forked from php/php-src
-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathNEWS
1888 lines (1534 loc) · 69 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP 8.3.21
- GD:
. Fixed imagecrop() overflow with rect argument with x/width y/heigh usage
in gdImageCrop(). (David Carlier)
- Standard:
. Fixed bug GH-18145 (php8ts crashes in php_clear_stat_cache()).
(Jakub Zelenka)
10 Apr 2025, PHP 8.3.20
- Core:
. Fixed bug GH-17961 (use-after-free during dl()'ed module class destruction).
(Arnaud)
. Fixed bug GH-15367 (dl() of module with aliased class crashes in shutdown).
(Arnaud)
. Fixed bug GH-13193 again (Significant performance degradation in 'foreach').
(nielsdos)
- DOM:
. Fix weird unpack behaviour in DOM. (nielsdos)
. Fix xinclude destruction of live attributes. (nielsdos)
- Embed:
. Fixed bug GH-8533 (Unable to link dynamic libphp on Mac). (Kévin Dunglas)
- Fuzzer:
. Fixed bug GH-18081 (Memory leaks in error paths of fuzzer SAPI).
(Lung-Alexandra)
- GD:
. Fixed bug GH-17984 (calls with arguments as array with references).
(David Carlier)
- Intl:
. Fix locale_compose and locale_lookup to work with their array argument
with values as references. (David Carlier)
. Fix dateformat_format when the time is an array of references.
(David Carlier)
. Fix UConverter::transcode with substitutes as references. (David Carlier)
- Mbstring:
. Fixed bug GH-17989 (mb_output_handler crash with unset
http_output_conv_mimetypes). (nielsdos)
- Opcache:
. Fixed bug GH-18112 (NULL access with preloading and INI option). (nielsdos)
. Fixed bug GH-18107 (Opcache CFG jmp optimization with try-finally breaks
the exception table). (nielsdos)
- PDO:
. Fix memory leak when destroying PDORow. (nielsdos)
- SOAP:
. Fixed bug #66049 (Typemap can break parsing in parse_packet_soap leading to
a segfault) . (Remi)
- SPL:
. Fixed bug GH-18018 (RC1 data returned from offsetGet causes UAF in
ArrayObject). (nielsdos)
- Treewide:
. Fixed bug GH-17736 (Assertion failure zend_reference_destroy()). (nielsdos)
- Windows:
. Fixed bug GH-17836 (zend_vm_gen.php shouldn't break on Windows line
endings). (DanielEScherzer)
13 Mar 2025, PHP 8.3.19
- BCMath:
. Fixed bug GH-17398 (bcmul memory leak). (SakiTakamachi)
- Core:
. Fixed bug GH-17623 (Broken stack overflow detection for variable
compilation). (ilutov)
. Fixed bug GH-17618 (UnhandledMatchError does not take
zend.exception_ignore_args=1 into account). (timwolla)
. Fix fallback paths in fast_long_{add,sub}_function. (nielsdos)
. Fixed bug GH-17718 (Calling static methods on an interface that has
`__callStatic` is allowed). (timwolla)
. Fixed bug GH-17797 (zend_test_compile_string crash on invalid
script path). (David Carlier)
. Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown
causes Use-After-Free). (CVE-2024-11235) (ilutov)
- DOM:
. Fixed bug GH-17847 (xinclude destroys live node). (nielsdos)
- FFI:
. Fix FFI Parsing of Pointer Declaration Lists. (davnotdev)
- FPM:
. Fixed bug GH-17643 (FPM with httpd ProxyPass encoded PATH_INFO env).
(Jakub Zelenka)
- GD:
. Fixed bug GH-17772 (imagepalettetotruecolor crash with memory_limit=2M).
(David Carlier)
- LDAP:
. Fixed bug GH-17704 (ldap_search fails when $attributes contains a
non-packed array with numerical keys). (nielsdos, 7u83)
- LibXML:
. Fixed GHSA-wg4p-4hqh-c3g9 (Reocurrence of #72714). (nielsdos)
. Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header
when requesting a redirected resource). (CVE-2025-1219) (timwolla)
- MBString:
. Fixed bug GH-17503 (Undefined float conversion in mb_convert_variables).
(cmb)
- Opcache:
. Fixed bug GH-17654 (Multiple classes using same trait causes function
JIT crash). (nielsdos)
. Fixed bug GH-17577 (JIT packed type guard crash). (nielsdos, Dmitry)
. Fixed bug GH-17899 (zend_test_compile_string with invalid path
when opcache is enabled). (David Carlier)
. Fixed bug GH-17868 (Cannot allocate memory with tracing JIT). (nielsdos)
- PDO_SQLite:
. Fixed GH-17837 ()::getColumnMeta() on unexecuted statement segfaults).
(cmb)
. Fix cycle leak in sqlite3 setAuthorizer(). (nielsdos)
- Phar:
. Fixed bug GH-17808: PharFileInfo refcount bug. (nielsdos)
- PHPDBG:
. Partially fixed bug GH-17387 (Trivial crash in phpdbg lexer). (nielsdos)
. Fix memory leak in phpdbg calling registered function. (nielsdos)
- Reflection:
. Fixed bug GH-15902 (Core dumped in ext/reflection/php_reflection.c).
(DanielEScherzer)
- Sockets:
. Fixed bug GH-17921 (socket_read/socket_recv overflow on buffer size).
(David Carlier)
- Standard:
. Fixed bug #72666 (stat cache clearing inconsistent between file:// paths
and plain paths). (Jakub Zelenka)
- Streams:
. Fixed bug GH-17650 (realloc with size 0 in user_filters.c). (nielsdos)
. Fix memory leak on overflow in _php_stream_scandir(). (nielsdos)
. Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit
basic auth header). (CVE-2025-1736) (Jakub Zelenka)
. Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location
to 1024 bytes). (CVE-2025-1861) (Jakub Zelenka)
. Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers
without colon). (CVE-2025-1734) (Jakub Zelenka)
. Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not
handle folded headers). (CVE-2025-1217) (Jakub Zelenka)
- Windows:
. Fixed phpize for Windows 11 (24H2). (bwoebi)
. Fixed GH-17855 (CURL_STATICLIB flag set even if linked with shared lib).
(cmb)
- Zlib:
. Fixed bug GH-17745 (zlib extension incorrectly handles object arguments).
(nielsdos)
. Fix memory leak when encoding check fails. (nielsdos)
. Fix zlib support for large files. (nielsdos)
13 Feb 2025, PHP 8.3.17
- Core:
. Fixed bug GH-16892 (ini_parse_quantity() fails to parse inputs starting
with 0x0b). (nielsdos)
. Fixed bug GH-16886 (ini_parse_quantity() fails to emit warning for 0x+0).
(nielsdos)
. Fixed bug GH-17214 (Relax final+private warning for trait methods with
inherited final). (ilutov)
. Fixed NULL arithmetic during system program execution on Windows. (cmb,
nielsdos)
. Fixed potential OOB when checking for trailing spaces on Windows. (cmb)
. Fixed bug GH-17408 (Assertion failure Zend/zend_exceptions.c).
(nielsdos, ilutov)
. Fix may_have_extra_named_args flag for ZEND_AST_UNPACK. (nielsdos)
. Fix NULL arithmetic in System V shared memory emulation for Windows. (cmb)
- DOM:
. Fixed bug GH-17500 (Segfault with requesting nodeName on nameless doctype).
(nielsdos)
- Enchant:
. Fix crashes in enchant when passing null bytes. (nielsdos)
- FTP:
. Fixed bug GH-16800 (ftp functions can abort with EINTR). (nielsdos)
- GD:
. Fixed bug GH-17349 (Tiled truecolor filling looses single color
transparency). (cmb)
. Fixed bug GH-17373 (imagefttext() ignores clipping rect for palette
images). (cmb)
. Ported fix for libgd 223 (gdImageRotateGeneric() does not properly
interpolate). (cmb)
- Intl:
. Fixed bug GH-11874 (intl causing segfault in docker images). (nielsdos)
. Fixed bug GH-17469 (UConverter::transcode always emit E_WARNING on
invalid encoding). (David Carlier)
- Opcache:
. Fixed bug GH-17307 (Internal closure causes JIT failure). (nielsdos)
. Fixed bug GH-17564 (Potential UB when reading from / writing to struct
padding). (ilutov)
- PDO:
. Fixed a memory leak when the GC is used to free a PDOStatment. (Girgias)
. Fixed a crash in the PDO Firebird Statement destructor. (nielsdos)
. Fixed UAFs when changing default fetch class ctor args. (Girgias, nielsdos)
- Phar:
. Fixed bug GH-17518 (offset overflow phar extractTo()). (nielsdos)
- PHPDBG:
. Fix crashes in function registration + test. (nielsdos, Girgias)
- Session:
. Fix type confusion with session SID constant. (nielsdos)
. Fixed bug GH-17541 (ext/session NULL pointer dereferencement during
ID reset). (Girgias)
- SimpleXML:
. Fixed bug GH-17409 (Assertion failure Zend/zend_hash.c:1730). (nielsdos)
- SNMP:
. Fixed bug GH-17330 (SNMP::setSecurity segfault on closed session).
(David Carlier)
- SPL:
. Fixed bug GH-17463 (crash on SplTempFileObject::ftruncate with negative
value). (David Carlier)
- Zip:
. Fixed bug GH-17139 (Fix zip_entry_name() crash on invalid entry).
(nielsdos)
16 Jan 2025, PHP 8.3.16
- Core:
. Fixed bug GH-17106 (ZEND_MATCH_ERROR misoptimization). (ilutov)
. Fixed bug GH-17162 (zend_array_try_init() with dtor can cause engine UAF).
(nielsdos)
. Fixed bug GH-17101 (AST->string does not reproduce constructor property
promotion correctly). (nielsdos)
. Fixed bug GH-17211 (observer segfault on function loaded with dl()).
(Arnaud)
. Fixed bug GH-17216 (Trampoline crash on error). (nielsdos)
- Date:
. Fixed bug GH-14709 DatePeriod::__construct() overflow on recurrences.
(David Carlier)
- DBA:
. Skip test if inifile is disabled. (orlitzky)
- DOM:
. Fixed bug GH-17224 (UAF in importNode). (nielsdos)
- Embed:
. Make build command for program using embed portable. (dunglas)
- FFI:
. Fixed bug #79075 (FFI header parser chokes on comments). (nielsdos)
. Fix memory leak on ZEND_FFI_TYPE_CHAR conversion failure. (nielsdos)
. Fixed bug GH-16013 and bug #80857 (Big endian issues). (Dmitry, nielsdos)
- Filter:
. Fixed bug GH-16944 (Fix filtering special IPv4 and IPv6 ranges, by using
information from RFC 6890). (Derick)
- FPM:
. Fixed bug GH-13437 (FPM: ERROR: scoreboard: failed to lock (already
locked)). (Jakub Zelenka)
. Fixed bug GH-17112 (Macro redefinitions). (cmb, nielsdos)
. Fixed bug GH-17208 (bug64539-status-json-encoding.phpt fail on 32-bits).
(nielsdos)
- GD:
. Fixed bug GH-16255 (Unexpected nan value in ext/gd/libgd/gd_filter.c).
(nielsdos, cmb)
. Ported fix for libgd bug 276 (Sometimes pixels are missing when storing
images as BMPs). (cmb)
- Gettext:
. Fixed bug GH-17202 (Segmentation fault ext/gettext/gettext.c
bindtextdomain()). (Michael Orlitzky)
- Iconv:
. Fixed bug GH-17047 (UAF on iconv filter failure). (nielsdos)
- LDAP:
. Fixed bug GH-17280 (ldap_search() fails when $attributes array has holes).
(nielsdos)
- LibXML:
. Fixed bug GH-17223 (Memory leak in libxml encoding handling). (nielsdos)
- MBString:
. Fixed bug GH-17112 (Macro redefinitions). (nielsdos, cmb)
- Opcache:
. opcache_get_configuration() properly reports jit_prof_threshold. (cmb)
. Fixed bug GH-17246 (GC during SCCP causes segfault). (Dmitry)
- PCNTL:
. Fix memory leak in cleanup code of pcntl_exec() when a non stringable
value is encountered past the first entry. (Girgias)
- PgSql:
. Fixed bug GH-17158 (pg_fetch_result Shows Incorrect ArgumentCountError
Message when Called With 1 Argument). (nielsdos)
. Fixed further ArgumentCountError for calls with flexible
number of arguments. (David Carlier)
- Phar:
. Fixed bug GH-17137 (Segmentation fault ext/phar/phar.c). (nielsdos)
- SimpleXML:
. Fixed bug GH-17040 (SimpleXML's unset can break DOM objects). (nielsdos)
. Fixed bug GH-17153 (SimpleXML crash when using autovivification on
document). (nielsdos)
- Sockets:
. Fixed bug GH-16276 (socket_strerror overflow handling with INT_MIN).
(David Carlier / cmb)
. Fixed overflow on SO_LINGER values setting, strengthening values check
on SO_SNDTIMEO/SO_RCVTIMEO for socket_set_option().
(David Carlier)
- SPL:
. Fixed bug GH-17225 (NULL deref in spl_directory.c). (nielsdos)
- Streams:
. Fixed bug GH-17037 (UAF in user filter when adding existing filter name due
to incorrect error handling). (nielsdos)
. Fixed bug GH-16810 (overflow on fopen HTTP wrapper timeout value).
(David Carlier)
. Fixed bug GH-17067 (glob:// wrapper doesn't cater to CWD for ZTS builds).
(cmb)
- Windows:
. Hardened proc_open() against cmd.exe hijacking. (cmb)
- XML:
. Fixed bug GH-1718 (unreachable program point in zend_hash). (nielsdos)
19 Dec 2024, PHP 8.3.15
- Calendar:
. Fixed jdtogregorian overflow. (David Carlier)
. Fixed cal_to_jd julian_days argument overflow. (David Carlier)
- COM:
. Fixed bug GH-16991 (Getting typeinfo of non DISPATCH variant segfaults).
(cmb)
- Core:
. Fail early in *nix configuration build script. (hakre)
. Fixed bug GH-16727 (Opcache bad signal 139 crash in ZTS bookworm
(frankenphp)). (nielsdos)
. Fixed bug GH-16799 (Assertion failure at Zend/zend_vm_execute.h:7469).
(nielsdos)
. Fixed bug GH-16630 (UAF in lexer with encoding translation and heredocs).
(nielsdos)
. Fix is_zend_ptr() huge block comparison. (nielsdos)
. Fixed potential OOB read in zend_dirname() on Windows. (cmb)
- Curl:
. Fixed bug GH-16802 (open_basedir bypass using curl extension). (nielsdos)
. Fix various memory leaks in curl mime handling. (nielsdos)
- DOM:
. Fixed bug GH-16777 (Calling the constructor again on a DOM object after it
is in a document causes UAF). (nielsdos)
. Fixed bug GH-16906 (Reloading document can cause UAF in iterator).
(nielsdos)
- FPM:
. Fixed GH-16432 (PHP-FPM 8.2 SIGSEGV in fpm_get_status). (Jakub Zelenka)
- GD:
. Fixed GH-16776 (imagecreatefromstring overflow). (David Carlier)
- GMP:
. Fixed bug GH-16890 (array_sum() with GMP can loose precision (LLP64)).
(cmb)
- Hash:
. Fixed GH-16711: Segfault in mhash(). (Girgias)
- Opcache:
. Fixed bug GH-16770 (Tracing JIT type mismatch when returning UNDEF).
(nielsdos, Dmitry)
. Fixed bug GH-16851 (JIT_G(enabled) not set correctly on other threads).
(dktapps)
. Fixed bug GH-16902 (Set of opcache tests fail zts+aarch64). (nielsdos)
- OpenSSL:
. Prevent unexpected array entry conversion when reading key. (nielsdos)
. Fix various memory leaks related to openssl exports. (nielsdos)
. Fix memory leak in php_openssl_pkey_from_zval(). (nielsdos)
- PDO:
. Fixed memory leak of `setFetchMode()`. (SakiTakamachi)
- Phar:
. Fixed bug GH-16695 (phar:// tar parser and zero-length file header blocks).
(nielsdos, Hans Krentel)
- PHPDBG:
. Fixed bug GH-15208 (Segfault with breakpoint map and phpdbg_clear()).
(nielsdos)
- SAPI:
. Fixed bug GH-16998 (UBSAN warning in rfc1867). (nielsdos)
- SimpleXML:
. Fixed bug GH-16808 (Segmentation fault in RecursiveIteratorIterator
->current() with a xml element input). (nielsdos)
- SOAP:
. Fix make check being invoked in ext/soap. (Ma27)
- Standard:
. Fixed bug GH-16905 (Internal iterator functions can't handle UNDEF
properties). (nielsdos)
. Fixed bug GH-16957 (Assertion failure in array_shift with
self-referencing array). (nielsdos)
- Streams:
. Fixed network connect poll interuption handling. (Jakub Zelenka)
- Windows:
. Fixed bug GH-16849 (Error dialog causes process to hang). (cmb)
21 Nov 2024, PHP 8.3.14
- CLI:
. Fixed bug GH-16373 (Shebang is not skipped for router script in cli-server
started through shebang). (ilutov)
. Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data
Processing in CLI SAPI Interface). (nielsdos)
- COM:
. Fixed out of bound writes to SafeArray data. (cmb)
- Core:
. Fixed bug GH-16168 (php 8.1 and earlier crash immediately when compiled
with Xcode 16 clang on macOS 15). (nielsdos)
. Fixed bug GH-16371 (Assertion failure in Zend/zend_weakrefs.c:646). (Arnaud)
. Fixed bug GH-16515 (Incorrect propagation of ZEND_ACC_RETURN_REFERENCE for
call trampoline). (ilutov)
. Fixed bug GH-16509 (Incorrect line number in function redeclaration error).
(ilutov)
. Fixed bug GH-16508 (Incorrect line number in inheritance errors of delayed
early bound classes). (ilutov)
. Fixed bug GH-16648 (Use-after-free during array sorting). (ilutov)
. Fixed bug GH-15915 (overflow with a high value for precision INI).
(David Carlier / cmb)
- Curl:
. Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if
curl_multi_add_handle fails). (timwolla)
- Date:
. Fixed bug GH-16454 (Unhandled INF in date_sunset() with tiny $utcOffset).
(cmb)
. Fixed bug GH-14732 (date_sun_info() fails for non-finite values). (cmb)
- DBA:
. Fixed bug GH-16390 (dba_open() can segfault for "pathless" streams). (cmb)
- DOM:
. Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
(nielsdos)
. Add missing hierarchy checks to replaceChild. (nielsdos)
. Fixed bug GH-16336 (Attribute intern document mismanagement). (nielsdos)
. Fixed bug GH-16338 (Null-dereference in ext/dom/node.c). (nielsdos)
. Fixed bug GH-16473 (dom_import_simplexml stub is wrong). (nielsdos)
. Fixed bug GH-16533 (Segfault when adding attribute to parent that is not
an element). (nielsdos)
. Fixed bug GH-16535 (UAF when using document as a child). (nielsdos)
. Fixed bug GH-16593 (Assertion failure in DOM->replaceChild). (nielsdos)
. Fixed bug GH-16595 (Another UAF in DOM -> cloneNode). (nielsdos)
- EXIF:
. Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a
real file). (nielsdos, cmb)
- FFI:
. Fixed bug GH-16397 (Segmentation fault when comparing FFI object).
(nielsdos)
- Filter:
. Fixed bug GH-16523 (FILTER_FLAG_HOSTNAME accepts ending hyphen). (cmb)
- FPM:
. Fixed bug GH-16628 (FPM logs are getting corrupted with this log
statement). (nielsdos)
- GD:
. Fixed bug GH-16334 (imageaffine overflow on matrix elements).
(David Carlier)
. Fixed bug GH-16427 (Unchecked libavif return values). (cmb)
. Fixed bug GH-16559 (UBSan abort in ext/gd/libgd/gd_interpolation.c:1007).
(nielsdos)
- GMP:
. Fixed floating point exception bug with gmp_pow when using
large exposant values. (David Carlier).
. Fixed bug GH-16411 (gmp_export() can cause overflow). (cmb)
. Fixed bug GH-16501 (gmp_random_bits() can cause overflow).
(David Carlier)
. Fixed gmp_pow() overflow bug with large base/exponents.
(David Carlier)
. Fixed segfaults and other issues related to operator overloading with
GMP objects. (Girgias)
- LDAP:
. Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932)
(nielsdos)
- MBstring:
. Fixed bug GH-16361 (mb_substr overflow on start/length arguments).
(David Carlier)
- MySQLnd:
. Fixed bug GHSA-h35g-vwh6-m678 (Leak partial content of the heap through
heap buffer over-read). (CVE-2024-8929) (Jakub Zelenka)
- Opcache:
. Fixed bug GH-16408 (Array to string conversion warning emitted in
optimizer). (ilutov)
- OpenSSL:
. Fixed bug GH-16357 (openssl may modify member types of certificate arrays).
(cmb)
. Fixed bug GH-16433 (Large values for openssl_csr_sign() $days overflow).
(cmb)
. Fix various memory leaks on error conditions in openssl_x509_parse().
(nielsdos)
- PDO DBLIB:
. Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing
OOB writes). (CVE-2024-11236) (nielsdos)
- PDO Firebird:
. Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter
causing OOB writes). (CVE-2024-11236) (nielsdos)
- PDO ODBC:
. Fixed bug GH-16450 (PDO_ODBC can inject garbage into field values). (cmb)
- Phar:
. Fixed bug GH-16406 (Assertion failure in ext/phar/phar.c:2808). (nielsdos)
- PHPDBG:
. Fixed bug GH-16174 (Empty string is an invalid expression for ev). (cmb)
- Reflection:
. Fixed bug GH-16601 (Memory leak in Reflection constructors). (nielsdos)
- Session:
. Fixed bug GH-16385 (Unexpected null returned by session_set_cookie_params).
(nielsdos)
. Fixed bug GH-16290 (overflow on cookie_lifetime ini value).
(David Carlier)
- SOAP:
. Fixed bug GH-16318 (Recursive array segfaults soap encoding). (nielsdos)
. Fixed bug GH-16429 (Segmentation fault access null pointer in SoapClient).
(nielsdos)
- Sockets:
. Fixed bug with overflow socket_recvfrom $length argument. (David Carlier)
- SPL:
. Fixed bug GH-16337 (Use-after-free in SplHeap). (nielsdos)
. Fixed bug GH-16464 (Use-after-free in SplDoublyLinkedList::offsetSet()).
(ilutov)
. Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()). (ilutov)
. Fixed bug GH-16478 (Use-after-free in SplFixedArray::unset()). (ilutov)
. Fixed bug GH-16588 (UAF in Observer->serialize). (nielsdos)
. Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed
SplFileObject::__constructor). (Girgias)
. Fixed bug GH-16589 (UAF in SplDoublyLinked->serialize()). (nielsdos)
. Fixed bug GH-14687 (segfault on SplObjectIterator instance).
(David Carlier)
. Fixed bug GH-16604 (Memory leaks in SPL constructors). (nielsdos)
. Fixed bug GH-16646 (UAF in ArrayObject::unset() and
ArrayObject::exchangeArray()). (ilutov)
- Standard:
. Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with
bail enabled). (ilutov)
- Streams:
. Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context
might allow for CRLF injection in URIs). (CVE-2024-11234) (Jakub Zelenka)
. Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with
convert.quoted-printable-decode filter). (CVE-2024-11233) (nielsdos)
- SysVMsg:
. Fixed bug GH-16592 (msg_send() crashes when a type does not properly
serialized). (David Carlier / cmb)
- SysVShm:
. Fixed bug GH-16591 (Assertion error in shm_put_var). (nielsdos, cmb)
- XMLReader:
. Fixed bug GH-16292 (Segmentation fault in ext/xmlreader/php_xmlreader.c).
(nielsdos)
- Zlib:
. Fixed bug GH-16326 (Memory management is broken for bad dictionaries.)
(cmb)
24 Oct 2024, PHP 8.3.13
- Calendar:
. Fixed GH-16240: jdtounix overflow on argument value. (David Carlier)
. Fixed GH-16241: easter_days/easter_date overflow on year argument.
(David Carlier)
. Fixed GH-16263: jddayofweek overflow. (cmb)
. Fixed GH-16234: jewishtojd overflow. (nielsdos)
- CLI:
. Fixed bug GH-16137: duplicate http headers when set several times by
the client. (David Carlier)
- Core:
. Fixed bug GH-16054 (Segmentation fault when resizing hash table iterator
list while adding). (nielsdos)
. Fixed bug GH-15905 (Assertion failure for TRACK_VARS_SERVER). (cmb)
. Fixed bug GH-15907 (Failed assertion when promoting Serialize deprecation to
exception). (ilutov)
. Fixed bug GH-15851 (Segfault when printing backtrace during cleanup of
nested generator frame). (ilutov)
. Fixed bug GH-15866 (Core dumped in Zend/zend_generators.c). (Arnaud)
. Fixed bug GH-16188 (Assertion failure in Zend/zend_exceptions.c). (Arnaud)
. Fixed bug GH-16233 (Observer segfault when calling user function in
internal function via trampoline). (nielsdos)
- DOM:
. Fixed bug GH-16039 (Segmentation fault (access null pointer) in
ext/dom/parentnode/tree.c). (nielsdos)
. Fixed bug GH-16149 (Null pointer dereference in
DOMElement->getAttributeNames()). (nielsdos)
. Fixed bug GH-16151 (Assertion failure in ext/dom/parentnode/tree.c).
(nielsdos)
. Fixed bug GH-16150 (Use after free in php_dom.c). (nielsdos)
. Fixed bug GH-16152 (Memory leak in DOMProcessingInstruction/DOMDocument).
(nielsdos)
- JSON:
. Fixed bug GH-15168 (stack overflow in json_encode()). (nielsdos)
- GD:
. Fixed bug GH-16232 (bitshift overflow on wbmp file content reading /
fix backport from upstream). (David Carlier)
. Fixed bug GH-12264 (overflow/underflow on imagerotate degrees value)
(David Carlier)
. Fixed bug GH-16274 (imagescale underflow on RBG channels /
fix backport from upstream). (David Carlier)
- LDAP:
. Fixed bug GH-16032 (Various NULL pointer dereferencements in
ldap_modify_batch()). (Girgias)
. Fixed bug GH-16101 (Segfault in ldap_list(), ldap_read(), and ldap_search()
when LDAPs array is not a list). (Girgias)
. Fix GH-16132 (php_ldap_do_modify() attempts to free pointer not allocated
by ZMM.). (Girgias)
. Fix GH-16136 (Memory leak in php_ldap_do_modify() when entry is not a
proper dictionary). (Girgias)
- MBString:
. Fixed bug GH-16261 (Reference invariant broken in mb_convert_variables()).
(nielsdos)
- OpenSSL:
. Fixed stub for openssl_csr_new. (Jakub Zelenka)
- PCRE:
. Fixed bug GH-16189 (underflow on offset argument). (David Carlier)
. Fixed bug GH-16184 (UBSan address overflowed in ext/pcre/php_pcre.c).
(nielsdos)
- PHPDBG:
. Fixed bug GH-15901 (phpdbg: Assertion failure on i funcs). (cmb)
. Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).
(cmb)
- Reflection:
. Fixed bug GH-16187 (Assertion failure in ext/reflection/php_reflection.c).
(DanielEScherzer)
- SAPI:
. Fixed bug GH-15395 (php-fpm: zend_mm_heap corrupted with cgi-fcgi request).
(Jakub Zelenka, David Carlier)
- SimpleXML:
. Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).
(nielsdos)
- Sockets:
. Fixed bug GH-16267 (socket_strerror overflow on errno argument).
(David Carlier)
- SOAP:
. Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP
headers in array form). (nielsdos)
. Fixed bug #62900 (Wrong namespace on xsd import error message). (nielsdos)
. Fixed bug GH-15711 (SoapClient can't convert BackedEnum to scalar value).
(nielsdos)
. Fixed bug GH-16237 (Segmentation fault when cloning SoapServer). (nielsdos)
. Fix Soap leaking http_msg on error. (nielsdos)
. Fixed bug GH-16256 (Assertion failure in ext/soap/php_encoding.c:460).
(nielsdos)
. Fixed bug GH-16259 (Soap segfault when classmap instantiation fails).
(nielsdos)
- SPL:
. Fixed bug GH-15918 (Assertion failure in ext/spl/spl_fixedarray.c).
(nielsdos)
- Standard:
. Fixed bug GH-16053 (Assertion failure in Zend/zend_hash.c). (Arnaud)
. Fixed bug GH-15169 (stack overflow when var serialization in
ext/standard/var). (nielsdos)
- Streams:
. Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).
(nielsdos)
. Fixed bug GH-15980 (Signed integer overflow in main/streams/streams.c).
(cmb)
- TSRM:
. Prevent closing of unrelated handles. (cmb)
- Windows:
. Fixed minimal Windows version. (cmb)
26 Sep 2024, PHP 8.3.12
- CGI:
. Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection
Vulnerability). (CVE-2024-8926) (nielsdos)
. Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is
bypassable due to the environment variable collision). (CVE-2024-8927)
(nielsdos)
- Core:
. Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
(zeriyoshi)
. Fixed bug GH-15515 (Configure error grep illegal option q). (Peter Kokot)
. Fixed bug GH-15514 (Configure error: genif.sh: syntax error). (Peter Kokot)
. Fixed bug GH-15565 (--disable-ipv6 during compilation produces error
EAI_SYSTEM not found). (nielsdos)
. Fixed bug GH-15587 (CRC32 API build error on arm 32-bit).
(Bernd Kuhls, Thomas Petazzoni)
. Fixed bug GH-15330 (Do not scan generator frames more than once). (Arnaud)
. Fixed uninitialized lineno in constant AST of internal enums. (ilutov)
- Curl:
. FIxed bug GH-15547 (curl_multi_select overflow on timeout argument).
(David Carlier)
- DOM:
. Fixed bug GH-15551 (Segmentation fault (access null pointer) in
ext/dom/xml_common.h). (nielsdos)
. Fixed bug GH-15654 (Signed integer overflow in ext/dom/nodelist.c).
(nielsdos)
- Fileinfo:
. Fixed bug GH-15752 (Incorrect error message for finfo_file
with an empty filename argument). (DanielEScherzer)
- FPM:
. Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered).
(CVE-2024-9026) (Jakub Zelenka)
- MySQLnd:
. Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb,
Kamil Tekiela)
- Opcache:
. Fixed bug GH-15661 (Access null pointer in
Zend/Optimizer/zend_inference.c). (nielsdos)
. Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
(nielsdos)
- SAPI:
. Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data).
(CVE-2024-8925) (Arnaud)
- Standard:
. Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c). (cmb)
- Streams:
. Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
(cmb)
29 Aug 2024, PHP 8.3.11
- Core:
. Fixed bug GH-15020 (Memory leak in Zend/Optimizer/escape_analysis.c).
(nielsdos)
. Fixed bug GH-15023 (Memory leak in Zend/zend_ini.c). (nielsdos)
. Fixed bug GH-13330 (Append -Wno-implicit-fallthrough flag conditionally).
(Peter Kokot)
. Fix uninitialized memory in network.c. (nielsdos)
. Fixed bug GH-15108 (Segfault when destroying generator during shutdown).
(Arnaud)
. Fixed bug GH-15275 (Crash during GC of suspended generator delegate).
(Arnaud)
- Curl:
. Fixed case when curl_error returns an empty string.
(David Carlier)
- DOM:
. Fix UAF when removing doctype and using foreach iteration. (nielsdos)
- FFI:
. Fixed bug GH-14286 (ffi enum type (when enum has no name) make memory
leak). (nielsdos, dstogov)
- Hash:
. Fix crash when converting array data for array in shm in xxh3. (nielsdos)
- Intl:
. Fixed bug GH-15087 (IntlChar::foldCase()'s $option is not optional). (cmb)
- Opcache:
. Fixed bug GH-13817 (Segmentation fault for enabled observers after pass 4).
(Bob)
. Fixed bug GH-13775 (Memory leak possibly related to opcache SHM placement).
(Arnaud, nielsdos)
- Output:
. Fixed bug GH-15179 (Segmentation fault (null pointer dereference) in
ext/standard/url_scanner_ex.re). (nielsdos)
- PDO_Firebird:
. Fix bogus fallthrough path in firebird_handle_get_attribute(). (nielsdos)
- PHPDBG:
. Fixed bug GH-13199 (EOF emits redundant prompt in phpdbg local console mode
with libedit/readline). (Peter Kokot)
. Fixed bug GH-15268 (heap buffer overflow in phpdbg
(zend_hash_num_elements() Zend/zend_hash.h)). (nielsdos)
. Fixed bug GH-15210 use-after-free on watchpoint allocations. (nielsdos)
- Random:
. Fixed part of bug GH-15381, checking getrandom availability on solaris.
(David Carlier)
- Soap:
. Fixed bug #55639 (Digest autentication dont work). (nielsdos)
. Fix SoapFault property destruction. (nielsdos)
. Fixed bug GH-15252 (SOAP XML broken since PHP 8.3.9 when using classmap
constructor option). (nielsdos)
- Standard:
. Fix passing non-finite timeout values in stream functions. (nielsdos)
. Fixed GH-14780 p(f)sockopen timeout overflow. (David Carlier)
. Fixed GH-15653 overflow on fgetcsv length parameter. (David Carlier)
- Streams:
. Fixed bug GH-15028 (Memory leak in ext/phar/stream.c). (nielsdos)
. Fixed bug GH-15034 (Integer overflow on stream_notification_callback
byte_max parameter with files bigger than 2GB). (nielsdos)
. Reverted fix for GH-14930 (Custom stream wrapper dir_readdir output
truncated to 255 characters). (Jakub Zelenka)
- Tidy:
. Fix memory leaks in ext/tidy basedir restriction code. (nielsdos)
01 Aug 2024, PHP 8.3.10
- Core:
. Fixed bug GH-13922 (Fixed support for systems with
sysconf(_SC_GETPW_R_SIZE_MAX) == -1). (Arnaud)
. Fixed bug GH-14626 (Fix is_zend_ptr() for huge blocks). (Arnaud)
. Fixed bug GH-14590 (Memory leak in FPM test gh13563-conf-bool-env.phpt.
(nielsdos)
. Fixed OSS-Fuzz #69765. (nielsdos)
. Fixed bug GH-14741 (Segmentation fault in Zend/zend_types.h). (nielsdos)
. Fixed bug GH-14969 (Use-after-free in property coercion with __toString()).
(ilutov)
. Fixed bug GH-14961 (Comment between -> and keyword results in parse error).
(ilutov)
- Dom:
. Fixed bug GH-14702 (DOMDocument::xinclude() crash). (nielsdos)
- Fileinfo:
. Fixed bug GH-14888 (README.REDIST.BINS refers to non-existing LICENSE).
(cmb)
- Gd:
. ext/gd/tests/gh10614.phpt: skip if no PNG support. (orlitzky)
. restored warning instead of fata error. (dryabov)
- LibXML:
. Fixed bug GH-14563 (Build failure with libxml2 v2.13.0). (nielsdos)
- Opcache:
. Fixed bug GH-14550 (No warning message when Zend DTrace is enabled that
opcache.jit is implictly disabled). (nielsdos)
- Output:
. Fixed bug GH-14808 (Unexpected null pointer in Zend/zend_string.h with
empty output buffer). (nielsdos)
- PDO:
. Fixed bug GH-14712 (Crash with PDORow access to null property).
(David Carlier)
- Phar:
. Fixed bug GH-14603 (null string from zip entry).
(David Carlier)
- PHPDBG:
. Fixed bug GH-14596 (crashes with ASAN and ZEND_RC_DEBUG=1).
(David Carlier)
. Fixed bug GH-14553 (echo output trimmed at NULL byte). (nielsdos)
- Shmop:
. Fixed bug GH-14537 (shmop Windows 11 crashes the process). (nielsdos)
- SPL:
. Fixed bug GH-14639 (Member access within null pointer in
ext/spl/spl_observer.c). (nielsdos)
- Standard:
. Fixed bug GH-14775 (range function overflow with negative step argument).
(David Carlier)
. Fix 32-bit wordwrap test failures. (orlitzky)
. Fixed bug GH-14774 (time_sleep_until overflow). (David Carlier)
- Streams:
. Fixed bug GH-14930 (Custom stream wrapper dir_readdir output truncated to
255 characters in PHP 8.3). (Joe Cai)
- Tidy:
. Fix memory leak in tidy_repair_file(). (nielsdos)
- Treewide:
. Fix compatibility with libxml2 2.13.2. (nielsdos)
- XML:
. Move away from to-be-deprecated libxml fields. (nielsdos)
. Fixed bug GH-14834 (Error installing PHP when --with-pear is used).
(nielsdos)
04 Jul 2024, PHP 8.3.9
- Core:
. Fixed bug GH-14315 (Incompatible pointer type warnings). (Peter Kokot)
. Fixed bug GH-12814 (max_execution_time reached too early on MacOS 14
when running on Apple Silicon). (Manuel Kress)
. Fixed bug GH-14387 (Crash when stack walking in destructor of yielded from
values during Generator->throw()). (Bob)
. Fixed bug GH-14456 (Attempting to initialize class with private constructor
calls destructor). (Girgias)
. Fixed bug GH-14510 (memleak due to missing pthread_attr_destroy()-call).
(Florian Engelhardt)
. Fixed bug GH-14549 (Incompatible function pointer type for fclose).
(Ryan Carsten Schmidt)
- BCMath:
. Fixed bug (bcpowmod() with mod = -1 returns 1 when it must be 0). (Girgias)
- Curl:
. Fixed bug GH-14307 (Test curl_basic_024 fails with curl 8.8.0). (nielsdos)
- DOM:
. Fixed bug GH-14343 (Memory leak in xml and dom). (nielsdos)
- FPM:
. Fixed bug GH-14037 (PHP-FPM ping.path and ping.response config vars are
ignored in status pool). (Wilhansen Li, Pierrick Charron)
- GD:
. Fix parameter numbers for imagecolorset(). (Giovanni Giacobbi)
- Intl:
. Fix reference handling in SpoofChecker. (nielsdos)