Commit 5a405e9d3eb for php

commit 5a405e9d3ebc0e6aa2bbc27405752727468e508d
Merge: d48602bccf3 b2e02ccba0b
Author: Jakub Zelenka <bukka@php.net>
Date:   Sat Nov 7 12:31:12 2026 +0100

    Merge branch 'PHP-8.5' into PHP-8.6

    * PHP-8.5:
      Fix use-after-free when pclose() closes a stream from its user filter

    # Conflicts:
    #       ext/standard/file.c

diff --cc NEWS
index f80adaa2217,053bd8f7169..a3c75a47e37
--- a/NEWS
+++ b/NEWS
@@@ -39,10 -30,32 +39,12 @@@ PH
      callback). (Ilia Alshanetsky)
    . Fixed leaks and data loss when user filter leaves buckets on input
      brigade. (ndossche, Matthias Goergens, Jakub Zelenka)
+   . Fixed bug GH-24175 (Use-after-free when pclose() closes a stream from its
+     user filter). (Edmond)

 -19 Nov 2026, PHP 8.5.13
 +05 Nov 2026, PHP 8.6.0RC5

  - Core:
 -  . Fixed bug GH-24184 (System ID not being reinitialized after an Apache
 -    graceful restart, potentially causing incompatible OPcache file cache
 -    entries to be reused). (Levi Morrison)
 -  . Fixed memory leak when an exception already contains the pending exception
 -    in its previous chain. (Edmond)
 -  . Fixed bug GH-23979 (Nullsafe operator must not flush delayed oplines of an
 -    enclosing function). (ndossche)
 -  . Fixed memory manager keeping a block reallocated to exactly the size of
 -    the next smaller bin in its larger bin, which efree_size() then freed
 -    into the wrong one. (Marc Bennewitz)
 -  . Fixed bug GH-24081 (User opcode handlers resume execution against a stale
 -    frame under ZEND_VM_KIND_TAILCALL). (devnexen)
 -  . Fixed bug GH-24218 (Invalid opcode for count() of a literal array
 -    without SCCP). (lazerg)
 -  . Fix throwing behaviour with recursive arrays in VM. (ndossche)
 -  . Fixed skipped catch block when switching fibers during exception unwinding
 -    (Nicolas Grekas)
 -  . Fix escape analysis for objects implementing ArrayAccess. (ndossche, Arnaud)
 -  . Fix UAF for resolved callable zval. (EdmondDantes)
 -  . Fix memory leak for nested HTTP calls. (EdmondDantes)
    . Fix function and constant imports in compile_to_ast and add support
      for grouping. (Klaas Skelte van der Werf)
    . Fixed bug GH-24668 (zend_set_local_var() leaks the previous value of an
diff --cc ext/standard/file.c
index a3dd691b5d6,51258be9c73..ff68374928c
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@@ -871,11 -840,11 +871,16 @@@ PHP_FUNCTION(pclose
  		PHP_Z_PARAM_STREAM(stream)
  	ZEND_PARSE_PARAMETERS_END();

+ 	if ((stream->flags & PHP_STREAM_FLAG_NO_FCLOSE) != 0) {
+ 		php_error_docref(NULL, E_WARNING, "cannot close the provided stream, as it must not be manually closed");
+ 		RETURN_LONG(-1);
+ 	}
+
 +	php_stream_context *context = PHP_STREAM_CONTEXT(stream);
 +	if (context) {
 +		GC_ADDREF(context->res);
 +	}
 +	php_stream_error_operation_begin();
  	FG(pclose_wait) = 1;
  	zend_list_close(stream->res);
  	FG(pclose_wait) = 0;