Commit 75cdbcd40bc for php.net
commit 75cdbcd40bc840da2d044b7d08b82ea15d670c90
Merge: 0a5edc51c04 6493ea617aa
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date: Sun Jul 12 20:37:47 2026 -0400
Merge branch 'PHP-8.5'
* PHP-8.5:
Fix GH-22678: array_multisort() use-after-free on mutating comparator
diff --cc NEWS
index 9807e07945d,46f23c3aa6d..7105b8d44f5
--- a/NEWS
+++ b/NEWS
@@@ -86,23 -91,23 +86,25 @@@ PH
. Fixed bug GH-21314 (Different session garbage collector behavior between
PHP 8.3 and PHP 8.5). (jorgsowa)
-- SPL:
- . Fix class_parents for classes with leading slash in non-autoload mode.
- (jorgsowa)
- . Ignore leading back-slash in class_parents(), class_implements(), and
- class_uses(). (jorgsowa)
- . Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object
- segfaults). (iliaal)
+- SOAP:
+ . Fixed bug GH-22585 (OOM on bailout with uninitialized
+ do_request() parameters). (David Carlier)
+ . Fixed xsd:hexBinary decoding to reject odd-length values instead of
+ silently truncating the last nibble. (Weilin Du)
- Standard:
- . Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
- (Weilin Du)
+ . Fixed sleep() and usleep() to reject values that overflow the underlying
+ unsigned int timeout. (Weilin Du)
+ . Fixed bug GH-22671 (assert.bail aborts the process when the assert callback
+ throws an exception whose reporting re-throws). (iliaal)
+ . Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator
+ mutates the array being sorted). (azchin, iliaal)
+- Streams:
+ . Fixed bug GH-21468 (Segfault in file_get_contents w/ a https URL
+ and a proxy set). (CVE-2026-12184) (ndossche)
+
- URI:
- . Fixed behavior of Uri\WhatWg\Url wither methods with regards to empty
- opaque hosts. (kocsismate)
. Fixed bug GH-22628 (Percent-encoding of caret in WHATWG URL paths is not
performed). (kocsismate)
. Fixed bug GH-22629 (WHATWG Validation error incorrect with empty host and