Commit 4c2924299cf for php

commit 4c2924299cf088457cb0bbed973b26ffcfc3e2f5
Merge: 37c8477bdb9 48b3f94fe2d
Author: ndossche <7771979+ndossche@users.noreply.github.com>
Date:   Sat Oct 24 00:42:23 2026 +0200

    Merge branch 'PHP-8.5' into PHP-8.6

    * PHP-8.5:
      Fix GH-24509: HTTP wrapper leaks Location buffer on empty Location header

diff --cc NEWS
index 741985a9ca6,6d0f780c681..01adc8ff275
--- a/NEWS
+++ b/NEWS
@@@ -1,44 -1,8 +1,46 @@@
  PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? ????, PHP 8.5.13
 +?? ??? ????, PHP 8.6.0RC5
 +
 +- Opcache:
 +  . Fixed tracing JIT returning a wrapped integer instead of a float on
 +    integer overflow after an integer was compared with a float or
 +    numeric-string literal. (Ilia Alshanetsky)
 +  . Fixed use-after-free in JIT ASSIGN_DIM_OP when concatenating into an
 +    empty array element. (jorgsowa)
 +  . Fixed bug GH-24396 (Assertion failure in zend_jit_def_reg() "reg forwarding"
 +    with chained Pi nodes). (ndossche)
 +
 +- PDO_PGSQL:
 +  . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops
 +    PgBouncer's prepared statements). (David Carlier, Artem Ukrainskiy)
 +
 +- SAPI:
 +  . Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
 +    (Martin Mirchev)
 +
 +- Standard:
 +  . Fixed bug GH-24308 (Request shutdown calls closelog() even when syslog
 +    was not opened by PHP). (lazerg)
 +
 +- Streams:
 +  . Fixed bug GH-24506 (stream_select() leaks a stream-error operation level
 +    on its FD_SETSIZE failure path). (azjezz)
 +  . Fixed bug GH-24508 (HTTP wrapper leaks the dechunk filter when header
 +    parsing fails after Transfer-Encoding). (bercedev)
++  . Fixed bug GH-24509 (HTTP wrapper leaks Location buffer on empty
++    Location header). (bercedev)
 +
 +- Zlib:
 +  . Fixed bug GH-24533 (zlib.lib could not be found because zlib 1.3.2
 +    CMake build does not emit it). (Lazizbek Ergashev)
 +
 +21 Oct 2026, PHP 8.6.0RC4

  - Core:
 +  . Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via
 +    bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
 +    ndossche, Nicolas Grekas)
    . Fixed bug GH-24184 (System ID not being reinitialized after an Apache
      graceful restart, potentially causing incompatible OPcache file cache
      entries to be reused). (Levi Morrison)
diff --cc ext/standard/http_fopen_wrapper.c
index 2eadc006a29,302c012bd3e..37844ec5e31
--- a/ext/standard/http_fopen_wrapper.c
+++ b/ext/standard/http_fopen_wrapper.c
@@@ -318,13 -331,13 +318,13 @@@ static zend_string *php_stream_http_res
  		size_t last_header_value_len = strlen(last_header_value);
  		if (last_header_value_len > HTTP_HEADER_MAX_LOCATION_SIZE) {
  			header_info->error = true;
 -			php_stream_wrapper_log_error(wrapper, options,
 +			php_stream_wrapper_log_warn(wrapper, context, options, InvalidResponse,
  					"HTTP Location header size is over the limit of %d bytes",
  					HTTP_HEADER_MAX_LOCATION_SIZE);
 -			zend_string_efree(last_header_line_str);
 +			zend_string_efree(last_header_line);
  			return NULL;
  		}
- 		if (header_info->location_len == 0) {
+ 		if (header_info->location == NULL) {
  			header_info->location = emalloc(last_header_value_len + 1);
  		} else if (header_info->location_len <= last_header_value_len) {
  			header_info->location = erealloc(header_info->location, last_header_value_len + 1);