* PHP-8.6:
Fix GH-24438: Preserve indirect types in JIT side traces
Fix GH-17733: System entropy does not take into account function order, resulting in wrong functions possibly called in different configurations
ext/openssl: Fix build with OpenSSL 4.1 (#24686)
* PHP-8.5:
Fix GH-24438: Preserve indirect types in JIT side traces
Fix GH-17733: System entropy does not take into account function order, resulting in wrong functions possibly called in different configurations
* PHP-8.4:
Fix GH-24438: Preserve indirect types in JIT side traces
Fix GH-17733: System entropy does not take into account function order, resulting in wrong functions possibly called in different configurations
This properly fixes the entropy computation to take into account
function ordering and module versions. This is basically a
reintroduction of the previously removed code from GH-5871, but a
simpler version. Since this runs once every module startup, the overhead
is negligible as it does not influence the request.
I chose this simple approach rather than the suggestion to introduce
multiple system entropies based on shm/file-cache.
This PR also simplifies some other parts, since we can get rid of some
workarounds.
Closes GH-24664.
Since 2f7b01b86c, `zend_is_callable()` fills in an error string even when it fails because an exception is already pending, so `php_stream_call_error_handler()` threw a TypeError over the StreamException (or whatever the user error handler threw) for any `Class::method` handler. It now only throws when nothing is pending, the same way curl already does.
The same commit made `zend_parse_arg()` leak that error string when it bails out on a pending exception, so it's freed there now too.
Fixes GH-24491
- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Jakub Zelenka <bukka@php.net>
Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
* Zend: always populate error pointer on failure
Most of the code base expects an error to be set if a char* is provided, as this used to be always the case. It no longer was the case since the partially supported callables were deprecates as the deprecation could be promoted to an exception in which case we skipped allocating a char*.
The simple fix, allocate a char* even in case of an exception so callers don't need to check if it still NULL. This fixes some error messages at the same time.
* tree: simplify error handling for failed zend_is_callable() calls
* docs: clarify docs for zend_is_callable()
---------
Co-authored-by: Arnaud Le Blanc <365207+arnaud-lb@users.noreply.github.com>
FRAMELESS_ICALL stores an index into zend_flf_handlers, whose layout
depends on the loaded extensions, but zend_system_id did not cover it. A
file cache warmed with a frameless-declaring extension then crashed in a
process without it, or one that loads it with dl(), which registers no
frameless handlers. Each persistent frameless function now adds its name
and arity to the system id when it registers, before disable_functions can
free the function record.
Closes GH-24047
Fix#22895
The return value of array_set_zval_key() was ignored, so when the key is
not a legal array offset, e.g. MultipleIterator::key() returning an
array, it threw and took no reference. The unconditional zval_ptr_dtor()
then dropped the iterator's only reference to the borrowed value and the
following Z_TRY_ADDREF_P() read freed memory. array_set_zval_key() now
also fails when a float or resource key diagnostic throws, and the loop
stops on failure.
Close GH-22896
dl() modules are MODULE_TEMPORARY. Their function records are freed at
request shutdown, but zend_flf_functions keeps those pointers for the
process lifetime. A later request can match the stale handler address
and use the freed record. Temporary modules leave the frameless info
unset, so the call uses the ordinary internal path.
Closes GH-24008
Correct typographical and grammatical mistakes across docs, comments, and build tools. Refactor local identifiers childrens to children in RecursiveFilterIterator and sav to saved_char in sapi_header_add_op.
* zend_API: Verify property types in `object_properties_load()`
Fixesphp/php-src#9708.
* zend_API: Fix various issues in `object_properties_load()`
Fixes Fixesphp/php-src#9707.
Co-authored-by: Tim Düsterhus <tim@tideways-gmbh.com>
* NEWS
* random: Remove now-obsolete manual `$engine` type check in `Randomizer::__unserialize()`
* zend_API: Make `object_properties_load()` use `strict_types=1`
This is consistent with regular unserialization, which also performs strict
type checking.
Co-authored-by: Gina Peter Banyard <girgias@php.net>
* Block creation of readonly reference properties
Co-authored-by: Arnaud Le Blanc <365207+arnaud-lb@users.noreply.github.com>
---------
Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Gina Peter Banyard <girgias@php.net>
Co-authored-by: Arnaud Le Blanc <365207+arnaud-lb@users.noreply.github.com>
Splitting the behavioural change of #23052 out into this and come up with something that is hopefully more sensible and consistent between fast and slow ZPP and the object or class_name Fast ZPP specifier.
zend_hash_str_find_ptr_lc is very useful in place we need to deal with lower
case strings. Here we use it to replace the process of first creating the
string, turning it to lower case and freeing it.
Fix#23121
zend_is_callable_at_frame() tested `get_closure && get_closure(...) == FAILURE`,
so a NULL handler short circuited past the error branch into the success path,
leaving fcc->function_handler NULL. zend_fcc_addref() then asserted and
call_user_func() dereferenced the null zend_function.
Close GH-23123
* Zend: add tests for ZPP class-string specifier
* Zend: handle non-string arguments for ZPP class-string specifier as expected
This doesn't behave like any of the other specifiers, as it doesn't respect strict_types, emit a deprecation for null, or reject arrays
ndossche