path);
+				return true;
+			}
+
 			zval_ptr_dtor(&state.zchild);
 			ZVAL_COPY_VALUE(&state.zchild, &obj);
 			break;
@@ -901,7 +927,7 @@ bool phongo_bson_to_zval(const bson_t* b, zval* zv)
 }
 
 /* Converts BSON data to a PHP value using the default typemap. */
-bool phongo_bson_data_to_zval(const unsigned char* data, int data_len, zval* zv)
+bool phongo_bson_data_to_zval(const unsigned char* data, size_t data_len, zval* zv)
 {
 	bool              retval;
 	phongo_bson_state state;
@@ -1183,7 +1209,7 @@ bool phongo_bson_to_zval_ex(const bson_t* b, phongo_bson_state* state)
  * as-is on PHP 7; however, it should have the type undefined if the state
  * was initialized to zero.
  */
-bool phongo_bson_data_to_zval_ex(const unsigned char* data, int data_len, phongo_bson_state* state)
+bool phongo_bson_data_to_zval_ex(const unsigned char* data, size_t data_len, phongo_bson_state* state)
 {
 	bson_reader_t* reader = NULL;
 	const bson_t*  b;

src/phongo_bson.h

@@ -109,8 +109,8 @@ bool               phongo_field_path_pop(phongo_field_path* field_path);
 bool phongo_bson_to_json(zval* return_value, const bson_t* bson, phongo_json_mode_t mode);
 bool phongo_bson_to_zval(const bson_t* b, zval* zv);
 bool phongo_bson_to_zval_ex(const bson_t* b, phongo_bson_state* state);
-bool phongo_bson_data_to_zval(const unsigned char* data, int data_len, zval* zv);
-bool phongo_bson_data_to_zval_ex(const unsigned char* data, int data_len, phongo_bson_state* state);
+bool phongo_bson_data_to_zval(const unsigned char* data, size_t data_len, zval* zv);
+bool phongo_bson_data_to_zval_ex(const unsigned char* data, size_t data_len, phongo_bson_state* state);
 
 bool phongo_bson_value_to_zval(const bson_value_t* value, zval* zv);
 bool phongo_bson_value_to_zval_legacy(const bson_value_t* value, zval* zv);

src/phongo_bson_encode.c

@@ -571,11 +571,12 @@ void phongo_zval_to_bson(zval* data, phongo_bson_flags_t flags, bson_t* bson, bs
 	phongo_field_path_free(field_path);
 }
 
-static void phongo_zval_to_bson_value_ex(zval* data, phongo_bson_flags_t flags, bson_value_t* value)
+static bool phongo_zval_to_bson_value_ex(zval* data, phongo_bson_flags_t flags, bson_value_t* value)
 {
 	bson_iter_t iter;
 	bson_t      bson = BSON_INITIALIZER;
 	zval        data_object;
+	bool        success = false;
 
 	array_init_size(&data_object, 1);
 	add_assoc_zval(&data_object, "data", data);
@@ -584,12 +585,15 @@ static void phongo_zval_to_bson_value_ex(zval* data, phongo_bson_flags_t flags,
 
 	phongo_zval_to_bson(&data_object, flags, &bson, NULL);
 
-	if (bson_iter_init_find(&iter, &bson, "data")) {
+	if (!EG(exception) && bson_iter_init_find(&iter, &bson, "data")) {
 		bson_value_copy(bson_iter_value(&iter), value);
+		success = true;
 	}
 
 	bson_destroy(&bson);
 	zval_ptr_dtor(&data_object);
+
+	return success;
 }
 
 /* Converts the argument to a bson_value_t. If the object is an instance of
@@ -639,6 +643,11 @@ bool phongo_zval_to_bson_value(zval* data, bson_value_t* value)
 			return true;
 
 		case IS_STRING:
+			if (!bson_utf8_validate(Z_STRVAL_P(data), Z_STRLEN_P(data), true)) {
+				phongo_throw_exception(PHONGO_ERROR_UNEXPECTED_VALUE, "Detected invalid UTF-8 in string value");
+				return false;
+			}
+
 			value->value_type       = BSON_TYPE_UTF8;
 			value->value.v_utf8.len = Z_STRLEN_P(data);
 
@@ -651,8 +660,7 @@ bool phongo_zval_to_bson_value(zval* data, bson_value_t* value)
 		case IS_ARRAY:
 		case IS_OBJECT:
 			/* Use phongo_zval_to_bson internally to convert arrays and documents */
-			phongo_zval_to_bson_value_ex(data, PHONGO_BSON_NONE, value);
-			return true;
+			return phongo_zval_to_bson_value_ex(data, PHONGO_BSON_NONE, value);
 	}
 
 	phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT, "Unsupported type %s", zend_zval_type_name(data));