Commit 2bff391ff13 for php

commit 2bff391ff135990df45ba49182c89207e89a2b19
Merge: fed2b4e17fb 4d303daf07c
Author: Jakub Zelenka <bukka@php.net>
Date:   Tue Oct 27 17:07:16 2026 +0100

    Merge branch 'PHP-8.5' into PHP-8.6

    * PHP-8.5:
      Fix FPM worker output prefix longer than its buffer or log_limit

diff --cc NEWS
index a7cbfe0c7de,94bad1b0eb6..ce102bda180
--- a/NEWS
+++ b/NEWS
@@@ -23,108 -49,10 +23,117 @@@ PH
  - DOM:
    . Fix error paths in dom_xml_serializing_a_document_node(). (ndossche)

+ - FFI:
+   . Fixed bug GH-24582 (Memory leaks in ext/ffi parser when finalize_type()
+     bails out). (matyapiro31, David Carlier)
+
++- FPM:
++  . Fixed crash and stack memory disclosure in the worker output logging with
++    a pool name longer than the message prefix buffer or log_limit.
++    (Martin Mirchev)
++
 +- Hash:
 +  . Fix GOST and Snefru digests of 512 MiB or more. (Martin Mirchev)
 +
 +- Opcache:
 +  . Fixed tracing JIT returning a wrapped integer instead of a float on
 +    integer overflow after an integer was compared with a float or
 +    numeric-string literal. (Ilia Alshanetsky)
 +  . Fixed use-after-free in JIT ASSIGN_DIM_OP when concatenating into an
 +    empty array element. (jorgsowa)
 +  . Fixed bug GH-24396 (Assertion failure in zend_jit_def_reg() "reg forwarding"
 +    with chained Pi nodes). (ndossche)
 +  . Fixed JIT treating an array as packed after a string key write turned it
 +    into a hash. (jorgsowa)
 +  . Fixed bug GH-24436 (Tracing JIT: keep the SEND_VAL type guard after
 +    assigning to a reference). (waroad)
 +  . Fixed bug GH-24745 (File cache loses attributes on constants on 32-bit
 +    builds). (Yannick Decat, Lazizbek Ergashev)
 +  . Fixed bug GH-17733 (System entropy does not take into account function
 +    order, resulting in wrong functions possibly called
 +    in different configurations). (ndossche)
 +  . Fixed bug GH-24438 (Preserve indirect types in JIT side traces). (aasul)
 +  . Fixed bug GH-24577 (CE-cache flag on interned class name visible before
 +    map_ptr offset). (prateekbhujel)
 +  . Fixed tracing JIT losing register-allocated CVs when an interrupt is
 +    handled at the end of a loop trace. (Levi Morrison)
 +
 +- OpenSSL:
 +  . Fixed build with OpenSSL 4.1. (Weilin Du)
 +
 +- PDO_PGSQL:
 +  . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops
 +    PgBouncer's prepared statements). (David Carlier, Artem Ukrainskiy)
 +
 +- Phar:
 +  . Fixed bug GH-24740 (Oversized tar metadata exhausts the memory limit).
 +    (Lazizbek Ergashev)
 +
 +- SAPI:
 +  . Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
 +    (Martin Mirchev)
 +
 +- SPL:
 +  . Fixed bug GH-24264 (Unwind/GracefulExit discarded in spl_iterators.c).
 +    (Lazizbek Ergashev)
 +
 +- Sockets:
 +  . Fixed bug GH-24748 (socket_set_option() crashes with declared object
 +    properties). (Lazizbek Ergashev)
 +
 +- Standard:
 +  . Fixed bug GH-24308 (Request shutdown calls closelog() even when syslog
 +    was not opened by PHP). (lazerg)
 +  . Fixed bug GH-24552 (Case-insensitive substr_compare(), ksort() and
 +    krsort() are still locale-dependent). (Lazizbek Ergashev, Jon Surrell)
 +
 +- Streams:
 +  . Fixed bug GH-24506 (stream_select() leaks a stream-error operation level
 +    on its FD_SETSIZE failure path). (azjezz)
 +  . Fixed bug GH-24508 (HTTP wrapper leaks the dechunk filter when header
 +    parsing fails after Transfer-Encoding). (bercedev)
 +  . Fixed bug GH-24509 (HTTP wrapper leaks Location buffer on empty
 +    Location header). (bercedev)
 +
 +- Zip:
 +  . Reject broken libzip versions 1.3.1, 1.7.0 and 1.12.0 during Windows
 +    configuration. (Weilin Du)
 +  . Excluded libzip 1.12.0 due to a regression preventing additions and
 +    replacements in torrentzip archives. (Weilin Du)
 +
 +- Zlib:
 +  . Fixed bug GH-24533 (zlib.lib could not be found because zlib 1.3.2
 +    CMake build does not emit it). (Lazizbek Ergashev)
 +
 +21 Oct 2026, PHP 8.6.0RC4
 +
 +- Core:
 +  . Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via
 +    bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
 +    ndossche, Nicolas Grekas)
 +  . Fixed bug GH-24184 (System ID not being reinitialized after an Apache
 +    graceful restart, potentially causing incompatible OPcache file cache
 +    entries to be reused). (Levi Morrison)
 +  . Fixed memory leak when an exception already contains the pending exception
 +    in its previous chain. (Edmond)
 +  . Fixed bug GH-23979 (Nullsafe operator must not flush delayed oplines of an
 +    enclosing function). (ndossche)
 +  . Fixed memory manager keeping a block reallocated to exactly the size of
 +    the next smaller bin in its larger bin, which efree_size() then freed
 +    into the wrong one. (Marc Bennewitz)
 +  . Fix throwing behaviour with recursive arrays in VM. (ndossche)
 +  . Fixed skipped catch block when switching fibers during exception unwinding
 +    (Nicolas Grekas)
 +  . Fix escape analysis for objects implementing ArrayAccess. (ndossche, Arnaud)
 +  . Fixed array_map() optimization not resolving the class name of a static
 +    first-class callable. (Claudio Dekker)
 +
 +- Date:
 +  . Fixed bug GH-20503 (Assertion failure with ext/date DateInterval property
 +    hash construction). (heathdutton)
 +  . Fixed bug GH-24350 (MINIT reads a stale external tz database after an
 +    in-process module restart). (Lazizbek Ergashev)
 +
  - Fileinfo:
    . Fixed bug GH-24289 (finfo::file() reports the wrong argument number for
      an invalid $filename). (Lazizbek Ergashev)