NEWS

PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP 8.3.21

- Core:
 . Fixed bug GH-18304 (Changing the properties of a DateInterval through
 dynamic properties triggers a SegFault). (nielsdos)
 . Fix some leaks in php_scandir. (nielsdos)

- Filter:
 . Fixed bug GH-18309 (ipv6 filter integer overflow). (nielsdos)

- GD:
 . Fixed imagecrop() overflow with rect argument with x/width y/heigh usage
 in gdImageCrop(). (David Carlier)
 . Fixed GH-18243 imagettftext() overflow/underflow on font size value.
 (David Carlier)

- Intl:
 . Fix reference support for intltz_get_offset(). (nielsdos)

- LDAP:
 . Fixed bug GH-17776 (LDAP_OPT_X_TLS_* options can't be overridden). (Remi)
 . Fix NULL deref on high modification key. (nielsdos)

- libxml:
 . Fixed custom external entity loader returning an invalid resource leading
 to a confusing TypeError message. (Girgias)

- OpenSSL:
 . Fix memory leak in openssl_sign() when passing invalid algorithm.
 (nielsdos)
 . Fix potential leaks when writing to BIO fails. (nielsdos)

- PDO Firebird:
 . Fixed GH-18276 - persistent connection - "zend_mm_heap corrupted"
 with setAttribute() (SakiTakamachi).

- SPL:
 . Fixed bug GH-18322 (SplObjectStorage debug handler mismanages memory).
 (nielsdos)

- Standard:
 . Fixed bug GH-18145 (php8ts crashes in php_clear_stat_cache()).
 (Jakub Zelenka)
 . Fixed bug GH-18209 (Use-after-free in extract() with EXTR_REFS). (ilutov)
 . Fixed bug GH-18212 (fseek with SEEK_CUR whence value and negative offset
 leads to negative stream position). (David Carlier)
 . Fix resource leak in iptcembed() on error. (nielsdos)

- Zip:
 . Fix uouv when handling empty options in ZipArchive::addGlob(). (nielsdos)
 . Fix memory leak when handling a too long path in ZipArchive::addGlob().
 (nielsdos)

10 Apr 2025, PHP 8.3.20

- Core:
 . Fixed bug GH-17961 (use-after-free during dl()'ed module class destruction).
 (Arnaud)
 . Fixed bug GH-15367 (dl() of module with aliased class crashes in shutdown).
 (Arnaud)
 . Fixed bug GH-13193 again (Significant performance degradation in 'foreach').
 (nielsdos)

- DOM:
 . Fix weird unpack behaviour in DOM. (nielsdos)
 . Fix xinclude destruction of live attributes. (nielsdos)

- Embed:
 . Fixed bug GH-8533 (Unable to link dynamic libphp on Mac). (Kévin Dunglas)

- Fuzzer:
 . Fixed bug GH-18081 (Memory leaks in error paths of fuzzer SAPI).
 (Lung-Alexandra)

- GD:
 . Fixed bug GH-17984 (calls with arguments as array with references).
 (David Carlier)

- Intl:
 . Fix locale_compose and locale_lookup to work with their array argument
 with values as references. (David Carlier)
 . Fix dateformat_format when the time is an array of references.
 (David Carlier)
 . Fix UConverter::transcode with substitutes as references. (David Carlier)

- Mbstring:
 . Fixed bug GH-17989 (mb_output_handler crash with unset
 http_output_conv_mimetypes). (nielsdos)

- Opcache:
 . Fixed bug GH-18112 (NULL access with preloading and INI option). (nielsdos)
 . Fixed bug GH-18107 (Opcache CFG jmp optimization with try-finally breaks
 the exception table). (nielsdos)

- PDO:
 . Fix memory leak when destroying PDORow. (nielsdos)

- SOAP:
 . Fixed bug #66049 (Typemap can break parsing in parse_packet_soap leading to
 a segfault) . (Remi)

- SPL:
 . Fixed bug GH-18018 (RC1 data returned from offsetGet causes UAF in
 ArrayObject). (nielsdos)

- Treewide:
 . Fixed bug GH-17736 (Assertion failure zend_reference_destroy()). (nielsdos)

- Windows:
 . Fixed bug GH-17836 (zend_vm_gen.php shouldn't break on Windows line
 endings). (DanielEScherzer)

13 Mar 2025, PHP 8.3.19

- BCMath:
 . Fixed bug GH-17398 (bcmul memory leak). (SakiTakamachi)

- Core:
 . Fixed bug GH-17623 (Broken stack overflow detection for variable
 compilation). (ilutov)
 . Fixed bug GH-17618 (UnhandledMatchError does not take
 zend.exception_ignore_args=1 into account). (timwolla)
 . Fix fallback paths in fast_long_{add,sub}_function. (nielsdos)
 . Fixed bug GH-17718 (Calling static methods on an interface that has
 `__callStatic` is allowed). (timwolla)
 . Fixed bug GH-17797 (zend_test_compile_string crash on invalid
 script path). (David Carlier)
 . Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown
 causes Use-After-Free). (CVE-2024-11235) (ilutov)

- DOM:
 . Fixed bug GH-17847 (xinclude destroys live node). (nielsdos)

- FFI:
 . Fix FFI Parsing of Pointer Declaration Lists. (davnotdev)

- FPM:
 . Fixed bug GH-17643 (FPM with httpd ProxyPass encoded PATH_INFO env).
 (Jakub Zelenka)

- GD:
 . Fixed bug GH-17772 (imagepalettetotruecolor crash with memory_limit=2M).
 (David Carlier)

- LDAP:
 . Fixed bug GH-17704 (ldap_search fails when $attributes contains a
 non-packed array with numerical keys). (nielsdos, 7u83)

- LibXML:
 . Fixed GHSA-wg4p-4hqh-c3g9 (Reocurrence of #72714). (nielsdos)
 . Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header
 when requesting a redirected resource). (CVE-2025-1219) (timwolla)

- MBString:
 . Fixed bug GH-17503 (Undefined float conversion in mb_convert_variables).
 (cmb)

- Opcache:
 . Fixed bug GH-17654 (Multiple classes using same trait causes function
 JIT crash). (nielsdos)
 . Fixed bug GH-17577 (JIT packed type guard crash). (nielsdos, Dmitry)
 . Fixed bug GH-17899 (zend_test_compile_string with invalid path
 when opcache is enabled). (David Carlier)
 . Fixed bug GH-17868 (Cannot allocate memory with tracing JIT). (nielsdos)

- PDO_SQLite:
 . Fixed GH-17837 ()::getColumnMeta() on unexecuted statement segfaults).
 (cmb)
 . Fix cycle leak in sqlite3 setAuthorizer(). (nielsdos)

- Phar:
 . Fixed bug GH-17808: PharFileInfo refcount bug. (nielsdos)

- PHPDBG:
 . Partially fixed bug GH-17387 (Trivial crash in phpdbg lexer). (nielsdos)
 . Fix memory leak in phpdbg calling registered function. (nielsdos)

- Reflection:
 . Fixed bug GH-15902 (Core dumped in ext/reflection/php_reflection.c).
 (DanielEScherzer)

- Sockets:
 . Fixed bug GH-17921 (socket_read/socket_recv overflow on buffer size).
 (David Carlier)

- Standard:
 . Fixed bug #72666 (stat cache clearing inconsistent between file:// paths
 and plain paths). (Jakub Zelenka)

- Streams:
 . Fixed bug GH-17650 (realloc with size 0 in user_filters.c). (nielsdos)
 . Fix memory leak on overflow in _php_stream_scandir(). (nielsdos)
 . Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit
 basic auth header). (CVE-2025-1736) (Jakub Zelenka)
 . Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location
 to 1024 bytes). (CVE-2025-1861) (Jakub Zelenka)
 . Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers
 without colon). (CVE-2025-1734) (Jakub Zelenka)
 . Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not
 handle folded headers). (CVE-2025-1217) (Jakub Zelenka)

- Windows:
 . Fixed phpize for Windows 11 (24H2). (bwoebi)
 . Fixed GH-17855 (CURL_STATICLIB flag set even if linked with shared lib).
 (cmb)

- Zlib:
 . Fixed bug GH-17745 (zlib extension incorrectly handles object arguments).
 (nielsdos)
 . Fix memory leak when encoding check fails. (nielsdos)
 . Fix zlib support for large files. (nielsdos)

13 Feb 2025, PHP 8.3.17

- Core:
 . Fixed bug GH-16892 (ini_parse_quantity() fails to parse inputs starting
 with 0x0b). (nielsdos)
 . Fixed bug GH-16886 (ini_parse_quantity() fails to emit warning for 0x+0).
 (nielsdos)
 . Fixed bug GH-17214 (Relax final+private warning for trait methods with
 inherited final). (ilutov)
 . Fixed NULL arithmetic during system program execution on Windows. (cmb,
 nielsdos)
 . Fixed potential OOB when checking for trailing spaces on Windows. (cmb)
 . Fixed bug GH-17408 (Assertion failure Zend/zend_exceptions.c).
 (nielsdos, ilutov)
 . Fix may_have_extra_named_args flag for ZEND_AST_UNPACK. (nielsdos)
 . Fix NULL arithmetic in System V shared memory emulation for Windows. (cmb)

- DOM:
 . Fixed bug GH-17500 (Segfault with requesting nodeName on nameless doctype).
 (nielsdos)

- Enchant:
 . Fix crashes in enchant when passing null bytes. (nielsdos)

- FTP:
 . Fixed bug GH-16800 (ftp functions can abort with EINTR). (nielsdos)

- GD:
 . Fixed bug GH-17349 (Tiled truecolor filling looses single color
 transparency). (cmb)
 . Fixed bug GH-17373 (imagefttext() ignores clipping rect for palette
 images). (cmb)
 . Ported fix for libgd 223 (gdImageRotateGeneric() does not properly
 interpolate). (cmb)

- Intl:
 . Fixed bug GH-11874 (intl causing segfault in docker images). (nielsdos)
 . Fixed bug GH-17469 (UConverter::transcode always emit E_WARNING on
 invalid encoding). (David Carlier)

- Opcache:
 . Fixed bug GH-17307 (Internal closure causes JIT failure). (nielsdos)
 . Fixed bug GH-17564 (Potential UB when reading from / writing to struct
 padding). (ilutov)

- PDO:
 . Fixed a memory leak when the GC is used to free a PDOStatment. (Girgias)
 . Fixed a crash in the PDO Firebird Statement destructor. (nielsdos)
 . Fixed UAFs when changing default fetch class ctor args. (Girgias, nielsdos)

- Phar:
 . Fixed bug GH-17518 (offset overflow phar extractTo()). (nielsdos)

- PHPDBG:
 . Fix crashes in function registration + test. (nielsdos, Girgias)

- Session:
 . Fix type confusion with session SID constant. (nielsdos)
 . Fixed bug GH-17541 (ext/session NULL pointer dereferencement during
 ID reset). (Girgias)

- SimpleXML:
 . Fixed bug GH-17409 (Assertion failure Zend/zend_hash.c:1730). (nielsdos)

- SNMP:
 . Fixed bug GH-17330 (SNMP::setSecurity segfault on closed session).
 (David Carlier)

- SPL:
 . Fixed bug GH-17463 (crash on SplTempFileObject::ftruncate with negative
 value). (David Carlier)

- Zip:
 . Fixed bug GH-17139 (Fix zip_entry_name() crash on invalid entry).
 (nielsdos)

16 Jan 2025, PHP 8.3.16

- Core:
 . Fixed bug GH-17106 (ZEND_MATCH_ERROR misoptimization). (ilutov)
 . Fixed bug GH-17162 (zend_array_try_init() with dtor can cause engine UAF).
 (nielsdos)
 . Fixed bug GH-17101 (AST->string does not reproduce constructor property
 promotion correctly). (nielsdos)
 . Fixed bug GH-17211 (observer segfault on function loaded with dl()).
 (Arnaud)
 . Fixed bug GH-17216 (Trampoline crash on error). (nielsdos)

- Date:
 . Fixed bug GH-14709 DatePeriod::__construct() overflow on recurrences.
 (David Carlier)

- DBA:
 . Skip test if inifile is disabled. (orlitzky)

- DOM:
 . Fixed bug GH-17224 (UAF in importNode). (nielsdos)

- Embed:
 . Make build command for program using embed portable. (dunglas)

- FFI:
 . Fixed bug #79075 (FFI header parser chokes on comments). (nielsdos)
 . Fix memory leak on ZEND_FFI_TYPE_CHAR conversion failure. (nielsdos)
 . Fixed bug GH-16013 and bug #80857 (Big endian issues). (Dmitry, nielsdos)

- Filter:
 . Fixed bug GH-16944 (Fix filtering special IPv4 and IPv6 ranges, by using
 information from RFC 6890). (Derick)

- FPM:
 . Fixed bug GH-13437 (FPM: ERROR: scoreboard: failed to lock (already
 locked)). (Jakub Zelenka)
 . Fixed bug GH-17112 (Macro redefinitions). (cmb, nielsdos)
 . Fixed bug GH-17208 (bug64539-status-json-encoding.phpt fail on 32-bits).
 (nielsdos)

- GD:
 . Fixed bug GH-16255 (Unexpected nan value in ext/gd/libgd/gd_filter.c).
 (nielsdos, cmb)
 . Ported fix for libgd bug 276 (Sometimes pixels are missing when storing
 images as BMPs). (cmb)

- Gettext:
 . Fixed bug GH-17202 (Segmentation fault ext/gettext/gettext.c
 bindtextdomain()). (Michael Orlitzky)

- Iconv:
 . Fixed bug GH-17047 (UAF on iconv filter failure). (nielsdos)

- LDAP:
 . Fixed bug GH-17280 (ldap_search() fails when $attributes array has holes).
 (nielsdos)

- LibXML:
 . Fixed bug GH-17223 (Memory leak in libxml encoding handling). (nielsdos)

- MBString:
 . Fixed bug GH-17112 (Macro redefinitions). (nielsdos, cmb)

- Opcache:
 . opcache_get_configuration() properly reports jit_prof_threshold. (cmb)
 . Fixed bug GH-17246 (GC during SCCP causes segfault). (Dmitry)

- PCNTL:
 . Fix memory leak in cleanup code of pcntl_exec() when a non stringable
 value is encountered past the first entry. (Girgias)

- PgSql:
 . Fixed bug GH-17158 (pg_fetch_result Shows Incorrect ArgumentCountError
 Message when Called With 1 Argument). (nielsdos)
 . Fixed further ArgumentCountError for calls with flexible
 number of arguments. (David Carlier)

- Phar:
 . Fixed bug GH-17137 (Segmentation fault ext/phar/phar.c). (nielsdos)

- SimpleXML:
 . Fixed bug GH-17040 (SimpleXML's unset can break DOM objects). (nielsdos)
 . Fixed bug GH-17153 (SimpleXML crash when using autovivification on
 document). (nielsdos)

- Sockets:
 . Fixed bug GH-16276 (socket_strerror overflow handling with INT_MIN).
 (David Carlier / cmb)
 . Fixed overflow on SO_LINGER values setting, strengthening values check
 on SO_SNDTIMEO/SO_RCVTIMEO for socket_set_option().
 (David Carlier)

- SPL:
 . Fixed bug GH-17225 (NULL deref in spl_directory.c). (nielsdos)

- Streams:
 . Fixed bug GH-17037 (UAF in user filter when adding existing filter name due
 to incorrect error handling). (nielsdos)
 . Fixed bug GH-16810 (overflow on fopen HTTP wrapper timeout value).
 (David Carlier)
 . Fixed bug GH-17067 (glob:// wrapper doesn't cater to CWD for ZTS builds).
 (cmb)

- Windows:
 . Hardened proc_open() against cmd.exe hijacking. (cmb)

- XML:
 . Fixed bug GH-1718 (unreachable program point in zend_hash). (nielsdos)

19 Dec 2024, PHP 8.3.15

- Calendar:
 . Fixed jdtogregorian overflow. (David Carlier)
 . Fixed cal_to_jd julian_days argument overflow. (David Carlier)

- COM:
 . Fixed bug GH-16991 (Getting typeinfo of non DISPATCH variant segfaults).
 (cmb)

- Core:
 . Fail early in *nix configuration build script. (hakre)
 . Fixed bug GH-16727 (Opcache bad signal 139 crash in ZTS bookworm
 (frankenphp)). (nielsdos)
 . Fixed bug GH-16799 (Assertion failure at Zend/zend_vm_execute.h:7469).
 (nielsdos)
 . Fixed bug GH-16630 (UAF in lexer with encoding translation and heredocs).
 (nielsdos)
 . Fix is_zend_ptr() huge block comparison. (nielsdos)
 . Fixed potential OOB read in zend_dirname() on Windows. (cmb)

- Curl:
 . Fixed bug GH-16802 (open_basedir bypass using curl extension). (nielsdos)
 . Fix various memory leaks in curl mime handling. (nielsdos)

- DOM:
 . Fixed bug GH-16777 (Calling the constructor again on a DOM object after it
 is in a document causes UAF). (nielsdos)
 . Fixed bug GH-16906 (Reloading document can cause UAF in iterator).
 (nielsdos)

- FPM:
 . Fixed GH-16432 (PHP-FPM 8.2 SIGSEGV in fpm_get_status). (Jakub Zelenka)

- GD:
 . Fixed GH-16776 (imagecreatefromstring overflow). (David Carlier)

- GMP:
 . Fixed bug GH-16890 (array_sum() with GMP can loose precision (LLP64)).
 (cmb)

- Hash:
 . Fixed GH-16711: Segfault in mhash(). (Girgias)

- Opcache:
 . Fixed bug GH-16770 (Tracing JIT type mismatch when returning UNDEF).
 (nielsdos, Dmitry)
 . Fixed bug GH-16851 (JIT_G(enabled) not set correctly on other threads).
 (dktapps)
 . Fixed bug GH-16902 (Set of opcache tests fail zts+aarch64). (nielsdos)

- OpenSSL:
 . Prevent unexpected array entry conversion when reading key. (nielsdos)
 . Fix various memory leaks related to openssl exports. (nielsdos)
 . Fix memory leak in php_openssl_pkey_from_zval(). (nielsdos)

- PDO:
 . Fixed memory leak of `setFetchMode()`. (SakiTakamachi)

- Phar:
 . Fixed bug GH-16695 (phar:// tar parser and zero-length file header blocks).
 (nielsdos, Hans Krentel)

- PHPDBG:
 . Fixed bug GH-15208 (Segfault with breakpoint map and phpdbg_clear()).
 (nielsdos)

- SAPI:
 . Fixed bug GH-16998 (UBSAN warning in rfc1867). (nielsdos)

- SimpleXML:
 . Fixed bug GH-16808 (Segmentation fault in RecursiveIteratorIterator
 ->current() with a xml element input). (nielsdos)

- SOAP:
 . Fix make check being invoked in ext/soap. (Ma27)

- Standard:
 . Fixed bug GH-16905 (Internal iterator functions can't handle UNDEF
 properties). (nielsdos)
 . Fixed bug GH-16957 (Assertion failure in array_shift with
 self-referencing array). (nielsdos)

- Streams:
 . Fixed network connect poll interuption handling. (Jakub Zelenka)

- Windows:
 . Fixed bug GH-16849 (Error dialog causes process to hang). (cmb)

21 Nov 2024, PHP 8.3.14

- CLI:
 . Fixed bug GH-16373 (Shebang is not skipped for router script in cli-server
 started through shebang). (ilutov)
 . Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data
 Processing in CLI SAPI Interface). (nielsdos)

- COM:
 . Fixed out of bound writes to SafeArray data. (cmb)

- Core:
 . Fixed bug GH-16168 (php 8.1 and earlier crash immediately when compiled
 with Xcode 16 clang on macOS 15). (nielsdos)
 . Fixed bug GH-16371 (Assertion failure in Zend/zend_weakrefs.c:646). (Arnaud)
 . Fixed bug GH-16515 (Incorrect propagation of ZEND_ACC_RETURN_REFERENCE for
 call trampoline). (ilutov)
 . Fixed bug GH-16509 (Incorrect line number in function redeclaration error).
 (ilutov)
 . Fixed bug GH-16508 (Incorrect line number in inheritance errors of delayed
 early bound classes). (ilutov)
 . Fixed bug GH-16648 (Use-after-free during array sorting). (ilutov)
 . Fixed bug GH-15915 (overflow with a high value for precision INI).
 (David Carlier / cmb)

- Curl:
 . Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if
 curl_multi_add_handle fails). (timwolla)

- Date:
 . Fixed bug GH-16454 (Unhandled INF in date_sunset() with tiny $utcOffset).
 (cmb)
 . Fixed bug GH-14732 (date_sun_info() fails for non-finite values). (cmb)

- DBA:
 . Fixed bug GH-16390 (dba_open() can segfault for "pathless" streams). (cmb)

- DOM:
 . Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
 (nielsdos)
 . Add missing hierarchy checks to replaceChild. (nielsdos)
 . Fixed bug GH-16336 (Attribute intern document mismanagement). (nielsdos)
 . Fixed bug GH-16338 (Null-dereference in ext/dom/node.c). (nielsdos)
 . Fixed bug GH-16473 (dom_import_simplexml stub is wrong). (nielsdos)
 . Fixed bug GH-16533 (Segfault when adding attribute to parent that is not
 an element). (nielsdos)
 . Fixed bug GH-16535 (UAF when using document as a child). (nielsdos)
 . Fixed bug GH-16593 (Assertion failure in DOM->replaceChild). (nielsdos)
 . Fixed bug GH-16595 (Another UAF in DOM -> cloneNode). (nielsdos)

- EXIF:
 . Fixed bug GH-16409 (Segfault in exif_thumbnail when not dealing with a
 real file). (nielsdos, cmb)

- FFI:
 . Fixed bug GH-16397 (Segmentation fault when comparing FFI object).
 (nielsdos)

- Filter:
 . Fixed bug GH-16523 (FILTER_FLAG_HOSTNAME accepts ending hyphen). (cmb)

- FPM:
 . Fixed bug GH-16628 (FPM logs are getting corrupted with this log
 statement). (nielsdos)

- GD:
 . Fixed bug GH-16334 (imageaffine overflow on matrix elements).
 (David Carlier)
 . Fixed bug GH-16427 (Unchecked libavif return values). (cmb)
 . Fixed bug GH-16559 (UBSan abort in ext/gd/libgd/gd_interpolation.c:1007).
 (nielsdos)

- GMP:
 . Fixed floating point exception bug with gmp_pow when using
 large exposant values. (David Carlier).
 . Fixed bug GH-16411 (gmp_export() can cause overflow). (cmb)
 . Fixed bug GH-16501 (gmp_random_bits() can cause overflow).
 (David Carlier)
 . Fixed gmp_pow() overflow bug with large base/exponents.
 (David Carlier)
 . Fixed segfaults and other issues related to operator overloading with
 GMP objects. (Girgias)

- LDAP:
 . Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932)
 (nielsdos)

- MBstring:
 . Fixed bug GH-16361 (mb_substr overflow on start/length arguments).
 (David Carlier)

- MySQLnd:
 . Fixed bug GHSA-h35g-vwh6-m678 (Leak partial content of the heap through
 heap buffer over-read). (CVE-2024-8929) (Jakub Zelenka)

- Opcache:
 . Fixed bug GH-16408 (Array to string conversion warning emitted in
 optimizer). (ilutov)

- OpenSSL:
 . Fixed bug GH-16357 (openssl may modify member types of certificate arrays).
 (cmb)
 . Fixed bug GH-16433 (Large values for openssl_csr_sign() $days overflow).
 (cmb)
 . Fix various memory leaks on error conditions in openssl_x509_parse().
 (nielsdos)

- PDO DBLIB:
 . Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing
 OOB writes). (CVE-2024-11236) (nielsdos)

- PDO Firebird:
 . Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter
 causing OOB writes). (CVE-2024-11236) (nielsdos)

- PDO ODBC:
 . Fixed bug GH-16450 (PDO_ODBC can inject garbage into field values). (cmb)

- Phar:
 . Fixed bug GH-16406 (Assertion failure in ext/phar/phar.c:2808). (nielsdos)

- PHPDBG:
 . Fixed bug GH-16174 (Empty string is an invalid expression for ev). (cmb)

- Reflection:
 . Fixed bug GH-16601 (Memory leak in Reflection constructors). (nielsdos)

- Session:
 . Fixed bug GH-16385 (Unexpected null returned by session_set_cookie_params).
 (nielsdos)
 . Fixed bug GH-16290 (overflow on cookie_lifetime ini value).
 (David Carlier)

- SOAP:
 . Fixed bug GH-16318 (Recursive array segfaults soap encoding). (nielsdos)
 . Fixed bug GH-16429 (Segmentation fault access null pointer in SoapClient).
 (nielsdos)

- Sockets:
 . Fixed bug with overflow socket_recvfrom $length argument. (David Carlier)

- SPL:
 . Fixed bug GH-16337 (Use-after-free in SplHeap). (nielsdos)
 . Fixed bug GH-16464 (Use-after-free in SplDoublyLinkedList::offsetSet()).
 (ilutov)
 . Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()). (ilutov)
 . Fixed bug GH-16478 (Use-after-free in SplFixedArray::unset()). (ilutov)
 . Fixed bug GH-16588 (UAF in Observer->serialize). (nielsdos)
 . Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed
 SplFileObject::__constructor). (Girgias)
 . Fixed bug GH-16589 (UAF in SplDoublyLinked->serialize()). (nielsdos)
 . Fixed bug GH-14687 (segfault on SplObjectIterator instance).
 (David Carlier)
 . Fixed bug GH-16604 (Memory leaks in SPL constructors). (nielsdos)
 . Fixed bug GH-16646 (UAF in ArrayObject::unset() and
 ArrayObject::exchangeArray()). (ilutov)

- Standard:
 . Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with
 bail enabled). (ilutov)

- Streams:
 . Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context
 might allow for CRLF injection in URIs). (CVE-2024-11234) (Jakub Zelenka)
 . Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with
 convert.quoted-printable-decode filter). (CVE-2024-11233) (nielsdos)

- SysVMsg:
 . Fixed bug GH-16592 (msg_send() crashes when a type does not properly
 serialized). (David Carlier / cmb)

- SysVShm:
 . Fixed bug GH-16591 (Assertion error in shm_put_var). (nielsdos, cmb)

- XMLReader:
 . Fixed bug GH-16292 (Segmentation fault in ext/xmlreader/php_xmlreader.c).
 (nielsdos)

- Zlib:
 . Fixed bug GH-16326 (Memory management is broken for bad dictionaries.)
 (cmb)

24 Oct 2024, PHP 8.3.13

- Calendar:
 . Fixed GH-16240: jdtounix overflow on argument value. (David Carlier)
 . Fixed GH-16241: easter_days/easter_date overflow on year argument.
 (David Carlier)
 . Fixed GH-16263: jddayofweek overflow. (cmb)
 . Fixed GH-16234: jewishtojd overflow. (nielsdos)

- CLI:
 . Fixed bug GH-16137: duplicate http headers when set several times by
 the client. (David Carlier)

- Core:
 . Fixed bug GH-16054 (Segmentation fault when resizing hash table iterator
 list while adding). (nielsdos)
 . Fixed bug GH-15905 (Assertion failure for TRACK_VARS_SERVER). (cmb)
 . Fixed bug GH-15907 (Failed assertion when promoting Serialize deprecation to
 exception). (ilutov)
 . Fixed bug GH-15851 (Segfault when printing backtrace during cleanup of
 nested generator frame). (ilutov)
 . Fixed bug GH-15866 (Core dumped in Zend/zend_generators.c). (Arnaud)
 . Fixed bug GH-16188 (Assertion failure in Zend/zend_exceptions.c). (Arnaud)
 . Fixed bug GH-16233 (Observer segfault when calling user function in
 internal function via trampoline). (nielsdos)

- DOM:
 . Fixed bug GH-16039 (Segmentation fault (access null pointer) in
 ext/dom/parentnode/tree.c). (nielsdos)
 . Fixed bug GH-16149 (Null pointer dereference in
 DOMElement->getAttributeNames()). (nielsdos)
 . Fixed bug GH-16151 (Assertion failure in ext/dom/parentnode/tree.c).
 (nielsdos)
 . Fixed bug GH-16150 (Use after free in php_dom.c). (nielsdos)
 . Fixed bug GH-16152 (Memory leak in DOMProcessingInstruction/DOMDocument).
 (nielsdos)

- JSON:
 . Fixed bug GH-15168 (stack overflow in json_encode()). (nielsdos)

- GD:
 . Fixed bug GH-16232 (bitshift overflow on wbmp file content reading /
 fix backport from upstream). (David Carlier)
 . Fixed bug GH-12264 (overflow/underflow on imagerotate degrees value)
 (David Carlier)
 . Fixed bug GH-16274 (imagescale underflow on RBG channels /
 fix backport from upstream). (David Carlier)

- LDAP:
 . Fixed bug GH-16032 (Various NULL pointer dereferencements in
 ldap_modify_batch()). (Girgias)
 . Fixed bug GH-16101 (Segfault in ldap_list(), ldap_read(), and ldap_search()
 when LDAPs array is not a list). (Girgias)
 . Fix GH-16132 (php_ldap_do_modify() attempts to free pointer not allocated
 by ZMM.). (Girgias)
 . Fix GH-16136 (Memory leak in php_ldap_do_modify() when entry is not a
 proper dictionary). (Girgias)

- MBString:
 . Fixed bug GH-16261 (Reference invariant broken in mb_convert_variables()).
 (nielsdos)

- OpenSSL:
 . Fixed stub for openssl_csr_new. (Jakub Zelenka)

- PCRE:
 . Fixed bug GH-16189 (underflow on offset argument). (David Carlier)
 . Fixed bug GH-16184 (UBSan address overflowed in ext/pcre/php_pcre.c).
 (nielsdos)

- PHPDBG:
 . Fixed bug GH-15901 (phpdbg: Assertion failure on i funcs). (cmb)
 . Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).
 (cmb)

- Reflection:
 . Fixed bug GH-16187 (Assertion failure in ext/reflection/php_reflection.c).
 (DanielEScherzer)

- SAPI:
 . Fixed bug GH-15395 (php-fpm: zend_mm_heap corrupted with cgi-fcgi request).
 (Jakub Zelenka, David Carlier)

- SimpleXML:
 . Fixed bug GH-15837 (Segmentation fault in ext/simplexml/simplexml.c).
 (nielsdos)

- Sockets:
 . Fixed bug GH-16267 (socket_strerror overflow on errno argument).
 (David Carlier)

- SOAP:
 . Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP
 headers in array form). (nielsdos)
 . Fixed bug #62900 (Wrong namespace on xsd import error message). (nielsdos)
 . Fixed bug GH-15711 (SoapClient can't convert BackedEnum to scalar value).
 (nielsdos)
 . Fixed bug GH-16237 (Segmentation fault when cloning SoapServer). (nielsdos)
 . Fix Soap leaking http_msg on error. (nielsdos)
 . Fixed bug GH-16256 (Assertion failure in ext/soap/php_encoding.c:460).
 (nielsdos)
 . Fixed bug GH-16259 (Soap segfault when classmap instantiation fails).
 (nielsdos)

- SPL:
 . Fixed bug GH-15918 (Assertion failure in ext/spl/spl_fixedarray.c).
 (nielsdos)

- Standard:
 . Fixed bug GH-16053 (Assertion failure in Zend/zend_hash.c). (Arnaud)
 . Fixed bug GH-15169 (stack overflow when var serialization in
 ext/standard/var). (nielsdos)

- Streams:
 . Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).
 (nielsdos)
 . Fixed bug GH-15980 (Signed integer overflow in main/streams/streams.c).
 (cmb)

- TSRM:
 . Prevent closing of unrelated handles. (cmb)

- Windows:
 . Fixed minimal Windows version. (cmb)

26 Sep 2024, PHP 8.3.12

- CGI:
 . Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection
 Vulnerability). (CVE-2024-8926) (nielsdos)
 . Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is
 bypassable due to the environment variable collision). (CVE-2024-8927)
 (nielsdos)

- Core:
 . Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
 (zeriyoshi)
 . Fixed bug GH-15515 (Configure error grep illegal option q). (Peter Kokot)
 . Fixed bug GH-15514 (Configure error: genif.sh: syntax error). (Peter Kokot)
 . Fixed bug GH-15565 (--disable-ipv6 during compilation produces error
 EAI_SYSTEM not found). (nielsdos)
 . Fixed bug GH-15587 (CRC32 API build error on arm 32-bit).
 (Bernd Kuhls, Thomas Petazzoni)
 . Fixed bug GH-15330 (Do not scan generator frames more than once). (Arnaud)
 . Fixed uninitialized lineno in constant AST of internal enums. (ilutov)

- Curl:
 . FIxed bug GH-15547 (curl_multi_select overflow on timeout argument).
 (David Carlier)

- DOM:
 . Fixed bug GH-15551 (Segmentation fault (access null pointer) in
 ext/dom/xml_common.h). (nielsdos)
 . Fixed bug GH-15654 (Signed integer overflow in ext/dom/nodelist.c).
 (nielsdos)

- Fileinfo:
 . Fixed bug GH-15752 (Incorrect error message for finfo_file
 with an empty filename argument). (DanielEScherzer)

- FPM:
 . Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered).
 (CVE-2024-9026) (Jakub Zelenka)

- MySQLnd:
 . Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb,
 Kamil Tekiela)

- Opcache:
 . Fixed bug GH-15661 (Access null pointer in
 Zend/Optimizer/zend_inference.c). (nielsdos)
 . Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
 (nielsdos)

- SAPI:
 . Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data).
 (CVE-2024-8925) (Arnaud)

- Standard:
 . Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c). (cmb)

- Streams:
 . Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).
 (cmb)

29 Aug 2024, PHP 8.3.11

- Core:
 . Fixed bug GH-15020 (Memory leak in Zend/Optimizer/escape_analysis.c).
 (nielsdos)
 . Fixed bug GH-15023 (Memory leak in Zend/zend_ini.c). (nielsdos)
 . Fixed bug GH-13330 (Append -Wno-implicit-fallthrough flag conditionally).
 (Peter Kokot)
 . Fix uninitialized memory in network.c. (nielsdos)
 . Fixed bug GH-15108 (Segfault when destroying generator during shutdown).
 (Arnaud)
 . Fixed bug GH-15275 (Crash during GC of suspended generator delegate).
 (Arnaud)

- Curl:
 . Fixed case when curl_error returns an empty string.
 (David Carlier)

- DOM:
 . Fix UAF when removing doctype and using foreach iteration. (nielsdos)

- FFI:
 . Fixed bug GH-14286 (ffi enum type (when enum has no name) make memory
 leak). (nielsdos, dstogov)

- Hash:
 . Fix crash when converting array data for array in shm in xxh3. (nielsdos)

- Intl:
 . Fixed bug GH-15087 (IntlChar::foldCase()'s $option is not optional). (cmb)

- Opcache:
 . Fixed bug GH-13817 (Segmentation fault for enabled observers after pass 4).
 (Bob)
 . Fixed bug GH-13775 (Memory leak possibly related to opcache SHM placement).
 (Arnaud, nielsdos)

- Output:
 . Fixed bug GH-15179 (Segmentation fault (null pointer dereference) in
 ext/standard/url_scanner_ex.re). (nielsdos)

- PDO_Firebird:
 . Fix bogus fallthrough path in firebird_handle_get_attribute(). (nielsdos)

- PHPDBG:
 . Fixed bug GH-13199 (EOF emits redundant prompt in phpdbg local console mode
 with libedit/readline). (Peter Kokot)
 . Fixed bug GH-15268 (heap buffer overflow in phpdbg
 (zend_hash_num_elements() Zend/zend_hash.h)). (nielsdos)
 . Fixed bug GH-15210 use-after-free on watchpoint allocations. (nielsdos)

- Random:
 . Fixed part of bug GH-15381, checking getrandom availability on solaris.
 (David Carlier)

- Soap:
 . Fixed bug #55639 (Digest autentication dont work). (nielsdos)
 . Fix SoapFault property destruction. (nielsdos)
 . Fixed bug GH-15252 (SOAP XML broken since PHP 8.3.9 when using classmap
 constructor option). (nielsdos)

- Standard:
 . Fix passing non-finite timeout values in stream functions. (nielsdos)
 . Fixed GH-14780 p(f)sockopen timeout overflow. (David Carlier)
 . Fixed GH-15653 overflow on fgetcsv length parameter. (David Carlier)

- Streams:
 . Fixed bug GH-15028 (Memory leak in ext/phar/stream.c). (nielsdos)
 . Fixed bug GH-15034 (Integer overflow on stream_notification_callback
 byte_max parameter with files bigger than 2GB). (nielsdos)
 . Reverted fix for GH-14930 (Custom stream wrapper dir_readdir output
 truncated to 255 characters). (Jakub Zelenka)

- Tidy:
 . Fix memory leaks in ext/tidy basedir restriction code. (nielsdos)

01 Aug 2024, PHP 8.3.10

- Core:
 . Fixed bug GH-13922 (Fixed support for systems with
 sysconf(_SC_GETPW_R_SIZE_MAX) == -1). (Arnaud)
 . Fixed bug GH-14626 (Fix is_zend_ptr() for huge blocks). (Arnaud)
 . Fixed bug GH-14590 (Memory leak in FPM test gh13563-conf-bool-env.phpt.
 (nielsdos)
 . Fixed OSS-Fuzz #69765. (nielsdos)
 . Fixed bug GH-14741 (Segmentation fault in Zend/zend_types.h). (nielsdos)
 . Fixed bug GH-14969 (Use-after-free in property coercion with __toString()).
 (ilutov)
 . Fixed bug GH-14961 (Comment between -> and keyword results in parse error).
 (ilutov)

- Dom:
 . Fixed bug GH-14702 (DOMDocument::xinclude() crash). (nielsdos)

- Fileinfo:
 . Fixed bug GH-14888 (README.REDIST.BINS refers to non-existing LICENSE).
 (cmb)

- Gd:
 . ext/gd/tests/gh10614.phpt: skip if no PNG support. (orlitzky)
 . restored warning instead of fata error. (dryabov)

- LibXML:
 . Fixed bug GH-14563 (Build failure with libxml2 v2.13.0). (nielsdos)

- Opcache:
 . Fixed bug GH-14550 (No warning message when Zend DTrace is enabled that
 opcache.jit is implictly disabled). (nielsdos)

- Output:
 . Fixed bug GH-14808 (Unexpected null pointer in Zend/zend_string.h with
 empty output buffer). (nielsdos)

- PDO:
 . Fixed bug GH-14712 (Crash with PDORow access to null property).
 (David Carlier)

- Phar:
 . Fixed bug GH-14603 (null string from zip entry).
 (David Carlier)

- PHPDBG:
 . Fixed bug GH-14596 (crashes with ASAN and ZEND_RC_DEBUG=1).
 (David Carlier)
 . Fixed bug GH-14553 (echo output trimmed at NULL byte). (nielsdos)

- Shmop:
 . Fixed bug GH-14537 (shmop Windows 11 crashes the process). (nielsdos)

- SPL:
 . Fixed bug GH-14639 (Member access within null pointer in
 ext/spl/spl_observer.c). (nielsdos)

- Standard:
 . Fixed bug GH-14775 (range function overflow with negative step argument).
 (David Carlier)
 . Fix 32-bit wordwrap test failures. (orlitzky)
 . Fixed bug GH-14774 (time_sleep_until overflow). (David Carlier)

- Streams:
 . Fixed bug GH-14930 (Custom stream wrapper dir_readdir output truncated to
 255 characters in PHP 8.3). (Joe Cai)

- Tidy: