- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Jakub Zelenka <bukka@php.net>
Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
* PHP-8.6:
SoapClient: add new `keep_headers` option
ext/soap: redact more sensitive headers
`sdl_set_uri_credentials()`: use early returns to improve readability
GH-23686: Add regression tests for sensitive headers
* PHP-8.6:
Update NEWS
ext/standard/tests: work around Windows quoting with tempfiles.
.github/scripts/windows: pass an extension_dir to the test runner.
{ext/standard,sapi/cli}/tests: pass TEST_PHP_EXTRA_ARGS to php
ext/standard/tests: pass TEST_PHP_EXTRA_ARGS to some proc_open() tests
sapi/cli/tests/023.phpt: support TEST_PHP_EXTRA_ARGS
std: Fix memory leak of the last response headers after a nested HTTP request (#24201)
Fiber: hold the object a callable resolved to in the creating frame (#24134)
* PHP-8.5:
Update NEWS
ext/standard/tests: work around Windows quoting with tempfiles.
.github/scripts/windows: pass an extension_dir to the test runner.
{ext/standard,sapi/cli}/tests: pass TEST_PHP_EXTRA_ARGS to php
ext/standard/tests: pass TEST_PHP_EXTRA_ARGS to some proc_open() tests
sapi/cli/tests/023.phpt: support TEST_PHP_EXTRA_ARGS
std: Fix memory leak of the last response headers after a nested HTTP request (#24201)
Fiber: hold the object a callable resolved to in the creating frame (#24134)
* PHP-8.4:
Update NEWS
ext/standard/tests: work around Windows quoting with tempfiles.
.github/scripts/windows: pass an extension_dir to the test runner.
{ext/standard,sapi/cli}/tests: pass TEST_PHP_EXTRA_ARGS to php
ext/standard/tests: pass TEST_PHP_EXTRA_ARGS to some proc_open() tests
sapi/cli/tests/023.phpt: support TEST_PHP_EXTRA_ARGS
std: Fix memory leak of the last response headers after a nested HTTP request (#24201)
Fiber: hold the object a callable resolved to in the creating frame (#24134)
Several of these tests fail to pass TEST_PHP_EXTRA_ARGS to
the PHP binary they execute. This can lead to spurious failures when,
for example, the system's INI file is incompatible with the just-built
CLI php:
---- EXPECTED OUTPUT
int(111)
---- ACTUAL OUTPUT
Failed loading /usr/lib64/php8.2/lib64/opcache.so:
/usr/lib64/php8.2/lib64/opcache.so: undefined symbol: _emalloc_32
int(111)
---- FAILED
This commit adds TEST_PHP_EXTRA_ARGS to the "php" invocations that are
missing them, allowing the user to run "run-tests.php -n" to work
around the problem.
This test runs the PHP test executable from the command-line, but was
not passing TEST_PHP_EXTRA_ARGS to it from run-tests.php. This commit
adds the args, but also updates the test case.
This test relies on memory_limit being updated by an INI file
(generated on-the-fly), but by default, run-tests.php overrides PHP's
memory_limit using TEST_PHP_EXTRA_ARGS. So if we pass the extra args
to PHP, then the memory limit will be constant. To work around that,
we switch to using max_input_vars (as opposed to memory_limit) inside
the test.
* PHP-8.6:
ext/curl/config.m4: include string.h for test using strncmp()
ext/soap/tests/bugs/bug62900.phpt: make use of TEST_PHP_ vars
sapi/cli/tests/php_cli_server_ipv6_error_message.phpt: use TEST_PHP_ vars
* PHP-8.5:
ext/curl/config.m4: include string.h for test using strncmp()
ext/soap/tests/bugs/bug62900.phpt: make use of TEST_PHP_ vars
sapi/cli/tests/php_cli_server_ipv6_error_message.phpt: use TEST_PHP_ vars
When invoking the PHP in a subprocess, TEST_PHP_EXECUTABLE_ESCAPED is
preferable to PHP_BINARY, because the former can be set to ensure that
the just-built (often development) php gets used rather than a system
install. In addition, TEST_PHP_EXTRA_ARGS should be passed to this
interpreter.
Closes GH-22414
The test resets the connection as soon as it is opened, so the reset could
reach the server while the connection was still in the listen backlog. The
server then never saw the request and the expected error was never logged.
Complete a request on a second connection first: the accept queue is FIFO,
so a response on the later connection means the earlier one has been
accepted, and the reset is guaranteed to hit an established connection.
Close GH-23841
* PHP-8.5:
sapi/cli: Fix crash in the CLI server when a client is reset before being accepted
ext/curl: Preserve callback lifetime without rejecting callback changes (#23863)
# Conflicts:
# ext/curl/interface.c
* PHP-8.4:
sapi/cli: Fix crash in the CLI server when a client is reset before being accepted
ext/curl: Preserve callback lifetime without rejecting callback changes (#23863)
accept() can return a socket without filling in the peer address when the
client has already reset the connection. The address buffer was left
uninitialized and php_network_populate_name_from_sockaddr() does not set the
output string for an unknown family, so zend_string_dup() was handed a NULL.
Zero the buffer and fall back to "-" when the address is unknown.
Close GH-23840
Updates the output of `ReflectionClassConstant::__toString()` and
`ReflectionConstant::__toString()`, as well as the other ways that class
constants are printed, e.g. `ReflectionClass::__toString()`.
The server previously responded with a copy of the requested "Host" header in
the response, without any validation. That header, as defined in RFC 9110, is
intended for use in *requests*; remove it from the responses.
When posting large payloads, curl checks whether the server is ready for
the body. It sends an `Expect: 100-continue` header and expects
`HTTP/1.1 100 Continue` as the response before sending the body. The PHP
development server did not support this, causing a timeout in curl. This
made such requests take one second longer.
HTTP/1.0 does not support this, so the response is only sent when the
request is HTTP/1.1.
- https://everything.curl.dev/http/post/expect100.html
- https://github.com/php/php-src/issues/23242
Fix GH-23242
Close GH-23245
sapi_cli_server_send_headers() sent the header buffer through
php_cli_server_client_send_through() but dropped the return value, so it
always reported SAPI_HEADER_SENT_SUCCESSFULLY, even when the send failed
and php_handle_aborted_connection() did not bail out (ignore_user_abort=1).
It now compares the send result against the buffer length and returns
SAPI_HEADER_SEND_FAILED when it comes up short.
php_cli_server_client_send_through() itself returned the number of bytes
left on failure, which equals str_len when nothing was sent: the same
value it returns on success. It now returns the number of bytes actually
sent on both paths.
Since sapi_send_headers() resets headers_sent on SAPI_HEADER_SEND_FAILED,
a headers_written flag on the client guards against rebuilding and
resending the whole header block on every subsequent output write.
Close GH-23428
Runs the test suite in parallel by default; automatically selects up to 10 workers. Explicit -j1 remains the opt-out to run tests serial. Smaller batches improve balancing.
The dev server's HTTP parser accumulates Content-Length digits into an
ssize_t without an overflow check; a 30-digit value wraps and the
consumer aborts on pemalloc. Guard the decimal and chunked-size
accumulators against SSIZE_MAX, then reject in on_headers_complete when
the parsed length exceeds post_max_size and reply 413 with the
configured limit in the body.
A chunked request carries no Content-Length, so enforce the same limit
as the chunks accumulate in on_body, and honour a non-zero return from
that callback in the parser. The body buffer was reserved from the
declared length and resized down to the bytes in hand on the next line,
so a chunk header of 7FFFFFFFFFFFFF aborted the server for no gain; grow
it from the received length instead. A parse error between a header name
and its value left the copied name owned by nobody; release both header
strings in php_cli_server_client_dtor().
Fixes GH-22003
Technically this applies to other SAPIs, but CLI is currently the only one with
a flag with an optional value. The PHP getopt() implementation already clears
php_optarg by-hand.
Fixes GH-21901
Closes GH-21902
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Ilija Tovilo