The default is non-strict, we need to keep the default for BC reasons.
We change the macro handling such that it can be enabled now, previously
it couldn't be enabled.
Closes GH-24704.
Co-authored-by: David Carlier <devnexen@gmail.com>
- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Jakub Zelenka <bukka@php.net>
Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
* PHP-8.6:
SoapClient: add new `keep_headers` option
ext/soap: redact more sensitive headers
`sdl_set_uri_credentials()`: use early returns to improve readability
GH-23686: Add regression tests for sensitive headers
* PHP-8.6:
Update NEWS
ext/standard/tests: work around Windows quoting with tempfiles.
.github/scripts/windows: pass an extension_dir to the test runner.
{ext/standard,sapi/cli}/tests: pass TEST_PHP_EXTRA_ARGS to php
ext/standard/tests: pass TEST_PHP_EXTRA_ARGS to some proc_open() tests
sapi/cli/tests/023.phpt: support TEST_PHP_EXTRA_ARGS
std: Fix memory leak of the last response headers after a nested HTTP request (#24201)
Fiber: hold the object a callable resolved to in the creating frame (#24134)
* PHP-8.5:
Update NEWS
ext/standard/tests: work around Windows quoting with tempfiles.
.github/scripts/windows: pass an extension_dir to the test runner.
{ext/standard,sapi/cli}/tests: pass TEST_PHP_EXTRA_ARGS to php
ext/standard/tests: pass TEST_PHP_EXTRA_ARGS to some proc_open() tests
sapi/cli/tests/023.phpt: support TEST_PHP_EXTRA_ARGS
std: Fix memory leak of the last response headers after a nested HTTP request (#24201)
Fiber: hold the object a callable resolved to in the creating frame (#24134)
* PHP-8.4:
Update NEWS
ext/standard/tests: work around Windows quoting with tempfiles.
.github/scripts/windows: pass an extension_dir to the test runner.
{ext/standard,sapi/cli}/tests: pass TEST_PHP_EXTRA_ARGS to php
ext/standard/tests: pass TEST_PHP_EXTRA_ARGS to some proc_open() tests
sapi/cli/tests/023.phpt: support TEST_PHP_EXTRA_ARGS
std: Fix memory leak of the last response headers after a nested HTTP request (#24201)
Fiber: hold the object a callable resolved to in the creating frame (#24134)
Several of these tests fail to pass TEST_PHP_EXTRA_ARGS to
the PHP binary they execute. This can lead to spurious failures when,
for example, the system's INI file is incompatible with the just-built
CLI php:
---- EXPECTED OUTPUT
int(111)
---- ACTUAL OUTPUT
Failed loading /usr/lib64/php8.2/lib64/opcache.so:
/usr/lib64/php8.2/lib64/opcache.so: undefined symbol: _emalloc_32
int(111)
---- FAILED
This commit adds TEST_PHP_EXTRA_ARGS to the "php" invocations that are
missing them, allowing the user to run "run-tests.php -n" to work
around the problem.
This test runs the PHP test executable from the command-line, but was
not passing TEST_PHP_EXTRA_ARGS to it from run-tests.php. This commit
adds the args, but also updates the test case.
This test relies on memory_limit being updated by an INI file
(generated on-the-fly), but by default, run-tests.php overrides PHP's
memory_limit using TEST_PHP_EXTRA_ARGS. So if we pass the extra args
to PHP, then the memory limit will be constant. To work around that,
we switch to using max_input_vars (as opposed to memory_limit) inside
the test.
* PHP-8.6:
ext/curl/config.m4: include string.h for test using strncmp()
ext/soap/tests/bugs/bug62900.phpt: make use of TEST_PHP_ vars
sapi/cli/tests/php_cli_server_ipv6_error_message.phpt: use TEST_PHP_ vars
* PHP-8.5:
ext/curl/config.m4: include string.h for test using strncmp()
ext/soap/tests/bugs/bug62900.phpt: make use of TEST_PHP_ vars
sapi/cli/tests/php_cli_server_ipv6_error_message.phpt: use TEST_PHP_ vars
When invoking the PHP in a subprocess, TEST_PHP_EXECUTABLE_ESCAPED is
preferable to PHP_BINARY, because the former can be set to ensure that
the just-built (often development) php gets used rather than a system
install. In addition, TEST_PHP_EXTRA_ARGS should be passed to this
interpreter.
Closes GH-22414
php_cli_server_content_sender_send() moved on to the next queued chunk
after a short send() of the current one. When that send() succeeded, its
bytes went out ahead of the current chunk's remainder, and the full-send
branch pointed buffer.first past both, unlinking the partially sent chunk.
The client received later chunks spliced into the body, the connection was
closed short of Content-Length, and the unsent remainder leaked. Stop at
the first partial write and resume from that chunk on the next POLLOUT.
Closes GH-23969
This is unused; this is a vestige of 6c158374ba
and 45e327a672, which set up some timeout code
which was removed in 650c1c0a7d. Remove this
useless function from SAPIs.
The test resets the connection as soon as it is opened, so the reset could
reach the server while the connection was still in the listen backlog. The
server then never saw the request and the expected error was never logged.
Complete a request on a second connection first: the accept queue is FIFO,
so a response on the later connection means the earlier one has been
accepted, and the reset is guaranteed to hit an established connection.
Close GH-23841
* PHP-8.5:
sapi/cli: Fix crash in the CLI server when a client is reset before being accepted
ext/curl: Preserve callback lifetime without rejecting callback changes (#23863)
# Conflicts:
# ext/curl/interface.c
* PHP-8.4:
sapi/cli: Fix crash in the CLI server when a client is reset before being accepted
ext/curl: Preserve callback lifetime without rejecting callback changes (#23863)
accept() can return a socket without filling in the peer address when the
client has already reset the connection. The address buffer was left
uninitialized and php_network_populate_name_from_sockaddr() does not set the
output string for an unknown family, so zend_string_dup() was handed a NULL.
Zero the buffer and fall back to "-" when the address is unknown.
Close GH-23840
Updates the output of `ReflectionClassConstant::__toString()` and
`ReflectionConstant::__toString()`, as well as the other ways that class
constants are printed, e.g. `ReflectionClass::__toString()`.
php_cli_server_begin_send_static() opens the file, but for HEAD requests
never stores the descriptor in client->file_fd, so nothing closes it.
Close it right away; Content-Length comes from the stat and the body is
never sent, so the descriptor is not needed.
Closes GH-23765.
The server previously responded with a copy of the requested "Host" header in
the response, without any validation. That header, as defined in RFC 9110, is
intended for use in *requests*; remove it from the responses.
When posting large payloads, curl checks whether the server is ready for
the body. It sends an `Expect: 100-continue` header and expects
`HTTP/1.1 100 Continue` as the response before sending the body. The PHP
development server did not support this, causing a timeout in curl. This
made such requests take one second longer.
HTTP/1.0 does not support this, so the response is only sent when the
request is HTTP/1.1.
- https://everything.curl.dev/http/post/expect100.html
- https://github.com/php/php-src/issues/23242
Fix GH-23242
Close GH-23245
sapi_cli_server_send_headers() sent the header buffer through
php_cli_server_client_send_through() but dropped the return value, so it
always reported SAPI_HEADER_SENT_SUCCESSFULLY, even when the send failed
and php_handle_aborted_connection() did not bail out (ignore_user_abort=1).
It now compares the send result against the buffer length and returns
SAPI_HEADER_SEND_FAILED when it comes up short.
php_cli_server_client_send_through() itself returned the number of bytes
left on failure, which equals str_len when nothing was sent: the same
value it returns on success. It now returns the number of bytes actually
sent on both paths.
Since sapi_send_headers() resets headers_sent on SAPI_HEADER_SEND_FAILED,
a headers_written flag on the client guards against rebuilding and
resending the whole header block on every subsequent output write.
Close GH-23428
Runs the test suite in parallel by default; automatically selects up to 10 workers. Explicit -j1 remains the opt-out to run tests serial. Smaller batches improve balancing.
ndossche