- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Jakub Zelenka <bukka@php.net>
Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
zend_call_function() ran the callback with fci_cache->object as $this
without holding a reference, so a callback that released the last
reference to its own receiver (an autoloader unregistering itself, a
SQLite3 authorizer calling setAuthorizer(null)) freed $this while its
frame was still executing. Take the reference where the receiver is
selected rather than after argument setup, so the error handlers
reachable from the deprecation notice and the by-reference warning
cannot free it first, and release it on every early exit.
Fixes GH-22060
Fixes GH-22122
Runs the test suite in parallel by default; automatically selects up to 10 workers. Explicit -j1 remains the opt-out to run tests serial. Smaller batches improve balancing.
Prevents unavailable optional test services from slowing the suite through repeated connection timeouts. PDO and SNMP availability probes cache the first failure for the duration of one test run, so later SKIPIF checks return immediately.
Only failures are cached; successful probes and test connections are unchanged. PDOs one second timeout applies only to the default availability probe. The caches are private, run-scoped and removed afterwards. A service becoming available mid run is detected on the next test-suite run.
This introduces new API for fd copying and modifies
php_stream_copy_to_stream_ex to use it. The implementation is separated
for various platforms and the end result have couple of implications:
- sendfile is used for copying file to generic fd (e.g. sockets) on all
platforms except Windows that use TransmitFile
- splice is used for copying between generic fds (e.g. sockets) on
Linux
- copy_file_range should get used on alpine linux with directly using
syscall (as musl does not seem to implement it)
- copy_file_range is used in the loop so it is used multiple times for
files bigger than 2GB on Linux.
- file mmap for copying is removed as it allowed crashing PHP when
another process modified mapped file - this was used as a fallback
for file copying. Sendfile should partially replace it.
- File to file copying was optimized on Windows with use of ReadFile
and WriteFile.
This also adds various tests including Linux unit tests.
Closes GH-20399
Co-authored-by: David Carlier <devnexen@gmail.com>
Negate after casting to unsigned instead of before, avoiding signed
integer overflow when offset is ZEND_LONG_MIN. The same pattern existed
in the pdo_sqlite and sqlite3 stream seek handlers.
Closes GH-20964
Closes GH-20927
When given a "Class::property" argument, getProperty() lowercased the
class part before looking it up, so the "Class ... does not exist"
exception printed the lowercased name and autoloaders received it in
lowercase, breaking case-sensitive (PSR-4) autoloaders.
Pass the class name to zend_lookup_class() as given - it lowercases
internally for the class-table lookup - matching what ReflectionMethod
and ReflectionProperty already do.
The problem is that the code is doing `php_output_handler_free` in a loop on the output stack,
but prior to freeing the pointer on the stack in `php_output_handler_free` it calls
`php_output_handler_dtor` which can run user code that reallocates the stack,
resulting in a dangling pointer freed by php_output_handler_free.
Furthermore, OG(active) is set when creating a new output handler, but
the loop is supposed to clean up all handlers, so OG(active) must be
reset as well.
Closes GH-20356.
Make sure to always duplicate max_memory_limit ini value. Otherwise the alter
ini routine may assume the value hasn't been overwritten, resulting in the
user-specified value being set after the on_modify handler has run.
Fixes GH-17951
Closes GH-19963
* PHP-8.5:
PHP 8.5 | UPGRADING: fix entry about new grapheme $locale parameter (#20239)
uri: Make uri_parser_rfc3986.h usable for external extensions (#20173)
Fix missing deprecation message for default case statement followed by semicolon (#20172)
Since the ini message handlers already check for basedir, we need to
drop the basedir check from ini_set. Then we also fix the exceptional
case for the empty string: it should bypass the basedir check.
Furthermore, there was a regression introduced with the error_log
"syslog" check in ddfe269a (inverted check), so we fix that as well.
Closes GH-19487
* main: Ignore `register_argc_argv` when `SG(request_info).argc` is available
* sapi: Remove hardcoded `register_argc_argv` for CLI SAPIs
This INI is ignored since the previous commit, which makes the hardcoded
setting obsolete.
* main: Deprecate deriving $_SERVER['argc'] and $_SERVER['argv'] from the query string
RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_the_register_argc_argv_ini_directive
* main: Adjust deprecation message for `register_argc_argv`
* NEWS/UPGRADING
Ilija Tovilo