Commit c8682fb61af for php.net
commit c8682fb61af207c09c71bcded7fe5ba7b17d4a5e
Merge: 4b26ff1698b 46b40957b17
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date: Mon Aug 10 15:15:33 2026 -0400
Merge branch 'PHP-8.5'
* PHP-8.5:
Fix use-after-free when __clone() retains the stylesheet copy
diff --cc NEWS
index 7bbc50fcccf,299678d0a00..4ed01591ea4
--- a/NEWS
+++ b/NEWS
@@@ -90,116 -70,23 +90,120 @@@ PH
. Fixed segfault when comparing uninitialized SimpleXMLElement
instances. (iliaal)
+- Standard:
+ . Added the "filter.max_filter_count" stream context option for php://filter
+ URLs. Using more than 16 filters without configuring this option is now
+ deprecated. (Sjoerd Langkemper)
+ . metaphone() is now deprecated. (Weilin Du)
+ . Improved performance of array_intersect(). (mehmetcansahin)
+ . Fixed bug GH-23006 (phpcredits() full-page HTML title says phpinfo()).
+ (Weilin Du)
+ . The following functions now raise a ValueError when the $filename argument
+ contains NUL bytes: fileperms(), fileinode(), filesize(), fileowner(),
+ filegroup(), fileatime(), filemtime(), filectime(), filetype(),
+ is_writable(), is_readable(), is_executable(), is_file(), is_dir(),
+ is_link(), file_exists(), lstat(), stat(). (Girgias)
+ . Fixed bug GH-22818 (stream_filter_register() orphaned user_filter_map on
+ shutdown re-registration). (David Carlier)
+ . Io\Poll\Context::wait() now takes a Time\Duration object as a timeout.
+ (timwolla)
+
++- XSL:
++ . Fixed use-after-free when a DOMDocument subclass __clone() retains the
++ stylesheet copy made by XSLTProcessor::importStylesheet(). (iliaal)
++
+30 Jul 2026, PHP 8.6.0alpha3
+
+- Core:
+ . Implemented partial function application RFC. (Arnaud)
+ . Fixed bug GH-22263 (reset typed property default on every unserialize
+ failure path). (David Carlier)
+ . Fixed bug GH-18985 (Wrong line numbers for match with constant arms).
+ (ilutov)
+ . Fixed bug GH-18847 (SEGV in zend_fetch_debug_backtrace() when the memory
+ limit is reached while the tracing JIT enters a call frame). (Arnaud,
+ iliaal)
+
+- DOM:
+ . Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD
+ declares a default value for the attribute). (iliaal)
+ . Fixed bug GH-23120 (Stack overflow when comparing deeply nested DOM nodes
+ with DOMNode::isEqualNode()). (Weilin Du)
+
+- Embed:
+ . Made php-cli functionality available in embed builds. (henderkes)
+
+- GMP:
+ . Added gmp_prevprime(). (Weilin Du, David Carlier)
+ . Fixed GMP power and shift operators to reject GMP right operands outside
+ the unsigned long range instead of silently truncating them. (Weilin Du)
+ . Fixed GMP integer string parsing to reject strings containing NUL bytes
+ instead of silently truncating them. (Weilin Du)
+ . Fixed GMP error messages that referenced outdated parameter names.
+ (Weilin Du)
+
+- Intl:
+ . Fixed grammatical issues in Normalizer invalid form and IntlCalendar time
+ zone offset error messages. (Weilin Du)
+ . Removed the dependency on the ICU IO library. (Weilin Du)
+
+- ODBC:
+ . Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the
+ driver-reported display size). (iliaal)
+
+- Opcache:
+ . Re-enable JIT for ZTS builds on Apple Silicon. (realFlowControl)
+
+- PDO_ODBC:
+ . Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the
+ driver-reported display size). (iliaal)
+ . Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is
+ longer than the declared maxlen). (iliaal)
+ . Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a
+ diagnostic message length beyond the error buffer). (iliaal)
+
+- Phar:
+ . Fixed grammatical issues and outdated terminology in Phar error messages.
+ (Weilin Du)
+
+- Reflection:
+ . Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).
+ (DanielEScherzer)
+
+- SOAP:
+ . Fixed header injection through the Content-Type context option, the
+ soapaction and the cookie names and values. (David Carlier)
+ . Fixed the SoapClient and SoapServer "classmap" option to reject arrays
+ containing integer keys, and made SoapClient throw TypeError/ValueError
+ for invalid "classmap" options. (Weilin Du, David Carlier)
+
+- MBString:
+ . Fixed bug GH-22779 (mb_strrpos() returns the wrong position for a negative
+ offset in a non-UTF-8 encoding). (Eyüp Can Akman)
+ . Fixed bug GH-21036 (mb_ereg_search_getregs() crashes after mb_eregi()
+ invalidates the regex cache). (Matthias Goergens)
+
+- PCRE:
+ . Fixed bug GH-21134 (Crash with \C + UTF-8). Using \C in UTF-8 patterns is
+ now forbidden. (Arnaud)
+
- Sockets:
. Fixed socket_set_option() validation error messages for UDP_SEGMENT and
- SO_LINGER options. (Weilin Du)
+ TCP_USER_TIMEOUT, and SO_LINGER options. (Weilin Du)
. Fixed various memory related issues in ext/sockets. (David Carlier)
-- SQLite:
- . Fix leak when trying to close db if blob stream is still open. (ndossche)
-
- Standard:
- . Fixed bug GH-23111 (Stack overflow in array_walk_recursive() with deeply
- nested arrays). (Lazizbek Ergashev)
- . Fixed bug GH-23113 (Stack overflow in array_replace_recursive() with deeply
- nested arrays). (Lazizbek Ergashev)
- . Fixed bug GH-23115 (Stack overflow in compact() with deeply nested
- arrays). (Lazizbek Ergashev)
+ . Fixed setlocale() to reject locale names containing NUL bytes instead of
+ silently truncating them, and to reject arrays passed after the $locales
+ argument or additional arguments passed after an array $locales argument.
+ (Weilin Du)
- Streams:
+ . Added a new IO copy API used by php_stream_copy_to_stream_ex() that
+ leverages platform primitives (sendfile, splice, copy_file_range,
+ TransmitFile) for faster stream copying. (Jakub Zelenka, David Carlier)
+ . Fixed bug GH-22841 (php_stream_copy_to_stream_ex() drops progress
+ notifications when using the copy fast path). (David Carlier)
. Fixed bug GH-15836 (Use-after-free when a user stream filter accesses
$this->stream during the close flush). (iliaal)
diff --cc ext/xsl/xsltprocessor.c
index 230c7bd39cc,68ff9eb76ab..5d24ab1ec87
--- a/ext/xsl/xsltprocessor.c
+++ b/ext/xsl/xsltprocessor.c
@@@ -213,9 -216,23 +213,15 @@@ PHP_METHOD(XSLTProcessor, importStylesh
ZVAL_OBJ(&clone_zv, clone);
nodep = php_libxml_import_node(&clone_zv);
- if (nodep) {
- newdoc = nodep->doc;
- }
- if (newdoc == NULL) {
- OBJ_RELEASE(clone);
- zend_argument_type_error(1, "must be a valid XML node");
- RETURN_THROWS();
- }
-
+ newdoc = nodep->doc;
php_libxml_node_object *clone_lxml_obj = Z_LIBXML_NODE_P(&clone_zv);
+ if (GC_REFCOUNT(clone) > 1 || clone_lxml_obj->document->refcount > 1) {
+ OBJ_RELEASE(clone);
+ zend_argument_value_error(1, "must not have its clone retained by __clone()");
+ RETURN_THROWS();
+ }
+
PHP_LIBXML_SANITIZE_GLOBALS(parse);
ZEND_DIAGNOSTIC_IGNORED_START("-Wdeprecated-declarations")
xmlSubstituteEntitiesDefault(1);