Core
- Fixed bug GH-24184 (System ID not being reinitialized after an Apache graceful restart, potentially causing incompatible OPcache file cache entries to be reused).
- Fixed memory leak when an exception already contains the pending exception in its previous chain.
- Fixed bug GH-23979 (Nullsafe operator must not flush delayed oplines of an enclosing function).
- Fixed memory manager keeping a block reallocated to exactly the size of the next smaller bin in its larger bin, which efree_size() then freed into the wrong one.
- Fixed bug GH-24218 (Invalid opcode for count() of a literal array without SCCP).
- Fix throwing behaviour with recursive arrays in VM.
- Fixed skipped catch block when switching fibers during exception unwinding (Nicolas Grekas)
- Fix escape analysis for objects implementing ArrayAccess.
- Fix UAF for resolved callable zval.
- Fix memory leak for nested HTTP calls.
- Fixed pthread attribute leak in zend_call_stack_get_netbsd_pthread().
- Fixed bug GH-24321 (ZTS: global_map_ptr_last survives zend_shutdown(), so an in-process engine restart keeps growing the map_ptr table).
- Fix function and constant imports in compile_to_ast and add support for grouping.
- Fixed bug GH-24265 (Unwind/GracefulExit discarded in zend_fiber_execute()).
- Fixed bug GH-24668 (zend_set_local_var() leaks the previous value of an existing CV).
- Fixed unmapping of an unrelated range when the aligned chunk mmap fails (Marti2203).
- Fixed bug GH-24989 (Use-after-free in GC when an exception is thrown).
- Fixed bug GH-24534 (Segfault in zend_try_early_bind when a parent class autoloads its cached child during linking).
- Fixed AST printing dropping final on class constants and properties, and abstract on properties.
- Fixed AST export of readonly anonymous classes dropping the readonly modifier.
- Fixed memory leak of a duplicate named argument in new in initializer.
- Fixed bug GH-25061 ($x = $x - 1 on null is optimized to PRE_DEC).
- Fixed bug GH-24480 (Finally block running a second time when a VM interrupt throws as the finally block returns to a "return" in its try block).
CLI
COM
- Fixed bug GH-25008 (com_event_sink() and com_print_typeinfo() crash resolving an event source with no loaded typelib).
Curl
- Fix use-after-free of CURLOPT_STDERR stream on cloned curl handle.
- Fix UAF on clone due to callback data pointer mismatch.
Date
DBA
- Fixed bug GH-24641 (ndbm backend never checks dbm_open() return value, NULL deref on first use after a failed open).
DOM
- Fixed a use-after-free when reflected attribute setters replace an attribute whose child still has a live wrapper.
- Fixed bug GH-23352 (UAF reading an attribute value node retained across DOMDocument::adoptNode()).
- Fixed bug GH-24260 (querySelectorAll() returns duplicate elements for selector lists).
- Fixed bug GH-23334 (Use-after-free in php_dom_free_templated_content()).
- Fixed bug GH-22077 (UAF in custom XPath function).
- Fixed bug GH-22554 (use-after-free with XPath callback returning a node from a foreign document).
- Fixed DOMXPath crash wrapping a foreign node after a nodeset callback.
- Fix error paths in dom_xml_serializing_a_document_node().
- Fixed use-after-free on namespace axis results with a foreign-document XPath callback node.
FFI
- Fixed bug GH-24582 (Memory leaks in ext/ffi parser when finalize_type() bails out).
FPM
- Fixed bug GH-24229 (fcgi_close() passes shutdown() a literal 1, which is SHUT_RD in WASI).
- Fixed crash and stack memory disclosure in the worker output logging with a pool name longer than the message prefix buffer or log_limit.
- Fixed bug GH-24046 (FPM worker stdio pipe fd closed twice when a child process outlives the worker, breaking a later worker's stdio).
- Fixed memory leaks of the _GET string on the status page error and HEAD request paths.
- Fixed use-after-free of the scoreboard copy when logging invalid status values.
- Fixed null pointer dereference in fpm_get_status() when the scoreboard copy fails.
Fileinfo
- Fixed bug GH-24289 (finfo::file() reports the wrong argument number for an invalid $filename).
FTP
- Fix double free in ext/ftp data_accept() on accept failure.
GD
- Fixed imagetruecolortopalette() error message.
Hash
- Fix GOST and Snefru digests of 512 MiB or more.
Intl
- Fixed IntlDateFormatter parse functions truncating an $offset below INT_MIN.
JSON
- Fixed json_encode() leaving the recursion guard set on objects with hooked properties after running out of memory while escaping a property name.
- Fixed json_encode() silently narrowing $depth values outside the int range, which wrapped to an unrelated depth.
- Fixed json_encode() continuing to encode after an array or object key failed to encode.
LDAP
- Fix crash in ldap_exop_sync() when $response_data is omitted.
MBString
- Fixed bug GH-23958 (truncated encoding names resolving to full names).
- Fixed out-of-bounds read in php_mb_rfc1867_getword() on a multibyte lead byte at the end of a multipart field name.
- Fixed negative mbstring.regex_stack_limit and mbstring.regex_retry_limit on 32bit platforms.
MySQLnd
ODBC
Opcache
- Fixed bug GH-24397 (Assertion failure when dumping JIT IR).
- Fixed tracing JIT returning a wrapped integer instead of a float on integer overflow after an integer was compared with a float or numeric-string literal.
- Fixed bug GH-20890 (Segfault in zval_undefined_cv with non-simple property hook with minimal tracing JIT).
- Fixed bug GH-17626 (JIT corrupts an opline handler when blacklisting a root trace at the opcache.jit_max_root_traces limit, causing spurious "Too few arguments" errors and crashes).
- Fix type inference of ADD_ARRAY_UNPACK with integer keys.
- Fix too wide type inference for ASSIGN_DIM_OP.
- Fix OSS-Fuzz #568005340 (FETCH_DIM_FUNC_ARG partial conversion).
- Fixed bug GH-24218 (Invalid opcode for count() of a literal array when SCCP is disabled).
- Fixed bug GH-24337 (JIT: segfault when decrementing a non-numeric string property).
- Fix SIGFPE on LONG_MIN % -1 with a constant divisor.
- Fixed bug GH-24388 (Tracing JIT: segfault when a trace runs out of side exits).
- Fixed bug GH-24391 (JIT switch on constant null takes default instead of case 0).
- Fixed bug GH-24206 (Tracing JIT loses loop-carried CV when its loop PHI is reloaded from memory).
- Fixed bug GH-24386 (JIT: register operand must be loaded before the typed reference check).
- Fixed bug GH-24437 (JIT: Fix OP_DATA read from an unwritten slot in zend_jit_assign_dim_op()).
- Fixed bug GH-24398 (JIT: minimal JIT segfault when a hooked property is passed to a run-time-resolved function).
- Fixed bug GH-24389 (Tracing JIT: type guard on entry of an inlined call exits with an uninitialized opline).
- Fixed use-after-free in JIT ASSIGN_DIM_OP when concatenating into an empty array element.
- Fixed bug GH-24396 (Assertion failure in zend_jit_def_reg() "reg forwarding" with chained Pi nodes).
- Fixed JIT treating an array as packed after a string key write turned it into a hash.
- Fixed bug GH-24436 (Tracing JIT: keep the SEND_VAL type guard after assigning to a reference).
- Fixed bug GH-17733 (System entropy does not take into account function order, resulting in wrong functions possibly called in different configurations).
- Fixed bug GH-24438 (Preserve indirect types in JIT side traces).
- Fixed bug GH-24577 (CE-cache flag on interned class name visible before map_ptr offset).
- Fixed tracing JIT losing register-allocated CVs when an interrupt is handled at the end of a loop trace.
- Fixed bug GH-24675 (function with >~1.7 MB of machine code corrupts JIT buffer accounting).
- Call orig_post_shutdown_cb().
- Fixed JIT segfault on switch over a string reference holding a non-string value.
- Fixed AArch64 JIT encoding of invalid logical immediates.
- Fixed unsound shift_left_overflows range when shift wraps.
- Fix block pass dropping ZEND_FAST_CALL OP2 definition.
- Fixed bug GH-23626 (orphaned temporaries cause leaks and assertions).
- Fix preloaded functions JIT-compiled on load being overwritten after restart.
- Fix opcache.interned_strings_buffer being 0 in threads started later (ZTS).
- Fixed potential infinite recursion/hang (HYBRID/TAILCALL respectively) when zend_interrupt_function resets EG(vm_interrupt).
- Fixed preloaded functions not JIT-compiled again after OPcache restart.
- Fixed bug GH-24988 (Incorrect opcode range check causes bugs with exceptions in function JIT).
- Fix opcache phar check.
OpenSSL
- Fixed build and test compatibility with OpenSSL 4.0 and 4.1.
- Fixed bug GH-24784 (openssl_pkcs7_read() and openssl_cms_read() overwrite certificates with CRLs).
PDO
- Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.
- Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a persistent connection.
PDO_Firebird
- Fixed bug GH-25006 (getColumnMeta() reads out of bounds for an out-of-range column index).
PDO_PGSQL
- Fixed a use-after-free when a persistent connection receives a notice after the request that called Pdo\Pgsql::setNoticeCallback() has ended.
PDO_SQLite
Phar
- Fixed bug GH-25093 (Phar::webPhar() redirect reads past the request URI).
- Fixed bug GH-25089 (Heap buffer over-read via crafted alias size in zip-based phar).
- Fixed bug GH-8469 (Phar::decompressFiles() and Phar::compressFiles() retain compressed contents after changing compression).
- Fixed bug GH-24740 (Oversized tar metadata exhausts the memory limit).
- Fixed bug GH-25090 (UAF in phar rename() of an entry with metadata).
- Fixed bug GH-25091 (UAF in phar rename() when source and destination are equal).
- Fixed bug GH-25092 (Double free in Phar::copy() on link and mounted entries).
- Fixed bug GH-24531 (Crash when modifying a zip-based phar whose file was renamed).
Phpdbg
- Fix wrong command names.
- Fixed bug GH-22480 (Use-after-free when re-watching an already-watched variable).
- Fixed over-read when watching a packed array element.
- Fixed double free of watch element chains.
Readline
- Fixed a crash in readline_info() when completion_append_character contains a non-ASCII byte.
SAPI
- Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
SOAP
- Fixed use of uninitialized func in do_request() on OOM bailout.
Session
- Validate whole session ID instead of stopping at the first NUL byte.
- Fixed session data loss in the files save handler when writing the session file fails after it was already truncated.
SimpleXML
- Fixed bug GH-24488 (GC double-frees the SimpleXMLElement properties table).
SPL
- Fixed bug GH-24264 (Unwind/GracefulExit discarded in spl_iterators.c).
Sockets
- Fixed bug GH-24748 (socket_set_option() crashes with declared object properties).
Standard
- Fixed memory leaks in checkdnsrr() and dns_check_record() on Windows.
- Fixed __unserialize() and __wakeup() being called for objects with a missing closing brace.
- Fixed bug GH-24308 (Request shutdown calls closelog() even when syslog was not opened by PHP).
- Fixed bug GH-24399 (usleep() and time_nanosleep() ignore queued APCs on Windows).
- Fixed chown() and lchown() failing to resolve user names in ZTS builds when getpwnam_r() needs a larger buffer.
- Fixed password_get_info() and password_needs_rehash() accepting malformed bcrypt costs.
- Fixed proc_open() null descriptor not being inheritable on Windows.
- Don't share the unserialize() context with enum autoloaders.
- Fixed bug GH-24373 (serialize() called from a destructor during var_hash destruction reuses the outer var_hash).
- Fixed bug GH-24552 (Case-insensitive substr_compare(), ksort() and krsort() are still locale-dependent).
- Fixed bug GH-24605 (var_export() crashes on deeply nested arrays and objects).
- Fix use-after-free in Randomizer::shuffleArray() when the engine throws.
Streams
Tidy
- Fixed tidy_repair_string(), tidy_repair_file(), tidy::repairString() and tidy::repairFile() rejecting null for $encoding.
Windows
- Fixed sapi_windows_cp_set() and sapi_windows_cp_conv() accepting a negative codepage on 32bit platforms.
- Fixed bug GH-25009 (GetConsoleTitleW() buffer size passed in bytes).
Zip
- Reject broken libzip versions 1.3.1, 1.7.0 and 1.12.0 during Windows configuration.
- Excluded libzip 1.12.0 due to a regression preventing additions and replacements in torrentzip archives.
- Fixed use-after-free when re-entering ZipArchive during destruction or a close warning, and rejected opening streams while closing.
- Fixed a use-after-free when a ZipArchive method that modifies the archive is called from a progress or cancel callback during close().