BCMath
- Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds n_scale.
Core
- Fixed out-of-bounds reads during automatic UTF-16/32 encoding detection.
- Fixed bug GH-15375 (Nested "yield from" skips items after a valid() or next() call on the inner generator).
- Fixed bug GH-23232 (lone namespace separator asks the autoloader for an empty class name).
- Fixed bug GH-23301 (Nested "yield from" yields a value twice when the middle generator delegates again).
DOM
- Fixed NamedNodeMap::getNamedItemNS() with an empty URI not matching the null namespace in spec-following mode.
- Fixed stale getElementsByClassName() and other node list caches after className/classList writes and attribute removals.
- Fixed a use-after-free when cloning a DOMNameSpaceNode after DOMDocument::xinclude().
- Fixed a crash in DOMXPath when a php:function callback receives a nodeset and a later callback returns a node from another document.
- Fixed bug GH-23331 (UAF when node_list_unlink() skips attribute children that still have a live wrapper).
- Fixed a use-after-free when Dom\Element::setAttributeNS() replaces the value of an attribute whose child still has a live wrapper.
GD
- Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the wrong argument in error messages.
FPM
- Fixed bug GH-19320 (FPM UID and GID overflow).
Intl
- Fixed grapheme_strpos() and grapheme_strrpos() with an empty needle returning UTF-16 offsets instead of grapheme offsets.
- Fixed a memory leak when dumping IntlCalendar instances.
- Fixed a memory leak when iterating IntlBreakIterator::getPartsIterator() results.
- Fixed a double-free when IntlGregorianCalendar construction fails after the ICU constructor adopts the TimeZone.
- Fixed bug GH-23094 (NumberFormatter parsing offsets use UTF-16 positions for UTF-8 strings).
- Fixed Locale::parseLocale() reading past a trailing '-' or '_'.
- Fixed grapheme_str_split() treating UBRK_DONE as a byte index.
- Fixed a leak in Locale::getKeywords() when a keyword value cannot be read.
- Fixed a use-after-free when IntlRuleBasedBreakIterator is constructed from compiled rules.
MBString
- Fixed mb_ereg_replace() emitting a NUL or out-of-bounds bytes in the replacement when a \k<name> backref has no closing delimiter.
ODBC
- Fixed odbc_field_len(), odbc_field_scale() and odbc_field_type() returning uninitialized memory when SQLColAttribute fails.
Opcache
- Fixed opcache.protect_memory race under ZTS.
- Fixed a tracing JIT crash when compiling a side trace for a method of a class that could not be stored in the inheritance cache.
- Fixed a crash when the huge page SHM remap discarded mappings outside the reserved address range.
PDO
- Fixed a leak when a persistent connection failed a liveness check with no other live PDO handle.
PDO_PGSQL
- Fixed PDO::CURSOR_SCROLL statements failing under lazy fetching (PDO::ATTR_PREFETCH => 0).
PDO Sqlite
- Fixed bug GH-20214 (PDO::FETCH_DEFAULT unexpected behavior with PDOStatement::setFetchMode).
Phar
Readline
- Fixed the interactive shell not waiting for the pager process to exit.
SOAP
- Fixed WSDL cache corruption when a soap:header defines headerfaults.
- Fixed stack overflow when parsing a WSDL with self-referential schema groups or attributeGroups.
Standard
- Fixed a segfault when a stream filter callback unsets StreamBucket::$data before re-attaching the bucket.
- Fixed an out-of-bounds read when following a redirect response with an empty Location header.
- Fixed read buffer compaction in php_stream_filter_flush().
- Fixed bug GH-22410 (Incorrect float behavior with large numbers).
- Fixed GH-23338 (fsockopen()/pfsockopen() ValueError reported wrong argument number for $timeout).
- Fixed bug GH-23576 (Next index for array returned from array_keys() is wrong).
SimpleXML
- Fixed writing to a dimension of the object returned by attributes() not creating the attribute.
- Fixed child elements of the element returned by SimpleXMLElement::addChild() not being accessible by property name when namespaces are involved.
Zip
SAPI
- Fixed fuzzer targets failing to build in isolation.
- Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo)