5 people 31c0ea7d7f Avoid state corruption via bailout ...

- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup

Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)

Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Jakub Zelenka <bukka@php.net>
Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>

2026-10-18 19:23:46 +02:00

..

tests

Avoid state corruption via bailout

2026-10-18 19:23:46 +02:00

config.m4

Add date extension to dependencies (#15475)

2024-08-18 16:47:57 +02:00

config.w32

Add date extension to dependencies (#15475)

2024-08-18 16:47:57 +02:00

CREDITS

…

mod_files.bat

Remove forgotten obsolete session INI directives (#14238)

2024-05-15 17:01:15 +02:00

mod_files.c

Merge branch 'PHP-8.2' into PHP-8.3

2024-04-20 17:11:33 +01:00

mod_files.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

mod_files.sh

Update http links to https and sync www.php.net URLs (#14854)

2024-07-07 04:23:08 +02:00

mod_mm.c

Merge branch 'PHP-8.4' into PHP-8.5

2026-08-05 10:26:02 +02:00

mod_mm.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

mod_user_class.c

Merge branch 'PHP-8.4' into PHP-8.5

2026-08-18 22:58:31 +02:00

mod_user.c

ext/session: Preserve exceptions thrown by create_sid()

2026-09-23 12:21:26 -04:00

mod_user.h

Update http->https in license (#6945)

2021-05-06 12:16:35 +02:00

php_session.h

Avoid state corruption via bailout

2026-10-18 19:23:46 +02:00

session_arginfo.h

Fix registration of internal readonly child classes (#15459)

2024-08-24 12:36:54 +02:00

session.c

Avoid state corruption via bailout

2026-10-18 19:23:46 +02:00

session.stub.php

Refactor session_set_save_handler()

2022-10-22 12:47:34 +01:00