Commit 1c92d577570 for php
commit 1c92d577570e78ee3e3bd5b0ff443264862a3971
Merge: c59451a35ce 0862a59e751
Author: Jorg Sowa <jorg.sowa@gmail.com>
Date: Thu Oct 29 16:04:52 2026 +0100
Merge branch 'PHP-8.5' into PHP-8.6
diff --cc NEWS
index 0b39499544c,0d4838421d8..e41fb4e5c69
--- a/NEWS
+++ b/NEWS
@@@ -107,135 -172,6 +107,139 @@@ PH
. Fixed bug GH-24784 (openssl_pkcs7_read() and openssl_cms_read() overwrite
certificates with CRLs). (Alexander Danilov)
+- PDO_PGSQL:
+ . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops
+ PgBouncer's prepared statements). (David Carlier, Artem Ukrainskiy)
+
+- Phar:
+ . Fixed bug GH-24740 (Oversized tar metadata exhausts the memory limit).
+ (Lazizbek Ergashev)
+
+- SAPI:
+ . Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
+ (Martin Mirchev)
+
++- Session:
++ . Validate whole session ID instead of stopping at the first NUL byte.
++ (Sjoerd Langkemper)
++
+- Sodium:
+ . Pass sodium_crypto_xof_*() state via objects instead of by-ref strings.
+ (timwolla)
+
+- SPL:
+ . Fixed bug GH-24264 (Unwind/GracefulExit discarded in spl_iterators.c).
+ (Lazizbek Ergashev)
+
+- Sockets:
+ . Fixed bug GH-24748 (socket_set_option() crashes with declared object
+ properties). (Lazizbek Ergashev)
+
+- Standard:
+ . Fixed bug GH-24308 (Request shutdown calls closelog() even when syslog
+ was not opened by PHP). (lazerg)
+ . Fixed bug GH-24552 (Case-insensitive substr_compare(), ksort() and
+ krsort() are still locale-dependent). (Lazizbek Ergashev, Jon Surrell)
+ . Fix use-after-free in Randomizer::shuffleArray() when the engine throws.
+ (Marti2203)
+
+- Streams:
+ . Fixed bug GH-24506 (stream_select() leaks a stream-error operation level
+ on its FD_SETSIZE failure path). (azjezz)
+ . Fixed bug GH-24508 (HTTP wrapper leaks the dechunk filter when header
+ parsing fails after Transfer-Encoding). (bercedev)
+ . Fixed bug GH-24509 (HTTP wrapper leaks Location buffer on empty
+ Location header). (bercedev)
+
+- Zip:
+ . Reject broken libzip versions 1.3.1, 1.7.0 and 1.12.0 during Windows
+ configuration. (Weilin Du)
+ . Excluded libzip 1.12.0 due to a regression preventing additions and
+ replacements in torrentzip archives. (Weilin Du)
+
+- Zlib:
+ . Fixed bug GH-24533 (zlib.lib could not be found because zlib 1.3.2
+ CMake build does not emit it). (Lazizbek Ergashev)
+
+21 Oct 2026, PHP 8.6.0RC4
+
+- Core:
+ . Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via
+ bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
+ ndossche, Nicolas Grekas)
+ . Fixed bug GH-24184 (System ID not being reinitialized after an Apache
+ graceful restart, potentially causing incompatible OPcache file cache
+ entries to be reused). (Levi Morrison)
+ . Fixed memory leak when an exception already contains the pending exception
+ in its previous chain. (Edmond)
+ . Fixed bug GH-23979 (Nullsafe operator must not flush delayed oplines of an
+ enclosing function). (ndossche)
+ . Fixed memory manager keeping a block reallocated to exactly the size of
+ the next smaller bin in its larger bin, which efree_size() then freed
+ into the wrong one. (Marc Bennewitz)
+ . Fix throwing behaviour with recursive arrays in VM. (ndossche)
+ . Fixed skipped catch block when switching fibers during exception unwinding
+ (Nicolas Grekas)
+ . Fix escape analysis for objects implementing ArrayAccess. (ndossche, Arnaud)
+ . Fixed array_map() optimization not resolving the class name of a static
+ first-class callable. (Claudio Dekker)
+
+- Date:
+ . Fixed bug GH-20503 (Assertion failure with ext/date DateInterval property
+ hash construction). (heathdutton)
+ . Fixed bug GH-24350 (MINIT reads a stale external tz database after an
+ in-process module restart). (Lazizbek Ergashev)
+
+- Fileinfo:
+ . Fixed bug GH-24289 (finfo::file() reports the wrong argument number for
+ an invalid $filename). (Lazizbek Ergashev)
+
+- FPM:
+ . Fixed bug GH-24229 (fcgi_close() passes shutdown() a literal 1, which is
+ SHUT_RD in WASI). (Ryosuke Ishibashi)
+
+- FTP:
+ . Fix double free in ext/ftp data_accept() on accept failure. (alepacheco)
+
+- MBString:
+ . Fixed bug GH-23958 (truncated encoding names resolving to full names). (Kamil Tekiela)
+ . Fixed out-of-bounds read in php_mb_rfc1867_getword() on a multibyte lead
+ byte at the end of a multipart field name. (Jorg Sowa)
+
+- MySQLnd:
+ . Fixed bug GH-24293 (Segfault on connect with an empty password to a
+ MariaDB PAM account). (lazerg)
+
+- Opcache:
+ . Fixed bug GH-17626 (JIT corrupts an opline handler when blacklisting a
+ root trace at the opcache.jit_max_root_traces limit, causing spurious
+ "Too few arguments" errors and crashes). (RV7PR)
+ . Fix type inference of ADD_ARRAY_UNPACK with integer keys. (ndossche)
+ . Fix too wide type inference for ASSIGN_DIM_OP. (ndossche)
+ . Fix OSS-Fuzz #568005340 (FETCH_DIM_FUNC_ARG partial conversion). (ndossche)
+ . Fix exception checks due to NAN warnings and object empty()'s. (ndossche)
+ . Fixed bug GH-24270 (JIT loses the called scope of self:: and parent:: calls
+ in closures). (RV7PR)
+ . Fixed bug GH-24337 (JIT: segfault when decrementing a non-numeric string
+ property). (Lazizbek Ergashev)
+ . Fixed bug GH-24185 (Windows ZTS: random access violations with OPcache JIT
+ in multi-process setups). (Arnaud, ndossche)
+ . Fix SIGFPE on LONG_MIN % -1 with a constant divisor. (waroad)
+ . Fixed bug GH-24388 (Tracing JIT: segfault when a trace runs out of side
+ exits). (Lazizbek Ergashev)
+ . Fixed bug GH-24391 (JIT switch on constant null takes default instead of
+ case 0). (ndossche)
+ . Fixed bug GH-24206 (Tracing JIT loses loop-carried CV when its loop PHI
+ is reloaded from memory). (ndossche)
+ . Fixed bug GH-24386 (JIT: register operand must be loaded before the typed
+ reference check). (ndossche)
+ . Fixed bug GH-24437 (JIT: Fix OP_DATA read from an unwritten slot in
+ zend_jit_assign_dim_op()). (waroad)
+ . Fixed bug GH-24398 (JIT: minimal JIT segfault when a hooked property is
+ passed to a run-time-resolved function). (waroad)
+ . Fixed bug GH-24389 (Tracing JIT: type guard on entry of an inlined call
+ exits with an uninitialized opline). (waroad)
+
- PDO:
. Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.
(Ilia Alshanetsky)
diff --cc ext/session/php_session.h
index e2b7a7e5a7d,d0741e69e0e..ee36eb291e5
--- a/ext/session/php_session.h
+++ b/ext/session/php_session.h
@@@ -252,27 -274,46 +252,28 @@@ PHPAPI const ps_module *_php_find_ps_mo
PHPAPI const ps_serializer *_php_find_ps_serializer(const char *name);
PHPAPI zend_result php_session_valid_key(const char *key);
+ zend_result php_session_valid_key_ex(const zend_string *key);
PHPAPI zend_result php_session_reset_id(void);
-#define PS_ADD_VARL(name) do { \
- php_add_session_var(name); \
-} while (0)
-
-#define PS_ADD_VAR(name) PS_ADD_VARL(name)
-
-#define PS_DEL_VARL(name) do { \
- if (!Z_ISNULL(PS(http_session_vars))) { \
- zend_hash_del(Z_ARRVAL(PS(http_session_vars)), name); \
- } \
-} while (0)
-
-
-#define PS_ENCODE_VARS \
- zend_string *key; \
- zend_ulong num_key; \
- zval *struc;
-
/* Do not use a return statement in `code` because that may leak memory.
* Break out of the loop instead. */
-#define PS_ENCODE_LOOP(code) do { \
- zval _zv; \
- /* protect against user interference */ \
- ZVAL_COPY(&_zv, Z_REFVAL(PS(http_session_vars))); \
- HashTable *_ht = Z_ARRVAL(_zv); \
- ZEND_HASH_FOREACH_KEY(_ht, num_key, key) { \
- if (key == NULL) { \
- php_error_docref(NULL, E_WARNING, \
- "Skipping numeric key " ZEND_LONG_FMT, num_key);\
- continue; \
- } \
- if ((struc = php_get_session_var(key))) { \
- code; \
- } \
- } ZEND_HASH_FOREACH_END(); \
- zval_ptr_dtor(&_zv); \
-} while(0)
+#define PS_ENCODE_LOOP(code) do { \
+ zval _zv; \
+ /* protect against user interference */ \
+ ZVAL_COPY(&_zv, Z_REFVAL(PS(http_session_vars))); \
+ ZEND_HASH_FOREACH_KEY(Z_ARRVAL(_zv), zend_ulong num_key, zend_string * key) { \
+ if (key == NULL) { \
+ php_error_docref(NULL, E_WARNING, \
+ "Skipping numeric key " ZEND_LONG_FMT, num_key); \
+ continue; \
+ } \
+ zval *struc = php_get_session_var(key); \
+ if (struc) { \
+ code; \
+ } \
+ } ZEND_HASH_FOREACH_END(); \
+ zval_ptr_dtor(&_zv); \
+} while (0)
PHPAPI ZEND_EXTERN_MODULE_GLOBALS(ps)
diff --cc ext/session/session.c
index cca448b5a41,ecdb38b8e49..81c4455808b
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@@ -2511,11 -2513,11 +2520,11 @@@ PHP_FUNCTION(session_create_id
}
if (prefix && ZSTR_LEN(prefix)) {
- if (ZSTR_LEN(prefix) > PS_MAX_SID_LENGTH) {
- zend_argument_value_error(1, "cannot be longer than %d characters", PS_MAX_SID_LENGTH);
- RETURN_THROWS();
- }
+ if (ZSTR_LEN(prefix) > PS_MAX_SID_LENGTH) {
+ zend_argument_value_error(1, "cannot be longer than %d characters", PS_MAX_SID_LENGTH);
+ RETURN_THROWS();
+ }
- if (php_session_valid_key(ZSTR_VAL(prefix)) == FAILURE) {
+ if (php_session_valid_key_ex(prefix) == FAILURE) {
/* E_ERROR raised for security reason. */
php_error_docref(NULL, E_WARNING, "Prefix cannot contain special characters. Only the A-Z, a-z, 0-9, \"-\", and \",\" characters are allowed");
RETURN_FALSE;