* Remove param argument from php_verror
Now that docref has been knocked out and error_include_args exists,
remove this argument. Callers will be updated accordingly.
* Remove param from exif
* Remove param from snmp (no changes for tests needed)
* Remove param from gd (no changes for tests needed)
* Remove param from openssl
* Document param change to php_verror
This reverts commit fa47ae16a1.
On macOS in GitHub Actions, pthread_jit_write_protect_supported_np() returns
false. So, there's really no point in running JIT with it in the first place.
We'll still need to tweak some tests when they explicitly enable the JIT.
The self-signed certificate the FTP test server presents
(ext/ftp/tests/server.inc) was generated in 2016 with a ten-year
validity and expired on 2026-07-23, so ext/ftp/tests and the ftps://
stream tests (ext/standard/tests/streams/opendir-003 and -004) fail the
TLS handshake with "certificate expired" on every branch. Regenerate it
as a self-signed CN=127.0.0.1 certificate that expires 2099-12-31, so
the suite does not silently break again on a ten-year cadence.
The gd 2.4 sync guarded gdkanji.c's 'typedef void *iconv_t' fallback
with HAVE_ICONV_T_DEF, which the bundled build never defined. On
Solaris <iconv.h> declares iconv_t as a struct pointer, so it clashed.
Define HAVE_ICONV_T_DEF when <iconv.h> already provides iconv_t.
mb_find_strpos() converts the haystack and needle to UTF-8 and does the length and offset math on the converted strings.
The negative-offset branch computed the needle length from the raw needle instead of needle_u8.
mb_fast_strlen_utf8() reads those bytes as UTF-8, so the count is wrong whenever they do not decode one to one.
A byte in 0x80-0xBF (ISO-8859-1) undercounts, and a wider encoding such as an ASCII needle in UTF-16 overcounts, so the reverse-search window is shifted.
Use needle_u8, the converted needle the rest of the branch already searches with.
This allows controlling the RSA-PSS salt length and enforcing an expected
salt length when verifying. It also adds OPENSSL_RSA_PSS_SALTLEN_* constants.
This is needed for some application. Custom TLS implementation is one example
Preloading will try to evaluate class constants during compilation but
evaluated FCCs are objects, which can not be persisted. Apply the same fix as
for enums: Fail evaluation when compiling.
Preloading will also reset CG(map_ptr_last) after compilation, which results in
collisions if map ptrs were allocated during compilation. Move the
ZEND_MAP_PTR_NEW() to the persist phase, as a shared map ptr is not necessary
before that.
Fixes GH-22782.
Fixes GH-22763.
The reproducer triggers an assertion failure in `zend_jit_use_reg()` because a var has `jit->ra[var].ref == IR_NULL` but `jit->ra[var].flags` doesn't contain `ZREG_LOAD`.
This happens because of the following events:
* An in-register variable is spilled to the VM stack frame by IR (IR_REG_SPILL_SPECIAL)
* zend_jit_snapshot_handler() set the stack descriptor to .flags = ZREG_TYPE_ONLY, .reg = ZREG_NONE
* During a subsequent call to zend_jit_snapshot_handler(), the reg is not IR_REG_SPILL_SPECIAL anymore, so .reg is set but .flags remains ZREG_TYPE_ONLY which is inconsistent
* A side trace inherits from this stack descriptor
* zend_jit_trace_deoptimization() doesn't set `jit->ra[var].ref` for this var because `.flags == ZREG_TYPE_ONLY`, which causes the assertion failure later
Fix by removing irrelevant flags when setting reg in zend_jit_snapshot_handler().
Fix#22447
xmlHasProp() matches an attribute by local name only, ignoring its
namespace, whereas xmlAddChild()/xmlAddPrevSibling() dedup an incoming
no-namespace attribute via xmlHasNsProp(..., NULL), which matches only
attributes with no namespace. When both a no-namespace and a namespaced
attribute share a local name, the pre-insertion check unlinked the wrong
(namespaced) attribute, leaving libxml to free the still-wrapped
no-namespace duplicate and producing a use-after-free at request
shutdown.
Use xmlHasNsProp(..., NULL) so the pre-insertion check matches libxml's
internal duplicate detection, as advised by @nwellnhof.
Close GH-22452
The argument name in these error messages are different from what is claimed
in the documentation and public signatures.
Updated messages:
- gmp_root() and gmp_rootrem() now refer to argument 1 as $num instead of $a.
- gmp_random_range() now refers to argument 2 as $max instead of $maximum.
Commit 3dcdb9826b routed the user_agent option through a truncate-and-warn
check, but the Content-Type context option, the soapaction and the cookie
names and values reach the same request buffer unchecked, so a CR/LF in any
of them still injects arbitrary request headers.
Emit all of them through that same check. The helper now takes an explicit
length so the char* soapaction can share it.
Close GH-22781
php_filter_encode_url() initialized its 256-byte "must encode" table with
memset(tmp, 1, sizeof(tmp) - 1), leaving tmp[255] uninitialized. Whether
0xFF got percent-encoded then depended on stack garbage; valgrind reports
the read as a conditional jump on an uninitialised value. Initialize the
whole table.
Closes GH-22762
After __isset() returns true on ?? or empty(), re-check the property table
before calling __get(). When __isset() materialised the property (a pattern used
by lazy proxies), its value is returned directly. isset() itself is unchanged.
Fixes GH-12695
There are two OSes in this family: AIX itself, and IBM i PASE, which
provides an AIX syscall emulation environment. uname is different
between them (AIX/OS400).
Cas Ebbers