Commit 9d58ce53a13 for php.net
commit 9d58ce53a131f3a81f4b0e534397360e9638f3df
Merge: b645104e3d4 2806a3637e6
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date: Mon Aug 10 10:23:36 2026 -0400
Merge branch 'PHP-8.5'
* PHP-8.5:
Fix segfault comparing uninitialized SimpleXMLElement instances
diff --cc NEWS
index 2a06febbfa2,ade75459307..1fa28e59084
--- a/NEWS
+++ b/NEWS
@@@ -83,118 -62,31 +83,120 @@@ PH
- SimpleXML:
. Fixed integer element offsets that cannot resolve aliasing an existing
element. (iliaal)
+ . SimpleXMLElement::__construct() now raises a ValueError when the $data
+ argument contains NUL bytes. (iliaal)
+ . Fixed segfault when comparing uninitialized SimpleXMLElement
+ instances. (iliaal)
+- Standard:
+ . Added the "filter.max_filter_count" stream context option for php://filter
+ URLs. Using more than 16 filters without configuring this option is now
+ deprecated. (Sjoerd Langkemper)
+ . Improved performance of array_intersect(). (mehmetcansahin)
+ . Fixed bug GH-23006 (phpcredits() full-page HTML title says phpinfo()).
+ (Weilin Du)
+ . The following functions now raise a ValueError when the $filename argument
+ contains NUL bytes: fileperms(), fileinode(), filesize(), fileowner(),
+ filegroup(), fileatime(), filemtime(), filectime(), filetype(),
+ is_writable(), is_readable(), is_executable(), is_file(), is_dir(),
+ is_link(), file_exists(), lstat(), stat(). (Girgias)
+ . Fixed bug GH-22818 (stream_filter_register() orphaned user_filter_map on
+ shutdown re-registration). (David Carlier)
+ . Io\Poll\Context::wait() now takes a Time\Duration object as a timeout.
+ (timwolla)
+
+30 Jul 2026, PHP 8.6.0alpha3
+
+- Core:
+ . Implemented partial function application RFC. (Arnaud)
+ . Fixed bug GH-22263 (reset typed property default on every unserialize
+ failure path). (David Carlier)
+ . Fixed bug GH-18985 (Wrong line numbers for match with constant arms).
+ (ilutov)
+ . Fixed bug GH-18847 (SEGV in zend_fetch_debug_backtrace() when the memory
+ limit is reached while the tracing JIT enters a call frame). (Arnaud,
+ iliaal)
+
+- DOM:
+ . Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD
+ declares a default value for the attribute). (iliaal)
+ . Fixed bug GH-23120 (Stack overflow when comparing deeply nested DOM nodes
+ with DOMNode::isEqualNode()). (Weilin Du)
+
+- Embed:
+ . Made php-cli functionality available in embed builds. (henderkes)
+
+- GMP:
+ . Added gmp_prevprime(). (Weilin Du, David Carlier)
+ . Fixed GMP power and shift operators to reject GMP right operands outside
+ the unsigned long range instead of silently truncating them. (Weilin Du)
+ . Fixed GMP integer string parsing to reject strings containing NUL bytes
+ instead of silently truncating them. (Weilin Du)
+ . Fixed GMP error messages that referenced outdated parameter names.
+ (Weilin Du)
+
+- Intl:
+ . Fixed grammatical issues in Normalizer invalid form and IntlCalendar time
+ zone offset error messages. (Weilin Du)
+ . Removed the dependency on the ICU IO library. (Weilin Du)
+
+- ODBC:
+ . Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the
+ driver-reported display size). (iliaal)
+
+- Opcache:
+ . Re-enable JIT for ZTS builds on Apple Silicon. (realFlowControl)
+
+- PDO_ODBC:
+ . Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the
+ driver-reported display size). (iliaal)
+ . Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is
+ longer than the declared maxlen). (iliaal)
+ . Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a
+ diagnostic message length beyond the error buffer). (iliaal)
+
+- Phar:
+ . Fixed grammatical issues and outdated terminology in Phar error messages.
+ (Weilin Du)
+
+- Reflection:
+ . Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).
+ (DanielEScherzer)
+
+- SOAP:
+ . Fixed header injection through the Content-Type context option, the
+ soapaction and the cookie names and values. (David Carlier)
+ . Fixed the SoapClient and SoapServer "classmap" option to reject arrays
+ containing integer keys, and made SoapClient throw TypeError/ValueError
+ for invalid "classmap" options. (Weilin Du, David Carlier)
+
+- MBString:
+ . Fixed bug GH-22779 (mb_strrpos() returns the wrong position for a negative
+ offset in a non-UTF-8 encoding). (Eyüp Can Akman)
+ . Fixed bug GH-21036 (mb_ereg_search_getregs() crashes after mb_eregi()
+ invalidates the regex cache). (Matthias Goergens)
+
+- PCRE:
+ . Fixed bug GH-21134 (Crash with \C + UTF-8). Using \C in UTF-8 patterns is
+ now forbidden. (Arnaud)
+
- Sockets:
. Fixed socket_set_option() validation error messages for UDP_SEGMENT and
- SO_LINGER options. (Weilin Du)
+ TCP_USER_TIMEOUT, and SO_LINGER options. (Weilin Du)
. Fixed various memory related issues in ext/sockets. (David Carlier)
-- SQLite:
- . Fix leak when trying to close db if blob stream is still open. (ndossche)
-
- Standard:
- . Fixed bug GH-23111 (Stack overflow in array_walk_recursive() with deeply
- nested arrays). (Lazizbek Ergashev)
- . Fixed bug GH-23113 (Stack overflow in array_replace_recursive() with deeply
- nested arrays). (Lazizbek Ergashev)
- . Fixed bug GH-23115 (Stack overflow in compact() with deeply nested
- arrays). (Lazizbek Ergashev)
+ . Fixed setlocale() to reject locale names containing NUL bytes instead of
+ silently truncating them, and to reject arrays passed after the $locales
+ argument or additional arguments passed after an array $locales argument.
+ (Weilin Du)
- Streams:
+ . Added a new IO copy API used by php_stream_copy_to_stream_ex() that
+ leverages platform primitives (sendfile, splice, copy_file_range,
+ TransmitFile) for faster stream copying. (Jakub Zelenka, David Carlier)
+ . Fixed bug GH-22841 (php_stream_copy_to_stream_ex() drops progress
+ notifications when using the copy fast path). (David Carlier)
. Fixed bug GH-15836 (Use-after-free when a user stream filter accesses
$this->stream during the close flush). (iliaal)