Commit 6493ea617aa for php.net

commit 6493ea617aacb1e4b359511d65d961b842fd025e
Merge: 7f97b839764 1e9f56cdb41
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Sun Jul 12 20:26:03 2026 -0400

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      Fix GH-22678: array_multisort() use-after-free on mutating comparator

diff --cc NEWS
index 9cb1c52aacd,ee23c0ec7a1..46f23c3aa6d
--- a/NEWS
+++ b/NEWS
@@@ -100,17 -81,15 +100,19 @@@ PH
      segfaults). (iliaal)

  - Standard:
 -  . Fixed bug GH-22360 (convert.base64-encode corruption on
 -    incremental flush). (David Carlier)
    . Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
      (Weilin Du)
 -  . Fixed integer overflow in getimagesize() and getimagesizefromstring()
 -    when parsing an IFF chunk with a size of INT_MAX. (David Carlier, Weilin Du)
+   . Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator
+     mutates the array being sorted). (azchin, iliaal)

 +- URI:
 +  . Fixed behavior of Uri\WhatWg\Url wither methods with regards to empty
 +    opaque hosts. (kocsismate)
 +  . Fixed bug GH-22628 (Percent-encoding of caret in WHATWG URL paths is not
 +    performed). (kocsismate)
 +  . Fixed bug GH-22629 (WHATWG Validation error incorrect with empty host and
 +    non-empty userinfo). (kocsismate)
 +
  - Zip:
    . Fixed bug GH-22649 (ZipArchive::setCommentName() and setCommentIndex()
      could crash after overwriting an entry and resetting its inherited