Commit c35224e11cc for php.net
commit c35224e11cc57efb047252cddbcdea9705667a01
Merge: 735f354ac9a 0590a34aeeb
Author: Niels Dossche <7771979+ndossche@users.noreply.github.com>
Date: Fri Dec 19 19:37:11 2025 +0100
Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
Fix GH-20352: UAF in php_output_handler_free via re-entrant ob_start() during error deactivation
diff --cc NEWS
index 2d0ad26c229,8c62fb8ebf4..583477048bc
--- a/NEWS
+++ b/NEWS
@@@ -8,7 -8,13 +8,9 @@@ PH
. Fixed bug GH-20695 (Assertion failure in normalize_value() when parsing
malformed INI input via parse_ini_string()). (ndossche)
. Fixed bug GH-20714 (Uncatchable exception thrown in generator). (ilutov)
+ . Fixed bug GH-20352 (UAF in php_output_handler_free via re-entrant
+ ob_start() during error deactivation). (ndossche)
-- Bz2:
- . Fixed bug GH-20620 (bzcompress overflow on large source size).
- (David Carlier)
-
- DOM:
. Fixed bug GH-20722 (Null pointer dereference in DOM namespace node cloning
via clone on malformed objects). (ndossche)