The certificate and CRL loops in openssl_pkcs7_read() and
openssl_cms_read() both indexed the output array with their own counter,
so each CRL replaced the certificate at the same index. Append with
add_next_index_zval() instead, preserving both certificates and CRLs.
Closes#24785
In the CALL and TAILCALL VMs, opcode handlers called by function JIT
can return the next opline tagged with ZEND_VM_ENTER_BIT after invoking
a VM interrupt callback. Function JIT used that result directly as an
opcode pointer, causing invalid accesses when execution continued.
Check both bounds before narrowing the parse offset to int32_t. On 64-bit
systems, a value such as -4294967295 previously became 1 and parsing
started at the wrong position. Cover all three parse functions with a
regression test.
Closes#24781
php_array_data_shuffle() first compacts the holes of a packed array and
only then updates nNumUsed. When the engine threw in between, the stale
tail slots were still counted, so the moved values were released twice
when the copied array was destroyed. Update nNumUsed right after the
compaction.
Closes GH-24553.
Follow-up to https://github.com/php/php-src/pull/24570#issuecomment-6375965729
The namespace node branch of php_xpath_eval() still created the parent
element with the DOMXPath's own dom, so with a foreign-doc callback node
the parent proxy referenced the wrong document. Use
dom_xpath_intern_for_doc() there too.
Close GH-24629
dasm_imm13() accepted some non-encodable constants and returned a bogus
encoding, so AND/OR/XOR with them computed a wrong result
(0x5555555555555554) or emitted an illegal instruction (0x200000003).
It also negated INT64_MIN in signed arithmetic. Backport the rewritten
dasm_imm13() from DynASM (LuaJIT a9981441), already in master via the
IR update.
Closes GH-24663.
The tracing guard checked IS_LONG instead of IS_STRING after ZVAL_DEREF,
passing a non-string to zend_hash_find(). The function JIT path checked
IS_STRING instead of IS_REFERENCE, so the deref fast path was dead.
Closes GH-24796.
When curl opaque objects are cloned, the curl handle was only updated if
the callback function wasn't null. However, the C handler in PHP remains
attached even if the callback was set to NULL (*). So we must
unconditionally update the callback data pointer to the new curl handle.
(*) We can't set the C handler to NULL unconditionally on stable branches
because that invokes a behaviour change (e.g. built in progress bar).
Closes GH-24760.
This was never called and resulted in this compiler warning:
```
./ext/opcache/ZendAccelerator.c:3720:15: warning: variable 'orig_post_shutdown_cb' set
but not used [-Wunused-but-set-global]
3720 | static void (*orig_post_shutdown_cb)(void);
| ^
```
Closes GH-24761.
The windows-1258 charset is optional on glibc systems and may be absent
from minimal installations. When iconv cannot open it, the test fails
with "Wrong encoding" instead of exercising iconv_mime_decode().
Probe support in SKIPIF and skip the test if the charset is unavailable,
following the existing iconv test pattern. The test continues to run
when windows-1258 is supported.
Closes#24789
* sodium: Use opaque objects for SHAKE state
* sodium: Make `sodium_crypto_xof_*shake*_update()` void
* sodium: Fix error message phrasing when requesting invalid lengths from SHAKE
* NEWS
Weilin Du