Commit 0401fb3a753 for php.net

commit 0401fb3a75316f5c8ef42d6230fe3a162a4e296f
Author: Michael Orlitzky <michael@orlitzky.com>
Date:   Fri Mar 20 12:03:34 2026 -0400

    [fileinfo] Hide libmagic dynamic symbols

    When libphp.so (from the embed SAPI, or the apache module) is loaded
    by another project that already uses libmagic, the symbols from the
    two copies of libmagic...

      $ objdump -TC ./libs/libphp.so | grep '\smagic_'
      00000000002b2754 g  DF .text  0000000000000034  Base  magic_compile
      00000000002b25fe g  DF .text  0000000000000024  Base  magic_open
      00000000002b27f0 g  DF .text  0000000000000034  Base  magic_descriptor
      00000000002b2720 g  DF .text  0000000000000034  Base  magic_load
      00000000002b2c1a g  DF .text  0000000000000032  Base  magic_setflags
      00000000002b27bc g  DF .text  0000000000000034  Base  magic_list
      00000000002b2c62 g  DF .text  0000000000000206  Base  magic_setparam
      00000000002b2bf4 g  DF .text  0000000000000026  Base  magic_getflags
      00000000002b2bbe g  DF .text  0000000000000036  Base  magic_errno
      00000000002b2e68 g  DF .text  00000000000001f4  Base  magic_getparam
      00000000002b2b14 g  DF .text  000000000000006e  Base  magic_buffer
      00000000002b2b82 g  DF .text  000000000000003c  Base  magic_error
      00000000002b2788 g  DF .text  0000000000000034  Base  magic_check
      00000000002b2c4c g  DF .text  0000000000000016  Base  magic_version
      00000000002b26fa g  DF .text  0000000000000026  Base  magic_close
      00000000002b2858 g  DF .text  0000000000000034  Base  magic_stream
      00000000002b2824 g  DF .text  0000000000000034  Base  magic_file

    can clash. To see this, we (pointlessly) link libphp.so from the
    embed SAPI into a small program using the system copy of libmagic:

      $ gcc $(/usr/lib/php8.5/bin/php-config --includes) main.c \
        -L/usr/lib/php8.5/lib -lphp -lmagic
      $ LD_LIBRARY_PATH=/usr/lib/php8.5/lib ./a.out
      Segmentation fault         LD_LIBRARY_PATH=/usr/lib/php8.5/lib ./a.out

    To avoid this, we modify the internal "file_public" macro used by
    libmagic, so that (on platforms that support it) hidden visibility is
    used instead of the default. Afterwards the objdump command above
    produces no output, and the test program no longer sefaults.

    Co-authored-by:  Ilija Tovilo <ilija.tovilo@me.com>
    PHP-bug: https://bugs.php.net/bug.php?id=66095
    Gentoo-bug: https://bugs.gentoo.org/471682

    Fixes #66095
    Closes GH-21472

diff --git a/NEWS b/NEWS
index e2df869dfbc..54a45028c6a 100644
--- a/NEWS
+++ b/NEWS
@@ -30,6 +30,7 @@ PHP                                                                        NEWS
 - Fileinfo:
   . Fixed bug GH-20679 (finfo_file() doesn't work on remote resources).
     (ndossche)
+  . Fixed bug #66095 (Hide libmagic dynamic symbols). (orlitzky)

 - Hash:
   . Upgrade xxHash to 0.8.2. (timwolla)
@@ -51,7 +52,7 @@ PHP                                                                        NEWS
     small value). (David Carlier)

 - Mail:
-  . Fixed bug GH-20862 (null pointer dereference in
+  . Fixed bug GH-20862 (null pointer dereference in
     php_mail_detect_multiple_crlf via error_log (jordikroon)

 - Mbstring:
diff --git a/ext/fileinfo/libmagic.patch b/ext/fileinfo/libmagic.patch
index 6e3751fa943..0f69e732fdd 100644
--- a/ext/fileinfo/libmagic.patch
+++ b/ext/fileinfo/libmagic.patch
@@ -1727,7 +1727,7 @@ diff -u libmagic.orig/encoding.c libmagic/encoding.c
  }
 diff -u libmagic.orig/file.h libmagic/file.h
 --- libmagic.orig/file.h	2024-11-27 10:37:00.000000000 -0500
-+++ libmagic/file.h	2026-03-25 08:13:23.336328498 -0400
++++ libmagic/file.h	2026-03-25 16:14:40.128668705 -0400
 @@ -27,15 +27,13 @@
   */
  /*
@@ -1767,6 +1767,21 @@ diff -u libmagic.orig/file.h libmagic/file.h

  #define ENABLE_CONDITIONALS

+@@ -109,12 +102,12 @@
+
+ #if HAVE_VISIBILITY
+ # if defined(WIN32)
+-#  define file_public  __declspec(dllexport)
++#  define file_public
+ #  ifndef file_protected
+ #   define file_protected
+ #  endif
+ # else
+-#  define file_public  __attribute__((__visibility__("default")))
++#  define file_public  __attribute__((__visibility__("hidden")))
+ #  ifndef file_protected
+ #   define file_protected __attribute__((__visibility__("hidden")))
+ #  endif
 @@ -179,7 +172,7 @@
  #define MAXstring 128		/* max len of "string" types */

@@ -3075,7 +3090,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  	}
  	return file_getbuffer(ms);
 diff -u libmagic.orig/magic.h libmagic/magic.h
---- libmagic.orig/magic.h	2026-03-25 08:16:04.280413419 -0400
+--- libmagic.orig/magic.h	2026-03-25 16:14:49.284673536 -0400
 +++ libmagic/magic.h	2026-03-20 12:10:19.777614667 -0400
 @@ -47,8 +47,6 @@
  					   * extensions */
diff --git a/ext/fileinfo/libmagic/file.h b/ext/fileinfo/libmagic/file.h
index 718a60b2e1b..5357578c6a7 100644
--- a/ext/fileinfo/libmagic/file.h
+++ b/ext/fileinfo/libmagic/file.h
@@ -102,12 +102,12 @@

 #if HAVE_VISIBILITY
 # if defined(WIN32)
-#  define file_public  __declspec(dllexport)
+#  define file_public
 #  ifndef file_protected
 #   define file_protected
 #  endif
 # else
-#  define file_public  __attribute__((__visibility__("default")))
+#  define file_public  __attribute__((__visibility__("hidden")))
 #  ifndef file_protected
 #   define file_protected __attribute__((__visibility__("hidden")))
 #  endif