Commit f9e04180aef for php.net
commit f9e04180aef042366d2d58df277c93ee434d016f
Merge: 7f3d3de1a28 3aedde06bc3
Author: Jakub Zelenka <bukka@php.net>
Date: Tue Sep 22 10:54:22 2026 +0200
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
ext/soap: make GHSA-cj93-vc83-wgqv test lean and reliable
Add NEWS entries
ext/standard: Fix 1-char relative Location redirects after GH-23467
[http] Fix out-of-bounds read on empty Location header
Fix GHSA-ch8v-r6jh-4vvr: encode 0xFF in FILTER_SANITIZE_ENCODED
Fix GHSA-9f67-6fw4-hpfp
Fix GHSA-j3wh-g957-2m85: phar tar entry injection
Fix GHSA-cj93-vc83-wgqv
Fix GHSA-rgrp-mwpx-f6rm: unbounded recursion in ext/soap XML parsing and decoding
Fix GHSA-fpwc-w8rq-cr92: strip credentials from user headers on cross-origin redirects
Fix GHSA-r6x9-5r99-36j7: Various packet overreads in mysqlnd wireprotocol
Fix GHSA-xr7j-rvgx-xq5p: OOB read in php_openssl_matches_wildcard_name()
Fix GHSA-vvx9-73fr-5jjx: do not fall back to CN if the cert has a service ID
Fix GHSA-62xp-839h-2637: FastCGI allowed_clients compared only 96 bits of IPv6 addresses
Fix heap-buffer-overflow in convert stream filters with NUL in line-break-chars
diff --cc NEWS
index 48d2e208393,91bd9e2da7c..0ba2c03f817
--- a/NEWS
+++ b/NEWS
@@@ -1,9 -1,51 +1,51 @@@
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 8.2.34
+?? ??? ????, PHP 8.3.34
+ - Filter:
+ . Fixed GHSA-ch8v-r6jh-4vvr (FILTER_SANITIZE_ENCODED does not encode 0xFF).
+ (Ilia Alshanetsky)
+
+ - FPM:
+ . Fixed GHSA-62xp-839h-2637 (IPv6 ACL bypass in FastCGI listen.allowed_clients
+ due to partial address comparison). (CVE-2026-91768) (Alexandre Daubois)
+
+ - MySQLnd:
+ . Fixed GHSA-r6x9-5r99-36j7 (Various packet overreads in mysqlnd wire
+ protocol). (CVE-2025-1218) (Jakub Zelenka, Nora Dossche)
+
+ - OpenSSL:
+ . Fixed GHSA-vvx9-73fr-5jjx (TLS hostname verification falls back to CN after
+ SAN mismatch). (CVE-2026-91769) (Jakub Zelenka)
+ . Fixed GHSA-xr7j-rvgx-xq5p (Heap buffer overflow in
+ php_openssl_matches_wildcard_name() on crafted server certificate wildcard
+ CN). (CVE-2026-91767) (Jakub Zelenka)
+
+ - Phar:
+ . Fixed GHSA-j3wh-g957-2m85 (Integer overflow in phar_tar_number() allowing
+ TAR archive entry injection). (CVE-2026-6103) (Jakub Zelenka)
+
+ - SOAP:
+ . Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side
+ cleanup_xml_node()). (CVE-2026-91765) (Alexandre Daubois)
+ . Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP
+ parsing). (CVE-2025-14181) (Nora Dossche, Jakub Zelenka)
+
+ - Standard:
+ . Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert.* stream filters
+ when line-break-chars contains NUL). (CVE-2026-92842) (geeknik)
+ . Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream
+ wrapper redirects). (CVE-2026-91766) (Alexandre Daubois, Jakub Zelenka)
+ . Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper
+ when following a redirect with an empty Location header). (CVE-2026-93682)
+ (Ilia Alshanetsky, Jordi Kroon)
+
+ - Windows:
+ . Fixed GHSA-9f67-6fw4-hpfp (Reserved device names are not rejected before
+ file and stream I/O). (CVE-2026-17545) (Shivam Mathur, Jakub Zelenka)
+
-30 Jul 2026, PHP 8.2.33
+30 Jul 2026, PHP 8.3.33
- Date:
. Fixed leak on double DatePeriod::__construct() call. (ilutov)
diff --cc ext/mysqlnd/mysqlnd_wireprotocol.c
index e37f95b61d9,8f526798e8e..02e59726ed3
--- a/ext/mysqlnd/mysqlnd_wireprotocol.c
+++ b/ext/mysqlnd/mysqlnd_wireprotocol.c
@@@ -337,10 -380,10 +381,10 @@@ php_mysqlnd_greet_read(MYSQLND_CONN_DAT
DBG_ENTER("php_mysqlnd_greet_read");
- if (FAIL == mysqlnd_read_packet_header_and_body(&(packet->header), pfc, vio, stats, error_info, connection_state, buf, sizeof(buf), "greeting", PROT_GREET_PACKET)) {
+ if (FAIL == mysqlnd_read_packet_header_and_body(&(packet->header), pfc, vio, stats, error_info, connection_state, buf, buf_len, "greeting", PROT_GREET_PACKET)) {
DBG_RETURN(FAIL);
}
- BAIL_IF_NO_MORE_DATA;
+ BAIL_IF_NOT_ENOUGH_DATA;
packet->authentication_plugin_data.s = packet->intern_auth_plugin_data;
packet->authentication_plugin_data.l = sizeof(packet->intern_auth_plugin_data);
@@@ -678,8 -728,16 +726,8 @@@ php_mysqlnd_auth_response_read(MYSQLND_
if (FAIL == mysqlnd_read_packet_header_and_body(&(packet->header), pfc, vio, stats, error_info, connection_state, buf, buf_len, "OK", PROT_OK_PACKET)) {
DBG_RETURN(FAIL);
}
- BAIL_IF_NO_MORE_DATA;
+ BAIL_IF_NOT_ENOUGH_DATA;
- /*
- zero-terminate the buffer for safety. We are sure there is place for the \0
- because buf_len is -1 the size of the buffer pointed
- */
- buf[packet->header.size] = '\0';
-
/* Should be always 0x0 or ERROR_MARKER for error */
packet->response_code = uint1korr(p);
p++;
@@@ -2024,13 -2117,13 +2103,13 @@@ php_mysqlnd_sha256_pk_request_response_
DBG_ENTER("php_mysqlnd_sha256_pk_request_response_read");
/* leave space for terminating safety \0 */
- if (FAIL == mysqlnd_read_packet_header_and_body(&(packet->header), pfc, vio, stats, error_info, connection_state, buf, sizeof(buf), "SHA256_PK_REQUEST_RESPONSE", PROT_SHA256_PK_REQUEST_RESPONSE_PACKET)) {
+ if (FAIL == mysqlnd_read_packet_header_and_body(&(packet->header), pfc, vio, stats, error_info, connection_state, buf, buf_len, "SHA256_PK_REQUEST_RESPONSE", PROT_SHA256_PK_REQUEST_RESPONSE_PACKET)) {
DBG_RETURN(FAIL);
}
- BAIL_IF_NO_MORE_DATA;
+ BAIL_IF_NOT_ENOUGH_DATA;
p++;
- BAIL_IF_NO_MORE_DATA;
+ BAIL_IF_NOT_ENOUGH_DATA;
packet->public_key_len = packet->header.size - (p - buf);
packet->public_key = mnd_emalloc(packet->public_key_len + 1);
@@@ -2104,10 -2195,10 +2182,10 @@@ php_mysqlnd_cached_sha2_result_read(MYS
const zend_uchar * const begin = buf;
DBG_ENTER("php_mysqlnd_cached_sha2_result_read");
- if (FAIL == mysqlnd_read_packet_header_and_body(&(packet->header), pfc, vio, stats, error_info, connection_state, buf, sizeof(buf), "PROT_CACHED_SHA2_RESULT_PACKET", PROT_CACHED_SHA2_RESULT_PACKET)) {
+ if (FAIL == mysqlnd_read_packet_header_and_body(&(packet->header), pfc, vio, stats, error_info, connection_state, buf, buf_len, "PROT_CACHED_SHA2_RESULT_PACKET", PROT_CACHED_SHA2_RESULT_PACKET)) {
DBG_RETURN(FAIL);
}
- BAIL_IF_NO_MORE_DATA;
+ BAIL_IF_NOT_ENOUGH_DATA;
packet->response_code = uint1korr(p);
p++;