Commit e5c3b4b0833 for php.net

commit e5c3b4b083354d24f7202ccdb82f00a61bb16fe8
Merge: 3de8e640b3c 4f83876af75
Author: Ilija Tovilo <ilija.tovilo@me.com>
Date:   Tue Jul 28 11:51:44 2026 +0200

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      Fix out-of-bounds write in ext-bcmath bccomp() via bc_str2num()
      Add NEWS entries
      Fix GHSA-vc5h-9ppw-p5f3: phar circular symlink crash
      Fix SQL injection in ext-pgsql via E'...' backslash breakout
      libgd patch for CVE-2026-9672

diff --cc NEWS
index 25c5af392c8,54dea5289ff..28a4ef939ea
--- a/NEWS
+++ b/NEWS
@@@ -35,16 -27,12 +35,20 @@@ PH
    . Fixed bug GH-15836 (Use-after-free when a user stream filter accesses
      $this->stream during the close flush). (iliaal)

 -30 Jul 2026, PHP 8.4.24
 +30 Jul 2026, PHP 8.5.9
 +
 +- Core:
 +  . Fixed bug GH-22290 (AST pretty printing does not correctly handle strings
 +    containing NUL). (iliaal)
 +  . Fixed bug GH-22206 (missing return in global register detection).
 +    (P3p111n0)
 +  . Lock unmodified readonly properties for modification after clone-with.
 +    (NickSdot)

+ - BCMath:
+   . Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()).
+     (CVE-2026-17544) (Recep Asan)
+
  - Calendar:
    . Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with
      INT_MAX year). (arshidkv12)