exif_read_data() only reads the thumbnail if $read_thumbnail is true,
and exif_thumbnail() only scans the thumbnail for its dimensions if they
are requested, so the exif fuzzer never reached this code.
* PHP-8.6:
fpm: fix _GET_str memory leaks and test headers_only status path
fpm: fix a use-after-free of scoreboard_p
fpm: fix potential null dereference in fpm_status_export_to_zval()
# Conflicts:
# NEWS
* PHP-8.5:
fpm: fix _GET_str memory leaks and test headers_only status path
fpm: fix a use-after-free of scoreboard_p
fpm: fix potential null dereference in fpm_status_export_to_zval()
* PHP-8.4:
fpm: fix _GET_str memory leaks and test headers_only status path
fpm: fix a use-after-free of scoreboard_p
fpm: fix potential null dereference in fpm_status_export_to_zval()
When a worker exits while one of its child processes still holds the
worker's stdout/stderr pipe open, the drain in fpm_child_close() gets
EAGAIN instead of EOF and leaves the fd open. fpm_child_close() then
closed the fd but kept its number in the child struct, so the postponed
free closed it (and removed its event) a second time. If a new worker
had been given the same fd number in the meantime, its pipe was closed
and every later write it made to stdio failed with EPIPE.
Remove the event and reset the fd to -1 when closing it in
fpm_child_close() so the postponed free cannot act on it again.
Closes GH-24056.
Co-authored-by: ndossche <7771979+ndossche@users.noreply.github.com>
zlog_stream_set_msg_prefix() used the length returned by vsnprintf()
rather than what was written to its 512-byte buffer, so a long pool name
copied stack memory into the prefix. A prefix close to or above log_limit
also made the remaining line length underflow when the worker output was
logged, which crashed the master or made it write unbounded data.
Use only what was written and limit the prefix to half of log_limit. Also
clamp the formatted length in zlog_stream_vformat().
Closes GH-24541
When FPM fails to start, getPid() reports the missing PID file and
returns 0, and signal() then runs kill -USR2 0. That signals the whole
process group and takes down run-tests.php along with the test. Now
signal() returns early in that case, so the test just fails and the run
keeps going.
Co-authored-by: Bill Sommerfeld <sommerfeld@hamachi.org>
Make it clear that the `init_request_info()` function is indeed meant to be
using `LSAPI_GetScriptFileName()` without any validation, and document in the
README file that this lack of validation is another reason why only trusted
sources should be granted direct access to the listener.
The default is non-strict, we need to keep the default for BC reasons.
We change the macro handling such that it can be enabled now, previously
it couldn't be enabled.
Closes GH-24704.
Co-authored-by: David Carlier <devnexen@gmail.com>
Since the default of opcache.jit changed from "tracing" to "disable"
(c16ad918ba, RFC jit_config_defaults), JIT_G(enabled) is false after
startup and zend_jit_config() rejects every runtime change of
opcache.jit. The function-jit and tracing-jit fuzzers turn the JIT on
at runtime without checking the result, so since PHP 8.4 they have only
been running the VM. The OSS-Fuzz coverage report of 2026-10-24 shows
0.04% line coverage (40/103166) for ext/opcache/jit/.
Start with opcache.jit=off, which keeps the JIT available, and abort if
switching the JIT mode fails, so that this cannot regress silently.
Backport 207dd1d23f and 250f138329 by Ilia Alshanetsky, and 9d6fd4fd98
by Arnaud Le Blanc. These fix watchpoint memory errors and allow watch_006
to run without an expected-failure marker on PHP-8.4 and PHP-8.5.
Fixes GH-24549
Closes GH-24655
- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Jakub Zelenka <bukka@php.net>
Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
* PHP-8.6:
SoapClient: add new `keep_headers` option
ext/soap: redact more sensitive headers
`sdl_set_uri_credentials()`: use early returns to improve readability
GH-23686: Add regression tests for sensitive headers
Make it clear that the `alter_ini()` function is indeed meant to be operating
at the `ZEND_INI_SYSTEM` level, and document in the README file that only
trusted sources should be granted direct access to the listener.
ZEND_VM_ENTER_BIT tags the opline returned by CALL VM handlers. It is
1ULL so that ~ZEND_VM_ENTER_BIT keeps the upper half of 64-bit pointers,
but on 32-bit platforms it widens the tagged pointer expressions to
64 bits, and casting those back to a pointer warns. This breaks
--enable-werror builds where no global VM registers are used, e.g. arm32,
or i386 with --disable-gcc-global-regs.
Use (uintptr_t)1 instead, which is exactly pointer-sized everywhere, also
in the copies of the definition in the JIT and the fuzzer SAPI.
* PHP-8.6:
Update NEWS
ext/standard/tests: work around Windows quoting with tempfiles.
.github/scripts/windows: pass an extension_dir to the test runner.
{ext/standard,sapi/cli}/tests: pass TEST_PHP_EXTRA_ARGS to php
ext/standard/tests: pass TEST_PHP_EXTRA_ARGS to some proc_open() tests
sapi/cli/tests/023.phpt: support TEST_PHP_EXTRA_ARGS
std: Fix memory leak of the last response headers after a nested HTTP request (#24201)
Fiber: hold the object a callable resolved to in the creating frame (#24134)
* PHP-8.5:
Update NEWS
ext/standard/tests: work around Windows quoting with tempfiles.
.github/scripts/windows: pass an extension_dir to the test runner.
{ext/standard,sapi/cli}/tests: pass TEST_PHP_EXTRA_ARGS to php
ext/standard/tests: pass TEST_PHP_EXTRA_ARGS to some proc_open() tests
sapi/cli/tests/023.phpt: support TEST_PHP_EXTRA_ARGS
std: Fix memory leak of the last response headers after a nested HTTP request (#24201)
Fiber: hold the object a callable resolved to in the creating frame (#24134)
Yuma Kakei