Commit 2d7131e1bf1 for php.net

commit 2d7131e1bf1da03eb133c50aee37c8377ecc1723
Merge: 9cce500a504 cb1b529fc30
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Tue Sep 1 08:58:23 2026 -0400

    Merge branch 'PHP-8.5'

    * PHP-8.5:
      [mbstring] Fix mb_ereg_replace() emitting NUL/garbage for unterminated \k<name>

diff --cc NEWS
index c2735429778,82adcae4408..17ec66961b3
--- a/NEWS
+++ b/NEWS
@@@ -24,16 -46,25 +24,21 @@@ PH
      read. (iliaal)
    . Fixed a use-after-free when IntlRuleBasedBreakIterator is constructed
      from compiled rules. (iliaal)
 +  . Fixed Spoofchecker methods not recording the ICU error code when an ICU
 +    call fails. (Ilia Alshanetsky)

+ - MBString:
+   . Fixed mb_ereg_replace() emitting a NUL or out-of-bounds bytes in the
+     replacement when a \k<name> backref has no closing delimiter.
+     (Ilia Alshanetsky)
+
 -- Opcache:
 -  . Fixed opcache.protect_memory race under ZTS. (realFlowControl)
 -  . Fixed a tracing JIT crash when compiling a side trace for a method of a
 -    class that could not be stored in the inheritance cache. (GH-21710)
 -    (Arnaud, iliaal)
 -
 -- PDO:
 -  . Fixed a leak when a persistent connection failed a liveness check
 -    with no other live PDO handle. (iliaal)
 -
  - PDO_PGSQL:
 -  . Fixed PDO::CURSOR_SCROLL statements failing under lazy fetching
 -    (PDO::ATTR_PREFETCH => 0). (KentarouTakeda)
 +  . Added Pdo\Pgsql::ATTR_CHUNK_SIZE to fetch a result set in chunks of the
 +    given number of rows. (KentarouTakeda)
 +
 +- PGSQL:
 +  . Fixed the pg_insert(), pg_update() and pg_delete() flag error messages,
 +    which did not name the set of flags actually accepted. (lacatoire)

  - Phar:
    . Fixed bug GH-23418 (Use-after-free when looking up mounted directories).
diff --cc ext/mbstring/tests/mb_ereg_replace_kname_unterminated_nul.phpt
index 00000000000,67a39dc9f95..80308370d21
mode 000000,100644..100644
--- a/ext/mbstring/tests/mb_ereg_replace_kname_unterminated_nul.phpt
+++ b/ext/mbstring/tests/mb_ereg_replace_kname_unterminated_nul.phpt
@@@ -1,0 -1,18 +1,27 @@@
+ --TEST--
+ mb_ereg_replace() with unterminated \k<name> backref must not embed a NUL byte
+ --EXTENSIONS--
+ mbstring
+ --FILE--
+ <?php
+ var_dump(bin2hex(mb_ereg_replace('(\d+)', '\k<num', '123')));
+ var_dump(bin2hex(mb_ereg_replace('(\d+)', "\\k'num", '123')));
+ var_dump(bin2hex(mb_ereg_replace('(x)(y)', 'a\k<n', 'xy')));
+ var_dump(bin2hex(mb_ereg_replace('(\d+)', "a\\k\xF0", '123')));
+ var_dump(bin2hex(mb_ereg_replace('(\d+)', "\\\\k\xE2\x82", '123')));
+ ?>
 ---EXPECT--
++--EXPECTF--
++Deprecated: Function mb_ereg_replace() is deprecated since 8.6, because the underlying library is no longer maintained in %s on line %d
+ string(12) "5c6b3c6e756d"
++
++Deprecated: Function mb_ereg_replace() is deprecated since 8.6, because the underlying library is no longer maintained in %s on line %d
+ string(12) "5c6b276e756d"
++
++Deprecated: Function mb_ereg_replace() is deprecated since 8.6, because the underlying library is no longer maintained in %s on line %d
+ string(10) "615c6b3c6e"
++
++Deprecated: Function mb_ereg_replace() is deprecated since 8.6, because the underlying library is no longer maintained in %s on line %d
+ string(8) "615c6bf0"
++
++Deprecated: Function mb_ereg_replace() is deprecated since 8.6, because the underlying library is no longer maintained in %s on line %d
+ string(10) "5c5c6be282"