- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Jakub Zelenka <bukka@php.net>
Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
* PHP-8.2:
ext/soap: make GHSA-cj93-vc83-wgqv test lean and reliable
Add NEWS entries
ext/standard: Fix 1-char relative Location redirects after GH-23467
[http] Fix out-of-bounds read on empty Location header
Fix GHSA-ch8v-r6jh-4vvr: encode 0xFF in FILTER_SANITIZE_ENCODED
Fix GHSA-9f67-6fw4-hpfp
Fix GHSA-j3wh-g957-2m85: phar tar entry injection
Fix GHSA-cj93-vc83-wgqv
Fix GHSA-rgrp-mwpx-f6rm: unbounded recursion in ext/soap XML parsing and decoding
Fix GHSA-fpwc-w8rq-cr92: strip credentials from user headers on cross-origin redirects
Fix GHSA-r6x9-5r99-36j7: Various packet overreads in mysqlnd wireprotocol
Fix GHSA-xr7j-rvgx-xq5p: OOB read in php_openssl_matches_wildcard_name()
Fix GHSA-vvx9-73fr-5jjx: do not fall back to CN if the cert has a service ID
Fix GHSA-62xp-839h-2637: FastCGI allowed_clients compared only 96 bits of IPv6 addresses
Fix heap-buffer-overflow in convert stream filters with NUL in line-break-chars
php_filter_encode_url() initialized its 256-byte "must encode" table with
memset(tmp, 1, sizeof(tmp) - 1), leaving tmp[255] uninitialized. Whether
0xFF got percent-encoded then depended on stack garbage; valgrind reports
the read as a conditional jump on an uninitialised value. Initialize the
whole table.
Backport of 56149186d8 from PHP-8.4.
Headers required by the generated code (zend_attributes.h, zend_constants.h, zend_enum.h) are collected during generation and emitted as includes at the top of the arginfo file, with the same preprocessor conditions and PHP version guards as the code that needs them.
Removes the manual zend_attributes.h and zend_enum.h includes from sources that only needed them for the arginfo file they include.
The stub declares array|false|null, but null is unreachable. The function
has two exits: RETURN_FALSE for an unknown filter id, and the array handler,
which establishes an array on both of its branches before doing anything
else. Its remaining exits throw.
The sibling filter_input_array() is declared identically and does return
null, deliberately, because its source superglobal may not exist. That case
has no equivalent here, where the source is a required array parameter.
null remains an ordinary element value in the returned array, which is
likely where the wider union came from; that is the value type, not the
return type.
* ext/bz2: applied fixers to improve test robustness
* ext/calendar: applied fixers to improve test robustness
* ext/exif: applied fixers to improve test robustness
* ext/fileinfo: applied fixers to improve test robustness
* ext/filter: applied fixers to improve test robustness
* ext/ftp: applied fixers to improve test robustness
* ext/hash: applied fixers to improve test robustness
* ext/iconv: applied fixers to improve test robustness
* ext/ldap: applied fixers to improve test robustness
* ext/pcre: applied fixers to improve test robustness
* ext/posix: applied fixers to improve test robustness
* ext/readline: applied fixers to improve test robustness
* ext/shmop: applied fixers to improve test robustness
* ext/snmp: applied fixers to improve test robustness
* ext/sodium: applied fixers to improve test robustness
* ext/sqlite3: applied fixers to improve test robustness
* ext/sysvmsg: applied fixers to improve test robustness
* ext/sysvsem: applied fixers to improve test robustness
* ext/sysvshm: applied fixers to improve test robustness
* ext/tidy: applied fixers to improve test robustness
* ext/tokenizer: applied fixers to improve test robustness
* ext/zend_test: applied fixers to improve test robustness
* ext/zlib: applied fixers to improve test robustness
php_filter_encode_url() initialized its 256-byte "must encode" table with
memset(tmp, 1, sizeof(tmp) - 1), leaving tmp[255] uninitialized. Whether
0xFF got percent-encoded then depended on stack garbage; valgrind reports
the read as a conditional jump on an uninitialised value. Initialize the
whole table.
Closes GH-22762
php_sapi_filter() re-exported PARSE_STRING results through Z_STRLEN/Z_STRVAL
without checking the type php_zval_filter() left behind. A validation failure
frees the string and stores IS_FALSE, so the macros read the freed
zend_string; a successful FILTER_VALIDATE_INT stores IS_LONG, so they
dereference the integer as a pointer. Convert with zval_get_tmp_string()
before writing back.
Closes GH-22765
php_zval_filter() copies the filtered value so it can be quoted in the
FilterFailedException message, then released the copy with
zend_string_delref(), which only decrements the refcount. When the input
is a non-string scalar that convert_to_string() turns into a fresh heap
string, the copy was the sole owner and leaked one string per call on
both the failure and the success path. Use zend_string_release() so it is
freed at refcount zero.
Closes GH-22339
The call_user_function() API redoes the zend_is_callable() check, which has been just done.
We can check validity and retrieve the FCC to call it directly rather than having a useless double check
* uri: Rename `uri_recomposition_mode_t` to `php_uri_recomposition_mode`
* uri: Align the names of the `php_uri_recomposition_mode` values
* uri: Rename `uri_component_read_mode_t` to `php_uri_component_read_mode`
* uri: Align the names of the `php_uri_component_read_mode` values
* uri: Rename `uri_property_name_t` to `php_uri_property_name`
* uri: Align the names of the `php_uri_property_name` values
* uri: Rename `uri_property_handler_t` to `php_uri_property_handler`
* uri: Rename `uri_(read|write)_t` to `php_uri_property_handler_(read|write)`
* uri: Rename `php_uri_property_handler`’s `(read|write)_func` to `read|write`
The `_func` is implied by the data type and the name of the struct.
* uri: Rename `uri_parser_t` to `php_uri_parser`
* uri: Shorten the names of `php_uri_parser` fields
The `_uri` suffix is implied, because this is an URI parser.
* uri/standard: Move the `parse_url()` URI parser into ext/uri/
Making ext/standard depend on ext/uri/ is a bit iffy (given that it is called
*standard*) and having the parser implementation in ext/uri/ makes it easier to
find and keep in sync.
* uri: Mark local pointers as `const` in uri_parser_php_parse_url.c
* uri: Remove useless explicit cast from void in uri_parser_php_parse_url.c
* uri: Properly prefix symbols in uri_parser_php_parse_url.[ch]
* uri: Remove useless `throw_invalid_uri_exception()` helper in uri_parser_php_parse_url.c
Avoid initializing the same string content multiple times and make use of the
fact that the strings created to initialize attribute values are not freed by
simply making use of an existing zend_string with the same content if one is
available.
Instead of
* adding a zval on the stack
* initializing it
* copying the value to the attribute
Just initialize the value directly in the zend_attribute_arg
Have each of the specialized methods for registering a constant return a
pointer to the registered constant the same way that the generic
`zend_register_constant()` function does, and use those in the generated
arginfo files to avoid needing to search for a constant that was just
registered in order to add attributes to it.
Only covers constants declared via stub files, others will be handled
separately in a later commit.
Does not include the intl extension, since that had some errors relating to the
cpp code; that extension will be updated separately.
* PHP-8.4:
Fix GH-18309: ipv6 filter integer overflow
Fix GH-18304: Changing the properties of a DateInterval through dynamic properties triggers a SegFault
* PHP-8.3:
Fix GH-18309: ipv6 filter integer overflow
Fix GH-18304: Changing the properties of a DateInterval through dynamic properties triggers a SegFault
The intermediate computation can cause a signed integer overflow, but
the input is correctly rejected later on by the check on variable `n`.
Solve this by using an unsigned number.
Closes GH-18312.
Ilija Tovilo