Commit 17277c619fb for php
commit 17277c619fbfeb4754722c9464d51d51825ffef0
Merge: 9cd641febca 12b8c58be41
Author: Alexandre Daubois <alex.daubois@gmail.com>
Date: Tue Oct 6 09:11:00 2026 +0200
Merge branch 'PHP-8.6'
* PHP-8.6:
lexbor: Merge upstream WHATWG URL and IDNA fixes
diff --cc NEWS
index 8d0f7c815b6,8b30e7f4d3e..07d329ef5a6
--- a/NEWS
+++ b/NEWS
@@@ -20,10 -63,166 +20,19 @@@ PH
(Ilia Alshanetsky)
- Lexbor:
+ . Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a
+ heap buffer overflow in :lexbor-contains() parsing and buffer overflows
+ in malformed decode replay. (alexandre-daubois)
+ . Merge patches lexbor/lexbor@859f100, lexbor/lexbor@a36e09a,
+ lexbor/lexbor@b0f7412, lexbor/lexbor@1b215a8, lexbor/lexbor@385afff,
+ lexbor/lexbor@e6c068f, lexbor/lexbor@327a8b6, lexbor/lexbor@917742f and
+ lexbor/lexbor@e89c258, fixing dropped usernames containing an at sign,
+ uninitialized memory in IDNA buffer growth, the encoding of a space
+ before a query or fragment in an opaque path, a query or fragment lost
+ after a dot segment in a path, replacement file drive paths, the output
+ encoding used for percent-encoding, the URLSearchParams tail pointer and
+ fragment serialization without a query. (alexandre-daubois)
-- MySQLnd:
- . Fixed field_count not resetting on OK packet. (Kamil Tekiela)
- . Fixed memory leak when closing a prepared statement after its connection
- was killed. (Kamil Tekiela)
-
-- Opcache:
- . Fix zend_analyze_calls() call_stack buffer overrun. (Mrmaxmeier)
- . Fixed bug GH-23679 (Tracing JIT writes a parent private property into a
- child's shadowing public property). (Ilia Alshanetsky)
- . Fix multiple incorrect DCE due to unsound escape analysis. (ndossche,
- arnaud-lb)
- . Fixed bug GH-24063 (OPcache optimizer folds `$cond ? -0.0 : 0.0` into a
- single `-0.0` constant). (lazerg)
- . Fixed crash when a file cache is reused with a different set of
- extensions declaring frameless functions. (Ilia Alshanetsky)
- . Fixed bug GH-23991 (JIT generates invalid IR for multiple recursive calls).
- (ndossche)
- . Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object.
- (ndossche)
-
-- OpenSSL:
- . Fixed stream_socket_enable_crypto() leaving the socket non-blocking
- after a handshake timeout. (Ilia Alshanetsky)
- . Fix memory leak by doing early salt validation. (adapik)
- . Fixed openssl_sign() using the maximum RSA-PSS salt length by default
- instead of the OpenSSL default. (adapik)
- . Fixed feof() on a TLS stream staying false after a close_notify on Windows.
- (Jakub Zelenka)
-
-- PCNTL:
- . Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while
- an exception is pending. (nicolas-grekas)
- . Fixed pcntl_signal_dispatch() dropping the signals queued behind a handler
- that throws. (nicolas-grekas)
- . Fixed bug GH-23986 (/proc/self paths resolve to the parent process after
- pcntl_fork()). (Lazizbek Ergashev)
-
-- PDO:
- . Fixed PDO::setAttribute() installing a PDO::ATTR_STATEMENT_CLASS class
- whose constructor arguments it rejects. (Ilia Alshanetsky)
- . Fixed PDO::ATTR_STATEMENT_CLASS constructor_args type errors reporting
- "array given" regardless of the value passed. (Ilia Alshanetsky)
- . Fixed PDOStatement::bindParam() and bindColumn() leaking the driver
- options value. (Ilia Alshanetsky)
- . Fixed PDOStatement not reporting its bound parameters and columns to the
- cycle collector. (Ilia Alshanetsky)
- . Fixed PDOStatement::setFetchMode() not applying changes atomically.
- (Ilia Alshanetsky)
- . Fixed PDOStatement::execute() leaving the previous result available
- after a failed execution. (Ilia Alshanetsky)
- . Fixed a use-after-free when bindValue()/execute()/closeCursor() is called
- from a bound parameter's __toString() during execute(). (Ilia Alshanetsky)
-
-- PDO_DBLIB:
- . Fixed bug GH-23741 (segfault after a failed query inside a PDO
- transaction). Errors raised by beginTransaction(), commit(), rollBack()
- and lastInsertId() are now reported instead of being dropped.
- (Ilia Alshanetsky)
-
-- PDO_PGSQL:
- . Fixed crash when a persistent connection fails. (KentarouTakeda)
-
-- Reflection:
- . Fixed bug GH-23842 (ReflectionProperty::skipLazyInitialization() copies
- invalid constant defaults with OPcache). (DirkTrunkstar, Lazizbek Ergashev)
-
-- SimpleXML:
- . Fixed reconstructing a SimpleXMLElement freeing a child element that
- another variable still references. (Ilia Alshanetsky)
-
-- SOAP:
- . Fixed bug GH-22895 (Heap use-after-free while encoding a Traversable with
- an illegal key). (David Carlier)
- . Fixed memory leak when load_wsdl_ex() failed to load. (DanielEScherzer)
-
-- Standard:
- . Fixed sha1_file() returning a digest for incomplete data after a stream
- read failure. (Ilia Alshanetsky)
- . Fixed iptcembed() corrupting JPEG headers when called recursively from an
- output handler. (Ilia Alshanetsky)
- . Fixed proc_open() leaking descriptor zero when descriptor setup fails.
- (Ilia Alshanetsky)
- . Fixed StreamPollHandle changing unread_bytes of a TLS stream when it is
- added to an Io\Poll\Context. (Jakub Zelenka)
- . Fix wordwrap() ignoring an existing break at the end of the string
- (Nicolas Grekas)
- . Fixed convert.quoted-printable-decode decoding lowercase hex digits to
- the wrong byte. (Ilia Alshanetsky)
-
-- Tidy:
- . Fixed a use-after-free when a tidyNode is used after its document is
- reparsed. (Ilia Alshanetsky)
-
-- Zip:
- . Fixed bug GH-23899 (Assertion failure when a cancel callback returns an
- invalid type during shutdown). (Weilin Du)
-
-24 Sep 2026, PHP 8.6.0RC2
-
-- Core:
- . Fixed incorrect internal pointer and foreach iterator positions when
- compacting arrays with holes. (Weilin Du)
- . Fix handling of references to typed properties during unserialization
- of various internal classes. (ndossche, timwolla)
- . Fixed OSS-Fuzz 532353396 (assertion failure with static type). (Girgias)
- . Fix GH-23662 (Avoid NAN warning in print_r()). (CodedByManish)
- . Fixed bug GH-23752 (Use scoped diagnostic suppression for the global
- register declarations so the caller's -Wvolatile-register-var state is
- restored). (yqtian-se)
- . Fixed OSS-Fuzz #538730793 (Assertion failure when returning by-ref from
- closure invoke). (ndossche)
- . Fixed OSS-Fuzz #540904105 (ASSERT: ast->attr == T_CLASS_C). (ndossche)
-
-- CLI
- . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during
- request activation). (matyhtf)
- . Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD
- request for a static file). (jakubskopal)
-
-- Date:
- . Fix unserialization of Time\Duration. (timwolla)
- . Add comparison handler for Time\Duration. (timwolla)
-
-- DOM:
- . Fixed use-after-free when re-constructing a DOMXPath whose php:function
- registrations are freed while still reachable from the cycle collector.
- (Ilia Alshanetsky)
- . Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and
- MathML elements. (Ilia Alshanetsky)
- . Fixed Dom\HTMLDocument giving attributes the namespace of their element
- when a fragment is parsed with an xlink, xml or xmlns context element.
- (Ilia Alshanetsky)
-
-- Fileinfo:
- . Upgrade to file 5.48. (Weilin Du)
-
-- Intl:
- . Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state
- such as dateType, timeType, calendar and the message pattern.
- (Ilia Alshanetsky)
- . Fixed a crash when converting with a cloned UConverter that uses
- toUCallback/fromUCallback. (Ilia Alshanetsky)
- . Fixed Collator attribute and strength methods not rejecting an
- unconstructed Collator. (Ilia Alshanetsky)
-
-- Lexbor:
- . Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a
- heap buffer overflow in :lexbor-contains() parsing and buffer overflows
- in malformed decode replay. (alexandre-daubois)
-
- MBString:
. Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in
a truncated UTF-8 sequence). (Lazizbek Ergashev)