diff --git a/.docker/dev/Dockerfile b/.docker/dev/Dockerfile
new file mode 100644
index 0000000000..af22cfceba
--- /dev/null
+++ b/.docker/dev/Dockerfile
@@ -0,0 +1,46 @@
+# Development Docker
+#
+# Provides the main runtime engine as well as tooling for running
+# during development
+#
+# NOTES:
+# - Does not copy and files in as it is expected to be handled via a mount
+
+FROM php:8.4-cli
+
+# Codebase doesn't have production flag so we negate it instead with
+# the DEVELOPMENT flag
+ENV DEVELOPMENT=1
+
+#
+# install additional development tooling
+#
+RUN apt update \
+ && apt-get install -y --no-install-recommends git unzip \
+ && rm -rf /var/lib/apt/lists/*
+
+#
+# Composer is required for dev dependencies
+#
+RUN php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" \
+ && php -r "if (hash_file('sha384', 'composer-setup.php') === 'c8b085408188070d5f52bcfe4ecfbee5f727afa458b2573b8eaaf77b3419b0bf2768dc67c86944da1544f06fa544fd47') { echo 'Installer verified'.PHP_EOL; } else { echo 'Installer corrupt'.PHP_EOL; unlink('composer-setup.php'); exit(1); }" \
+ && php composer-setup.php \
+ && php -r "unlink('composer-setup.php');" \
+ && mv composer.phar /usr/local/bin/composer
+
+#
+# node.js - used for socket.dev and other front-end tooling
+#
+RUN apt-get update && apt-get install -y curl gnupg ca-certificates \
+ && mkdir -p /etc/apt/keyrings \
+ && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
+ && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list \
+ && apt-get update && apt-get install -y nodejs \
+ && rm -rf /var/lib/apt/lists/*
+
+#
+# Global dependencies and tools brought in via npm
+#
+RUN npm install -g socket
+
+WORKDIR /app
diff --git a/.docker/prod/Dockerfile b/.docker/prod/Dockerfile
new file mode 100644
index 0000000000..67d1bae587
--- /dev/null
+++ b/.docker/prod/Dockerfile
@@ -0,0 +1,13 @@
+# "Production" Docker
+#
+# Provides the main runtime for PHP when deploying to a "Production"
+# or "Testing" environment that needs a full container using
+# the inbuilt server (not recommended).
+
+FROM php:8.4-cli
+
+# All of the files from the source location are copied into
+# the /app folder
+RUN mkdir /app
+WORKDIR /app
+COPY . /app
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000000..cc2efccdc9
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+# .dockerignore
+.git
+.gitmodules
+.gitattributes
+.idea
+build-deploy.sh
+/var/composer
diff --git a/.gitignore b/.gitignore
index 5fa5cd36ef..1f0110f0b9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,6 @@ node_modules/
/playwright-report/
/blob-report/
/playwright/.cache/
+/releases/[0-9]*_[0-9]*_[0-9]*.php
+/releases/[0-9]*_[0-9]*_[0-9]*_fr.php
+/releases/[0-9]*_[0-9]*_[0-9]*_win32.php
diff --git a/.router.php b/.router.php
index c204ce635e..f705e8d689 100644
--- a/.router.php
+++ b/.router.php
@@ -4,12 +4,38 @@
$filename = $_SERVER["PATH_INFO"] ?? $_SERVER["SCRIPT_NAME"];
-if (!file_exists($_SERVER["DOCUMENT_ROOT"] . $filename)) {
+$wantedPath = realpath($_SERVER["DOCUMENT_ROOT"] . $filename);
+if ($wantedPath === false || !str_starts_with($wantedPath, __DIR__ . '/')) {
require_once __DIR__ . '/error.php';
return;
}
+/**
+ * Unfortunately, we do not yet have a dedicated public folder, meaning the entire directory
+ * structure is exposed.
+ *
+ * These rules try and lock it down some.
+ */
+foreach ([
+ '.git/*',
+ '.docker/*',
+ '.devcontainer/*',
+ '.github/*',
+ 'backend/*',
+ 'bin/*',
+ 'data/*',
+ 'src/*',
+ 'tests/*',
+ 'var/*',
+ '*.inc', // do not allow any .inc files
+] as $testRule) {
+ if (fnmatch(__DIR__ . '/' . $testRule, $wantedPath, FNM_CASEFOLD)) {
+ header('HTTP/1.0 403 Access Denied');
+ die('Access Denied');
+ }
+}
+
/* This could be an image or whatever, so don't try to compress it */
ini_set("zlib.output_compression", 0);
return false;
diff --git a/ChangeLog-4.php b/ChangeLog-4.php
deleted file mode 100644
index c242baf2d7..0000000000
--- a/ChangeLog-4.php
+++ /dev/null
@@ -1,3882 +0,0 @@
-
-
-
-
-Version 4.4.9
-
-
-- Updated PCRE to version 7.7.
-- Fixed overflow in memnstr().
-- Fixed crash in imageloadfont when an invalid font is given.
-- Fixed open_basedir handling issue in the curl extension.
-- (mbstring.func_overload set in .htaccess becomes global).
-
-
-
-
-
-Version 4.4.8
-
-
-- Improved fix for MOPB-02-2007.
-- Fixed an integer overflow inside chunk_split(). Identified by Gerhard Wagner.
-- Fixed integer overlow in str[c]spn().
-- Fixed regression in glob when open_basedir is on introduced by fix.
-- Fixed money_format() not to accept multiple %i or %n tokens.
-- Added "max_input_nesting_level" php.ini option to limit nesting level of input variables. Fix for MOPB-03-2007.
-- Fixed INFILE LOCAL option handling with MySQL - now not allowed when open_basedir or safe_mode is active.
-- Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378).
-- (Fixed regression in imagearc with two equivelent angles).
-- (Recode crashes/does not work on amd64).
-- (segfault when an invalid color index is present in the image data).
-- (PHP settings leak between Virtual Hosts in Apache 1.3).
-- (OpenSSL init corrected in php5 but not in php4).
-
-
-
-
-
-Version 4.4.7
-
-
-- Fixed MOPB-33-2007 (PHP mail() Message ASCIIZ Byte Truncation).
-- Fixed MOPB-32-2007 (Double free inside session_decode()).
-- Fixed MOPB-26-2007 (mb_parse_str() can be used to activate register_globals).
-- Fixed MOPB-24-2007 (Fixed unallocated memory access/double free in in array_user_key_compare()).
-- Fixed MOPB-22-2007 (PHP session_regenerate_id() Double Free Vulnerability).
-- Fixed MOPB-21-2007 (An open_basedir/safe_mode bypass inside the compress.bzip2 wraper).
-- Fixed MOPB-8-2007 (XSS in phpinfo()).
-- Fixed CVE-2007-1001 (GD wbmp used with invalid image size).
-- Fixed CVE-2007-0455 (Buffer overflow in gdImageStringFTEx, used by imagettf function).
-- (Calling mcrypt_generic without first calling mcrypt_generic_init crashes).
-- (long session array keys are truncated).
-- (addcslashes unexpected behavior with binary input).
-- (cURL extension doesn't clean up the buffer of reused handle).
-- (possible crash in session when save_path is out of open_basedir).
-- (Binary data gets corrupted on multipart/formdata POST).
-- Fixed huge CPU usage in imagearc when used with large angles (libgd bug #74).
-- Fixed CRLF injection inside ftp_putcmd().
-
-
-
-
-
-Version 4.4.6
-
-
-- Updated PCRE to version 7.0.
-- Fixed segfault in ext/session when register_globals=On.
-- (segfault in cURL extension).
-- (possible cURL memory error).
-- (imagettftext() multithreading issue).
-- (ext/interbase compile failure).
-- (PHP fastcgi with PHP_FCGI_CHILDREN don't kill children when parent is killed).
-
-
-
-
-
-Version 4.4.5
-
-
-- Upgraded PEAR to 1.5.0.
-- Updated PCRE to version 6.7.
-- Moved extensions to PECL: ext/ovrimos
-- Added a meta tag to phpinfo() output to prevent search engines from indexing the page.
-- Backported a fix in the configure tests to detect the "rounding fuzz".
-- Backported fix for ext/imap compilation failure with recent c-client versions.
-- Fixed missing open_basedir check inside chdir() function.
-- (Compile fails when using GCC 4.1.1/binutils 2.17).
-- (pg_insert/pg_update do not allow now() to be used for timestamp fields).
-- (using autoconf 2.6x and --with-layout=GNU breaks PEAR install path).
-- (Using $this not in object context can cause segfaults).
-- (ext/dba doesn't check for db-4.5 and db-4.4 when db4 support is enabled).
-- (ftp_put() does not change transfer mode to ASCII).
-- (ftp_nlist() returns false on empty dirs).
-- (Allow building of curl extension against libcurl 7.16.0).
-- (curl_exec() with return transfer returns TRUE on empty files).
-- (Fixed a possible open_basedir bypass in tempnam()).
-- (ldap_connect causes segfault with newer versions of OpenLDAP).
-- (parse_url() fails if passing '@' in passwd).
-- (Calling undefined method prints insufficient error message).
-- (segfault when calling setlocale() in userspace session handler).
-- (constructor is not called for classes used in userspace stream wrappers).
-- (wddx_serialize_value() generates no wellformed xml).
-- (aggregate_methods_by_list fails to take certain methods).
-- (natcasesort() causes array_pop() to misbehave).
-- (CURLOPT_HEADERFUNCTION, couldn't set the function in the class).
-- (recursive array_walk causes segfault).
-
-
-There is a separate announcement available for this release.
-
-
-
-
-Version 4.4.4
-
-
-- Fixed memory_limit on 64bit systems.
-- Fixed overflow on 64bit systems in str_repeat() and wordwrap().
-- Disabled CURLOPT_FOLLOWLOCATION in curl when open_basedir or safe_mode are enabled.
-- Fixed a memory corruption error with an invalid foreach() call.
-- (xmlrpc_get_type() crashes PHP on objects).
-- (session_destroy() gives warning after session_regenerate_id()).
-- (reading past array in sscanf() leads to arbitary code execution).
-- (session_cache_expire()'s value does not match phpinfo's session.cache_expire).
-- (socket_select() and invalid arguments).
-- (disable_classes=Foobar causes disabled class to be called Foo).
-- (corrupted gif segfaults).
-- (Added missing safe_mode & open_basedir checks to imap_body()).
-- (number_format and problem with 0).
-
-
-There is a separate announcement available for this release.
-
-
-
-
-Version 4.4.3
-
-
-- Added control character checks for cURL extension's open_basedir/safe_mode checks.
-- Added overflow checks to wordwrap() function.
-- Added a check for special characters in the session name.
-- Improved safe_mode check for the error_log() function.
-- Updated PCRE to version 6.6.
-- Fixed handling of extremely long paths inside tempnam() function.
-- Fixed XSS inside phpinfo() with long inputs.
-- Fixed a possible buffer overflow inside create_named_pipe() for Win32 systems in libmysql.c.
-- (merge_php_config scrambles values).
-- (WDDX incorrectly encodes high-ascii characters).
-- (session_regenerate_id changes session_id() even on failure).
-- (Memory errors with a corrupt GIF file).
-- (Make PEAR install ignore open_basedir).
-- (Crashes when using an invalid colormap format).
-- (wddx does not build as a shared extension).
-- (foreach breaks static scope).
-- (Fixed check for special chars for http redirects).
-- (Added support for partial content fetching to the HTTP streams wrapper).
-- (node_list_wrapper_dtor segfault).
-- (Incorrect adding PHPSESSID to links, which contains \r\n).
-- (sleep() accepts negative values).
-- (Possible memory corruption in stream_select()).
-- (curl bypasses open_basedir restrictions).
-- (Memory leaks on duplicate cookies).
-- (unpack("H*hex", $data) is adding an extra character to the end of the string).
-- (fopen() crashes PHP when opening a URL).
-
-
-There is a separate announcement available for this release.
-
-
-
-
-Version 4.4.2
-
-
-- Added missing safe_mode/open_basedir checks into cURL extension.
-- Backported missing imap_mailcompose() fixes from PHP 5.x.
-- Prevent header injection by limiting each header to a single line.
-- Fixed possible XSS inside error reporting functionality.
-- Fixed Apache 2 regression with sub-request handling on non-linux systems.
-- (unpack() does not decode odd number of hexadecimal values).
-- ($EGREP not defined in configure).
-- (imap_mail_compose() crashes with multipart-multiboundary-email).
-- (whitespace following end of heredoc is lost).
-- (%{mod_php_memory_usage}n is not reset after exit).
-- (Multiple calls to getopt() may result in a crash).
-- (Fixed crash in Apache 2 SAPI when more then one php script is loaded via SSI include).
-- (mysql_field_type() doesn't handle NEWDECIMAL).
-- (wddx_deserialize() doesn't handle large ints as keys properly).
-- (Fix for bug breaks build with older curl).
-- (Multiple virtual() calls crash Apache 2 php module).
-- (Calling ob_flush after creating an ob callback causes segfault).
-- (stream_set_blocking(true) toggles, not enables blocking).
-- (configure does not find ldap_start_tls_s).
-- (Wrong fopen mode used in GD safe-mode checks).
-- , (key(),current() need to work by reference).
-- (socket_read() produces warnings on non blocking sockets).
-- (Apache2 crash with mod_rewrite).
-- (ZTS: Persistent resource destruct crashes when extension is compiled as shared).
-- (ImageTrueColorToPalette() crashes when ncolors is zero).
-- (SO_RECVTIMEO and SO_SNDTIMEO socket options expect integer parameter on Windows).
-- (the 5th argument of mb_send_mail does not work).
-- (Possible crash inside fopen http wrapper).
-- (mssql_bind() fails on input parameters).
-- (cURL needs CRYPTO_callback functions to prevent locking).
-- (mb_encode_mimeheader does not work for multibyte chars).
-- (Memory leak in xmlrpc_encode_request()).
-- (Crash when fetching some data types).
-- (crash in mssql_next result).
-- (crash when mssql_bind() is called more than once).
-- (ftp_login fails on some SSL servers).
-- (Remove MessageBox on win32 for E_CORE errors if display_startup_error is off).
-- (number_format() crashes with large numbers).
-
-
-
-There is a separate announcement available for this release.
-
-
-
-
-Version 4.4.1
-
-
-- Added missing safe_mode checks for image* functions and cURL.
-- Added missing safe_mode/open_basedir checks for file uploads.
-- Fixed a memory corruption bug regarding included files.
-- Fixed possible INI setting leak via virtual() in Apache 2 sapi.
-- Fixed possible crash and/or memory corruption in import_request_variables().
-- Fixed potential GLOBALS overwrite via import_request_variables().
-- Fixed possible GLOBALS variable override when register_globals are ON.
-- Fixed possible register_globals toggle via parse_str().
-- Added "new_link" parameter to mssql_connect(). Bug .
-- (--program-suffix and --program-prefix not included in man page names).
-- (preg_match_all(), named capturing groups, variable assignment/return => crash).
-- (ftp wrapper failures caused from segmented command transfer).
-- (Infinite recursion due to corrupt JPEG).
-- (ctype corrupts memory when validating large numbers).
-- (mb_send_mail does not fetch mail.force_extra_parameters).
-- (php -m exits with "error" 1).
-- (Possible crash inside pspell extension).
-- (unserialize() crashes with chars above 191 dec).
-- (on_modify handler not called to set the default value if setting from php.ini was invalid).
-- (date('W') do not return leading zeros for week 1 to 9).
-- (array_filter() crashes with references and objects).
-- (ob_gzhandler does not enforce trailing \0).
-- (memory usage remains elevated after memory limit is reached).
-- (+,- and . not supported as parts of scheme).
-- (assigning array element by reference causes binary mess).
-- (Numeric string as array key not cast to integer in wddx_deserialize()).
-- (arr[] as param to function is allowed only if function receives argument by reference).
-- (extract($GLOBALS,EXTR_REFS) crashes PHP).
-- (php script as ErrorDocument causes crash in Apache 2).
-- (array_map() fails to pass by reference when called recursively).
-- (Crash setting some ini directives in httpd.conf).
-- (Added detection for partially uploaded files).
-- (Using --with-regex=system causes compile failure).
-- (Warning with nested calls to functions returning by reference).
-- (crash when retrieving empty LOBs).
-- (cygwin version of setitimer doesn't accept ITIMER_PROF).
-- (open_basedir looses trailing / in the limiter).
-- (possible crash inside imap_mail_compose() function).
-- (xmlrpc_encode() segfaults with recursive references).
-- (copying a file into itself leads to data loss).
-- (array_splice on $GLOBALS crashes).
-- (PHP does not explicitly set mime type & charset).
-- (array_diff with $GLOBALS argument fails).
-- (ext/sesssion: catch bailouts of write handler during RSHUTDOWN).
-
-
-There is a separate announcement available for this release.
-
-
-
-
-Version 4.4.0
-
-
-- Added man pages for "phpize" and "php-config" scripts.
-- Added support for .cc files in extensions.
-- Added the sorting flag SORT_LOCALE_STRING to the sort() functions which makes them sort based on the current locale.
-- Changed sha1_file() and md5_file() functions to use streams instead of low level IO.
-- Fixed memory corruptions when using references in a wrong way.
-- Fixed memory corruption in pg_copy_from() in case the as_null parameter was passed.
-- Fixed memory corruption in stristr().
-- , (Segfault when using assignment by reference within function).
-- (Mangled error message when stream fails).
-- (segfault when CURL handle is closed in a callback).
-- (odbc_next_result does not signal SQL errors with 2-statement SQL batches).
-- (relax jpeg recursive loop protection).
-- (preg_replace(): magic_quotes_sybase=On makes 'e' modifier misbehave).
-- (shtool: insecure temporary file creation).
-- (Add a safemode/open_basedir check for runtime save_path change).
-- (Improved performance of bzdecompress() by several orders of magnitude).
-- (Don't send extraneous entity-headers on a 304 as per RFC 2616 section 10.3.5).
-- (socket errors cause memory leaks in php_strerror()).
-- ("make distclean" gives an error with VPATH build).
-- ("next month" was handled wrong while parsing dates).
-- (pcntl calls malloc() from a signal handler).
-- (Disabling session.use_cookies doesn't prevent reading session cookies).
-- (http redirects URLs are not checked for control chars).
-- (Oracle LDAP: ldap_get_entries invalid pointer).
-- (pg_get_notify() ignores result_type parameter).
-- (parse_url() does not handle scheme-only urls properly).
-- (temporary files not using plain file wrapper).
-- (General cookie overrides more specific cookie).
-- , (ext/odbc: Problems with 64bit systems).
-- (GMP functions break when second parameter is 0).
-- (segmentation fault when the stream with a wrapper is not closed).
-- (ext/crack.c fails to compile with cracklib-2.8.3).
-- (foreach() does not issue warning on unset array arg).
-- (pg_affected_rows() was defined when it was not available).
-- (ext/mssql: Error on module shutdown when called from activescript).
-- (Using register_shutdown_function() with invalid callback can crash PHP).
-- (ext/mysql: Unsatisfied symbol: ntohs with HP-UX).
-- (Possible crash inside imap_mail_compose, with charsets).
-- (Apache2: errors sent to error_log do not include timestamps).
-- (ext/gmp fails to compile in threadsafe mode).
-- (ext/swf/swf.c does not compile with gcc-3.4.x or newer).
-- (chunk_split() does not append endstr if chunklen is longer then the original string).
-- (File upload error - unable to create a temporary file).
-- (mb_encode_mimeheader() does not properly escape characters).
-- (xml_parser_free() in a function assigned to the xml parser gives a segfault).
-- (mysql compressed connection doesn't work under windows).
-- (ISAPI: Custom 5xx error does not return correct HTTP response message).
-- (php_std_date() uses short day names in non-y2k_compliance mode).
-- (Sideeffects caused by fix of bug ).
-- (Crash on shutdown after odbc_pconnect()).
-- (memory leaks when set_error_handler() is used inside error handler).
-- (Function defined in switch, crashes).
-- (unencoded spaces get ignored after certain tags).
-- (Need to use -[m]ieee option for Alpha CPUs).
-- (debug_backtrace is intermittently passing args).
-
-
-There is a separate announcement available for this release.
-
-
-
-
-
-
-Version 4.3.11
-
-
-- Added Oracle Instant Client support
-- Added checks for negative values to gmp_sqrt(), gmp_powm(), gmp_sqrtrem() and gmp_fact() to prevent SIGFPE
-- Changed phpize not to require libtool
-- Updated bundled libmbfl library (used for multibyte functions)
-- Fixed several leaks in ext/browscap and sapi/embed
-- Fixed several leaks in ext/filepro
-- Fixed build system to always use bundled libtool files
-- Fixed MacOSX shared extensions crashing on Apache startup
-- (segfault in bzopen() if supplied path to non-existent file).
-- (insert_before($node,NULL) does not return).
-- (Prevent using both --with-apxs2 and --with-apxs2filter).
-- (DOM crashing when attribute appended to Document).
-- (mb_convert_encoding ignores named entity 'alpha').
-- (msql_fetch_row() and msql_fetch_array() dropping columns with NULL values).
-- (set_h_errno() is redefined incompatibly).
-- (mb_decode_mimeheader() is case-sensitive to hex escapes).
-- (--disable-cli does not force --without-pear).
-- (*date('r') does not return RFC2822 conforming date string).
-- (exif_read_data() uses too low nesting limit).
-- (readline completion handler does not handle empty return values).
-- (getrusage() does not provide ru_nswap value).
-- (dbase_open() fails for mode = 1).
-- (parse_url() does not recognize http://foo.com#bar).
-- (dio_tcsetattr(): misconfigured termios settings).
-- (unserialize() float problem on non-English locales).
-- (OCILogin does not support password grace period).
-- (fgetcsv() problematic with "" escape sequences).
-- (crash in msg_send() when non-string is stored without being serialized).
-- (open_basedir uses path_translated rather then cwd for . translation).
-- (Possible infinite loop in imap_mail_compose()).
-- (Fixed crash in chunk_split(), when chunklen > strlen).
-- (False warning in unpack() when working with *).
-- (session_set_save_handler crashes PHP when supplied non-existent object ref).
-- (Memory leak in zend_language_scanner.c).
-- (unserialize broken on 64-bit systems).
-- ($GLOBALS can be overwritten via GPC when register_globals is enabled).
-- (curl POSTFIELDS crashes on 64-bit platforms).
-- (compile fails with gd 2.0.33 without freetype).
-- (highlight_file() trims new line after heredoc).
-- (missing safe_mode/open_basedir check in swf_openfile()).
-- (compile warning in url.c).
-- (COM object access is not working).
-- (imap_mail_compose() fails to generate correct output).
-- (When magic_guotes_gpc are enabled filenames with ' get cutoff).
-- (Possible crash in mysql_fetch_field(), if mysql_list_fields() was not called previously).
-- (mssql_query returns false on successful inserts and stored procedures).
-- , , , (Compile failure of zend_strtod.c).
-- (Fixed crash in overloaded objects).
-- (Better error message when c-client cannot be found).
-- (missing kerberos header file path with --with-openssl).
-- (var_export() does not output an array element with an empty string key).
-- (imageftbbox() does not use linespacing parameter).
-- (php_std_date() returns invalid formatted date if y2k_compliance is On).
-- (apache2filter: per request leak proportional to the full path of the request URI).
-- (-.1 like numbers are not being handled correctly).
-- (cURL functions bypass open_basedir).
-- (compiler warnings in libmbfl due to invalid type cast).
-- (incorrect character translations for some ISO8859 charsets).
-- (apache2handler: virtual() includes files out of sequence)
-- (odbc_next_result() doesn't bind values and that results in segfault).
-- (imagettftext() and imagettfbbox() accept too many parameters).
-- (printf() handles repeated placeholders wrong).
-- (width and height inverted for JPEG2000 files).
-- (mail(): use "From:" from headers if sendmail_from is empty).
-- (PHP sources pick wrong header files generated by bison).
-- (ini-file section parsing pattern is buggy).
-- (enabled debug causes bailout errors with CLI on AIX because of fflush() called on already closed filedescriptor).
-- (corrupt EXIF headers have unlimited recursive IFD directory entries).
-- (mb_strwidth() returns wrong width values for some handful chars).
-- (crash inside overload() function).
-- (FastCGI: stderr should be written in a FCGI stderr stream).
-- (partially incorrect utf8 to htmlentities mapping).
-- (Double \r problem on ftp_get in ASCII mode on Win32).
-- (Multiple OUs in x509 certificate not handled properly).
-- (Cannot use PATH_INFO fully with php isapi).
-
-
-There is a separate announcement available for this release.
-
-
-
-
-Version 4.3.10
-
-
-- Added the %F modifier to *printf to render a non-locale-aware representation of a float with the . as decimal separator.
-- Fixed a bug in addslashes() handling of the '\0' character.
-- Backported Marcus' foreach() speedup patch from PHP 5.x.
-- Fixed potential problems with unserializing invalid serialize data.
-- (Problem with non-existing iconv header file).
-- (Crash in fgetcsv() with negative length).
-- (Logic error mssql library checking).
-- (snmp extension does not build with net-snmp 5.2).
-- (allow popen() on *NIX to accept 'b' flag).
-- (Certain reference relations cannot be unserialized properly).
-- (Meaningful error message when upload directory is not accessible).
-- (imagefill does not set back alphablending mode).
-- (Problem handling exif data in jpeg images at unusual places).
-- (Ensure that temporary files created by GD are removed).
-- (oci8 persistent connection is deleted from hash if there was exclusive connection with the same credentials).
-- (Prevent infinite recursion in url redirection).
-- (array_multisort doesn't separate zvals before changing them).
-- (curl_getinfo() may crash in some situations).
-- (segfault when parsing ?getvariable[][ ).
-- (rename across filesystems loses ownership and permission info).
-- (segfault when using unknown/unsupported session.save_handler and/or session.serialize_handler).
-- (Prevent non-wbmp images from being detected as such).
-- (Possible crash in ctype_digit on large numbers).
-- (imagerectangle and imagefilledrectangle do work well with alpha channel, corners are drawn twice).
-- (Sybase date strings are sometimes not null terminated).
-- (get_current_user() crashes on Windows).
-- (did not detect IPV6 on FreeBSD 4.1).
-- (Possible crash inside ftp_get()).
-- (HTTP Authentication Issues).
-- (double free when openssl_csr_new fails)..
-- (Lost support for MS Symbol fonts).
-- (Circular references not properly serialized).
-- (NULL decimal separator is not being handled correctly).
-- (serialize() objects of incomplete class).
-
-
-
-There is a separate announcement available for this release.
-
-
-
-
-Version 4.3.9
-
-
-- GPC input processing fixes.
-- Implemented periodic PCRE compiled regexp cache cleanup, to avoid memory exhaustion.
-- Fixed bug with raw_post_data not getting set.
-- Fixed a file-descriptor leak with phpinfo() and other 'special' URLs.
-- Rewritten UNIX and Windows install help files.
-- Updated PCRE to provide better error handling in certain cases.
-- NSAPI: added "bucket" parameter to list of non-php.ini-keys of php4_execute for doing performance stats without warnings in server-log.
-- Fixed leap year checking with idate().
-- Fixed strip_tags() to correctly handle '\0' characters.
-- Fixed funny forking effect in FastCGI when PHP_FCGI_CHILDREN was not set.
-- (Possible crash inside php_shutdown_config()).
-- (isset crashes on arrays).
-- (mcal_fetch_event() allows 2nd argument to be optional).
-- (Added missing CURL authentication directives).
-- (fgetcsv() has problem parsing strings ending with escaped enclosures).
-- (highlighting code with HEREDOC produces invalid output).
-- (domxml_error segfaults another apache module).
-- (Use PHP's own tmpfile() implementation).
-- (Typo inside php.ini comments for mysql.trace_mode).
-- (extract(array, EXTR_REFS) misbehaves with elements referred twice or more times).
-- (Sanity check for wbmp detection).
-- (Uploaded files with ' or " in their names get their names truncated at those characters).
-- (imagecreatefromstring() crashes with external GD library).
-- (output_buffering+trans_sess_id can corrupt output).
-- (ctype_* functions missing validation of numeric string representations).
-- (imap_fetchbody() doesn't check message index).
-- (Zend constant warning uses memory after free).
-- (Potential double free in php_stat).
-- (strnatcmp() incorrectly handles whitespace).
-- (array sorting via user function/method does not validate it).
-- (extract() with EXTR_PREFIX_SAME prefixes empty strings).
-- (wordwrap() returns a boolean when passed empty string).
-- (overflow in array_slice(), array_splice(), substr, substr_replace(), strspn(), strcspn()).
-- (ibase: -1 returned as -0.000 for 64-bit scaled int).
-- (Implicit/Explicit array creation inconsistency when using Resources, Arrays, or Objects as indices).
-- (Setting of inikey's in obj.conf fails).
-- (Internal wrapper registry not thread safe).
-- (Apache 2 sapis do not export st_dev).
-- (strings beginning with "inf" improperly converted).
-- (Fixed mbstring config.m4 to work on OSes where test command does not support -e parameter).
-- (\0 in Authenticate header passed via safe_mode).
-- (WWW-Authentication header mangling with PCRE in safe_mode adds extra spaces).
-- (glob() does not work with relative paths on Windows).
-- (Proper glob() return value on Linux when there are no matches).
-- (sprintf incorrectly adding padding to floats).
-- (When multiple MySQL links are used default link is leaked).
-- (gmp_powm() does not work with hexadecimal string modulo represented as a string).
-- (Allocate enough space to store MSSQL data).
-- (mbstring_convert_variables() array separation problem).
-- (Allow bundled GD to compile against freetype 2.1.2).
-
-
-There is a separate announcement available for this release.
-
-
-
-
-Version 4.3.8
-
-
-- Fixed strip_tags() to correctly handle '\0' characters. (Stefan)
-- Improved stability during startup when memory_limit is used. (Stefan)
-- Replace alloca() with emalloc() for better stack protection. (Ilia)
-- Added missing safe_mode checks inside ftok and itpc. (Ilia)
-- Fixed address allocation routine in IMAP extension. (Ilia)
-- Prevent open_basedir bypass via MySQL's LOAD DATA LOCAL. (Ilia)
-
-
-There is a separate announcement available for this release.
-
-
-
-Version 4.3.7
-
-
-- Upgraded bundled GD library to 2.0.23. (Ilia)
-- Changed user error handler mechanism to relay to built-in error handler if it returns false. (Andrei)
-- Fixed command line escaping routines for win32. (Ilia)
-- Fixed problems with *printf() functions and '%f' formatting. (Marcus)
-- Fixed possible crash inside pg_copy_(to|from) function if delimiter is more then 1 character long. (Ilia)
-- Fixed crash inside cpdf_place_inline_image() when working with true-color images. (Ilia)
-- Fixed handling of return values from stored procedures in mssql_execute() with multiple result sets returned. (Frank)
-- Fixed logic bug in session_register() which allowed registering _SESSION and/or HTTP_SESSION_VARS. (Sara)
-- (xmlrpc_encode_request() incorrectly encodes chars in 200-210 range). (fernando dot nemec at folha dot com dot br, Ilia)
-- (informix connection id is not thread safe). (novicky at aarongroup dot cz, Ard)
-- (Problem building informix as a shared extension). (roques at mti dot ag, Ilia)
-- (Do not make hypot() available if not supported by libc). (Ilia)
-- (Allow negative start angle in imagearc and imagefilledarc). (Pierre)
-- (Problem with enclosed / in uploaded files). (Antony)
-- (wordwrap() wraps lines 1 character too soon). (Ilia)
-- (Possible unterminated loop inside _php_pgsql_trim_message()). (Ilia)
-- (glob() does not return error on Linux when it does not have permission to open the directory). (Ilia)
-- (incorrect resolving of relative paths by glob() in windows). (Ilia)
-- (run-tests tripped up by spaces in names). (Marcus)
-- (number_format() does not allow empty decimal separator). (Ilia)
-- (missing error constants in cURL extension). (Ilia)
-- (parse_url() not handling embedded IPv6 in URLs). (Sara)
-- (build problem for people using FreeType 2.1.0-2.1.2). (Ilia)
-- (Crash with drawing anti-aliased lines). (Derick)
-- (dba_open db3: Permission denied). (Marcus)
-- (sqlite_query() crashing apache on malformed query). (Ilia, Marcus)
-- (timeout duration too long in feof()/pfsockopen() liveness checks). (Wez)
-- (Do not force mysql.trace_mode to 0 on every request). (Ilia)
-- (greek letters in html to entity mapping not correct). (Derick)
-- (compile mssql extension with old versions of FreeTDS fails). (Frank)
-- (imagefilltoborder() stops the fill process prematurely). (Ilia)
-- (don't use php's pemalloc in ext/pcre). (Joe Orton)
-- (SSL: fatal protocol error when talking to IIS). (Wez)
-
-
-There is a separate announcement available for this release.
-
-
-
-
-Version 4.3.6
-
-
-- Updated bundled PDFLib library to version 5.0.3p1 in Windows distribution. (Edin)
-- Synchronized bundled GD library with GD 2.0.22. (Ilia)
-- Fixed a crash in multi-threaded environments when a thread is shutdown by the web server. (Stas)
-- Fixed a bug that prevented building of the GD extension against external GD lib 1.X. (Ilia, Edin, Nick Talbott).
-- (Session lifetime setting may leak between requests). (Ilia)
-- (configure craps out on trivial syntax error). (Derick)
-- (is_resource() returns TRUE for closed resources). (Derick)
-- (problems returning reference to a reference parameter). (Ilia)
-- (ftp_systype returns null on some ftp servers). (Ilia)
-- (default number of children to 8 when PHP_FCGI_CHILDREN is not defined). (Ilia)
-- (strtotime(+1 xxx) returns a wrong date/time). (Derick)
-- (domxml_xmltree crashes). (Rob)
-- (Get return value from a stored procedure not returning any result sets). (Frank)
-- (SCO Openserver doesn't have S_ISSOCK). (Wez)
-- (Make sure Money types are converted and returned correctly). (Frank)
-- (Fixed compilation bug inside php_sab_info.h). (Ilia)
-- (error_reporting() inside @ block fails to set error_reporting level). (Ilia)
-- (mktime issues on and around DST changeover). (Rasmus)
-- (Test Failures when compiled on 64-bit mode). (Ard, Derick)
-- (Bug Adding Default Charset to 'text/*' Content-Type Header). (Marcus)
-- (compile failure with cURL 7.11.1). (Ilia)
-- (Cannot serialize/unserialize non-finite numeric values). (Marcus)
-- (session.save_path default is bogus for win32). (Wez)
-- (Crash inside mssql extension when selecting many columns of type money). (Frank)
-- (error_handler and array index with function call). cschneid at cschneid dot com)
-
-
-There is a separate announcement available for this release.
-
-
-
-
-Version 4.3.5
-
-
-
-- Fixed possible crash using an invalid color index with a palette image in imagecolortransparent (Pierre)
-- Fixed php-cgi to not ignore command-line switches when run in a web context. This fixes our test cases allowing INI with GET sections to work (Rasmus)
-- Fixed getopt() so it works without $_SERVER (Rasmus, bfrance)
-- Fixed crash in php_ini_scanned_files() when no additional INI files were actually parsed. (Jon)
-- Fixed possible crashes inside socket extension, due to missing check inside allocation functions. (Ilia)
-- Fixed zero bytes memory allocation when no extra ini files are found in the --with-config-file-scan-dir specified directory. (Eric Colinet, Derick)
-- Changed "allow_url_fopen" php.ini option to be PHP_INI_SYSTEM. (Sara)
-- Improved the sybase_ct module: (Timm)
-
- - Added ability to define a message handler not only globally, but also per connection.
- - Added "sybct.packet_size" php.ini option.
- - Changed "sybct.login_timeout" php.ini option changeable at runtime.
- - Fixed memory leak in sybase_set_message_handler().
-
-- Synchronized bundled GD library with GD 2.0.17
-- Upgraded PCRE library to version 4.5. (Andrei)
-- Updated bundled PostgreSQL library to version 7.4 in Windows distribution. (Edin)
-- Added support for --program-prefix and --program-suffix configure options. (Jani)
-- Added a warning when creating temp stream fails with ftp_(n)list(). (Sara)
-- Fixed header handler in NSAPI SAPI module (header->replace was ignored, send_default_content_type now sends value from php.ini). (Uwe Schindler)
-- (Incorrect EOL translation by ftp_get() in ASCII mode). (Ilia)
-- (GCC 3.0.4 does not like __attribute__ directive). (Sascha)
-- (crash during shutdown when freeing persistent resources in ZTS mode). (Ilia)
-- (possible crashes in imagefilltoborder()). (Pierre)
-- (pre-initialization errors in ap2 handler are not being written to vhost error log). (Ilia)
-- (Corrected open_basedir resolving logic). (Ilia)
-- (broken http auth when safe_mode is on and PCRE is disabled). (Ilia)
-- (broken getaddrinfo() causes fsockopen() error). (Sara)
-- (htmlentities() does not handle BIG5 correctly). (Ilia, ywliu at hotmail dot com)
-- (bogus safe_mode error on nonexistent directories for chdir() and opendir() functions). (Ilia)
-- (base64_decode() does not handle extra padding). (Ilia, naish at klanen dot net)
-- (defined() returns wrong type). (Derick)
-- (wrong freetype include inside GD library). (Ilia)
-- (headers missing on flush() in apache 2 SAPIs). (Ilia)
-- (mbstring.func_overload should be system ini setting). (Ilia)
-- (unpack() misbehaves with 1 char string). (GeorgeS)
-- (Potential crash inside fopen_wrapper, while parsing response code). (Ilia)
-- (Modulus operator crashes PHP). (Derick)
-- (HEAD requests fail to return data). (Ilia)
-- (missing sapi_shutdown() in sapi/isapi causes memory leak). (Jani, msisolak at yahoo dot com)
-- (ftp extension relies on 32-bit longs). (Sara)
-- (Improved regex for pg_convert()). (benjcarson at digitaljunkies dot ca, Ilia)
-- (memory leak inside sscanf()). (Ilia)
-- (two crashes inside image2wbmp()). (Ilia)
-- (get_browser matches browscap.ini patterns incorrectly). (Jay)
-- (*printf() functions treat arguments as if passed by reference). (Ilia)
-- (iptcparse() function misses some fields). (Pierre)
-- (Interbase NUMERIC x.0 field returns empty string on 0). (Ard)
-- (Missing content_length initialization in apache 2 sapis). (Ilia, pdoru at kappa dot ro)
-- (userland stream wrapper segfaults on stream_write). (Moriyoshi)
-- (tzset() is not being called by PHP on startup). (Ilia, sagawa at sohgoh dot net)
-- (Possible floating point exception in gmp_powm()). (Ilia)
-- (crash inside gmp_hamdist()). (Jani)
-- (Compile Failure on Solaris 8). (Timm)
-- (broken CLOB support in oci8 extension). (Antony)
-- (Possible crash inside mb_strlen()). (Moriyoshi)
-- (CLI/CGI SAPI module variable name conflict). (Marcus)
-- (crash in sybase_connect() with 2 arguments). (Ilia)
-- (ints used instead of longs inside some GD functions). (Ilia)
-- (passing an array of form-fields to CURLOPT_POSTFIELDS does not work). (Ilia, Jani)
-- (fixed possible crash in apache2handler output code). (Ilia)
-- (Added "cgi.nph" php.ini option to allow forcing of the 'Status: 200' header that is not normally needed). (Ilia)
-- (64bit int/long confusion in preg_match*() functions). (Ilia)
-- (missing connection closure when connect fails in pgsql). (Ilia)
-- (rename() doesn't check the destination file against safe_mode/open_basedir). (Ilia)
-- (*printf() '+' modifier broken). (Jani)
-- (--with-openssl=shared build fails). (Jani)
-- (Segfault with Interbase module built as shared). (Ard)
-- (rand(min,max) always returns min when ZTS enabled). (Jani)
-- (Warning in xml.c). (Jani)
-- (preg_quote() does not escape \0). (Ilia)
-- (ext/imap: pam and crypt libraries missing when build as shared extension). (Jani)
-- (crash in imap_mime_header_decode() when no encoding is used). (Ilia)
-- (ext/ftp does not work as shared extension). (Jani)
-- (ORA-21301 in ocinewcollection() call). (Antony)
-- (problem with multiple references to the same variable with different types). (Ilia)
-- (pg_(update|delete) ignore PGSQL_DML_EXEC option). (Ilia)
-- (ob_flush() followed by output_reset_rewrite_vars() may result in data loss). (Ilia, scottmacvicar at ntlworld dot com)
-- (memory leak in mail() when to/subject contain only spaces). (Ilia)
-- (When included file has a parse error, terminate script execution). (Ilia)
-- (ext/interbase: Let DB handle NULL params). (Ard)
-- , (file operations return NULL instead of FALSE). (Wez, Ilia)
-- (FastCGI exits immediately with status 255). (Ilia, tcarter at noggin dot com dot au)
-- (CLI now overrides php.ini settings and switches off output buffering). (Edin)
-- (zend_fetch_list_dtor_id() doesn't check NULL strings). (Jani, Markus dot Lidel at shadowconnect dot com)
-- (Silent unterminated loop when length parameter for fgets(), fread() and fgetss() is 0). (Ilia)
-- (PHP can't find the MySQL socket on a case sensitive file system). (Derick)
-- (Certain characters inside strings incorrectly treated as keywords). (vrana [at] php [dot] net, Ilia)
-- (mbstring doesn't identify "binary" as a valid encoding). (nirva-php at ishiboo dot com, Moriyoshi)
-- (Added safety checks to ip2long()). (Ilia)
-- (open_basedir incorrectly resolved on win32). (Ilia, scottmacvicar at ntlworld dot com)
-- (mb_convert_variables() clutters variables beyond the references). (Moriyoshi)
-- (fixed look up for fonts in the current directory w/ZTS). (Ilia)
-- (pg_convert sets NULL incorrectly for character data types). (Ilia)
-- (Apache2 SAPIs implicitly disable Keep-Alive). (Ilia)
-- (ext/domxml: XSLT_NAMESPACE undeclared). (Christian)
-- (strtotime("this month") resolving to the wrong month). (Jani)
-- (ncurses5 has headers in PREFIX/include/ncurses/). (Jani)
-- (ext/session: Malformed HTTP dates headers). (Derick)
-- (ext/domxml: get_elements_by_tag_name() wildcard fails). (Rob Richards)
-- (Missing declaration of CRTSCTS in ext/dio/dio.c). (Jani)
-- (flock() does not force the "wouldblock" parameter to be passed by reference). (Wez)
-- (Incorrect handling of semicolons after heredoc). (Ilia)
-- (phpize + ext/bcmath -> compile error). (Jani)
-- (-lssl missing from LIBS). (Jani)
-- (var_dump(), var_export(), debug_zval_dump() not binary safe for array keys). (Ilia)
-- (--with-openssl=shared causes compile errors). (Jani)
-- (domxml_open_file() returns an empty error-Array). (Rob)
-- (MFH missing context options). (Ilia)
-- (error in thttpd SAPI installation). (Jani)
-- (Updated bundled OpenSSL DLLs in the Windows distribution to 0.9.7c). (Edin)
-- (Result set fetching broken around transactions). (Timm)
-- (parse_url() destroys strings that contain a character in range of \x80-\xff)). (Moriyoshi)
-- (crash in domxslt->process()). (Christian)
-- (rand() without srand() doesn't work with certain php.ini). (Jani)
-- (typo in ext/odbc/config.m4: DBMaker test fails). (Jani)
-- (flock() doesn't initialize the wouldblock argument). (Ilia)
-- (Fixed argument parsing for imageftbbox()). (Ilia)
-- (Unexpected data loss when opening dba file). (Marcus)
-- (escapeshellarg() uses wrong quotes on windows). (Ilia)
-- (gmp_random() leaks memory and does not produce random numbers). (Jani)
-- (ext/tokenizer: build as shared extension fails). (Jani)
-- (yp_first/yp_next do not specify correct key length). (Ilia)
-- ("getimagesize(): stream does not support seeking" when using remote files). (Marcus)
-- (crash in ibase_trans() on invalid link handle). (Ilia)
-- (strtotime() handling of M/F Y date format). (Ilia)
-- (iconv() not properly defined with libiconv). (Steph, Frank, Moriyoshi)
-- (Fixed handling of numeric keys in INI files). (Ilia)
-- (shtool availability check in phpize). (robbat2 at gentoo dot org, Ilia)
-- (Print the notice before modifying variable on type mismatch). (morten-bugs dot php dot net at afdelingp dot dk, Ilia)
-- (mbstring prints out wrong information on phpinfo()). (Moriyoshi)
-- (remove leftover local file when ftp_get/ftp_nb_get fails). (Ilia)
-- (Compile failure on GCC version 3.0.X). (Ilia)
-- (ext/mime_magic causes compile failure in ext/mssql). (Jani)
-- (gdImageColorClosestAlpha() returns incorrect results). (sprice at wisc dot edu, Ilia)
-- (memory leak if mcrypt_generic_deinit() is not called after every mcrypt_generic_init() call). (Ilia)
-- (Segfault on glob() without GLOB_NOCHECK or GLOB_NOMAGIC under *BSD platforms). (Moriyoshi)
-- (Random "cannot change the session ini settings" errors). (Jani, jsnajdr at kerio dot com)
-- (Make fgetcsv() binary safe). (Ilia, Moriyoshi)
-- (PostgreSQL error message include \n characters). (Marcus, Ilia)
-- (feof() not working correctly for sockets). (Wez)
-- (get_browser() -> PHP Fatal error: Nesting level too deep - recursive dependency?). (Uwe Schindler)
-- (Cannot open existing hash db3 file with write" ext/dba). (Marcus)
-- (php.ini settings "leak" from vhosts/.htaccess files). (Patch by: rover at tob dot ru)
-- (round() and number_format() give inconsistent results). (Ilia)
-- (calling ITypeInfo::Invoke with bogus params). (Wez)
-- (getimagesize () return incorrect values on bitmap (os2) files). (Marcus)
-- (sqlite_create_function with method and reference to $this). (Marcus).
-- (unsetting string as array causes a crash). (Sara)
-- (Unsetting string offsets crashes PHP). (Moriyoshi, Sara)
-- (extensions can't be loaded dynamically in Solaris/iPlanet). (Jani)
-- (date('T') outputs incorrect Time Zone). (Jani, scottmacvicar at ntlworld dot com)
-- (PHP crashes when executing a sql procedure without parameters). (Timm)
-- (Invalid response code when force-cgi-redirect safety mechanism is triggered). (Ilia, scottmacvicar at ntlworld dot com)
-- (Use of uninitialized pointer inside php_read()). (Ilia, uce at ftc dot gov)
-- (shutdown functions not executed if timed out). (Zeev)
-- (ftp_genlist/ANSI-tmpfile() fail w/ some platform). (Sara)
-
-
-There is a separate announcement available for this release.
-
-
-
-
-
-Version 4.3.4
-
-
-- Made MCVE extension available on win32. (Jani)
-- Upgraded bundled libfcgi and made FastCGI support viable on Win32. (Sascha)
-- Added apache_get_version() function. (Ilia)
-- Fixed disk_total_space() and disk_free_space() under FreeBSD. (Jon Parise)
-- Fixed crash bug when non-existing save/serializer handler was used. (Jani)
-- Fixed memory leak in gethostbynamel() if an error occurs. (Sara)
-- Fixed FastCGI being unable to bind to a specific IP. (Sascha)
-- Fixed multibyte regex engine to properly handle ".*" pattern under POSIX compatible mode. (K.Kosako <kosako at sofnec.co.jp>, Moriyoshi)
-- (Compile failure on MacOSX 10.3 Panther). (Marko, Dan)
-- (mail() modifies the to & subject arguments). (Ilia)
-- (Crash in error handler when 5th argument is modified). (Ilia)
-- (Possible crash in mime_content_type()). (Ilia)
-- (document->get_elements_by_tag_name with default xmlns). (Rob)
-- (Incorrect detection of safe_mode limited ini options). (Ilia)
-- (Crash of php.exe when xpath_eval of a namespace). (Rob)
-- (last key of multi-dimensional array passed via GPC not being escaped when magic_quotes_gpc is on). (Ilia)
-- (tzset() was not called to reset libc environment on request shutdown). (Wez)
-- (Make flock() return correct value when 3rd argument is used). (Ilia)
-- (parse_url() could not parse urls with empty port). (Ilia)
-- (ext/session: invalid "session.cookie_lifetime" makes session_start() to crash in win32). (Jani)
-- (Do not rtrim() of text fields fetched from mssql). (Ilia)
-- (Segfault with PHP and bison 1.875). (eggert@gnu.org, Marcus)
-- (ldap_get_option() crashes with unbound ldap link). (Jani)
-- (var_export does not escape ' & \ inside array keys). (Ilia)
-- (ext/ncurses: ncurses.h instead of curses.h with BSD). (Jani)
-- (Do not bail out when unable to chdir original dir on systems with broken getcwd()). (Ilia)
-- (ctype functions fail with non-ascii characters). (Moriyoshi)
-- (make ZTS build of ext/sybase compile). (Ilia)
-- (alloca() related issues on the Darwin platform). (Moriyoshi)
-- (extract($GLOBALS, EXTR_REFS) mangles $GLOBALS). (Moriyoshi)
-- (html_entity_decode() over-decodes <). (Moriyoshi)
-- (openssl configure check failed). (Jani)
-- (On flush() set headers_sent in apache2handler). (Ilia)
-- (str_replace() corrupts subarrays). (Sara)
-- (eregi() with non-ascii characters). (Moriyoshi)
-- (var_dump() hangs on Nan and INF). (Ilia)
-- (xslt_set_encoding() not detected correctly). (Jani)
-- (SNMP Session not closed on success). (Ilia, patch by: nesslage at mwsc dot edu)
-- (Make "make tests" to fail due to invalid include_path). (Ilia)
-- (HAVE_SNMP_PARSE_OID undefined with phpize build). (Jani)
-- (Incorrect handling of paths starting with "/" on win32 inside glob() function). (Ilia)
-- (Possible crash in apache2handler when zend_bailout called outside of zend_try {} block). (Ilia)
-- (ext/dbase: reverted fix for bug ). (Vlad)
-- (checkdate() incorrectly handles floats). (Ilia)
-- (ldap_explode_dn() crashes when passed invalid dn). (Sara, patch by: mikael dot suvi at trigger dot ee)
-- (pcre_match_all() crashes when passed only 2 parameters). (Jani)
-- (ext/informix: bogus -469 error from ifx_query()). (Jani, patch by: denisov at kubsu dot ru)
-- (ext/cpdf: compile failure with bundled GD)
-- (fix copying of stdin using copy() function). (Ilia)
-- (ext/informix: lvarchar not supported in win32). (Jani)
-- (ext/pgsql: open transactions not closed when script ends). (Marcus)
-- (ob_gzhandler(): typo in sapi_add_header_ex() call). (Jani)
-- (unserialize() crashes with invalid data). (Jani)
-- (sscanf() does not work with %X). (Jani)
-- ("make install" fails with --enable-short-tags). (Jani)
-- (is_dir() gives warning on FreeBSD). (Jani)
-- (Possible body corruption & crash in win32 mail()). (Ilia)
-- (Possible infinite loop inside _php_stream_write()). (Ilia)
-- (FTP_ASCII mode behaving like binary from Win->Unix). (Sara)
-- (php -m crashes when zend extensions are loaded). (Stas)
-- (Crash with WDDX serializer). (Sascha, Jani)
-- (QNX6: php_ini.c:414: 'alphasort' undeclared). (Jani)
-- (ext/ftp: NLST failure leads to crash on exit). (Sara, Rob)
-- (Output correct EOL to error_log). (Ilia)
-- (ftp_fopen_wrapper not RFC compliant). (Sara)
-- ("deflate" compressed pages had a gzip header). (Stefan)
-- (image.c compile failure with AIX). (Marcus)
-- (WDDX serializer handler missing in win32). (Jani)
-- (Possible crash when fetching field names in pgsql). (Ilia)
-- (Added more stringent checks on bzopen() mode). (Ilia)
-- (unlock session files on win32 before closing them). (Ilia)
-- (Compile failure with gettext 0.12.x). (Jani)
-- (zlib.output_compression overrides Vary header). (Stefan)
-- (ext/domxml: Attributes via append_child not supported). (Melvyn)
-- (Wrong Apache version shown in phpinfo() output). (Jani)
-- (ifx_close() leaves open session). (nobbie@php.net)
-- (realpath() returns invalid results for non-existent paths). (Ilia)
-
-There is a separate announcement available for this release.
-
-
-
-
-Version 4.3.3
-
-
-- Synchronized bundled GD library with GD 2.0.15. (Ilia)
-- Upgraded the bundled Expat library to version 1.95.6. (Jani)
-- Upgraded the bundled PCRE library to version 4.3. (Andrei)
-- Improved the engine to use POSIX/socket IO where feasible. (Sascha)
-- Improved the NSAPI SAPI module (Uwe Schindler)
-
- - php4_init (magnus.conf): new parameter to set alternate path to php.ini. (php_ini="/path/to/php.ini")
- - php4_execute (obj.conf): support for additional php.ini values. Allows different settings per virtual server. (See sapi/nsapi/nsapi-readme.txt for more information)
- - Added support for virtual().
- - Added nsapi_request_headers() and nsapi_response_headers() with aliases for apache compatibility.
- - Added "nsapi.read_timeout" php.ini option.
- - Synced $_SERVER variables to be similar to Apache variables.
- - Added possibility to use PHP to generate HTTP error pages (404 Not Found..)
- - Added possibility to use PHP to generate directory listings for directories without index.html
-
-
-- Improved the IMAP extension (Ilia)
-
- - Added imap_timeout() function. (bug )
- - Added optional 'charset' parameter to imap_search() and imap_sort(). (bug )
-
-
-- Improved the InterBase extension (Daniela)
-
- - Added transaction constants: IBASE_REC_VERSION, IBASE_REC_NO_VERSION, IBASE_WRITE, IBASE_WAIT and IBASE_CONCURRENCY. (bugs , )
- - Made numeric/decimal datatype handling work on any platform.
-
-
-- Added DBA handler 'inifile' to support ini files. (Marcus)
-- Added a "DEBUG" note to 'php -v' output when --enable-debug is used. (Derick)
-- Added long options into CLI & CGI (e.g. --version). (Marcus)
-- Added a new parameter to preg_match*() that can be used to specify the starting offset in the subject string to match from. (Andrei)
-- Fixed possible integer overflows in:
-
- - base64_encode(). (Moriyoshi)
- - bundled GD library. (Ilia)
-
-
-- Fixed "mysql.connect_timeout" php.ini option to be settable with ini_set(). (Rasmus)
-- Fixed ext/yaz to not log if "yaz.log_file" php.ini option is not set. (Adam)
-- Fixed a bug in bundled libmysql (mysql bug 564). (Georg)
-- Fixed ext/exif to honor "magic_quotes_runtime" php.ini option. (Marcus)
-- Fixed FastCGI IIS document root problem. (Shane)
-- Fixed corruption of multibyte character including 0x5c as second byte in multipart/form-data. (Rui)
-- Fixed possible crash in imagerotate() when an invalid color index is used for background color. (Pierre-Alain Joye)
-- Fixed a bug that under certain circumstances could invalidate safe_mode. (Ilia)
-- Fixed certificate version and allowed setting of the serial number in openssl_csr_sign(). (Stefan Roehrich)
-- Fixed each() to be binary safe for keys. (Zeev)
-- (Various leaks due to non-freed queries). (Ilia)
-- (Make refer check not dependant on register_globals). (Ilia)
-- (odbc_fetch_array() may mangle numeric fields). (Ilia)
-- (header("Location:") changing HTTP status). (Marcus)
-- (Possible infinite loop inside SendText()). (Ilia)
-- (rand() & mt_rand() seed RNG every call). (Jani)
-- (external libexpat conflicts with bundled libexpat). (Jani)
-- (array_reduce() uses first element as default running total). (Ilia)
-- (Revert mysql_select_db optimization). (Ilia)
-- (Incorrect handling of 404s). (Ilia, Justin)
-- (ob_flush() needlessly destroys output handler). (Ilia)
-- (ext/fdf not linked properly as shared extension). (Jani)
-- (Bad random numbers with ZTS builds on Solaris). (Ilia)
-- (inconsistent behavior of shuffle() & array_multisort()). (Ilia, Jani)
-- (variables_order and gpc_order being ignored). (Ilia)
-- (incorrect handling of / inside open_basedir). (Ilia)
-- (methods misidentified as constructors). (Ilia)
-- (ob_gzhandler overrides Vary header). (Ilia)
-- (--enable-zend-multibyte causes random segfaults with ZTS). (fujimoto)
-- (foreach($ar as $key => $val), $key not binary safe). (Zeev)
-- (non-default SNMP port number not working). (Jani)
-- (Unhandled "uniqueidentifier" field type). (Ilia, s.sonnenberg[at]coolspot.de)
-- (Crash when $obj->{0} is used). (Zeev)
-- (\n. sequences were not being escaped). (Ilia)
-- (var_export() and var_dump() can not output large floats). (Marcus)
-- (FreeBSD select() does not like large microseconds values). (Mirco Bauer).
-- (ext/domxml: segfault when using replace node across different docs). (Rob Richards)
-- (Rewrite of the imagefill() function). (Pierre-Alain Joye)
-- (NULL related crash in session extension). (Sascha)
-- (debug_backtrace() crashes if $this set to null). (Jani)
-- (parse_url() incorrectly handling certain file:// based schemas). (Ilia)
-- (make fclose() respect refcount on the resource). (Wez, Ilia)
-- (apache2 compile misses some include directories). (Jani)
-- (ext/mysql: crash when retrieving data from unbuffered result after the original connection has been changed). (Ilia)
-- (aggregate_methods_by_list() does not increment refcount).
-- (file_exists() warning on non-existent files when open_basedir is used). (Ilia)
-- (base64_decode() does not skip 0xF0-0xFF characters). (gereon.steffens[at]onvista.de, Ilia)
-- (Fixed memory leak inside pg_ping()). (Ilia)
-- (fdf_add_doc_javascript() not available on Windows). (Edin)
-- (ibase_blob_get() overflow). (Ard)
-- (missing variable initialization in bundled gd). (Ilia)
-- (range() didn't handle numeric strings correctly). (Ilia)
-- (not detecting assume_default_colors - typo). (Sara)
-- (Invalid recursion detection in array_merge_recurcive()). (Ilia)
-- (Status not set correctly after flush() in Apache 2). (Ilia)
-- (gdImageRotate270 incorrectly use x parameter for y axis). (tom@gksystems.com, Ilia)
-- (crash in imap_fetch_overview() & imap_rfc822_write_address()). (Ilia)
-- (workaround for a gcc bug affecting round()). (Marcus, Ilia)
-- (serialize() missing 0 after the . on scientific notation). (Marcus, Ilia)
-- (scientific notation broken in *printf()). (Ilia)
-- (ncurses_del_panel() causes segfault). (Georg)
-- (Integer overflow failure with GCC/x86 for *=). (Sascha)
-- (Reading raw post message by php://input failed). (Jani)
-- (FastCGI handling of file not found). (Shane)
-- (Problem with register_globals & arrays). (Ilia)
-- (constants in static initializers clobbered by inheritance). (Wez, Zend Engine)
-- (ext/interbase: fail to select and fetch). (Ard)
-- (make rename() work across partitions on *nix). (Ilia)
-- (Invalid CSS in phpinfo() output). (Ilia)
-- (NULL in CGI header output). (Shane)
-- (Proper handling of NULLs in odbc_result, odbc_fetch_into and odbc_result_all). (Ilia)
-- (Fixed a check for mbfilter_ru.h). (aleks@m2media.ru, Ilia)
-- (sprintf() decimal specifiers problem). (Moriyoshi)
-- (Missing input validation for flags parameter). (Ilia)
-- (broken imagecopymerge()). (Pierre-Alain Joye)
-- (Spaces were not being stripped from Bcc header). (Ilia)
-- (imagerotate() problems with limited pallet, the function will always return true color image from now on). (Pierre-Alain Joye)
-- (mysql_connect(): disable local infile option if php.ini option "open_basedir" is set). (Georg)
-- (In FreeBSD glob() gives wrong result when pattern not found). (Hartmut)
-- (Coredump on startup with Oracle 9+). (Edin)
-- (fake values returned when OID value is an empty string). (Jani)
-- (FastCGI socket listening). (Shane)
-- (exit code lost when exit() called from register_shutdown_function()). (Ilia)
-- (added Dbase2 version check). (Vlad Krupin)
-- (Potential Stack overflow in zendlex). (Wez)
-- (hash position of static arrays not being reset). (Ilia)
-- , (aggregate() related leaks and crashes). (Andrei)
-- (Ack() inside win32/sendmail.c may stall in certain situations). (Ilia)
-- (ob_start() did not work with create_function() callbacks). (Marcus)
-- (Cascading assignments to strings with curly braces broken). (Stas)
-- (References inside $_SESSION not being handled). (Ilia)
-- (Possible crash when memory_limit is reached and output buffering in addition to session.use_trans_sid is used). (Ilia)
-- (Apache2 sapis do not detect aborted connections). (Ilia)
-- (workaround for unusual realpath() on AIX & Tru64). (Ilia)
-- (serialize() mangles objects with __sleep). (Ilia)
-- (strange behavior of mixed type in array-keys). (Marcus)
-- (Threading issue on HP-UX). (Roshan Naik, Andi, Moriyoshi)
-- (version_compare() does not support "p" as suffix). (Stefan Walk)
-- (Apache2: "ErrorDocument xxx /error.php" broken). (Jani)
-- (-s -w modes with php-cli cause php to hang). (Ilia)
-- (putenv("VAR=") does not empty VAR on win32). (Zeev)
-- (blob_add() has max limit of 64k). (Ard)
-- (escapeshellcmd() can now handle quoted arguments). (Ilia)
-- (pthreads bug workaround). (timo.teras[at]iki.fi)
-- (strtotime not handling "M d H:i:s Y" format). (Ilia)
-- (ibase_query(), ibase_execute() mangled passed parameters). (Jani)
-- (crash in _php_ibase_error() after request shutdown). (Ard)
-
-More information on this release on our Releases page.
-
-
-
-
-Version 4.3.2
-
-
-- Syncronized bundled GD library with GD 2.0.12. (Ilia)
-- Removed support for GDLIB version 1.x.x (php_gd.dll) on Windows. (Edin)
-- Enabled read-only GIF support in the bundled GDLIB (php_gd2.dll) on Windows. (Sebastian, Edin)
--
- Improved dba extension (Marcus)
-
- - Added support for internal error handling of Berkeley db libraries.
- - Disallowed Berkeley db versions 4.1.0 to 4.1.24 due to locking problems.
- - Disallowed linkage of Berkeley db submodules against libraries with different major versions.
- - Disallowed configuring of more than one Berkeley db handler.
- - Reenabled dba_popen() with new persistent STDIO streams.
-
-
-- Added a new Apache 2.0 SAPI module (sapi/apache2handler) based on the old version (sapi/apache2filter). (Ian Holsman, Justin Erenkrantz)
-- Added "disable_classes" php.ini option to allow administrators to disable certain classes for security reasons. (Harald)
-- Added man page for CLI version of PHP. (Marcus)
-- Added --clean option into phpize. (Jani)
-- Added --ldflags option into php-config. (Jani)
-- Added imagesavealpha() and imageistruecolor() functions. (Pierre)
-- Added XBM support for bundled GD library. (Marcus)
-- Added session_regenerate_id() function. (Sascha)
-- Added zlib_get_coding_type() function which returns the coding type used for output compression. (Moriyoshi)
-- Added OCIPasswordChange() which allows renewing expired Oracle users. (Maxim)
-- Added memory_get_usage(). Only available when PHP is configured with --enable-memory-limit. (Andrey)
-- Added improved JPEG 2000 support for getimagesize(). (Marcus, Adam Wright)
-- Added XBM and WBMP support for getimagesize(). (Marcus)
-- Added KOI8-R, CP866, and CP1251 support for htmlentities(). (Antony Dovgal, Moriyoshi)
-- Added domdocument->free() to free XML-documents from memory. (Rob Richards)
-- Fixed a bug in error reporting with the CLI for start-up errors. (Derick)
-- Fixed spurious fsync calls during socket communication. (Sascha)
-- Fixed a possible vhost issue in thttpd. (Sascha, dgl@dgl.cx)
-- Fixed including from HTTP URLs. (Sascha)
-- Fixed a lot of memory leaks in domxml. (Rob Richards, Chregu)
-- Fixed a bug in GD's truecolor TTF handling. (Derick)
-- Fixed several 64-bit problems. (Dave)
-- Fixed several errors in hwapi extension. Objects weren't handled properly. (Uwe)
-- (str|preg_replace() clobber the array elements). (Ilia)
-- (file uploads ignored due to case sensitivity). (Sara)
-- (ifx_copy_blob() crash). (Jani)
-- (mysql_fetch_array() gives no warning when an invalid argument was passed as result_type). (Derick)
-- (set_error_handler() registered handler not called for object instances). (Jani, waboring@qualys.com)
-- (Unable to build --with-db4 (db4.1.25)). (Marcus)
-- (pfsockopen() returns dead connections). (Wez)
-- (curl_exec() produces strange results). (daniel@haxx.se)
-- (PostScript Type 1 fonts do not render properly). (nid@home.se, Ilia)
-- (crash with improper use of mssql_bind()). (Frank)
-- (configure falsely detects c-client using SSL). (Jani)
-- (fopen on multiple URLs causes memory corruption). (Wez)
-- (serialize cuts off floats & doubles). (Ilia, Marcus)
-- (safe_mode does not honor PHP_AUTH_* in apache2). (Ilia)
-- (money_format() didn't handle erroneous return of strfmon). (Ilia, marcot@tabini.ca)
-- (set_file_buffer() crashes with stdio streams). (Ilia)
-- (CDB databases created with 'c' mode do not work). (Marcus)
-- (memory leaks in sybase_connect/sybase_pconnect). (Ilia)
-- (user_error() crashs if error message > 1024 bytes). (Jay, Marcus, Moriyoshi)
-- ($http_response_header empty on invalid URLs). (Ilia)
-- (integer overflow in exif_iif_add_value()). (Ilia)
-- (ext/interbase: libgds.so: undefined reference to 'crypt'). (Jani)
-- (highlight_string() crashed with __FUNCTION__). (Jani)
-- (socket_strerror() crashes on win32). (Moriyoshi)
-- (when DST in effect, date("T") crashed PHP). (Scott MacVicar, Jani)
-- (tempnam creates readonly file [win32]). (Wez)
-- (pg_select with timestamp). (Marcus, Jay)
-- (ldap_start_tls() not available on Windows). (Edin)
-- (When ftp_close() is called, send QUIT to the ftp server). (Ilia)
-- (sendmail not found by configure). (igyu@ionsphere.org)
-- (missing perror() check in configure). (Jani)
-- (Crash in gd lib's ImageFillToBorder()). (Ilia)
-- (crash in imap_header_info()). (Ilia)
-- (Changing bool value via -d or ini_set(), On would be Off). (Ilia)
-- (Crash when trying to call DomAttribute's set_namespace method). (Chregu)
-- (Fatal errors exit with status 0 with CGI/CLI). (Jani)
-- (PHP crashes when exiting (long XML doc)). (Rob Richards)
-- (Compile error in gdcache.c when external libgd is used). (Jani)
-- (Poor file() performance on systems without mmap). (Wez)
-- (Crash in interbase when database unavailable). (Vladimir Michl)
-- (Crash when reading from invalid file pointer). (Ilia)
-- (User not logged under Apache2). (Ian)
-- (Wrong order of -lssl and -lcrypto with IMAP). (Jani)
-- (imagettfbox() does not add the kerning distance to the running position). (Ilia)
-- (Do not terminate the script on minor errors). (Ilia)
-- (overflow protection for upload_max_filesize ini option). (Ilia)
-- (writing transparency to truecolor png images). (Ilia)
-- (failed stat on stdio/stdin/stderr streams). (Wez, Ilia)
-- (append_child does not unlink node). (Chregu)
-- (mcrypt_generic_deinit() was not available on Windows). (Edin)
-- (Added protection against circular HTML redirects). (Ilia)
-- (ISAPI Secure Server variables not available). (Christian Swoboda)
-- (opening of ftp for read/write could fail due to invalid return code handling). (Ilia)
-- (FNM_CASEFOLD is not available). (Hartmut)
-- (fgetcsv() did not handle \" correctly). (Ilia)
-- (wrong httpd.conf modified when using INSTALL_ROOT). (Jani)
-- (combinations of fwrite(), fread() and fseek() produce unexpected results). (Wez)
-- (PHP would remove folding from Subject & To fields). (Ilia)
-- (overloaded strrpos() gives wrong results). (david@santinoli.com, Moriyoshi)
-- (crash on failed connection when curl_getinfo() was called). (Phil Oleson <poleson@verio.net>)
-- (optimized passthru, code is now ~40 times faster). (Ilia)
-- (pg_lo_seek($h, 0, PGSQL_SEEK_SET) succeeds but returns false). (Jani)
-- (htmlspecialchars() crashes Apache on Tru64). (Ilia)
-- (gethostbyname() with non-existing domain crashed on MacOSX). (Jani)
-- (possible crash when opening relative URLs). (Ilia)
-- (stream_select() clobbers fifos under win9x). (Wez)
-- (copy() fails if source file has 0 length). (Moriyoshi)
-- (printf() field limiters broke between 4.2.3 and 4.3.0). (Moriyoshi)
-- (implode() changes object references in array). (Moriyoshi)
-- (bad rows count in the result object for postgresql). (Marc)
-- (e notation in *printf would be missing a 0 when there is no exponent). (Ilia)
-- ("php_admin_value open_basedir none" does not work). (Jani)
-- (frontbase build broken with old version of frontbase). (Ilia)
-- (spprintf function did not handle floats correctly). (Ilia)
-- (incorrect insertion of session id when tabs are used to separate tag elements). (Ilia)
-- (removed undocumented Boyer str_replace() method). (Sara)
-- (Added gdImageEllipse and replaced old gdImageFilledEllipse with a better implementation). (Pierre)
-- (array_shift() left next index to be +1 too much). (Jani)
-- (MySQL charset directory problem on Windows). (Edin)
-- (ftp_chdir() causes segfault). (Sara)
-- (crash in imap_header() when the e-mail contains an abnormally large number of special characters). (Ilia)
-- (pg_result_seek() would never seek to the 1st row in the result due to always seeking to row next to the one requested). (Ilia)
-- (Made curl_write() & curl_write_header() binary safe). (Ilia)
-- (Crash in imap_mail_compose() if the body is an empty array). (Ilia)
-- (date() does not support negative timestamps on win32). (Ilia)
-- (strip_tags() eliminates too much). (Moriyoshi)
-- (Overload extension and _call() breaks classes). (Shane)
-- (array_pop() did not reset the current array position). (Jani)
-- , (win32 mail(), bcc: gets interpreted as cc:). (Sara)
-- (move_uploaded_file() does not ignore open_basedir). (Wez)
-- ("$arr['foo']" generates bogus E_NOTICE, should be E_PARSE). (Jani)
-- (fpassthru() ignored buffered data but complained anyway). (Wez)
-- (select would not always timeout during socket shutdown). (Wez)
-- (default output buffer could not be deleted). (Marcus)
-- (return behaviour differs between include and require). (Zeev)
-- (include remote files leaks descriptors on Solaris). (Wez)
-- (ucwords() trouble again). (Moriyoshi)
-- (fgetcsv() suppresses some characters before a separator). (Masahiro, Moriyoshi)
-- , (getimagesize() failed for remote files). (Wez)
-- (made glob() understand Windows paths). (Edin)
-- (problem with Ingres II persistent connections). (Jani)
-- (Extended checks for where FreeTDS is installed). (Frank)
-- (typo in gmp_gcdext() causes incorrect results). (Sara)
-- (file_exists() and other filestat functions report errors when the requested file/directory does not exists). (Sara)
-- (memory corruption by fsockopen()). (Ilia)
-- (bind_textdomain_codeset() now available on Windows). (Edin)
-- (number_format() could cause a memory allocation for a negative memory size in situations where the sprintf implementation of the host system generated less decimal places than were requested). (Wez)
-- (imagecreatefromstring() crashed with invalid image files). (Ilia)
-- (config.status warning). (Jani)
-- (mysql_pconnect connection problems). (Georg)
-- (improper handling of non-terminated < by strip_tags()). (Ilia)
-- (gd unable to open fonts). (Ilia)
-- (improper handling of ? surrounded by spaces in get_browser()). (Ilia)
-- (crash in mail() on Windows when 1st parameter is empty). (Edin)
-- (fixed handling of NULL or "" files on Win32). (Ilia)
-- (COM code crashes after update 4.2.1 to 4.3.0). (Harald)
-- (html_entity_decode() crashed when "" is passed). (Ilia)
-- (Solaris has issues with getcwd() needing read permissions on directories instead of just execute). (Wez, jflemer)
-- (in CLI/CGI on the #! it would leave a \n when the code encounters \r\n). (Ilia)
-- (session_decode() returned FALSE on success). (Ilia)
-- (opening URLs that result in redirection to a relative path was failing). (Ilia)
-- (missing 3rd argument to php_module_startup). (Ilia)
-- (broken check for ob_gzhandler and made ob_start() return the correct value). (Ilia)
-- (parse_url handling of urls without a path). (Ilia)
-- (apache configure fails when using --enable-versioning). (Jani)
-- (Compile Failure and lots of warnings on UnixWare). (Derick)
-- (fopen() with mode 'a+' and rewind() doesn't work). (Wez)
-- (html_errors off text-only output in phpinfo). (Marcus)
-- (snmpset() failed always, patch by: rs@epost.de). (Jani)
-- (PHP would die silently when memory limit reached). (Ilia)
-- (odbc could not be compiled as shared extension). (Jani)
-- (Numeric/decimal datatype overflow in ext/interbase on Win32). (Daniela)
-- (imagesetbrush() not available on Windows). (Edin)
-- (COM memory leak). (Harald)
-- (snprintf() not defined on some systems). (Jani)
-- (crash in sapi_apache_header_handler under heavy load). (George)
-- (Problems with strnatcmp() / strnatcasecmp()). (Moriyoshi)
-- (multiple <!--include--> used to include PHP files crashes). (Ilia)
-- (Print the message when OCI_SUCCESS_WITH_INFO is returned). (Maxim)
-- (make Apache2 aware that PHP scripts should not be cached). (Ilia)
-- (Compile failure with LOB support for Oracle version < 8.1). (Maxim)
-- (fixed connection_status() to return 2 for timeouts). (Jani)
-- ('make install' fails on AIX when using --with-apxs). (Jani)
-- (CGI: passing query string on command line broken). (Shane)
-- (--without-pear disabled phpize/php-config install). (Jani)
-- (bcmath functions applying scale incorrectly). (Sara)
-
-More information on this release on our Releases page.
-
-
-
-
-Version 4.3.1
-
-
-- Fixed serious security vulnerability in CGI SAPI. (Shane)
-
-More information on this release on our Releases page.
-
-
-
-
-
-
-
-
-Version 4.2.3
-
-
-- Enable UTF8 modifier support for PCRE on win32. (Wez, Edin)
-- Enabled strcoll() on win32. (Markus)
-- Fixed possible ASCII control char injection in mail(). (Stefan Esser)
-- Fixed a potential crash bug in import_request_variables() (Zeev)
-- Fixed several problems with directory functions on Windows. (Steph)
-- Fixed xbithack bug in Apache module. (Rasmus)
-- Fixed a bug that prevented touch() from working on various platforms. (Steph)
-- Fixed ob_gzhandler()'s handling of requests that do have the Accept-Encoding header, but do not allow compression. (Zeev)
-- Fixed several bugs in the multithreaded version that could cause random parse errors, especially on machines with multiple CPUs. (Zeev, Zend Engine)
-- Fixed a build problem in bcmath. (Alan)
-- Fixed several bzip2 issues. (Andrei, kalowsky)
-- Fixed several COM issues. (Harald)
-- Various exif fixes. (Marcus)
-- Fixed domxml_xslt_process() and domxml_get_element_by_id() and several other issues in DOMXML. (Christian)
-- Fixed DOMXML crash on removing previously created attributes. (Christian)
-- Fixed crash when converting $GLOBALS to an object. (Zeev, Zend Engine)
-- Fixed ImageCreateFromGD2Part() (Jani)
-- Fixed a build issue in the IMAP extension under IRIX. (kalowsky)
-- Fixed a bug in imap_last_error() (Jani)
-- Various mbstring fixes. (Yasuo, Rui)
-- Fixed a build problem in the mcal extension. (Jani)
-- Made MySQL rollback open transactions when the request ends. (Georg)
-- Fixed a crash in the shutdown order of the ODBC module. (kalowsky)
-- Fixed PCRE build problems. (troels@arvin.dk)
-- Fixed a crash in pg_lo_write() (Yasuo)
-- Fixed posix_isatty() and posix_ttyname(). (Markus)
-- Fixed accidental pg_lo_import() API change. (Yasuo)
-- Fixed ereg_replace() crash when the backreference number was greater than the number of captured subpatterns. (oliver@billix.franken.de)
-- Fixed array_rand() on thread-safe platforms such as Windows. (Edin)
-- Report the right exit code after a call to exit(). (Edin)
-
-More information on this release on our Releases page.
-
-
-
-
-Version 4.2.2
-
-
-- Fixed serious security vulnerability. (Stefan Esser)
-
-More information on this release on our Releases page.
-
-
-
-
-Version 4.2.1
-
-
-- Added safe-mode checks to show_source(), parse_ini_file() and rmdir(). Also
- fixed security problems with safe_mode_include_dir directive. (Rasmus)
-- Changed HTTP upload code to accept 0 byte file uploads. (Zeev)
-- Major update of domxml. New functions, better DOM compliance and bug fixes:
-
- -
- Changed the old $node->append_child() to $node->append_sibling() since
- the new append_child() behaves correctly (= W3C standard).
-
- -
- Added domxml functions:
-
- - domxml_elem_get_elements_by_tagname()
- - domxml_doc_get_elements_by_tagname()
- - domxml_doc_get_element_by_id()
- - domxml_elem_remove_attribute()
- - domxml_elem_get_attribute_node()
-
-
- -
- Fixed a segfault in domxml_unlink().
-
- -
- Added formatting option to domxml_dump_mem().
-
-
- (Uwe, jtate, Chregu)
-- Fixed a bug in socket_select() that could cause unexpected behavior when
- using a statement like $w = $e = array($sock); This change unfortunately
- prevents the use of constant values (e.g. NULL) for the socket array
- paramaters. Instead, use a temporary variable or an expression with the
- leftmost member being a temporary variable. ex.:
- socket_select($w, $r, $e = NULL, 10); (Jason)
-- Fixed crashes in the session serializer. (Stas)
-- Fixed malformed atime/mtime with touch(). (Yasuo)
-- Fixed a couple of bugs in array_sum() and array_merge(). (Andrei)
-- Fixed SJIS directory name handling under Windows. (Rui)
-- Fixed empty mb_output_handler() output when Content-Type is specified.
- (Yasuo)
-- Fixed the false logic in ext/session which made SID constant not to be
- defined when cookies are disabled. (Sascha)
-- Fixed possible crash bug in HTTP uploads. (Patch: Lucas Schroeder)
-- Fixed possible NULL-pointer dereferencing in the COM extension which
- caused 'Error in php_OLECHAR_to_char()' warnings on various places.
- Also modified the API to consistently return NULL in case of an error.
- (Alan, Harald)
-- Fixed a bug in the COM extension that caused outproc servers to 'hang'
- because of a missing Release() call. (Alan, Harald)
-
-More information on this release on our Releases page.
-
-
-
-
-Version 4.2.0
-
-
-- ATTENTION!! register_globals defaults to 'off' now !!!
-- Note: Apache2 support is EXPERIMENTAL.
-- Moved ext/mailparse to PECL. See http://thebrainroom.com/opensource/php/
-for more information and to download the extension. (Wez/Jim)
-- Fixed pg_last_notice() crash. (Yasuo)
-- Modified the mysql extension to disable 'LOAD LOCAL' when safe mode is
-enabled. (Jason)
-- Fixed HTTP file upload support to handle big files better. (Jani)
-- Major modifications to the Sockets Extension and its API (Jason):
-
- - Fixed numerous bugs.
- - Added automatic host lookup capability to all functions that take addr's.
-example: socket_connect($sock, 'www.yahoo.com', 80);
- - Corrected and standardized host lookup errors
- - Modified socket_recv() behavior. [$r=socket_recv($sock, $buf, $len, $flags)]
- - Added socket_set_block() which changes a socket into blocking IO mode
- - Modified socket_last_error() to not clear the last error
- - Added socket_clear_error() which clears the last error on a socket
- - Removed all code pertaining to fd_sets (socket_fd_*)
- - Modified/Improved socket_select() to accept array of resources instead of fd_sets. example:
-
- <?php
- $wfds=$rfds=array($sock1, $sock2, $sock3, $sock7);
- $r=socket_select($rfds, $wfds, NULL, 1);
- print "Ready to read:\n"; var_dump($rfds);
- ?>
-
-
-- Fixed segfault in ibase_close() if user does not free the resultset.
-Bugs , . (daniela)
-- Fixed pg_last_notice() crash. (Yasuo)
-- Added optional 3rd parameter "int encoding_mode" to gzencode() and fixed
-parameters to conform documentation. (Stefan)
-- Changed read_exif_data() to be an alias of exif_read_data(). (Marcus)
-- Added exif_tagname() function which returns the names of tags and
-exif_thumbnail() function to extract embedded thumbnails. (Marcus)
-- Fixed iconv support with FreeBSD. (kalowsky)
-- Cleaned up the posix extension: (Markus)
-
- - Removed unwanted warning messages
- - Added posix_errno() and posix_strerror() for fetching error messages
- - Changed the way posix_getgrnam() and posix_getgrgid() return their values
-(breaks BC but makes more sense)
- - Does not include functions in symbol table which aren't supported on host
-system.
-
-- Added TIFF support for getimagesize() and read_exif_data(). (Marcus)
-- Changed the Velocis extension namespace to Birdstep to reflect new product
-name. Added aliases for BC. (James)
-- Added safe_mode checks for opendir(). (jflemer)
-- Changed the 2nd parameter in pgsql_fetch_*() functions to support NULL if
-all 3 parameters are supplied, but you do not want to provide a row number.
-(Derick)
-- Improved iconv() when using libc's iconv. (Yasuo)
-- Added PHP_SAPI constant which contains the name of running SAPI. (Edin)
-- Added ob_get_status() which returns an array of buffers with their status.
-(Yasuo)
-- Fixed a crash bug in ob_end_*() functions. ob_end_*() will not delete
-buffers that may not be deleted. (Yasuo)
-- Added 3rd parameter "bool erase" to ob_start(). If FALSE, the buffer may not
-be deleted until script finishes. (Yasuo)
-- Changed ob_*() functions to return TRUE for success, FALSE for failure.
-(Yasuo)
-- Added sybase_ct support to dbx module. (Marc)
-- Fixed error message handling with PostgreSQL 7.2. (Rui)
-- Added object aggregation capability, see aggregation_*() functions. (Andrei)
-- Added debug_zval_dump() which works similarly to var_dump, but displays
-extra internal information such as refcounts and true type names. (Jason)
-- Added Andrei's tokenizer extension. (Stig)
-- Fixed a bug in the COM extension which caused php to crash in
-php_COM_get_ids_of_names(). (Paul, Harald)
-- Removed ext/satellite. It is now part of PEAR. (eriksson)
-- Changed php.ini directive 'safe_mode_include_dir' to accept a (semi)colon
-separated path (like 'include_path') rather than a single directory.
-(jflemer)
-- Added is_a() function that can be used to test whether object is of a certain
-class or is derived from it. (Andrei, Zend Engine)
-- Added optional parameter to highlight_string() and highlight_file() which
-makes these functions to return a highlighted string instead of dumping
-it to standard output. (Derick)
-- Added EXTR_IF_EXISTS and EXTR_PREFIX_IF_EXISTS flags to extract(). (Rasmus)
-- Fixed a segfault in pg_pconnect(). If PostgreSQL server is restarted, broken
-connection is detected and reconnected. (Yasuo)
-- Fixed --enable-safe-mode configure option. (Yasuo)
-- Added function domxml_dump_node($doc,$node). Dumps a node plus all children
-into a string. (chregu)
-- Added function domxml_node_get_content(). (chregu)
-- Added function domxml_dump_file($filename,[$compression]). Dumps XML to
-a file and uses compression, if specified. (chregu)
-- Added exslt integration to domxml extension (http://exslt.org/ for details).
-Configure with --with-dom-exslt[=DIR] (and --with-dom-xslt).
-(chregu,jaroslaw)
-- Fixed session_unset() to not touch any globals if register_globals is off.
-(Thies)
-- Added 3 new optional parameters to OCIFetchStatement(). They control
-the number of rows to skip at the beginning of the cursor, the
-maximun numer of rows that should be fetched and the format of the
-returned array. (Thies)
-- Updated the XSLT extension to support Sablotron 0.8. (Petr Cimprich)
-- Fixed a bug in preg_match() and preg_match_all() when matching strings
-contain null bytes. (Andrei)
-- Added xpath_register_ns() function. This makes it possible to issue XPath
-queries with namespaces like for example: "//namespace:sampletag".
-(Chris Jarecki)
-- Added multi-byte enabled regular expression functions. (Rui)
-- Added optional second parameter to count() which can be used to specify
-either normal or recursive counting. (patch by Vlad Bosinceanu <glipy@fx.ro>)
-- Added mb_get_info() to get internal settings of mbstring. (Rui)
-- Added async query functions to PostgreSQL module. (Yasuo)
-- Added pg_copy_to()/pg_copy_from() for PostgreSQL module. (Youichi, Yasuo)
-- Added IPv6 support for FTP extension. (Stig Venaas)
-- Improved the speed of wordwrap() significantly. (Jim)
-- Fixed pow()'s incorrect behaviour when dealing with powers of 0. (Jim)
-- Added is_finite(), is_infinite() and is_nan(). (Jim)
-- Fixed segfault in wordwrap() when wrapping to zero width and using
-multi-character break or trying to force cut (bug ). (Jim)
-- Fixed several bugs in dbase extension (dbase_pack() truncate file to right
-size, fix #1 and #2). (Vlad)
-- Fixed bug in krsort() where an extra character was being compared. (Andi)
-- Fixed bug that made pspell include pspell.h from a wrong location. (Vlad)
-- Added function overload in mbstring to add multibyte support for
-string and mail functions. (Rui)
-- Added flags parameter to preg_grep(). The only flag currently is
-PREG_GREP_INVERT that will make the function return entries that
-did not match. (Andrei)
-- Fixed several crash bugs in the xslt extension. (Markus, Derick)
-- Fixed problem with dbase not returning very large (larger than long)
-integers properly. (Vlad)
-- Added concepts to IRCG: bailout-on-trivial issue, write output to
-files, fetch a resource upon connection end. (Sascha)
-- Fixed POST-related bugs in thttpd, added QUERY_STRING, HTTP_HOST,
-HTTP_ACCEPT_LANGUAGE to the script environment, improved patch
-to send correct MIME types, and added support for /nocache/. (Sascha)
-- Fixed several bugs and memleaks in the domxml extension. (Markus)
-- Added var_export() which outputs a representation of a variable as reusable
-PHP code. (Derick)
-- Added -w option to the CGI-version to strip all comments and whitespace
-from the script. (Thies)
-- Added support for SO_RCVTIMEO and SO_SNDTIMEO to ext/sockets. (Jason)
-- Added ob_get_level() which returns the nesting level of the output buffering
-mechanism. (Yasuo, Derick)
-- Added ob_flush() and ob_clean() functions which flush and clean an output
-buffer without destroying the buffer. (Derick)
-- Added new optional parameter to mysql_connect() which forces a new database
-link to be created. (Markus, Derick)
-- Added ldap_sort() function. (Stig Venaas)
-- Added md5_file() function which calculates the MD5 sum of a file.
-Patch by Alessandro Astarita <aleast@capri.it> (Derick)
-- Added support for parsing recordsets contained in WDDX packets. (Andrei)
-- Renamed key_exists() to array_key_exists(). (Derick)
-- Fixed ImageColorsForIndex() and ImageColorAt() to work for TrueColor
-images. (Rasmus)
-- Added support for bind_textdomain_codeset(). <rudib@email.si>
-- Added generic Win 32 API extension. (jmoore)
-- Removed warning message about NONEXISTENT character set from mysql_connect()
-when the server's default character set != latin1. (MySQL Team)
-- Added Direct I/O extension for lowlevel access to the POSIX layer. (Sterling)
-- Added SAPI module for the WebJames server on RISC OS. (Alex Waugh)
-- Fixed ldap_add() and ldap_modify() functions to throw a warning with illegal
-value arrays. Previously segfaulted or added wrong value. (Stig Venaas)
-- Added udm_check_charset() function into mnoGoSearch extension. (gluke)
-- Fixed mnoGoSearch extension to support mnogosearch-3.2.x. (gluke)
-- Made fbsql_num_rows() to return the correct value on all select statements.
-(Frank)
-- Added array_chunk() function which splits an array into chunks of specified
-size. (Andrei)
-- Fixed $HTTP_RAW_POST_DATA to be populated on a missing content-type when
-always_populate_raw_post_data is on. (Rasmus)
-- Added session_cache_expire() function. (patch by <anuradha@gnu.org>) (Andrei)
-- Added array_fill() function. (Rasmus)
-- Made Authorization header to be hidden from phpinfo() output in safe_mode.
-(Rasmus)
-- Re-instated safe-mode realm mangling. (Rasmus)
-- Fixed a bug in preg_replace() that would change the type of the replacement
-array entries to string. (Andrei)
-- Added user-space object overloading extension. (Andrei)
-- Added ldap_start_tls() function. (Stig Venaas, patch by <kuenne@rentec.com>)
-- Changed rand() and mt_rand() to be seed automatically if srand() or
-mt_srand() has not been called. (Sterling)
-- Changed the seed options to srand() and mt_srand() to be optional. If the
-seed is not specified the most random seed possible is generated. (Sterling)
-- Added array_change_key_case() function which returns an array with all
-string keys lowercased or uppercased. (Edin)
-- Added parameter to ircg_pconnect to suppress treating non-fatal errors
-as fatal, and added conversion of Windows quotes to ". (Sascha)
-- Added pcntl_exec() function which behaves similar to the system execve.
-(Jason)
-- Fixed segfault and check for truecolor image in ImageColorAt(). (Rasmus)
-- Fixed nl2br() to handle all styles of line-endings in one string.
-(Boian, Derick)
-- Added mcrypt_generic_deinit() to replace mcrypt_generic_end(). (Derick)
-- Added apache_setenv() function for injecting variables into Apache's
-subprocess_env table. (Rasmus)
-- Added support for 'int', 'bool', 'float' and 'null' in settype(). (Jeroen)
-- Added IPv6 support to gethostbyaddr().
-(Patch by Matthias Wimmer <matthias@charente.de> and venaas)
-- Fixed LONG_VARCHAR type crashing in ODBC extension. Patch by Walter Franzini.
-(kalowsky)
-- Changed in_array() and search_array() to allow the needle to be an array
-in itself. (Andrei)
-- Added ini_get_all() function which returns all registered ini entries
-or entries for the specified extension. (Jani)
-- Added support for chinese encodings in htmlentities() and htmlspecialchars().
-(Patch by Alan Knowles <alan_k@hklc.com> and Wez)
-- Improved support for autoconf-2.50+/libtool 1.4b+. (Jan Kneschke, Sascha)
-
-More information on this release on our Releases page.
-
-
-
-
-
-
-Version 4.1.2
-
-
-- Fixed start up failure when mm save handler is used and there is multiple
- SAPIs are working at the same time. (Yasuo)
-- Fixed the Roxen SAPI (Yasuo)
-- Fixed a buffer overflow in the RFC-1867 file upload code (Stefan)
-- Fixed a crash in the session module (Yasuo)
-- Fixed a crash in the pspell module (Yasuo)
-- Changed the default output encoding of mbstring 'pass' to fix
- initialization problem (Rui)
-
-More information on this release on our Releases page.
-
-
-
-
-Version 4.1.1
-
-
-- Fixed incompatibility with Windows .NET / IIS 6 - may improve stability
- under other versions of IIS. (Zeev)
-- Fixed bug that caused crashes or error notices on shutdown on threaded
- platforms. (Zeev)
-- Fixed several crash bugs in the xslt extension. (Markus, Derick)
-- Fixed problem with dbase not returning very large (larger than long)
- integers properly. (Vlad)
-- Fixed several bugs and memleaks in the domxml extension. (Markus)
-- Fixed bug in gmmktime() which was one hour off during standard time -
- bug . Patch by bfoddy@mediaone.net. (jmoore)
-- Fixed bug in gmdate() timezone handling on Windows - bug . (jmoore)
-- Fixed several crash bugs in the mcrypt extension. (Derick)
-- Made the mcrypt extension compile with the libmcrypt 2.2 series again.
- (Sterling)
-- Fixed a bug where the is_file() family of functions would in-correctly give
- an error when they were given filenames that didn't exist. (Sterling)
-- Fixed a bug in the strtotime() function where it was incorrectly recognizing
- GMT +0100 and GMT -0100. (Derick)
-
-More information on this release on our Releases page.
-
-
-
-
-Version 4.1.0
-
-
-- Worked around a bug in the MySQL client library that could cause PHP to hang
- when using unbuffered queries. (Zeev)
-- Fixed a bug which caused set_time_limit() to affect all subsequent requests
- to running Apache child process. (Zeev)
-- Removed the sablotron extension in favor of the new XSLT extension.
- (Sterling)
-- Fixed a bug in WDDX deserialization that would sometimes corrupt the root
- element if it was a scalar one. (Andrei)
-- Make ImageColorAt() and ImageColorsForIndex() work with TrueColor images.
- (Rasmus)
-- Fixed a bug in preg_match_all() that would return results under improper
- indices in certain cases. (Andrei)
-- Fixed a crash in str_replace() that would happen if search parameter was an
- array and one of the replacements resulted in subject string being empty.
- (Andrei)
-- Fixed MySQL extension to work with MySQL 4.0. (Jani)
-- Fixed a crash bug within Cobalt systems. Patch by tomc@tripac.com.
-(Jani)
-- Bundled Dan Libby's xmlrpc-epi extension.
-- Introduced extension version numbers. (Stig)
-- Added version_compare() function. (Stig)
-- Fixed pg_last_notice() (could cause random crashes in PostgreSQL
- applications, even if they didn't use pg_last_notice()). (Zeev)
-- Fixed DOM-XML's error reporting, so E_WARNING errors are given instead of
- E_ERROR error's, this allows you to trap errors thrown by DOMXML functions.
- (Sterling)
-- Fixed a bug in the mcrypt extension, where list destructors were not
- properly being allocated. (Sterling)
-- Better Interbase blob, null and error handling. (Patch by Jeremy Bettis)
-- Fixed a crash bug in array_map() if the input arrays had string or
- non-sequential keys. Also modified it so that if a single array is passed,
- its keys are preserved in the resulting array. (Andrei)
-- Fixed a crash in dbase_replace_record. (Patch by robin.marlow@dps-int.com)
-- Fixed a crash in msql_result(). (Zeev)
-- Added support for single dimensional SafeArrays and Enumerations.
- Added com_isenum() function to check if a component implements an
- enumeration. (Alan, Harald)
-- Fixed a bug in dbase_get_record() and dbase_get_record_with_names().
- boolean fields are now returned correctly.
- Patch by Lawrence E. Widman <widman@cardiothink.com> (Jani)
-- Added --version option to php-config. (Stig)
-- Improved support for thttpd-2.21b by incorporating patches for all known
- bugs. (Sascha)
-- Added ircg_get_username, a roomkey argument to ircg_join, error fetching
- infrastructure, a tokenizer to speed up message processing, and fixed
- a lot of bugs in the IRCG extension. (Sascha)
-- Improved speed of the serializer/deserializer. (Thies, Sascha)
-- Floating point numbers are better detected when converting from strings.
- (Zeev, Zend Engine)
-- Replaced php.ini-optimized with php.ini-recommended. As the name implies,
- it's warmly recommended to use this file as the basis for your PHP
- configuration, rather than php.ini-dist. (Zeev)
-- Restore xpath_eval() and php_xpathptr_eval() for 4.0.7. There
- are still some known leaks. (Joey)
-- Added import_request_variables(), to allow users to safely import form
- variables to the global scope (Zeev)
-- Introduced a new $_REQUEST array, which includes any GET, POST or COOKIE
- variables. Like the other new variables, this variable is also available
- regardless of the context. (Andi & Zeev)
-- Introduced $_GET, $_POST, $_COOKIE, $_SERVER and $_ENV variables, which
- deprecate the old $HTTP_*_VARS arrays. In addition to be much shorter to
- type - these variables are also available regardless of the scope, and
- there's no need to import them using the 'global' statement. (Andi & Zeev)
-- Added vprintf() and vsprintf() functions that allow passing all arguments
- after format as an array. (Andrei)
-- Added support for GD2 image type for ImageCreateFromString() (Jani)
-- Added ImageCreateFromGD(), ImageCreateFromGD2(), ImageCreateFromGD2part(),
- ImageGD() and ImageGD2() functions (Jani)
-- addcslashes now warns when charlist is invalid. The returned string
- remained the same (Jeroen)
-- Added optional extra argument to gmp_init(). The extra argument
- indicates which number base gmp should use when converting a
- string to the gmp-number. (Troels)
-- Added the Cyrus-IMAP extension, which allows a direct interface to Cyrus'
- more advanced capabilities. (Sterling)
-- Enhance read_exif_data() to support multiple comment tags (Rasmus)
-- Fixed a crash bug in array_map() when NULL callback was passed in. (Andrei)
-- Change from E_ERROR to E_WARNING in the exif extension (Rasmus)
-- New pow() implementation, which returns an integer when possible,
- and warnings on wrong input (jeroen)
-- Added optional second parameter to trim, chop and ltrim. You can
- now specify which characters to trim (jeroen)
-- Hugely improved the performance of the thread-safe version of PHP, especially
- under Windows (Andi & Zeev)
-- Improved request-shutdown performance significantly (Andi & Zeev, Zend
- Engine)
-- Added a few new math functions. (Jesus)
-- Bump bundled expat to 1.95.2 (Thies)
-- Improved the stability of OCIPlogon() after a database restart. (Thies)
-- Fixed __FILE__ in the CGI & Java servlet modes when used in the main script.
- It only worked correctly in included files before this fix (Andi)
-- Improved the Zend hash table implementation to be much faster (Andi, Zend
- Engine)
-- Updated PHP's file open function (used by include()) to check in the calling
- script's directory in case the file can't be found in the include_path (Andi)
-- Fixed a corruption bug that could cause constants to become corrupted, and
- possibly prevent resources from properly being cleaned up at the end of
- a request (Zeev)
-- Added optional use of Boyer-Moore algorithm to str_replace() (Sascha)
-- Fixed and improved shared-memory session storage module (Sascha)
-- Add config option (always_populate_raw_post_data) which when enabled
- will always populate $HTTP_RAW_POST_DATA regardless of the post mime
- type (Rasmus)
-- Added support for socket and popen file types to ftp_fput (Jason)
-- Fixed various memory leaks in the LDAP extension (Stig Venaas)
-- Improved interactive mode - it is now available in all builds of PHP, without
- any significant slowdown (Zeev, Zend Engine)
-- Fixed crash in iptcparse() if the supplied data was bogus. (Thies)
-- Fixed return value for a failed snmpset() - now returns false (Rasmus)
-- Added hostname:port support to snmp functions (nbougues@axialys.net, Rasmus)
-- Added fdf_set_encoding() function (Masaki YATSU, Rasmus)
-- Reversed the destruction-order of resources. This fixes the reported OCI8
- "failed to rollback outstanding transactions!" message (Thies, Zend Engine)
-- Added option for returning XMLRPC fault packets. (Matt Allen, Sascha
- Schumann)
-- Improved range() function to support range('a','z') and range(9,0) types of
- ranges. (Rasmus)
-- Added getmygid() and safe_mode_gid ini directive to allow safe mode to do
- a gid check instead of a uid check. (James E. Flemer, Rasmus)
-- Made assert() accept the array(&$obj, 'methodname') syntax. (Thies)
-- Made sure that OCI8 outbound variables are always zero-terminated. (Thies)
-- Fixed a bug that allowed users to spawn processes while using the 5th
- parameter to mail(). (Derick)
-- Added nl_langinfo() (when OS provides it) that returns locale.
-- Fixed a major memory corruption bug in the thread safe version. (Zeev)
-- Fixed a crash when using the CURLOPT_WRITEHEADER option. (Sterling)
-- Added optional suffix removal parameter to basename(). (Hartmut)
-- Added new parameter UDM_PARAM_VARDIR ha in Udm_Set_Agent_Param() function to
- support alternative search data directory. This requires mnogoSearch 3.1.13
- or later.
-- Fixed references in sessions. This doesn't work when using the WDDX
- session-serializer. Also improved speed of sessions. (Thies)
-- Added new experimental module pcntl (Process Control). (Jason)
-- Fixed a bug when com.allow_dcom is set to false. (phanto)
-- Added a further parameter to the constructor to load typelibs from file when
- instantiating components (e.g. DCOM Components without local registration).
- (phanto)
-- Added the possibility to specify typelibs by full name in the typelib file
- (Alan Brown)
-- Renamed the ZZiplib extension to the Zip extension, function names have also
- changed accordingly, functionality, has stayed constant. (Sterling)
-- Made the length argument (argument 2) to pg_loread() optional, if not
- specified data will be read in 1kb chunks. (Sterling)
-- Added a third argument to pg_lowrite() which is the length of the data to
- write. (Sterling)
-- Added the CONNECTION_ABORTED, CONNECTION_TIMEOUT and CONNECTION_NORMAL
- constants. (Zak)
-- Assigning to a string offset beyond the end of the string now automatically
- increases the string length by padding it with spaces, and performs the
- assignment. (Zeev, Zend Engine)
-- Added warnings in case an uninitialized string offset is read. (Zeev, Zend
- Engine)
-- Fixed a couple of overflow bugs in case of very large negative integer
- numbers. (Zeev, Zend Engine)
-- Fixed a crash bug in the string-offsets implementation (Zeev, Zend Engine)
-- Improved the implementation of parent::method_name() for classes which use
- run-time inheritance. (Zeev, Zend Engine)
-- Added 'W' flag to date() function to return week number of year using ISO
- 8601 standard. (Colin)
-- Made the PostgreSQL driver do internal row counting when iterating through
- result sets. (gvz@2scale.net)
-- Updated ext/mysql/libmysql to version 3.23.39; Portability fixes, minor
- bug fixes. (tim@mysql.com)
-- Added get_defined_constants() function to return an associative array of
- constants mapped to their values. (Sean)
-- New mailparse extension for parsing and manipulating MIME mail. (Wez)
-- Define HAVE_CONFIG_H when building standalone DSO extensions. (Stig)
-- Added the 'u' modifier to printf/sprintf which prints unsigned longs.
- (Derick)
-- Improved IRIX compatibility. (Sascha)
-- Fixed crash bug in bzopen() when specifying an invalid file. (Andi)
-- Fixed bugs in the mcrypt extension that caused crashes. (Derick)
-- Added the IMG_ARC_ROUNDED option for the ImageFilledArc() function, which
- specified that the drawn curve should be rounded. (Sterling)
-- Updated the sockets extension to use resources instead of longs for the
- socket descriptors. The socket functions have been renamed to conform with
- the PHP standard instead of their C counterparts. The sockets extension is
- now usable under Win32. (Daniel)
-- Added disk_total_space() to return the total size of a filesystem.
- (Patch from Steven Bower)
-- Renamed diskfreespace() to disk_free_space() to conform to established
- naming conventions. (Jon)
-- Fixed . Now zero is returned instead of an unset value for
- 7-bit encoding and plain text body type. (Vlad)
-- Fixed a bug in call_user_*() functions that would not allow calling
- functions/methods that accepted parameters by reference. (Andrei)
-- Added com_release($obj) and com_addref($obj) functions and the related class
- members $obj->Release() and $obj->AddRef() to gain more control over the used
- COM components. (phanto)
-- Added an additional parameter to dotnet_load to specify the codepage (phanto)
-- Added peak memory logging. Use --enable-memory-limit to create a new Apache
- 1.x logging directive "{mod_php_memory_usage}n" which will log the peak
- amount of memory used by the script. (Thies)
-- Made fstat() and stat() provide identical output by returning a numerical and
- string indexed array. (Jason)
-- Fixed memory leak upon re-registering constants. (Sascha, Zend Engine)
-
-More information on this release on our Releases page.
-
-
-
-
-
-
-Version 4.0.6
-
-
-- Fixed memory fragmention problem which could lead to web server processes
- growing much more than they should. (Andi, Zend Engine)
-- Made $HTTP_SESSION_VARS['foo'] and $foo be references to the same value
- when register_globals is on. (Andrei)
-- Fixed disk_free_space() and disk_total_space() under FreeBSD. (Jon)
-- Fixed readfile/passthru losing resources during connection abort (Sascha)
-- Fixed bug in the mcrypt extension that caused segfaults when using a key
- that is too large for the used algorithm, and a bug that caused
- mcrypt_generic() to segfault PHP (Derick)
-- Fixed getopt so that it accepts command line arguments in the form
- -<opt><arg> and -<opt> <arg>. (Jmoore)
-- Fixed race in writing session files (Sascha)
-- Fixed a possible crash in the PHP CGI when no input file is
- specified (Zeev)
-- Added is_callable() function that can be used to find out whether
- its argument is a valid callable construct. (Andrei)
-- Fixed a rare possible crash when generating extended information. (Dmitri
- Dmitrienko, Zend Engine)
-- Improved virtual() to support PHP-enabled URIs. (Zeev)
-- Fixed undefined behavior when using floating point keys in array()
- expressions. (Zeev, Zend Engine)
-- Fixed a possible crash in case of parse errors in include files or eval
- statements. (Zeev, Zend Engine)
-- Added --with-layout configure option. (Stig)
-- Improved interactive mode - supports function calls, and works in
- multithreaded builds. (Zeev, Zend Engine)
-- Fixed a crash bug in interactive mode. (Zeev, Zend Engine)
-- Added pg_last_notice() function. (Rasmus from suggestion by Dirk@rackspace.com)
-- Fixed a bug in preg_split() that would incorrectly limit the number of
- results when used along with PREG_SPLIT_NO_EMPTY flag. (Andrei)
-- Added connection error support to mysql_error() and mysql_errno(). (Jason)
-- Added support to getimagesize to return dimensions of BMP and PSD
- files. (Derick)
-- Added heuristic to kill stale IRC connections, message scanner caching, and
- nickname escaping to IRCG, suppress option to ircg_msg(), and statistics to
- IRCG phpinfo() output. (Sascha)
-- Added Japanese multibyte string functions support. (Rui)
-- Added Mac OS X "\r" line ending support. (Andi, Zend Engine)
-- Fixed a bug regarding the $PHP_SELF being incorrectly registered when
- force-cgi-redirect was not enabled. (Sterling)
-- pfpro extension now supports version 3 of the Verisign SDK. (John Donagher)
-- Udm_Cat_List and Udm_Cat_Path functions has been added.
-- Added key_exists() to check if a given key or index exists in an
- array or object. (David Croft)
-- Modify the cURL extension to compile only with the latest cURL release.
- Backwards compatibility with regards to the extension api has not been
- broken. (Sterling)
-- Added the ability to use user-defined callbacks with cURL. (Sterling)
-- Added the SSL_VERIFYPEER, CAINFO, MAXREDIRS, FILETIME, RANDOM_FILE, EGDSOCKET
- and CONNECTTIMEOUT options to curl_setopt(). (Sterling)
-- Added support for persistent connections with cURL. (Sterling)
-- Fixed a problem in cURL with file descriptors being allocated, but never
- closed. (Sterling)
-- Fixed interactive mode (-a). It works again with the same limitations it
- has always had. (Andi, Zend Engine)
-- Improved memory manager to use less memory and provide better memory overflow
- detection abilities in debug mode. (Andi, Zend Engine)
-- Fixed resource leaks when resources were being cast to numbers. (Zeev, Zend
- Engine)
-- Fixed foreach() to not crash when being sent an invalid argument. (Andi, Zend
- Engine)
-- Fixed a bug in opendir() under Windows when trying to open a non-exisiting
- directory. (Andi)
-- Fixed popen() and the exec family under Win32 (Unable to fork issue). (Daniel)
-- Make the printf family of functions binary clean. (Rasmus)
-- Fixed WDDX serialization to HTML-escape key/variable names so as not to
- break the XML packet. (Andrei)
-- Made WDDX extension enabled by default. (Andrei)
-- Added -C command-line option to avoid chdir to the script's directory. (Stig)
-- Fixed a bug with /e modifier in preg_replace(), that would not correctly
- replace two-digit references if single digit references were present
- before them. This fixed bug . (Andrei)
-- Added temporary LOB support in OCI8. (Patch by David Benson)
-- Fixed crash in pathinfo()
-- OCI8 now supports binding of collections. (Patch by Andy Sautins
- <asautins@veripost.net>)
-- Added GD 2.0.1 support for truecolor and alpha channels, plus some other gd
- functions, both old and new - see docs for more info. (Wez)
-- Added S/MIME sign/verify encrypt/decrypt functions to openssl extension,
- along with some other certificate manipulation and interrogation functions.
- See docs for more info. (Wez)
-- printf argnum (parameter swapping) support. (Morten Poulsen, Rasmus)
-- Add DIRECTORY_SEPARATOR constant ('/' on UNIX, '\' on Windows). (Stig)
-- Added small change to php_odbc module, to check for failed SQLDisconnects
- and to close any outstanding transactions if the call fails, then disconnect
- again. (lurcher)
-- Modified get_parent_class() and get_class_methods() to accept a class name as
- well as a class instance. (Andrei, Zend Engine)
-- Added support for UNC style paths. (\\server\share\file,
- //server/share/file). (Daniel, TSRM)
-- Added dbx module (database abstraction) to the repository. (Marc)
-- Using ITypeInfo instead of IDispatch if possible. This makes DCOM calls
- and even COM calls much faster.
- All ini settings are now prefixed by 'com.'.
- Now you need not provide a path to the file containing the typelib, you can
- also provide the GUID of the TypeLib - entry or an IID for preloading
- type - information. (phanto)
-- Rewrite of domxml. It's now mostly DOM Level 2 conform. (Uwe)
-- Added array_map() function that applies a callback to the elements
- of given arrays and returns the result. It can also be used with a
- null callback to transpose arrays. (Andrei)
-- Added array_filter(), which allows filtering of array elements via
- the specified callback. (Andrei)
-- Fixed all relevant array functions to avoid moving the internal array
- pointer during operations. (Andrei)
-- Added mysql_unbuffered_query(), which is useful for very large result sets.
- (Zeev)
-
-More information on this release on our Releases page.
-
-
-
-
-Version 4.0.5
-
-
-- IMPORTANT: removed /F modifier handling from preg_replace(). Instead
- one should use new preg_replace_callback() function. (Andrei)
-- Added new php.ini directive: arg_separator.input which is used to tell
- PHP which characters are considered as argument separators in URLs.
- Renamed php.ini directive: arg_separator -> arg_separator.output (Jani)
-- Added FastCGI SAPI module. (Ben Mansell)
-- Added array_reduce(), which allows iterative reduction of an array
- to a single value via a callback function. (Andrei)
-- The imageloadfont function of the gd extension should be not platform
- dependent after this fix. (alex@zend.com)
-- Fixed a compatibility problem in some file functions (fgets, fputs, fread,
- fwrite). The ANSI standard says that if a file is opened in read/write
- mode, fseek() should be called before switching from reading to writing
- and vice versa. (alex@zend.com)
-- Fixed argument checking for call_user_func* functions and allowed
- specifying array($obj, 'method') syntax for call_user_func_array. (Andrei)
-- Fixed parent::method() to also work with runtime bindings.
- (Zeev, Zend Engine)
-- Implemented high-performance zlib-based output compression - see
- zlib.output_compression INI directive. (Zeev)
-- Improved ob_gzhandler() to support chunked output buffering - it's
- recommended to use it with 4KB chunks. (Zeev)
-- Fixed chunked output buffering. (Zeev)
-- Forced call_user_method() and call_user_method_array() to take the
- object argument by reference. (Andrei)
-- Fixed binding of ROWIDs in OCI8. (Thies)
-- Added PEAR/Cache as a generic Caching System. (Sebastian, PEAR/Cache)
-- Added IMAP quota support (imap_set_quota, imap_get_quota), enabled/added via
- c-client2000. (kalowsky)
-- Upgraded PCRE to version 3.4. (Andrei)
-- Added array_search which works similar to in_array but returns
- the key instead of a boolean. (jason@php.net)
-- Fixed pgsql transaction support. (Stig, PEAR/DB)
-- Added new object VARIANT() to encapsulate values for use with
- the COM and DOTNET module. Therefore it is now possible to pass
- values by reference, convert php values to extended variant types (currency,
- date, idispatch, iunknown, ...) and define the codepage that should
- be used for unicode - conversion.
-- Improved overall speed of IRCG, added URL handling to message scanner.
- (Sascha)
-- Fixed some modules to allow using output-buffering. (Thies)
-- Added the chroot() function. (Derick)
-- PostgreSQL now does a rollback at the end of a request on every
- persistent connection. This is done by doing an "empty" transaction
- on the connection. This was advised by someone from the PostgreSQL
- core-team. (Thies)
-- Fixed PostgeSQL pg_connect() bug. We would sometimes close the default
- link by accident. (Patch by: aja@nlgroup.ca)
-- Improved OCI8 dead-session detection. (Patch by: George Schlossnagle)
-- Fixed get_meta_tags() multiline bug . (Sean)
-- Prefer random() over *rand48(). (JimJag)
-- Sped up WDDX serialization 2x. (Andrei)
-- Added a new parameter to mail() which appends aditional command line
- parameters to the mail program. (Derick)
-- Added Udm_Clear_Search_Limits mnoGoSearch extension function. (gluke)
-- Fixed mnogosearch protos. Fixed mnogosearch functions return values.
- A bug with capital letters break search has been fixed. (gluke)
-- Static methods can now be called via call_user_method_* functions, e.g.
- call_user_method('method', 'class'), and also array('class', 'method')
- constructs (for array_walk(), for example). (Andrei, Zend Engine)
-- microtime() under Windows now returns accurate values. (James)
-- Added PREG_SPLIT_DELIM_CAPTURE flag to preg_split() that allows for Perl-like
- functionality of capturing parenthesized delimiter expression. (Andrei)
-- Fixed strip_tags() to not strip a lone > character. (Rasmus)
-- When using the ob_gzhandler() PHP now automagically also sets the
- Content-Lengh correctly which enables browsers to use the HTTP
- Keep-Alive feature. (Thies)
-- Improved handling of preg_replace() /F modifier so that it's possible to
- specify array($obj, 'method') construct as a replacement function. (Andrei)
-- Added mysql_get_client_info(), mysql_get_server_info(),
- mysql_get_proto_info(), and mysql_get_host_info() functions. (Sean)
-- Major change of the php pdf api. It could break some functions though
- backwards compatibility was tried to maintain. Adding some still
- missing functions as well. (Uwe)
-- Added mnoGoSearch extension - http://search.mnogo.ru. (Sergey K)
-- Allow URL encoding in DB usernames and passwords. (Stig, PEAR)
-- Added raiseError and setErrorHandling methods to PEAR class. (Stig, PEAR)
-- Added support for converting images from JPG/PNG on the fly with the GD
- extension, which is usefull for creating dynamic WAP-sites. (Derick)
-- Updated ext/mysql/libmysql to version 3.23.32; bug fixes. (tim@mysql.com)
-- Fixed possible crash in all (non-pcre) regex functions. (Thies)
-- Improved str_replace() to accept an array for any parameter - similar
- to preg_replace(). (Andrei)
-- Fixed extract() to properly prefix numeric keys when EXTR_PREFIX_ALL is
- used. (Andrei)
-- Added EXTR_PREFIX_INVALID flag to extract() to automatically prefix
- string keys that do not constitute valid variable names. (Andrei)
-- BeOS patch from svanegmond@bang.dhs.org, modified somewhat by Rasmus.
-- Fixed the Apache module to overwrite PATH_TRANSLATED with SCRIPT_FILENAME,
- only if PATH_TRANSLATED is not previously set. (Zeev)
-- Fixed crash bug in highlight_string(). (Rasmus)
-- Added URL support for getimagesize() function. (Jani)
-- Added xslt_set_scheme_handler() function. (carmelo@akooe.com)
-- Added the pg_lolseek and pg_lotell functions. (Derick)
-- Fixed wrong breaking with the wordwrap function. (Derick)
-- Fixed 'O' and 'r' flags of date() to have correct sign for timezone
- offset. (Andrei)
-- Changed 'Z' flag to date() to always return timezone offset with
- negative sign if it's west of UTC. (Andrei)
-- Added the HTML_Processor class which provides common functions for
- processing HTML. (Sterling)
-- Added localeconv() and strcoll() functions for localization. (Sean)
-- Added the xslt_set_base function. (Sterling)
-- Added support for Zeus 3.3.8.
-- Added odbc_error() and odbc_errormsg() functions. (Stig)
-- New extension for vpopmail - http://www.inter7.com/vpopmail,
- give it a try, but keep in mind that it is not ready for production
- environments. (David Croft, Boian Bonev)
-- Added sybase_get_last_message() to the Sybase CT module. (Jan Fedak)
-- Made ldap_list(), ldap_read() and ldap_search() do parallel search when
- first parameter is an array of link identifiers. (Stig Venaas)
-- Made fopen() of HTTP URL follow redirects, $http_response_header will
- contain all headers with empty string as delimiter. (Stig Venaas)
-- Added Console_Getopt class for parsing command-line args. (Andrei, PEAR)
-- Added an experimental version of the ZZipLib extension which provides the
- ability to read zip files. (Sterling)
-- Allow access to uploaded files in safe_mode. Beware that you can only
- read the file. If you copy it to new location the copy will not have the
- right UID and you script won't be able to access that copy. (Thies)
-- Changed extract() to check that prefixed name is a valid one. (Andrei)
-- Changed extract() to return the number of variables extracted. (Andrei)
-- Added ldap_rename() function. (Stig Venaas)
-- Made ldap_set_option() support controls. (Stig Venaas)
-- Changed ldap_search() and added functions ldap_parse_result(),
- ldap_first_reference(), ldap_next_reference() and ldap_parse_reference()
- to cope with LDAPv3 stuff like referrals and references. (Stig Venaas)
-- Fixed date('r') overflow.
-- Made the php.ini path reported in phpinfo() always point to the absolute
- path that was opened. (Zeev)
-- Made the INI mechanism thread safe. (Zeev, Zend Engine)
-- Changed setlocale() to use LC_* constants. (Jani)
-- ctype functions now follow the extension naming conventions. (Hartmut)
-- Added iconv() function (using libc or libiconv). (Stig)
-- Added ODBC_TYPE constant. (Stig)
-- Added the call_user_method_array function which allows you to call a method
- with an arbitrary number of parameters. (Sterling)
-- ext/odbc: IBM DB2 patch by Walter Franzini. (walter@sys-net.it)
-- Added extension for the cracklib library. (Alexander Feldman)
-
-More information on this release on our Releases page.
-
-
-
-
-Version 4.0.4
-
-
-- Allow assigning a newly created object by reference. This is needed only if
- your constructor makes other data structures reference the $this object (for
- example, $GLOBALS["foobar"] =& $this;)
- The new syntax is $obj =& new MyClass(); (Andi, Zend Engine)
-Allow for three expression types to be sent to functions which are requesting
- the function argument to be passed by reference (only c. was previously
- supported):
- a. func(new myclass());
- b. func(func2()); where func2() returns a reference, i.e. is defined as
- function &func2(...)
- {
- ...
- }
- c. func($var); where func() is defined as function func(&$var) {...}
- You CAN'T count on any other expressions to be passable by reference.
- (Andi, Zend Engine)
-- Made ldap_get_entries() return an array even if there are no entries
- in search result. (Jani)
-- Fixed bad mod_perl interaction which caused segfaults when using LFS (Sascha)
-- const CONSTNAME now gets recognized. Before the patch only @const CONSTNAME
- description was recognized.
-- Added the is_null() function that will return true if a variable is of
- type null. (Sterling)
-- Fixed a bug which made readdir() unusable in some systems. (Jani)
-- Added the get_defined_functions() function which returns a list of all
- currently defined functions. (Sterling)
-- Added the get_defined_vars() function which returns an associative array
- of all variables defined in the current scope and their subsequent values.
- (Sterling)
-- Added the call_user_func_array() function which gives you the ability to
- call a user function by passing an array of parameters as the second
- argument. (Sterling)
-- Added the constant() function which returns the value of a constant given
- the constant's name. (Sterling)
-- Implemented support for Perl-style matching regexp delimiters in PCRE.
- You can use <{[( and )]}> to delimit your expressions now. (Andrei)
-- Introduced new 'F' modifier in PCRE that lets you specify a function
- name in the replacement argument to preg_replace() that will be called
- at run-time to provide the replacement string. It is passed an array of
- matched pattern and subpatterns. (Andrei)
-- Put an end to Bug (kalowsky & Eric Veldhuyzen)
-- Fixed realpath() in Virtual Directory mode (Daniel)
-- Integrated the Phil Nelson's bc math library routines into PHP, now that
- the license allows it (Phil Nelson)
-- Added the xslt_set_error_handler() function to the Sablotron extension.
- (Sterling)
-- Improved Sablotron's error handling system allowing you to catch all
- errors before they are outputted to the screen. (Sterling)
-- Added OpenSSL extension (Stig Venaas)
-- Fixed/created support for Solid 3.0 databases (kalowsky)
-- Fixed support for Solid 2.3 databases (kalowsky)
-- quoted_printable_decode() function is made RFC-2045 compliant. (Kir)
-- Modified preg_grep() to always return the results with keys from the original
- array. (Andrei)
-- Modified preg_replace() to accept Perl-style $n backreferences in addition
- to \\n ones. (Andrei)
-- Modified preg_replace() to ignore backreferences that refer to
- non-existing subpatterns. (Andrei)
-- Fixed column-title buffer-overflow in OCIFetchStatement(). (Thies)
-- Added 'output_handler' INI directive (Zeev)
-- Fixed some buglets in the output buffering mechanism (Zeev)
-- Added transparent gzip compression support (Jade Nicoletti, Zeev)
-- Major overhaul of domxml. Added basic XPath support as well (Uwe)
-- Added 'r' flag to date() which generates an RFC822 formatted date, e.g.
- "Thu, 9 Nov 2000 16:33:01 -0500" (Colin)
-- In CGI mode, $HTTP_SERVER_VARS now includes all of the environment variables
- as well (Zeev)
-- Allow user to use mysql_use_result in mysql queries (Stas)
-- Fixed a memory leak that would occur when restarting Apache often
- (mookid@sigent.ru)
-- Fixed a bug that prevented $argv and $argc from being defined in the command
- line version of PHP (Stas)
-- Fixed a bug that prevented a changed compile-time extension_dir from
- affecting modules that were loaded via php.ini (Zeev)
-- Fixed a bug in ftp_mkdir() when used on ftp server which doesn't return
- the full path (Jani)
-- Added ImageCreateFromString() which creates an image stream out of
- e.g. a MySQL blob. (Mathieu)
-- Fixed a crash bug in imagewbmp() (Jani)
-- Changed the sablot configuration file so that if you use any version of
- Sablotron below 0.44 you must use Sablotron's built-in Expat libraries.
- (Sterling)
-- Added basic authentication support to thttpd (Sascha)
-- Added support for the Caudium webserver (http://caudium.net/). It's based
- on the Roxen SAPI module. Many bugs have been identified and fixed. (David)
-- Fixed mysql_close(), pg_close(), msql_close() and sybase_close() - they
- weren't properly closing the SQL connections (Zeev)
-- Fixed crypt() to supply random seed if none is given (Andi)
-- Made print_r() support recursive data structures, e.g. $GLOBALS. (Zeev)
-- Fixed a bug that caused PHP not to properly flush its output buffer, if more
- than one output buffer was used. (Zeev)
-- Fixed a bug that could draw the shutdown sequence of the PHP Apache module
- into an endless loop, under certain circumstances. It could cause Apache
- processes under Solaris to get stuck, especially when using output
- buffering. (Zeev)
-- Added support for serializing references (Stas)
-- Fixed conflict with OpenLDAP and Oracle 8.1.x (Jani)
-- parse_ini_file() supports a new optional 2nd argument that instructs it
- to divide the directives to arrays according to the sections in which they
- reside (Zeev)
-- parse_ini_file() is now thread-safe, and supported under Windows (Zeev)
-- Unified aborted-connection semantics of all SAPI modules (Sascha)
-- URL-opened files now store the HTTP response header in $http_response_header
- (Zeev)
-- Fixed array_rand() to shuffle results when the number of requested
- elements is the same as the number of elements in the array. (Andrei)
-- Added replace parameter to header() (Sascha)
-- Fixed handling of single quotes in transparent session-id mode (Sascha)
-- Fixed "php://*" fopen handler (Sascha)
-- Made rename work in threadsafe enviroments (Daniel)
-- Made session_destroy() close files before unlinking (Daniel)
-- Added array_sum() function. (Andrei)
-- Fixed a bug in session.c. The php_session_save_current_state did not check
- if mod_data is NULL and such situation is possible if the user calls
- session_module_name with a parameter. (alex@zend.com)
-- Added IIS Admin extension. (Frank)
-- OCIBindByName() now does better parameter-checking. (Thies)
-- Made read() binary-safe in sockets.c (Chris Vandomelen)
-- Made array_intersect() and array_diff() not alter order (Stig Venaas)
-- Made ldap_connect() accept URL in host parameter when using OpenLDAP
- 2.x. To use SSL, use ldaps://host/ as URL. (Stig Venaas)
-- Made resource type names visible, e.g. var_dump() and
- get_resource_type() display "file" for file resources. (Andrei)
-- Added the curl_getinfo() function to find out information about a CURL
- transfer. This function requires cURL 7.4.0 or above. (Sterling)
-- Added the CURLOPT_KRB4, CURLOPT_INTERFACE, CURLOPT_QUOTE, CURLOPT_POSTQUOTE,
- CURLOPT_QUOTE and CURLOPT_HTTPPROXYTUNNELL options. (Sterling)
-- Renamed the shm_* functions to shmop_* (Derick)
-- Updated ext/mysql/libmysql to version 3.23 (tim@mysql.com)
-- Added ldap_get_option() and ldap_set_option() functions (Stig Venaas)
-- Fixed a crash in CGI mode, in case no file was provided
- (Daniel Beulshausen& Zeev)
-- Fixed possible crash bug in imap_fetchstructure() (Jani)
-- Fixed possible crash bug in imap_open() (Jani & Mark Musone)
-- Added url_rewriter.tags configuration directive (Sascha)
-- Added CORBA client extension, ready for use (eriksson@php.net)
-- Fixed memory leak in x-httpd-source mode (Jason Greene)
-- Changed ext/gd not to be enabled by default (Jani)
-- Make increment of empty string ("") behave like in PHP 3 and result in "1"
- (Andi, Zend Engine)
-- Added POST handler for Adobe FDF format (Hartmut)
-- Added transparent read and write .gz-files on glibc based systems
- using the 'zlib:' fopen wrapper (Hartmut)
-- Fixed a problem in the configuration parser (two null bytes were added
- to each ENCAPSULATED TC_STRING) (alex@zend.com)
-- Added HMAC support in the mhash module (nmav@altera.gr)
-- Added module for Ovrimos sql server (nmav@altera.gr)
-
-More information on this release on our Releases page.
-
-
-
-
-Version 4.0.3
-
-
-- Fixed a possible crash in -a interactive mode (Zeev, Zend Engine)
-- Added mysql_escape_string() (Peter A. Savitch and & Brian Wang)
-- Fixed many possible crash bugs with improper use of the printf() family of
- functions (Andi)
-- Fixed a problem that allowed users to override admin_value's and admin_flag's
- (Zeev)
-- Fixed PostgreSQL module to work when the link handle is omitted (Zeev)
-- Fixed returning of empty LOB fields in OCI8. (Thies)
-- Added Calendar module to default Win32 build (Andi)
-- Added FTP module to default Win32 build (Andi)
-- Fixed crash in the POSIX getrlimit() function (alex@zend.com)
-- Fixed dirname() under certain conditions (Andi)
-- Added --with-imap-ssl to support SSL'ized imap library in RH7 and others
- (Rasmus)
-- Fixed possible crash bug in parse_url() (Andi)
-- Added support for trans sid under Win32 (Daniel)
-- IPv6 support in fopen (Stig Venaas)
-- Added the shmop extension. It allows more general ways of shared memory
- access. (thanks to Ilia Alshanestky <iliaa@home.com> and Slava Poliakov
- <slavapl@mailandnews.com> (Derick)
-- Added the ability for CURLOPT_POSTFIELDS to accept an associative array of
- HTTP POST variables and values. (Sterling)
-- Added the CURLOPT_HTTPHEADER option to curl_setopt(). (Sterling)
-- Added the curl_error() and curl_errno() functions. (Sterling)
-- Changed ext/db not to be enabled by default (Jani)
-- Fixed building Apache SAPI module on SCO UnixWare (Sascha)
-- Fixed writing empty session sets to shared memory (tcarroll@chc-chimes.com)
-- Added support for BSD/OS make (Sascha)
-- Added improved URL rewriter (Sascha)
-- Fixed readdir_r() use on Solaris (Sascha)
-- Improved HTTP headers for private-caching (jon@csh.rit.edu, Sascha)
-- Added new function session_cache_limiter (jon@csh.rit.edu, Sascha)
-- Added ftp_exec to the ftp functions (thanks to <jhennebicq@i-d.net>)
- (Derick)
-- PEAR: add last executed query as debug info in DB errors (Stig)
-- PEAR: allow multiple modes in PEAR_Error (Stig)
-- Made the Sybase CT module thread safe (Zeev)
-- Added second argument to array_reverse() that indicatese whether
- the original array keys should be preserved. (Andrei)
-- Clean up htmlspecialchars/htmlentities inconsistencies. (Rasmus)
-- PEAR: renamed DB_GETMODE_* to DB_FETCHMODE_*, added setFetchMode()
- in DB_common to set the default mode, added some MySQL tests (Stig)
-- Made eval() and several other runtime-evaluated code portions report the
- nature and location of errors more accurately (Stas)
-- Added an optional parameter to wordwrap that cuts a string if the length of a
- word is longer than the maximum allowed. (Derick)
-- Added functions pg_put_line and pg_end_copy (Dirk Elmendorf)
-- Added second parameter for parse_str to save result (John Bafford)
-- Fixed bug with curl places extra data in the output. (medvitz@medvitz.net)
-- Added the pathinfo() function. (Sterling)
-- Updated sybase_ct module and its sybase_query to use high performance API.
- (Joey)
-- Added a more configurable error reporting interface to DB. (Stig)
-- Added is_uploaded_file() and move_uploaded_file() (Zeev)
-- Added several directives to php.ini - post_max_size, file_uploads,
- display_startup_errors - see php.ini-dist for further information (Zeev)
-- Worked around a bug in the libc5 implementation of readdir() (Stas)
-- Fixed some potential OpenBSD and NetBSD crash bugs when opening files. (Andi)
-- Added EscapeShellArg() function (Rasmus)
-- Added a php.ini option session.use_trans_sid to enable/disable trans-sid.
- (Sterling)
-- Added the Sablotron extension for XSL parsing. (Sterling)
-- Fixed a bug in checkdate() which caused < 1 years to be valid (Jani)
-- Added support for an optional output handler function for output
- buffering. This enables transparent rendering of XML through XSL,
- transparent compression, etc. (Zeev)
-- Added support for user defined 'tick' callback functions. This helps
- emulate background processing. (Andrei)
-- Fixed problem with having $this as the XML parser object. (Andrei)
-- Internal opened_path variable now uses the Zend memory manager so that full
- paths of files won't leak on unclean shutdown (Andi)
-- Removed support of print $obj automatically calling the __string_value()
- method. Instead define yourself a method such as toString() and use
- print $obj->toString() (Andi, Zend Engine)
-
-More information on this release on our Releases page.
-
-
-
-
-Version 4.0.2
-
-
-- Added PHP API for Zend's ticks. (Stig)
-- PHP 3 regression testing framework re-born (Stig)
-- Added php_uname() function (Stig)
-- Made a minor change to allow building with OpenLDAP 2.0 (Stig Venaas)
-- Fixed a bug in preg_replace() that would truncate subject string if the
- first argument was en empty array. (Andrei)
-- Added ob_get_length function (Stig)
-- Fixed a bug that did not respect limit parameter in preg_replace() when
- using /e modifier. (Andrei)
-- Added ability for each xml_set_*_handler() function to take the
- array($obj, 'method') syntax for the handler argument as well
- as the normal function name. (Andrei)
-- Updated array_walk() to be able to accept array($obj, 'method')
- syntax for the walk function. (Andrei)
-- Fixed segfault with fgets(), fgetcsv(), fgetss(), and fread() when
- called with negative length argument. (Torben)
-- Fixed by-reference parameters passing for xml_ functions and for scanf
- functions (Stas)
-- Added experimental Oracle LDAP SDK support. 8.1.6 or later needed. Configure
- with something like --with-ldap=/usr/local/oracle/product/8.1.6 (Stig Venaas)
-- Fixed memory leaks in eval(); A script that used eval() extensively, could
- end up consuming very large amounts of memory during execution (Zeev, Zend
- Engine)
-- Fixed memory_limit feature, which did not work properly in previous versions
- (Zeev, Zend Engine)
-- Fixed stdout support with the swf extension. (Sterling)
-- Fixed byte order for ip2long and long2ip (Stas)
-- Fixed dbase_add_record. (Sterling)
-- Added support for libmcrypt 2.4.4 (Derick)
-- Added strncasecmp function (Andi, Zend Engine)
-- Fixed FTP module to accept multiline server replies (Jani)
-- Fixed switch which only has a single default rule. (Andi, Zend Engine)
-- Fixed problem with nested foreach()'s. (Andi, Zend Engine)
-- The CCVS module is now stable and compiling. It compiles as a CGI and into
- Apache cleanly without warnings. (Brendan W. McAdams)
-- Fixed mSQL_close(). (nick@loman.net)
-- Made return() in a require()'d file work like return() in an include()'d
- file (Andi & Zeev, Zend Engine)
-- Changed require_once() to work using the same table as include_once()
- (Andi & Zeev, Zend Engine)
-- Fixed PostgreSQL module to work when the link handle is omitted (Zeev)
-- Fixed the Sybase modules to work properly with PHP 4.0 (Zeev)
-- Fixed CLOB handling in OCI8 driver when using variable-width
- character sets. (Thies)
-- Added 4th optional parameter to sybase_[p]connect to specify the charset
- for the connection (alf@alpha.ulatina.ac.cr)
-- Fixed support for current thttpd releases. (Sascha)
-- Added support for kerberized IMAP library using --with-kerberos
- (Rasmus, Sascha)
-- Virtualize realpath, chmod, chown and utime (Stas)
-- Support content-encoding headers in file upload MIME parts
- (Ragnar Kjørstad)
-- Fixed warning when shutting down OCINLogon() connections. (Thies)
-- Fixed \n in session variables bug on Win32 (Stas)
-- OCIError() would sometimes not report failed connections. (Thies)
-- Fixed HEAD request bug on an Apache ErrorDocument redirect and preserve
- the status code across the redirect as well. (Rasmus)
-- Added Olympus-specific tags to read_exif_data() (Rasmus)
-- Fixed bug in imap_fetchheader() where using FT_PREFETCHTEXT didn't return
- the body. Bug . (Jani)
-- Fixed exec() returning "\0" when output is empty
-- Added XML_Parser class in PEAR (Stig)
-- Added "make test" target in pear/ and added some regression tests (Stig)
-- Fixed bug in strip_tags function as per bug (Rasmus)
-- Fixed reading of IPTC via GetImageInfo() for certain JPEG files. (Thies)
-- Improved the output-buffering functions to be re-entrant (Zeev)
-- Made ldap_add(), ldap_modify(), ldap_mod_add(), ldap_mod_replace()
- binary-safe. Original patch: Terrence Miao <terrence_miao@email.com> (Jani)
-- CGI aka. command line version has now an option '-l' for syntax check
- without execution (Hartmut)
-- Fixed bug in ldap_get_values_len() which makes it NULL-safe. (Jani)
-- Bug-report and fix submitted by Michel Alexeline <alexel@dr15.cnrs.fr>
-- Make ext_skel create a Makefile.in set up to handle shared extension
- support automatically (Rasmus)
-- Fixed php_realpath not to die on non-existing files (needed for touch())
- (Stas and china@thewrittenword.com)
-- Fixed get_browser() function (Stas)
-- Fixed symbol clash which caused a DSO problem on OpenBSD (Rob Black and
- anil@recoil.org)
-- Added new function: ldap_compare(). (Jani)
-- Fixed a bug in ldap_get_entries() and ldap_get_attributes(). (Jani)
-- Ported DB to new error reporting scheme in PEAR. (Stig)
-- Added sybase and ibase DB backends in PEAR. (Sterling)
-- New PEAR package Payment_Verisign for use with the Payflow Pro
- (pfpro) extension. (David Croft)
-- Added CURL support. (Sterling)
-- Catch users trying to set "compatibility" parameter in PDF, which is not
- supported from user-land. (Joey)
-- Fixed dbase_add_record. (Sterling)
-- Added new function wordwrap() to wordwrap long strings from Chris
- Russel <russel@yorku.ca> (David Croft)
-- Added four additional arguments: attrsonly, sizelimit, timelimit, deref which
- were missing in ldap_search(), ldap_list() and ldap_read() functions (Jani)
-- Fixed a bug in ldap_search/list/read() which prevented returning the partial
- results when 'Sizelimit exceeded' error occurred. (Jani Taskinen)
-- Fixed preg_replace() to automatically escape quotes in matched
- strings when using /e modifier. (Andrei)
-- Itanium patch (Steve Robb)
-- Set default include_path so PEAR files can be reached (Stig)
-- Added "pear" executable, requires CGI version installed (Stig)
-- Added extension ii for Ingres II native support. See README in ext/ingres_ii
- directory. (David H)
-- Added Win32 project for the Interbase module (Zeev)
-- Added ability to perform calls to the parent class without explicitly
- specifying its name, using parent::func_name(...) (Zeev, Zend Engine)
-- You can now call Ora_Error() without prameters to get the reason
- for a failed connection attempt. (Kirill Maximov)
-- New extension "pfpro" for interface with Verisign Payflow Pro (David Croft)
-- Added IMG_GIF, IMG_JPG, IMG_JPEG, IMG_PNG and IMG_WBMP constants for
- imagetypes() function (Rasmus)
-- Added ImageTypes() function which returns a bitfield with the supported
- image formats. 1=gif, 2=jpeg, 4=png and 8=wbmp (Rasmus)
-- Make it possible to specify an empty string as a thousands-seperator
- in number_format() (Rasmus)
-- Shared module support for LDAP extension (Troels Arvin)
-- Fixed a bug with imap_mail where apache would segfault if the rpath
- parameter was specified.
-- Use dashes and short day name in cookies since some browsers seem picky
- about this (Rasmus)
-- Added pspell module. (Vlad)
-- Added 3 additional arguments to the user-defined error handler - the file
- name and line number in which the error occured, and the context (local
- variables) of the code in which the error occured (Zeev, Zend Engine)
-- Improved the error handling code to handle an error in a user-defined error
- handling function (Zeev, Zend Engine)
-- Fixed leak when using string offsets in the array() construct.
- (Andi, Zend Engine)
-- Fixed corruption problem when changing deeply nested values in objects.
- (Andi & Zeev, Zend Engine)
-- Improved array_multisort() to be able to specify sort type as well sort
- order. Incidentally, it can be used to sort multi-dimensional arrays
- as well. (Andrei)
-- Fixed a possible data corruption in case of a huge amount of aborted requests
- (Zeev)
-- Apache module would sometimes close a wrong file-descriptor. (Sascha)
-- Fixed use of alternative storage handlers in the session module. (Sascha)
-- Updated str_pad() to be able to pad on left/right/both sides. (Andrei)
-- Fixed crash in gzopen(). (Thies)
-- Multiple character set support in gdttf.c (Rob Goodwin)
-- When using HTTP auth from PHP, fill in the %u custom log field so the
- authenticated used id will get logged in the Apache access_log (Rasmus)
-- Support for pdflib 3.01. (Uwe)
-- FDF Data is handled properly and can be accessed by reading
- HTTP_RAW_POST_DATA. (Uwe)
-- Added new 'O' format modifier that will output the GMT offset as "[+-]HHMM"
- (eg: Pacific time is -0700). This is useful for things such as Date: mail
- headers. (Mike W)
-- Fixed crash on OCI?Logon() failure. (Thies)
-- Make the special Header("http/...") response be case insensitive like 3.0
- (Rasmus)
-- Allow cybercash to compile as a DL module. (Sterling)
-- Fixed the dbase_create function. (Sterling)
-- Fixed a problem under some versions of Windows that could cause PHP to hang
- on startup if errors occured, e.g. in the php.ini file (Zeev)
-- Fixed opendir() again. It should actually work well continuously now (Zeev)
-- Added three additional arguments to be sent to a user-defined error handler -
- the filename and line number in which the error occured, and the context
- (the local variables) of the error (Zeev, Zend Engine)
-- Improved the error handling code to handle an error in a user-defined error
- handling function (Zeev, Zend Engine)
-- Added an optional parameter to preg_replace() that can be used to
- specify how many replacements to make. (Andrei)
-
-More information on this release on our Releases page.
-
-
-
-
-Version 4.0.1
-
-
-- Fixed a possible crash in the LDAP modify code. (Eric Kilfoil)
-- Fixed a bug in opendir(), which prevented readdir() from working properly if
- the $dir argument wasn't explicitly specified (Zeev)
-- Made --enable-discard-path work again. (Andi)
-- Removed 8KB limit on line length of the file() function (Zeev)
-- Disabled dl() when PHP is being used as a module inside a multithreaded web
- server - it didn't work before, and caused weird results (Zeev)
-- Added the ImageColorClosestHWB(), ImageCopyMerge() and ImagePaletteCopy()
- functions. (Sterling)
-- Added ImageCreateFromWBMP() function. (Jouni)
-- Fixed problems with POST requests under the NSAPI module. (Roberto Biancardi)
-- Added spliti() function. (Thies)
-- Fixed serializer behaviour with regards to serializing objects whose class
- definition was not available in the deserializing context. (Sascha)
-- Improve memory cache performance and increase cache size. (Stas, Zend Engine)
-- Added a crc32 checksum function - used by the UdmSearch search engine
- and currently run through a system call. This will speed up the UdmSearch
- php frontend significantly. (Rasmus)
-- Modified in_array() to not touch array pointer. (Andrei)
-- Added restore_error_handler(). (Zeev, Zend engine)
-- Fixed erroneous file names and line numbers in error situations under the
- multithreaded version of PHP - most noticeably Win32 (Zeev, Zend Engine)
-- Fixed problem with CGI crashing on certain servers especially Windows Apache
- & O'Reilly website (Andi)
-- Added Pi3Web SAPI module; run ./configure --with-pi3web to enable this.
- (Holger; zimpel@t-online.de)
-- Enhanced WDDX functions to call __sleep() and __wakeup() when working on
- objects. (Andrei)
-- Changed WDDX to serialize arrays as structs only if needed. (Thies)
-- Implemented max_execution_time under Win32 (Zeev)
-- Updated strtotime() to handle many more formats. It now has complete
- feature parity with GNU date command. (Andrei)
-- Added support for multiple arguments in unset(). (Faisal, Zend Engine)
-- Functions that expect a resource but are passed something else now return
- NULL instead of FALSE. (Thies, Zend Engine)
-- Fixed gmmktime(), on certain systems it incorrectly adjusted for the timezone
- offset and daylight savings time. (Andrei)
-- Moved VC++ Win32 project and workspace files to the win32 directory
- (Zeev)
-- Fixed checkdate() to not return true on non-numeric arguments (Rasmus)
-- Added --enable-c9x-inline option for compilers which support the new C9x
- standard. If you encounter undefined references to i_zend_is_true and
- other symbols, you should enable this. (Sascha, Zend Library)
-- Fixed a problem in ldap_add() and ldap_modify(), sometimes added trailing
- garbage to the values (Stig Venaas)
-- Fixed a problem with dbmopen() not handing 'c' correctly with dbm/db/ndbm
- databases. (JimJag)
-- Fixed a crash in number_format() when used with locales. (Andrei)
-- Fixed an initialization problem in the MS-SQL problem that could cause
- a crash in mssql_query() (Zeev)
-- Upgraded PCRE to version 3.2 and fixed a bug when anchored pattern
- matched an empty string. (Andrei)
-- Fixed a bug that prevented PHP from paying attention to the extension_dir
- directive with extensions that were loaded from the php.ini file (Zeev)
-- Changed set_error_handler() to return the name of the previously defined
- error handler, if any (Zeev, Zend Engine)
-- Declared <? php_track_vars ?> officially dead. It didn't work in PHP 4.0.0
- either, but now it's gone for good (Zeev)
-- Make convert_cyr_string() binary safe and stop it from corrupting other
- PHP variables. (Andi)
-- Added functions array_unique, array_intersect and array_diff (Stig Venaas)
-- Fixed problem when using uninitialized values in comparisons with strings.
- They behave as empty strings again just like in PHP 3.
- (Andi & Zeev, Zend Engine)
-- Fixed 'Z' flag in date() to adjust for daylight savings time. (Andrei)
-- Fixed var_dump() not to modify the internal order of array elements (Zeev)
-- Fixed stripcslashes() to remove to strip \ in unknown escapes instead of
- leaving it. (Andrei)
-- Changed WDDX to always serialize arrays as structs. (Andrei)
-- Fixed include_once() to issue a warning in case the supplied file name is
- not found (Zeev, Zend Engine)
-- Fixed a bug in get_declared_classes() which could return the same class
- multiple times under certain circumstances (Zeev, Zend Engine)
-- Fixed a bug in rawurldecode() that would cause in rawurldecode() corrupting
- its argument (Zeev)
-- Parse errors (or other errors) in the php.ini files under Windows will no
- longer mess up the HTTP headers in CGI mode and are now displayed in a
- message box (Zeev)
-- Fixed a crash in OCIFetchStatement() when trying to read after all data
- has already been read. (Thies)
-- fopen_wrappers() are now extensible via modules (Hartmut Holzgraefe)
-- Make trim strip \0 to match php 3 (Rasmus)
-- Added function imagecreatefromxbm(). (Jouni)
-- Added function imagewbmp(). (Jouni, based on patch from Rune Nordbøe
- Skillingstad)
-- Added str_pad() for padding a string with an arbitrary string on left or
- right. (Andrei)
-- Made the short_tags, asp_tags and allow_call_time_pass_reference INI
- directives work on a per-directory basis as well, e.g. from .htaccess
- files. (Zeev)
-- Added fflush() function. (Eric Huss)
-- Fixed a problem with static variables, default function arguments and class
- member variables, that contained array values. (Andi & Zeev, Zend Engine)
-- Fixed virtual() when used with output buffering (Marc Pohl)
-- Clean up constants in flock() function and add optional 3rd arg which
- is set to true on EWOULDBLOCK (Rasmus)
-- Added functions pg_loimport(), pg_loexport(). (Jouni)
-- Added SWF support to getimagesize() function (Derick Rethans)
-- Added support for both indexed and non-indexed arrays of file uploads
- eg. name="file[]" type="file" (Rasmus)
-- Added create_function(), which gives the ability to create functions
- on-the-fly (Zeev, Zend Engine)
-- Added support for comparisons of arrays (with arrays) and objects (with
- objects); The equality operator (==) performs an unordered comparison,
- whereas the identity operator (===) performs an ordered comparison (Zeev,
- Zend Engine)
-- Allow all functions that receive user-defined function callbacks to accept
- an array that contains an object and a method name, in place of a function
- name, e.g. usort($array, array($obj, "ObjSort")) (Zeev, Zend Engine)
-- Added set_error_handler() to allow custom error handling functions,
- instead of the built-in error handling code (Zeev, Zend Engine)
-- Renamed user_error() to trigger_error(); user_error() remains
- defined for compatibility (Zeev, Zend Engine)
-- Fixed the global/static statements to require a trailing terminating
- semi-colon ';'. (Andi, Zend Engine)
-- Cleaned up PCRE extension and made it binary-safe. (Andrei)
-- Added third argument to in_array(). If it's true, then in_array()
- will use strict comparison instead of the default one. (Andrei)
-- Added pg_trace() and pg_untrace (Dominic J. Eidson & Zeev)
-- ignore_user_abort=Off is now default. (Thies)
-- Added array_merge_recursive() that will recursively merge values
- under the same keys. (Andrei)
-- fixed crash in OCIParse when parsing invalid SQL. (Thies)
-- Fixed a bug in mysql_connect() that made it ignore the socket argument, in
- case of non-persistent connects (Zeev)
-- Added disable_functions php.ini directive, to allow administrators to disable
- certain functions for security reasons (Zeev)
-- Fixed sessions on Win32. When setting the directory depth parameter in
- save_path you need to now delimit it with a ';' instead of ':', e.g
- "5;/tmp" instead of "5:/tmp" (Andi)
-- Changed the Apache handler's return status to 'Declined' when a requested
- PHP file could not be found. Returning 'Not Found' caused problems
- in the ErrorDocument handler stage in that $REDIRECT_REDIRECT_ERROR_NOTES
- was not getting set at all. Moving to 'Declined' should fix this and I
- can't see any other side effects. (Rasmus)
-- Fixed scanning decimal numbers in internationalized environments. They should
- always be in standard US format e.g. 23.3. (Andi, Zend Engine)
-- Added second argument to preg_quote() which allows quoting of
- one additional character, usually the regex delimiter. (Andrei)
-- Uncommitted outstanding OCI8 transactions are now rolled back
- before the connection is closed. (Thies)
-- ignore_user_abort() & friends should now work in CGI mode as well.
- (Patch by daniel.braun@ercom.fr)
-- Added extension YAZ (dickmeiss).
-- Fixed a crash bug triggered by certain cases of class redeclarations
- (Stas & Zeev, Zend Engine)
-- Fixed min()/max() segfault. (Andrei)
-- New module for reading EXIF header data from JPEG files. Most digital
- cameras will embed all sorts of information about a picture inside the
- jpeg images it generates. (Rasmus)
-- Fixed basename() bug where "file.ext///" would not return the same
- as "/path/file.ext///" (Rasmus)
-- Added the swf_ortho function. (Sterling)
-- Moved to virtual current working directory support. This highly improves the
- functionality and stability of multi-threaded versions of PHP (Andi, Sascha)
-
-More information on this release on our Releases page.
-
-
-
-
-Version 4.0.0 Release
-
-
-- Allow the writing of flash files to stdout.
-- Fixed a crash bug in .phps syntax-highlighted files (Andi)
-- Improved round() to allow specification of rounding precision.
- (Andrei, Todd Kirby <kirbyt@yahoo.com>)
-- Added SORT_REGULAR, SORT_NUMERIC, SORT_STRING flags that can be used with
- non-user sort functions for precise sorting behavior. (Andrei)
-- Fixed two 64-bit issues (startup crash, gethostbyaddr). (Sascha)
-- NULL values are now preserved in the return value of mysql_fetch_array()
- and mysql_fetch_object(). (Andrei)
-- Ported InterBase module finally from PHP 3 to PHP 4. Full support for
- InterBase 6. (Jouni)
-- Added swf_definepoly for drawing polygons to the SWF functions. (Sterling)
-- Ported imagegammacorrect from PHP3 to PHP4. (Sterling)
-- Added array_rand() function. (Andrei)
-
-More information on this release on our Releases page.
-
-
-
-
-Version 4.0, Release Candidate 2
-
-
-- NSAPI WIN32 Module compilable, untested (Shane)
-- Apache WIN32 Module compilable and lightly tested. (Shane)
-- Enabled assert() by default in php.ini-dist. (Andrei)
-- Put in safeguards in case dynamic code evaluation in assert() and
- preg_replace() with /e modifier fails. (Andrei)
-- Fixed infinite recursion when serializing $GLOBALS[] in WDDX. (Andrei)
-- Made WDDX serialization properly escape <, >, and &. Also speeded up
- the serialization in general. (Andrei)
-- Moved install-local to install-sapi for clarity. (Joey)
-- Improved extension build framework. Refer to README.SELF-CONTAINED-EXTENSIONS
- for an introduction. (Sascha)
-- ImagePolygon() is no longer limited by a maximum number of polygons.
- (Marc Pohl)
-- Added configure time checking for bcmath package. (Joey, Sascha)
-- Added get_declared_classes(). (Andrei, Zend Engine)
-- Added initial NSAPI module from Jayakumar Muthukumarasamy. (Rasmus)
-- Added the SWF module which allows you to create Macromedia Flash files via
- libswf. (Sterling)
-- Improved UNIX build system to support more vendor make tools (Sascha)
-- Updated natural comparison/sorting algorithm by Martin Pool
- <mbp@humbug.org.au>. (Andrei)
-- Fixed a crash in array_multisort() that happened when empty arrays
- were passed to it. (Andrei)
-- Added substr_count() from Peter Kovacs. (Andrei)
-- Added an optional third argument to fseek to indicate where to seek from.
- (Andrei)
-- OCIBindByName() will no longer complain about bindlength beeing zero. (Thies)
-- Converted the IMAP module to the high performance API (Zeev)
-- The fgetcsv() function now handles embedded end-of-line in a quoted field
- (Nick Talbott)
-- Added user_error(), to allow explicitly generate error messages from scripts
- (Zeev, Zend Engine)
-- Fixed a problem in long2ip() that occasionally returned incorrect IP address.
- (Evan, Andrei)
-- Fixed many memory leaks in the IMAP module (Stas, Andi, Zeev)
-- Fixed bug in number_format (Jon Forsberg)
-- Make error_prepend_string and error_append_string work (Rasmus)
-- array_walk() now automatically resets the array. (Andrei)
-- Added natural comparison/sorting routines strnatcmp(), strnatcasecmp(),
- natsort(), and natcasesort(). These are useful for comparing and sorting
- strings that contain numbers. Based on the code from Martin Pool
- <mbp@humbug.org.au>. See http://www.linuxcare.com.au/projects/natsort/
- for more info on natural sorting. (Andrei)
-- Zeus Webserver support (version 3.3.6+) for ISAPI (Ben Mansell)
-- Fixed several problems with the PATH_TRANSLATED and PHP_SELF under Apache
- (Paul Gregg & Zeev)
-- Ported ldap_get_values_len() function from PHP3 to PHP4. (Sterling)
-- Fixed a problem in include_once() with non constant arguments (Andi & Zeev,
- Zend Engine)
-- Added php.ini-optimized (Zeev)
-- Ported ldap_errno(), ldap_err2str() and ldap_error() from PHP3 to PHP4.
- (Sterling)
-- WDDX now defaults to ISO-8859-1. (Thies)
-- Fixed crash resulting from IMAP's error handling (Stas)
-- Added $HTTP_POST_FILES[filename][tmp_name] - it was previously impossible to
- retrieve the temporary name of an uploaded file using $HTTP_POST_FILES[]
- (Zeev)
-- Made the IMAP and LDAP modules compilable under Windows and thread-safe
- (Zeev)
-- Fixed a problem when dealing with large POST blocks in CGI mode (Zeev)
-- Added session_get_cookie_params() function. (Sterling)
-- Fixed return of stristr() to no longer always be lowercased. (Andrei)
-- Changed the Windows version of PHP so that a php.ini file is no
- longer mandatory (Zeev)
-- session_start() is now more verbose if headers cannot be send. (Thies)
-- Fixed a memory leak when using assign-op bitwise operators on strings (Zeev,
- Zend Engine)
-- Added support for reading properties that require arguments in the COM
- module - writing to them will only be supported in PHP 4.1 (Zeev)
-- Fixed a very old legacy memory leak in the COM module (Zeev)
-- Fixed problems with object-overloading support - noteably, COM and Java
- (Zeev, Zend Engine)
-- Fixed an overrun in WDDX. (Thies)
-- Fixed a crash bug with modules loaded through dl() not properly freeing their
- resources (Zeev, Zend Engine)
-- Added localtime() function. (Sterling)
-- Added the 'I' format option for the date function, this option will return
- true or false depending on whether or not daylight savings time is in effect.
-(Sterling)
-- Added gmstrftime() function. (Sterling)
-- snmp_walkoid is now an alias for snmp_realwalk. (Sterling)
-- Fixed a bug that could cause a crash when using 'global' inside large include
- files (Stas, Zend Engine)
-- Added --enable-libgcc switch to force linking against libgcc (Sascha)
-- Fixed dynamic loading where extension_dir had no trailing slash (Sascha)
-- Fixed dynamic loading on OpenBSD (Sascha)
-- Improved POSIX threads check. ZTS works now on at least Linux, Solaris,
- FreeBSD and OpenBSD (Sascha, TSRM)
-- Added !== operator support. (Torben, Zend Engine)
-
-
-
-
-
-Version 4.0, Release Candidate 1
-
-
-- Added support for UCD-SNMP 4.1.x (Sascha)
-- Fixed a data corruption bug in mysql_result(), if used in table.fieldname
- mode (Zeev)
-- Fixed a crash problem in func_num_args(), func_get_arg() and func_get_args()
- when used as function arguments (Andi, Zend Engine)
-- Added get_class_methods(string classname) function. (Andrei)
-- Added 'I' switch to test whether or not DST is active. (Sterling)
-- Fixed a data corruption bug in mysql_result(), if used in table.fieldname
- mode (Zeev)
-- Modified the registry INI entry reader (Win32) to work with drive letters.
- For example, if you wish to wish to specify INI entries for C:\foo\bar, you
- should create HKLM\PHP\Per Directory Values\C\foo\bar in the registry, and add
- string values for each directive you want to override in this directory (Zeev)
-- Fixed extract() for EXTR_PREFIX_SAME and EXTR_SKIP cases. (Andrei)
-- stristr() no longer modifies it's arguments. (Thies)
-- Don't default to iso-8859-1 since this confuses some browsers. (Rasmus)
-- Make it possible to specify both a port and a socket
- in mysql_[p]connect. (Rasmus)
-- Added --disable-pic for disabling generating PIC for shared objects
- on platforms which support it (i.e. Linux) (Sascha)
-- serialize()/unserialize() now call __sleep() and __wakeup() when
- working on objects. (Thies)
-- renamed to_string() method to __string_value() for consistency.
- (Thies, Zend Engine)
-- Fixed a bug in the third argument to define()
-- Added is_numeric() that returns true if the argument is a number
- or a numeric string. (Andrei)
-- domxml now supports libxml 2.0 Beta and drops support for older versions,
- due to massive changes in libxml
-- fixed possible crash in unserialize() if serialized data was
- corrupted. (Thies)
-- Changed $HTTP_STATE_VARS to $HTTP_SESSION_VARS. Use only the latter
- version now! (Andrei)
-- Added GD-JPEG Support (Rasmus)
-- Prevent from loading dynamic PHP modules which were compiled with different
- debug and thread safety modes than PHP, which resulted in a crash (Andi)
-- connection_aborted() and friends work again (Thies)
-- Upgraded to libtool 1.3.4 (Sascha)
-- UNIX configure creates config.nice in the build directory now which allows
- easy reuse of configuration options (Sascha)
-- Added support for embedded MySQL client library. Unless you specify a path
- to --with-mysql, the bundled MySQL client library will be used (Sascha)
-- Added include_once() and require_once() functionality (Andi, Zend Engine)
-- Removed support for pdflib < 3.0 (Uwe)
-- Added auto-registration of everything in $HTTP_SESSION_VARS[] if
- register_globals is turned off. (Andrei)
-- Cleaned up extension namespace (Stig)
-- OCINLogon() sessions are now closed again. (Thies)
-- Added ip2long() and long2ip(),
- courtesy of Faisal Nasim <faisal@nasim.org> (Andrei)
-- Added ftruncate() and fstat(),
- courtesy of Faisal Nasim <faisal@nasim.org> (Andrei)
-- Added parse_ini_file(). Currently implemented in non thread safe version
- of PHP, and currently lacks section support (Zeev)
-- "none" is now equivalent with "" in Apache config directives (Stig)
-- OCINLogon no longer crashes. (Thies)
-- Fixed comparisons of (string) "nan" with (string) "nan". (Thies, Zend Engine)
-- Switched back to the old $HTTP_*_VARS[] behavior - $HTTP_GET_VARS["foo"]
- and $foo are no longer references to each other, but separate variables
- like they were prior to PHP 4.0 Beta 4 (Zeev)
-- Fixed Sybase-DB compilation (Zeev)
-- Fixed a (fairly common) situation where error_reporting values would not be
- properly restored after a call to error_reporting(), in between requests
- (Zeev)
-- The various $HTTP_*_VARS[] are now protected, and cannot be manipulated by
- user input (Zeev)
-- Added ini_set() as an alias to ini_alter() (Zeev)
-- The string None is now recognized as a keyword by the php.ini processor, and
- can be used to denote an empty string (Zeev)
-- Added get_class_vars(string class_name) and get_object_vars(object obj)
- functions. (Andrei, Zend Engine)
-- Added pdf_set_parameter(), pdf_skew(), pdf_show_boxed() (Uwe)
-- Fixed comparison of (string) "inf" with (string) "inf", which was erroneously
- returning false (Zeev)
-- Implemented default_charset and default_mimetype config directives (Stig)
-- Ported T1lib support from PHP3. (Jouni)
-- Fixed -DEAPI inheritance from APXS. (Sascha)
-- Fixed possible crash in module-shutdown. (Thies)
-- Fixed safe_mode_protected_env_vars INI directive (Zeev)
-- Fixed getrusage() (Sascha)
-- Fixed OCI8 crash when returning cursors from stored-procedures. (Thies)
-
-
-
-
-
-Version 4.0, Beta 4 Patch Level 1
-
-
-- Fixed crash when magic_quotes were switched off. (Thies)
-- Support for pdflib 2.30 (Uwe)
-
-
-
-
-
-Version 4.0, Beta 4
-
-
-- Introduced $HTTP_POST_FILES[], that contains information about files uploaded
- through HTTP upload (Zeev)
-- Made PHP work under Microsoft Personal Web Server, under both Windows NT
- workstation and Windows 95 (Zeev)
-- Made multipart/form-data content obey to the variables_order directive (Zeev)
-- Updated the browscap module to work with PHP 4.0 (Zeev)
-- Recover gracefully in ISAPI after the client prematurely presses STOP (Andi)
-- Fixed bug in unset() on array offsets which are referenced more than once
- (Andi, Zend Engine)
-- Improved ISAPI module - it should no longer be necessary to set PHP as
- an ISAPI filter, only as an ISAPI extension, unless you wish to perform
- authentication using PHP. This didn't yet get enough testing, but it
- should work (Zeev)
-- Fixed RFC1867 file upload under Windows (Zeev)
-- Initital support for pdflib 2.20 (Uwe)
-- Added PostgreSQL support for DB (Rui Hirokawa <louis@cityfujisawa.ne.jp>)
-- Re-introduced "none" for disabling auto_prepend/append_file (Stig)
-- Added DB/storage (Stig, PEAR)
-- Introduced DB warnings (Stig, PEAR)
-- Fixed overrun in strip_tags (Stas)
-- Fixed crash in strip_tags() and related functions. (Thies)
-- Workaround for bogus POST-Data from IE/Mac. (Thies)
- Patch by Alain Malek <alain@virtua.ch>
-- Finished the server abstraction layer; All of the PHP code is now shared
- across different servers (Apache, CGI, IIS, etc.), except for thin
- interface modules (Zeev)
-- Added NULL-support in gettype(). (Thies)
-- base64_decode() will decode POST data correct. (Thies)
- Patch submitted by: Turadg Aleahmad <turadg@wise.berkeley.edu>
-- Much more work on domxml. Build xml tree, create xml doc works (Uwe)
-- Made foreach() work on objects. (Thies, Zend Engine)
-- Added domxml extension based on libxml, still little functionality (Uwe)
-- Fixed memory corruption in fgetss(), strip_tags() and gzgetss() (Zeev)
-- Updated calendar dynamic library to work with PHP 4. (Evan)
-- Added strncmp() function, courtesy of Walter. (Andrei)
-- Made the output of var_dump() more informative. (Thies)
-- Fixed some OCIBindByName() problems. (Thies)
-- Protect the ISAPI module against exceptions. Stack overflows in scripts are
- now nicely detected and handled (Zeev)
-- Fixed possible buffer-overflow in base64_decode. (Thies)
-- Fixed possible buffer-overflow in setcookie(). (Thies)
-- Fixed signal() bug that could cause the Apache master process to
- die. (Thies)
-- Added session_set_cookie_params() function. (Andrei)
-- If header information is sent after output has already been sent, the warning
- message will now state the filename and line number at which the first output
- was made (Zeev)
-- Added the XML Expat library to the standard PHP source distribution thanks
- to its author James Clark (Andi & Zeev)
-- Added XML support to the default Win32 build (Andi & Zeev)
-- Added socket_get_status() function. Renamed set_socket_timeout() to
- socket_set_timeout() and set_socket_blocking() to socket_set_blocking(). (Andrei)
-- Added realpath() function. (Andrei)
-- mktime interprets years in the range 0-70 now as 2000-2070. You can
- continue to specify the complete year (i.e. 1920) (Sascha)
-- Added the ability to control the environment variables the user is allowed
- to change in Safe Mode, using INI directives (Zeev)
-- Fixed a crash bug in strtr() working on large input strings (Zeev)
-- Ora_GetColumn()/Ora_FetchInto() now return NULL for NULL-Columns. (Thies)
-- OCI8 now supports binding of NULL-values. Module cleanups. (Thies)
-- Added ability to set timeout on socket read operations through
- set_socket_timeout() function. (Andrei)
-- Added implicit_flush INI directive (Zeev)
-- Added implicit_flush() to control whether flush() should be called
- implicitly after any output (Zeev)
-- Fixed a crash in pfsockopen() (Zeev)
-- Fixed a possible crash in phpinfo() (Zeev)
-- Added register_argc_argv INI directive, to allow to selectively disable
- the declaration of the $argv and $argc variables for increased
- performance (Zeev)
-- Added $HTTP_ENV_VARS[] and $HTTP_SERVER_VARS[] support, which similarly
- to $HTTP_GET_VARS[], contain environment and server variables. Setting
- register_globals to Off will now also prevent registration of the
- environment and server variables into the global scope (Zeev)
-- Renamed gpc_globals INI directive to register_globals (Zeev)
-- Introduced variables_order that deprecates gpc_order, and allows control
- over the server and environment variables, in addition to GET/POST/Cookies
- (Zeev)
-- new function cpdf_set_document_limits() (Uwe)
-- Applied safe-mode patch to popen(). (Patch by Kristian Köhntopp)
-- str_repeat() now returns correct length. (Thies)
-- Don't assume libz and libpng are installed for the GD checks (Rasmus)
-- Implemented support for <boolean> and <null> types according
- to WDDX version 1.0 (Andrei)
-- Made var_dump()/serialize()/unserialize() NULL aware. (Thies)
-- Added new NULL constant (Zeev, Zend Engine)
-- Fixed -c support in the standalone CGI binary (Zeev)
-- Increased PHP's performance by 5-15% using a new memory cache (Andi & Zeev,
- Zend Engine)
-- Improved the php.ini reader to support constants and bitwise operators (Zeev)
-- Fixed strrev() to no longer modify arg1. (Thies)
-- Fixed buffer overruns in iptcembed(). (Thies)
-- Fixed a bug in ODBC error reporting (Zeev)
-- Added PHP_Logo_GUID() and Zend_Logo_GUID() functions, that return the GUIDs
- of the PHP and Zend logos used in phpinfo() (Zeev)
-- Added GNU Pth support (Sascha, TSRM library)
-- Removed select(), fd_set() and fd_isset() - will be reimplemented soon! (Thies)
-- Improved Win32 performance significantly by using different mutexes (Zeev,
- TSRM library)
-- Made quotemeta() and preg_quote() binary-safe. (Andrei)
-- Added UDP support in fsockopen(). (Evan)
-- Added --disable-pear option (Andrei)
-- Renamed libzend repository to Zend (Zeev)
-- Added support for thttpd (Sascha)
-- Added session.cache_limiter and cache_expire options (Sascha)
-- Restored the PHP_VERSION and PHP_OS constants (Zeev)
-- Added get_loaded_extensions(), extension_loaded(), and
- get_extension_funcs() functions. (Andrei)
-- Added date/time stamping to PHP error log file. (Andrei, Joey)
-- Added is_subclass_of() function (Andrei, Zend Engine)
-- Implemented count_chars(). (Thies)
-- Added class_exists() function (Andrei, Zend Engine)
-- Made strspn() and strcspn() binary-safe. (Andrei)
-- Added array_multisort() function. (Andrei)
-- Made pageinfo.c thread-safe (Sascha)
-- Made implode() binary-safe (Andrei)
-- Made strstr(), stristr(), and ucwords() binary-safe() (Andrei)
-- Made strtoupper(), strtolower(), substr_replace() binary-safe. (Andrei)
-- Fixed a crash in the Apache syntax highlighting mode (Zeev)
-- Report all ODBC error's not just the one on the top of the stack (lurcher)
-- OCI8 now returns NULL values in LONG columns correct. (Thies)
-- Added support for a C-like assert() function. (Thies)
-- Added CyberCash support. (Evan)
-- Made explode() binary-safe. (Thies)
-- Made strpos() binary-safe. (Thies)
-- Added XML_Set_Object() function, now you can use the XML-Parser from
- within an object. (Thies)
-- Session vars are now decoded into $HTTP_STATE_VARS[] array and the
- globals, depending on track_vars and gpc_globals settings (Andrei)
-- Added get_used_files() function - returns a hash mapping the use()'d files
- to their full path (Zeev)
-- PHP 4 scripts will now obey the max_execution_time setting and actually
- time out (Rasmus)
-- Added configure command to phpinfo() output (Stig)
-- Added optional socket path to the mysql_?connect() functions (Rasmus)
-- Made mysql and gd work as shared extensions again (Stig)
-- Make the global GET/POST/Cookie variables and their $HTTP_*_VARS[] counterparts
- be references to each other (Zeev)
-- Added support for the 'use' keyword - behaves like 'require', but will not
- use the same file more than once (Andi & Zeev, Zend Engine)
-- Added check to see if a persistent connection is still valid with the
- ODBC interface before reusing (nick@easysoft.com)
-- Added DBMaker support (patch by Pax Tsai <paxtsai@lion.syscom.com.tw>)
-- Renamed "PECL" to "PEAR" (PHP Extension and Add-on Repository) (Stig)
-- buildconf now uses build.mk (Stig)
-- Disable symlinks to urls (Rasmus)
-- Informix driver now reflects version of ESQL/C used (Danny)
-- Modified session_register() to take variable number of arguments (Andrei)
-- Fixed file descriptor leak in thread safe mode (Zeev, Zend Engine)
-- Added select(), fd_set() and fd_isset() (Evan)
-- cpdf support has been ported from php3, needs ClibPDF 2.x (Uwe)
-- Fixed a leak when using automatic output buffering (Zeev)
-- Introduced PECL - PHP Extension and Code Library
- (prounounced "pickle") (Stig)
-- Fixed inconsistencies in the implementation of here-docs (Andi & Zeev, Zend
- library)
-- Fixed a problem with constant class-member initializations (Andi & Zeev,
- Zend Engine)
-- Fixed float-compare in min(),max(),a[r]sort(),[r]sort() (Thies)
-- Implemented get_html_translation_table() function (Thies)
-- Implemented array_flip() function. Returns input-array with key, value
- flipped (Thies)
-- Added Berkeley DB3 support in DBA (Sascha)
-- Implemented 2-Arg version of strtr($str,$translation_array). This can be used
- to revert what htmlspecialchars() did (Thies)
-- Fixed mem-overwrite in XML_Parse_Into_Struct (Thies)
-- Added substr_replace() function (Andrei)
-
-
-
-
-
-Version 4.0 Beta 3
-
-
-- ucfirst()/ucwords() no longer modify arg1 (Thies)
-- Fixed strtr() not to modify arg1 (Thies)
-- Added Win32 build files for Informix driver and make it
- compile with ZTS (danny)
-- Added tmpfile() function (Stig)
-- Upgraded regex library to alpha3.8 (Sascha)
-- Fixed selecting nested-tables in OCI8. (Thies)
-- RFC-854 fix for internal FTP-Code. Commands have to end in "\r\n" (Thies)
-- Fixed OpenLink ODBC support (Stig)
-- min(),max(),a[r]sort(),[r]sort(),k[r]sort() now work consistent with the
- language-core. (Thies)
-- tempnam() now uses mkstemp() if available (Stig)
-- serialize() and var_dump() now honor the precision as set in php.ini
- for doubles. (Thies)
-- Improved the Win32 COM module to support [out] parameters (Boris Wedl)
-- Fixed garbage returned at the end of certain Sybase-Columns (Thies)
- Patch submitted by: neal@wanlink.com
-- Added Microsoft SQL Server module for Win32 (Frank)
-- Added support for forcing a variable number of internal function arguments
- by reference. (Andi & Zeev, Zend Engine)
-- Implemented getprotoby{name,number} (Evan)
-- Added array_pad() function. (Andrei)
-- Added new getservby{name,port} functions. (Evan)
-- Added session.cookie_path and session.cookie_domain (Sascha)
-- Continue processing PHP_INI_SYSTEM knownDirectives after extension=
- (Sam Ruby)
-- Enable IBM DB2 support - Tested against DB2 6.1 UDB on Linux (Rasmus)
-- Added new str_repeat() function. (Andrei)
-- Output-Buffering system is now Thread-Safe. (Thies)
-- implemented OCI8 $lob->WriteToFile() function - very useful for streaming
- large amounts of LOB-Data without to need of a huge buffer. (Thies)
-- Added session.use_cookies option (Sascha)
-- Added getcwd() function. (Thies)
-- XML_Parse_Into_Struct no longer eats data. (Thies)
-- Fixed parse_url('-') crash. (Thies)
-- added === operator support. (Andi & Thies, Zend Engine)
-- unserialize() now gives a notice when passed invalid data. (Thies)
-- Fixed shuffle() so that it no longer breaks on Solaris. (Andrei)
-- Added is_resource(), is_bool() functions. (Thies)
-- Cleaned up File-Module (Thies)
-- Upgraded math-funtions to use new Zend function API (Thies)
-- Fixed zombie problem in shell_exec() and $a = `some_command`
- constructs. (Thies)
-- Thies introduced ZEND_FETCH_RESOURCE2 (Danny).
-- Added Informix driver to list of maintained extensions. (Danny).
-- Informix driver : Changed ifx.ec to use the new high-performance
- ZEND API. (Danny)
-- IXF_LIBDIR environment variable specifies alternate Informix library
- path for configure (Danny).
-- Fixed gmmktime() so that the following should always be true:
- gmmktime([args]) == mktime([args]) + date('Z', mktime([args])) (Jouni)
-- setlocale doesn't anymore screw up things if you forgot to change it back
- to the original settings. (Jouni)
-- Switched to new system where ChangeLog is automagically updated from commit
- messages. NEWS file is now the place for public announcements. (Andrei)
-- Fixed refcount problem in XML module. (Thies)
-- Fixed crash in HTTP_RAW_POST_DATA handling (Thies)
-- You can use resources as array-indices again (Thies, Zend Engine)
-- Fixed pg_fetch_array() with three arguments (Sascha)
- Patch submitted by: brian@soda.berkeley.edu
-- Upgraded a lot internal functions to use new Zend function API (Thies)
-- fdf support ported; not completely tested with latest version 4.0 for
- glibc (Uwe)
-- OCI8 connections are now kept open as long as they are referenced (Thies)
-- Cleaned up Directory-Module (Thies)
-- Small fix in Ora_Close (Thies)
-- Ported range() and shuffle() from PHP 3 to PHP 4 (Andrei)
-- Fixed header("HTTP/..."); behaviour (Sascha)
-- Improved UNIX build system. Now utilizes libtool (Sascha)
-- Upgrade some more internal functions to use new Zend function API. (Thies,
- Zend Engine)
-- Fixed backwards incompatibility with ereg() (Thies)
-- Updated Zend garbage collection with a much more thorough method.
- (Andi, Zend Engine)
-- Added the ability to use variable references in the array() construct.
- For example, array("foo" => &$foo). (Andi, Zend Engine)
-- Added array_reverse() function (Andrei)
-- Some more XML fixes/cleanups (Thies)
-- Updated preg_replace() so that if any argument passed in is an array
- it will make a copy of each entry before converting it to string so that
- the original is intact. If the subject is an array then it will preserve
- the keys in the output as well (Andrei)
-- Updated OCI8 to use the new high-performance Zend function API. (Thies)
-- Configure speedup (Stig)
-- Fixed LOB/Persistent-Connection related OCI8-Crash (Thies)
-- Generalized server-API build procedure on UNIX (Stig)
-- Added '--disable-rpath' option (Sascha)
-- Added AOLserver SAPI module (Sascha)
-- Fixed XML Callbacks. (Thies)
-- Updated ODBC to use the new high-performance Zend function API (kara)
-- Updated zlib to use the new high-performance Zend function API. (Stefan)
-- Updated preg_split() to allow returning only non-empty pieces (Andrei)
-- Updated PCRE to use the new high-performance Zend function API (Andrei)
-- Updated session, dba, mhash, mcrypt, sysvshm, sysvsem, gettext modules to use
- the new high-performance Zend function API (Sascha)
-- Extended var_dump to handle resource type somewhat (Andrei)
-- Updated WDDX to use the new high-performance Zend function API (Andrei)
-- Updated XML to use the new high-performance Zend function API. (Thies)
-- Updated Oracle to use the new high-performance Zend function API. (Thies)
-- Improved the performance of the MySQL module significantly by using the new
- high-performance Zend function API. (Zeev)
-- Added support for the Easysoft ODBC-ODCB Bridge (martin@easysoft.com)
-- Fixed bug in odbc_setoption, getParameter call incorrect (martin@easysoft.com)
-- Ora_Fetch_Into now resets the returned array in all cases (Thies)
-- Fixed NULL-Column problem in Oracle-Driver (Thies)
-- Added extra metadata functions to ODBC, SQLTables etc (nick@easysoft.com)
-- Fixed SEGV in mcal make_event_object() and
- typo in mcal_list_alarms() (Andrew Skalski)
-- Fixed Ora_PLogon (Thies)
-- Resourcified Oracle (Thies)
-- Implemented object serialization/deserialization in WDDX (Andrei)
-- Added krsort() function (Thies)
-- Added func_num_args(), func_get_arg() and func_get_args() for standard
- access to variable number of arguments functions (Zeev)
-- Added FTP support (Andrew Skalski)
-- Added optional allowable_tags arguments to strip_tags(), gzgetss() and
- fgetss() to allow you to specify a string of tags that are not to be
- stripped (Rasmus)
-- Upgraded var_dump() to take multiple arguments (Andrei)
-- Resourcified XML (Thies)
-- Fixed a memory leak in the Apache per-directory directives handler (Zeev)
-- Added array_count_values() function. (Thies)
-- snmp, pgsql, mysql and gd modules can be built as dynamically loaded
- modules (Greg)
-- OCI8 fix for fetching empty LOBs (Thies)
-- Added user-level callbacks for session module (Sascha)
-- Added support for unknown POST content types (Zeev)
-- Added "wddx" serialization handler for session module (Sascha)
- (automatically enabled, if you compile with --with-wddx)
-- Fixed unserializing objects (Thies)
-- PHP 4.0 now serializes Objects as 'O' (not understood by PHP 3.0), but
- unserializes PHP 3.0 serialized objects as expected. (Thies)
-- Made serialize/unserialize work on classes. If the class is known at
- unserialize() time, you'll get back a fully working object! (Thies)
-- Reworked preg_* functions according to the new PCRE API, which also made
- them behave much more like Perl ones (Andrei)
-- Made it possible to specify external location of PCRE library (Andrei)
-- Updated bundled PCRE library to version 2.08 (Andrei)
-- count()/is_array/is_object... speedups. (Thies)
-- OCI8 supports appending and positioning when saving LOBs (Thies)
-- Added metaphone support (Thies)
-- OCI8 doesn't use define callbacks any longer. (Thies)
-- OCI8 Driver now supports LOBs like PHP 3.0. (Thies)
-- var_dump now dumps the properties of an object (Thies)
-- Rewrote the GET/POST/Cookie data reader to support multi-dimensional
- arrays! (Zeev)
-- Renamed allow_builtin_links to expose_php (defaults to On). This directive
- tells PHP whether it may expose its existence to the outside world, e.g.
- by adding itself to the Web server header (Zeev)
-- Added support for transparent session id propagation (Sascha)
-- Made WDDX serialize object properties properly (Andrei)
-- Fixed WDDX mem leak when undefined variable is passed in
- for serialization (Andrei)
-- Added session_unset() function (Andrei)
-- Fixed double session globals shutdown crash (Andrei)
-- Fixed crash related to ignore_user_abort ini entry (Andrei)
-- Added support for external entropy sources for session id creation
- (on Unices /dev/random and /dev/urandom) (Sascha)
-- Added gpc_globals variable directive to php.ini. By default it is On, but
- if it is set to Off, GET, POST and Cookie variables will not be inserted
- to the global scope. Mostly makes sense when coupled with track_vars (Zeev)
-- Added versioning support for shared library (Sascha)
- This allows concurrent use of PHP 3.0 and PHP 4.0 as Apache modules. See
- the end of the INSTALL file for more information.
-- Added second parameter to array_keys which specifies search value
- for which the key should be returned (Andrei)
-- Resourcified Informix driver (Danny)
-- New resource handling for odbc, renamed to php_odbc.[ch]
-- Make set_time_limit() work on Unix (Rasmus)
-- Added connection handling support (Rasmus)
-- Improved the Sybase-CT module to make use of resources (Zeev)
-- Improved the mSQL module to make use of resources (Zeev)
-- Changed mysql_query() and mysql_db_query() to return false in case of saving
- the result set data fails (Zeev)
-- Improved the resource mechanism - resources were not getting freed as soon
- as they could (Zeev)
-- Added shared memory module for session data storage (Sascha)
-- Fixed session.auto_start (Sascha)
-- Fixed several problems with output buffering and HEAD requests (Zeev)
-- Fixed HTTP Status code issue with ISAPI module (Zeev)
-- Fixed a problem that prevented $GLOBALS from working properly (Zeev, Zend
- library)
-- Ported newest GetImageSize (Thies)
-- Added session compile support in Win32 (Andi)
-- Added -d switch to the CGI binary that allows overriding php.ini values
- from the command line (Zeev)
-- Fixed a crash that would occur if wddx_deserialize did not receive
- a valid packet (Andrei)
-- Fixed a bugglet when redefining a class at run-time (Andi, Zend Engine)
-- Fixed sem_get() on AIX (Sascha)
-- Fixed fopen() to work with URL's in Win32 (Andi & Zeev)
-- Fixed include_path for Win32 (Andi, Zend Engine)
-- Fixed bug in ISAPI header sending function (Charles)
-- Fixed memory leak when using undefined values (Andi & Zeev, Zend Engine)
-- Added output_buffering directive to php.ini, to enable output buffering
- for all PHP scripts - default is off (Zeev).
-- Fixed some more class inheritance issues (Zeev, Zend Engine)
-- Fixed Apache build wrt to shared modules on FreeBSD/Linux (Sascha)
-- Added session.extern_referer_chk which checks whether session ids were
- referred to by an external site and eliminates them (Sascha)
-- Improved session id generation (Sascha)
-- Improved speed of uniqid() by using the combined LCG and removing
- the extra usleep() (Sascha)
-- Introduced general combined linear congruential generator (Sascha)
-- Made ldap_close back into an alias for ldap_unbind (Andrei)
-- OciFetchInto now resets the returned array in all cases (Thies)
-- Fixed mysql_errno() to work with recent versions of MySQL (Zeev)
-- Fixed a problem with define() and boolean values (Zeev)
-- Fixed inclusion of gd/freetype functions (Sascha)
-- Fixed persistency of MHASH_* constants (Sascha)
-- Oracle is now ZTS-Safe (Thies)
-- Fixed flushing of cached information to disk in DBA's DB2 module (Sascha)
-- OCI8 is now ZTS-Safe (Thies)
-- Fixed is_writeable/is_writable problem; they are both defined now (Andrei)
-- Imported PHP 3.0 diskfreespace() function (Thies)
-- Fixed thread-safety issues in the MySQL module (Zeev)
-- Fixed thread-safe support for dynamic modules (Zeev)
-- Fixed Sybase CT build process (Zeev)
-
-
-
-
-
-Version 4.0 Beta 2
-
-
-- Fixed a problem when sending HTTP/1.x header lines using header() (Zeev)
-- Win32 builds now include the ODBC module built-in (Zeev)
-- Fixed SYSV-SHM interface (Thies).
-- Updated hyperwave module, made it thread safe
-- Updated pdflib module, version 0.6 of pdflib no longer supported
-- Updated fdf module
-- Built-in phpinfo() links are now turned off by default. They can be turned
- on using the allow_builtin_links INI directive (Zeev)
-- Changed phpinfo() to list modules that have no info function (Zeev)
-- Modified array_walk() function so that the userland callback is passed
- a key and possible user data in addition to the value (Andrei)
-- Fixed ldap_search(), ldap_read() and ldap_list() (Zeev)
-- Fixed Apache information in phpinfo() (sam@breakfree.com)
-- Improved register_shutdown_function() - you may now supply arguments that
- will be passed to the shutdown function (Zeev)
-- Improved call_user_func() and call_user_method() - they now support passing
- arguments by reference (Zeev)
-- Fixed usort() and uksort() (Zeev)
-- Fixed md5() in the Apache module (Thies)
-- Introduced build process for dynamic modules (Stig)
-- Improved ISAPI module to supprt large server variables (Zeev)
-- Imported PHP 3.0 fixes for problem with PHP as a dynamic module and Redhat
- libc2.1 in zlib module (Stefan)
-- Fixed sybase_fetch_object() (Zeev)
-- Made the IMAP module work with PHP 4.0 (Zeev)
-- Fixed a problem with include()/require() of URLs (Sascha, Zeev)
-- Fixed a bug in implode() that caused it to corrupt its arguments (Zeev)
-- Added get_class($obj), get_parent_class($obj) and method_exists($obj,"name")
- (Andi & Zeev)
-- Fixed various inheritance problems (Andi & Zeev, Zend Engine)
-- Children now inherit their parent's constructor, if they do not supply a
- constructor of their own.
-- Fixed runtime inheritance of classes (parent methods/properties were
- overriding their children) (Zeev, Zend Engine)
-- Fixed backwards incompatibility with the "new" operator (Andi, Zend Engine)
-- Fixed bugs in uksort() and ksort() sort ordering (Andrei)
-- Fixed a memory leak when using assignment-op operators with lvalue of type
- string (Zeev, Zend Engine)
-- Fixed a problem in inheritance from classes that are defined in include()d
- files (Zeev, Zend Engine)
-- Fixed a problem with the PHP error handler that could result in a crash
- on certain operating systems (Zeev)
-- Apache php_flag values only recognized 'On' (case sensitive) - changed
- to case insensitive (Zeev)
-- Fixed a memory leak with switch statement containing return statements
- (Andi & Zeev, Zend Engine)
-- Fixed a crash problem in switch statements that had a string offset
- as a conditional (Andi & Zeev, Zend Engine)
-- Imported PHP 3.0 fixes for rand() and mt_rand() (Rasmus)
-- Added function entries for strip_tags() and similar_text() (Andrei)
-- Fixed a bug in WDDX that would cause a crash if a number was passed in
- instead of a variable name (Andrei)
-- Ported strtotime() function from PHP 3.0 (Andrei)
-- Merged in gdttf stuff from PHP 3.0 (Sascha)
-- buildconf now checks your installation (Stig)
-- XML module now built dynamically with --with-xml=shared (Stig)
-- Added a check for freetype.h - fixed build on RedHat 6.0 (Zeev)
-- Fixed array_walk() to work in PHP 4.0 (Andrei)
-- Ported all remaining date() format options from PHP 3.0 (Andrei)
-- $php_errormsg now works (Andrei)
-- Added locale support for Perl Compatible Regexp functions (Andrei)
-- Informix module ported (Danny)
-- Remove --with-shared-apache (Sascha)
-- Added patch for reverse lookup table in base64_decode (Sascha)
- Submitted by bfranklin@dct.com
-- Merged in PHP 3.0 version of str_replace (Sascha)
-- Added DBA module (Sascha)
-- Added session id detection within REQUEST_URI (Sascha)
-- Merged in HP-UX/ANSI compatibility switch from PHP 3.0 (Sascha)
-- Fixed rpath handling for utilitites built during Apache build (Sascha)
-- Added missing E_ error level constants (Zeev, Zend Engine)
-- Fixed a bug in sending multiple HTTP Cookies under Apache (Zeev)
-- Fixed implicit connect on the MySQL, mSQL, PostgreSQL and Sybase
- modules (Zeev)
-- Gave PHP 4.0's SNMP extension all the functionality of PHP 3.0.12 (SteveL)
-
-
-
-
-
-Version 4.0 Beta 1
-
-
-- First public beta of PHP 4.0
-
-
-
-
-
-
-Version 5.6.40
-
-- GD:
-
- - (efree() on uninitialized Heap data in imagescale leads to
-use-after-free). (CVE-2016-10166)
- - (imagecolormatch Out Of Bounds Write on Heap). (CVE-2019-6977)
-
-- Mbstring:
-
- - (Buffer overflow on mb regex functions - fetch_token). (CVE-2019-9023)
- - (heap buffer overflow in mb regex functions - compile_string_node). (CVE-2019-9023)
- - (heap buffer overflow in multibyte match_at). (CVE-2019-9023)
- - (heap buffer overflow due to incorrect length in expand_case_fold_string). (CVE-2019-9023)
- - (buffer overflow in fetch_token). (CVE-2019-9023)
- - (Buffer overflow in multibyte case folding - unicode). (CVE-2019-9023)
- - (Heap overflow in utf32be_mbc_to_code). (CVE-2019-9023)
-
-- Phar:
-
- - (heap buffer overflow in phar_detect_phar_fname_ext). (CVE-2019-9021)
-
-- Xmlrpc:
-
- - (heap out of bounds read in xmlrpc_decode()). (CVE-2019-9020)
- - (Global out of bounds read in xmlrpc base64 code). (CVE-2019-9024)
-
-
-
-
-
-Version 5.6.39
-
-- Core:
-
- - (Segfault when using convert.quoted-printable-encode filter).
-
-- IMAP:
-
- - (null pointer dereference in imap_mail).
- - (imap_open allows to run arbitrary shell commands via mailbox parameter). (CVE-2018-19518)
-
-- Phar:
-
- - (PharData always creates new files with mode 0666).
- - (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile). (CVE-2018-20783)
-
-
-
-
-
-Version 5.6.38
-
-- Apache2:
-
- - (XSS due to the header Transfer-Encoding: chunked). (CVE-2018-17082)
-
-
-
-
-
-Version 5.6.37
-
-- Exif:
-
- - (Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c). (CVE-2018-14883)
- - (heap-buffer-overflow (READ of size 48) while reading exif data). (CVE-2018-14851)
-
-- Win32:
-
- - (windows linkinfo lacks openbasedir check). (CVE-2018-15132)
-
-
-
-
-
-Version 5.6.36
-
-- Exif:
-
- - (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value). (CVE-2018-10549)
-
-- iconv:
-
- - (stream filter convert.iconv leads to infinite loop on invalid sequence). (CVE-2018-10546)
-
-- LDAP:
-
- - (Malicious LDAP-Server Response causes Crash). (CVE-2018-10548)
-
-- Phar:
-
- - (fix for CVE-2018-5712 may not be complete). (CVE-2018-10547)
-
-
-
-
-
-Version 5.6.35
-
-- FPM:
-
- - (Dumpable FPM child processes allow bypassing opcache access controls). (CVE-2018-10545)
-
-
-
-
-
-Version 5.6.34
-
-- Standard:
-
- - (stack-buffer-overflow while parsing HTTP response). (CVE-2018-7584)
-
-
-
-
-
-Version 5.6.33
-
-- GD:
-
- - (Potential infinite loop in gdImageCreateFromGifCtx). (CVE-2018-5711)
-
-- Phar:
-
- - (Reflected XSS in .phar 404 page). (CVE-2018-5712)
-
-
-
-
-
-Version 5.6.32
-
-- Date:
-
- - (Out-Of-Bounds Read in timelib_meridian()). (CVE-2017-16642)
-
-- mcrypt:
-
- - (arcfour encryption stream filter crashes php).
-
-- PCRE:
-
- - (applied upstream patch for CVE-2016-1283).
-
-
-
-
-
-Version 5.6.31
-
-- Core:
-
- - (Performance problem with processing large post request). (CVE-2017-11142)
- - (Heap buffer overread (READ: 1) finish_nested_data from unserialize). (CVE-2017-12933)
- - (PHP INI Parsing Stack Buffer Overflow Vulnerability). (CVE-2017-11628)
- - (wddx_deserialize() heap out-of-bound read via php_parse_date()). (CVE-2017-11145)
-
-- GD:
-
- - (Buffer over-read into uninitialized memory). (CVE-2017-7890)
-
-- mbstring:
-
- - Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
-
-- OpenSSL:
-
- - (negative-size-param (-1) in memcpy in zif_openssl_seal()). (CVE-2017-11144)
-
-- PCRE:
-
- - (Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)).
-
-- WDDX:
-
- - (wddx parsing empty boolean tag leads to SIGSEGV). (CVE-2017-11143)
-
-
-
-
-
-Version 5.6.30
-
-- EXIF:
-
- - (FPE when parsing a tag format). (CVE-2016-10158)
-
-- GD:
-
- - (Use after free when stream is passed to imagepng).
- - (DOS vulnerability in gdImageCreateFromGd2Ctx()). (CVE-2016-10167)
- - (Signed Integer Overflow gd_io.c). (CVE-2016-10168)
-
-- Intl:
-
- - (grapheme_extract take an extra trailing character).
-
-- Phar:
-
- - (Crash while loading hostile phar archive). (CVE-2016-10159)
- - (Memory corruption when loading hostile phar). (CVE-2016-10160)
- - (Seg fault when loading hostile phar). (CVE-2017-11147)
-
-- SQLite3:
-
- - Reverted fix for bug (Unsetting result set may reset other result set).
-
-- Standard:
-
- - (Unserialize context shared on double class lookup).
- - (Heap out of bounds read on unserialize in finish_nested_data()). (CVE-2016-10161)
-
-
-
-
-
-Version 5.6.29
-
-- Mysqlnd:
-
- - (Add missing mysqlnd.* parameters to php.ini-*).
-
-- Opcache:
-
- - (Opcache segfault when using class constant to call a method).
- - (check cached files permissions)
-
-- OpenSSL:
-
- - (Invalid parameter in memcpy function trough openssl_pbkdf2).
-
-- Postgres:
-
- - (Incorrect SQL generated for pg_copy_to()).
-
-- SOAP:
-
- - (Segfault (Regression for )).
-
-- SQLite3:
-
- - (Unsetting result set may reset other result set).
-
-- Standard:
-
- - (HTTP stream wrapper should ignore HTTP 100 Continue).
-
-- WDDX:
-
- - (Invalid read when wddx decodes empty boolean element). (CVE-2016-9935)
-
-
-
-
-
-Version 5.6.28
-
-- Core:
-
- - (try/catch not working with two exceptions inside a same operation).
-
-- Bz2:
-
- - (crash in bzcompress function).
-
-- GD:
-
- - (Integer overflow in imageline() with antialiasing).
- - (imagescale() is not affected by, but affects imagesetinterpolation()).
- - (Integer overflow in gdImageScaleBilinearPalette()).
- - (Stack Buffer Overflow in GD dynamicGetbuf).
- - (Illegal write/read access caused by gdImageAALine overflow).
- - (imagefilltoborder stackoverflow on truecolor images). (CVE-2016-9933)
-
-- Imap:
-
- - (Integer Overflow in "_php_imap_mail" leads Heap Overflow).
-
-- SPL:
-
- - (Use-after-free in ArrayObject Deserialization).
-
-- SOAP:
-
- - (SoapServer reports Bad Request when gzipped).
-
-- SQLite3:
-
- - (2147483647 is fetched as string).
-
-- Standard:
-
- - (passing additional_parameters causes mail to fail).
- - (use after free in userspace streams).
- - (parse_url return wrong hostname).
-
-- Wddx:
-
- - (NULL Pointer Dereference in WDDX Packet Deserialization with PDORow). (CVE-2016-9934)
-
-
-
-
-
-Version 5.6.27
-
-- Core:
-
- - (Heap Buffer Overflow in virtual_popen of zend_virtual_cwd.c).
- - (crypt broken when salt is 'too' long).
- - (Out of bounds global memory read in BF_crypt triggered by
-password_verify).
- - (Memcpy negative size parameter php_resolve_path).
- - (Use After Free in unserialize()).
-
-- BCmath:
-
- - (memcpy negative parameter _bc_new_num_ex).
-
-- DOM:
-
- - (missing NULL check in dom_document_save_html).
-
-- Ereg:
-
- - (heap overflow in php_ereg_replace function).
-
-- Filter:
-
- - (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and
-FILTER_FLAG_NO_PRIV_RANGE).
- - (Wrong return value from FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE).
- - (default option ignored when object passed to int filter).
-
-- GD:
-
- - (imagetruecolortopalette: white is duplicated in palette).
- - (imagettftext broken on transparent background w/o alphablending).
- - (Integer Overflow in gdImageWebpCtx of gd_webp.c).
- - (imagettfbbox gives incorrect values for bounding box).
- - (imagegd2() ignores 3rd param if 4 are given).
- - (imagegd2() writes wrong chunk sizes on boundaries).
- - (imagegd2(): unrecognized formats may result in corrupted files).
- - (imagecreatefromgd2() may leak memory).
-
-- Intl:
-
- - (add mitigation for ICU int overflow).
-
-- Imap:
-
- - (integer overflow in imap_8bit caused heap corruption).
-
-- Mbstring:
-
- - (mbc_to_code() out of bounds read).
- - (mb_convert_variables() cannot detect recursion).
- - (mbstring.internal_encoding doesn't inherit default_charset).
- - (string length overflow in mb_encode_* function).
-
-- PCRE:
-
- - (heap overflow in php_pcre_replace_impl).
-
-- Opcache:
-
- - (Opcache restart with kill_all_lockers does not work).
-
-- OpenSSL:
-
- - (Invalid path SNI_server_certs causes segfault).
- - (crash in openssl_encrypt function).
- - (crash in openssl_random_pseudo_bytes function).
-
-- Session:
-
- - (Session does not report invalid uid for files save handler).
- - (session_destroy null dereference in ps_files_path_create).
-
-- SimpleXML:
-
- - (NULL pointer dereference in SimpleXMLElement::asXML()).
-
-- SPL:
-
- - (CachingIterator null dereference when convert to string).
-
-- Standard:
-
- - (Write out of bounds at number_format).
- - (memory corruption in wordwrap function).
-
-- Stream:
-
- - (readfile() mangles files larger than 2G).
-
-- Zip:
-
- - (Depacking with wrong password leaves 0 length files).
-
-
-
-
-
-Version 5.6.26
-
-- Core:
-
- - (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:260)).
-
-- Dba:
-
- - (Bad dba_replace condition because of wrong API usage).
- - (Cannot fetch multiple values with group in ini file).
-
-- EXIF:
-
- - (Uninitialized Thumbail Data Leads To Memory Leakage in exif_process_IFD_in_TIFF).
-
-- FTP:
-
- - (Cannot upload file using ftp_put to FTPES with require_ssl_reuse).
-
-- GD:
-
- - (imagecopy does not support 1bit transparency on truecolor images).
- - (imagecopy() loses single-color transparency on palette images).
- - (possible resource leaks in _php_image_convert()).
-
-- Intl:
-
- - (add locale length check). (CVE-2016-7416)
-
-- JSON:
-
- - (json_decode reads out of bounds).
-
-- mbstring:
-
- - (mb_substr only takes 32-bit signed integer).
- - (Out of bounds heap read in mbc_to_code() / triggered by mb_ereg_match()).
-
-- MSSQL:
-
- - (Use of uninitialised value on mssql_guid_string).
-
-- Mysqlnd:
-
- - (Heap overflow in mysqlnd related to BIT fields). (CVE-2016-7412)
-
-- PDO:
-
- - (call to empty() on NULL result using PDO::FETCH_LAZY returns false).
-
-- PDO_pgsql:
-
- - Implemented FR (Postgres PDO lastInsertId() should work without specifying a sequence).
- - (Regression in pgo_pgsql).
-
-- Phar:
-
- - (Out of bound when verify signature of zip phar in phar_parse_zipfile). (CVE-2016-7414)
- - (Out of bound when verify signature of tar phar in phar_parse_tarfile).
-
-- SPL:
-
- - (Missing type check when unserializing SplArray). (CVE-2016-7417)
-
-- Standard:
-
- - (strtr out-of-bound access).
- - (getimagesize returning FALSE on valid jpg).
- - (get_browser() incorrectly parses entries with "+" sign).
- - (Negative ftruncate() on php://memory exhausts memory).
- - (integer overflow in fgets cause heap corruption).
- - (memory corruption in wordwrap function).
- - (integer overflow in fgetcsv caused heap corruption).
- - (Memory Corruption in During Deserialized-object Destruction). (CVE-2016-7411)
-
-- Streams:
-
- - (stream_set_blocking doesn't work).
-
-- Wddx:
-
- - (wddx_deserialize use-after-free). (CVE-2016-7413)
- - (Out-Of-Bounds Read in php_wddx_push_element). (CVE-2016-7418)
-
-- XML:
-
- - (SEGV on unknown address zif_xml_parse).
- - (integer overflow in xml_utf8_encode).
-
-- ZIP:
-
- - (impossible to compile php with zip support).
-
-
-
-
-
-Version 5.6.25
-
-- Core:
-
- - (Use After Free Vulnerability in unserialize()).
- - (microtime() leaks memory).
- - (previous property undefined in Exception after deserialization).
- - Implemented FR (Support "nmake test" on building extensions by phpize).
- - (phpize (on Windows) ignores PHP_PREFIX).
- - (Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization). (CVE-2016-7124)
- - (PHP Session Data Injection Vulnerability). (CVE-2016-7125)
-
-- Bz2:
-
- - (integer overflow in bzdecompress caused heap corruption).
-
-- Calendar:
-
- - (cal_days_month() fails for final month of the French calendar).
- - (AddressSanitizer: global-buffer-overflow in zif_cal_from_jd).
-
-- Curl:
-
- - (Segmentation fault when using cURL with ZTS).
- - (Certification information (CERTINFO) data parsing error).
- - (integer overflow in curl_escape caused heap corruption).
-
-- DOM:
-
- - (DOM document dangling reference).
-
-- Ereg:
-
- - (Integer overflow lead to heap corruption in sql_regcase).
-
-- EXIF:
-
- - (Memory Leakage In exif_process_IFD_in_TIFF). (CVE-2016-7128)
- - (Samsung picture thumb not read (zero size)).
-
-- Filter:
-
- - (FILTER_FLAG_NO_RES_RANGE does not cover whole 127.0.0.0/8 range).
-
-- FPM:
-
- - (using --allow-to-run-as-root should ignore missing user).
-
-- GD:
-
- - (broken transparency of imagearc for truecolor in blendingmode).
- - (Always false condition in ext/gd/libgd/gdkanji.c).
- - (suspicious if-else statements).
- - (500 Server Error but page is fully rendered).
- - (imagetypes function won't advertise WEBP support).
- - (imagearc() ignores thickness for full arcs).
- - (select_colors write out-of-bounds). (CVE-2016-7126)
- - (imagesetstyle() causes OOB read for empty $styles).
- - (imagegammacorrect allows arbitrary write access). (CVE-2016-7127)
- - (imagecropauto out-of-bounds access)
-
-- Intl:
-
- - Partially fixed (idn_to_ascii for UTS #46 incorrect for long domain names).
-
-- mbstring:
-
- - (mb_ereg_search raises a warning if a match zero-width).
- - (mb_ereg_search increments search position when a match zero-width).
- - (mb_ereg_search_setpos does not accept a string's last position).
- - (`mb_ereg` causes buffer overflow on regexp compile error).
-
-- PCRE:
-
- - (preg_match missing group names in matches).
-
-- PDO_pgsql:
-
- - (PDO statement fails to throw exception).
-
-- Reflection:
-
- - (ReflectionClass::export doesn't handle array constants).
-
-- SNMP:
-
- - (php_snmp_parse_oid integer overflow in memory allocation).
-
-- Standard:
-
- - (CSV fields incorrectly split if escape char followed by UTF chars).
- - (integer overflow in base64_decode).
- - (integer overflow in quoted_printable_encode).
- - (integer overflow in urlencode).
- - (integer overflow in php_uuencode).
- - (initialize buffer before read).
-
-- Streams:
-
- - (Problems with the ftps wrapper).
- - (opendir() does not work with ftps:// wrapper).
- - (opendir() with ftp:// attempts to open data stream for non-existent directories).
- - (ftps:// opendir wrapper data channel encryption fails with IIS FTP 7.5, 8.5).
- - (ftps:// wrapper is vulnerable to protocol downgrade attack).
-
-- SPL:
-
- - (IteratorIterator breaks '@' error suppression).
- - (SplFileObject::getCsvControl does not return the escape character).
- - (AppendIterator segfault with closed generator).
-
-- SQLite3:
-
- - Implemented FR (SQLite should allow opening with empty filename).
-
-- Wddx:
-
- - (WDDX Packet Injection Vulnerability in wddx_serialize_value()).
- - (wddx_deserialize allows illegal memory access). (CVE-2016-7129)
- - (wddx_deserialize null dereference). (CVE-2016-7130)
- - (wddx_deserialize null dereference with invalid xml). (CVE-2016-7131)
- - (wddx_deserialize null dereference in php_wddx_pop_element). (CVE-2016-7132)
-
-
-
-
-
-Version 5.6.24
-
-- Core:
-
- - (Segmentation fault destroying HTTP_RAW_POST_DATA).
- - (Cannot declare public method with signature incompatible with parent private method).
- - (Integer Overflow in Length of String-typed ZVAL).
- - (Stack-based buffer overflow vulnerability in virtual_file_ex). (CVE-2016-6289)
- - (Use After Free in unserialize() with Unexpected Session Deserialization). (CVE-2016-6290)
- - (HTTP_PROXY is improperly trusted by some PHP libraries and applications). (CVE-2016-5385)
-
-- bz2:
-
- - (Type Confusion in php_bz2_filter_create()).
- - (Inadequate error handling in bzread()). (CVE-2016-5399)
-
-- Date:
-
- - (DateTime::createFromFormat 'U' with pre 1970 dates fails parsing).
-
-- EXIF:
-
- - (exif_read_data() returns corrupted exif headers).
- - (Out of bound read in exif_process_IFD_in_MAKERNOTE). (CVE-2016-6291)
- - (NULL Pointer Dereference in exif_process_user_comment). (CVE-2016-6292)
-
-- GD:
-
- - (Thick styled lines have scrambled patterns).
- - (XBM images require width to be multiple of 8).
- - (imagefilledpolygon doesn't draw horizontal line).
- - (gdImageTrueColorToPaletteBody allows arbitrary write/read access).
- - (imagegif/output out-of-bounds access).
- - (Integer overflow error within _gdContributionsAlloc()). (CVE-2016-6207)
-
-- Intl:
-
- - (locale_accept_from_http out-of-bounds access). (CVE-2016-6294)
-
-- OpenSSL:
-
- - (openssl_random_pseudo_bytes is not fork-safe).
- - (openssl_pkey_new does not fail for invalid DSA params).
-
-- SNMP:
-
- - (Use After Free Vulnerability in SNMP with GC and unserialize()). (CVE-2016-6295)
-
-- SPL:
-
- - (GlobIterator throws LogicException).
-
-- SQLite3:
-
- - (Clearing bindings on an SQLite3 statement doesn't work).
-
-- Streams:
-
- - (Stream socket with remote address leads to a segmentation fault).
-
-- Xmlrpc:
-
- - (heap-buffer-overflow (write) simplestring_addn simplestring.c). (CVE-2016-6296)
-
-- Zip:
-
- - (Stack-based buffer overflow vulnerability in php_stream_zip_opener). (CVE-2016-6297)
-
-
-
-
-
-Version 5.6.23
-
-- Core:
-
- - (Integer Overflow in nl2br()).
- - (Integer Overflow in json_encode()/json_decode()/ json_utf8_to_utf16()).
- - (Integer Overflow in addcslashes/addslashes).
- - (Integer Overflow in Length of String-typed ZVAL).
-
-- Date:
-
- - (strtotime seems to use both sunday and monday as start of week).
-
-- GD:
-
- - (pass2_no_dither out-of-bounds access).
- - (invalid dimensions can lead to crash).
- - (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (CVE-2016-5766)
- - (NULL Pointer Dereference at _gdScaleVert).
- - (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (CVE-2016-5767)
-
-- Intl:
-
- - (selectordinal doesn't work with named parameters).
-
-- mbstring:
-
- - (_php_mb_regex_ereg_replace_exec - double free). (CVE-2016-5768)
-
-- mcrypt:
-
- - (Heap Overflow due to integer overflows). (CVE-2016-5769)
-
-- OpenSSL:
-
- - (segfault after calling ERR_free_strings()).
-
-- Phar:
-
- - (invalid free in phar_extract_file()). (CVE-2016-4473)
-
-- SPL:
-
- - (int/size_t confusion in SplFileObject::fread). (CVE-2016-5770)
- - (Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5771)
-
-- WDDX:
-
- - (Double Free Courruption in wddx_deserialize). (CVE-2016-5772)
-
-- zip:
-
- - (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5773)
-
-
-
-
-
-Version 5.6.22
-
-- Core:
-
- - (zend_hex_strtod should not use strlen).
- - (Integer underflow / arbitrary null write in fread/gzread). (CVE-2016-5096)
- - (Integer Overflow in php_html_entities). (CVE-2016-5094)
-
-- GD:
-
- - (imagescale out-of-bounds read). (CVE-2013-7456)
-
-- Intl:
-
- - (Add intl.use_exceptions to php.ini-*).
- - (get_icu_value_internal out-of-bounds read). (CVE-2016-5093)
-
-- Postgres:
-
-- (mysqli_fetch_object changed behaviour). Patch to is reverted.
-
-
-
-
-
-Version 5.6.21
-
-- Core:
-
- - (__debugInfo with empty string for key gives error).
- - (EG(error_zval) is not handled well).
-
-- BCmath:
-
- - (bcpowmod accepts negative scale and corrupts _one_ definition). (CVE-2016-4537, CVE-2016-4538)
-
-- Curl:
-
- - (CURLOPT_NOPROXY applied as long instead of string).
-
-- Date:
-
- - (DateInterval::format Segmentation fault).
-
-- EXIF:
-
- - (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
-
-- GD:
-
- - (Corruption inside imageaffinematrixget).
- - (libgd: signedness vulnerability). (CVE-2016-3074)
-
-- Intl:
-
- - (Out-of-bounds reads in zif_grapheme_stripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
-
-- OCI8:
-
- - (Fix ORA-01438: value larger than specified precision allowed for this column).
-
-- ODBC:
-
- - (Script hangs after max_execution_time).
-
-- Opcache:
-
- - (null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER).
-
-- PDO:
-
- - (Own PDOStatement implementation ignore __call()).
- - (Quotes inside comments not properly handled).
-
-- Postgres:
-
- - (pg_fetch_object binds parameters before call constructor).
-
-- SPL:
-
- - (Cloned SplObjectStorage with overwritten getHash fails offsetExists()).
-
-- Standard:
-
- - (Unserialize accepts wrongly data).
- - (php_crypt() crashes if crypt_r() does not exist or _REENTRANT is not defined).
-
-- XML:
-
- - (xml_parse_into_struct segmentation fault). (CVE-2016-4539)
-
-
-
-
-
-Version 5.6.20
-
-- CLI Server:
-
- - (Support MKCALENDAR request method).
-
-- Core:
-
- - (Segmentation fault on ZTS with date function (setlocale)).
-
-- Curl:
-
- - (Support constant CURLM_ADDED_ALREADY).
-
-- Date:
-
- - (DatePeriod::getEndDate segfault).
-
-- Fileinfo:
-
- - (Buffer over-write in finfo_open with malformed magic file). (CVE-2015-8865)
-
-- Mbstring:
-
- - (AddressSanitizer: negative-size-param (-1) in mbfl_strcut). (CVE-2016-4073)
-
-- ODBC:
-
- - , (Executing prepared statements is succesfull only for the first two statements).
- - (Invalid memory write in phar on filename with \0 in name). (CVE-2016-4072)
-
-- PDO_DBlib:
-
- - (PDO::MSSQL forces format of datetime fields).
-
-- Phar:
-
- - (Crash in php7.dll with bad phar filename).
- - (Parsing of tar file with duplicate filenames causes memory leak).
-
-- SNMP:
-
- - (php_snmp_error() Format String Vulnerability). (CVE-2016-4071)
-
-- Standard:
-
- - (Integer Overflow in php_raw_url_encode). (CVE-2016-4070)
-
-
-
-
-
-Version 5.6.19
-
-- CLI server:
-
- - (Built-in HTTP server, we can download file in web by bug).
-
-- CURL:
-
- - (Copied handle with new option CURLOPT_HTTPHEADER crashes while curl_multi_exec).
-
-- Date:
-
- - (Datetime comparisons ignore microseconds).
- - (Calls to date_modify will mutate timelib_rel_time, causing date_date_set issues).
-
-- Fileinfo:
-
- - (finfo throws notice for specific python file).
-
-- FPM:
-
- - (FPM not working with Apache httpd 2.4 balancer/fcgi setup).
-
-- Opcache:
-
- - (Possible use-after-free of ZCG(cwd) in Zend Opcache).
-
-- PDO MySQL:
-
- - ( fix causes segmentation fault).
-
-- Phar:
-
- - (Out-of-Bound Read in phar_parse_zipfile()).
-
-- Standard:
-
- - (strip_tags improper php code parsing).
-
-- WDDX:
-
- - (Use-After-Free / Double-Free in WDDX Deserialize).
-
-- XSL:
-
- - (NULL pointer dereference in xsl_ext_function_php()).
-
-- Zip:
-
- - (NULL pointer dereference in Zip::ExtractTo).
-
-
-
-
-
-Version 5.6.18
-
-- Core:
-
- - Added support for new HTTP 451 code.
- - (exec functions ignore length but look for NULL termination).
- - (No check to duplicate zend_extension).
- - (round() segfault on 64-bit builds).
- - (A wrong ext directory setup in php.ini leads to crash).
- - (Output of stream_get_meta_data can be falsified by its input).
- - (Integer overflow in iptcembed()).
-
-- Apache2handler:
-
- - Fix >2G Content-Length headers in apache2handler.
-
-- FTP:
-
- - Implemented FR (Option to ignore the returned FTP PASV address).
-
-- GD:
-
- - Improved fix for bug .
-
-- Opcache:
-
- - (Define in auto_prepend_file is overwrite).
- - (Unable to use PHP 7.0 x64 side-by-side with PHP 5.6 x32 on the same server).
-
-- PCRE:
-
- - Upgraded bundled PCRE library to 8.38. (CVE-2015-8383, CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)
-
-- Phar:
-
- - (Heap corruption in tar/zip/phar parser). (CVE-2016-4342)
- - (Uninitialized pointer in phar_make_dirstream()). (CVE-2016-4343)
- - (NULL Pointer Dereference in phar_tar_setupmetadata()).
- - (Stack overflow when decompressing tar archives). (CVE-2016-2554)
-
-- Session:
-
- - (Crash in SessionHandler::read()).
-
-- SOAP:
-
- - (crash with bad soap request).
-
-- SPL:
-
- - (segfault if clean spl_autoload_funcs while autoloading).
-
-- WDDX:
-
- - (Type Confusion in WDDX Packet Deserialization).
-
-
-
-
-
-Version 5.6.17
-
-- Core:
-
- - (configure fails utf8_to_mutf7 test).
- - (Invalid opcode while using ::class as trait method paramater default value).
- - (self::class can not be resolved with reflection for abstract class).
- - (try{ } finally{} can create infinite chains of exceptions).
- - (SAPI build problem on AIX: Undefined symbol: php_register_internal_extensions).
-
-- FPM:
-
- - (fpm_log.c memory leak and buffer overflow). (CVE-2016-5114)
-
-- GD:
-
- - (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds). (CVE-2016-1903)
-
-- Mysqlnd:
-
- - (LOAD DATA LOCAL INFILE / open_basedir restriction).
-
-- SOAP:
-
- - (SoapClient systematic out of memory error).
-
-- Standard:
-
- - (ReflectionFunction for array_unique returns wrong number of parameters).
-
-- PDO_Firebird:
-
- - (Integer returned as a 64bit integer on X64_86).
-
-- WDDX:
-
- - (Use After Free Vulnerability in WDDX Packet Deserialization).
- - (Session WDDX Packet Deserialization Type Confusion Vulnerability).
-
-- XMLRPC:
-
- - (Type Confusion Vulnerability in PHP_to_XMLRPC_worker()).
-
-
-
-
-
-Version 5.6.16
-
-- Core:
-
- - (php-fpm 5.6 with opcache crashes when referencing a non-existent constant).
- - (Segfault in ini_lex () at Zend/zend_ini_scanner.l).
-
-- Mysqlnd:
-
- - (MySQLi does not provide way to disable peer certificate validation) by introducing MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT connection flag.
-
-- OCI8:
-
-- PDO_DBlib:
-
- - (Segmentation fault on nextRowset).
-
-- SOAP:
-
- - (Segmentation fault if wsdl has no targetNamespace attribute).
-
-- SPL:
-
- - (Segfault getting NULL offset of an ArrayObject).
-
-
-
-
-
-Version 5.6.15
-
-- Core:
-
- - (Segfault when binding $this of internal instance method to null).
- - (Segfault for getClosure() internal method rebind with invalid $this).
-
-- Date:
-
- - (DateTimeImmutable segfault).
-
-- Mcrypt:
-
- - (mcrypt_encrypt() won't return data when no IV was specified under RC4).
-
-- Mysqlnd:
-
- - (mysqli_real_query():Unknown type 245 sent by the server).
- - segfault in mysqlnd_connect.
-
-- Opcache:
-
- - (Third one of segfault in gc_remove_from_buffer).
- - (Another Segfault in gc_remove_from_buffer()).
- - (Segfault in gc_remove_from_buffer()).
- - Fixed compatibility with Windows 10 (see also ).
-
-
-
-
-
-Version 5.6.14
-
-- Core:
-
- - (Bundled libtool.m4 doesn't handle FreeBSD 10 when building extensions).
-
-- CLI server:
-
- - (404 on urls with '+').
-
-- DOM:
-
- - (Assigning to DOMNode::textContent does additional entity encoding).
-
-- ldap:
-
- - (Bug in ldap_search() modifies LDAP_OPT_TIMELIMIT/DEREF's values). (Tyson Andre).
- - (ldap timeouts not enforced). (Côme Bernigaud).
-
-- Mysqlnd:
-
- - (mysqlnd doesn't activate TCP keep-alive when connecting to a server).
-
-- OpenSSL:
-
- - (openssl extension does not get the DH parameters from DH key resource).
- - (Missing ARG_INFO for openssl_seal()).
- - (openssl_seal fails with AES).
- - (Lookup for openssl.cnf causes a message box).
-
-- PDO:
-
- - (PDO constructor changes unrelated variables).
-
-- Phar:
-
- - (Null pointer dereference in phar_get_fp_offset()). (CVE-2015-7803)
- - (Uninitialized pointer in phar_make_dirstream when zip entry filename is "/"). (CVE-2015-7804)
-
-- Phpdbg:
-
- - Fix phpdbg_break_next() sometimes not breaking.
-
-- Standard:
-
- - (setcookie() conditional for empty values not met).
-
-- Streams:
-
- - (HTTP stream wrapper doesn't close keep-alive connections).
-
-- Zip:
-
- - (ZipArchive::close() doesn't indicate errors).
-
-
-
-
-
-Version 5.6.13
-
-- Core:
-
- - (Too long timeout on pipes).
- - (SAPI may truncate POST data).
- - (Checking liveness does not work as expected).
- - (Use After Free Vulnerability in unserialize()). (CVE-2015-6834)
- - (Use after free vulnerability in session deserializer). (CVE-2015-6835)
-
-- CLI server:
-
- - (Sets HTTP_CONTENT_TYPE but not CONTENT_TYPE).
- - (CLI server directory traversal).
-
-- Date:
-
- - (DateInterval::__construct.interval_spec is not supposed to be optional).
- - (new DateTimeZone($foo) is ignoring text after null byte).
-
-- EXIF:
-
- - (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).
-
-- GMP:
-
- - (Use after free vulnerability in unserialize() with GMP).
-
-- hash:
-
- - (HAVAL gives wrong hashes in specific cases).
-
-- MCrypt:
-
- - (mcrypt fd caching not working).
-
-- Opcache:
-
- - (Empty while and do-while segmentation fault with opcode on CLI enabled).
-
-- PCRE:
-
- - (Incorrect bump-along behavior with \K and empty string match).
- - (Multiple vulnerabilities related to PCRE functions).
-
-- SOAP:
-
- - (SOAP serialize_function_call() type confusion / RCE). (CVE-2015-6836)
-
-- SPL:
-
- - (Null pointer deref (segfault) in spl_autoload via ob_start).
- - (Incorrect constructor reflection for ArrayObject).
- - (Use-after-free vulnerability in unserialize() with SplObjectStorage). (CVE-2015-6834)
- - (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList). (CVE-2015-6834)
-
-- Standard:
-
- - (getimagesize() fails for very large and very small WBMP).
- - (parse_ini_string() segmentation fault with INI_SCANNER_TYPED).
-
-- XSLT:
-
- - (NULL pointer dereference). (CVE-2015-6837, CVE-2015-6838)
-
-- ZIP:
-
- - (ZipArchive::extractTo allows for directory traversal when creating directories). (CVE-2014-9767)
-
-
-
-
-
-Version 5.6.12
-
-- Core:
-
- - (Exception lost with nested finally block).
- - (TS issues with temporary dir handling).
- - (Remotely triggerable stack exhaustion via recursive method calls).
- - (Different arrays compare indentical due to integer key truncation).
- - (unserialize() could lead to unexpected methods execution / NULL pointer deref).
-
-- CLI server:
-
- - (php -S changes MKCALENDAR request method to MKCOL).
- - (304 responses return Content-Type header).
-
-- GD:
-
- - (imagerectangle problem with point ordering).
- - (Stack overflow with imagefilltoborder). (CVE-2015-8874)
- - (imagecreatefromwebm() shifts colors).
- - (imagewebp() doesn't pad to even length).
- - (imagerotate by -90 degrees truncates image by 1px).
- - (imagescale(..., IMG_BICUBIC) leaks memory).
- - (imagescale segfault with palette based image).
- - (Zero-height rectangle has whiskers).
- - (imagecrop() add a black line when cropping).
- - (copy 'n paste error).
- - (PHP segfaults in imagexbm).
- - (gd_info() doesn't report WebP support).
-
-- ODBC:
-
- - (PHP segfaults when accessing nvarchar(max) defined columns). (CVE-2015-8879)
-
-- OpenSSL:
-
- - (OpenSSL error "key values mismatch" after openssl_pkcs12_read with extra cert).
- - (openssl_random_pseudo_bytes() is not cryptographically secure). (CVE-2015-8867)
-
-- Phar:
-
- - Improved fix for bug .
- - (Files extracted from archive may be placed outside of destination directory). (CVE-2015-6833)
-
-- SOAP:
-
- - (SoapClient info leak / null pointer dereference via multiple type confusions).
-
-- SPL:
-
- - (Dangling pointer in the unserialization of ArrayObject items). (CVE-2015-6832)
- - (Use After Free Vulnerability in unserialize() with SPLArrayObject). (CVE-2015-6831)
- - (Use After Free Vulnerability in unserialize() with SplObjectStorage). (CVE-2015-6831)
- - (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList). (CVE-2015-6831)
-
-- Standard:
-
- - (Repeated iptcembed() adds superfluous FF bytes).
-
-
-
-
-
-Version 5.6.11
-
-- Core:
-
- - (escapeshell*() doesn't cater to !).
- - (Use __builtin_clzl on PowerPC).
- - (can induce segmentation fault with basic php code).
- - (Windows 10 reported as Windows 8).
- - (parse_ini_file() and parse_ini_string() segmentation fault).
- - (phpinfo() reports Professional Editions of Windows 7/8/8.1/10 as "Business").
- - (finally in generator (yield) swallows exception in iteration).
- - (phpinfo() does not report many Windows SKUs).
- - (Different arrays compare indentical due to integer key truncation).
- - (Can't set empty additional_headers for mail()), regression from fix to bug .
-
-- GD:
-
- - (imagegammacorrect function loses alpha channel).
-
-- GMP:
-
- - (gmp_random_range() modifies second parameter if GMP number).
-
-- Mysqlnd:
-
- - (mysqlnd is vulnerable to BACKRONYM). (CVE-2015-3152)
-
-- PCRE:
-
- - (preg_replace: * qualifier on unicode replace garbles the string).
- - (Segfault in preg_replace_callback).
-
-- PDO_pgsql:
-
- - (PDOStatement::execute() leaks memory with DML Statements when closeCuror() is u).
- - (PDO-pgsql fails to connect if password contains a leading single quote).
- - (PDO PgSQL Incorrect binding numeric array with gaps).
-
-- Phar:
-
- - (Segfault in Phar::convertToData on invalid file). (CVE-2015-5589)
- - (Buffer overflow and stack smashing error in phar_fix_filepath). (CVE-2015-5590)
-
-- SimpleXML:
-
- - Refactored the fix for bug (simplexml_load_string() mangles empty node name).
-
-- SPL:
-
- - (Segfault when SplMinHeap::compare produces fatal error).
- - (SplFileObject setMaxLineLength).
- - (Use-after-free vulnerability in spl_recursive_it_move_forward_ex()).
-
-- Sqlite3:
-
- - (Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk()).
-
-
-
-
-
-Version 5.6.10
-
-- Core:
-
- - (temp. directory is cached during multiple requests).
- - (Conditional jump or move depends on uninitialised value in extension trait).
- - (Strange generator+exception+variadic crash).
- - (complex GLOB_BRACE fails on Windows).
- - Fixed POST data processing slowdown due to small input buffer size on Windows.
- - (OS command injection vulnerability in escapeshellarg). (CVE-2015-4642)
- - (Incorrect handling of paths with NULs). (CVE-2015-4598)
-
-- FTP:
-
- - Improved fix for bug (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4643)
-
-- GD:
-
- - (GD fails to build with newer libvpx).
-
-- Iconv:
-
- - (iconv with //IGNORE cuts the string).
-
-- Litespeed SAPI:
-
- - (Unchecked return value).
-
-- Mail:
-
- - (mail() does not have mail header injection prevention for additional headers).
-
-- MCrypt:
-
- - Added file descriptor caching to mcrypt_create_iv().
-
-- Opcache:
-
- - (Memory leak with opcache.optimization_level=0xFFFFFFFF).
-
-- Phar:
-
- - (phar symlink in binary directory broken).
-
-- Postgres:
-
- - (segfault in php_pgsql_meta_data). (CVE-2015-4644)
-
-- Sqlite3:
-
- - Upgrade bundled sqlite to 3.8.10.2. (CVE-2015-3414, CVE-2015-3415,
- CVE-2015-3416)
-
-
-
-
-
-Version 5.6.9
-
-- Core:
-
- - (Wrong checked for the interface by using Trait).
- - (Invalid read in zend_std_get_method).
- - ("use statement [...] has no effect" depends on leading backslash).
- - (Segmentation fault in gc_remove_zval_from_buffer).
- - (segmentation fault in destructor).
- - (Returning compatible sub generator produces a warning).
- - (php_sys_readlink ignores misc errors from GetFinalPathNameByHandleA).
- - (PHP Multipart/form-data remote dos Vulnerability). (CVE-2015-4024)
- - (str_repeat() sign mismatch based memory corruption).
- - (CVE-2006-7243 fix regressions in 5.4+). (CVE-2015-4025)
- - (heap buffer overflow in unpack()).
-
-- FTP:
-
- - (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4022)
-
-- ODBC:
-
- - (Incorrect use of SQLColAttributes with ODBC 3.0).
- - (ODBC: Query with same field name from two tables returns incorrect result).
- - (out of memory with sage odbc driver).
-
-- OpenSSL:
-
- - (Reading empty SSL stream hangs until timeout).
-
-- PCNTL:
-
- - (pcntl_exec() should not allow null char). (CVE-2015-4026)
-
-- PCRE:
-
- - Upgraded pcrelib to 8.37. (CVE-2015-2325, CVE-2015-2326)
-
-- Phar:
-
- - (Memory Corruption in phar_parse_tarfile when entry filename starts with null). (CVE-2015-4021)
-
-
-
-
-
-Version 5.6.8
-
-- Core:
-
- - (php crashes with __get() and ++ operator in some cases).
- - (get_browser() browser_name_regex returns non-utf-8 characters).
- - (parse_url fails on some partial urls).
- - (Per Directory Values overrides PHP_INI_SYSTEM configuration options).
- - Additional fix for bug (Type confusion vulnerability in exception::getTraceAsString).
- - (serialize function return corrupted data when sleep has non-string values).
- - (Leaking VIA_HANDLER func when exception thrown in __call/... arg passing).
- - (Segmentation fault when using a generator in combination with an Iterator).
- - (php_stream_url_wrap_http_ex() type-confusion vulnerability).
- - (Missing null byte checks for paths in various PHP extensions). (CVE-2015-3411, CVE-2015-3412)
-
-- Apache2handler:
-
- - (potential remote code execution with apache 2.4 apache2handler). (CVE-2015-3330)
-
-- cURL:
-
- - (HTTP2 support).
- - (Missing break / control flow).
- - (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER).
-
-- Date:
-
- - (Issues with "last day of <monthname>").
-
-- Enchant:
-
- - (Enchant broker plugins are in the wrong place in windows builds).
-
-- Ereg:
-
- - (NULL Pointer Dereference).
-
-- Fileinfo:
-
- - (Fileinfo on specific file causes spurious OOM and/or segfault). (CVE-2015-4604, CVE-2015-4605)
-
-- Filter:
-
- - (FILTER_FLAG_STRIP_BACKTICK ignored unless other flags are used).
- - (FILTER_FLAG_STRIP_HIGH doesn't strip ASCII 127).
-
-- Mbstring:
-
- - (False detection of CJK Unified Ideographs Extension E).
-
-- OPCache:
-
- - (function_exists strange behavior with OPCache on disabled function).
- - (opcache_is_script_cached no longer works).
- - (Use After Free). (CVE-2015-1351)
-
-- OpenSSL:
-
- - , (Buffered crypto stream data breaks IO polling in stream_select() contexts).
- - (openssl_pkcs7_sign handles default value incorrectly).
- - (Crypto servers should send client CA list).
- - Add a check for RAND_egd to allow compiling against LibreSSL.
-
-- Phar:
-
- - (PharData::extractTo fails for tarball created by BSD tar).
- - (phar_add_file is too restrictive on filename).
- - (Call to undefined method cli_arg_typ_string).
- - (Phar::mapPhar fails for Phars inside a path containing ".tar").
- - (Buffer Over-read in unserialize when parsing Phar). (CVE-2015-2783, CVE-2015-3307)
- - (Buffer Overflow when parsing tar/zip/phar in phar_set_inode). (CVE-2015-3329)
-
-- Postgres:
-
- - (Null pointer dereference). (CVE-2015-1352)
-
-- SOAP:
-
- - (Type Confusion Infoleak Vulnerability in unserialize() with SoapFault). (CVE-2015-4599)
- - (NEW segfault when using SoapClient::__setSoapHeader (bisected, regression)).
-
-- SPL:
-
- - (Use after free in zval_scan caused by spl_object_storage_get_gc).
-
-- Sqlite3:
-
- - (SQLITE segfaults if custom collator throws an exception).
- - (Upgrade bundled libsqlite to 3.8.8.3).
- - (SQLite prepared statement use-after-free).
-
-
-
-
-
-Version 5.6.7
-
-- Core:
-
- - (leaks when unused inner class use traits precedence).
- - (Crash in gc_zval_possible_root on unserialize).
- - (Segfault in get_current_user when script owner is not in passwd with ZTS build).
- - (Segfault when calling ob_start from output buffering callback).
- - (pointer returned by php_stream_fopen_temporary_file not validated in memory.c).
- - (Exception with invalid character causes segv).
- - (Missing arguments in reflection info for some builtin functions).
- - (Use After Free Vulnerability in unserialize()). (CVE-2015-2787)
- - (Per Directory Values overrides PHP_INI_SYSTEM configuration options).
- - (move_uploaded_file allows nulls in path). (CVE-2015-2348)
-
-- CGI:
-
- - (php-cgi's getopt does not see $argv).
-
-- CLI:
-
- - (auto_prepend_file messes up __LINE__).
-
-- cURL:
-
- - (PHP_MINIT_FUNCTION does not fully initialize cURL on Win32).
- - Add CURLPROXY_SOCKS4A and CURLPROXY_SOCKS5_HOSTNAME constants if supported by libcurl.
-
-- Ereg:
-
- - (heap overflow vulnerability in regcomp.c). (CVE-2015-2305)
-
-- FPM:
-
- - (request time is reset too early).
-
-- ODBC:
-
- - (Allowed memory size exhausted with odbc_exec).
-
-- Opcache:
-
- - (Opcache causes problem when passing a variable variable to a function).
- - (Array numeric string as key).
- - (switch(SOMECONSTANT) misbehaves).
-
-- OpenSSL:
-
- - (Segmentation fault at openssl_spki_new).
- - , , , (encrypted streams don't observe socket timeouts).
- - (use strict peer_fingerprint input checks) (Daniel Lowrey)
- - (IP Address fields in subjectAltNames not used) (Daniel Lowrey)
- - (SAN match fails with trailing DNS dot) (Daniel Lowrey)
- - (Add signatureType to openssl_x509_parse) (Daniel Lowrey)
- - (Inconsistent stream crypto values across versions) (Daniel Lowrey)
-
-- pgsql:
-
- - (pg_update() fails to store infinite values).
-
-- Readline:
-
- - (Null dereference in readline_(read|write)_history() without parameters).
-
-- SOAP:
-
- - (SoapClient's __call() type confusion through unserialize()). (CVE-2015-4147, CVE-2015-4148)
-
-- SPL:
-
- - ("Segmentation fault" when (de)serializing SplObjectStorage).
- - (RecursiveDirectoryIterator::seek(0) broken after calling getChildren()).
-
-- ZIP:
-
- - (ZIP Integer Overflow leads to writing past heap boundary). (CVE-2015-2331)
-
-
-
-
-
-Version 5.6.6
-
-- Core:
-
- - Removed support for multi-line headers, as they are deprecated by RFC 7230.
- - (getClosure returns somethings that's not a closure).
- - (Use after free vulnerability in unserialize() with DateTimeZone). (CVE-2015-0273)
- - (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow).
- - (htmlspecialchars() does not respect default_charset specified by ini_set).
- - Added NULL byte protection to exec, system and passthru.
-
-- Dba:
-
- - (useless comparisons).
-
-- Enchant:
-
- - (heap buffer overflow in enchant_broker_request_dict()). (CVE-2014-9705)
-
-- Fileinfo:
-
- - (Double free with disabled ZMM).
- - (Bundled libmagic 5.17 does not detect quicktime files correctly).
- - (finfo_buffer doesn't extract the correct mime with some gifs).
-
-- FPM:
-
- - (Wrong response to FCGI_GET_VALUES).
- - (core dump when webserver close the socket).
-
-- JSON:
-
- - (json_encode() does not always encode a float as a float) by adding JSON_PRESERVE_ZERO_FRACTION.
-
-- LIBXML:
-
- - (libxml_disable_entity_loader setting is shared between threads). (CVE-2015-8866)
-
-- Mysqli:
-
- - (linker error on some OS X machines with fixed width decimal support).
- - (Reading 4 byte floats with Mysqli and libmysqlclient has rounding errors).
-
-- Opcache:
-
- - Fixed bug with try blocks being removed when extended_info opcode generation is turned on.
-
-- PDO_mysql:
-
- - (PDOMysql with mysqlnd does not allow the usage of named pipes).
-
-- Phar:
-
- - (use after free). (CVE-2015-2301)
-
-- Pgsql:
-
- - (pg_copy_from() modifies input array variable).
-
-- Session:
-
- - (mod_files.sh is a bash-script).
- - (no EINTR check on flock).
- - (Empty session IDs do still start sessions).
-
-- Sqlite3:
-
- - (SQLite3Result::fetchArray declares wrong required_num_args).
-
-- Standard:
-
- - (flock() out parameter not set correctly in windows).
- - (Request may get env. variables from previous requests if PHP works as FastCGI).
-
-- Streams:
-
- - Fixed bug which caused call after final close on streams filter.
-
-
-
-
-
-Version 5.6.5
-
-- Core:
-
- - Upgraded crypt_blowfish to version 1.3.
- - (unlink() bug with some files path).
- - (Inside trait, self::class != __CLASS__).
- - (pack for 64bits integer is broken on bigendian).
- - (errors spawn MessageBox, which blocks test automation).
- - (Application Popup provides too few information).
- - (localeconv() broken in TS builds).
- - (setting locale randomly broken).
- - (configure doesn't define EXPANDED_DATADIR / PHP_DATADIR correctly).
- - (Crash in timeout thread).
- - (Constructor from trait conflicts with inherited constructor).
- - (Explicit Double Free). (CVE-2014-9425)
- - (Use After Free Vulnerability in PHP's unserialize()). (CVE-2015-0231)
-
-- CGI:
-
- - (out of bounds read crashes php-cgi). (CVE-2014-9427)
-
-- CLI server:
-
- - (Invalid HTTP requests make web server segfault).
-
-- cURL:
-
- - (curl_multi_getcontent returns '' when CURLOPT_RETURNTRANSFER isn't set).
-
-- Date:
-
- - (DatePeriod: Getter for start date, end date and interval).
-
-- EXIF:
-
- - (Free called on uninitialized pointer). (CVE-2015-0232)
-
-- Fileinfo:
-
- - (msooxml matches too many archives).
- - (invalid free in libmagic).
- - (incorrect expression in libmagic).
- - Removed readelf.c and related code from libmagic sources.
- - (fileinfo out-of-bounds memory access). (CVE-2014-9652)
-
-- FPM:
-
- - (Implement POSIX Access Control List for UDS).
- - (listen.allowed_clients is broken).
-
-- GD:
-
- - (buffer read overflow in gd_gif_in.c). (CVE-2014-9709)
- - (Report gd library version).
-
-- mbstring:
-
- - (--with-libmbfl configure option not present on Windows).
-
-- Opcache:
-
- - (strlen incorrect : mbstring + func_overload=2 +UTF-8 + Opcache).
- - (Memory leak when using "continue 2" inside two foreach loops).
-
-- OpenSSL:
-
- - Improved handling of OPENSSL_KEYTYPE_EC keys.
-
-- pcntl:
-
- - (pcntl_signal doesn't decrease ref-count of old handler when setting SIG_DFL).
-
-- PCRE:
-
- - (Alignment Bug in PCRE 8.34 upstream).
-
-- pgsql:
-
- - (lo_export return -1 on failure).
-
-- PDO:
-
- - (PDO#getAttribute() cannot be called with platform-specifi attribute names).
-
-- PDO_mysql:
-
- - (Add new PDO mysql connection attr to control multi statements option).
-
-- SPL:
-
- - (RecursiveDirectoryIterator::CURRENT_AS_PATHNAME breaks the RecursiveIterator).
- - (Added escape parameter to SplFileObject::fputcsv).
-
-- SQLite:
-
- - (Update bundled libsqlite to 3.8.7.2).
-
-- Streams:
-
- - (convert.base64-encode omits padding bytes).
-
-
-
-
-
-Version 5.6.4
-
-- Core:
-
- - (Some Zend headers lack appropriate extern "C" blocks).
- - (Segfault while pre-evaluating a disabled function).
- - ("Inconsistent insteadof definition."- incorrectly triggered).
- - (Inconsistency in example php.ini comments).
- - ("unset($this)" can make the program crash).
- - (Incorrect argument reflection info for array_multisort()).
- - (NULL pointer dereference in unserialize.c).
- - (Array constant not accepted for array parameter default).
- - (Use after free vulnerability in unserialize()). (CVE-2014-8142)
-
-- Date:
-
- - Fixed day_of_week function as it could sometimes return negative values internally.
-
-- FPM:
-
- - (fpm_unix_init_main ignores log_level).
- - (listen=9000 listens to ipv6 localhost instead of all addresses).
- - (access.format='%R' doesn't log ipv6 address).
- - (PHP-FPM will no longer load all pools).
- - (listen.allowed_clients is IPv4 only).
- - (php-fpm man page is oudated).
- - (Change pm.start_servers default warning to notice).
- - (listen.allowed_clients can silently result in no allowed access).
- - (php-fpm conf files loading order).
- - (access.log don't use prefix).
-
-- Mcrypt:
-
- - Fixed possible read after end of buffer and use after free.
-
-- GMP:
-
- - (build error with gmp 4.1).
-
-- PDO_pgsql:
-
- - (PDO_PGSQL::beginTransaction() wrongly throws exception when not in transaction).
- - (PDO::PARAM_BOOL and ATTR_EMULATE_PREPARES misbehaving).
-
-- Session:
-
- - (Session custom storage callable functions not being called).
-
-- SOAP:
-
- - (Segmentation fault on SoapClient::__getTypes).
-
-- zlib:
-
- - (Compiling PHP with large file support will replace function gzopen by gzopen64).
-
-
-
-
-
-Version 5.6.3
-
-- Core:
-
- - Implemented 64-bit format codes for pack() and unpack().
- - (proc_open on Windows hangs forever).
- - (A foreach on an array returned from a function not doing copy-on-write).
- - (Windows 8.1/Server 2012 R2 OS build number reported as 6.2 (instead of 6.3)).
- - (DOMNodeList elements should be accessible through array notation).
- - (AddressSanitizer reports a heap buffer overflow in php_getopt()).
- - ($a->foo .= 'test'; can leave $a->foo undefined).
- - (parse_url() - incomplete support for empty usernames and passwords).
- - (zend_mm_heap corrupted after memory overflow in zend_hash_copy).
-
-- CURL:
-
- - Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl.
-
-- Fileinfo:
-
- - (libmagic: don't assume char is signed).
- - (buffer-overflow in libmagic/readcdf.c caught by AddressSanitizer).
- - (fileinfo: out-of-bounds read in elf note headers). (CVE-2014-3710)
-
-- FPM:
-
- - (PHP-FPM incorrectly defines the SCRIPT_NAME variable when using Apache, mod_proxy-fcgi and ProxyPass).
- - (listen and listen.allowed_clients should take IPv6 addresses).
-
-- GD:
-
- - (imagescale() fails without height param).
-
-- GMP:
-
- - Implemented gmp_random_range() and gmp_random_bits().
- - (GMP memory management conflicts with other libraries using GMP).
-
-- Mysqli:
-
- - (linker error on some OS X machines with fixed width decimal support).
-
-- ODBC:
-
- - (ODBC not correctly reading DATE column when preceded by a VARCHAR column).
-
-- OpenSSL:
-
- - (Allow to use system cipher list instead of hardcoded value).
-
-- PDO_pgsql:
-
- - (PDO::pgsqlGetNotify doesn't support NOTIFY payloads).
- - (Segmentation fault on statement deallocation).
-
-- Reflection:
-
- - (Duplicate entry in Reflection for class alias).
-
-- SPL:
-
- - (Regression in RecursiveRegexIterator).
-
-
-
-
-
-Version 5.6.2
-
-- Core:
-
- - (Integer overflow in unserialize() (32-bits only)). (CVE-2014-3669)
-
-- cURL:
-
- - (NULL byte injection - cURL lib).
-
-- EXIF:
-
- - (Heap corruption in exif_thumbnail()). (CVE-2014-3670)
-
-- XMLRPC:
-
- - (Global buffer overflow in mkgmtime() function). (CVE-2014-3668)
-
-
-
-
-
-Version 5.6.1
-
-- Core:
-
- - (parse_ini_file() loses the type of booleans).
- - (SIGSEGV during zend_shutdown()).
- - (Crash on SIGTERM in apache process).
- - (program_prefix not honoured in man pages).
- - (Segfault when extending interface method with variadic).
- - (Incorrect last used array index copied to new array after unset).
- - (New Posthandler Potential Illegal efree() vulnerability). (CVE-2014-3622)
-
-- DOM:
-
- - Made DOMNode::textContent writeable.
-
-- Fileinfo:
-
- - (finfo::file() returns invalid mime type for binary files).
-
-- GD:
-
- - Made fontFetch's path parser thread-safe.
-
-- GMP:
-
- - (Using GMP objects with overloaded operators can cause memory exhaustion).
- - (gmp_init() results 0 on given base and number starting with 0x or 0b).
- - Implemented gmp_import() and gmp_export().
-
-- MySQLi:
-
- - (mysqli does not handle 4-byte floats correctly).
-
-- OpenSSL:
-
- - (extension won't build if openssl compiled without SSLv3).
-
-- phpdbg:
-
- - (compile error without ZEND_SIGNALS).
-
-- SOAP:
-
- - (SoapClient prepends 0-byte to cookie names).
-
-- Session:
-
- - (SessionHandler Invalid memory read create_sid()).
-
-- Sysvsem:
-
- - (Add optional nowait argument to sem_acquire).
-
-
-
-
-
-Version 5.6.0
-
-
-- General improvements:
-
- - Added constant scalar expressions syntax.
- - Added dedicated syntax for variadic functions.
- - Added support for argument unpacking to complement the variadic syntax.
- - Added an exponentiation operator (**).
- - Added phpdbg SAPI.
- - Added unified default encoding.
- - The php://input stream is now re-usable and can be used concurrently with enable_post_data_reading=0.
- - Added use function and use const..
- - Added a function for timing attack safe string comparison.
- - Added the __debugInfo() magic method to allow userland classes to implement the get_debug_info API previously available only to extensions.
- - Added gost-crypto (CryptoPro S-box) hash algorithm.
- - Stream wrappers verify peer certificates and host names by default in encrypted client streams.
- - Uploads equal or greater than 2GB in size are now accepted.
-
-
-- Core:
-
- - (incorrect push to the empty array).
- - Removed inconsistency regarding behaviour of array in constants at run-time.
- - (eval with parse error causes segmentation fault in generator).
- - (strtr with empty array crashes).
- - (Windows 8.1/Server 2012 R2 reported as Windows 8/Server 2012).
- - (Incorrect behavior with nested "finally" blocks).
- - (ucwords and Title Case).
- - (make install fails to install libphp5.so on FreeBSD 10.0).
- - (Memory leak with immediately dereferenced array in class constant).
- - (Segfault in highlight_file()/highlight_string()).
- - (phpinfo() Type Confusion Information Leak Vulnerability). (CVE-2014-4721)
- - (php://input temp file will be located in sys_temp_dir instead of upload_tmp_dir).
- - (array_splice all elements, then []= gives wrong index).
- - (php://input regression).
- - (spl_fixedarray_resize integer overflow).
- - (iptcparse out-of-bounds read).
- - (convert_uudecode out-of-bounds read).
- - (printf out-of-bounds read).
- - (Differentiate between member function call on a null and non-null, non-objects).
- - (Autoloader isn't called if two method definitions don't match).
- - (Closures do not correctly capture the late bound class (static::) in some cases).
- - (insecure temporary file use in the configure script). (CVE-2014-3981)
- - (dtrace breaks argument unpack).
- - (header('Location: foo') will override a 308-399 response code).
- - (SIGSEGV when using count() on an object implementing Countable).
- - (putenv with empty variable may lead to crash).
- - Expose get_debug_info class hook as __debugInfo() magic method.
- - Implemented unified default encoding (RFC: https://wiki.php.net/rfc/default_encoding).
- - Added T_POW (**) operator (RFC: https://wiki.php.net/rfc/pow-operator).
- - Improved IS_VAR operands fetching.
- - Improved empty string handling. Now ZE uses an interned string instead of allocation new empty string each time.
- - Implemented internal operator overloading (RFC: https://wiki.php.net/rfc/operator_overloading_gmp).
- - Made calls from incompatible context issue an E_DEPRECATED warning instead of E_STRICT (phase 1 of RFC: https://wiki.php.net/rfc/incompat_ctx).
- - Uploads equal or greater than 2GB in size are now accepted.
- - Reduced POST data memory usage by 200-300%. Changed INI setting always_populate_raw_post_data to throw a deprecation warning when enabling and to accept -1 for never populating the $HTTP_RAW_POST_DATA global variable, which will be the default in future PHP versions.
- - Implemented dedicated syntax for variadic functions (RFC: https://wiki.php.net/rfc/variadics).
- - Improving multi-threaded scalability by using emalloc/efree/estrdup (Anatol, Dmitry)
- - Implemented constant scalar expressions (with support for constants) (RFC: https://wiki.php.net/rfc/const_scalar_exprs).
- - (Segfault with finally).
- - (copy() arginfo has changed starting from 5.4).
- - Allow zero length comparison in substr_compare() (Tjerk)
- - (proc_open() changes environment array) (Tjerk)
- - (Out of memory on command stream_get_contents).
- - (stream_socket_server() creates wrong Abstract Namespace UNIX sockets).
- - (exit in stream filter produces segfault).
- - (fpassthru broken).
- - (Cannot use T_POW in const expression) (Tjerk)
- - (substr_compare broke by previous change) (Tjerk)
- - (copy() doesn't work when destination filename is created by tempnam()).
- - (Unexpected array indexing in class's static property).
- - Added (constant) string/array dereferencing to static scalar expressions to complete the set; now possible thanks to being fixed.
- - (Update reflection information for unserialize() function).
- - (Composer.phar install/update fails).
- - (getimagesize should recognize BMP files with negative height).
- - (Countable interface prevents using 2nd parameter ($mode) of count() function).
- - (Echoing unserialized "SplFileObject" crash).
- - (Remove reference to Windows 95).
-
-- Apache2 Handler SAPI:
-
- - Fixed Apache log issue caused by APR's lack of support for %zu (APR issue https://issues.apache.org/bugzilla/show_bug.cgi?id=56120).
-
-- CLI server:
-
- - Added some MIME types to the CLI web server.
- - (Missing MIME types for XML/XSL files).
- - (Empty header causes PHP built-in web server to hang).
- - (Unable to access to apache_request_headers() elements).
- - (CLI server is missing some new HTTP response codes).
- - (built-in web-server segfaults on startup).
-
-- COM:
-
- - (DOTNET is successful once per server run) (Aidas Kasparas)
- - Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas).
- - (Special Character via COM Interface (CP_UTF8)).
-
-- Curl:
-
- - (re-enable CURLOPT_FOLLOWLOCATION with open_basedir or safe_mode).
- - Check for openssl.cafile ini directive when loading CA certs.
- - Remove cURL close policy related constants as these have no effect and are no longer used in libcurl.
- - (Can't reset CURLOPT_CUSTOMREQUEST to default behaviour) (Tjerk)
- - Fix compilation on libcurl versions between 7.10.5 and 7.12.2, inclusive.
- - (CURLOPT_INFILE doesn't allow reset).
- - (curl_exec returns differently than curl_multi_getcontent).
-
-- Date:
-
- - (Heap buffer over-read in DateInterval). (CVE-2013-6712)
- - (memory leaks in DateTime constructor) (Tjerk).
- - (Serialize of DateTime truncates fractions of second).
- - Fixed regression in fix for (constructor can't be called twice).
- - (date_parse_from_format out-of-bounds read).
- - (timelib_meridian_with_check out-of-bounds read).
- - Added DateTimeImmutable::createFromMutable to create a DateTimeImmutable object from an existing DateTime (mutable) object (Derick)
- - (__wakeup of DateTime segfaults when invalid object data is supplied).
- - (DateTime constructor crash with invalid data).
-
-- DOM:
-
- - (DOMDocumentType->internalSubset returns entire DOCTYPE tag, not only the subset).
-
-- Embed:
-
- - (php5embed.lib isn't provided anymore). (Anatol).
-
-- Fileinfo:
-
- - (Segfault in cdf.c). (CVE-2014-3587)
- - (extensive backtracking in rule regular expression). (CVE-2014-3538)
- - (fileinfo: CDF infinite loop in nelements DoS). (CVE-2014-0238)
- - (fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation). (CVE-2014-0237)
- - (fileinfo: cdf_read_short_sector insufficient boundary check). (CVE-2014-0207)
- - (fileinfo: NULL pointer deference flaw by processing certain CDF files). (CVE-2014-0236)
- - (fileinfo: mconvert incorrect handling of truncated pascal string size). (CVE-2014-3478)
- - (fileinfo: cdf_check_stream_offset insufficient boundary check). (CVE-2014-3479)
- - (fileinfo: cdf_count_chain insufficient boundary check). (CVE-2014-3480)
- - (fileinfo: cdf_read_property_info insufficient boundary check). (CVE-2014-3487)
- - Upgraded to libmagic-5.17 (Anatol)
- - (file: infinite recursion). (CVE-2014-1943)
- - (out-of-bounds memory access in fileinfo). (CVE-2014-2270)
- - (fileinfo: extensive backtracking in awk rule regular expression). (CVE-2013-7345)
- - (Memory corruption in fileinfo ext / bigendian).
- - (Solaris 10 is missing strcasestr and needs substitute).
- - (Fileinfo crashes with powerpoint files).
-
-- FPM:
-
- - (revised fix 67541, broke mod_fastcgi BC).
- - (error_log=syslog ignored).
- - (php links to systemd libraries without using pkg-config).
- - (syslog cannot be set in pool configuration).
- - (Fix Apache 2.4.10+ SetHandler proxy:fcgi:// incompatibilities).
- - Included apparmor support in fpm (RFC: https://wiki.php.net/rfc/fpm_change_hat).
- - Added clear_env configuration directive to disable clearenv() call.
- - (unknown entry 'priority' in php-fpm.conf).
- - (php-fpm reload leaks epoll_create() file descriptor).
- - (sapi/fpm: possible privilege escalation due to insecure default configuration). (CVE-2014-0185)
-
-- GD:
-
- - (Null byte injection possible with imagexxx functions). (CVE-2014-5120)
- - (php-gd 'c_color' NULL pointer dereference). (CVE-2014-2497)
- - (imageaffinematrixget missing check of parameters).
- - Fixed imagettftext to load the correct character map rather than the last one.
- - (Heap Overflow Vulnerability in imagecrop()). (CVE-2013-7226)
- - (imagecrop(): insufficient fix for NULL defer). (CVE-2013-7327)
- - (Invalid 2nd argument crashes imageaffinematrixget).
- - (imagescale - poor quality of scaled image).
- - (imagescale segfault).
- - (imagescale ignore method argument).
-
-- GMP:
-
- - (invalid argument crashes gmp_testbit) (Pierre)
- - Fixed crashes in serialize/unserialize.
- - Moved GMP to use object as the underlying structure and implemented various improvements based on this.
- - Added gmp_root() and gmp_rootrem() functions for calculating nth roots.
-
-- Hash:
-
- - Added gost-crypto (CryptoPro S-box) GOST hash algo.
- - (Missing FNV1a32 and FNV1a64 hash functions). (Michael M Slusarz).
- - Implemented timing attack safe string comparison function (RFC: https://wiki.php.net/rfc/timing_attack).
- - hash_pbkdf2() now works correctly if the $length argument is not specified.
-
-- Intl:
-
- - (A reproductible crash in UConverter when given invalid encoding) (Stas)
- - (Wrong argument type hint for function intltz_from_date_time_zone).
- - (NumberFormatter::parse() resets LC_NUMERIC setting).
- - (Locale::parseLocale Double Free).
- - (Buffer overflow in locale_get_display_name and uloc_getDisplayName (libicu 4.8.1)).
-
-- JSON:
-
- - Fixed case part of bug ("json_decode handles whitespace and case-sensitivity incorrectly")
- - (JsonSerializeable couldn't implement on module extension) (chobieeee@php.net)
- - (Blank line inside empty array/object when JSON_PRETTY_PRINT is set).
-
-- ldap:
-
- - Added new function ldap_modify_batch().
- - Fixed issue with null bytes in LDAP bindings.
-
-- litespeed:
-
- - (-Werror=format-security error in lsapi code).
-
-- Mail:
-
- - (Don't add newline after X-PHP-Originating-Script) (Tjerk)
-
-- Mcrypt:
-
- - No longer allow invalid key sizes, invalid IV sizes or missing required IV in mcrypt_encrypt, mcrypt_decrypt and the deprecated mode functions.
- - Use /dev/urandom as the default source for mcrypt_create_iv().
-
-- Mbstring:
-
- - Upgraded to oniguruma 5.9.5 (Anatol)
- - (mb_regex_encoding mismatch).
-
-- Milter:
-
- - (php-milter does not build and crashes randomly).
-
-- mysqli:
-
- - Added new function mysqli_get_links_stats() as well as new INI variable mysqli.rollback_on_cached_plink of type bool (Andrey)
- - (Segfault in mysqli_stmt::bind_result() when link closed) (Remi)
- - Fixed building against an external libmysqlclient.
-
-- mysqlnd:
-
- - Disabled flag for SP OUT variables for 5.5+ servers as they are not natively supported by the overlying APIs.
- - Added a new fetching mode to mysqlnd.
- - Added support for gb18030 from MySQL 5.7.
-
-- Network:
-
- - (segfault in dns_get_record). (CVE-2014-3597)
- - (Fix potential segfault in dns_get_record()). (CVE-2014-4049)
-
-- OCI8:
-
- - (Improve performance of multi-row OCI_RETURN_LOB queries) (Perrier, Chris Jones)
-
-- ODBC:
-
- - (odbc_fetch_into returns junk at end of multi-byte char fields).
-
-- OpenSSL:
-
- - Fixed missing type checks in OpenSSL options (Yussuf Khalil, Stas).
- - (TLS connections fail behind HTTP proxy).
- - Fixed broken build against OpenSSL older than 0.9.8 where ECDH unavailable.
- - (Subject altNames doesn't support wildcard matching).
- - (Fall back to crypto_type from context if not specified explicitly in stream_socket_enable_crypto).
- - (certificates validity parsing does not work past 2050).
- - (openssl_x509_parse warning with V_ASN1_GENERALIZEDTIME).
- - Peer certificates now verified by default in client socket operations (RFC: https://wiki.php.net/rfc/tls-peer-verification).
- - New openssl.cafile and openssl.capath ini directives.
- - Added crypto_method option for the ssl stream context.
- - Added certificate fingerprint support.
- - Added explicit TLSv1.1 and TLSv1.2 stream transports.
- - (CN_match gives false positive).
- - Peer name verification matches SAN DNS names for certs using the Subject Alternative Name x509 extension.
- - Fixed segfault when built against OpenSSL>=1.0.1 (Daniel Lowrey)
- - Added SPKAC support.
- - Fallback to Windows CA cert store for peer verification if no openssl.cafile ini directive or "cafile" SSL context option specified in Windows.
- - The openssl.cafile and openssl.capath ini directives introduced in alpha2 now have PHP_INI_PERDIR accessibility (was PHP_INI_ALL).
- - New "peer_name" SSL context option replaces "CN_match" (which still works as before but triggers E_DEPRECATED).
- - Fixed segfault when accessing non-existent context for client SNI use (Daniel Lowrey)
- - (Add EC key support to php_openssl_is_private_key).
- - (add new boolean "verify_peer_name" SSL context option allowing clients to verify cert names separately from the cert itself). "verify_peer_name" is enabled by default for client streams.
- - ("cafile" SSL context option now supports stream wrappers).
- - New openssl_get_cert_locations() function to aid CA file and peer verification debugging.
- - Encrypted stream wrappers now disable TLS compression by default.
- - New "capture_session_meta" SSL context option allows encrypted client and server streams access to negotiated protocol/cipher information.
- - New "honor_cipher_order" SSL context option allows servers to prioritize cipher suites of their choosing when negotiating SSL/TLS handshakes.
- - New "single_ecdh_use" and "single_dh_use" SSL context options allow for improved forward secrecy in encrypted stream servers.
- - New "dh_param" SSL context option allows stream servers control over the parameters when negotiating DHE cipher suites.
- - New "ecdh_curve" SSL context option allowing stream servers to specify the curve to use when negotiating ephemeral ECDHE ciphers (defaults to NIST P-256).
- - New "rsa_key_size" SSL context option gives stream servers control over the key size (in bits) used for RSA key agreements.
- - Crypto methods for encrypted client and server streams now use bitwise flags for fine-grained protocol support.
- - Added new tlsv1.0 stream wrapper to specify TLSv1 client/server method. tls wrapper now negotiates TLSv1, TLSv1.1 or TLSv1.2.
- - Encrypted client streams now enable SNI by default.
- - Encrypted streams now prioritize ephemeral key agreement and high strength ciphers by default.
- - New OPENSSL_DEFAULT_STREAM_CIPHERS constant exposes default cipher list.
- - New STREAM_CRYPTO_METHOD_* constants for enhanced control over the crypto methods negotiated encrypted server/client sessions.
- - Encrypted stream servers now automatically mitigate potential DoS vector arising from client-initiated TLS renegotiation. New "reneg_limit", "reneg_window" and "reneg_limit_callback" SSL context options for custom renegotiation limiting control.
- - Fixed memory leak in windows cert verification on verify failure.
- - Peer certificate capturing via SSL context options now functions even if peer verification fails.
- - Encrypted TLS servers now support the server name indication TLS extension via the new "SNI_server_certs" SSL context option.
- - (Default disgest algo is still MD5, switch to SHA1).
- - (memory leak in openssl_seal()).
- - (memory leak in openssl_open()).
- - (Fix broken build when extension built separately).
-
-- OPcache:
-
- - Added an optimization of class constants and constant calls to some internal functions (Laruence, Dmitry)
- - Added an optimization pass to convert FCALL_BY_NAME into DO_FCALL.
- - Added an optimization pass to merged identical constants (and related cache_slots) in op_array->literals table.
- - Added script level constant replacement optimization pass.
- - Added function opcache_is_script_cached().
- - Added information about interned strings usage.
- - (php-cgi work with opcache, may be segmentation fault happen) (Dmitry, Laruence)
-
-- PCRE:
-
- - (Ungreedy and min/max quantifier bug, applied patch from the upstream).
- - Upgraded to PCRE 8.34.
- - Added support for (*MARK) backtracking verbs.
-
-- pgsql:
-
- - (Error in code "form" instead of "from", pgsql.c, line 756), which affected builds against libpq < 7.3.
- - pg_insert()/pg_select()/pg_update()/pg_delete() are no longer EXPERIMENTAL.
- - (Return value for pg_insert should be resource instead of bool).
- - (Add "description" with exteneded flag pg_meta_data(). pg_meta_data(resource $conn, string $table [, bool extended]) It also made pg_meta_data() return "is enum" always).
- - Read-only access to the socket stream underlying database connections is exposed via a new pg_socket() function to allow read/write polling when establishing asynchronous connections and executing queries in non-blocking applications.
- - Asynchronous connections are now possible using the PGSQL_CONNECT_ASYNC flag in conjunction with a new pg_connect_poll() function and connection polling status constants.
- - New pg_flush() and pg_consume_input() functions added to manually complete non-blocking reads/writes to underlying connection sockets.
- - pg_version() returns full report which obtained by PQparameterStatus().
- - Added pg_lo_truncate().
- - Added 64bit large object support for PostgreSQL 9.3 and later.
- - (Cannot build against libpq 7.3).
-
-- phpdbg:
-
- - (Compilation fails for phpdbg when the build directory != src directory).
- - (readline feature not enabled when build with libedit).
- - (List behavior is inconsistent).
- - (The prompt should always ensure it is on a newline).
- - (break if does not seem to work).
- - (register function has the same behavior as run).
- - (No way to list the current stack/frames) (Help entry was missing).
- - Fixed bug which caused phpdbg to fail immediately on startup in non-debug builds.
- - (phpdbg uses non-standard TIOCGWINSZ).
- - Included phpdbg sapi (RFC: https://wiki.php.net/rfc/phpdbg).
- - Added watchpoints (watch command).
- - Renamed some commands (next => continue and how to step).
- - (Added stdin/stdout/stderr constants and their php:// wrappers).
-
-- PDO:
-
- - ('pdo/php_pdo_error.h' not copied to the include dir).
-
-- PDO-ODBC:
-
- - (PDO-ODBC changes for 64-bit).
-
-- PDO_pgsql:
-
- - (PDO_pgsql: add pg_get_notify support).
- - (pgsqlCopyFromFile, pgsqlCopyToArray use Postgres < 7.3 syntax).
- - Cleaned up code by increasing the requirements to libpq versions providing PQexecParams, PQprepare, PQescapeStringConn, PQescapeByteaConn. According to the release notes that means 8.0.8+ or 8.1.4+.
- - Deprecated PDO::PGSQL_ATTR_DISABLE_NATIVE_PREPARED_STATEMENT, an undocument constant effectively equivalent to PDO::ATTR_EMULATE_PREPARES.
- - Added PDO::PGSQL_ATTR_DISABLE_PREPARES constant to execute the queries without preparing them, while still passing parameters separately from the command text using PQexecParams.
-
-- PDO_firebird:
-
- - (memory corruption in error handling) (Popa)
-
-- Phar:
-
- - ($phar->buildFromDirectory can't compress file with an accent in its name).
- - (Redirection loop on nginx with FPM).
-
-- readline:
-
- - (Interactive mode doesn't force a newline before the prompt).
- - (Save command history when exiting interactive shell with control-c).
-
-- Reflection:
-
- - (loosen the restrictions on ReflectionClass::newInstanceWithoutConstructor()).
-
-- Session:
-
- - (Regression in session_regenerate_id()).
- - Fixed missing type checks in php_session_create_id (Yussuf Khalil, Stas).
- - (Session raises E_NOTICE when session name variable is array).
- - (session.hash_function silently fallback to default md5) (Yasuo)
- - (Session write short circuit).
- - (session_abort() and session_reset() function).
- - Remove session_gc() and session_serializer_name() wich were introduced in the first 5.6.0 alpha.
-
-- SimpleXML:
-
- - (simplexml_load_string() mangles empty node name) (Anatol)
-
-- SQLite:
-
- - Updated the bundled libsqlite to the version 3.8.3.1 (Anatol)
- - (Updated bundled libsqlite to 3.8.4.3).
-
-- SOAP:
-
- - (Add SoapClient::__getCookies()).
-
-- SPL:
-
- - Revert fix for (BC issues).
- - (ArrayIterator use-after-free due to object change during sorting). (CVE-2014-4698)
- - (SPL Iterators use-after-free). (CVE-2014-4670)
- - (unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion). (CVE-2014-3515)
- - (Segfault in recursiveDirectoryIterator).
- - (Segmentation fault with ArrayObject unset).
- - (Allow to unserialize empty data).
- - (empty() does not work on classes that extend ArrayObject) (Tjerk)
- - (RegexIterator::INVERT_MATCH does not invert).
-
-- Standard:
-
- - (HTTP wrapper is very slow with protocol_version 1.1).
- - Implemented Change crypt() behavior w/o salt RFC. (Yasuo) https://wiki.php.net/rfc/crypt_function_salt
- - (Change array_fill() to allow creating empty array).
-
-- Streams:
-
- - (http:// wrapper doesn't follow 308 redirects).
-
-- Tokenizer:
-
- - (token_name() does not return name for T_POW and T_POW_EQUAL token).
-
-- XMLReader:
-
- - (XMLReader::getAttribute/No/Ns methods inconsistency).
-
-- XSL:
-
- - (<xsl:include> cannot find files with relative paths when loaded with "file://").
-
-- Zip:
-
- - update libzip to version 0.11.2. PHP doesn't use any ilibzip private symbol anymore.
- - new method ZipArchive::setPassword($password).
- - add --with-libzip option to build with system libzip.
- - new methods: ZipArchive::setExternalAttributesName($name, $opsys, $attr [, $flags]) ZipArchive::setExternalAttributesIndex($idx, $opsys, $attr [, $flags]) ZipArchive::getExternalAttributesName($name, &$opsys, &$attr [, $flags]) ZipArchive::getExternalAttributesIndex($idx, &$opsys, &$attr [, $flags])
-
-- Zlib:
-
- - (internal corruption phar error). Mike
- - (chained zlib filters silently fail with large amounts of data).
-
-
-
-
-
-
-Version 5.5.38
-
-- Core:
-
- - (php_url_parse_ex() buffer overflow read). (CVE-2016-6288)
- - (Stack-based buffer overflow vulnerability in virtual_file_ex). (CVE-2016-6289)
- - (Use After Free in unserialize() with Unexpected Session Deserialization). (CVE-2016-6290)
- - (HTTP_PROXY is improperly trusted by some PHP libraries and applications). (CVE-2016-5385)
-
-- BZip2:
-
- - (Inadequate error handling in bzread()). (CVE-2016-5399)
-
-- EXIF:
-
- - (Out of bound read in exif_process_IFD_in_MAKERNOTE). (CVE-2016-6291)
- - (NULL Pointer Dereference in exif_process_user_comment). (CVE-2016-6292)
-
-- GD:
-
- - (gdImageTrueColorToPaletteBody allows arbitrary write/read access).
- - (imagegif/output out-of-bounds access).
- - (Integer overflow error within _gdContributionsAlloc()). (CVE-2016-6207)
-
-- Intl:
-
- - (locale_accept_from_http out-of-bounds access). (CVE-2016-6294)
-
-- ODBC:
-
- - (PHP segfaults when accessing nvarchar(max) defined columns). (CVE-2015-8879)
-
-- SNMP:
-
- - (Use After Free Vulnerability in SNMP with GC and unserialize()). (CVE-2016-6295)
-
-- Xmlrpc:
-
- - (heap-buffer-overflow (write) simplestring_addn simplestring.c). (CVE-2016-6296)
-
-- Zip:
-
- - (Stack-based buffer overflow vulnerability in php_stream_zip_opener). (CVE-2016-6297)
-
-
-
-
-
-Version 5.5.37
-
-- Core:
-
- - (Integer Overflow in nl2br()).
- - (Integer Overflow in json_encode()/json_decode()/ json_utf8_to_utf16()).
- - (Integer Overflow in addcslashes/addslashes).
- - (Integer Overflow in Length of String-typed ZVAL).
-
-- GD:
-
- - (Stack overflow with imagefilltoborder). (CVE-2015-8874)
- - (pass2_no_dither out-of-bounds access).
- - (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (CVE-2016-5766)
- - (NULL Pointer Dereference at _gdScaleVert).
- - (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (CVE-2016-5767)
-
-- mbstring:
-
- - (_php_mb_regex_ereg_replace_exec - double free). (CVE-2016-5768)
-
-- mcrypt:
-
- - (Heap Overflow due to integer overflows). (CVE-2016-5769)
-
-- SPL:
-
- - (int/size_t confusion in SplFileObject::fread). (CVE-2016-5770)
- - (Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5771)
-
-- WDDX:
-
- - (Double Free Courruption in wddx_deserialize). (CVE-2016-5772)
-
-- zip:
-
- - (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5773)
-
-
-
-
-
-Version 5.5.36
-
-- Core:
-
- - (Integer underflow / arbitrary null write in fread/gzread). (CVE-2016-5096)
- - (Integer Overflow in php_html_entities). (CVE-2016-5094)
-
-- GD:
-
- - (imagescale out-of-bounds read). (CVE-2013-7456)
-
-- Intl:
-
- - (get_icu_value_internal out-of-bounds read). (CVE-2016-5093)
-
-- Phar:
-
- - (Uninitialized pointer in phar_make_dirstream()). (CVE-2016-4343)
-
-
-
-
-
-Version 5.5.35
-
-- BCMath:
-
- - (bcpowmod accepts negative scale and corrupts _one_ definition). (CVE-2016-4537, CVE-2016-4538)
-
-- Exif:
-
- - (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
-
-- GD:
-
- - (libgd: signedness vulnerability). (CVE-2016-3074)
-
-- Intl:
-
- - (Out-of-bounds reads in zif_grapheme_stripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
-
-- XML:
-
- - (xml_parse_into_struct segmentation fault). (CVE-2016-4539)
-
-
-
-
-
-Version 5.5.34
-
-- Fileinfo:
-
- - (Buffer over-write in finfo_open with malformed magic file). (CVE-2015-8865)
-
-- Mbstring:
-
- - (AddressSanitizer: negative-size-param (-1) in mbfl_strcut). (CVE-2016-4073)
-
-- ODBC:
-
- - (Invalid memory write in phar on filename with \0 in name). (CVE-2016-4072)
-
-- SNMP:
-
- - (php_snmp_error() Format String Vulnerability). (CVE-2016-4071)
-
-- Standard:
-
- - (Integer Overflow in php_raw_url_encode). (CVE-2016-4070)
-
-
-
-
-
-Version 5.5.33
-
-- Phar:
-
- - (Out-of-Bound Read in phar_parse_zipfile()).
-
-- WDDX:
-
- - (Use-After-Free / Double-Free in WDDX Deserialize).
-
-
-
-
-
-Version 5.5.32
-
-- Core:
-
- - (exec functions ignore length but look for NULL termination).
- - (Output of stream_get_meta_data can be falsified by its input).
- - (Integer overflow in iptcembed()).
-
-- GD:
-
- - Improved fix for bug .
-
-- PCRE:
-
- - Upgraded bundled PCRE library to 8.38. (CVE-2015-8383, CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)
-
-- Phar:
-
- - (Heap corruption in tar/zip/phar parser). (CVE-2016-4342)
- - (NULL Pointer Dereference in phar_tar_setupmetadata()).
- - (Stack overflow when decompressing tar archives). (CVE-2016-2554)
-
-- WDDX:
-
- - (Type Confusion in WDDX Packet Deserialization).
-
-
-
-
-
-Version 5.5.31
-
-- FPM:
-
- - (fpm_log.c memory leak and buffer overflow). (CVE-2016-5114)
-
-- GD:
-
- - (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds). (CVE-2016-1903)
-
-- WDDX:
-
- - (Use After Free Vulnerability in WDDX Packet Deserialization).
- - (Session WDDX Packet Deserialization Type Confusion Vulnerability).
-
-- XMLRPC:
-
- - (Type Confusion Vulnerability in PHP_to_XMLRPC_worker()).
-
-
-
-
-
-Version 5.5.30
-
-- Phar:
-
- - (Null pointer dereference in phar_get_fp_offset()). (CVE-2015-7803)
- - (Uninitialized pointer in phar_make_dirstream when zip entry filename is "/"). (CVE-2015-7804)
-
-
-
-
-
-Version 5.5.29
-
-- Core:
-
- - (Use After Free Vulnerability in unserialize()). (CVE-2015-6834)
- - (Use after free vulnerability in session deserializer). (CVE-2015-6835)
-
-- EXIF:
-
- - (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).
-
-- hash:
-
- - (HAVAL gives wrong hashes in specific cases).
-
-- PCRE:
-
- - (Multiple vulnerabilities related to PCRE functions).
-
-- SOAP:
-
- - (SOAP serialize_function_call() type confusion / RCE). (CVE-2015-6836)
-
-- SPL:
-
- - (Use-after-free vulnerability in unserialize() with SplObjectStorage). (CVE-2015-6834)
- - (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList). (CVE-2015-6834)
-
-- XSLT:
-
- - (NULL pointer dereference). (CVE-2015-6837, CVE-2015-6838)
-
-- ZIP:
-
- - (ZipArchive::extractTo allows for directory traversal when creating directories). (CVE-2014-9767)
-
-
-
-
-
-Version 5.5.28
-
-- Core:
-
- - (Remotely triggerable stack exhaustion via recursive method calls).
- - (Different arrays compare indentical due to integer key truncation).
- - (TS issues with temporary dir handling).
- - (unserialize() could lead to unexpected methods execution / NULL pointer deref).
-
-- OpenSSL:
-
- - (openssl_random_pseudo_bytes() is not cryptographically secure). (CVE-2015-8867)
-
-- Phar:
-
- - Improved fix for bug .
- - (Files extracted from archive may be placed outside of destination directory). (CVE-2015-6833)
-
-- SOAP:
-
- - (SoapClient info leak / null pointer dereference via multiple type confusions).
-
-- SPL:
-
- - (Dangling pointer in the unserialization of ArrayObject items). (CVE-2015-6832)
- - (Use After Free Vulnerability in unserialize() with SPLArrayObject). (CVE-2015-6831)
- - (Use After Free Vulnerability in unserialize() with SplObjectStorage). (CVE-2015-6831)
- - (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList). (CVE-2015-6831)
-
-
-
-
-
-Version 5.5.27
-
-- Core:
-
- - (escapeshell*() doesn't cater to !).
- - (Use __builtin_clzl on PowerPC).
- - (can induce segmentation fault with basic php code).
- - (Windows 10 reported as Windows 8).
- - (parse_ini_file() and parse_ini_string() segmentation fault).
- - (phpinfo() reports Professional Editions of Windows 7/8/8.1/10 as "Business").
- - (phpinfo() does not report many Windows SKUs).
- - (Different arrays compare indentical due to integer key truncation).
- - (Can't set empty additional_headers for mail()), regression from fix to bug .
-
-- GD:
-
- - (imagegammacorrect function loses alpha channel).
-
-- Mysqlnd:
-
- - (mysqlnd is vulnerable to BACKRONYM). (CVE-2015-3152)
-
-- PCRE:
-
- - (preg_replace: * qualifier on unicode replace garbles the string).
- - (Segfault in preg_replace_callback).
-
-- PDO_pgsql:
-
- - (PDOStatement::execute() leaks memory with DML Statements when closeCuror() is u).
- - (PDO-pgsql fails to connect if password contains a leading single quote).
- - (PDO PgSQL Incorrect binding numeric array with gaps).
-
-- Phar:
-
- - (Segfault in Phar::convertToData on invalid file). (CVE-2015-5589)
- - (Buffer overflow and stack smashing error in phar_fix_filepath). (CVE-2015-5590)
-
-- SimpleXML:
-
- - Refactored the fix for bug (simplexml_load_string() mangles empty node name).
-
-- SPL:
-
- - (Segfault when SplMinHeap::compare produces fatal error).
- - (SplFileObject setMaxLineLength).
-
-
-
-
-
-Version 5.5.26
-
-- Core:
-
- - (Conditional jump or move depends on uninitialised value in extension trait).
- - (temp. directory is cached during multiple requests).
- - (complex GLOB_BRACE fails on Windows).
- - (OS command injection vulnerability in escapeshellarg). (CVE-2015-4642)
- - (Incorrect handling of paths with NULs). (CVE-2015-4598)
-
-- FTP:
-
- - Improved fix for bug (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4643)
-
-- GD:
-
- - (GD fails to build with newer libvpx).
-
-- Iconv:
-
- - (iconv with //IGNORE cuts the string).
-
-- Litespeed SAPI:
-
- - (Unchecked return value).
-
-- Mail:
-
- - (mail() does not have mail header injection prevention for additional headers).
-
-- MCrypt:
-
- - Added file descriptor caching to mcrypt_create_iv().
-
-- Opcache:
-
- - (Memory leak with opcache.optimization_level=0xFFFFFFFF).
-
-- PCRE:
-
- - Upgraded pcrelib to 8.37. (CVE-2015-2325, CVE-2015-2326)
-
-- Phar:
-
- - (phar symlink in binary directory broken).
-
-- Postgres:
-
- - (segfault in php_pgsql_meta_data). (CVE-2015-4644)
-
-- Sqlite3:
-
- - Upgrade bundled sqlite to 3.8.10.2. (CVE-2015-3414, CVE-2015-3415,
- CVE-2015-3416)
-
-
-
-
-
-Version 5.5.25
-
-- Core:
-
- - (PHP Multipart/form-data remote dos Vulnerability). (CVE-2015-4024)
- - (str_repeat() sign mismatch based memory corruption).
- - (CVE-2006-7243 fix regressions in 5.4+). (CVE-2015-4025)
- - (heap buffer overflow in unpack()).
- - (Wrong checked for the interface by using Trait).
- - (Invalid read in zend_std_get_method).
- - ("use statement [...] has no effect" depends on leading backslash).
- - (Segmentation fault in gc_remove_zval_from_buffer).
- - (segmentation fault in destructor).
- - (Returning compatible sub generator produces a warning).
- - (php_sys_readlink ignores misc errors from GetFinalPathNameByHandleA).
-
-- FTP:
-
- - (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4022)
-
-- ODBC:
-
- - (Incorrect use of SQLColAttributes with ODBC 3.0).
- - (ODBC: Query with same field name from two tables returns incorrect result).
- - (out of memory with sage odbc driver).
-
-- OpenSSL:
-
- - (Reading empty SSL stream hangs until timeout).
-
-- PCNTL:
-
- - (pcntl_exec() should not allow null char). (CVE-2015-4026)
-
-- Phar:
-
- - (Memory Corruption in phar_parse_tarfile when entry filename starts with null). (CVE-2015-4021)
-
-
-
-
-
-Version 5.5.24
-
-- Apache2handler:
-
- - (potential remote code execution with apache 2.4 apache2handler). (CVE-2015-3330)
-
-- Core:
-
- - (php crashes with __get() and ++ operator in some cases).
- - (User exceptions not properly handled in streams).
- - (get_browser() browser_name_regex returns non-utf-8 characters).
- - (parse_url fails on some partial urls).
- - (Per Directory Values overrides PHP_INI_SYSTEM configuration options).
- - Additional fix for bug (Type confusion vulnerability in exception::getTraceAsString).
- - (Leaking VIA_HANDLER func when exception thrown in __call/... arg passing).
- - (Segmentation fault when using a generator in combination with an Iterator).
- - (php_stream_url_wrap_http_ex() type-confusion vulnerability).
- - (Missing null byte checks for paths in various PHP extensions). (CVE-2015-3411, CVE-2015-3412)
-
-- cURL:
-
- - (HTTP2 support).
- - (Missing break / control flow).
- - (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER).
-
-- Date:
-
- - Export date_get_immutable_ce so that it can be used by extensions.
- - (Issues with "last day of <monthname>").
-
-- Enchant:
-
- - (Enchant broker plugins are in the wrong place in windows builds).
-
-- Ereg:
-
- - (NULL Pointer Dereference).
-
-- Fileinfo:
-
- - (Fileinfo on specific file causes spurious OOM and/or segfault). (CVE-2015-4604, CVE-2015-4605)
-
-- Filter:
-
- - (FILTER_FLAG_STRIP_BACKTICK ignored unless other flags are used).
- - (FILTER_FLAG_STRIP_HIGH doesn't strip ASCII 127).
-
-- Mbstring:
-
- - (False detection of CJK Unified Ideographs Extension E).
-
-- ODBC:
-
- - (Incorrect use of SQLColAttributes with ODBC 3.0).
-
-- OPCache:
-
- - (opcache_is_script_cached no longer works).
- - (Use After Free). (CVE-2015-1351)
-
-- OpenSSL:
-
- - (Add signatureType to openssl_x509_parse).
- - Add a check for RAND_egd to allow compiling against LibreSSL.
-
-- Phar:
-
- - (PharData::extractTo fails for tarball created by BSD tar).
- - (phar_add_file is too restrictive on filename).
- - (Call to undefined method cli_arg_typ_string).
- - (Phar::mapPhar fails for Phars inside a path containing ".tar").
- - (Buffer Over-read in unserialize when parsing Phar). (CVE-2015-2783, CVE-2015-3307)
- - (Buffer Overflow when parsing tar/zip/phar in phar_set_inode). (CVE-2015-3329)
-
-- Postgres:
-
- - (Null pointer dereference). (CVE-2015-1352)
-
-- SOAP:
-
- - (Type Confusion Infoleak Vulnerability in unserialize() with SoapFault). (CVE-2015-4599)
- - (NEW segfault when using SoapClient::__setSoapHeader (bisected, regression)).
-
-- SPL:
-
- - (Use after free in zval_scan caused by spl_object_storage_get_gc).
-
-- SQLITE:
-
- - (SQLITE segfaults if custom collator throws an exception).
- - (Upgrade bundled sqlite to 3.8.8.3).
- - (SQLite prepared statement use-after-free).
-
-
-
-
-
-
-Version 5.5.23
-
-- Core:
-
- - (leaks when unused inner class use traits precedence).
- - (Crash in gc_zval_possible_root on unserialize).
- - (Segfault in get_current_user when script owner is not in passwd with ZTS build).
- - (Segfault when calling ob_start from output buffering callback).
- - (Fail to push to the empty array with the constant value defined in class scope).
- - (pointer returned by php_stream_fopen_temporary_file not validated in memory.c).
- - (Exception with invalid character causes segv).
- - (Missing arguments in reflection info for some builtin functions).
- - (Use After Free Vulnerability in unserialize()). (CVE-2015-2787)
- - (Per Directory Values overrides PHP_INI_SYSTEM configuration options).
- - (move_uploaded_file allows nulls in path). (CVE-2015-2348)
-
-- CGI:
-
- - (php-cgi's getopt does not see $argv).
-
-- CLI:
-
- - (auto_prepend_file messes up __LINE__).
-
-- cURL:
-
- - (PHP_MINIT_FUNCTION does not fully initialize cURL on Win32).
- - Add CURLPROXY_SOCKS4A and CURLPROXY_SOCKS5_HOSTNAME constants if supported by libcurl.
-
-- Ereg:
-
- - (heap overflow vulnerability in regcomp.c). (CVE-2015-2305)
-
-- FPM:
-
- - (request time is reset too early).
-
-- JSON :
-
- - (JSON_NUMERIC_CHECK has issues with strings that are
- numbers plus the letter e).
-
-- ODBC:
-
- - (Allowed memory size exhausted with odbc_exec).
-
-- Opcache:
-
- - (Array numeric string as key).
- - (switch(SOMECONSTANT) misbehaves).
-
-- OpenSSL:
-
- - , , , (encrypted streams don't observe socket timeouts).
-
-- pgsql:
-
- - (pg_update() fails to store infinite values).
-
-- Readline:
-
- - (Null dereference in readline_(read|write)_history() without parameters).
-
-- SOAP:
-
- - (SoapClient's __call() type confusion through unserialize()). (CVE-2015-4147, CVE-2015-4148)
-
-- SPL:
-
- - ("Segmentation fault" when (de)serializing SplObjectStorage).
- - (RecursiveDirectoryIterator::seek(0) broken after calling getChildren()).
-
-- ZIP:
-
- - (ZIP Integer Overflow leads to writing past heap boundary). (CVE-2015-2331)
-
-
-
-
-
-Version 5.5.22
-
-- Core:
-
- - (getClosure returns somethings that's not a closure).
- - (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow).
- - (Use after free vulnerability in unserialize() with DateTimeZone). (CVE-2015-0273)
- - Added NULL byte protection to exec, system and passthru.
- - Removed support for multi-line headers, as they are deprecated by RFC 7230.
-
-- Date:
-
- - (strtotime incorrectly interprets SGT time zone).
-
-- Dba:
-
- - (useless comparisons).
-
-- Enchant:
-
- - (heap buffer overflow in enchant_broker_request_dict()). (CVE-2014-9705)
-
-- Fileinfo:
-
- - (Double free with disabled ZMM).
-
-- FPM:
-
- - (Wrong response to FCGI_GET_VALUES).
- - (core dump when webserver close the socket).
-
-- Libxml:
-
- - (libxml_disable_entity_loader setting is shared between threads). (CVE-2015-8866)
-
-- PDO_mysql:
-
- - (PDOMysql with mysqlnd does not allow the usage of named pipes).
-
-- Phar:
-
- - (use after free). (CVE-2015-2301)
-
-- Pgsql:
-
- - (pg_copy_from() modifies input array variable).
-
-- Sqlite3:
-
- - (SQLite3Result::fetchArray declares wrong required_num_args).
-
-- Mysqli:
-
- - (linker error on some OS X machines with fixed width decimal support).
- - (Reading 4 byte floats with Mysqli and libmysqlclient has rounding errors).
-
-- Session:
-
- - (mod_files.sh is a bash-script).
- - (no EINTR check on flock).
- - (Empty session IDs do still start sessions).
-
-- Standard:
-
- - (flock() out parameter not set correctly in windows).
- - (Request may get env. variables from previous requests if PHP works as FastCGI).
-
-- Streams:
-
- - Fixed bug which caused call after final close on streams filter.
-
-
-
-
-
-Version 5.5.21
-
-- Core:
-
- - Upgraded crypt_blowfish to version 1.3.
- - (unlink() bug with some files path).
- - (Inside trait, self::class != __CLASS__).
- - (Constructor from trait conflicts with inherited constructor).
- - (errors spawn MessageBox, which blocks test automation).
- - (Application Popup provides too few information).
- - (localeconv() broken in TS builds).
- - (setting locale randomly broken).
- - (configure doesn't define EXPANDED_DATADIR / PHP_DATADIR correctly).
- - (Crash in timeout thread).
- - (Explicit Double Free). (CVE-2014-9425)
- - (Use After Free Vulnerability in PHP's unserialize()). (CVE-2015-0231)
-
-- CGI:
-
- - (out of bounds read crashes php-cgi). (CVE-2014-9427)
-
-- CLI server:
-
- - (Invalid HTTP requests make web server segfault).
-
-- cURL:
-
- - (curl_multi_getcontent returns '' when CURLOPT_RETURNTRANSFER isn't set).
-
-- EXIF:
-
- - (Free called on uninitialized pointer). (CVE-2015-0232)
-
-- Fileinfo:
-
- - (incorrect expression in libmagic).
- - (fileinfo out-of-bounds memory access). (CVE-2014-9652)
- - Removed readelf.c and related code from libmagic sources.
-
-- FPM:
-
- - (listen.allowed_clients is broken).
-
-- GD:
-
- - (buffer read overflow in gd_gif_in.c). (CVE-2014-9709)
-
-- Mbstring:
-
- - (--with-libmbfl configure option not present on Windows).
-
-- Mcrypt:
-
- - Fixed possible read after end of buffer and use after free.
-
-- Opcache:
-
- - (Memory leak when using "continue 2" inside two foreach loops).
-
-- OpenSSL:
-
- - (use case-insensitive cert name matching).
-
-- Pcntl:
-
- - (pcntl_signal doesn't decrease ref-count of old handler
- when setting SIG_DFL).
-
-- PCRE:
-
- - (Alignment Bug in PCRE 8.34 upstream).
-
-- pgsql:
-
- - (lo_export return -1 on failure).
-
-- PDO:
-
- - (PDO#getAttribute() cannot be called with platform-specific
- attribute names).
-
-- PDO_mysql:
-
- - (Add new PDO mysql connection attr to control multi
- statements option).
-
-- SPL:
-
- - (RecursiveDirectoryIterator::CURRENT_AS_PATHNAME
- breaks the RecursiveIterator).
- - (cannot cast SplFileInfo to boolean).
- - (Added escape parameter to SplFileObject::fputcsv).
-
-- SQLite:
-
- - (Update bundled libsqlite to 3.8.7.2).
-
-- Streams:
-
- - (convert.base64-encode omits padding bytes).
-
-
-
-
-
-
-Version 5.5.20
-
-- Core:
-
- - (Some Zend headers lack appropriate extern "C" blocks).
- - ("Inconsistent insteadof definition."- incorrectly triggered).
- - ("unset($this)" can make the program crash).
- - (NULL pointer dereference in unserialize.c).
- - (Use after free vulnerability in unserialize()). (CVE-2014-8142)
-
-- Date:
-
- - Fixed day_of_week function as it could sometimes return negative values internally.
-
-- FPM:
-
- - (fpm_unix_init_main ignores log_level).
- - (listen=9000 listens to ipv6 localhost instead of all addresses).
- - (access.format='%R' doesn't log ipv6 address).
- - (PHP-FPM will no longer load all pools).
- - (listen.allowed_clients is IPv4 only).
- - (php-fpm man page is oudated).
- - (Change pm.start_servers default warning to notice).
- - (listen.allowed_clients can silently result in no allowed access).
- - (php-fpm conf files loading order).
- - (access.log don't use prefix).
-
-- Mcrypt:
-
- - Fixed possible read after end of buffer and use after free.
-
-- PDO_pgsql:
-
- - (Segmentation fault on statement deallocation).
- - (PDO_PGSQL::beginTransaction() wrongly throws exception
- when not in transaction).
- - (PDO::PARAM_BOOL and ATTR_EMULATE_PREPARES misbehaving).
-
-- SOAP:
-
- - (Segmentation fault on SoapClient::__getTypes).
-
-- zlib:
-
- - (Compiling PHP with large file support will replace
- function gzopen by gzopen64).
-
-
-
-
-
-Version 5.5.19
-
-- Core:
-
- - (AddressSanitizer reports a heap buffer overflow in
- php_getopt()).
- - ($a->foo .= 'test'; can leave $a->foo undefined).
- - (parse_url() - incomplete support for empty usernames
- and passwords).
- - (zend_mm_heap corrupted after memory overflow in
- zend_hash_copy).
-
-- cURL:
-
- - Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and
- CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl.
-
-- Fileinfo:
-
- - (libmagic: don't assume char is signed).
- - (fileinfo: out-of-bounds read in elf note headers).
- (CVE-2014-3710)
-
-- FPM:
-
- - (listen and listen.allowed_clients should take IPv6
- addresses.
-
-- GD:
-
- - imagescale() fails without height param
-
-- GMP:
-
- - (GMP memory management conflicts with other libraries
- using GMP).
-
-- Mysqli:
-
- - (linker error on some OS X machines with fixed width
- decimal support).
-
-- ODBC:
-
- - (ODBC not correctly reading DATE column when preceded by
- a VARCHAR column)
-
-- SPL:
-
- - (Regression in RecursiveRegexIterator)
-
-
-
-
-
-Version 5.5.18
-
-- Core:
-
- - (Incorrect last used array index copied to new array after
- unset).
- - (Windows 8.1/Server 2012 R2 OS build number reported
- as 6.2 (instead of 6.3)).
- - (A foreach on an array returned from a function not doing
- copy-on-write).
- - (proc_open on Windows hangs forever).
- - (Integer overflow in unserialize() (32-bits only)).
- (CVE-2014-3669)
-
-- cURL:
-
- - (NULL byte injection - cURL lib).
-
-- Exif:
-
- - (Heap corruption in exif_thumbnail()). (CVE-2014-3670)
-
-- FPM:
-
- - (PHP-FPM incorrectly defines the SCRIPT_NAME variable
- when using Apache, mod_proxy-fcgi and ProxyPass).
-
-- OpenSSL:
-
- - Revert regression introduced by fix of bug .
-
-- Reflection:
-
- - (Duplicate entry in Reflection for class alias).
-
-- Session:
-
- - (SessionHandler Invalid memory read create_sid()).
-
-- XMLRPC:
-
- - (Global buffer overflow in mkgmtime() function).
- (CVE-2014-3668)
-
-
-
-
-
-Version 5.5.17
-
-- Core:
-
- - (glob returns error, should be empty array()).
- - (SIGSEGV during zend_shutdown()).
- - (Crash on SIGTERM in apache process).
- - (program_prefix not honoured in man pages).
-
-- COM:
-
- - (DOTNET is successful once per server run).
-
-- Date:
-
- - (memory leaks in DateTime constructor).
- - (Some timezones are no longer valid in PHP 5.5.10).
- - (First uppercase letter breaks date string parsing).
-
-- FPM:
-
- - (FPM with mod_fastcgi/apache2.4 is broken).
-
-- GD:
-
- - Made fontFetch's path parser thread-safe.
-
-- MySQLi:
-
- - (mysqli does not handle 4-byte floats correctly).
-
-- OpenSSL:
-
- - (socket timeouts not honored in blocking SSL reads).
- - (extension won't build if openssl compiled without SSLv3).
-
-- SPL:
-
- - (CachingIterator::__construct InvalidArgumentException
- wrong message).
-
-- Zlib:
-
- - (chained zlib filters silently fail with large amounts of
- data).
- - (internal corruption phar error).
-
-
-
-
-
-Version 5.5.16
-
-- COM:
-
- - Fixed missing type checks in com_event_sink.
-
-- Core:
-
- - (incorrect push to the empty array).
-
-- Fileinfo:
-
- - (extensive backtracking in rule regular expression). (CVE-2014-3538)
- - (Segfault in cdf.c). (CVE-2014-3587).
-
-- FPM:
-
- - (php links to systemd libraries without using pkg-config).
-
-- GD:
-
- - (php-gd 'c_color' NULL pointer dereference). (CVE-2014-2497)
- - (Null byte injection possible with imagexxx functions).
- (CVE-2014-5120).
-
-- Milter:
-
- - (php-milter does not build and crashes randomly).
-
-- Network:
-
- - (segfault in dns_get_record). (CVE-2014-3597).
-
-- OpenSSL:
-
- - Fixed missing type checks in OpenSSL options.
-
-- readline:
-
- - (Interactive mode doesn't force a newline before the
- prompt).
- - (Save command history when exiting interactive shell
- with control-c).
-
-- Sessions:
-
- - Fixed missing type checks in php_session_create_id.
-
-- ODBC:
-
- - (odbc_fetch_into returns junk data at end of multi-byte
- char fields).
-
-
-
-
-
-Version 5.5.15
-
-- CLI server:
-
- - (CLI server is missing some new HTTP response codes).
- - (Empty header causes PHP built-in web server to hang).
-
-- Core:
-
- - (header('Location: foo') will override a 308-399 response
- code).
- - (Autoloader isn't called if two method definitions don't
- match).
- - (make install fails to install libphp5.so on FreeBSD 10.0).
- - eval with parse error causes segmentation fault in
- generator).
- - (strtr with empty array crashes).
- - (Windows 8.1/Server 2012 R2 reported as Windows 8/Server
- 2012).
-
-- FPM:
-
- - (error_log=syslog ignored).
- - (syslog cannot be set in pool configuratio).
-
-- Intl:
-
- - (Wrong argument type hint for function
- intltz_from_date_time_zone).
- - (NumberFormatter::parse() resets LC_NUMERIC setting).
-
-- OPCache:
-
- - (php-cgi work with opcache, may be segmentation fault
- happen).
-
-- pgsql:
-
- - (Error in code "form" instead of "from", pgsql.c, line 756),
- which affected builds against libpq < 7.3).
-
-- Phar:
-
- - (Redirection loop on nginx with FPM).
-
-- SPL:
-
- - (ArrayIterator use-after-free due to object change during
- sorting). (CVE-2014-4698)
- - (SPL Iterators use-after-free) (CVE-2014-4670).
-
-- Streams:
-
- - (http:// wrapper doesn't follow 308 redirects).
-
-
-
-
-Version 5.5.14
-
-- CLI server:
-
- - (built-in web-server segfaults on startup).
-
-- Core:
-
- - (Closures do not correctly capture the late bound class
- (static::) in some cases).
- - (insecure temporary file use in the configure script).
- (CVE-2014-3981).
- - (putenv with empty variable may lead to crash).
- - (phpinfo() Type Confusion Information Leak Vulnerability). (CVE-2014-4721)
- - Fixed BC break introduced by patch for bug .
-
-- Date:
-
- - (Serialize of DateTime truncates fractions of second).
- - Fixed regression in fix for bug (constructor can't be called twice).
-
-- Fileinfo:
-
- - (cdf_read_short_sector insufficient boundary check).
- (CVE-2014-0207)).
- - (mconvert incorrect handling of truncated pascal
- string size). (CVE-2014-3478).
- - (cdf_check_stream_offset insufficient boundary
- check). (CVE-2014-3479).
- - (cdf_count_chain insufficient boundary check).
- (CVE-2014-3480).
- - (cdf_read_property_info insufficient boundary
- check). (CVE-2014-3487).
-
-- Intl:
-
- - (Locale::parseLocale Double Free).
- - (Buffer overflow in locale_get_display_name and
- uloc_getDisplayName (libicu 4.8.1)).
-
-- Network:
-
- - (Fix potential segfault in dns_get_record()).
- (CVE-2014-4049)).
-
-- OPCache:
-
- - (TMP_VAR is not only used once).
-
-- OpenSSL:
-
- - (certificates validity parsing does not work past 2050).
- - (openssl_x509_parse warning with V_ASN1_GENERALIZEDTIME).
-
-- PDO-ODBC:
-
- - (PDO-ODBC changes for 64-bit).
-
-- SOAP:
-
- - (Add SoapClient::__getCookies()).
-
-- SPL:
-
- - (Segmentation fault with ArrayObject unset).
- - (Segfault in recursiveDirectoryIterator).
- - (Missing element after ArrayObject::getIterator).
- - (unserialize() SPL ArrayObject / SPLObjectStorage Type
- Confusion). (CVE-2014-3515).
-
-
-
-
-
-Version 5.5.13
-
-- CLI server:
-
- - (Missing MIME types for XML/XSL files).
-
-- COM:
-
- - (Special Character via COM Interface (CP_UTF8)).
-
-- Core:
-
- - (copy() doesn't work when destination filename is created
- by tempnam()).
- - (Echoing unserialized "SplFileObject" crash).
- - (usage of memcpy() with overlapping src and dst in
- zend_exceptions.c).
- - (spl_fixedarray_resize integer overflow).
- - (printf out-of-bounds read).
- - (iptcparse out-of-bounds read).
-
-- cURL:
-
- - (CURLOPT_INFILE doesn't allow reset).
-
-- Date:
-
- - (DateTime constructor crash with invalid data).
- - (date_parse_from_format out-of-bounds read).
- - (timelib_meridian_with_check out-of-bounds read).
-
-- DOM:
-
- - (DOMDocumentType->internalSubset returns entire DOCTYPE tag,
- not only the subset).
-
-- Fileinfo:
-
- - (Fileinfo crashes with powerpoint files).
- - (CDF infinite loop in nelements DoS) (CVE-2014-0238).
- - (numerous file_printf calls resulting in
- performance degradation) (CVE-2014-0237).
-
-- FPM:
-
- - (php-fpm reload leaks epoll_create() file descriptor).
-
-- GD:
-
- - (imageaffinematrixget missing check of parameters).
-
-- PCRE:
-
- - Ungreedy and min/max quantifier bug, applied patch
- from the upstream.
-
-- Phar:
-
- - ($phar->buildFromDirectory can't compress file with an accent
- in its name).
-
-
-
-
-
-Version 5.5.12
-
-- Core:
-
- - (Out of memory on command stream_get_contents).
- - (stream_socket_server() creates wrong Abstract Namespace
- UNIX sockets).
- - (exit in stream filter produces segfault).
- - (fpassthru broken).
- - (getimagesize should recognize BMP files with negative
- heighty).
- - (substr_compare broke by previous change).
-
-- cURL:
-
- - (curl_exec returns differently than curl_multi_getcontent).
-
-- Date:
-
- - (__wakeup of DateTime segfaults when invalid object data is
- supplied).
-
-- Embed:
-
- - (php5embed.lib isn't provided anymore).
-
-- Fileinfo:
-
- - (Memory corruption in fileinfo ext / bigendian).
-
-- FPM:
-
- - (unknown entry 'priority' in php-fpm.conf).
- - (possible privilege escalation due to insecure default configuration). (CVE-2014-0185)).
-
-- Json:
-
- - (Blank line inside empty array/object when
- JSON_PRETTY_PRINT is set).
-
-- LDAP:
-
- - Fixed issue with null bytes in LDAP bindings.
-
-- mysqli:
-
- - Fixed problem in mysqli_commit()/mysqli_rollback() with second parameter
- (extra comma) and third parameters (lack of escaping).
-
-- Openssl:
-
- - (memory leak in openssl_seal()).
- - (memory leak in openssl_open()).
-
-- SimpleXML:
-
- - (simplexml_load_string() mangles empty node name).
-
-- SQLite:
-
- - (Updated bundled libsqlite to 3.8.4.3)
-
-- XSL:
-
- - (<xsl:include> cannot find files with relative paths
- when loaded with "file://")
-
-- Apache2 Handler SAPI:
-
- - Fixed Apache log issue caused by APR's lack of support for %zu
- (APR issue https://issues.apache.org/bugzilla/show_bug.cgi?id=56120)
-
-
-
-
-
-Version 5.5.11
-
-- Core:
-
- - (proc_open() changes environment array).
- - Allow zero length comparison in substr_compare().
-
-- cURL:
-
- - (Can't reset CURLOPT_CUSTOMREQUEST to default behaviour).
- - Fix compilation on libcurl versions between 7.10.5 and 7.12.2, inclusive.
-
-- Fileinfo:
-
- - (fileinfo: extensive backtracking in awk rule regular expression). (CVE-2013-7345)
-
-- FPM:
-
- - Added clear_env configuration directive to disable clearenv() call.
-
-- GD:
-
- - (imageconvolution breakage).
- - (Invalid 2nd argument crashes imageaffinematrixget).
- - (imagescale - poor quality of scaled image).
- - (imagescale segfault).
- - (imagescale ignore method argument).
-
-- GMP:
-
- - (invalid argument crashes gmp_testbit).
-
-- Hash:
-
- - hash_pbkdf2() now works correctly if the $length argument is not specified.
-
-- Intl:
-
- - A reproductible crash in UConverter when given invalid encoding.
-
-- Mail:
-
- - (Don't add newline after X-PHP-Originating-Script).
-
-- MySQLi:
-
- - (Segfault in mysqli_stmt::bind_result() when link closed).
-
-- OPCache:
-
- - Added function opcache_is_script_cached().
- - Added information about interned strings usage.
-
-- Openssl:
-
- - (Default disgest algo is still MD5, switch to SHA1).
-
-- SQLite:
-
- - Updated bundled libsqlite to 3.8.3.1.
-
-- SPL:
-
- - Added feature (SplFileObject::fread()).
-
-
-
-
-
-Version 5.5.10
-
-- Core:
-
- - (Allow multiple paths in php_ini_scanned_path).
-
-- Date:
-
- - (Allow the DateTimeZone constructor to accept timezones
- per offset too).
- - (some time zone offsets not recognized by timezone_name_from_abbr)
- - (DateTime::setTimezone can not set timezones without ID)
-
-- Fileinfo:
-
- - (file: infinite recursion (CVE-2014-1943)).
- - (out-of-bounds memory access in fileinfo (CVE-2014-2270)).
-
-- GD:
-
- - (imagecrop(): insufficient fix for NULL defer (CVE-2013-7327)).
-
-- JSON:
-
- - (JsonSerializeable couldn't implement on module extension).
-
-- LDAP:
-
- - Implemented ldap_modify_batch (https://wiki.php.net/rfc/ldap_modify_batch).
-
-- Openssl:
-
- - (Add EC key support to php_openssl_is_private_key).
-
-- PCRE:
-
- - Upgraded to PCRE 8.34.
-
-- Pgsql:
-
- - Added warning for dangerous client encoding and remove possible injections
- for pg_insert()/pg_update()/pg_delete()/pg_select().
-
-
-
-
-
-Version 5.5.9
-
-- Core:
-
- - (copy() arginfo has changed starting from 5.4).
-
-- GD:
-
- - (Heap Overflow Vulnerability in imagecrop(), CVE-2013-7226).
-
-- OPCache:
-
- - (Optimizer bug in constant string to boolean conversion).
- - (PHP crashes if opcache.interned_strings_buffer=0).
- - (ext/opcache/Optimizer/zend_optimizer.c has dos-style ^M as lineend).
-
-- PDO_pgsql:
-
- - (PDO-pgsql cannot connect if password contains spaces).
-
-- Readline:
-
- - (readline_clear_history() with libedit causes segfault after ).
-
-- Session:
-
- - (Session module is sending multiple set-cookie headers when session.use_strict_mode=1).
- - (Segfaults on session_name()).
-
-- Standard:
-
- - (basename function doesn't remove drive letter).
-
-- Sockets:
-
- - (__ss_family was changed on AIX 5.3).
-
-- Zend Engine:
-
- - (Failed compilation of PHP extension with C++ std library using VS 2012).
-
-
-
-
-
-Version 5.5.8
-
-- Core:
-
- - Disallowed JMP into a finally block.
- - Added validation of class names in the autoload process.
- - Fixed invalid C code in zend_strtod.c.
- - (list() fails to unpack yielded ArrayAccess object).
- - (generators/throw_rethrow FAIL with ZEND_COMPILE_EXTENDED_INFO).
- - (fopen and O_NONBLOCK).
- - (zend_register_functions breaks reflection).
-
-- Date:
-
- - (Heap buffer over-read in DateInterval, CVE-2013-6712).
- - (DateTimeImmutable::diff does not work).
-
-- DOM:
-
- - (Passing DOMDocumentFragment to DOMDocument::saveHTML()
- Produces invalid Markup).
-
-- Exif:
-
- - (Integer overflow in exif_read_data()).
-
-- Filter:
-
- - (128.0.0.0/16 isn't reserved any longer).
-
-- GD:
-
- - (Use freetype-config for determining freetype2 dir(s)).
-
-- PDO_odbc:
-
- - (Stack smashing protection kills PDO/ODBC queries).
-
-- MySQLi:
-
- - (mysqli_poll() is broken on win x64).
-
-- OPCache:
-
- - Fixed revalidate_path=1 behavior to avoid caching of symlinks values.
- - ("opcache.enable_file_override" doesn't respect
- "opcache.revalidate_freq".)
-
-- SNMP:
-
- - Fixed SNMP_ERR_TOOBIG handling for bulk walk operations.
-
-- SOAP:
-
- - (Use after free condition in SOAP extension).
-
-- Sockets:
-
- - (ext/socket assumes AI_V4MAPPED is defined).
-
-- XSL:
-
- - (Segfault throwing an exception in a XSL registered function).
-
-- ZIP:
-
- - (ZipArchive::open() ze_obj->filename_len not real).
-
-
-
-
-
-Version 5.5.7
-
-- Core:
-
- - (unregister_tick_function tries to cast a Closure to a string).
- - (Chain assignment with T_LIST failure).
-
-- CLI server:
-
- - Added some MIME types to the CLI web server.
- - (getallheaders() is not supported by the built-in web
- server) - also implements apache_response_headers()
-
-- OPCache:
-
- - (Invalid constant substitution).
- - (Inconsistent results with require return value).
- - (Opcache: cache not cleared if changes occur while running).
-
-- readline:
-
- - (PHP cli forces the tty to cooked mode).
-
-- Openssl:
-
- - Fixed memory corruption in openssl_x509_parse() (CVE-2013-6420).
-
-
-
-
-
-Version 5.5.6
-
-- Core:
-
- - Improved performance of array_merge() and func_get_args() by eliminating useless copying.
- - (basename is no more working after fgetcsv in certain situation).
- - (Space before ";" breaks php.ini parsing).
- - (scope resolution operator - strange behavior with $this).
- - (dangling context pointer causes crash).
-
-- FPM:
-
- - Changed default listen() backlog to 65535.
-
-- JSON:
-
- - (json_decode handles whitespace incorrectly).
-
-- MySQLi:
-
- - (Segfault calling bind_param() on mysqli).
-
-- OPCache:
-
- - Increased limit for opcache.max_accelerated_files to 1,000,000.
- - (path issue when using phar).
- - (Phar mount points not working with OPcache enabled).
-
-- ODBC:
-
- - (Field name truncation if the field name is bigger than 32 characters).
-
-- PDO:
-
- - (Segmentation Fault when constructor of PDO statement throws an exception).
- - (sql_parser permanently converts values bound to strings).
-
-- Standard:
-
- - (var_export() does not use full precision for floating-point numbers).
-
-
-
-
-
-Version 5.5.5
-
-- Core:
-
- - (Wrong behavior of static variables in closure generators).
- - (compile time errors won't trigger auto loading).
- - (By-ref foreach on property access of string offset segfaults).
-
-- CLI Server:
-
- - (built-in server treat some http headers as case-sensitive).
- - (Segfault with built-in webserver and chunked transfer encoding).
- - Added application/pdf to PHP CLI Web Server mime types
-
-- Datetime:
-
- - (DateTime::createFromFormat() reports confusing error message).
- - (DateTimeImmutable::createFromFormat returns DateTime).
- - (Comparison for DateTimeImmutable doesn't work).
-
-- DBA:
-
- - (dba functions cast $key param to string in-place, bypassing copy on write).
-
-- Filter:
-
- - Add RFC 6598 IPs to reserved addresses.
- - (FILTER_VALIDATE_URL rejects fully qualified domain names).
-
-- FTP:
-
- - (ftp_nb_continue produces segfault).
-
-- GD:
-
- - Ensure that the defined interpolation method is used with the generic scaling methods.
-
-- IMAP:
-
- - (configure script broken in 5.5.4 and 5.4.20 when enabling imap).
-
-- OPCache:
-
- - (Error when Zend Opcache Optimizer is fully enabled).
- - (Exception not properly caught when opcache enabled).
- - (5.5.2 crashes in _get_zval_ptr_ptr_var).
- - (segfault in interned strings if initial memory is too low).
- - Added function opcache_compile_file() to load PHP scripts into cache without execution.
- - Added support for GNU Hurd.
-
-- Sockets:
-
- - (the socket_connect() won't work with IPv6 address).
-
-- SPL:
-
- - (SplFileObject constructor make $context optional / give it a default value).
-
-- Standard:
-
- - content-type must appear at the end of headers for 201 Location to work in http.
-
-- XMLReader:
-
- - Crash with clone XMLReader.
- - XMLReader does not suppress errors.
-
-- Build system:
-
- - Race condition in shtool's mkdir -p implementation.
- - 'make test' crashes starting with 5.3.14 (missing gzencode()).
-
-
-
-
-
-Version 5.5.4
-
-- Core:
-
- - (cli/apache sapi segfault on objects manipulation).
- - Improved fputcsv() to allow specifying escape character.
- - (quoted-printable encode stream filter incorrectly encoding spaces).
- - (Segmentation fault in zend_error() with --enable-dtrace).
- - (Duplicate calls to get lineno & filename for DTRACE_FUNCTION_*).
- - (PHP_BINARY incorrectly set).
- - (PHP fails to build with DTrace).
- - (class_alias() should accept classes with leading backslashes).
- - (Pointer aliasing issue results in miscompile on gcc4.4).
-
-- cURL:
-
-- Datetime:
-
- - (createFromFormat broken when weekday name is followed by some delimiters).
- - (stack-buffer-overflow in DateTimeZone stuff caught by AddressSanitizer).
-
-- OPCache:
-
- - (Zend Opcache on Solaris 11 x86 needs ZEND_MM_ALIGNMENT=4).
-
-- Openssl:
-
- - (openssl_x509_parse fails to parse subject properly in some cases).
-
-- Session:
-
- - (Session ID is not initialized properly when strict session is enabled).
- - and , FR // (Added php_serialize session serialize handler that uses plain serialize())
-
-- Standard:
-
- - Fix issue with return types of password API helper functions. Found via static analysis by cjones.
-
-
-
-
-
-Version 5.5.3
-
-- Openssl:
-
- - Fixed UMR in fix for CVE-2013-4248.
-
-
-
-
-
-Version 5.5.2
-
-- Core:
-
- - (Segfault in gc_zval_possible_root when return reference fails).
- - Fixed value of FILTER_SANITIZE_FULL_SPECIAL_CHARS constant (previously was erroneously set to FILTER_SANITIZE_SPECIAL_CHARS value).
- - (Use of max int in array_sum).
- - (get_defined_constants() causes PHP to crash in a very limited case).
- - (solaris sed has no -i switch).
- - (CGI mode - make install don't work).
- - (--enable-dtrace leads make to clobber Zend/zend_dtrace.d).
-
-- DOM:
-
- - Added flags option to DOMDocument::schemaValidate() and DOMDocument::schemaValidateSource(). Added LIBXML_SCHEMA_CREATE flag.
-
-- OPcache:
-
- - Added opcache.restrict_api configuration directive that may limit usage of OPcahce API functions only to patricular script(s).
- - Added support for glob symbols in blacklist entries (?, *, **).
- - (Enabling both php_opcache and php_wincache AVs on shutdown).
-
-- Openssl:
-
- - Fixed handling null bytes in subjectAltName (CVE-2013-4248).
-
-- PDO_mysql:
-
- - (pdo mysql parsing errors).
-
-- Phar:
-
- - (Phar::buildFromDirectory creates corrupt archives for some specific contents).
-
-- Pgsql:
-
- - (Disallow possible SQL injections with pg_select()/pg_update() /pg_delete()/pg_insert()).
- - (pg_escape_literal/identifier() silently returns false).
-
-- Sessions:
-
- - Implemented strict sessions RFC (https://wiki.php.net/rfc/strict_sessions) which protects against session fixation attacks and session collisions (CVE-2011-4718).
- - Fixed possible buffer overflow under Windows. Note: Not a security fix.
- - Changed session.auto_start to PHP_INI_PERDIR.
-
-- SOAP:
-
- - (SoapHeader problems with SoapServer).
-
-- SPL:
-
- - (Segfault when getting SplStack object Value).
- - Added RecursiveTreeIterator setPostfix and getPostifx methods.
- - (spl_autoload_functions returns lambda functions incorrectly).
-
-- Streams:
-
- - (select() implementation uses outdated tick API).
-
-
-
-
-
-Version 5.5.1
-
-- Core:
-
- - (Exception not catchable when exception thrown in autoload with a namespace).
- - (Generated configure script is malformed on OpenBSD).
- - (is_callable() triggers Fatal Error).
- - (yield / exit segfault).
- - (Generator + autoload + syntax error = segfault).
- - (chroot() does not get enabled).
- - hex2bin() raises E_WARNING for invalid hex string.
-
-- OPcache:
-
- - (Segfault in zval_mark_grey (zend_gc.c)).
- - OPcache is now compatible with LiteSpeed SAPI.
-
-- CGI:
-
- - (Missing php-cgi man page).
-
-- CLI server:
-
- - (Cli server not responsive when responding with 422 http status code).
-
-- DateTime:
-
- - (strftime() returns insufficient-length string under multibyte locales).
-
-- GD:
-
- - (bgcolor does not use the same format as the input image with imagerotate).
- - (imagecreatefrom... crashes with user streams).
- - (imagecreatefromjpeg fails with URL).
- - Fix gdImageCreateFromWebpCtx and use same logic to load WebP image that other formats.
-
-- Intl:
-
- - Add IntlCalendar::setMinimalDaysInFirstWeek()/intlcal_set_minimal_days_in_first_week().
- - Fixed trailing space in name of constant IntlCalendar::FIELD_FIELD_COUNT.
- - (Buggy grapheme_substr() on edge case).
- - (Offsets may be wrong for grapheme_stri* functions).
-
-- OCI8:
-
- - Bump PECL package info version check to allow PECL installs with PHP 5.5+.
-
-- PDO:
-
- - Allowed PDO_OCI to compile with Oracle Database 12c client libraries.
-
-- Pgsql:
-
- - pg_unescape_bytea() raises E_WARNING for invalid inputs.
-
-- Phar:
-
- - (Missing phar man page).
-
-- Session:
-
- - Added optional create_sid() argument to session_set_save_handler(), SessionHandler and new SessionIdInterface.
-
-- Sockets:
-
- - Setting SO_BINDTODEVICE with socket_set_option.
- - Allowed specifying paths in the abstract namespace for the functions socket_bind(), socket_connect() and socket_sendmsg().
- - sendmsg() ancillary data construction for SCM_RIGHTS is faulty.
-
-- SPL:
-
- - RecursiveDirectoryIterator segfault.
- - Memleak when calling Directory(Recursive)Iterator/Spl(Temp)FileObject ctor twice.
-
-- CGI/FastCGI SAPI:
-
- - Added PHP_FCGI_BACKLOG, overrides the default listen backlog.
-
-
-
-
-
-Version 5.5.0
-
-
-- Drop support for bison < 2.4 when building PHP from GIT source
-
-
-
-- Improved Zend Engine:
-
- - Added ARMv7/v8 versions of various Zend arithmetic functions that are implemented using inline assembler
- - Added systemtap support by enabling systemtap compatible dtrace probes on linux
- - Optimized access to temporary and compiled VM variables. 8% less memory reads
- - The VM stacks for passing function arguments and syntaticaly nested calls
- were merged into a single stack. The stack size needed for op_array
- execution is calculated at compile time and preallocated at once. As result
- all the stack push operations don't require checks for stack overflow
- any more
-
-
-
-
-- General improvements:
-
- - Added generators and coroutines.
- - Added "finally" keyword.
- - Added simplified password hashing API.
- - Added support for constant array/string dereferencing.
- - Added Class Name Resolution As Scalar Via "class" Keyword
- - Added support for using empty() on the result of function calls and other expressions
- - Added support for non-scalar Iterator keys in foreach
- - Added support for list in foreach
-
-
-
-
-- Core:
-
- - Added Zend Opcache extension and enable building it by default.
- - Added array_column function which returns a column in a multidimensional array
- - Added boolval()
- - Added "Z" option to pack/unpack
- - Added optional second argument for assert() to specify custom message
- - Added support for changing the process's title in CLI/CLI-Server SAPIs. The implementation is more robust that the proctitle PECL module
- - Improve set_exception_handler while doing reset
- - Return previous handler when passing NULL to set_error_handler and set_exception_handler
- - (Added HTTP codes as of RFC 6585)
- - (Allow 'set_error_handler' to handle NULL)
- - (specify temp dir by php.ini)
- - (Dereferencing process-handles no longer waits on those processes)
- - (count() off by one inside unset())
- - (Class loading order affects E_STRICT warning)
- - (segfault in zend_do_fcall_common_helper_SPEC)
- - (Segfault in gc_zval_possible_root)
- - (doc comments picked up from previous scanner run)
- - (Apache2 TS crash with get_browser())
- - (Heap based buffer overflow in quoted_printable_encode, CVE 2013-2110)
- - (Use of no longer available ini directives causes crash on TS build)
- - (Custom Exceptions crash when internal properties overridden)
- - (SegFault on zend_deactivate).
- - (execution operator `` stealing surrounding arguments)
- - (Segfault on memory exhaustion within function definition)
- - (debug_backtrace in set_error_handler corrupts zend heap: segfault)
- - (copy doesn't report failure on partial copy)
- - (foreach no longer copies keys if they are interned)
- - and (fd leak on Solaris)
- - (Valgrind warnings after using putenv)
- - (Memoryleak when using the same variablename 2times in function declaration)
- - (Compilation fails with error: conflicting types for 'zendparse')
- - (Debug backtrace changed behavior since 5.4.10 or 5.4.11)
- - allow XOR in php.ini
- - (Unserialize array of objects whose class can't be autoloaded fail)
- - (microtime(true) less than $_SERVER['REQUEST_TIME_FLOAT'])
- - (quoted-printable-encode stream filter incorrectly discarding whitespace)
- - (dval to lval different behavior on ppc64)
- - (Exceptions from set_error_handler are not always propagated)
- - (object members get trimmed by zero bytes)
- - (Segfault if php_strip_whitespace has heredoc)
- - (Segfault on undefined function call in nested generator)
- - (Crash when using closures with ArrayAccess)
- - (Malformed grammar)
- - (unpack("a5", "str\0\0") does not work as expected)
- - (__invoke() visibility not honored)
- - (self, parent, static behave inconsistently case-sensitive)
- - timestamp for mail.log
- - (Uninitialized ++$foo->bar; does not cause a notice)
- - allow specifying Max-Age attribute in setcookie()
- - (Engine uses locale rules to handle class names)
- - Fix undefined behavior when converting double variables to integers. The double is now always rounded towards zero, the remainder of its division by 2^32 or 2^64 (depending on sizeof(long)) is calculated and it's made signed assuming a two's complement representation
-
-
-
-
-- Removed legacy features:
-
- - Remove php_logo_guid(), php_egg_logo_guid(), php_real_logo_guid(), zend_logo_guid()
- - Drop Windows XP and 2003 support
-
-
-
-
-- Apache2 Handler SAPI:
-
- - Enabled Apache 2.4 configure option for Windows.
-
-
-
-
-- Calendar:
-
- - (Integer overflow in SndToJewish).
- - (cal_from_jd returns month = 6 when there is only one Adar).
-
-
-
-
-- CLI server:
-
- - (buit-in web server is broken on ppc64).
-
-
-
-
-- CURL:
-
- - Remove curl stream wrappers.
- - (added CURLFile for safer file uploads).
- - Added support for CURLOPT_FTP_RESPONSE_TIMEOUT, CURLOPT_APPEND,
- CURLOPT_DIRLISTONLY, CURLOPT_NEW_DIRECTORY_PERMS, CURLOPT_NEW_FILE_PERMS,
- CURLOPT_NETRC_FILE, CURLOPT_PREQUOTE, CURLOPT_KRBLEVEL, CURLOPT_MAXFILESIZE,
- CURLOPT_FTP_ACCOUNT, CURLOPT_COOKIELIST, CURLOPT_IGNORE_CONTENT_LENGTH,
- CURLOPT_CONNECT_ONLY, CURLOPT_LOCALPORT, CURLOPT_LOCALPORTRANGE,
- CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_SSL_SESSIONID_CACHE,
- CURLOPT_FTP_SSL_CCC, CURLOPT_HTTP_CONTENT_DECODING,
- CURLOPT_HTTP_TRANSFER_DECODING, CURLOPT_PROXY_TRANSFER_MODE,
- CURLOPT_ADDRESS_SCOPE, CURLOPT_CRLFILE, CURLOPT_ISSUERCERT,
- CURLOPT_USERNAME, CURLOPT_PASSWORD, CURLOPT_PROXYUSERNAME,
- CURLOPT_PROXYPASSWORD, CURLOPT_NOPROXY, CURLOPT_SOCKS5_GSSAPI_NEC,
- CURLOPT_SOCKS5_GSSAPI_SERVICE, CURLOPT_TFTP_BLKSIZE,
- CURLOPT_SSH_KNOWNHOSTS, CURLOPT_FTP_USE_PRET, CURLOPT_MAIL_FROM,
- CURLOPT_MAIL_RCPT, CURLOPT_RTSP_CLIENT_CSEQ, CURLOPT_RTSP_SERVER_CSEQ,
- CURLOPT_RTSP_SESSION_ID, CURLOPT_RTSP_STREAM_URI, CURLOPT_RTSP_TRANSPORT,
- CURLOPT_RTSP_REQUEST, CURLOPT_RESOLVE, CURLOPT_ACCEPT_ENCODING,
- CURLOPT_TRANSFER_ENCODING, CURLOPT_DNS_SERVERS and CURLOPT_USE_SSL
- - (CURLOPT_BINARYTRANSFER no longer used. The constant
- still exists for backward compatibility but is doing nothing)
- - (Missing CURLINFO_RESPONSE_CODE support)
- - Added new functions curl_escape, curl_multi_setopt, curl_multi_strerror
- curl_pause, curl_reset, curl_share_close, curl_share_init,
- curl_share_setopt curl_strerror and curl_unescape
- - Addes new curl options CURLOPT_TELNETOPTIONS, CURLOPT_GSSAPI_DELEGATION,
- CURLOPT_ACCEPTTIMEOUT_MS, CURLOPT_SSL_OPTIONS, CURLOPT_TCP_KEEPALIVE,
- CURLOPT_TCP_KEEPIDLE and CURLOPT_TCP_KEEPINTVL
-
-
-
-
-- DateTime:
-
- - Added DateTimeImmutable - a variant of DateTime that only returns the
- modified state instead of changing itself.
- - (Invalid free when unserializing DateTimeZone).
- - (strftime crash with VS2012)
- - (Unserialize Invalid Date causes crash)
- - (modify("+5 weekdays") returns Sunday)
- - (DateInterval::format("%a") is always zero when an
- interval is created using the createFromDateString method)
- - (DateTimeZone serialize/unserialize)
- - (Crash when using unserialized DatePeriod instance)
-
-
-
-
-- dba:
-
- - (dba_insert not working as expected)
-
-
-
-
-- Filter:
-
- - (added MAC address validation)
-
-
-
-
-- Fileinfo:
-
- - Upgraded libmagic to 5.14.
- - (mimetype detection segfaults on mp3 file)
- - (Different results in TS and NTS under Windows)
- - (Load multiple magic files from a directory under Windows)
-
-
-
-
-- FPM:
-
- - Add --with-fpm-systemd option to report health to systemd, and
- systemd_interval option to configure this. The service can now use
- Type=notify in the systemd unit file.
- - Ignore QUERY_STRING when sent in SCRIPT_FILENAME
- - Log a warning when a syscall fails
- - (add support for FPM init.d script)
- - (error_log ignored when daemonize=0)
- - (php with fpm fails to build on Solaris 10 or 11)
- - Fixed some possible memory or resource leaks and possible null dereference
- detected by code coverity scan
-
-
-
-
-- GD:
-
- - (imagerotate produces corrupted image).
- - (segfault in imagesetinterpolation)
- - Fix build with system libgd >= 2.1 which is now the minimal
- version required (as build with previous version is broken).
- No change when bundled libgd is used
- - Upgraded libgd to 2.1
-
-
-
-
-- hash:
-
- - Added support for PBKDF2 via hash_pbkdf2().
- - (hash_pbkdf2() truncates data when using default length
- and hex output)
-
-
-
-
-- intl:
-
- - Added UConverter wrapper.
- - The intl extension now requires ICU 4.0+
- - Added intl.use_exceptions INI directive, which controls what happens when
- global errors are set together with intl.error_level
- - MessageFormatter::format() and related functions now accepted named
- arguments and mixed numeric/named arguments in ICU 4.8+
- - MessageFormatter::format() and related functions now don't error out when
- an insufficient argument count is provided. Instead, the placeholders will
- remain unsubstituted
- - MessageFormatter::parse() and MessageFormat::format() (and their static
- equivalents) don't throw away better than second precision in the arguments
- - IntlDateFormatter::__construct and datefmt_create() now accept for the
- $timezone argument time zone identifiers, IntlTimeZone objects, DateTimeZone
- objects and NULL
- - IntlDateFormatter::__construct and datefmt_create() no longer accept invalid
- timezone identifiers or empty strings
- - The default time zone used in IntlDateFormatter::__construct and
- datefmt_create() (when the corresponding argument is not passed or NULL is
- passed) is now the one given by date_default_timezone_get(), not the
- default ICU time zone
- - The time zone passed to the IntlDateFormatter is ignored if it is NULL and
- if the calendar passed is an IntlCalendar object -- in this case, the
- IntlCalendar's time zone will be used instead. Otherwise, the time zone
- specified in the $timezone argument is used instead. This does not affect
- old code, as IntlCalendar was introduced in this version
- - IntlDateFormatter::__construct and datefmt_create() now accept for the
- $calendar argument also IntlCalendar objects
- - IntlDateFormatter::getCalendar() and datefmt_get_calendar() return false
- if the IntlDateFormatter was set up with an IntlCalendar instead of the
- constants IntlDateFormatter::GREGORIAN/TRADITIONAL. IntlCalendar did not
- exist before this version
- - IntlDateFormatter::setCalendar() and datefmt_set_calendar() now also accept
- an IntlCalendar object, in which case its time zone is taken. Passing a
- constant is still allowed, and still keeps the time zone
- - IntlDateFormatter::setTimeZoneID() and datefmt_set_timezone_id() are
- deprecated. Use IntlDateFormatter::setTimeZone() or datefmt_set_timezone()
- instead
- - IntlDateFormatter::format() and datefmt_format() now also accept an
- IntlCalendar object for formatting
- - Added the classes: IntlCalendar, IntlGregorianCalendar, IntlTimeZone,
- IntlBreakIterator, IntlRuleBasedBreakIterator and
- IntlCodePointBreakIterator
- - Added the functions: intlcal_get_keyword_values_for_locale(),
- intlcal_get_now(), intlcal_get_available_locales(), intlcal_get(),
- intlcal_get_time(), intlcal_set_time(), intlcal_add(),
- intlcal_set_time_zone(), intlcal_after(), intlcal_before(), intlcal_set(),
- intlcal_roll(), intlcal_clear(), intlcal_field_difference(),
- intlcal_get_actual_maximum(), intlcal_get_actual_minimum(),
- intlcal_get_day_of_week_type(), intlcal_get_first_day_of_week(),
- intlcal_get_greatest_minimum(), intlcal_get_least_maximum(),
- intlcal_get_locale(), intlcal_get_maximum(),
- intlcal_get_minimal_days_in_first_week(), intlcal_get_minimum(),
- intlcal_get_time_zone(), intlcal_get_type(),
- intlcal_get_weekend_transition(), intlcal_in_daylight_time(),
- intlcal_is_equivalent_to(), intlcal_is_lenient(), intlcal_is_set(),
- intlcal_is_weekend(), intlcal_set_first_day_of_week(),
- intlcal_set_lenient(), intlcal_equals(),
- intlcal_get_repeated_wall_time_option(),
- intlcal_get_skipped_wall_time_option(),
- intlcal_set_repeated_wall_time_option(),
- intlcal_set_skipped_wall_time_option(), intlcal_from_date_time(),
- intlcal_to_date_time(), intlcal_get_error_code(),
- intlcal_get_error_message(), intlgregcal_create_instance(),
- intlgregcal_set_gregorian_change(), intlgregcal_get_gregorian_change() and
- intlgregcal_is_leap_year()
- - Added the functions: intltz_create_time_zone(), intltz_create_default(),
- intltz_get_id(), intltz_get_gmt(), intltz_get_unknown(),
- intltz_create_enumeration(), intltz_count_equivalent_ids(),
- intltz_create_time_zone_id_enumeration(), intltz_get_canonical_id(),
- intltz_get_region(), intltz_get_tz_data_version(),
- intltz_get_equivalent_id(), intltz_use_daylight_time(), intltz_get_offset(),
- intltz_get_raw_offset(), intltz_has_same_rules(), intltz_get_display_name(),
- intltz_get_dst_savings(), intltz_from_date_time_zone(),
- intltz_to_date_time_zone(), intltz_get_error_code(),
- intltz_get_error_message()
- - Added the methods: IntlDateFormatter::formatObject(),
- IntlDateFormatter::getCalendarObject(), IntlDateFormatter::getTimeZone(),
- IntlDateFormatter::setTimeZone()
- - Added the functions: datefmt_format_object(), datefmt_get_calendar_object(),
- datefmt_get_timezone(), datefmt_set_timezone(),
- datefmt_get_calendar_object(), intlcal_create_instance()
-
-
-
-
-- mbstring:
-
- - (mbstring PHPTs crash on Windows x64).
-
-
-
-
-- MCrypt:
-
- - mcrypt_ecb(), mcrypt_cbc(), mcrypt_cfb() and mcrypt_ofb() now throw E_DEPRECATED.
-
-
-
-
-- mysql:
-
- - This extension is now deprecated, and deprecation warnings will be generated
- when connections are established to databases via mysql_connect(),
- mysql_pconnect(), or through implicit connection: use MySQLi or PDO_MySQL
- instead
- - Dropped support for LOAD DATA LOCAL INFILE handlers when using libmysql.
- Known for stability problems
- - Added support for SHA256 authentication available with MySQL 5.6.6+
-
-
-
-
-- mysqli:
-
- - Added mysqli_begin_transaction()/mysqli::begin_transaction(). Implemented
- all options, per MySQL 5.6, which can be used with START TRANSACTION, COMMIT
- and ROLLBACK through options to mysqli_commit()/mysqli_rollback() and their
- respective OO counterparts. They work in libmysql and mysqlnd mode
- - Added mysqli_savepoint(), mysqli_release_savepoint()
- - (Segfault when calling fetch_object on a use_result and DB
- pointer has closed)
- - (MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS undeclared when
- using Connector/C)
-
-
-
-
-- mysqlnd:
-
- - Add new begin_transaction() call to the connection object. Implemented all
- options, per MySQL 5.6, which can be used with START TRANSACTION, COMMIT
- and ROLLBACK
- - Added mysqlnd_savepoint(), mysqlnd_release_savepoint()
- - (mysqlnd_stmt::bind_one_parameter crashes, uses wrong alloc
- for stmt->param_bind)
- - Fixed return value of mysqli_stmt_affected_rows() in the time after
- prepare() and before execute()
-
-
-
-
-- PCRE:
-
- - Merged PCRE 8.32
- - Deprecated the /e modifier
- - (Upgrade PCRE to 8.31)
-
-
-
-
-- PDO:
-
- - (Segmentation fault when instantiate 2 persistent PDO to the same db server)
-
-
-
-
-- PDO_DBlib:
-
- - (Cannot connect to SQL Server 2008 with PDO dblib)
- - (pdo_dblib can't connect to Azure SQL)
- - (FreeTDS PDO getColumnMeta on a prepared but not executed statement crashes)
-
-
-
-
-- PDO_pgsql:
-
- - (Buffer overflow in _pdo_pgsql_error)
-
-
-
-
-- PDO_mysql:
-
- - (getColumnMeta() doesn't return native_type for BIT, TINYINT and YEAR)
-
-
-
-
-- pgsql:
-
- - Added pg_escape_literal() and pg_escape_identifier()
- - Locale number format settings can cause pg_query_params to break with numerics
-
-
-
-
-- Phar:
-
- - Fixed timestamp update on Phar contents modification
-
-
-
-
-- readline:
-
- - (Expose additional readline variable to prevent default filename completion)
-
-
-
-
-- Reflection:
-
- - (There is an ability to create instance of Generator by hand)
-
-
-
-
-- Sockets:
-
- - Added socket_cmsg_space(), socket_sendmsg(), and socket_recvmsg() functions
- - (Fails to build with --disable-ipv6)
- - (sendmsg/recvmsg shutdown handler causes segfault)
-
-
-
-
-- SPL:
-
- - (Segfault while using RecursiveIteratorIterator on 64-bits systems)
- - (SPLFixedArray toArray problem)
- - (RecursiveDirectoryIterator always assumes SKIP_DOTS)
- - (Segfault on SplFixedArray[][x] = y when extended)
- - (SplFixedArray un-/serialize, getSize(), count() return 0, keys are strings)
- - (unset fails with ArrayObject and deep arrays)
- - Implement (Add SplDoublyLinkedList::add() to insert an element at a given offset)
-
-
-
-
-- SNMP:
-
- - (Some IPv6 addresses get interpreted wrong)
- - (Truncated snmpget)
- - (IPv6 malformed)
- - (OO API, walk: $suffix_as_key is not working correctly)
-
-
-
-
-- SOAP:
-
- - Added SoapClient constructor option 'ssl_method' to specify ssl method
-
-
-
-
-- Streams:
-
- - (stream_select() fails with pipes returned by proc_open() on Windows x64)
- - Fixed Windows x64 version of stream_socket_pair() and improved error handling
-
-
-
-
-- Tokenizer:
-
- - (token_get_all fails to lex nested heredoc)
-
-
-
-
-- Zip:
-
- - Upgraded libzip to 0.10.1
- - (Zip crash intermittently)
- - (ZipArchive::addFile() has to check for file existence)
-
-
-
-
-
-
-
-Version 5.4.45
-
-- Core:
-
- - (Use After Free Vulnerability in unserialize()). (CVE-2015-6834)
- - (Use after free vulnerability in session deserializer). (CVE-2015-6835)
-
-- EXIF:
-
- - (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).
-
-- hash:
-
- - (HAVAL gives wrong hashes in specific cases).
-
-- PCRE:
-
- - (Multiple vulnerabilities related to PCRE functions).
-
-- SOAP:
-
- - (SOAP serialize_function_call() type confusion / RCE). (CVE-2015-6836)
-
-- SPL:
-
- - (Use-after-free vulnerability in unserialize() with SplObjectStorage). (CVE-2015-6834)
- - (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList). (CVE-2015-6834)
-
-- XSLT:
-
- - (NULL pointer dereference). (CVE-2015-6837, CVE-2015-6838)
-
-- ZIP:
-
- - (ZipArchive::extractTo allows for directory traversal when creating directories). (CVE-2014-9767)
-
-
-
-
-
-
-Version 5.4.44
-
-- Core:
-
- - (Remotely triggerable stack exhaustion via recursive method calls).
- - (Different arrays compare indentical due to integer key truncation).
- - (unserialize() could lead to unexpected methods execution / NULL pointer deref).
-
-- OpenSSL:
-
- - (openssl_random_pseudo_bytes() is not cryptographically secure). (CVE-2015-8867)
-
-- Phar:
-
- - Improved fix for bug .
- - (Files extracted from archive may be placed outside of destination directory). (CVE-2015-6833)
-
-- SOAP:
-
- - (SoapClient info leak / null pointer dereference via multiple type confusions).
-
-- SPL:
-
- - (Dangling pointer in the unserialization of ArrayObject items). (CVE-2015-6832)
- - (Use After Free Vulnerability in unserialize() with SPLArrayObject). (CVE-2015-6831)
- - (Use After Free Vulnerability in unserialize() with SplObjectStorage). (CVE-2015-6831)
- - (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList). (CVE-2015-6831)
-
-
-
-
-
-Version 5.4.43
-
-- Core:
-
- - (escapeshell*() doesn't cater to !).
- - (Can't set empty additional_headers for mail()), regression from fix to bug .
-
-- Mysqlnd:
-
- - (mysqlnd is vulnerable to BACKRONYM). (CVE-2015-3152)
-
-- Phar:
-
- - (Segfault in Phar::convertToData on invalid file). (CVE-2015-5589)
- - (Buffer overflow and stack smashing error in phar_fix_filepath). (CVE-2015-5590)
-
-
-
-
-
-Version 5.4.42
-
-- Core:
-
- - Improved fix for bug (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4643)
- - (OS command injection vulnerability in escapeshellarg). (CVE-2015-4642)
- - (Incorrect handling of paths with NULs). (CVE-2015-4598)
-
-- Litespeed SAPI:
-
- - (Unchecked return value).
-
-- Mail:
-
- - (mail() does not have mail header injection prevention for additional headers).
-
-- Postgres:
-
- - (segfault in php_pgsql_meta_data). (CVE-2015-4644)
-
-- Sqlite3:
-
- - Upgrade bundled sqlite to 3.8.10.2. (CVE-2015-3414, CVE-2015-3415, CVE-2015-3416)
-
-
-
-
-
-Version 5.4.41
-
-- Core:
-
- - (PHP Multipart/form-data remote dos Vulnerability). (CVE-2015-4024)
- - (str_repeat() sign mismatch based memory corruption).
- - (CVE-2006-7243 fix regressions in 5.4+). (CVE-2015-4025)
- - (heap buffer overflow in unpack()).
-
-- FTP:
-
- - (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4022)
-
-- PCNTL:
-
- - (pcntl_exec() should not allow null char). (CVE-2015-4026)
-
-- PCRE:
-
- - Upgraded pcrelib to 8.37. (CVE-2015-2325, CVE-2015-2326)
-
-- Phar:
-
- - (Memory Corruption in phar_parse_tarfile when entry filename starts with null). (CVE-2015-4021)
-
-
-
-
-
-Version 5.4.40
-
-- Apache2handler:
-
- - (potential remote code execution with apache 2.4 apache2handler). (CVE-2015-3330)
-
-- Core:
-
- - Additional fix for bug (Type confusion vulnerability in exception::getTraceAsString).
- - (php_stream_url_wrap_http_ex() type-confusion vulnerability).
- - (Missing null byte checks for paths in various PHP extensions). (CVE-2015-3411, CVE-2015-3412)
-
-- cURL:
-
- - (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER).
-
-- Ereg:
-
- - (NULL Pointer Dereference).
-
-- Fileinfo:
-
- - (Fileinfo on specific file causes spurious OOM and/or segfault). (CVE-2015-4604, CVE-2015-4605)
-
-- GD:
-
- - (buffer read overflow in gd_gif_in.c). (CVE-2014-9709)
-
-- Phar:
-
- - (use after free). (CVE-2015-2301)
- - (Buffer Over-read in unserialize when parsing Phar). (CVE-2015-2783, CVE-2015-3307)
- - (Buffer Overflow when parsing tar/zip/phar in phar_set_inode). (CVE-2015-3329)
-
-- Postgres:
-
- - (Null pointer deference). (CVE-2015-1352)
-
-- SOAP:
-
- - (Type Confusion Infoleak Vulnerability in unserialize() with SoapFault). (CVE-2015-4599)
- - (NEW segfault when using SoapClient::__setSoapHeader (bisected, regression)).
-
-- Sqlite3:
-
- - (SQLite prepared statement use-after-free).
-
-
-
-
-
-Version 5.4.39
-
-- Core:
-
- - (Use After Free Vulnerability in unserialize()). (CVE-2015-2787)
- - (Per Directory Values overrides PHP_INI_SYSTEM configuration options).
- - (move_uploaded_file allows nulls in path). (CVE-2015-2348)
-
-- Ereg:
-
- - (heap overflow vulnerability in regcomp.c). (CVE-2015-2305)
-
-- SOAP:
-
- - (SoapClient's __call() type confusion through unserialize()). (CVE-2015-4147, CVE-2015-4148)
-
-- ZIP:
-
- - (ZIP Integer Overflow leads to writing past heap boundary). (CVE-2015-2331)
-
-
-
-
-
-Version 5.4.38
-
-- Core:
-
- - Removed support for multi-line headers, as they are deprecated by RFC 7230.
- - Added NULL byte protection to exec, system and passthru.
- - (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow).
- - (broken detection of system crypt sha256/sha512 support).
- - (Use after free vulnerability in unserialize() with DateTimeZone). (CVE-2015-0273)
-
-- Enchant:
-
- - (heap buffer overflow in enchant_broker_request_dict()). (CVE-2014-9705)
-
-- SOAP:
-
- - (SoapServer cannot handle large messages).
-
-
-
-
-
-Version 5.4.37
-
-- Core:
-
- - (Use After Free Vulnerability in PHP's unserialize()). (CVE-2015-0231)
-
-- CGI:
-
- - (out of bounds read crashes php-cgi). (CVE-2014-9427)
-
-- EXIF:
-
- - (Free called on uninitialized pointer). (CVE-2015-0232)
-
-- Fileinfo:
-
- - Removed readelf.c and related code from libmagic sources.
- - (fileinfo out-of-bounds memory access). (CVE-2014-9652)
-
-- OpenSSL:
-
- - (use case-insensitive cert name matching).
-
-
-
-
-
-
-Version 5.4.36
-
-- Core:
-
- - Upgraded crypt_blowfish to version 1.3.
- - (NULL pointer dereference in unserialize.c).
- - (Use after free vulnerability in unserialize()). (CVE-2014-8142)
-
- - Mcrypt:
-
- - Fixed possible read after end of buffer and use after free.
-
-
-
-
-
-Version 5.4.35
-
-- Core:
-
- - (zend_mm_heap corrupted after memory overflow in zend_hash_copy).
-
-- Fileinfo:
-
- - (fileinfo: out-of-bounds read in elf note headers). (CVE-2014-3710)
-
-- GMP:
-
- - (GMP memory management conflicts with other libraries using GMP).
-
-- PDO_pgsql:
-
- - (Segmentation fault on statement deallocation).
-
-
-
-
-
-Version 5.4.34
-
-- Fileinfo:
-
- - (libmagic: don't assume char is signed).
-
-- Core:
-
- - (Incorrect last used array index copied to new array after unset).
- - (Integer overflow in unserialize() (32-bits only)). (CVE-2014-3669)
-
-- cURL:
-
- - (NULL byte injection - cURL lib).
-
-- EXIF:
-
- - (Heap corruption in exif_thumbnail()). (CVE-2014-3670)
-
-- OpenSSL:
-
- - Reverted fixes for bug , due to regressions.
-
-- XMLRPC:
-
- - (Global buffer overflow in mkgmtime() function). (CVE-2014-3668)
-
-
-
-
-
-Version 5.4.33
-
-- Core:
-
- - (glob returns error, should be empty array()).
- - (SIGSEGV during zend_shutdown()).
- - (Crash on SIGTERM in apache process).
-
-- OpenSSL:
-
- - (socket timeouts not honored in blocking SSL reads).
-
-- Date:
-
- - (memory leaks in DateTime constructor).
-
-- FPM:
-
- - (FPM with mod_fastcgi/apache2.4 is broken).
-
-- GD:
-
- - Made fontFetch's path parser thread-safe.
-
-- Wddx:
-
- - (Segfaults in php_wddx_serialize_var).
-
-- Zlib:
-
- - (chained zlib filters silently fail with large amounts of data).
- - (internal corruption phar error).
-
-
-
-
-
-Version 5.4.32
-
-- Core:
-
- - (segfault in dns_get_record) (CVE-2014-3597).
- - (incorrect push to the empty array)
-
-- COM:
-
- - Fixed missing type checks in com_event_sink.
-
-- Fileinfo:
-
- - (extensive backtracking in rule regular expression). (CVE-2014-3538)
- - (Segfault in cdf.c) (CVE-2014-3587).
-
-- GD:
-
- - (php-gd 'c_color' NULL pointer dereference). (CVE-2014-2497)
- - (Null byte injection possible with imagexxx functions) (CVE-2014-5120).
-
-- Milter:
-
- - (php-milter does not build and crashes randomly).
-
-- OpenSSL:
-
- - Fixed missing type checks in OpenSSL options (Yussuf Khalil, Stas).
-
-- Readline:
-
- - (Interactive mode doesn't force a newline before the prompt).
- - (Save command history when exiting interactive shell with control-c).
-
-- Sessions:
-
- - Fixed missing type checks in php_session_create_id.
-
-- SPL:
-
- - (ArrayIterator use-after-free due to object change during sorting) (CVE-2014-4698).
- - (SPL Iterators use-after-free) (CVE-2014-4670).
-
-- ODBC:
-
- - (odbc_fetch_into returns junk data at end of multi-byte char fields).
-
-
-
-
-
-Version 5.4.31
-
-- Core:
-
- - (header('Location: foo') will override a 308-399 response code).
- - (Autoloader isn't called if two method definitions don't match).
- - (make install fails to install libphp5.so on FreeBSD 10.0).
- - (strtr with empty array crashes).
- - (Windows 8.1/Server 2012 R2 reported as Windows 8/Server 2012).
-
-- CLI server:
-
- - (CLI server is missing some new HTTP response codes).
- - (Empty header causes PHP built-in web server to hang).
-
-- FPM:
-
- - (error_log=syslog ignored).
- - (syslog cannot be set in pool configuration).
-
-- Intl:
-
- - (NumberFormatter::parse() resets LC_NUMERIC setting).
-
-- pgsql:
-
- - (Error in code "form" instead of "from", pgsql.c, line 756), which affected builds against libpq < 7.3.
-
-- Phar:
-
- - (Redirection loop on nginx with FPM).
-
-- Streams:
-
- - (http:// wrapper doesn't follow 308 redirects).
-
-
-
-
-
-
-Version 5.4.30
-
-- Core:
-
- - Fixed BC break introduced by patch for bug .
- - (Closures do not correctly capture the late bound class (static::) in some cases).
- - (insecure temporary file use in the configure script) (CVE-2014-3981).
- - (putenv with empty variable may lead to crash).
- - (phpinfo() Type Confusion Information Leak Vulnerability). (CVE-2014-4721)
-
-- CLI server:
-
- - (built-in web-server segfaults on startup).
-
-- Date:
-
- - (Serialize of DateTime truncates fractions of second).
- - Fixed regression in fix for bug (constructor can't be called twice).
-
-- Fileinfo:
-
- - (fileinfo: cdf_read_short_sector insufficient boundary check) (CVE-2014-0207).
- - (fileinfo: mconvert incorrect handling of truncated pascal string size) (CVE-2014-3478).
- - (fileinfo: cdf_check_stream_offset insufficient boundary check) (CVE-2014-3479).
- - (fileinfo: cdf_count_chain insufficient boundary check) (CVE-2014-3480).
- - (fileinfo: cdf_read_property_info insufficient boundary check) (CVE-2014-3487).
-
-- Intl:
-
- - (Locale::parseLocale Double Free).
- - (Buffer overflow in locale_get_display_name and uloc_getDisplayName (libicu 4.8.1)).
-
-- Network:
-
- - (Fix potential segfault in dns_get_record()) (CVE-2014-4049).
-
-- OpenSSL:
-
- - (certificates validity parsing does not work past 2050).
- - (openssl_x509_parse warning with V_ASN1_GENERALIZEDTIME).
-
-- SOAP:
-
- - (Add SoapClient::__getCookies()).
-
-- SPL:
-
- - (Segmentation fault with ArrayObject unset).
- - (Segfault in recursiveDirectoryIterator).
- - (Missing element after ArrayObject::getIterator).
- - (unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion) (CVE-2014-3515).
-
-
-
-
-
-Version 5.4.29
-
-- COM:
-
- - (Special Character via COM Interface (CP_UTF8)).
-
-- Core:
-
- - (copy() doesn't work when destination filename is created by tempnam()).
- - (Echoing unserialized "SplFileObject" crash).
- - (usage of memcpy() with overlapping src and dst in zend_exceptions.c).
- - (spl_fixedarray_resize integer overflow).
- - (printf out-of-bounds read).
- - (iptcparse out-of-bounds read).
- - (convert_uudecode out-of-bounds read). (Stas)
-
-- Fileinfo:
-
- - (Fileinfo crashes with powerpoint files).
- - (fileinfo: CDF infinite loop in nelements DoS). (CVE-2014-0238)
- - (fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation). (CVE-2014-0237)
-
-- Date:
-
- - (DateTime constructor crash with invalid data).
- - (date_parse_from_format out-of-bounds read).
- - (timelib_meridian_with_check out-of-bounds read).
-
-- DOM:
-
- - (DOMDocumentType->internalSubset returns entire DOCTYPE tag, not only the subset).
-
-- FPM:
-
- - (php-fpm reload leaks epoll_create() file descriptor).
-
-- Phar:
-
- - ($phar->buildFromDirectory can't compress file with an accent in its name).
-
-
-
-
-
-Version 5.4.28
-
-- Core:
-
- - (Out of memory on command stream_get_contents).
- - (stream_socket_server() creates wrong Abstract Namespace UNIX sockets).
- - (Symlinks and session handler allow open_basedir bypass).
- - (exit in stream filter produces segfault).
- - (fpassthru broken).
- - (getimagesize should recognize BMP files with negative height).
-
-- cURL:
-
- - (curl_exec returns differently than curl_multi_getcontent).
-
-- Date:
-
- - (__wakeup of DateTime segfaults when invalid object data is supplied).
-
-- Embed:
-
- - (php5embed.lib isn't provided anymore).
-
-- Fileinfo:
-
- - (Memory corruption in fileinfo ext / bigendian).
-
-- FPM:
-
- - (unknown entry 'priority' in php-fpm.conf).
- - (sapi/fpm: possible privilege escalation due to insecure default configuration) (CVE-2014-0185).
-
-- JSON:
-
- - (Blank line inside empty array/object when JSON_PRETTY_PRINT is set).
-
-- LDAP:
-
- - Fixed issue with null bytes in LDAP bindings.
-
-- OpenSSL:
-
- - (memory leak in openssl_seal()).
- - (memory leak in openssl_open()).
-
-- SimpleXML:
-
- - (simplexml_load_string() mangles empty node name) (Anatol)
-
-- XSL:
-
- - (<xsl:include> cannot find files with relative paths when loaded with "file://").
-
-- Apache2 Handler SAPI:
-
- - Fixed Apache log issue caused by APR's lack of support for %zu (APR issue 56120).
-
-
-
-
-
-Version 5.4.27
-
-- Core:
-
- - (proc_open() changes environment array)
-
-- Fileinfo:
-
- - (fileinfo: extensive backtracking in awk rule regular expression). (CVE-2013-7345)
-
-- FPM:
-
- - Added clear_env configuration directive to disable clearenv() call.
-
-- GMP:
-
- - (invalid argument crashes gmp_testbit)
-
-- Mail:
-
- - (Don't add newline after X-PHP-Originating-Script)
-
-- MySQLi:
-
- - (Segfault in mysqli_stmt::bind_result() when link closed)
-
-- Openssl:
-
- - (Default disgest algo is still MD5, switch to SHA1)
-
-
-
-
-
-Version 5.4.26
-
-- Date:
-
- - (some time zone offsets not recognized by timezone_name_from_abbr)
- - (DateTime::setTimezone can not set timezones without ID)
-
-- JSON:
-
- - (JsonSerializeable couldn't implement on module extension)
-
-- Fileinfo:
-
- - (file: infinite recursion) (CVE-2014-1943).
- - (out-of-bounds memory access in fileinfo) (CVE-2014-2270).
-
-- LDAP:
-
- - Implemented ldap_modify_batch (https://wiki.php.net/rfc/ldap_modify_batch).
-
-- Openssl:
-
- - (Add EC key support to php_openssl_is_private_key).
-
-- Pgsql:
-
- - Added warning for dangerous client encoding and remove possible injections for pg_insert()/pg_update()/pg_delete()/pg_select().
-
-
-
-
-
-
-Version 5.4.25
-
-- Core:
-
- - (Incorrect object comparison with inheritance).
- - (copy() arginfo has changed starting from 5.4).
-
-- mysqlnd:
-
- - (Segmentation fault after memory_limit).
-
-- PDO_pgsql:
-
- - (PDO-psql cannot connect if password contains spaces).
-
-- Session:
-
- - (Calls to session_name() segfault when session.name is null).
-
-
-
-
-
-Version 5.4.24
-
-- Core:
-
- - Added validation of class names in the autoload process.
- - Fixed invalid C code in zend_strtod.c.
- - (fopen and O_NONBLOCK).
-
-- Date:
-
- - (Heap buffer over-read in DateInterval, CVE-2013-6712).
- - (Incorrect/inconsistent day of week prior to the year 1600).
- - (Wrong Day of Week).
-
-- DOM:
-
- - (Passing DOMDocumentFragment to DOMDocument::saveHTML() Produces invalid Markup).
-
-- Exif:
-
- - (Integer overflow in exif_read_data()).
-
-- Filter:
-
- - (128.0.0.0/16 isn't reserved any longer).
-
-- GD:
-
- - (Use freetype-config for determining freetype2 dir(s)).
-
-- PDO_odbc:
-
- - (Stack smashing protection kills PDO/ODBC queries).
-
-- SNMP:
-
- - Fixed SNMP_ERR_TOOBIG handling for bulk walk operations.
-
-- XSL:
-
- - (Segfault throwing an exception in a XSL registered function).
-
-- ZIP:
-
- - (ZipArchive::open() ze_obj->filename_len not real).
-
-
-
-
-
-Version 5.4.23
-
-- Core:
-
- - (unregister_tick_function tries to cast a Closure to a string).
- - (basename is no more working after fgetcsv in certain situation).
-
-- JSON:
-
- - Fixed whitespace part of ("json_decode handles whitespace and case-sensitivity incorrectly").
-
-- MySQLi:
-
- - (Segfault calling bind_param() on mysqli).
-
-- mysqlnd:
-
- - (mysqli under mysqlnd loses precision when bind_param with 'i').
- - (mysqlnd quote function is wrong with NO_BACKSLASH_ESCAPES after failed query).
-
-- OpenSSL:
-
- - Fixed memory corruption in openssl_x509_parse() (CVE-2013-6420). (Stefan Esser).
-
-- PDO:
-
- - (sql_parser permanently converts values bound to strings).
-
-
-
-
-
-Version 5.4.22
-
-- Core:
-
- - (scope resolution operator - strange behavior with $this).
-
-- CLI server:
-
- - (Segfault with built-in webserver and chunked transfer encoding).
-
-- Exif:
-
- - Fixed crash on unknown encoding.
-
-- FTP:
-
- - (ftp_nb_continue produces segfault).
-
-- ODBC:
-
- - (Field name truncation if the field name is bigger than 32 characters).
-
-- Sockets:
-
- - (the socket_connect() won't work with IPv6 address).
-
-- Standard:
-
- - (var_export() does not use full precision for floating-point numbers).
-
-- XMLReader:
-
- - (Crash with clone XMLReader).
- - (XMLReader does not suppress errors).
-
-
-
-
-
-Version 5.4.21
-
-- Core:
-
- - (compile time errors won't trigger auto loading).
-
-- CLI server:
-
- - (built-in server treat some http headers as case-sensitive).
-
-- Datetime:
-
- - (DateTime::createFromFormat() reports confusing error message).
-
-- DBA extension:
-
- - (dba functions cast $key param to string in-place, bypassing copy on write).
-
-- Filter:
-
- - Add RFC 6598 IPs to reserved addresses.
- - (FILTER_VALIDATE_URL rejects fully qualified domain names).
-
-- IMAP:
-
- - (configure script broken in 5.5.4 and 5.4.20 when enabling imap).
-
-- Standard:
-
- - (content-type must appear at the end of headers for 201 Location to work in http).
-
-- Build system:
-
- - ('make test' crashes starting with 5.3.14 (missing gzencode())).
-
-
-
-
-
-
-Version 5.4.20
-
-- Core:
-
- - (cli/apache sapi segfault on objects manipulation).
- - (Using traits with get_class_methods causes segfault).
- - (Duplicate calls to get lineno & filename for DTRACE_FUNCTION_*).
- - (quoted-printable encode stream filter incorrectly encoding spaces).
- - (shutdown segfault due to serialize).
- - (Segmentation fault in zend_error() with --enable-dtrace).
- - (Segfault in gc_zval_possible_root when return reference fails).
- - (Use of max int in array_sum).
- - (get_defined_constants() causes PHP to crash in a very limited case).
- - (PHP_BINARY incorrectly set).
- - Improved fix for bug (compile failure on netbsd).
- - (PHP fails to build with DTrace).
- - (class_alias() should accept classes with leading backslashes).
- - (CGI mode - make install don't work).
- - Cherry-picked some DTrace build commits (allowing builds on Linux, bug and bug ) from PHP 5.5 branch.
- - (--enable-dtrace leads make to clobber Zend/zend_dtrace.d)
-
-- cURL:
-
-- Datetime:
-
- - (createFromFormat broken when weekday name is followed by some delimiters)
- - (stack-buffer-overflow in DateTimeZone stuff caught by AddressSanitizer)
-
-- Openssl:
-
- - (openssl_x509_parse fails to parse subject properly in some cases).
-
-- Session:
-
- - (rfc1867 crashes php even though turned off).
- - (session id not appended properly for empty anchor tags).
- - Fixed possible buffer overflow under Windows. Note: Not a security fix.
- - Changed session.auto_start to PHP_INI_PERDIR.
-
-- SOAP:
-
- - (SoapHeader problems with SoapServer).
-
-- SPL:
-
- - (Segfault when getting SplStack object Value).
-
-- PDO:
-
- - (Postgres prepared statement positional parameter casting).
-
-- Phar:
-
- - (Phar::buildFromDirectory creates corrupt archives for some specific contents).
-
-- Pgsql:
-
- - (pg_escape_literal/identifier() silently returns false).
- - (Disallow possible SQL injections with pg_select()/pg_update() /pg_delete()/pg_insert()).
-
-- Zlib:
-
- - (Unable to send vary header user-agent when ob_start('ob_gzhandler') is called).
-
-
-
-
-
-Version 5.4.19
-
-- Core:
-
- - (Compilation fails with error: conflicting types for 'zendparse').
-
-- Openssl:
-
- - Fixed UMR in fix for CVE-2013-4248.
-
-
-
-
-
-Version 5.4.18
-
-- Core:
-
- - Fixed value of FILTER_SANITIZE_FULL_SPECIAL_CHARS constant (previously was erroneously set to FILTER_SANITIZE_SPECIAL_CHARS value).
- - (Exception not catchable when exception thrown in autoload with a namespace).
- - (is_callable() triggers Fatal Error).
- - (Generated configure script is malformed on OpenBSD).
- - (Possible XSS on "Registered stream filters" info).
- - (Error on serialize of ArrayObject).
- - (variant_* functions causes crash when null given as an argument).
- - (php_error_docref links to invalid pages).
- - (chroot() does not get enabled).
-
-- CGI:
-
- - (Missing php-cgi man page).
-
-- CLI server:
-
- - (Cli server not responsive when responding with 422 http status code).
-
-- CURL:
-
- - (curl.cainfo doesn't appear in php.ini).
-
-- FPM:
-
- - (enabling FPM borks compile on FreeBSD).
-
-- FTP:
-
- - (FTPs memory leak with SSL).
-
-- GMP:
-
- - (Memory leak in gmp_cmp second parameter).
-
-- Imap:
-
- - (Segmentation fault after imap_reopen failure).
-
-- Intl:
-
- - (Buggy grapheme_substr() on edge case).
- - (Offsets may be wrong for grapheme_stri* functions).
-
-- mysqlnd:
-
- - Fixed segfault in mysqlnd when doing long prepare.
-
-- ODBC:
-
- - (NULL valued anonymous column causes segfault in odbc_fetch_array).
-
-- Openssl:
-
- - Fixed handling null bytes in subjectAltName (CVE-2013-4248).
-
-- PDO:
-
- - Allowed PDO_OCI to compile with Oracle Database 12c client libraries.
-
-- PDO_dblib:
-
- - (PDO/dblib not working anymore ("use dbName" not sent)).
-
-- PDO_pgsql:
-
- - Fixed meta data retrieve when OID is larger than 2^31.
-
-- Phar:
-
- - (Missing phar man page).
-
-- Session:
-
- - ($_SESSION[$key]["cancel_upload"] doesn't work as documented).
- - (when session_name("123") consist only digits, should warning).
- - (mod_files.sh does not support hash bits).
-
-- Sockets:
-
- - (Setting SO_BINDTODEVICE with socket_set_option).
-
-- SPL:
-
- - (RecursiveDirectoryIterator segfault).
- - (Memleak when calling Directory(Recursive)Iterator /Spl(Temp)FileObject ctor twice).
- - (SplFixedArray un-/serialize, getSize(), count() return 0, keys are strings).
-
-- XML:
-
- - (heap corruption in xml parser). (CVE-2013-4113)
-
-
-
-
-
-
-Version 5.4.17
-
-- Core:
-
- - (Class loading order affects E_STRICT warning).
- - (segfault in zend_do_fcall_common_helper_SPEC).
- - (Segfault in gc_zval_possible_root).
- - (doc comments picked up from previous scanner run).
- - (Apache2 TS crash with get_browser()).
- - (quoted-printable-encode stream filter incorrectly discarding whitespace).
-
-- DateTime:
-
- - (Crash when using unserialized DatePeriod instance).
-
-- FPM:
-
- - (error_log ignored when daemonize=0).
- - (add support for FPM init.d script).
-
-- PDO:
-
- - (Segmentation fault when instantiate 2 persistent PDO to the same db server).
-
-- PDO_DBlib:
-
- - (Cannot connect to SQL Server 2008 with PDO dblib).
- - (pdo_dblib can't connect to Azure SQL).
- - (FreeTDS PDO getColumnMeta on a prepared but not executed statement crashes).
-
-- PDO_firebird:
-
- - (Firebird return wrong value for numeric field).
- - (Cannot insert second row with null using parametrized query).
-
-- PDO_mysql:
-
- - (getColumnMeta() doesn't return native_type for BIT, TINYINT and YEAR).
-
-- PDO_pgsql:
-
- - (Buffer overflow in _pdo_pgsql_error).
-
-- pgsql:
-
- - (pg_convert enum type support).
-
-- Readline:
-
- - Implement FR (Expose additional readline variable to prevent default filename completion).
-
-- SPL:
-
- - (Segfault while using RecursiveIteratorIterator on 64-bits systems).
-
-
-
-
-
-Version 5.4.16
-
-
-- Core:
-
- - (Heap based buffer overflow in quoted_printable_encode, CVE-2013-2110).
- - (Use of no longer available ini directives causes crash on TS build).
- - (compilation failure on x32).
- - (SegFault on zend_deactivate).
- - (Segfault on memory exhaustion within function definition).
-
-
-- Calendar:
-
- - (Integer overflow in SndToJewish).
-
-
-- Fileinfo:
-
- - (mimetype detection segfaults on mp3 file).
-
-
-- FPM:
-
- - Ignore QUERY_STRING when sent in SCRIPT_FILENAME.
- - Fixed some possible memory or resource leaks and possible null dereference detected by code coverity scan.
- - Log a warning when a syscall fails.
- - Add --with-fpm-systemd option to report health to systemd, and systemd_interval option to configure this. The service can now use Type=notify in the systemd unit file.
-
-
-- MySQLi
-
- - (Segfault when calling fetch_object on a use_result and DB pointer has closed).
-
-
-- Phar:
-
- - (PHAR PHPTs intermittently crash when run on DFS, SMB or with non std tmp dir).
-
-
-- SNMP:
-
- - (Some IPv6 addresses get interpreted wrong).
- - (Truncated snmpget).
-
-
-- Streams:
-
- - (stream_select() fails with pipes returned by proc_open() on Windows x64).
-
-
-- Zend Engine:
-
- - (Custom Exceptions crash when internal properties overridden).
-
-
-
-
-
-
-Version 5.4.15
-
-
-- Core:
-
- - (debug_backtrace in set_error_handler corrupts zend heap: segfault).
- - (dns_get_record result with string of length -1).
- - (follow_location parameter of context is ignored for most response codes).
- - (fd leak on Solaris).
- - (fd leak on Solaris).
-
-- Fileinfo:
-
- - Upgraded libmagic to 5.14.
-
-- Streams:
-
- - Fixed Windows x64 version of stream_socket_pair() and improved error handling.
-
-- Zip:
-
- - (ZipArchive::addFile() has to check for file existence).
-
-
-
-
-
-Version 5.4.14
-
-
-- Core:
-
- - (Ran out of opcode space).
- - (Memoryleak when using the same variablename two times in function declaration).
- - (more empty delimiter warning in strX methods).
- - (ArrayAccess::&offsetGet() in a trait causes fatal error).
- - (microtime(true) less than $_SERVER['REQUEST_TIME_FLOAT']).
- - (Debug backtrace changed behavior since 5.4.10 or 5.4.11).
- - (Parent class incorrectly using child constant in class property).
- - (zend_do_fcall_common_helper_SPEC does not handle exceptions properly).
- - (Show class_alias In get_declared_classes()).
-
-
-- PCRE:
-
-
-- SNMP:
-
- - (OO API, walk: $suffix_as_key is not working correctly).
-
-
-- Zip:
-
- - (Zip crash intermittently). (Anatol)
-
-
-
-
-
-Version 5.4.13
-
-
-- Core:
-
- - (Insteadof not work for class method in 5.4.11).
- - (Added HTTP codes as of RFC 6585).
- - (dval to lval different behavior on ppc64).
- - (Inheritance with Traits failed with error).
-
-- CLI server:
-
- - (buit-in web server is broken on ppc64).
-
-- Mbstring:
-
- - mb_split() can now handle empty matches like preg_split() does.
-
-- OpenSSL:
-
- - (openssl corrupts ssl key resource when using
- openssl_get_publickey()).
-
-- PDO_mysql:
-
- - (undefined symbol: mysqlnd_debug_std_no_trace_funcs).
-
-- Phar:
-
- - Fixed timestamp update on Phar contents modification.
-
-- SOAP:
-
- - Added check that soap.wsdl_cache_dir conforms to open_basedir
- (CVE-2013-1635).
- - Disabled external entities loading (CVE-2013-1643, CVE-2013-1824).
-
-- SPL:
-
- - (SPLFixedArray toArray problem).
- - (RecursiveDirectoryIterator always assumes SKIP_DOTS).
- - (Segfault on SplFixedArray[][x] = y when extended).
- - (unset fails with ArrayObject and deep arrays).
-
-- SNMP:
-
-
-
-
-
-Version 5.4.12
-
-
-- Core:
-
- - (Wrong TSRM usage in zend_register_class alias).
- - (get_html_translation_table() output incomplete with HTML_ENTITIES and ISO-8859-1).
- - (isset() inconsistently produces a fatal error on protected property).
- - (Bad warning text from strpos() on empty needle).
- - (Use after scope error in zend_compile).
- - (Poor efficiency of strtr() using array with keys of very different length).
- - (zend_std_compare_objects crash on recursion).
- - (Magic methods called twice for unset protected properties).
- - (fopen follows redirects for non-3xx statuses).
- - Support BITMAPV5HEADER in getimagesize().
-
-
-
-
-- Date:
-
- - (Performance improvements for various ext/date functions).
- - Comparsion of incomplete DateTime causes SIGSEGV.
-
-
-
-
-- FPM:
-
- - (php with fpm fails to build on Solaris 10 or 11).
-
-
-
-
-- Litespeed:
-
- - (-Werror=format-security error in lsapi code).
-
-
-
-
-- sqlite3:
-
- - (sqlite3::bindvalue and relative PHP functions aren't using sqlite3_*_int64 API).
-
-
-
-
-- PDO_OCI:
-
- - (Multi-row BLOB fetches).
- - (Segfault in PDO_OCI on cleanup after running a long testsuite).
-
-
-
-
-- PDO_sqlite:
-
- - (PDO::PARAM_INT casts to 32bit int internally even on 64bit builds in pdo_sqlite).
-
-
-
-
-
-
-Version 5.4.11
-
-
-- Core:
-
- - (Sigsegv when Exception::$trace is changed by user).
- - (Errors in eval()'ed code produce status code 500).
-
-
-
-
-- Filter:
-
- - (getenv() produces memory leak with CGI SAPI).
- - (FILTER_VALIDATE_INT does not accept +0 and -0).
-
-
-
-
-- JSON:
-
- - (json_decode does not properly decode with options parameter).
-
-
-
-
-- CLI server:
-
- - Update list of common mime types. Added webm, ogv, ogg.
-
-
-
-
-- cURL extension:
-
- - Fixed bug (segfault due to libcurl connection caching).
- - (Memory leak when reusing curl-handle).
- - (CURL >= 7.28.0 no longer support value 1 for CURLOPT_SSL_VERIFYHOST).
- - (Can't enable hostname validation when using curl stream wrappers).
- - (Curlwapper is not sending http header randomly).
-
-
-
-
-
-
-Version 5.4.10
-
-
-- Core:
-
- - (Segfault in gc_collect_cycles).
- - (parse_ini_file() with INI_SCANNER_RAW removes quotes from value).
- - (wrong called method as callback with inheritance).
- - (config.guess file does not have AIX 7 defined, shared objects are not created).
- - (Crasher in tt-rss backend.php).
- - (ob_start callback gets passed empty string).
-
-
-
-
-- Date:
-
- - (Poor date() performance).
- - (Datetime::format('u') sometimes wrong by 1 microsecond).
-
-
-
-
-- Imap:
-
- - (DISABLE_AUTHENTICATOR ignores array).
-
-
-
-
-- Json:
-
- - (use php_next_utf8_char and remove duplicate implementation).
-
-
-
-
-
-
-- MySQLnd:
-
- - (Segfault when polling closed link).
-
-
-
-
-- Fileinfo:
-
- - (Different results in TS and NTS under Windows).
-
-
-
-
-- FPM:
-
- - Possible null dereference and buffer overflow.
-
-
-
-
-- Pdo_sqlite:
-
- - getColumnMeta should return the table name when system SQLite used.
-
-
-
-
-- Apache2 Handler SAPI:
-
- - Enabled Apache 2.4 configure option for Windows.
-
-
-
-
-- Reflection:
-
- - (Fatal error on Reflection).
-
-
-
-
-- SOAP:
-
- - (SOAP wsdl cache is not enabled after initial requests).
-
-
-
-
-- Sockets:
-
- - (Add SO_REUSEPORT support for socket_set_option()).
-
-
-
-
-
-
-Version 5.4.9
-
-
-- Core:
-
- - (zend_mm_heap corrupted with traits).
- - ((un)serialize() leaves dangling pointers, causes crashes).
- - (PHP fails to open Windows deduplicated files).
- - (Handle leak in is_readable on windows).
-
-
-
-
-- Curl:
-
- - (Curl silently accepts boolean true for SSL_VERIFYHOST).
-
-
-
-
-- Fileinfo:
-
- - (Load multiple magic files from a directory under Windows).
-
-
-
-
-- Libxml
-
- - (Missing context check on libxml_set_streams_context()
- causes memleak).
-
-
-
-
-- Mbstring:
-
- - (max_input_vars doesn't filter variables when
- mbstring.encoding_translation = On).
-
-
-
-
-- OCI8:
-
- - (Add ORA-00028 to the PHP_OCI_HANDLE_ERROR macro)
-
-
-
-
-- PCRE:
-
- - (Corruption of hash tables).
- - (Segfault in zend_gc with SF2 testsuite).
- - (Upgrade PCRE to 8.31).
-
-
-
-
-- PDO:
-
- - (buffer overflow in use of SQLGetDiagRec).
-
-
-
-
-- PDO_pgsql:
-
- - (Emulate prepares behave strangely with PARAM_BOOL).
-
-
-
-
-- Phar:
-
- - (Phar fails to write an openssl based signature).
-
-
-
-
-- Streams:
-
- - (stream_get_line() return contains delimiter string).
-
-
-
-
-- Reflection:
-
- - (ReflectionClass::getTraitAliases() incorrectly resolves traitnames).
-
-
-
-
-
-Version 5.4.8
-
-
-- CLI server
-
- - Changed response to unknown HTTP method to 501 according to RFC.
- - Support HTTP PATCH method.
-
-
-
-
-- Core
-
- - Added optional second argument for assert() to specify custom message.
- - Support building PHP with the native client toolchain.
- - Added --offline option for tests.
- - (parse_url does not match password component).
- - (is_callable() lies for abstract static method).
- - (Segfault while load extension failed in zts-build).
- - (Notice: could not be converted to int when comparing some builtin classes).
- - (Only one directive is loaded from "Per Directory Values" Windows registry).
- - (Double free when use traits).
- - (Shutdown functions not called in certain error situation).
- - (custom error handler throwing Exception + fatal error = no shutdown function).
- - (error_log error time has changed to UTC ignoring default timezone).
-
-
-
-
-- cURL
-
- - (file_get_contents a remote file by Curl wrapper will cause cpu Soaring).
-
-
-
-
-- Date
-
- - ("DateTime->modify('+0 days')" modifies DateTime object)
- - (DateTime add 'P1D' adds 25 hours).
-
-
-
-
-- DOM
-
- - (Incorrect arginfo for DOMErrorHandler).
-
-
-
-
-- FPM
-
- - (startup problems fpm / php-fpm).
- - (PHP-FPM may segfault/hang on startup).
- - (Systemd integration and daemonize).
- - (Unneccesary warnings on FPM).
- - (Only /status?plain&full gives "last request cpu").
- - (Add PID to php-fpm init.d script).
-
-
-
-
-- OpenSSL
-
- - (OpenSSL signature verification missing RMD160, SHA224, SHA256, SHA384, SHA512).
-
-
-
-
-- SOA
-
- - (SOAP Error when trying to submit 2nd Element of a choice).
-
-
-
-
-- SPL
-
- - (Assigning to ArrayObject[null][something] overrides all undefined variables).
-
-
-
-
-- mbstring
-
- - Allow passing null as a default value to mb_substr() and mb_strcut(). Patch by Alexander Moskaliov via GitHub PR .
-
-
-
-
-- Filter extension
-
- - (Boolean validation fails with FILTER_NULL_ON_FAILURE with empty string or false.)
-
-
-
-
-- Socket
-
- - (MCAST_JOIN_GROUP on OSX is broken, merge of PR 185 by Igor Wiedler).
-
-
-
-
-
-Version 5.4.7
-
-
-- Core
-
- - Fixed bug (segfault while build with zts and GOTO vm-kind)
- - (Only one directive is loaded from "Per Directory Values" Windows registry)
- - (parse_url() does not recognize //)
- - (stdint.h included on platform where HAVE_STDINT_H is not set)
- - (register_shutdown_function and extending class)
- - (Calling exit() in a shutdown function does not return the exit value)
- - (dangling pointers made by zend_disable_class)
- - (munmap() is called with the incorrect length)
- - (Segfault when using traits a lot)
- - (implementing __toString and a cast to string fails)
- - (Fatal error raised by var_export() not caught by error handler)
- - (Stat and Dir stream wrapper methods do not call constructor)
-
-
-
-
-- CURL
-
- - (CURLINFO_PRIMARY_* AND CURLINFO_LOCAL_* not exposed)
- - (curl_copy_handle segfault with CURLOPT_FILE)
-
-
-
-
-- DateTime
-
- - (Unserialize invalid DateTime causes crash)
-
-
-
-
-- Intl
-
- - Fixed Spoofchecker not being registered on ICU 49.1
- - (ext/intl compilation error on icu 3.4.1)
- - (defective cloning in several intl classes)
-
-
-
-
-- Installation
-
- - (php binaries installed as binary.dSYM)
-
-
-
-
-- PCRE
-
- - (preg_replace should fail on trailing garbage)
-
-
-
-
-- PDO
-
- - (Wrong return datatype in PDO::inTransaction())
-
-
-
-
-- Reflection
-
- - (ReflectionClass::getTraitAliases crashes on importing trait methods as private)
- - (ReflectionParameter::isDefaultValueAvailable() wrong result)
-
-
-
-
-- Session
-
- - Fixed bug (segfault due to retval is not initialized)
- - Fixed bug (segfault due to PS(mod_user_implemented) not be reseted when close handler call exit)
-
-
-
-
-- SPL
-
- - (Crash when cloning an object which inherits SplFixedArray)
- - (Add sort flag to ArrayObject::ksort)
-
-
-
-
-- Standard
-
- - (Seg fault or broken object references on unserialize())
-
-
-
-
-- FPM
-
- - Merged PR 121 by minitux to add support for slow request counting on PHP FPM status page
-
-
-
-
-
-Version 5.4.6
-
-
-- CLI Server
-
- - (have the console output 'Listening on http://localhost:8000').
-
-
-
-
-- Core
-
- - (Interactive php-cli crashes if include() is used in auto_prepend_file).
- - : (unset($array[$float]) causes a crash).
- - (Crashes due non-initialized internal properties_table).
- - (--with-zend-multibyte and --enable-debug reports LEAK with run-test.php).
-
-
-
-
-- CURL
-
- - (curl_setopt($ch, CURLOPT_COOKIEFILE, "") returns false).
-
-
-
-
-- DateTime
-
- - (Segfault in DateInterval class when extended).
-
-
-
-
-- Fileinfo
-
- - (finfo_open with directory causes invalid free).
-
-
-
-
-- Intl
-
- - (Extending MessageFormatter and adding property causes crash).
-
-
-
-
-- MySQLnd
-
- - (segfault in mysqlnd_res_meta::set_mode).
-
-
-
-
-- readline
-
- - (readline extension compilation fails with sapi/cli/cli.h: No such file).
-
-
-
-
-- Reflection
-
- - (Allow access to name of constant used as default value).
-
-
-
-
-- SimpleXML
-
- - (Get namespaces from current node).
-
-
-
-
-- SPL
-
- - (ArrayIterator::count() from IteratorIterator instance gives Segmentation fault).
- - (ArrayIterator gives misleading notice on next() when moved to the end).
-
-
-
-
-- Streams
-
- - (segfault in php_stream_wrapper_log_error with ZTS build).
-
-
-
-
-- Zlib
-
- - (ob_gzhandler always conflicts with zlib.output_compression).
-
-
-
-
-
-Version 5.4.5
-
-
-- Core
-
- - (Crypt SHA256/512 Segfaults With Malformed Salt)
- - (ReflectionMethod random corrupt memory on high concurrent)
- - (serialize() generates wrong reference to the object).
- - (compile failure: (S) Arguments missing for built-in function __memcmp)
- - (Using traits with method aliases appears to result in crash during execution)
- - (parse_ini_file() with INI_SCANNER_RAW cuts a value that includes a semi-colon)
- - Fixed potential overflow in _php_stream_scandir (CVE-2012-2688)
-
-
-
-
-- EXIF
-
- - Fixed information leak in ext exif
-
-
-
-
-- FPM
-
- - (php-fpm segfaults (null passed to strstr)
- - (Add process.priority to set nice(2) priorities)
- - (when using unix sockets, multiples FPM instances)
- - (php-fpm exits with status 0 on some failures to start)
- - (Unable to cross-compile PHP with --enable-fpm)
- - (php-fpm is not allowed to run as root)
- - (php-fpm should not fail with commented 'user'
- - (FPM drops connection while receiving some binary values in FastCGI requests)
- - (fpm don't send error log to fastcgi clients). (fat) for non-root start)
- - (FPM pools can listen on the same address). (fat) can be launched without errors)
-
-
-
-
-- Iconv
-
-- (Erealloc in iconv.c unsafe)
-
-
-
-
-- Intl
-
- - (grapheme_extract() memory leaks)
- - (IntlDateFormatter constructor leaks memory when called twice)
- - (Collator::getSortKey() returns garbage)
- - (datefmt_create with incorrectly encoded timezone leaks pattern)
- - (memory leak in IntlDateFormatter constructor)
- - ResourceBundle constructor now accepts NULL for the first two arguments
-
-
-
-
-- JSON
-
- - (json_encode() calls too many reallocs)
-
-
-
-
-- libxml
-
- - (Custom extension segfaults during xmlParseFile with FPM SAPI)
-
-
-
-
-- Phar
-
- - (Invalid phar stream path causes crash)
-
-
-
-
-- Readline
-
- - (readline fails to compile - void function should not return a value)
-
-
-
-
-- Reflection
-
- - (Attempting to invoke a Closure more than once causes segfault)
- - (ReflectionParameter::getDefaultValue() memory leaks with constant)
-
-
-
-
-- Sockets
-
- - (__ss_family was changed on AIX 5.3)
-
-
-
-
-- SPL
-
- - (Inconsistent behavior of RecursiveDirectoryIterator to dot files)
- - (RecursiveArrayIterator does not implement Countable)
-
-
-
-
-- XML Writer
-
- - (memory leak in the XML Writer module)
-
-
-
-
-- Zip
-
- - Upgraded libzip to 0.10.
-
-
-
-
-
-Version 5.4.4
-
-
-- CLI SAPI
-
- - (Need CLI web-server support for files with .htm & svg extensions)
- - Improved performance while sending error page, this also fixed bug
- (Memory leak when access a non-exists file without router)
- - (functions related to current script failed when chdir() in cli sapi)
-
-
-
-
-- Core
-
- - Fixed missing bound check in iptcparse()
- - Fixed CVE-2012-2143
- - (fix for bug )
- - (unexpected behavior when incrementally assigning to a member of a null object)
- - (Object recursion not detected for classes that implement JsonSerializable)
- - (long overflow in realpath_cache_get())
- - (ZTS build doesn't accept zend.script_encoding config)
- - (incorrect \e processing on Windows)
- - (__clone/__destruct do not match other methods when checking access controls)
- - ('Overriding' a private static method with a different signature causes crash)
- - (Segfault from array_walk modifying an array passed by reference)
- - (PHP crash when calling ob_start in request_shutdown phase)
- - (bin2hex(hex2bin($data)) != $data)
- - (ini parser crashes when using ${xxxx} ini variables (without apache2))
- - (header_remove() does not remove all headers)
- - (wrong equality of string numbers)
- - ([PATH=] sections incompatibility with user_ini.filename set to null)
- - Changed php://fd to be available only for CLI
-
-
-
-
-- CURL
-
- - (CURLOPT_COOKIEFILE '' raises open_basedir restriction)
-
-
-
-
-- COM
-
- - com_dotnet cannot be built shared
-
-
-
-
-- Fileinfo
-
- - (Uninitialised value used in libmagic)
-
-
-
-
-- FPM
-
- - (Uninitialised value used in libmagic)
- - where php_stream_open_wrapper_ex tries to open a directory descriptor under windows
- - failure caused by the posix lseek and read versions under windows in cdf_read()
-
-
-
-
-
-
-- Intl
-
- - (Memory corruption in internal function get_icu_disp_value_src_php()
-
-
-
-
-- JSON
-
- - (json_encode() incorrectly truncates/discards information)
-
-
-
-
-- LibXML
-
- - (Libxml tests failed(ht is already destroyed))
-
-
-
-
-- PDO
-
- - (A parsing bug in the prepared statements can lead to access violations). (CVE-2012-3450)
-
-
-
-
-- Phar
-
-- (Secunia SA44335) (CVE-2012-2386)
-
-
-
-
-- Streams
-
- - (file_get_contents leaks when access empty file with maxlen set)
-
-
-
-
-- zlib
-
- - (using ob_gzhandler will complain about headers already sent when no compression)
- - (can't change zlib.output_compression on the fly)
- - (zlib.output_compression fails on refresh)
-
-
-
-
-
-Version 5.4.3
-
-
-
- - Buffer Overflow in apache_request_headers, CVE-2012-2329.
- - Improve fix for PHP-CGI query string parameter vulnerability, CVE-2012-2311.
-
-
-
-
-Version 5.4.2
-
-
-
- - Fix PHP-CGI query string parameter vulnerability, CVE-2012-1823.
-
-
-
-
-
-
-Version 5.4.1
-
-
-
-- CLI Server
-
- - (missing checks around malloc() calls).
- - (Built in web server does not set
- $_SERVER['SCRIPT_FILENAME'] when using router).
-
-
-
-
-- Core
-
- - Fixed crash in ZTS using same class in many threads.
- - (html_entity_decode tries to decode code points that don't
- exist in ISO-8859-1).
- - (Incorrect lexing of 0b00*+<NUM>).
- - (Segfault when using header_register_callback).
- - (Missing error check in trait 'insteadof' clause).
- - (Crash when an exception is thrown by __autoload
- accessing a static property).
- - (exit code incorrect).
- - (Confusing error message when extending traits).
- - (Order of traits in use statement can cause a fatal
- error).
- - (type hinting with "self" keyword causes weird errors).
-
-
-
-
-- Fileinfo
-
- - Fix fileinfo test problems.
-
-
-
-
-- Intl
-
- - (Incorrent bounds checking in grapheme_strpos).
-
-
-
-
-- mbstring
-
- - MFH mb_ereg_replace_callback() for security enhancements.
-
-
-
-
-- mysqlnd
-
- - (mysqlnd FTBFS when -Wformat-security is enabled).
-
-
-
-
-- Standard
-
- - Fixed memory leak in substr_replace.
- - Make max_file_uploads ini directive settable outside of php.
- - (Bad formatting on phpinfo()).
- - (time_nanosleep() does validate input params).
- - (stream_socket_server silently truncates long unix socket
- paths).
-
-
-
-
-
-Version 5.4.0
-
-
-
-- autoconf 2.59+ is now supported (and required) for generating the
- configure script with ./buildconf. Autoconf 2.60+ is desirable
- otherwise the configure help order may be incorrect.
-
-
- - Removed legacy features
-
- - break/continue $var syntax.
- - Safe mode and all related ini options.
- - register_globals and register_long_arrays ini options.
- - import_request_variables().
- - allow_call_time_pass_reference.
- - define_syslog_variables ini option and its associated function.
- - highlight.bg ini option.
- - Session bug compatibility mode (session.bug_compat_42 and
- session.bug_compat_warn ini options).
- - session_is_registered(), session_register() and session_unregister()
- functions.
- - y2k_compliance ini option.
- - magic_quotes_gpc, magic_quotes_runtime and magic_quotes_sybase
- ini options. get_magic_quotes_gpc, get_magic_quotes_runtime are kept
- but always return false, set_magic_quotes_runtime raises an
- E_CORE_ERROR.
- - Removed support for putenv("TZ=..") for setting the timezone.
- - Removed the timezone guessing algorithm in case the timezone isn't set with
- date.timezone or date_default_timezone_set(). Instead of a guessed
- timezone, "UTC" is now used instead.
-
-
-
-
-- Moved extensions to PECL
-
- - ext/sqlite. (Note: the ext/sqlite3 and ext/pdo_sqlite extensions are
- not affected)
-
-
-
-
-- General improvements
-
- - Added short array syntax support ([1,2,3]), see UPGRADING guide for full
- details.
- - Added binary numbers format (0b001010).
- - Added support for Class::{expr}() syntax.
- - Added multibyte support by default. Previously php had to be compiled
- with --enable-zend-multibyte. Now it can be enabled or disabled through
- zend.multibyte directive in php.ini.
- - Removed compile time dependency from ext/mbstring.
- - Added support for Traits.
- - Added closure $this support back.
- - Added array dereferencing support.
- - Added callable typehint.
- - Added indirect method call through array. .
- - Added DTrace support.
- - Added class member access on instantiation (e.g. (new foo)->bar()) support.
- - <?= is now always available regardless of the short_open_tag setting.
- - Implemented Zend Signal Handling (configurable option --enable-zend-signals,
- off by default).
- - Improved output layer, see README.NEW-OUTPUT-API for internals.
- - Improved unix build system to allow building multiple PHP binary SAPIs and
- one SAPI module the same time. , .
- - Implemented closure rebinding as parameter to bindTo.
- - Improved the warning message of incompatible arguments.
- - Improved ternary operator performance when returning arrays.
-
- Changed error handlers to only generate docref links when the docref_root
- INI setting is not empty.
- - Changed silent conversion of array to string to produce a notice.
- - Changed default value of "default_charset" php.ini option from ISO-8859-1 to
- UTF-8.
- - Changed silent casting of null/''/false into an Object when adding
- a property into a warning.
- - Changed E_ALL to include E_STRICT.
- - Disabled windows CRT warning by default, can be enabled again using the ini
- directive windows_show_crt_warnings.
- - : Binary number literal returns float number though its
- value is small enough.
-
-
-
-
-- Improved Zend Engine memory usage
-
- - Improved parse error messages.
- - Replaced zend_function.pass_rest_by_reference by
- ZEND_ACC_PASS_REST_BY_REFERENCE in zend_function.fn_flags.
- - Replaced zend_function.return_reference by ZEND_ACC_RETURN_REFERENCE
- in zend_function.fn_flags.
- - Removed zend_arg_info.required_num_args as it was only needed for internal
- functions. Now the first arg_info for internal functions (which has special
- meaning) is represented by zend_internal_function_info structure.
- - Moved zend_op_array.size, size_var, size_literal, current_brk_cont,
- backpatch_count into CG(context) as they are used only during compilation.
- - Moved zend_op_array.start_op into EG(start_op) as it's used only for
- 'interactive' execution of single top-level op-array.
- - Replaced zend_op_array.done_pass_two by ZEND_ACC_DONE_PASS_TWO in
- zend_op_array.fn_flags.
- - op_array.vars array is trimmed (reallocated) during pass_two.
-
- Replaced zend_class_entry.constants_updated by ZEND_ACC_CONSTANTS_UPDATED
- in zend_class_entry.ce_flags.
- - Reduced the size of zend_class_entry by sharing the same memory space
- by different information for internal and user classes.
- See zend_class_entry.info union.
- - Reduced size of temp_variable.
-
-
-
-
-- Improved Zend Engine, performance tweaks and optimizations
-
- - Inlined most probable code-paths for arithmetic operations directly into
- executor.
- - Eliminated unnecessary iterations during request startup/shutdown.
- - Changed $GLOBALS into a JIT autoglobal, so it's initialized only if used.
- (this may affect opcode caches!)
- - Improved performance of @ (silence) operator.
- - Simplified string offset reading. $str[1][0] is now a legal construct.
- - Added caches to eliminate repeatable run-time bindings of functions,
- classes, constants, methods and properties.
- - Added concept of interned strings. All strings constants known at compile
- time are allocated in a single copy and never changed.
- - ZEND_RECV now always has IS_CV as its result.
- - ZEND_CATCH now has to be used only with constant class names.
- - ZEND_FETCH_DIM_? may fetch array and dimension operands in different order.
- - Simplified ZEND_FETCH_*_R operations. They can't be used with the
- EXT_TYPE_UNUSED flag any more. This is a very rare and useless case.
- ZEND_FREE might be required after them instead.
- - Split ZEND_RETURN into two new instructions ZEND_RETURN and
- ZEND_RETURN_BY_REF.
- - Optimized access to global constants using values with pre-calculated
- hash_values from the literals table.
- - Optimized access to static properties using executor specialization.
- A constant class name may be used as a direct operand of ZEND_FETCH_*
- instruction without previous ZEND_FETCH_CLASS.
- - zend_stack and zend_ptr_stack allocation is delayed until actual usage.
-
-
-
-
-- Other improvements to Zend Engine
-
- - Added an optimization which saves memory and emalloc/efree calls for empty
- HashTables.
- - Added ability to reset user opcode handlers.
- - Changed the structure of op_array.opcodes. The constant values are moved from
- opcode operands into a separate literal table.
- - Fixed (disabled) inline-caching for ZEND_OVERLOADED_FUNCTION methods.
- - (Interface implementation / inheritence not possible in
- abstract classes).
-
-
-
-
-- Improved core functions
-
- - Added optional argument to debug_backtrace() and debug_print_backtrace()
- to limit the amount of stack frames returned.
- - Added hex2bin() function.
- - number_format() no longer truncates multibyte decimal points and thousand
- separators to the first byte. .
- - Added support for object references in recursive serialize() calls.
- .
- - Added support for SORT_NATURAL and SORT_FLAG_CASE in array
- sort functions (sort, rsort, ksort, krsort, asort, arsort and
- array_multisort). .
- - Added stream metadata API support and stream_metadata() stream class
- handler.
- - User wrappers can now define a stream_truncate() method that responds
- to truncation, e.g. through ftruncate(). .
- - Improved unserialize() performance.
- - Changed array_combine() to return empty array instead of FALSE when both
- parameter arrays are empty. .
- - Fixed invalid free in call_user_method() function.
- - Fixed crypt_blowfish handling of 8-bit characters. (CVE-2011-2483).
- - (Incorect lexing of 0x00*+<NUM>).
- - (Buffer overflow on htmlspecialchars/entities with
- $double=false).
- - (Possible invalid handler usage in windows random
- functions).
- - (unserialize() Does not invoke __wakeup() on object).
- - (Segfault when running symfony 2 tests).
- - (TRAITS - PHPDoc Comment Style Bug).
- - (httpd.worker segfault on startup with php_value).
- - (Segmentation fault with $cls->{expr}() syntax).
- - (Segmentation fault with Cls::{expr}() syntax).
- - (Invalid read and writes).
- - (Traits Segfault).
- - (Segmentation fault with include & class extending).
- - (non-existent sub-sub keys should not have values).
- - (No string escape code for ESC (ascii 27), normally \e).
- - (ob_get_status(true) no longer returns an array when
- buffer is empty).
- - (Segfault when using ob_gzhandler() with open buffers).
- - (invalid read/writes when unserializing specially crafted
- strings).
- - (header() cannot detect the multi-line header with
- CR(0x0D)).
- - (Notice when array in method prototype error).
- - (Conjunction of ternary and list crashes PHP).
- - (proc_open's streams may hang with stdin/out/err when the data exceeds or is equal to 2048 bytes).
-
- (__halt_compiler() works in braced namespaces).
- - (SIGALRM cause segfault in php_error_cb).
- - (GCC does not provide __sync_fetch_and_add on some archs).
- - (Interruption in substr_replace()).
- - (Missing initial value of static locals in trait methods).
- - (Behavior of unserialize has changed).
- - (memory corruption in parse_ini_string).
- - (Digest Authenticate missed in 5.4) .
- - (multiple NULL Pointer Dereference with zend_strndup())
- (CVE-2011-4153).
- - (TOCTOU issue in getenv() on Windows builds).
- - (undefined reference to `__sync_fetch_and_add_4' on Linux
- parisc).
- - (Omitting a callable typehinted argument causes a segfault).
- - (is_a() triggers autoloader, new optional 3rd argument to
- is_a and is_subclass_of).
- - (ZTS build broken with dtrace).
- - (recursive mkdir fails with current (dot) directory in path).
- - (Function registered by header_register_callback is
- called only once per process).
- - Implement (Get php binary path during script execution).
- - (tempnam() by-pass open_basedir with nonexistent
- directory).
- - (iconv() returns part of string on error).
- - (Include fails with toplevel symlink to /).
-
-
-
-
-- Improved generic SAPI support
-
- - Added $_SERVER['REQUEST_TIME_FLOAT'] to include microsecond precision.
- - Added max_input_vars directive to prevent attacks based on hash collisions.
- - Added header_register_callback() which is invoked immediately
- prior to the sending of headers and after default headers have
- been added.
- - Added http_response_code() function. .
- - (Corrupted $_FILES indices lead to security concern).
- - (Insufficient validating of upload name leading to
- corrupted $_FILES indices).
-
-
-
-
-- Improved Apache SAPI
-
- - (possible integer overflow in content_length).
-
-
-
-
-- Improved CLI SAPI
-
- - Added friendly log messages. .
- - Added built-in web server that is intended for testing purpose.
- - Added command line option --rz <name> which shows information of the
- named Zend extension.
- - Interactive readline shell improvements
-
- - Added "cli.pager" php.ini setting to set a pager for output.
- - Added "cli.prompt" php.ini setting to configure the shell prompt.
- - Added shortcut #inisetting=value to change ini settings at run-time.
- - Changed shell not to terminate on fatal errors.
- - Interactive shell works with shared readline extension. .
-
- - (Memory leak when access a non-exists file).
- - (PHP Errors are not reported in browsers using built-in
- SAPI).
- - (Segfault after two multipart/form-data POST requests,
- one 200 RQ and one 404).
- - Implement (Missing $_SERVER['SERVER_PORT']).
- - ($_SERVER["PHP_SELF"] incorrect).
- - (Router returns false, but POST is not passed to requested
- resource).
- - (Last 2 lines of page not being output).
- - (memory definitely lost in cli server).
- - (If URI does not contain a file, index.php is not served).
- - (memory leak when using built-in server).
- - (SegFault when outputting header WWW-Authenticate).
- - (request headers missed in $_SERVER).
- - (Changing the working directory makes router script
- inaccessible).
- - (cli-server missing _SERVER[REMOTE_ADDR]).
- - (Built in web server not accepting file uploads).
- - (cli-server could not output correctly in some case).
-
-
-
-
-- Improved CGI/FastCGI SAPI
-
- - Added apache compatible functions: apache_child_terminate(),
- getallheaders(), apache_request_headers() and apache_response_headers().
- - Improved performance of FastCGI request parsing.
- - Fixed reinitialization of SAPI callbacks after php_module_startup().
-
-
-
-
-- Improved PHP-FPM SAPI
-
- - Added partial syslog support (on error_log only). .
- - Added .phar to default authorized extensions.
- - Added process.max to control the number of process FPM can fork. .
- - Dropped restriction of not setting the same value multiple times, the last
- one holds.
- - Lowered default value for Process Manager. .
- - Enhanced security by limiting access to user defined extensions.
- .
- - Enhanced error log when the primary script can't be open. .
- - Removed EXPERIMENTAL flag.
- - (FPM does not clear auth_user on request accept).
- - (memory corruption when web server closed the fcgi fd).
-
-
-
-
-- Improved Litespeed SAPI
-
- - (Make Fails with "Missing Separator" error).
-
-
-
-
-- Improved BCmath extension
-
- - (bcscale related crashes on 64bits platforms).
-
-
-
-- Improved CURL extension
-
- - Added support for CURLOPT_MAX_RECV_SPEED_LARGE and
- CURLOPT_MAX_SEND_SPEED_LARGE. .
- - (curl_copy_handle segfault when used with
- CURLOPT_PROGRESSFUNCTION).
-
-
-
-- Improved Date extension
-
- - Added the + modifier to parseFromFormat to allow trailing text in the
- string to parse without throwing an error.
-
-
-
-- Improved DBA extension
-
- - Added Tokyo Cabinet abstract DB support.
- - Added Berkeley DB 5 support.
-
-
-
-- Improved DOM extension
-
- - Added the ability to pass options to loadHTML.
-
-
-
-- Improved filesystem functions
-
- - scandir() now accepts SCANDIR_SORT_NONE as a possible sorting_order value.
- .
-
-
-
-- Improved fileinfo extension
-
- - Fixed possible memory leak in finfo_open().
- - Fixed memory leak when calling the Finfo constructor twice.
- - (C++ comment fails in c89).
-
-
-
-- Improved HASH extension
-
- - Added Jenkins's one-at-a-time hash support.
- - Added FNV-1 hash support.
- - Made Adler32 algorithm faster. .
- - Removed Salsa10/Salsa20, which are actually stream ciphers.
- - (Tiger hash output byte order).
-
-
-
-- Improved intl extension
-
- - Added Spoofchecker class, allows checking for visibly confusable characters and
- other security issues.
- - Added Transliterator class, allowing transliteration of strings.
- - Added support for UTS #46.
- - Fixed memory leak in several Intl locale functions.
- - Fixed build on Fedora 15 / Ubuntu 11.
- - (grapheme_substr() returns false on big length).
-
-
-
-- Improved JSON extension
-
- - Added new json_encode() option JSON_UNESCAPED_UNICODE. .
- - Added JsonSerializable interface.
- - Added JSON_BIGINT_AS_STRING, extended json_decode() sig with $options.
- - Added support for JSON_NUMERIC_CHECK option in json_encode() that converts
- numeric strings to integers.
- - Added new json_encode() option JSON_UNESCAPED_SLASHES. .
- - Added new json_encode() option JSON_PRETTY_PRINT. .
-
-
-
-- Improved LDAP extension
-
- - Added paged results support. .
-
-
-
-- Improved mbstring extension
-
- - Added Shift_JIS/UTF-8 Emoji (pictograms) support.
- - Added JIS X0213:2004 (Shift_JIS-2004, EUC-JP-2004, ISO-2022-JP-2004)
- support.
- - Ill-formed UTF-8 check for security enhancements.
- - Added MacJapanese (Shift_JIS) and gb18030 encoding support.
- - Added encode/decode in hex format to mb_[en|de]code_numericentity().
- - Added user JIS X0213:2004 (Shift_JIS-2004, EUC-JP-2004, ISO-2022-JP-2004)
- support.
- - Added the user defined area for CP936 and CP950.
- - Fixed possible crash in mb_ereg_search_init() using empty pattern.
- - (Characters lost while converting from cp936 to utf8).
-
-
-
-- Improved MS SQL extension
-
- - (Compile failure with freetds 0.91).
-
-
-
-- Improved MySQL extensions
-
- - MySQL: Deprecated mysql_list_dbs(). .
- - mysqlnd: Added named pipes support. .
- - MySQLi: Added iterator support in MySQLi. mysqli_result implements
- Traversable.
- - PDO_mysql: Removed support for linking with MySQL client libraries older
- than 4.1.
- - ext/mysql, mysqli and pdo_mysql now use mysqlnd by default.
- - (mysql_pconnect leaks file descriptors on reconnect).
- - (PS crash with libmysql when binding same variable as
- param and out).
-
-
-
-- Improved OpenSSL extension
-
- - Added AES support. .
- - Added a "no_ticket" SSL context option to disable the SessionTicket TLS
- extension. .
- - Added no padding option to openssl_encrypt()/openssl_decrypt().
- - Use php's implementation for Windows Crypto API in
- openssl_random_pseudo_bytes.
- - On error in openssl_random_pseudo_bytes() made sure we set strong result
- to false.
- - Fixed segfault with older versions of OpenSSL.
- - Fixed possible attack in SSL sockets with SSL 3.0 / TLS 1.0.
- CVE-2011-3389.
- - (Crash when decoding an invalid base64 encoded string).
- - (Fixed NULL pointer dereference in
- stream_socket_enable_crypto, case when ssl_handle of session_stream is not
- initialized.
-
-
-
-- Improved Oracle Database extension (OCI8)
-
- - Increased maximum Oracle error message buffer length for new 11.2.0.3 size.
- - Improved internal initalization failure error messages.
- - (show normal warning text for OCI_NO_DATA).
-
-
-
-- Improved PDO
-
- - Fixed PDO objects binary incompatibility.
-
-
-
-- PDO DBlib driver
-
- - Added nextRowset support.
- - (Incorrectly merged PDO dblib patches break
- uniqueidentifier column type).
- - (PDO DBLIB Fails with OOM).
-
-
-
-- Improved Pdo Firebird driver
-
- - (segfaults if query column count less than param count).
- - ("bindValue" and "bindParam" do not work for PDO Firebird).
- - (segfaults when passing lowercased column name to
- bindColumn).
-
-
-
-- Improved PostgreSQL extension
-
- - Added support for "extra" parameter for PGNotify().
-
-
-
-- Improved preg extension
-
- - Changed third parameter of preg_match_all() to optional. .
-
-
-
-- Improved readline extension
-
- - (Enable callback support when built against libedit).
-
-
-
-- Improved Reflection extension
-
- - Added ReflectionClass::newInstanceWithoutConstructor() to create a new
- instance of a class without invoking its constructor. .
- - Added ReflectionExtension::isTemporary() and
- ReflectionExtension::isPersistent() methods.
- - Added ReflectionZendExtension class.
- - Added ReflectionClass::isCloneable().
- - (Reflection and Late Static Binding).
- - (__toString() method triggers E_NOTICE "Array to string
- conversion").
-
-
-
-- Improved Session extension
-
- - Expose session status via new function, session_status. .
- - Added support for object-oriented session handlers.
- - Added support for storing upload progress feedback in session data.
- - Changed session.entropy_file to default to /dev/urandom or /dev/arandom if
- either is present at compile time.
- - (session.save_handler=user without defined function core
- dumps).
- - Implement (session_set_save_handler should support a core's
- session handler interface).
- - (invalid return values).
-
-
-
-- Improved SNMP extension
-
- - Added OO API. (php-snmp rewrite).
- - Sanitized return values of existing functions. Now it returns FALSE on
- failure.
- - Allow ~infinite OIDs in GET/GETNEXT/SET queries. Autochunk them to max_oids
- upon request.
- - Introducing unit tests for extension with ~full coverage.
- IPv6 support. ()
- - Way of representing OID value can now be changed when SNMP_VALUE_OBJECT
- is used for value output mode. Use or'ed SNMP_VALUE_LIBRARY(default if
- not specified) or SNMP_VALUE_PLAIN. ()
- - (SNMP module should not strip non-standard SNMP port
- from hostname).
- - (php build fails with USE flag snmp when IPv6 support
- is disabled).
- - (snmp_set_oid_output_format does not allow returning to default).
- - (snmprealwalk (snmp v1) does not handle end of OID tree correctly).
- - (snmp_set_quick_print() persists between requests).
- - (Snmp buffer limited to 2048 char).
- - (snmp v3 noAuthNoPriv doesn't work).
-
-
-
-- Improved SOAP extension
-
- - Added new SoapClient option "keep_alive". .
- - Fixed basic HTTP authentication for WSDL sub requests.
-
-
-
-- Improved SPL extension
-
- - Added RegexIterator::getRegex() method.
- - Added SplObjectStorage::getHash() hook.
- - Added CallbackFilterIterator and RecursiveCallbackFilterIterator.
- - Added missing class_uses(..) as pointed out by .
- - Immediately reject wrong usages of directories under Spl(Temp)FileObject
- and friends.
- - FilesystemIterator, GlobIterator and (Recursive)DirectoryIterator now use
- the default stream context.
- - (SplFileObject::setCsvControl does not expose third
- argument via Reflection).
- - (Wrong value for splFileObject::SKIP_EMPTY).
- - (spl_classes() not includes CallbackFilter classes)
-
-
-
-- Improved Sysvshm extension
-
- - (memory copy issue in sysvshm extension).
-
-
-
-- Improved Tidy extension
-
- - (Tidy::diagnose() NULL pointer dereference).
-
-
-
-- Improved Tokenizer extension
-
- - (token_get_all with regards to __halt_compiler is
- not binary safe).
-
-
-
-- Improved XSL extension
-
- - Added XsltProcessor::setSecurityPrefs($options) and getSecurityPrefs() to
- define forbidden operations within XSLT stylesheets, default is not to
- enable write operations from XSLT. .
- - XSL doesn't stop transformation anymore, if a PHP function can't be called
-
-
-
-- Improved ZLIB extension
-
- - Re-implemented non-file related functionality.
- - (ob_gzhandler always conflicts with zlib.output_compression).
-
-
-
-
-
-
-
-Version 5.3.29
-
-- Core:
-
- - (Segmentation fault with ArrayObject unset).
- - (spl_fixedarray_resize integer overflow).
- - (printf out-of-bounds read).
- - (iptcparse out-of-bounds read).
- - (convert_uudecode out-of-bounds read).
- - (Segfault in recursiveDirectoryIterator).
- - (insecure temporary file use in the configure script). (CVE-2014-3981)
- - (putenv with empty variable may lead to crash).
- - (unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion) (CVE-2014-3515).
- - (phpinfo() Type Confusion Information Leak Vulnerability). (CVE-2014-4721)
-
-- COM:
-
- - Fixed missing type checks in com_event_sink.
-
-- Date:
-
- - (Heap buffer over-read in DateInterval). (CVE-2013-6712)
- - (date_parse_from_format out-of-bounds read).
- - (timelib_meridian_with_check out-of-bounds read).
-
-- Exif:
-
- - (Integer overflow in exif_read_data()).
-
-- Fileinfo:
-
- - (Fileinfo crashes with powerpoint files).
- - (fileinfo: cdf_read_short_sector insufficient boundary check). (CVE-2014-0207)
- - (fileinfo: CDF infinite loop in nelements DoS). (CVE-2014-0238)
- - (fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation). (CVE-2014-0237)
- - (fileinfo: mconvert incorrect handling of truncated pascal string size) (CVE-2014-3478).
- - (fileinfo: cdf_check_stream_offset insufficient boundary check) (CVE-2014-3479).
- - (fileinfo: cdf_count_chain insufficient boundary check) (CVE-2014-3480).
- - (fileinfo: cdf_read_property_info insufficient boundary check) (CVE-2014-3487).
-
-- Intl:
-
- - (Locale::parseLocale Double Free).
- - (Buffer overflow in locale_get_display_name and uloc_getDisplayName (libicu 4.8.1)).
-
-- Network:
-
- - (Fix potential segfault in dns_get_record()). (CVE-2014-4049)
-
-- OpenSSL:
-
- - Fixed missing type checks in OpenSSL options.
-
-- Session:
-
- - Fixed missing type checks in php_session_create_id.
-
-
-
-
-
-Version 5.3.28
-
-- Openssl:
-
- - Fixed handling null bytes in subjectAltName (CVE-2013-4248).
- - Fixed memory corruption in openssl_x509_parse() (CVE-2013-6420). (Stefan Esser).
-
-
-
-
-
-Version 5.3.27
-
-- Core:
-
- - (segfault in zend_do_fcall_common_helper_SPEC).
- - (Segfault in gc_zval_possible_root).
- - (Apache2 TS crash with get_browser()).
- - (compile failure on netbsd).
-
-- DateTime:
-
- - (Crash when using unserialized DatePeriod instance).
-
-- PDO_firebird:
-
- - (Firebird return wrong value for numeric field).
- - (Cannot insert second row with null using parametrized query).
-
-- PDO_pgsql:
-
- - (Buffer overflow in _pdo_pgsql_error).
-
-- pgsql:
-
- - (pg_convert enum type support).
-
-- SPL:
-
- - (Segfault while using RecursiveIteratorIterator on 64-bits systems).
-
-- XML:
-
- - (heap corruption in xml parser). (CVE-2013-4113)
-
-
-
-
-
-Version 5.3.26
-
-
-- Core:
-
- - (Heap based buffer overflow in quoted_printable_encode, CVE-2013-2110).
-
-
-- Calendar:
-
- - (Integer overflow in SndToJewish).
-
-
-- FPM:
-
- - Fixed some possible memory or resource leaks and possible null dereference detected by code coverity scan.
- - Log a warning when a syscall fails.
-
-
-- MySQLi:
-
- - (Segfault when calling fetch_object on a use_result and DB pointer has closed).
-
-
-- Phar:
-
- - (PHAR PHPTs intermittently crash when run on DFS, SMB or with non std tmp dir).
-
-
-- Streams:
-
- - (stream_select() fails with pipes returned by proc_open() on Windows x64).
-
-
-- Zend Engine:
-
- - (Custom Exception crash when internal properties overridden).
-
-
-
-
-
-
-Version 5.3.25
-
-
-- Core:
-
- - (debug_backtrace in set_error_handler corrupts zend heap: segfault).
- - (dns_get_record result with string of length -1).
- - (fd leak on Solaris).
- - (fd leak on Solaris).
-
-- Streams:
-
- - Fixed Windows x64 version of stream_socket_pair() and improved error handling.
-
-- Zip:
-
- - (ZipArchive::addFile() has to check for file existence).
-
-
-
-
-
-Version 5.3.24
-
-
-- Core:
-
- - (microtime(true) less than $_SERVER['REQUEST_TIME_FLOAT']).
- - (zend_do_fcall_common_helper_SPEC does not handle exceptions properly).
- - (Show class_alias In get_declared_classes()).
-
-
-- PCRE:
-
-
-- mysqlnd:
-
- - (mysqlnd_stmt::bind_one_parameter crashes, uses wrong alloc for stmt->param_bind).
-
-
-- DateTime:
-
- - (Unserialize Invalid Date causes crash).
-
-
-- Zip:
-
- - (Zip crash intermittently).
-
-
-
-
-
-Version 5.3.23
-
-
-- Phar:
-
- - Fixed timestamp update on Phar contents modification.
-
-- SOAP
-
- - Added check that soap.wsdl_cache_dir conforms to open_basedir
- (CVE-2013-1635).
- - Disabled external entities loading (CVE-2013-1643, CVE-2013-1824).
-
-- SPL:
-
- - (SPLFixedArray toArray problem).
- - (RecursiveDirectoryIterator always assumes SKIP_DOTS).
- - (Segfault on SplFixedArray[][x] = y when extended).
- - (unset fails with ArrayObject and deep arrays).
-
-
-
-
-
-Version 5.3.22
-
-
-- Zend Engine:
-
- - (Wrong TSRM usage in zend_Register_class alias).
- - (Use after scope error in zend_compile).
-
-
-
-
-- Core:
-
- - (Bad warning text from strpos() on empty needle).
-
-
-
-
-- Date:
-
- - (comparsion of incomplete DateTime causes SIGSEGV).
-
-
-
-
-- FPM:
-
- - (php with fpm fails to build on Solaris 10 or 11).
-
-
-
-
-- SPL:
-
- - (Segfault on SplFixedArray[][x] = y when extended).
-
-
-
-
-
-Version 5.3.21
-
-
-- Zend Engine:
-
- - (Sigsegv when Exception::$trace is changed by user).
-
-
-
-
-- cURL extension:
-
- - Fixed bug (segfault due to libcurl connection caching).
- - (CURL >= 7.28.0 no longer support value 1 for CURLOPT_SSL_VERIFYHOST).
- - (Can't enable hostname validation when using curl stream wrappers).
- - (Curlwapper is not sending http header randomly).
-
-
-
-
-
-Version 5.3.20
-
-
-- Zend Engine:
-
- - (Segfault in gc_collect_cycles).
- - (parse_ini_file() with INI_SCANNER_RAW removes quotes from value).
- - (wrong called method as callback with inheritance).
-
-
-
-
-- Core:
-
- - (config.guess file does not have AIX 7 defined, shared objects are not created).
- - (Segfault on output buffer).
-
-
-
-
-- Apache2 Handler SAPI:
-
- - Enabled Apache 2.4 configure option for Windows.
-
-
-
-
-- Date:
-
- - (Datetime::format('u') sometimes wrong by 1 microsecond).
-
-
-
-
-- Fileinfo:
-
- - (Load multiple magic files from a directory under Windows).
- - (Different results in TS and NTS under Windows).
-
-
-
-
-- FPM:
-
- - (Possible null dereference and buffer overflow).
-
-
-
-
-- Imap:
-
- - (DISABLE_AUTHENTICATOR ignores array).
-
-
-
-
-- MySQLnd:
-
- - (Segfault when polling closed link).
-
-
-
-
-- Reflection:
-
- - (Fatal error on Reflection).
-
-
-
-
-- SOAP:
-
- - (SOAP wsdl cache is not enabled after initial requests).
-
-
-
-
-
-
-Version 5.3.19
-
-
-- Core:
-
- - (PHP fails to open Windows deduplicated files).
- - (Handle leak in is_readable on windows).
-
-
-
-
-- Libxml:
-
- - (Missing context check on libxml_set_streams_context() causes memleak).
-
-
-
-
-- Mbstring:
-
- - (max_input_vars doesn't filter variables when
- mbstring.encoding_translation = On).
-
-
-
-
-- MySQL:
-
- - Fixed compilation failure on mixed 32/64 bit systems.
-
-
-
-
-- OCI8:
-
- - (Add ORA-00028 to the PHP_OCI_HANDLE_ERROR macro)
-
-
-
-
-- PCRE:
-
- - (Segfault in zend_gc with SF2 testsuite).
- - (Upgrade PCRE to 8.31).
-
-
-
-
-- PDO:
-
- - (buffer overflow in use of SQLGetDiagRec).
-
-
-
-
-- PDO_pgsql:
-
- - (Emulate prepares behave strangely with PARAM_BOOL).
-
-
-
-
-- Phar:
-
- - (Phar fails to write an openssl based signature).
-
-
-
-
-- Streams:
-
- - (stream_get_line() return contains delimiter string).
-
-
-
-
-
-Version 5.3.18
-
-
-- Core
-
- - (is_callable() lies for abstract static method).
- - (Segfault while load extension failed in zts-build).
- - (Notice: could not be converted to int when comparing some builtin classes).
- - (Shutdown functions not called in certain error situation).
- - (exception threw in __autoload can not be catched).
- - (custom error handler throwing Exception + fatal error = no shutdown function).
-
-
-
-
-- cURL
-
- - (file_get_contents a remote file by Curl wrapper will cause cpu Soaring).
-
-
-
-
-- FPM
-
- - (startup problems fpm / php-fpm).
- - (PHP-FPM may segfault/hang on startup).
- - (Systemd integration and daemonize).
- - (Unneccesary warnings on FPM).
- - (Only /status?plain&full gives "last request cpu").
- - (Add PID to php-fpm init.d script).
-
-
-
-
-- Intl
-
- - (defective cloning in several intl classes).
-
-
-
-
-- SOAP
-
- - (SOAP Error when trying to submit 2nd Element of a choice).
-
-
-
-
-- SPL
-
- - (Assigning to ArrayObject[null][something] overrides all undefined variables).
-
-
-
-
-
-Version 5.3.17
-
-
-- Core
-
- - Fixed bug (segfault while build with zts and GOTO vm-kind)
- - (Only one directive is loaded from "Per Directory Values" Windows registry)
- - (register_shutdown_function and extending class)
- - (dangling pointers made by zend_disable_class)
- - (munmap() is called with the incorrect length)
- - (php binaries installed as binary.dSYM)
-
-
-
-
-- CURL
-
- - (curl_copy_handle segfault with CURLOPT_FILE)
-
-
-
-
-- DateTime
-
- - (Unserialize invalid DateTime causes crash)
-
-
-
-
-- Intl
-
- - Fix null pointer dereferences in some classes of ext/intl
-
-
-
-
-- MySQLnd
-
- - (mysqli_poll - Segmentation fault)
-
-
-
-
-- PDO
-
- - (Wrong return datatype in PDO::inTransaction())
-
-
-
-
-- Session
-
- - Fixed bug (segfault due to retval is not initialized)
-
-
-
-
-- SPL
-
- - (Crash when cloning an object which inherits SplFixedArray)
-
-
-
-
-- Enchant
-
- - (enchant_dict_quick_check() destroys zval, but fails to initialize it)
-
-
-
-
-
-Version 5.3.16
-
-
-- Core
-
- - (register_shutdown_function and extending class).
- - (dangling pointers made by zend_disable_class).
- - (munmap() is called with the incorrect length).
- - (php binaries installed as binary.dSYM).
- - (--with-zend-multibyte and --enable-debug reports LEAK with run-test.php).
-
-
-
-
-- CURL
-
- - (curl_copy_handle segfault with CURLOPT_FILE).
- - (curl_setopt($ch, CURLOPT_COOKIEFILE, "") returns false).
-
-
-
-
-- DateTime
-
- - (Segfault in DateInterval class when extended).
-
-
-
-
-- Enchant
-
- - (enchant_dict_quick_check() destroys zval, but fails to initialize it).
-
-
-
-
-- PDO
-
- - (Wrong return datatype in PDO::inTransaction()).
-
-
-
-
-- Reflection
-
- - (ReflectionParameter::isDefaultValueAvailable() wrong result).
-
-
-
-
-- Session
-
- - Fixed bug (segfault due to retval is not initialized).
-
-
-
-
-- SPL
-
- - (ArrayIterator::count() from IteratorIterator instance gives Segmentation fault).
-
-
-
-
-
-Version 5.3.15
-
-
-- Zend Engine
-
- - (parse_ini_file() with INI_SCANNER_RAW cuts a value that includes a semi-colon)
-
-
-
-
-- COM
-
- - com_dotnet cannot be built shared
-
-
-
-
-- Core
-
- - Fixed potential overflow in _php_stream_scandir, CVE-2012-2688
- - (ReflectionMethod random corrupt memory on high concurrent)
- - (Crypt SHA256/512 Segfaults With Malformed Salt)
-
-
-
-
-- Fileinfo
-
- - Fixed magic file regex support
-
-
-
-
-- FPM
-
- - (fpm don't send error log to fastcgi clients)
- - (php-fpm is not allowed to run as root)
- - (php-fpm should not fail with commented 'user' for non-root start)
- - (FPM pools can listen on the same address)
- - (php-fpm exits with status 0 on some failures to start)
- - (when using unix sockets, multiples FPM instances can be launched without errors)
- - (Add process.priority to set nice(2) priorities)
- - (FPM drops connection while receiving some binary values in FastCGI requests)
- - (php-fpm segfaults (null passed to strstr))
-
-
-
-
-- Intl
-
- - (grapheme_extract() memory leaks)
- - (IntlDateFormatter constructor leaks memory when called twice)
- - (Collator::getSortKey() returns garbage)
- - (datefmt_create with incorrectly encoded timezone leaks pattern)
- - (memory leak in IntlDateFormatter constructor)
-
-
-
-
-
-
-- Phar
-
- - (Invalid phar stream path causes crash)
-
-
-
-
-- Reflection
-
- - (Attempting to invoke a Closure more than once causes segfault)
- - (ReflectionParameter::getDefaultValue() memory leaks with constant)
-
-
-
-
-- SPL
-
- - (RecursiveArrayIterator does not implement Countable)
-
-
-
-
-- SQLite
-
- - Fixed open_basedir bypass, CVE-2012-3365
-
-
-
-
-- XML Write
-
- - (memory leak in the XML Writer module)
-
-
-
-
-- Zip
-
- - Upgraded libzip to 0.10
-
-
-
-
-
-Version 5.3.14
-
-
-- CLI SAPI
-
- - (functions related to current script failed when chdir() in cli sapi)
-
-
-
-
-- Core
-
- - Fixed CVE-2012-2143
- - (unexpected behavior when incrementally assigning to a member of a null object)
- - (Segfault from array_walk modifying an array passed by reference)
- - Fixed missing bound check in iptcparse()
- - ('I' unpacks n as signed if n > 2^31-1 on LP64)
- - ([PATH=] sections incompatibility with user_ini.filename set to null)
- - (Logic error in charset detection for htmlentities)
- - (long overflow in realpath_cache_get())
- - Changed php://fd to be available only for CLI.
-
-
-
-
-- CURL
-
- - (CURLOPT_COOKIEFILE '' raises open_basedir restriction)
-
-
-
-
-- COM
-
- - com_dotnet cannot be built shared
-
-
-
-
-- Fileinfo
-
- - (Uninitialised value used in libmagic)
-
-
-
-
-
-
-- Intl
-
- - (Memory corruption in internal function get_icu_disp_value_src_php()
-
-
-
-
-- JSON
-
- - (json_encode() incorrectly truncates/discards information)
-
-
-
-
-- PDO
-
- - (A parsing bug in the prepared statements can lead to access violations). (CVE-2012-3450)
-
-
-
-
-- Phar
-
-- (Secunia SA44335) (CVE-2012-2386)
-
-
-
-
-- Streams
-
- - (file_get_contents leaks when access empty file with maxlen set)
-
-
-
-
-
-Version 5.3.13
-
-
-
- - Improve fix for PHP-CGI query string parameter vulnerability, CVE-2012-2311.
-
-
-
-
-Version 5.3.12
-
-
-
- - Fix PHP-CGI query string parameter vulnerability, CVE-2012-1823.
-
-
-
-
-Version 5.3.11
-
-
-
-- Core
-
- - (ini parser crashes when using ${xxxx} ini variables
- (without apache2)).
- - (call_user_func_array with more than 16333 arguments
- leaks / crashes).
- - (Segfault - strip_tags()).
- - (Incorect lexing of 0x00*+<NUM>).
- - (Memory leak in parse_ini_file when specifying
- invalid scanner mode).
- - (Memory leak when restoring an exception handler).
- - (array_fill leaks if start index is PHP_INT_MAX).
- - (Exceeding max nesting level doesn't delete numerical
- vars).
- - (Possible invalid handler usage in windows random
- functions).
- - (Segfault when running symfony 2 tests).
- - (strpbrk() mishandles NUL byte).
- - (Nullbyte truncates Exception $message).
- - (header() cannot detect the multi-line header with CR).
- - (time_nanosleep() does validate input params).
- - (Insufficient validating of upload name leading to
- corrupted $_FILES indices). (CVE-2012-1172).
- - (array_walk_recursive crashes if third param of the
- function is by reference).
- - Improve performance of set_exception_handler while doing reset.
- - (Include fails with toplevel symlink to /).
-
-
-
-
-- DOM
-
- - Added debug info handler to DOM objects.
-
-
-
-
-- FPM
-
- - (Transposed memset() params in sapi/fpm/fpm/fpm_shm.)
- - (php-fpm compilation problem).
-
-
-
-
-- Fileinfo
-
- - Upgraded libmagic to 5.
- - where php_stream_open_wrapper_ex tries to open a
- directory descriptor under windows.
- - failure caused by the posix lseek and read versions
- under windows in cdf_read().
- - (Unable to detect error from finfo constructor).
-
-
-
-
-- Firebird Database extension (ibase)
-
- - (ibase_trans() gives segfault when passing params).
-
-
-
-
-- Ibase
-
- - (Segmentation fault while executing ibase_db_info).
-
-
-
-
-- Installation
-
- - (Add Apache 2.4 support).
-
-
-
-
-- mysqli
-
- - (mysql_stat() require a valid connection).
-
-
-
-
-- PDO_mysql
-
- - (PDO::nextRowset() after a multi-statement query doesn't
- always work).
- - (PDO should export compression flag with myslqnd).
-
-
-
-
-- PDO_odbc
-
- - (PDO ODBC Segfaults on SQL_SUCESS_WITH_INFO).
-
-
-
-
-- PDO_pgsql
-
- - (pdo_pgsql's PDO::exec() returns the number of SELECTed
- rows on postgresql >= 9).
-
-
-
-
-- PDO_Sqlite extension
-
- - Add createCollation support.
-
-
-
-
-- pgsql
-
- - (Compile problem with libpq (PostgreSQL 7.3 or less).
-
-
-
-
-- Phar
-
- - (Phar::webPhar() generates headers with trailing NUL
- bytes).
-
-
-
-
-- Readline
-
- - (Memory leak in readline_callback_handler_install).
- - Add open_basedir checks to readline_write_history and readline_read_history.
-
-
-
-
-- Reflection
-
- - (ReflectionObject:getProperties() issues invalid reads
- when get_properties returns a hash table with (inaccessible) dynamic
- numeric properties).
- - (Late static binding doesn't work with
- ReflectionMethod::invokeArgs()).
-
-
-
-
-- Session
-
- - (session.save_handler=user without defined function core
- dumps).
- - (Segmentation fault when trying to die() in
- SessionHandler::write()).
-
-
-
-
-- SOAP
-
- - (gzip compression fails).
- - (SoapClient ignores user_agent option and sends no
- User-Agent header).
- - , (Chunked response parsing error when
- chunksize length line is > 10 bytes).
- - (Soap Client stream context header option ignored).
-
-
-
-
-- SPL
-
- - Fixed memory leak when calling SplFileInfo's constructor twice.
- - (Segmentation fault when DirectoryIterator's or
- FilesystemIterator's iterators are requested more than once without
- having had its dtor callback called in between).
- - (inconsistent isset behavior of Arrayobject).
- - (ArrayObject comparison).
-
-
-
-
-- SQLite3 extension
-
- - Add createCollation() method.
-
-
-
-
-- Streams
-
- - (stream_context_create() causes memory leaks on use
- streams_socket_create).
- - (Wrappers opened with errors concurrency problem on ZTS).
- - (stream related segfault on fatal error in
- php_stream_context_link).
- - (stream_get_line() reads from stream even when there is
- already sufficient data buffered). stream_get_line() now behaves more like
- fgets(), as is documented.
- - Further fix for bug (stream_get_line misbehaves if EOF is not
- detected together with the last read).
- - (stream_socket_server silently truncates long unix
- socket paths).
-
-
-
-
-- Tidy
-
- - (tidy null pointer dereference).
-
-
-
-
-- XMLRPC
-
- - (xmlrpc_parse_method_descriptions leaks temporary
- variable).
- - (Memory leak in xmlrpc functions copying zvals).
-
-
-
-
-- Zlib
-
- - (initialization of global inappropriate for ZTS).
- - (A particular string fails to decompress).
- - (gzopen leaks when specifying invalid mode).
-
-
-
-
-
-Version 5.3.10
-
-
-
-- Core:
-
- - Fixed arbitrary remote code execution vulnerability reported by Stefan
- Esser, CVE-2012-0830.
-
-
-
-
-
-
-
-Version 5.3.9
-
-
-
-- Core:
-
- - Added max_input_vars directive to prevent attacks based on hash collisions
- (Dmitry).
- - (possible integer overflow in content_length). (Laruence)
- - (Anonymous functions create cycles not detected by the
- GC). (Dmitry)
- - (GC crash with referenced array in RecursiveArrayIterator)
- (Dmitry).
- - (proc_open's streams may hang with stdin/out/err when
- the data exceeds or is equal to 2048 bytes). (Pierre, Pascal Borreli)
- - (__halt_compiler() works in braced namespaces). (Felipe)
- - (Function time_nanosleep() is undefined on OS X). (Ilia)
- - (GCC does not provide __sync_fetch_and_add on some archs).
- (klightspeed at netspace dot net dot au)
- - (serialize followed by unserialize with numeric object
- prop. gives integer prop). (Gustavo)
- - (TOCTOU issue in getenv() on Windows builds). (Pierre)
- - (undefined reference to `__sync_fetch_and_add_4' on Linux
- parisc). (Felipe)
- - (fgetcsv & str_getcsv skip empty fields in some
- tab-separated records). (Laruence)
- - (Undefined function Bug()). (Laruence)
- - (memory corruption in parse_ini_string). (Pierre)
- - (Cannot conditionally move uploaded file without race
- condition). (Gustavo)
- - : $_FILES 'name' missing first character after upload.
- (Arpad)
- - (segfault on x86_64 using more than 2G memory). (Laruence)
- - (Content-Type header is not parsed correctly on
- HTTP POST request). (Hannes)
- - (is_a() triggers autoloader, new optional 3rd argument to
- is_a and is_subclass_of). (alan_k)
- - (Incomplete doctype and missing xmlns).
- (virsacer at web dot de, Pierre)
- - (keys lost when using substr_replace an array). (Arpad)
- - (base64_decode() with strict rejects whitespace after
- pad). (Ilia)
- - (tempnam() by-pass open_basedir with nonnexistent
- directory). (Felipe)
- - (incorrect assumption of PAGE_SIZE size). (Dmitry)
- - Fixed invalid free in call_user_method() function. (Felipe)
- - (Interface implementation / inheritence not possible in
- abstract classes). (Felipe)
-
-
-- BCmath:
-
- - (bcscale related crashes on 64bits platforms). (shm)
-
-
-- Calendar:
-
- - (Integer overflow in SdnToGregorian leads to segfault (in
- optimized builds). (Gustavo)
-
-
-- cURL:
-
- - (curl_copy_handle segfault when used with
- CURLOPT_PROGRESSFUNCTION). (Pierrick)
- - (Segfault when CURLOPT_STDERR file pointer is closed
- before calling curl_exec). (Hannes)
- - Fixed issues were curl_copy_handle() would sometimes lose copied
- preferences. (Hannes)
-
-
-- DateTime:
-
- - (Startup errors with log_errors on cause segfault).
- (Derick)
- - (TLA timezone dates are not converted properly from
- timestamp). (Derick)
- - (DateTime::add() and sub() result -1 hour on objects with
- time zone type 2). (Derick)
- - (DateTime::createFromFormat() doesn't interpret "D").
- (Derick)
- - (strtotime with timezone memory leak). (Derick)
- - (large timestamps with DateTime::getTimestamp and
- DateTime::setTimestamp). (Derick)
- - (date_parse_from_format is parsing invalid date using 'yz'
- format). (Derick)
- - (Seg fault while creating (by unserialization)
- DatePeriod). (Derick)
- - (cloning extended DateTime class without calling
- parent::__constr crashed PHP). (Hannes)
-
-
-- EXIF:
-
- - (Integer overflow during the parsing of invalid exif
- header). (Stas, flolechaud at gmail dot com)
-
-
-- Fileinfo:
-
- - (C++ comment fails in c89). (Laruence)
- - Fixed possible memory leak in finfo_open(). (Felipe)
- - Fixed memory leak when calling the Finfo constructor twice. (Felipe)
-
-
-- Filter:
-
- - (FILTER_VALIDATE_EMAIL fails with internationalized
- domain name addresses containing >1 -). (Ilia)
-
-
-- FTP:
-
- - (out of sync ftp responses). (bram at ebskamp dot me,
- rasmus)
-
-
-- Gd:
-
- - (imagefill() doesn't work correctly
- for small images). (Florian)
-
-
-- Intl:
-
- - (SegFault when Collator not constructed
- properly). (Florian)
- - Fixed memory leak in several Intl locale functions. (Felipe)
-
-
-- JSON:
-
- - (json_encode() with JSON_NUMERIC_CHECK fails on objects
- with numeric string properties). (Ilia, dchurch at sciencelogic dot com)
-
-
-- mbstring:
-
- - Fixed possible crash in mb_ereg_search_init() using empty pattern. (Felipe)
-
-
-- MS SQL:
-
- - (Compile failure with freetds 0.91). (Felipe)
-
-
-- MySQL:
-
- - (mysql.trace_mode miscounts result sets). (Johannes)
-
-
-- MySQLi extension:
-
- - (mysqli->stat property access gives error). (Andrey)
- - (mysqli_num_rows() returns always 0 for unbuffered, when
- mysqlnd is used). (Andrey)
- - (PHP crash when calling mysqli_fetch_fields).
- (eran at zend dot com, Laruence)
-
-
-- mysqlnd:
-
- - (mysqlnd cannot be built shared). (Johannes)
- - (MySQL doesn't support compression - wrong config option).
- (Andrey)
-
-
-- NSAPI SAPI:
-
- - Don't set $_SERVER['HTTPS'] on unsecure connection (bug ). (Uwe
- Schindler)
-
-
-- OpenSSL:
-
- - (Fixed NULL pointer dereference in
- stream_socket_enable_crypto, case when ssl_handle of session_stream is not
- initialized.) (shm)
- - Fix segfault with older versions of OpenSSL. (Scott)
-
-
-- Oracle Database extension (OCI8):
-
- - (show normal warning text for OCI_NO_DATA).
- (Chris Jones)
- - Increased maximum Oracle error message buffer length for new 11.2.0.3 size.
- (Chris Jones)
- - Improve internal initalization failure error messages. (Chris Jones)
-
-
-- PDO
-
- - (PDORow to session bug). (Johannes)
-
-
-- PDO Firebird:
-
- - ("bindValue" and "bindParam" do not work for PDO Firebird).
- (Mariuz)
- - (PDO_Firebird segfaults when passing lowercased column name to bindColumn).
- - (PDO_Firebird segfaults if query column count less than param count).
- (Mariuz)
-
-
-- PDO MySQL driver:
-
- - (pdo_mysql.default_socket ignored). (Johannes)
- - (PDO ignores all SSL parameters when used with mysql
- native driver). (Pierre)
- - (MYSQLND+PDO MySQL requires #define
- MYSQL_OPT_LOCAL_INFILE). (Andrey)
-
-
-- PDO OCI driver:
-
- - (PDO_OCI can't resume Oracle session after it's been
- killed). (mikhail dot v dot gavrilov at gmail dot com, Chris Jones, Tony)
-
-
-- Phar:
-
- - (NULL pointer dereference in phar). (Felipe)
- - (Stubs of a specific length break phar_open_from_fp
- scanning for __HALT_COMPILER). (Ralph Schindler)
- - (internal corruption of phar). (Hannes)
- - (Unable to decompress files in a compressed phar). (Hannes)
-
-
-- PHP-FPM SAPI:
-
- - (FPM does not clear auth_user on request accept).
- (bonbons at linux-vserver dot org)
- - (memory corruption when web server closed the fcgi fd).
- (fat)
- - (php_flag and php_value does not work properly). (fat)
- - (Heartbeat causes a lot of unnecessary events). (fat)
- - (The -d parameter doesn't work). (fat)
- - (Add the "ondemand" process-manager
- to allow zero children). (fat)
- - (status show BIG processes number). (fat)
- - (status.html does not install). (fat)
- - Backported from 5.4 branch (Dropped restriction of not setting the same
- value multiple times, the last one holds).
- (giovanni at giacobbi dot net, fat)
- - Backported FR from 5.4 branch (Added process.max to control
- the number of process FPM can fork). (fat)
- - Backported FR from 5.4 branch (Enhance security by limiting access
- to user defined extensions). (fat)
- - Backported FR from 5.4 branch (Lowered process manager
- default value). (fat)
- - Backported FR from 5.4 branch (Added partial syslog support). (fat)
- - (Enhanced status page with full status and details
- about each processes. Also provide a web page (status.html) for
- real-time FPM status. (fat)
- - Enhance error log when the primary script can't be open. FR . (fat)
- - Added .phar to default authorized extensions. (fat)
-
-
-- Postgres:
-
- - (pg_fetch_* functions do not validate that row param
- is >0). (Ilia)
-
-
-- Reflection:
-
- - (Reflection and Late Static Binding). (Laruence)
-
-
-- Session:
-
- - (session_regenerate_id fails after header sent). (Hannes)
-
-
-- SimpleXML:
-
- - Reverted the SimpleXML->query() behaviour to returning empty arrays
- instead of false when no nodes are found as it was since 5.3.3
- (bug ). (chregu, rrichards)
-
-
-- SOAP
-
- - (Access to a undefined member in inherit SoapClient may
- cause Segmentation Fault). (Dmitry)
- - (PHP Fatal error: SOAP-ERROR: Parsing WSDL:
- Extra content at the end of the doc, when server uses chunked transfer
- encoding with spaces after chunk size). (Dmitry)
- - (SOAP-ERROR: Parsing WSDL with references). (Dmitry)
-
-
-- Sockets:
-
- - (sa_len a #define on IRIX). (china at thewrittenword dot
- com)
-
-
-- SPL:
-
- - (Crash in ArrayObject() when using recursive references).
- (Tony)
- - (Wrong value for splFileObject::SKIP_EMPTY).
- (jgotti at modedemploi dot fr, Hannes)
- - (RegexIterator::accept() doesn't work with scalar values).
- (Hannes)
-
-
-- Streams:
-
- - (stream_get_line misbehaves if EOF is not detected together
- with the last read). (Gustavo)
-
-
-- Tidy:
-
- - (Tidy::diagnose() NULL pointer dereference).
- (Maksymilian Arciemowicz, Felipe)
-
-
-- XSL:
-
- - Added xsl.security_prefs ini option to define forbidden operations within
- XSLT stylesheets, default is not to enable write operations. This option
- won't be in 5.4, since there's a new method. Fixes Bug . (Chregu,
- Nicolas Gregoire)
-
-
-
-
-
-
-
-Version 5.3.8
-
-
-
-- Core:
-
- - (crypt() returns only the salt for MD5). (Stas)
-
-
-- OpenSSL:
-
- - Reverted a change in timeout handling restoring PHP 5.3.6 behavior,
- as the new behavior caused mysqlnd SSL connections to hang (
- bug ).
- (Pierre, Andrey, Johannes)
-
-
-
-
-
-
-
-Version 5.3.7
-
-
-
-- Upgraded bundled SQLite to version 3.7.7.1. (Scott)
-- Upgraded bundled PCRE to version 8.12. (Scott)
-
-- Zend Engine:
-
- - (ReflectionClass::getDocComment() returns comment even though the class has none). (Felipe)
- - (compiler fail after previous fail). (Felipe)
- - (Crash when calling call_user_func with unknown function name). (Dmitry)
- - (__halt_compiler and imported namespaces). (Pierrick, Felipe)
- - (class_alias and type hint). (Felipe)
- - (track_errors causes segfault). (Dmitry)
- - (classes from dl()'ed extensions are not destroyed). (Tony, Dmitry)
- - (Crash accessing global object itself returned from its __get() handle). (Dmitry)
- - (Use of closure causes problem in ArrayAccess). (Dmitry)
- - (Closure, use and reference). (Dmitry)
- - (Crash when assigning value to a dimension in a non-array). (Dmitry)
- - (use() of static variables in lambda functions can break staticness). (Dmitry)
-
-
-
-- Core:
-
- - Updated crypt_blowfish to 1.2. (CVE-2011-2483) (Solar Designer) (more info)
- - Removed warning when argument of is_a() or is_subclass_of() is not a known class. (Stas)
- - Fixed crash in error_log(). (Felipe) Reported by Mateusz Kocielski.
- - Added PHP_MANDIR constant telling where the manpages were installed into, and an --man-dir argument to php-config. (Hannes)
- - Fixed a crash inside dtor for error handling. (Ilia)
- - Fixed buffer overflow on overlog salt in crypt(). (Clément LECIGNE, Stas
- - (Range function accuracy). (Adam)
-
- - (parse_url() incorrectly treats ':' as a valid path). (Ilia)
- - (Segfault with allow_call_time_pass_reference = Off). (Dmitry)
- - [NEW]: popen_ex on windows, fixed possible heap overflow (Pierre)
- - (Windows Version Detecting Error). ( xiaomao5 at live dot com, Pierre)
- - (readlink returns weird characters when false result). (Pierre)
- - (var_export() doesn't escape properties properly). (Gustavo)
- - (Compile failure due to improper use of ctime_r()). (Ilia)
- - (File path injection vulnerability in RFC1867 File upload filename). (Felipe) Reported by Krzysztof Kotowicz. (CVE-2011-2202)
- - php_win_err can lead to crash. (Pierre)
- - (assert.* is not being reset upon request shutdown). (Ilia)
- - (Fix compiling with older gcc version without need for membar_producer macro). (mhei at heimpold dot de)
- - (incorrect accounting for realpath_cache_size). (Dustin Ward)
- - (getimagesize() doesn't check the full ico signature). (Scott)
- - (Different Hashes on Windows, BSD and Linux on wrong Salt size). (Pierre, os at irj dot ru)
- - (get_browser() segmentation fault when browscap ini directive is set through php_admin_value). (Gustavo)
- - (Crash in zend_mm_check_ptr // Heap corruption). (Dmitry)
- - (Crash in gc_remove_zval_from_buffer). (Dmitry)
- - (use-after-free in substr_replace()). (Stas) (CVE-2011-1148)
- - (Can't set a value with a PATH section in php.ini). (Pierre)
- - (parse_url() incorrectly parses path when ? in fragment). (tomas dot brastavicius at quantum dot lt, Pierrick)
- - (file_get_contents POST request sends additional line break). (maurice-php at mertinkat dot net, Ilia)
- - (fgetcsv() ignores spaces at beginnings of fields). (Ilia)
- - Alternative fix for bug , as applied to the round() function (signed overflow), as the old fix impacted the algorithm for numbers with magnitude smaller than 0. (Gustavo)
- - (Inconsistent behavior of is_subclass_of with interfaces) (Ralph Schindler, Dmitry)
- - (call exit in user_error_handler cause stream relate core). (Gustavo)
- - (SEEK_CUR with 0 value, returns a warning). (Ilia)
- - (Using class constants in array definition fails). (Pierrick, Dmitry)
- - (Invalid parsing in convert.quoted-printable-decode filter). (slusarz at curecanti dot org)
- - (sys_get_temp_dir() possibly inconsistent when using TMPDIR on Windows). (Pierre)
-
-
-
-- Apache2 Handler SAPI:
-
- - (SAPI crashes on apache_config.c:197). (hebergement at riastudio dot fr)
-
-
-
-- CLI SAPI:
-
- - (Zero exit code on option parsing failure). (Ilia)
-
-
-
-- cURL extension:
-
- - Added ini option curl.cainfo (support for custom cert db). (Pierre)
- - Added CURLINFO_REDIRECT_URL support. (Daniel Stenberg, Pierre)
- - Added support for CURLOPT_MAX_RECV_SPEED_LARGE and CURLOPT_MAX_SEND_SPEED_LARGE. FR . (Pierrick)
-
-
-
-- DateTime extension:
-
- - Fixed bug where the DateTime object got changed while using date_diff(). (Derick)
- - (DateTime::add() method bug). (Adam)
- - (DateTime::createFromFormat does not handle trailing '|' correctly). (Adam)
- - (new DatePeriod(NULL) causes crash). (Felipe)
- - (Case discrepancy in timezone names cause Uncaught exception and fatal error). (Hannes)
-
-
-
-- DBA extension:
-
- - Supress warning on non-existent file open with Berkeley DB 5.2 (Chris Jones)
- - (dba_insert returns true if key already exists). (Felipe)
-
-
-
-- Exif extesion:
-
- - (error message format string typo). (Ilia)
-
-
-
-- Fileinfo extension:
-
- - (Unresolved symbol strtoull in HP-UX 11.11). (Felipe)
-
-
-
-- Filter extension:
-
- - Added 3rd parameter to filter_var_array() and filter_input_array() functions that allows disabling addition of empty elements. (Ilia)
- - (FILTER_FLAG_EMPTY_STRING_NULL is not implemented). (Ilia)
-
-
-
-- Interbase extension:
-
- - (Short exception message buffer causes crash). (Felipe)
-
-
-
-- intl extension:
-
- - (Expose ICU version info). (David Zuelke, Ilia)
- - (Allow loading of arbitrary resource bundles when fallback is disabled). (David Zuelke, Stas)
-
-
-
-- Imap extension:
-
- - (Number of retries not set when params specified). (kevin at kevinlocke dot name)
-
-
-
-- json extension:
-
- - (Empty string in json_decode doesn't reset json_last_error()). (Ilia)
-
-
-
-- LDAP extension:
-
- - (Fails to build when compilng with gcc 4.5 and DSO libraries). (Clint Byrum, Raphael)
-
-
-
-- libxml extension:
-
- - (Removing the doctype node segfaults). (Hannes)
- - (libxml extension ignores default context). (Gustavo)
-
-
-
-- mbstring extension:
-
- - (mb_substr() mishandles UTF-32LE and UCS-2LE). (Gustavo)
-
-
-
-- MCrypt extension:
-
- - Change E_ERROR to E_WARNING in mcrypt_create_iv when not enough data has been fetched (Windows). (Pierre)
- - (mcrypt_create_iv always fails to gather sufficient random data on Windows). (Pierre)
-
-
-
-- MySQL Improved extension:
-
- - Fixed Bug (mysqli::get_warnings segfault when used in multi queries). (Andrey)
-
-
-
-- mysqlnd
-
- - Fixed crash when using more than 28,000 bound parameters. Workaround is to set mysqlnd.net_cmd_buffer_size to at least 9000. (Andrey)
- - mysqlnd valid_sjis_(head|tail) is using invalid operator and range). (nihen at megabbs dot com, Andrey)
-
-
-
-- MySQLi extension:
-
- - (SSL options set by mysqli_ssl_set ignored for MySQLi persistent connections). (Andrey)
-
-
-
-- OpenSSL extension:
-
- - openssl_encrypt()/openssl_decrypt() truncated keys of variable length ciphers to the OpenSSL default for the algorithm. (Scott)
- - On blocking SSL sockets respect the timeout option where possible. (Scott)
- - (Stream not closed and error not returned when SSL CN_match fails). (Gustavo, laird_ngrps at dodo dot com dot au)
-
-
-
-- Oracle Database extension (OCI8):
-
- - Added oci_client_version() returning the runtime Oracle client library version (Chris Jones)
-
-
-
-- PCRE extension:
-
- - Increased the backtrack limit from 100000 to 1000000 (Rasmus)
-
-
-
-- PDO extension:
-
- - (Parse error with single quote in sql comment). (Felipe)
- - (bindColumn creates Warning regardless of ATTR_ERRMODE settings). (Ilia)
-
-
-
-- PDO DBlib driver:
-
- - (MSSql extension memory leak). (dotslashpok at gmail dot com)
- - (PDO_DBLIB returns null on SQLUNIQUE field). (mjh at hodginsmedia dot com, Felipe)
-
-
-
-- PDO ODBC driver:
-
- - Fixed data type usage in 64bit. (leocsilva at gmail dot com)
-
-
-
-- PDO MySQL driver:
-
- - (wrong pathes in php_pdo_mysql_int.h). (Tony, Johannes)
- - (foreach throws irrelevant exception). (Johannes, Andrey)
- - (MySQL PDO driver doesn't support SSL connections). (Rob)
-
-
-
-- PDO PostgreSQL driver:
-
- - (Non-portable grep option used in PDO pgsql configuration). (bwalton at artsci dot utoronto dot ca)
-
-
-
-- PDO Oracle driver:
-
- - (64bit Oracle RPMs still not supported by pdo-oci). (jbnance at tresgeek dot net)
-
-
-
-- Phar extension:
-
- - (Phar::mount() crashes when calling with wrong parameters). (Felipe)
-
-
-
-- PHP-FPM SAPI:
-
- - (FPM ping and status_path should handle HEAD request). (fat)
- - (Overriding the pid file location of php-fpm). (fat)
- - Fixed missing Expires and Cache-Control headers for ping and status pages. (fat)
- - Fixed memory leak. (fat) Reported and fixed by Giovanni Giacobbi.
-
- Fixed wrong value of log_level when invoking fpm with -tt. (fat)
- - Added xml format to the status page. (fat)
- - Removed timestamp in logs written by children processes. (fat)
- - Fixed exit at FPM startup on fpm_resources_prepare() errors. (fat)
- - Added master rlimit_files and rlimit_core in the global configuration settings. (fat)
- - Removed pid in debug logs written by chrildren processes. (fat)
- - Added custom access log (also added per request %CPU and memory mesurement). (fat)
- - Added a real scoreboard and several improvements to the status page. (fat)
-
-
-
-- Reflection extension:
-
- - (reflection_extension does not lowercase module function name). (Felipe, laruence at yahoo dot com dot cn)
-
-
-
-- SOAP extension:
-
- - (SoapClient segmentation fault when XSD_TYPEKIND_EXTENSION contains itself). (Dmitry)
- - (soap_version logic bug). (tom at samplonius dot org)
-
-
-
-- Sockets extension:
-
- - Fixed stack buffer overflow in socket_connect(). (CVE-2011-1938) Found by Mateusz Kocielski, Marek Kroemeke and Filip Palian. (Felipe)
- - Changed socket_set_block() and socket_set_nonblock() so they emit warnings on error. (Gustavo)
- - (socket_accept() fails on IPv6 server sockets). (Gustavo)
-
-
-
-- SPL extension:
-
- - (Wrong result when using iterator_to_array with use_keys on true). (Pierrick)
- - (SplFixedArray::setSize() isn't resizing). (Felipe)
- - (Certain implementation(s) of SplFixedArray cause hard crash). (Felipe)
- - (Dual iterators, GlobIterator, SplFileObject and SplTempFileObject crash when user-space classes don't call the paren constructor). (Gustavo)
- - (Wrong parameter causes crash in SplFileObject::__construct()). (Felipe)
- - (Crash iterating DirectoryIterator for dir name starting with \0). (Gustavo)
- - (Crash in non-initialized RecursiveIteratorIterator). (Felipe)
-
-
-
-- Streams:
-
- - (stream_get_contents infinite loop). (Hannes)
- - (Segfault when writing to a persistent socket after closing a copy of the socket). (Gustavo)
- - (addGlob() crashes on invalid flags). (Felipe)
-
-
-
-
-
-
-
-Version 5.3.6
-
-
-
-- Upgraded bundled Sqlite3 to version 3.7.4. (Ilia)
-- Upgraded bundled PCRE to version 8.11. (Ilia)
-
-- Zend Engine:
-
- - Indirect reference to $this fails to resolve if direct $this is never used in method. (Scott)
- - Fixed bug numerous crashes due to setlocale (crash on error, pcre, mysql etc.) on Windows in thread safe mode. (Pierre)
- - Added options to debug backtrace functions. (Stas)
- - (isset() and empty() produce apparently spurious runtime error). (Dmitry)
- - (Closures can't 'use' shared variables by value and by reference). (Dmitry)
- - (memory leak inside highlight_string()). (Hannes, Ilia)
- - (Lack of error context with nested exceptions). (Stas)
- - (Throwing an exception in a destructor causes a fatal error). (Stas)
- - (same parameter name can be used multiple times in method/function definition). (Felipe)
-
-
-
-- Core:
-
- - Added ability to connect to HTTPS sites through proxy with basic authentication using stream_context/http/header/Proxy-Authorization (Dmitry)
- - Changed default value of ini directive serialize_precision from 100 to 17. (Gustavo)
- - (buffer overrun with high values for precision ini setting). (Gustavo)
- - (reflection data for fgetcsv out-of-date). (Richard)
- - (Regression introduced in 5.3.4 in open_basedir with a trailing forward slash). (lekensteyn at gmail dot com, Pierre)
- - (Fix compile on the VAX). (Rasmus, jklos)
- - (array_product() always returns 0 for an empty array). (Ilia)
- - (fwrite() doesn't check reply from ftp server before exiting). (Ilia)
-
-
-
-- Calendar extension:
-
- - (Integer overflow in SdnToJulian, sometimes leading to segfault). (Gustavo)
-
-
-
-- DOM extension:
-
- - (Made DOMDocument::saveHTML accept an optional DOMNode like DOMDocument::saveXML). (Gustavo)
-
-
-
-- DateTime extension:
-
- - Fixed a bug in DateTime->modify() where absolute date/time statements had no effect. (Derick)
- - (DatePeriod fails to initialize recurrences on 64bit big-endian systems). (Derick, rein@basefarm.no)
- - (Segfault when specifying interval as two dates). (Stas)
- - (Can't use new properties in class extended from DateInterval). (Stas)
- - (setDate, setISODate, setTime works wrong when DateTime created from timestamp). (Stas)
- - (DateTime constructor's second argument doesn't have a null default value). (Gustavo, Stas)
-
-
-
-- Exif extension:
-
- - (crash on crafted tag, reported by Luca Carettoni). (Pierre) (CVE-2011-0708)
-
-
-
-- Filter extension:
-
- - (FILTER_VALIDATE_URL doesn't validate port number). (Ilia, Gustavo)
- - (FILTER_FLAG_NO_RES_RANGE is missing some IP ranges). (Ilia)
- - (INPUT_ENV returns NULL for set variables (CLI)). (Ilia)
- - (FILTER_FLAG_NO_RES_RANGE don't work with ipv6). (Ilia, valli at icsurselva dot ch)
-
-
-
-- Fileinfo extension:
-
- - (finfo_file() Cannot determine filetype in archives). (Hannes)
-
-
-
-- Gettext
-
- - (_() crashes on Windows when no LANG or LANGUAGE environment variable are set). (Pierre)
-
-
-
-- IMAP extension:
-
- - (get MIME headers of the part of the email). (Stas)
- - (imap_mime_header_decode() doesn't ignore \t during long MIME header unfolding). (Adam)
-
-
-
-- Intl extension:
-
- - (Segmentation fault when using cloned several intl objects). (Gustavo)
- - (NumberFormatter::setSymbol crash on bogus $attr values). (Felipe)
- - Implemented clone functionality for number, date & message formatters. (Stas).
-
-
-
-- JSON extension:
-
- - (Ensure error_code is always set during some failed decodings). (Scott)
-
-
-
-- mysqlnd
-
- - Fixed problem with always returning 0 as num_rows for unbuffered sets. (Andrey, Ulf)
-
-
-
-- MySQL Improved extension:
-
- - Added 'db' and 'catalog' keys to the field fetching functions (FR ). (Kalle)
- - Fixed buggy counting of affected rows when using the text protocol. The collected statistics were wrong when multi_query was used with mysqlnd (Andrey)
- - (Connect Error from MySqli (mysqlnd) when using SSL). (Kalle)
- - (mysqli::query returns false after successful LOAD DATA query). (Kalle, Andrey)
- - (mysqli_real_connect() ignores client flags when built to call libmysql). (Kalle, tre-php-net at crushedhat dot com)
-
-
-
-- OpenSSL extension:
-
- - Fixed stream_socket_enable_crypto() not honoring the socket timeout in server mode. (Gustavo)
- - (Memory leaks when openssl_encrypt). (Pierre)
- - (Memory leaks when openssl_decrypt). (Pierre)
- - (stream_socket_enable_crypto() busy-waits in client mode). (Gustavo)
- - (Cannot disable SessionTicket extension for servers that do not support it) by adding a no_ticket SSL context option. (Adam, Tony)
-
-
-
-- PDO MySQL driver:
-
- - (PDOStatement execute segfaults for pdo_mysql driver). (Johannes)
- - (Support for setting character sets in DSN strings). (Kalle)
-
-
-
-- PDO Oracle driver:
-
- - (Cannot load Lob data with more than 4000 bytes on ORACLE 10). (spatar at mail dot nnov dot ru)
-
-
-
-- PDO PostgreSQL driver:
-
- - (segfault in pgsql_stmt_execute() when postgres is down). (gyp at balabit dot hu)
-
-
- - Phar extension:
-
- - (format-string vulnerability on Phar). (Felipe) (CVE-2011-1153)
- - (format string bug in ext/phar). (crrodriguez at opensuse dot org, Ilia)
- - (PHAR reports invalid error message, when the directory does not exist). (Ilia)
-
-
-
-- PHP-FPM SAPI:
-
- - Enforce security in the fastcgi protocol parsing. (ef-lists at email dotde)
- - (php-fpm log format now match php_error log format). (fat)
- - (php-fpm --test doesn't set a valuable return value). (fat)
- - (php-fpm slowlog now also logs the original request). (fat)
-
-
-
-- Readline extension:
-
- - (Fixed parameter handling inside readline() function). (jo at feuersee dot de, Ilia)
-
-
-
-- Reflection extension:
-
- - (ReflectionClass::getConstant(s) emits fatal error on constants with self::). (Gustavo)
-
-
-
-- Shmop extension:
-
- - (Integer overflow in shmop_read()). (Felipe) Reported by Jose Carlos Norte (CVE-2011-1092)
-
-
-
-- SNMP extension:
-
- - (snmprealwalk (snmp v1) does not handle end of OID tree correctly). (Boris Lytochkin)
-
-
-
-- SOAP extension:
-
- - Fixed possible crash introduced by the NULL poisoning patch. (Mateusz Kocielski, Pierre)
-
-
-
-- SPL extension:
-
- - Fixed memory leak in DirectoryIterator::getExtension() and SplFileInfo::getExtension(). (Felipe)
- - (SPL assumes HAVE_GLOB is defined). (Chris Jones)
- - (property_exists incorrect on ArrayObject null and 0 values). (Felipe)
- - Added SplFileInfo::getExtension(). FR . (Peter Cowburn)
-
-
-
-- SQLite3 extension:
-
- - Fixed memory leaked introduced by the NULL poisoning patch. (Mateusz Kocielski, Pierre)
- - Fixed memory leak on SQLite3Result and SQLite3Stmt when assigning to a reference. (Felipe)
- - Add SQlite3_Stmt::readonly() for checking if a statement is read only. (Scott)
- - (SQLite3Result::columnType() should return false after all of the rows have been fetched). (Scott)
-
-
-
-- Streams:
-
- - (Segmentation fault when using HTTP proxy with the FTP wrapper). (Gustavo)
- - (Streams functions assume HAVE_GLOB is defined). (Chris Jones)
- - (userspace stream stat callback does not separate the elements of the returned array before converting them). (Gustavo)
- - (open arbitrary file descriptor with fopen). (Gustavo)
-
-
-
-- Tokenizer Extension
-
- - (token_get_all() does not stop after __halt_compiler). (Ilia)
-
-
-
-- XSL extension:
-
- - Fixed memory leaked introduced by the NULL poisoning patch. (Mateusz Kocielski, Pierre)
-
-
-
-- Zip extension:
-
- - Added the filename into the return value of stream_get_meta_data(). (Hannes)
- - (Zip functions assume HAVE_GLOB is defined). (Adam)
- - (Wrong return value for ZipArchive::extractTo()). (Pierre)
- - (ZipArchive segfault with FL_UNCHANGED on empty archive). (Stas, Maksymilian Arciemowicz). (CVE-2011-0421)
- - (Missing constants for compression type). (Richard, Adam)
- - (ZipArchive should quiet stat errors). (brad dot froehle at gmail dot com, Gustavo)
- - (stream_get_contents() segfaults on ziparchive streams). (Hannes)
- - (swapped memset arguments in struct initialization). (crrodriguez at opensuse dot org)
- - (Missing parameters in docs and reflection definition). (Richard)
- - (feof never returns true for damaged file in zip). (Gustavo, Richard Quadling)
-
-
-
-
-
-
-
-
-Version 5.3.5
-
-
-
-- (PHP hangs on numeric value 2.2250738585072011e-308). (CVE-2010-4645) (Rasmus, Scott)
-
-
-
-
-
-
-Version 5.3.4
-
-
-
-- Upgraded bundled Sqlite3 to version 3.7.3. (Ilia)
-- Upgraded bundled PCRE to version 8.10. (Ilia)
-
-- Security enhancements:
-
- - Fixed crash in zip extract method (possible CWE-170).
- (Maksymilian Arciemowicz, Pierre)
- - Paths with NULL in them (foo\0bar.txt) are now considered as invalid. (Rasmus)
- - Fixed a possible double free in imap extension (Identified by Mateusz
- Kocielski). (CVE-2010-4150). (Ilia)
- - Fixed NULL pointer dereference in ZipArchive::getArchiveComment.
- (CVE-2010-3709). (Maksymilian Arciemowicz)
- - Fixed possible flaw in open_basedir (CVE-2010-3436). (Pierre)
- - Fixed MOPS-2010-24, fix string validation. (CVE-2010-2950). (Pierre)
- - Fixed symbolic resolution support when the target is a DFS share. (Pierre)
- - (Segfault in filter_var with FILTER_VALIDATE_EMAIL with
- large amount of data) (CVE-2010-3710). (Adam)
-
-
-
-- General improvements:
-
- - Added stat support for zip stream. (Pierre)
- - Added follow_location (enabled by default) option for the http stream
- support. (Pierre)
- - Improved support for is_link and related functions on Windows. (Pierre)
- - Added a 3rd parameter to get_html_translation_table. It now takes a charset
- hint, like htmlentities et al. (Gustavo)
-
-
-- Implemented feature requests:
-
- - , added new constant ZEND_MULTIBYTE to detect
- zend multibyte at runtime. (Kalle)
- - , added functions pcntl_get_last_error() and
- pcntl_strerror(). (nick dot telford at gmail dot com, Arnaud)
- - Implemented symbolic links support for open_basedir checks. (Pierre)
- - , SplFileInfo::getLinkTarget on Windows. (Pierre)
- - , not uploaded files don't count towards
- max_file_uploads limit. As a side improvement, temporary files are not opened
- for empty uploads and, in debug mode, 0-length uploads. (Gustavo)
-
-
-- Improved MySQLnd:
-
- - Added new character sets to mysqlnd, which are available in MySQL 5.5
- (Andrey)
-
-
-- Improved PHP-FPM SAPI:
-
- - Added '-p/--prefix' to php-fpm to use a custom prefix and run multiple
- instances. (fat)
- - Added custom process title for FPM. (fat)
- - Added '-t/--test' to php-fpm to check and validate FPM conf file. (fat)
- - Added statistics about listening socket queue length for FPM.
- (andrei dot nigmatulin at gmail dot com, fat)
-
-
-- Core:
-
- - Fixed extract() to do not overwrite $GLOBALS and $this when using
- EXTR_OVERWRITE. (jorto at redhat dot com)
- - Fixed bug in the Windows implementation of dns_get_record, where the two
- last parameters wouldn't be filled unless the type were DNS_ANY (Gustavo).
- - Changed the $context parameter on copy() to actually have an effect. (Kalle)
- - Fixed htmlentities/htmlspecialchars accepting certain ill-formed UTF-8
- sequences. (Gustavo)
- - (sleep() returns NULL on Windows). (Pierre)
- - (strip_tags() may strip '<br />' incorrectly). (Felipe)
- - (quot_print_decode does not handle lower-case hex digits).
- (Ilia, daniel dot mueller at inexio dot net)
- - (rawurlencode RFC 3986 EBCDIC support misses tilde char).
- (Justin Martin)
- - (file_exists fails on big filenames). (Adam)
- - (changing INI setting "from" with ini_set did not have any
- effect). (Gustavo)
- - (post_max_size=0 not disabling the limit when the content
- type is application/x-www-form-urlencoded or is not registered with PHP).
- (gm at tlink dot de, Gustavo)
- - (autoload misbehaves if called from closing session).
- (ladislav at marek dot su)
- - (In html_entity_decode, failure to convert numeric entities
- with ENT_NOQUOTES and ISO-8859-1). Fixed and extended the fix of ENT_NOQUOTES
- in html_entity_decode that had introduced the bug (rev #185591) to other
- encodings. Additionaly, html_entity_decode() now doesn't decode " if
- ENT_NOQUOTES is given. (Gustavo)
- - (strripos not overloaded with function overloading enabled).
- (Felipe)
- - (var_dump() doesn't check for the existence of
- get_class_name before calling it). (Kalle, Gustavo)
- - (var_export array with negative key). (Felipe)
- - (base64_decode() improper handling of leading padding in
- strict mode). (Ilia)
- - (dns_get_record fails with non-existing domain on Windows).
- (a_jelly_doughnut at phpbb dot com, Pierre)
- - (socket will not connect to IPv4 address when the host has
- both IPv4 and IPv6 addresses, on Windows). (Gustavo, Pierre)
- - (proc_open on Windows does not respect cwd as it does on
- other platforms). (Pierre)
- - (utf8_decode vulnerabilities and deficiencies in the number
- of reported malformed sequences). (CVE-2010-3870) (Gustavo)
- - (get_html_translation_table doesn't handle UTF-8). (Gustavo)
- - (php -i has different output to php --ini). (Richard,
- Pierre)
- - (array_diff() takes over 3000 times longer than php 5.2.4).
- (Felipe)
- - (printf of floating point variable prints maximum of 40
- decimal places). (Ilia)
- - (mt_rand() does not check that max is greater than min).
- (Ilia)
- - (bad default include_path on Windows). (Pierre)
- - (get_html_translation_table calls the ' ' instead of
- '). (Gustavo)
-
-
-- Zend engine:
-
- - Reverted fix for bug (Static calling in non-static method behaves
- like $this->). (Felipe)
- - Changed deprecated ini options on startup from E_WARNING to E_DEPRECATED.
- (Kalle)
- - Fixed NULL dereference in lex_scan on zend multibyte builds where the script
- had a flex incompatible encoding and there was no converter. (Gustavo)
- - Fixed covariance of return-by-ref constraints. (Etienne)
- - (E_NOTICE when defining a constant starts with
- __COMPILER_HALT_OFFSET__). (Felipe)
- - (zend_call_function does not respect ZEND_SEND_PREFER_REF).
- (Dmitry)
- - (Objects unreferenced in __get, __set, __isset or __unset
- can be freed too early). (mail_ben_schmidt at yahoo dot com dot au, Dmitry)
- - (PHP should reset section to [PHP] after ini sections).
- (Fedora at famillecollet dot com)
- - (newline problem with parse_ini_file+INI_SCANNER_RAW).
- (Felipe)
- - (__set() ignores setting properties with empty names).
- (Felipe)
- - (Throwing an exception in a destructor causes invalid
- catching). (Dmitry)
- - (Zend/tests/bug45877.phpt fails). (Dmitry)
-
-
-- Build issues:
-
- - (Compile error if systems do not have stdint.h)
- (Sriram Natarajan)
- - (nanosleep not detected properly on some solaris versions).
- (Ulf, Tony)
- - (make fails on glob_wrapper). (Felipe)
-
-
-- Calendar extension:
-
- - (cal_days_in_month incorrect for December 1 BCE).
- (gpap at internet dot gr, Adam)
-
-
-- cURL extension:
-
- - (curl_setopt does not accept persistent streams).
- (Gustavo, Ilia)
- - (cURL leaks handle and causes assertion error
- (CURLOPT_STDERR)). (Gustavo)
- - (CURLOPT_PRIVATE gets corrupted). (Ilia)
- - (curl extension slows down PHP on Windows). (Pierre)
-
-
-- DateTime extension:
-
- - (gettimeofday implementation in php/win32/time.c can return
- 1 million microsecs). (ped at 7gods dot org)
- - (Iterating over a dateperiod twice is broken). (Derick)
- - (Relative dates and getTimestamp increments by one day).
- (Derick)
- - (date_parse parse 24:xx:xx as valid time). (Derick)
- - Added support for the ( and ) delimiters/separators to
- DateTime::createFromFormat(). (Derick)
-
-
-- DBA extension:
-
- - Added Berkeley DB 5.1 support to the DBA extension. (Oracle Corp.)
-
-
-- DOM extension:
-
- - (DOMCdataSection does not work with splitText). (Ilia)
-
-
-- Filter extension:
-
- - Fixed the filter extension accepting IPv4 octets with a leading 0 as that
- belongs to the unsupported "dotted octal" representation. (Gustavo)
- - (problems in the validation of IPv6 addresses with leading
- and trailing :: in the filter extension). (Gustavo)
- - (problems in the validation of IPv6 addresses with IPv4
- addresses and ::). (Gustavo)
-
-
-- GD extension:
-
- - (fix crash if anti-aliasing steps are invalid). (Pierre)
-
-
-- GMP extension:
-
- - (gmp_mod returns negative result when non-negative is
- expected). (Stas)
- - (GNU MP invalid version match). (Adam)
-
-
-- Hash extension:
-
- - (unaligned memory access in ext/hash/hash_tiger.c).
- (Mike, Ilia)
-
-
-- Iconv extension:
-
- - (The 'iconv_mime_decode_headers' function is skipping
- headers). (Adam)
- - (iconv output handler outputs incorrect content type
- when flags are used). (Ilia)
- - (iconv_mime_decode() does not ignore malformed Q-encoded
- words). (Ilia)
-
-
-- Intl extension:
-
- - Fixed crashes on invalid parameters in intl extension. (CVE-2010-4409). (Stas, Maksymilian
- Arciemowicz)
- - Added support for formatting the timestamp stored in a DateTime object.
- (Stas)
- - (IntlDateFormatter::parse result is limited to the integer
- range). (Stas)
-
-
-- Mbstring extension:
-
- - (mb_strcut() returns garbage with the excessive length
- parameter). (CVE-2010-4156) (Mateusz Kocielski, Pierre, Moriyoshi)
- - (Unicode casing table was out-of-date. Updated with
- UnicodeData-6.0.0d7.txt and included the source of the generator program with
- the distribution) (Gustavo).
- - (mb_send_mail() appends an extra MIME-Version header).
- (Adam)
-
-
-- MSSQL extension:
-
- - Fixed possible crash in mssql_fetch_batch(). (Kalle)
- - (Segfault when optional parameters are not passed in to
- mssql_connect). (Felipe)
-
-
-- MySQL extension:
-
- - (php_mysql_fetch_hash writes long value into int).
- (Kalle, rein at basefarm dot no)
-
-
-- MySQLi extension:
-
- - (Wrong data inserted with mysqli/mysqlnd when using
- mysqli_stmt_bind_param and value> PHP_INT_MAX). (Andrey)
- - (mysql_stmt_attr_[gs]et argument points to incorrect type).
- (rein at basefarm dot no)
- - (mysqli doesn't install headers with structures it uses).
- (Andrey)
- - (Call to undefined method mysqli::poll() - must be static).
- (Andrey)
- - (MySQLi build failure with mysqlnd on MacOS X). (Andrey)
- - (MySQLi/libmysql build failure on OS X, FreeBSD). (Andrey)
- - (mysqli_report() should be per-request setting). (Kalle)
- - (mysqli_fetch_all does not work with MYSQLI_USE_RESULT).
- (Andrey)
- - (Misbehaviour of magic_quotes_runtime (get/set)). (Andrey)
- - (Can't initialize character set hebrew). (Andrey)
-
-
-- MySQLnd:
-
- - (crash in mysqlnd after hitting memory limit). (Andrey)
-
-
-- ODBC extension:
-
-- (Broken error handling in odbc_execute).
- (mkoegler at auto dot tuwien dot ac dot at)
-
-
-- Openssl extension:
-
- - Fixed possible blocking behavior in openssl_random_pseudo_bytes on Windows.
- (Pierre)
- - (Invalid read on openssl_csr_new()). (Felipe)
- - (segfault when ssl stream option capture_peer_cert_chain
- used). (Felipe)
-
-
-- Oracle Database extension (OCI8):
-
- - (Valgrind warnings in oci_set_* functions) (Oracle Corp.)
- - (Using oci_connect causes PHP to take a long time to
- exit). Requires Oracle 11.2.0.2 client libraries (or Oracle bug fix
- 9891199) for this patch to have an effect. (Oracle Corp.)
-
-
-- PCNTL extension:
-
- - (Race condition when handling many concurrent signals).
- (nick dot telford at gmail dot com, Arnaud)
-
-
-- PCRE extension:
-
- - (PCRE-Meta-Characters not working with utf-8). (Felipe)
- - (Docs say preg_match() returns FALSE on error, but it
- returns int(0)). (slugonamission at gmail dot com)
-
-
-- PHAR extension:
-
- - (unaligned memory access in phar.c).
- (geissert at debian dot org, Ilia)
-
-
-- PHP-FPM SAPI:
-
- - (segfault when using -y). (fat)
- - Fixed inconsistent backlog default value (-1) in FPM on many systems. (fat)
- - (libevent made FPM crashed when forking - libevent has
- been removed). (fat)
- - (gcc builtin atomic functions were sometimes used when they
- were not available). (fat)
- - (configuration file errors are not logged to stderr). (fat)
- - (FPM Status page returns inconsistent Content-Type headers).
- (fat)
- - (libevent was not only linked to php-fpm). (fat)
-
-
-- PDO:
-
- - (PDO bindValue writes long int 32bit enum).
- (rein at basefarm dot no)
- - (PDO::FETCH_INTO leaks memory). (Felipe)
-
-
-- PDO DBLib driver:
-
- - (pdo_dblib segmentation fault when iterating MONEY values).
- (Felipe)
-
-
-- PDO Firebird driver:
-
- - Restored firebird support (VC9 builds only). (Pierre)
- - (pdo_firebird did not implement rowCount()).
- (preeves at ibphoenix dot com)
- - (pdo_firebird getAttribute() crash).
- (preeves at ibphoenix dot com)
-
-
-- PDO MySQL driver:
-
- - (Binding params doesn't work when selecting a date inside a
- CASE-WHEN). (Andrey)
-
-
-- PostgreSQL extension:
-
- - (pg_delete() fails on NULL). (ewgraf at gmail dot com)
-
-
-- Reflection extension:
-
- - Fixed ReflectionProperty::isDefault() giving a wrong result for properties
- obtained with ReflectionClass::getProperties(). (Gustavo)
- - (Reflection doesnt get dynamic property value from
- getProperty()). (Felipe)
- - (ReflectionClass::newInstanceArgs does not work for classes
- without constructors). (Johannes)
-
-
-- SOAP extension:
-
- - (RFC2616 transgression while HTTPS request through proxy
- with SoapClient object). (Dmitry)
-
-
-- SPL extension:
-
- - (Segmentation fault when extending SplFixedArray). (Felipe)
- - (SplFileObject doesn't initialise default CSV escape
- character). (Adam)
- - (Segfault in SplObjectStorage::removeAll()). (Felipe)
- - (SPLObjectStorage defeats gc_collect_cycles). (Gustavo)
- - (SplFileObject::fscanf Segmentation fault). (Felipe)
- - (SplFileInfo::getType() does not work symbolic link
- and directory). (Pierre)
- - (Storing many SPLFixedArray in an array crashes). (Felipe)
- - (RegexIterator::REPLACE doesn't work). (Felipe)
-
-
-- SQLite3 extension:
-
- - (sqlite3 columnName() segfaults on bad column_number).
- (Felipe)
-
-
-- Streams:
-
- - Fixed forward stream seeking emulation in streams that don't support seeking
- in situations where the read operation gives back less data than requested
- and when there was data in the buffer before the emulation started. Also made
- more consistent its behavior -- should return failure every time less data
- than was requested was skipped. (Gustavo)
- - (stream casting that relies on fdopen/fopencookie fails
- with streams opened with, inter alia, the 'xb' mode). (Gustavo)
- - (stream_get_contents has an unpredictable behavior when the
- underlying stream does not support seeking). (Gustavo)
- - (Invalid write on second and subsequent reads with an
- inflate filter fed invalid data). (Gustavo)
- - (writes to fopencookie FILE* not commited when seeking the
- stream). (Gustavo)
-
-
-- WDDX extension:
-
- - (wddx_deserialize corrupts integer field value when left
- empty). (Felipe)
-
-
-- Zlib extension:
-
- - (zlib fopen wrapper does not use context). (Gustavo)
-
-
-
-
-
-
-
-Version 5.3.3
-
-
-- Upgraded bundled sqlite to version 3.6.23.1. (Ilia)
-- Upgraded bundled PCRE to version 8.02. (Ilia)
-
-
-- Added support for JSON_NUMERIC_CHECK option in json_encode() that converts numeric strings to integers. (Ilia)
-- Added stream_set_read_buffer, allows to set the buffer for read operation. (Pierre)
-- Added stream filter support to mcrypt extension (ported from mcrypt_filter). (Stas)
-- Added full_special_chars filter to ext/filter. (Rasmus)
-- Added backlog socket context option for stream_socket_server(). (Mike)
-- Added fifth parameter to openssl_encrypt()/openssl_decrypt() (string $iv) to use non-NULL IV.
- Made implicit use of NULL IV a warning. (Sara)
-- Added openssl_cipher_iv_length(). (Sara)
-- Added FastCGI Process Manager (FPM) SAPI. (Tony)
-- Added recent Windows versions to php_uname and fix undefined windows version support. (Pierre)
-- Added Berkeley DB 5 support to the DBA extension. (Johannes, Chris Jones)
-- Added support for copy to/from array/file for pdo_pgsql extension. (Denis Gasparin, Ilia)
-- Added inTransaction() method to PDO, with specialized support for Postgres. (Ilia, Denis Gasparin)
-
-
-- Changed namespaced classes so that the ctor can only be named __construct now. (Stas)
-- Reset error state in PDO::beginTransaction() reset error state. (Ilia)
-
-
-- (SQLite3::busyTimeout not existing). (Mark)
-- (Adding udate to imap_fetch_overview results). (Charles_Duffy at dell dot com )
-- Rewrote var_export() to use smart_str rather than output buffering, prevents data disclosure if a fatal error occurs (CVE-2010-2531). (Scott)
-- Fixed possible buffer overflows in mysqlnd_list_fields, mysqlnd_change_user. (Andrey)
-- Fixed possible buffer overflows when handling error packets in mysqlnd. Reported by Stefan Esser. (Andrey)
-- Fixed very rare memory leak in mysqlnd, when binding thousands of columns. (Andrey)
-- Fixed a crash when calling an inexistent method of a class that inherits PDOStatement if instantiated directly instead of doing by the PDO methods. (Felipe)
-
-
-- Fixed memory leak on error in mcrypt_create_iv on Windows. (Pierre)
-- Fixed a possible crash because of recursive GC invocation. (Dmitry)
-- Fixed a possible resource destruction issues in shm_put_var(). Reported by Stefan Esser. (Dmitry)
-- Fixed a possible information leak because of interruption of XOR operator. Reported by Stefan Esser. (Dmitry)
-- Fixed a possible memory corruption because of unexpected call-time pass by refernce and following memory clobbering through callbacks.
- Reported by Stefan Esser. (Dmitry)
-- Fixed a possible memory corruption in ArrayObject::uasort(). Reported by Stefan Esser. (Dmitry)
-- Fixed a possible memory corruption in parse_str(). Reported by Stefan Esser. (Dmitry)
-- Fixed a possible memory corruption in pack(). Reported by Stefan Esser. (Dmitry)
-- Fixed a possible memory corruption in substr_replace(). Reported by Stefan Esser. (Dmitry)
-- Fixed a possible memory corruption in addcslashes(). Reported by Stefan Esser. (Dmitry)
-- Fixed a possible stack exhaustion inside fnmatch(). Reported by Stefan Esser. (Ilia)
-- Fixed a possible dechunking filter buffer overflow. Reported by Stefan Esser. (Pierre)
-- Fixed a possible arbitrary memory access inside sqlite extension. Reported by Mateusz Kocielski. (Ilia)
-- Fixed string format validation inside phar extension. Reported by Stefan Esser. (Ilia)
-- Fixed handling of session variable serialization on certain prefix characters. Reported by Stefan Esser. (Ilia)
-- Fixed a NULL pointer dereference when processing invalid XML-RPC requests (Fixes CVE-2010-0397, bug ). (Raphael Geissert)
-- Fixed 64-bit integer overflow in mhash_keygen_s2k(). (Clément LECIGNE, Stas)
-- Fixed SplObjectStorage unserialization problems (CVE-2010-2225). (Stas)
-- Fixed the mail.log ini setting when no filename was given. (Johannes)
-
-
-- (Segmentation fault when using mail() on a rhel 4.x (only 64 bit)). (Adam)
-- (json_decode() shows no errors on invalid UTF-8). (Scott)
-- (hash_copy() does not copy the HMAC key, causes wrong results and PHP crashes). (Felipe)
-- (Crash when an Exception occured in iterator_to_array). (Johannes)
-- (converting closure to array yields empty array). (Felipe)
-- (Reflectionfunction reports invalid number of arguments for function aliases). (Felipe)
-- (custom request header variables with numbers are removed). (Sriram Natarajan)
-- (Invalid E_STRICT redefined constructor error). (Felipe)
-- (Constants are parsed into the ini file for section names). (Felipe)
-- (mysqli_result::fetch_all returns null, not an empty array). (Andrey)
-- (dns_get_record() garbage in 'ipv6' field on Windows). (Pierre)
-- (character_set_client & character_set_connection reset after mysqli_change_user()). (Andrey)
-- (GD doesn't recognize latest libJPEG versions). (php at group dot apple dot com, Pierre)
-- (Memory leak when writing on uninitialized variable returned from function). (Dmitry)
-- (Memory leak when passing a closure to method_exists()). (Felipe)
-- (ReflectionClass fails on Closure class). (Felipe)
-- (handling of case sensitivity of old-style constructors changed in 5.3+). (Felipe)
-- (Concurrent builds fail in install-programs). (seanius at debian dot org, Kalle)
-- (make lcov doesn't support TESTS variable anymore). (Patrick)
-- (open_basedir restrictions mismatch on vacuum command). (Ilia)
-- (Memory allocation problems after using variable variables). (Dmitry)
-- (spl_autoload and *nix support with namespace). (Felipe)
-- (AIX: Several files are out of ANSI spec). (Kalle, coreystup at gmail dot com)
-- (ReflectionParameter::getDefaultValue() memory leaks with constant array). (Felipe)
-- (ReflectionParameter fails if default value is an array with an access to self::). (Felipe)
-- (Parse error in parse_ini_file() function when empy value followed by no newline). (Felipe)
-- (checkdnsrr does not support types other than MX). (Pierre)
-- (Bad warning when register_shutdown_function called with wrong num of parameters). (Felipe)
-- (Segfault with strange __destruct() for static class variables). (Dmitry)
-- (constant() aborts execution when fail to check undefined constant). (Felipe)
-- (Fileinfo __construct or open does not work with NULL). (Pierre)
-- (xmlrpc_get_type() returns true on invalid dates). (Mike)
-- (Content-length header is limited to 32bit integer with Apache2 on Windows). (Pierre)
-- (mark DOMNodeList and DOMNamedNodeMap as Traversable). (David Zuelke)
-- (Test mysql_mysqlnd_read_timeout_long must fail on MySQL4). (Andrey)
-- (Unsafe operations in free_storage of SPL iterators, causes crash during shutdown). (Etienne)
-- (Phar::setStub looks for case-sensitive __HALT_COMPILER()). (Ilia)
-- (ini per dir crashes when invalid document root are given). (Pierre)
-- (imagefill does not work correctly for small images). (Pierre)
-- (getColumnMeta causes segfault when re-executing query after calling nextRowset). (Pierrick)
-- Certificate file without private key (pk in another file) doesn't work. (Andrey)
-- (CURLOPT_FOLLOWLOCATION error message is misleading). (Pierre)
-- (script path not correctly evaluated). (russell dot tempero at rightnow dot com)
-- (Crash when calling mysqli_options()). (Felipe)
-- (PHP crash with wrong HTML in SimpleXML). (Felipe)
-- (pg_copy_to: Invalid results when using fourth parameter). (Felipe)
-- (pg_copy_to: WARNING: nonstandard use of \\ in a string literal). (cbandy at jbandy dot com)
-- (pg_copy_from does not allow schema in the tablename argument). (cbandy at jbandy dot com)
-- (Mysqli - zombie links). (Andrey)
-- (newline in end of header is shown in start of message). (Daniel Egeberg)
-- (JSON_ERROR_UTF8 is undefined). (Felipe)
-- (Bus error due to wrong alignment in mysqlnd). (Rainer Jung)
-- (Don't assume UINT64_C it's ever available). (reidrac at usebox dot net, Pierre)
-- (Uninitialized memory reference with oci_bind_array_by_name) (Oracle Corp.)
-- (query timeout in mssql can not be changed per query). (ejsmont dot artur at gmail dot com)
-- (debug_backtrace() causes segmentation fault and/or memory issues). (Dmitry)
-- (var_dump() invalid/slow *RECURSION* detection). (Felipe)
-- (Missing ifdefs / logic bug in crypt code cause compile errors). (Felipe)
-- (crypt() function hangs after 3rd call). (Pierre, Sriram)
-- (Error line reported incorrectly if error handler throws an exception). (Stas)
-- (DateTime::createFromFormat() fails if format string contains timezone). (Adam)
-- (mysqli_close / connection memory leak). (Andrey, Johannes)
-- (URL-Rewriter is still enabled if use_only_cookies is on). (Ilia, j dot jeising at gmail dot com)
-- (oci_error doesn't report last error when called two times) (Oracle Corp.)
-- (php_load_extension() is missing when HAVE_LIBDL is undefined). (Tony)
-- (Faultstring property does not exist when the faultstring is empty) (Ilia, dennis at transip dot nl)
-- (zlib.output_compression Overwrites Vary Header). (Adam)
-- (CURL_VERSION_LARGEFILE incorrectly used after libcurl version 7.10.1). (aron dot ujvari at microsec dot hu)
-- (Empty mysql.default_port does not default to 3306 anymore, but 0). (Adam)
-- (milter SAPI crash on startup). (igmar at palsenberg dot com)
-- (pdo_mssql is trimming value of the money column). (Ilia, alexr at oplot dot com)
-- (ftp_put() returns false when transfer was successful). (Ilia)
-- (ext/date/php_date.c fails to compile with Sun Studio). (Sriram Natarajan)
-- (Static calling in non-static method behaves like $this->). (Felipe)
-- (curl_setopt() doesn't output any errors or warnings when an invalid option is provided). (Ilia)
-- (imagefill() doesn't work with large images). (Pierre)
-- ('last day' and 'first day' are handled incorrectly when parsing date strings). (Derick)
-- (DBA DB4 doesn't work with Berkeley DB 4.8). (Chris Jones)
-- (DBA DB4 uses mismatched headers and libraries). (Chris Jones)
-- (mysqli_ssl_set not working). (Andrey)
-- (filter doesn't detect int overflows with GCC 4.4). (Raphael Geissert)
-- (unaligned memory access in dba_fetch()). (Felipe)
-- (Soap headers Authorization not allowed). (Brain France, Dmitry)
-- (DOMNotation is not subclass of DOMNode). (Rob)
-- (property_exists does not work for private). (Felipe)
-- (in WSDL mode Soap Header handler function only being called if defined in WSDL). (mephius at gmail dot com)
-- (Inconsistent namespaces sent to functions registered with spl_autoload_register). (Felipe)
-- (removing E_WARNING from parse_url). (ralph at smashlabs dot com, Pierre)
-- (incorrect shebang in phar.phar). (Fedora at FamilleCollet dot com)
-- (date_create_from_format enforces 6 digits for 'u' format character). (Derick)
-- (Exceptions thrown in __call / __callStatic do not include file and line in trace). (Felipe)
-- (Compile failure compiling ext/phar/util.lo). (Felipe)
-- (name clash between global and local variable). (patch by yoarvi at gmail dot com)
-- (DateTime::sub() allows 'relative' time modifications). (Derick)
-- (fix possible memory corruption with very long names). (Pierre)
-- (Crash while creating an instance of Zend_Mail_Storage_Pop3). (Dmitry)
-- (STDOUT losing data with posix_isatty()). (Mike)
-- (DateInterval::format("%a") is always zero when an interval is created from an ISO string). (Derick)
-- (memory leaks in php_date.c if garbage collector is enabled). (Dmitry)
-- (FILTER_VALIDATE_EMAIL filter needs updating) (Rasmus)
-- (XPath namespace prefix conflict). (Rob)
-- (odbc_autocommit doesn't work). (Felipe)
-- (PDO returns null when SQLite connection fails). (Felipe)
-- (mysqli_ssl_set not found). (Andrey)
-- (Reflection doesn't seem to work properly on MySqli). (Andrey)
-- (PHP crashes when GC invoked on COM object). (Stas)
-- (DateTime::diff() mistake if start in January and interval > 28 days). (Derick)
-- (DateTime::diff() repeats previous sub() operation). (yoarvi@gmail.com, Derick)
-- (DomDocument : saveHTMLFile wrong charset). (Rob)
-- (__COMPILER_HALT_OFFSET__ incorrect in PHP >= 5.3). (Felipe)
-- (Timezone database fallback map is outdated). (Derick)
-- (Cyclical garbage collector memory leak). (Dmitry)
-- (xpath() returns FALSE for legitimate query). (Rob)
-- (SplFileInfo::getPathInfo should return the parent dir). (Etienne)
-- (iconv_mime_encode() quoted-printable scheme is broken). (Adam, patch from hiroaki dot kawai at gmail dot com).
-- (sscanf() does not support 64-bit values). (Mike)
-- (Some timezone identifiers can not be parsed). (Derick)
-- (stream_socket_enable_crypto() blocks and eats CPU). (vincent at optilian dot com)
-- (sasl support for ldap on Windows). (Pierre)
-- (formatOutput does not work with saveHTML). (Rob)
-- (getimagesize() fails to detect width/height on certain JPEGs). (Ilia)
-
-
-
-
-
-Version 5.3.2
-
-
-- Security Fixes
-
- - Improved LCG entropy. (Rasmus, Samy Kamkar)
- - Fixed safe_mode validation inside tempnam() when the directory path does not end with a /). (Martin Jansen)
- - Fixed a possible open_basedir/safe_mode bypass in the session extension identified by Grzegorz Stachowiak. (Ilia)
-
-
-
-
-- Upgraded bundled sqlite to version 3.6.22. (Ilia)
-- Upgraded bundled libmagic to version 5.03. (Mikko)
-- Upgraded bundled PCRE to version 8.00. (Scott)
-- Updated timezone database to version 2010.3. (Derick)
-
-- Improved LCG entropy. (Rasmus, Samy Kamkar)
-- Improved crypt support for edge cases (UFC compatibility). (Solar Designer, Joey, Pierre)
-
-- Changed gmp_strval() to use full range from 2 to 62, and -2 to -36. FR (David Soria Parra)
-- Changed "post_max_size" php.ini directive to allow unlimited post size by setting it to 0. (Rasmus)
-- Changed tidyNode class to disallow manual node creation. (Pierrick)
-
-- Removed automatic file descriptor unlocking happening on shutdown and/or stream close (on all OSes). (Tony, Ilia)
-
-- Added libpng 1.4.0 support. (Pierre)
-- Added support for DISABLE_AUTHENTICATOR for imap_open. (Pierre)
-- Added missing host validation for HTTP urls inside FILTER_VALIDATE_URL. (Ilia)
-- Added stream_resolve_include_path(). (Mikko)
-- Added INTERNALDATE support to imap_append. (nick at mailtrust dot com)
-- Added support for SHA-256 and SHA-512 to php's crypt. (Pierre)
-- Added realpath_cache_size() and realpath_cache_get() functions. (Stas)
-- Added FILTER_FLAG_STRIP_BACKTICK option to the filter extension. (Ilia)
-- Added protection for $_SESSION from interrupt corruption and improved "session.save_path" check. (Stas)
-- Added LIBXML_PARSEHUGE constant to override the maximum text size of a single text node when using libxml2.7.3+. (Kalle)
-- Added ReflectionMethod::setAccessible() for invoking non-public methods through the Reflection API. (Sebastian)
-- Added Collator::getSortKey for intl extension. (Stas)
-- Added support for CURLOPT_POSTREDIR. FR . (Sriram Natarajan)
-- Added support for CURLOPT_CERTINFO. FR . (Linus Nielsen Feltzing <linus@haxx.se>)
-- Added client-side server name indication support in openssl. (Arnaud)
-
-- Improved fix for bug (Segfault caused by uksort()). (Stas)
-
-- Fixed mysqlnd hang when queries exactly 16777214 bytes long are sent. (Andrey)
-- Fixed incorrect decoding of 5-byte BIT sequences in mysqlnd. (Andrey)
-- Fixed error_log() to be binary safe when using message_type 3. (Jani)
-- Fixed unnecessary invocation of setitimer when timeouts have been disabled. (Arvind Srinivasan)
-- Fixed memory leak in extension loading when an error occurs on Windows. (Pierre)
-- Fixed safe_mode validation inside tempnam() when the directory path does not end with a /). (Martin Jansen)
-- Fixed a possible open_basedir/safe_mode bypass in session extension identified by Grzegorz Stachowiak. (Ilia)
-- Fixed possible crash when a error/warning is raised during php startup. (Pierre)
-- Fixed possible bad behavior of rename on windows when used with symbolic links or invalid paths. (Pierre)
-- Fixed error output to stderr on Windows. (Pierre)
-- Fixed memory leaks in is_writable/readable/etc on Windows. (Pierre)
-- Fixed memory leaks in the ACL function on Windows. (Pierre)
-- Fixed memory leak in the realpath cache on Windows. (Pierre)
-- Fixed memory leak in zip_close. (Pierre)
-- Fixed crypt's blowfish sanity check of the "setting" string, to reject iteration counts encoded as 36 through 39. (Solar Designer, Joey, Pierre)
-
-- (crypt crashes when invalid salt are given). (Pierre)
-- (allow underscore _ in constants parsed in php.ini files). (Jani)
-- (Custom content-length set incorrectly in Apache SAPIs). (Brian France, Rasmus)
-- (Wrong date by php_date.c patch with ancient gcc/glibc versions). (Derick)
-- (X-PHP-Originating-Script adding two new lines in *NIX). (Ilia)
-- (build fails with openssl 1.0 due to md2 deprecation). (Ilia, hanno at hboeck dot de)
-- (strip_tags() removes all tags greater then 1023 bytes long). (Ilia)
-- (php.ini directive pdo_mysql.default_socket is ignored). (Ilia)
-- (HTTP fopen wrapper does not support passwordless HTTP authentication). (Jani)
-- (stream_set_write_buffer() has no effect on socket streams). (vnegrier at optilian dot com, Ilia)
-- (system.multiCall crashes in xmlrpc extension). (hiroaki dot kawai at gmail dot com, Ilia)
-- (CURLOPT_FTP_SKIP_PASV_IP does not exist). (Sriram)
-- (exec() adds single byte twice to $output array). (Ilia)
-- (All PDOExceptions hardcode 'code' property to 0). (Joey, Ilia)
-- (Bug in garbage collector causes crash). (Dmitry)
-- (putenv does not set ENV when the value is only one char). (Pierre)
-- (strtotime() does not support eighth ordinal number). (Ilia)
-- (DOMDocument::loadXML does not allow UTF-16). (Rob)
-- (copy() with an empty (zero-byte) HTTP source succeeds but returns false). (Ilia)
-- (filter_input() does not return default value if the variable does not exist). (Ilia)
-- (XML_OPTION_SKIP_TAGSTART option has no effect). (Pierrick)
-- (Broken object model when extending tidy). (Pierrick)
-- (Crash while running ldap_next_reference test cases). (Sriram)
-- (segfault in garbage collection when using set_error_handler and DomDocument). (Dmitry)
-- (compile failure: Conflicting HEADER type declarations). (Jani)
-- (Use of <stdbool.h> is valid only in a c99 compilation environment. (Sriram)
-- (declare encoding doesn't work within an included file). (Felipe)
-- (PDO::FETCH_FUNC fails with Closures). (Felipe, Pierrick)
-- (PDO-ODBC stored procedure call from Solaris 64-bit causes seg fault). (davbrown4 at yahoo dot com, Felipe)
-- (PROCEDURE db.myproc can't return a result set in the given context). (Andrey)
-- (Reference argument converted to value in __call). (Stas)
-- (performance regression handling objects, ten times slowerin 5.3 than in 5.2). (Dmitry)
-- (date_create_from_format() enforces 6 digits for 'u' format character). (Ilia)
-- (nanosleep not detected properly on some solaris versions). (Jani)
-- (php.ini parser does not allow spaces in ini keys). (Jani)
-- (crypt ignores sha512 prefix). (Pierre)
-- (Allow use of ; in values via ;; in PDO DSN). (Ilia, Pierrick)
-- (xmlrpc does not preserve keys in encoded indexed arrays). (Felipe)
-- (xmlrpc_encode_request() changes object into array in calling function). (Felipe)
-- (get_browser(null) does not use HTTP_USER_AGENT). (Jani)
-- (conflicting types for llabs). (Jani)
-- (Crash When Calling Parent Constructor with call_user_func()). (Dmitry)
-- (isset() and empty() silently casts array to object). (Felipe)
-- (pdo_mysql.default_socket in php.ini shouldn't used if it is empty). (foutrelis at gmail dot com, Ilia)
-- (Socket path passed using --with-mysql-sock is ignored when mysqlnd is enabled). (Jani)
-- (soap call Segmentation fault on a redirected url). (Pierrick)
-- (crash by ldap_get_option() with LDAP_OPT_NETWORK_TIMEOUT). (Ilia, shigeru_kitazaki at cybozu dot co dot jp)
-- (Compiling with libedit cannot find readline.h). (tcallawa at redhat dot com)
-- (segmentation fault when concatenating very large strings on 64bit linux). (Ilia)
-- (stream_copy_to_stream() produces warning when source is not file). (Stas)
-- (pg_copy_to() fails when table name contains schema. (Ilia)
-- (ldap_get_entries() return false instead of an empty array when there is no error). (Jani)
-- (Incorrectly matched docComment). (Felipe)
-- (FastCGI fails with wrong error on HEAD request to non-existant file). (Dmitry)
-- (Memory leak when fetching timestamp column from Oracle database). (Felipe)
-- (wrong working directory in symlinked files). (Dmitry)
-- (FILTER_VALIDATE_EMAIL fails with valid addresses containing = or ?). (Pierrick)
-- (ReflectionClass::hasProperty behaves like isset() not property_exists). (Felipe)
-- (property_exists: Closure object cannot have properties). (Felipe)
-- (crash while running bug35634.phpt). (Felipe)
-- (With default compilation option, php symbols are unresolved for nsapi). (Uwe Schindler)
-- (NSAPI performance improvements). (Uwe Schindler)
-- (parse_url() incorrect when ? in fragment). (Ilia)
-- (pdo_mysql doesn't use PHP_MYSQL_UNIX_SOCK_ADDR). (Ilia)
-- (Throwing through Reflection modified Exception object makes segmentation fault). (Felipe)
-- (SNMP3 warning message about security level printed twice). (Jani)
-- (pdo_pgsql prepare() re-use previous aborted transaction). (ben dot pineau at gmail dot com, Ilia, Matteo)
-- (Phar::isBuffering() returns inverted value). (Greg)
-- (crash with ftp stream in php_stream_context_get_option()). (Pierrick)
-- (Curl post upload functions changed). (Ilia)
-- (Making reference on string offsets crashes PHP). (Dmitry)
-- (import_request_variables() always returns NULL). (Ilia, sjoerd at php dot net)
-- , (http wrapper breaks on 1024 char long headers). (Ilia)
-- (SimpleXML allow (un)serialize() calls without warning). (Ilia, wmeler at wp-sa dot pl)
-- (ReflectionClass::hasProperty returns true for a private property in base class). (Felipe)
-- (ini parser crashes with apache2 and using ${something} ini variables). (Jani)
-- (libxml 2.7.3+ limits text nodes to 10MB). (Felipe)
-- (DOMUserData does not exist). (Rob)
-- (imageTTFText text shifted right). (Takeshi Abe)
-- (date_format buffer not long enough for >4 digit years). (Derick, Adam)
-- (oci8: using LOBs causes slow PHP shutdown). (Oracle Corp.)
-- (PDO fetchObject sets values before calling constructor). (Pierrick)
-- (Constants defined in Interfaces can be overridden). (Felipe)
-- (setAttributeNS fails setting default namespace). (Rob)
-- (Floating point NaN cause garbage characters). (Sjoerd)
-- (Compile error due to old DNS functions on AIX systems). (Scott)
-- (crash when extending PDOStatement and trying to set queryString property). (Felipe)
-- (Directives in PATH section do not get applied to subdirectories). (Patch by: ct at swin dot edu dot au)
-- (SoapClient does not honor max_redirects). (Sriram)
-- (Content-type parameter "boundary" is not case-insensitive in HTTP uploads). (Ilia)
-- (importNode doesn't preserve attribute namespaces). (Rob)
-- (extract() problem with array containing word "this"). (Ilia, chrisstocktonaz at gmail dot com)
-- ($php_errormsg is limited in size of characters) (Oracle Corp.)
-- (htmlentities() uses obsolete mapping table for character entity references). (Moriyoshi)
-- (strip_tags() truncates rest of string with invalid attribute). (Ilia, hradtke)
-- (PDOStatement->execute() returns true then false for same statement). (Pierrick)
-- (define() allows :: in constant names). (Ilia)
-- (imap_utf8() returns only capital letters). (steffen at dislabs dot de, Pierre)
-- (Failure in odbc_exec() using oracle-supplied odbc driver). (tim dot tassonis at trivadis dot com)
-
-
-
-
-Version 5.3.1
-
-
-- Security Fixes
-
- - Added "max_file_uploads" INI directive, which can be set to limit the number of file uploads per-request to 20 by default, to prevent possible DOS via temporary file exhaustion. (Ilia)
- - Added missing sanity checks around exif processing. (Ilia)
- - Fixed a safe_mode bypass in tempnam(). (Rasmus)
- - Fixed a open_basedir bypass in posix_mkfifo(). (Rasmus)
- - (safe_mode_include_dir fails). (Johannes, christian at elmerot dot se)
-
-
-
-- Added error constant when json_encode() detects an invalid UTF-8 sequence. (Scott)
-- Added support for ACL on Windows for thread safe SAPI (Apache2 for example) and fix its support on NTS. (Pierre)
-
-- Upgraded bundled sqlite to version 3.6.19. (Scott)
-- Updated timezone database to version 2009.17 (2009q). (Derick)
-
-- Fixed crash in com_print_typeinfo when an invalid typelib is given. (Pierre)
-- Fixed a safe_mode bypass in tempnam() identified by Grzegorz Stachowiak. (Rasmus)
-- Fixed a open_basedir bypass in posix_mkfifo() identified by Grzegorz Stachowiak. (Rasmus)
-- Fixed certificate validation inside php_openssl_apply_verification_policy (Ryan Sleevi, Ilia)
-- Fixed crash in SQLiteDatabase::ArrayQuery() and SQLiteDatabase::SingleQuery() when calling using Reflection. (Felipe)
-- Fixed crash when instantiating PDORow and PDOStatement through Reflection. (Felipe)
-- Fixed sanity check for the color index in imagecolortransparent. (Pierre)
-- Fixed scandir/readdir when used mounted points on Windows. (Pierre)
-- Fixed zlib.deflate compress filter to actually accept level parameter. (Jani)
-- Fixed leak on error in popen/exec (and related functions) on Windows. (Pierre)
-- Fixed possible bad caching of symlinked directories in the realpath cache on Windows. (Pierre)
-- Fixed atime and mtime in stat related functions on Windows. (Pierre)
-- Fixed spl_autoload_unregister/spl_autoload_functions wrt. Closures and Functors. (Christian Seiler)
-- Fixed open_basedir circumvention for "mail.log" ini directive. (Maksymilian Arciemowicz, Stas)
-- Fixed signature generation/validation for zip archives in ext/phar. (Greg)
-- Fixed memory leak in stream_is_local(). (Felipe, Tony)
-- Fixed BC break in mime_content_type(), removes the content encoding. (Scott)
-
-- Changed ini file directives [PATH=](on Win32) and [HOST=](on all) to be case insensitive (garretts)
-- Restored shebang line check to CGI sapi (not checked by scanner anymore). (Jani)
-
-- Improve symbolic, mounted volume and junctions support for realpath on Windows. (Pierre)
-- Improved readlink on Windows, suppress \??\ and use the drive syntax only. (Pierre)
-- Improved dns_get_record() AAAA support on windows. Always available when IPv6 is support is installed, format is now the same than on unix. (Pierre)
-- Improved the DNS functions on OSX to use newer APIs, also use Bind 9 API where available on other platforms. (Scott)
-- Improved shared extension loading on OSX to use the standard Unix dlopen() API. (Scott)
-- (safe_mode_include_dir fails). (Johannes, christian at elmerot dot se)
-- (Different Hashes on Windows and Linux on wrong Salt size). (Pierre)
-- (no support for ././@LongLink for long filenames in phar tar support). (Greg)
-- (throwing exception in __autoload crashes when interface is not defined). (Felipe)
-- (exec() fails to return data inside 2nd parameter, given output lines >4095 bytes). (Ilia)
-- (time_sleep_until() is not available on OpenSolaris). (Jani)
-- (long2ip() can return wrong value in a multi-threaded applications). (Ilia, Florian Anderiasch)
-- (calling mcrypt after mcrypt_generic_deinit crashes). (Sriram Natarajan)
-- (crashes when using fileinfo when timestamp conversion fails). (Pierre)
-- (Unexpected change in strnatcasecmp()). (Rasmus)
-- (imap_listscan function missing). (Felipe)
-- (use of C++ style comments causes build failure). (Sriram Natarajan)
-- (CURLOPT_INFILESIZE sometimes causes warning "CURLPROTO_FILE cannot be set"). (Felipe)
-- (cURL's CURLOPT_FILE prevents file from being deleted after fclose). (Ilia)
-- (FILTER_SANITIZE_EMAIL allows disallowed characters). (Ilia)
-- (php engine need to correctly check for socket API return status on windows). (Sriram Natarajan)
-- (ldap.c utilizing deprecated ldap_modify_s). (Ilia)
-- (wordwrap() wraps incorrectly on end of line boundaries). (Ilia, code-it at mail dot ru)
-- (segfault in php_curl_option_curl). (Pierre)
-- (inside pdo_mysql default socket settings are ignored). (Ilia)
-- (bcmath module doesn't compile with phpize configure). (Jani)
-- (php://input (php_stream_input_read) is broken). (Jani)
-- (Ternary operator fails on Iterator object when used inside foreach declaration). (Etienne, Dmitry)
-- (Missing PHP_SUBST(PDO_MYSQL_SHARED_LIBADD)). (Jani)
-- (Inconsistency using get_defined_constants). (Garrett)
-- (gdJpegGetVersionString() inside gd_compact identifies wrong type in declaration). (Ilia)
-- (dns_get_record does not return NAPTR records). (Pierre)
-- (Import of schema from different host transmits original authentication details). (Dmitry)
-- (crash when exception thrown from __tostring()). (David Soria Parra)
-- (Missing ICU DLLs on windows package). (Pierre)
-- (posix_times returns false without error). (phpbugs at gunnu dot us)
-- (Error in dba_exists C code). (jdornan at stanford dot edu)
-- (undefined reference to mysqlnd_stmt_next_result on compile with --with-mysqli and MySQL 6.0). (Jani)
-- (2nd scan_dir produces segfault). (Felipe)
-- (mysqli segfault on error). (Rasmus)
-- (proc_get_status['exitcode'] fails on win32). (Felipe)
-- (ReflectionFunction fails to work with functions in fully qualified namespaces). (Kalle, Jani)
-- (private class static fields can be modified by using reflection). (Jani)
-- (feof never returns true for damaged file in zip). (Pierre)
-- ("disable_functions" php.ini option does not work on Zend extensions). (Stas)
-- (--enable-session=shared does not work: undefined symbol: php_url_scanner_reset_vars). (Jani)
-- (parse_ini_file() regression in 5.3.0 when using non-ASCII strings as option keys). (Jani)
-- (context option headers freed too early when using --with-curlwrappers). (Jani)
-- (The function touch() fails on directories on Windows). (Pierre)
-- (SplFileObject::fscanf() variables passed by reference). (Jani)
-- (mysqli_options() doesn't work when using mysqlnd). (Andrey)
-- (proc_open() can bypass safe_mode_protected_env_vars restrictions). (Ilia)
-- (phar tar signature algorithm reports as Unknown (0) in getSignature() call). (Greg)
-- (phar misinterprets ustar long filename standard). (Greg)
-- (phar tar stores long filenames wit prefix/name reversed). (Greg)
-- (dechunked filter broken when serving more than 8192 bytes in a chunk). (andreas dot streichardt at globalpark dot com, Ilia)
-- (PHP CLI in Interactive mode (php -a) crashes when including files from function). (Stas)
-- (zlib.output_compression does not output HTTP headers when set to a string value). (Jani)
-- (Crash when compiling with pdo_firebird). (Felipe)
-- (cURL does not upload files with specified filename). (Ilia)
-- (Double \r\n after HTTP headers when "header" context option is an array). (David Zülke)
-- (Too long error code strings in pdo_odbc driver). (naf at altlinux dot ru, Felipe)
-- (Namespace causes unexpected strict behaviour with extract()). (Dmitry)
-- (Segmentation fault in mysqli_stmt_execute()). (Andrey)
-- (is_callable returns true even if method does not exist in parent class). (Felipe)
-- (Problems compiling with Curl). (Felipe)
-- (string.c: errors: duplicate case values). (Kalle)
-- (array_merge_recursive modifies arrays after first one). (Felipe)
-- (IPv6 socket transport is not working). (Ilia)
-- (printf() returns incorrect outputted length). (Jani)
-- (Random Appearing open_basedir problem). (Rasmus, Gwynne)
-- (open office files always reported as corrupted). (Greg)
-- (RecursiveDirectoryIterator doesn't descend into symlinked directories). (Ilia)
-- (make install will fail saying phar file exists). (Greg)
-- (SIGSEGVs when using curl_copy_handle()). (Sriram Natarajan)
-- (rename() between volumes fails and reports no error on Windows). (Pierre)
-- (parse_ini_*() crash with INI_SCANNER_RAW). (Jani)
-- (ZipArchive produces corrupt archive). (dani dot church at gmail dot com, Pierre)
-- (IPv6 address filter still rejects valid address). (Felipe)
-- (ReflectionFunction::invoke() parameter issues). (Kalle)
-- (mysql_close() crash php when no handle specified). (Johannes, Andrey)
-- (Crash during date parsing with invalid date). (Pierre)
-- (Unable to browse directories within Junction Points). (Pierre, Kanwaljeet Singla)
-- (mysqlnd: mysql_num_fields returns wrong column count for mysql_list_fields). (Andrey)
-- (PHAR install fails when INSTALL_ROOT is not the final install location). (james dot cohen at digitalwindow dot com, Greg)
-- (CURLOPT_WRITEHEADER|CURLOPT_FILE|CURLOPT_STDERR warns on files that have been opened with r+). (Ilia)
-- (parse_ini_*(): scanner_mode parameter is not checked for sanity). (Jani)
-- (FILTER_VALIDATE_EMAIL does not allow numbers in domain components). (Ilia)
-- (openssl signature verification for tar archives broken). (Greg)
-- (parse_ini_*(): dollar sign as last character of value fails). (Jani)
-- (mb_convert_encoding() doesn't understand hexadecimal html-entities). (Moriyoshi)
-- ("file" fopen wrapper is overwritten when using --with-curlwrappers). (Jani)
-- (Invalid libreadline version not detected during configure). (Jani)
-- (imap crashes when closing stream opened with OP_PROTOTYPE flag). (Jani)
-- (error message unclear on converting phar with existing file). (Greg)
-- (Infinite loop and possible crash during startup with errors when errors are logged). (Jani)
-- error: 'MYSQLND_LLU_SPEC' undeclared. Cause for and - both fixed too. (Andrey)
-- (ibase_execute error in return param). (Kalle)
-- (ssl handshake fails during asynchronous socket connection). (Sriram Natarajan)
-- (Fixed build with Openssl 1.0). (Pierre, Al dot Smith at aeschi dot ch dot eu dot org)
-- (Only the date fields of the first row are fetched, others are empty). (info at programmiernutte dot net)
-- (natcasesort() does not sort extended ASCII characters correctly). (Herman Radtke)
-- (Memory leak in DateTime). (Derick, Tobias John)
-- (Encoding bug in SoapServer->fault). (Dmitry)
-- (touch() afield returns different values on windows). (Pierre)
-- (Extended MySQLi class gives incorrect empty() result). (Andrey)
-- (with Sun Java System Web Server 7.0 on HPUX, #define HPUX). (Uwe Schindler)
-- (imagefilledrectangle() clipping error). (markril at hotmail dot com, Pierre)
-- (Inconsistent behavior of the u format char). (Derick)
-- (setcookie will output expires years of >4 digits). (Ilia)
-- (popen crashes when an invalid mode is passed). (Pierre)
-- (stream_get_meta_data() does not return same mode as used in fopen). (Jani)
-- (ImageLine w/ antialias = 1px shorter). (wojjie at gmail dot com, Kalle)
-- (php_uname() does not return nodename on Netware (Guenter Knauf)
-- (Mail() does not use FQDN when sending SMTP helo). (Kalle, Rick Yorgason)
-- (Sent incorrect RCPT TO commands to SMTP server) (Garrett)
-- (Impersonation with FastCGI does not exec process as impersonated user). (Pierre)
-- (oci_error return false when NO_DATA_FOUND is raised). (Chris Jones)
-
-
-
-
-
-Version 5.3.0
-
-
-
- - Upgraded bundled PCRE to version 7.9. (Nuno)
- - Upgraded bundled sqlite to version 3.6.15. (Scott)
-
- - Moved extensions to PECL (Derick, Lukas, Pierre, Scott):
-
- - ext/dbase
- - ext/fbsql
- - ext/fdf
- - ext/ncurses
- - ext/mhash (BC layer is now entirely within ext/hash)
- - ext/ming
- - ext/msql
- - ext/sybase (not maintained anymore, sybase_ct has to be used instead)
-
-
-
- - Removed the experimental RPL (master/slave) functions from mysqli. (Andrey)
- - Removed zend.ze1_compatibility_mode. (Dmitry)
- - Removed all zend_extension_* php.ini directives. Zend extensions are now
- always loaded using zend_extension directive. (Derick)
- - Removed special treatment of "/tmp" in sessions for open_basedir.
- Note: This undocumented behaviour was introduced in 5.2.2. (Alexey)
- - Removed shebang line check from CGI sapi (checked by scanner). (Dmitry)
-
- - Changed PCRE, Reflection and SPL extensions to be always enabled. (Marcus)
- - Changed md5() to use improved implementation. (Solar Designer, Dmitry)
- - Changed HTTP stream wrapper to accept any code between and including
- 200 to 399 as successful. (Mike, Noah Fontes)
- - Changed __call() to be invoked on private/protected method access, similar to
- properties and __get(). (Andrei)
- - Changed dl() to be disabled by default. Enabled only when explicitly
- registered by the SAPI. Currently enabled with cli, cgi and embed SAPIs.
- (Dmitry)
- - Changed opendir(), dir() and scandir() to use default context when no context
- argument is passed. (Sara)
- - Changed open_basedir to allow tightening in runtime contexts. (Sara)
- - Changed PHP/Zend extensions to use flexible build IDs. (Stas)
- - Changed error level E_ERROR into E_WARNING in Soap extension methods
- parameter validation. (Felipe)
- - Changed openssl info to show the shared library version number. (Scott)
- - Changed floating point behaviour to consistently use double precision on all
- platforms and with all compilers. (Christian Seiler)
- - Changed round() to act more intuitively when rounding to a certain precision
- and round very large and very small exponents correctly. (Christian Seiler)
- - Changed session_start() to return false when session startup fails. (Jani)
- - Changed property_exists() to check the existence of a property independent of
- accessibility (like method_exists()). (Felipe)
- - Changed array_reduce() to allow mixed $initial (Christian Seiler)
-
- - Improved PHP syntax and semantics:
-
- - Added lambda functions and closures. (Christian Seiler, Dmitry)
- - Added "jump label" operator (limited "goto"). (Dmitry, Sara)
- - Added NOWDOC syntax. (Gwynne Raskind, Stas, Dmitry)
- - Added HEREDOC syntax with double quotes. (Lars Strojny, Felipe)
- - Added support for using static HEREDOCs to initialize static variables and
- class members or constants. (Matt)
- - Improved syntax highlighting and consistency for variables in double-quoted
- strings and literal text in HEREDOCs and backticks. (Matt)
- - Added "?:" operator. (Marcus)
- - Added support for namespaces. (Dmitry, Stas, Gregory, Marcus)
- - Added support for Late Static Binding. (Dmitry, Etienne Kneuss)
- - Added support for __callStatic() magic method. (Sara)
- - Added forward_static_call(_array) to complete LSB. (Mike Lively)
- - Added support for dynamic access of static members using $foo::myFunc().
- (Etienne Kneuss)
- - Improved checks for callbacks. (Marcus)
- - Added __DIR__ constant. (Lars Strojny)
- - Added new error modes E_USER_DEPRECATED and E_DEPRECATED.
- E_DEPRECATED is used to inform about stuff being scheduled for removal
- in future PHP versions. (Lars Strojny, Felipe, Marcus)
- - Added "request_order" INI variable to control specifically $_REQUEST
- behavior. (Stas)
- - Added support for exception linking. (Marcus)
- - Added ability to handle exceptions in destructors. (Marcus)
-
-
-
- - Improved PHP runtime speed and memory usage:
-
- - Substitute global-scope, persistent constants with their values at compile
- time. (Matt)
- - Optimized ZEND_SIGNED_MULTIPLY_LONG(). (Matt)
- - Removed direct executor recursion. (Dmitry)
- - Use fastcall calling convention in executor on x86. (Dmitry)
- - Use IS_CV for direct access to $this variable. (Dmitry)
- - Use ZEND_FREE() opcode instead of ZEND_SWITCH_FREE(IS_TMP_VAR). (Dmitry)
- - Lazy EG(active_symbol_table) initialization. (Dmitry)
- - Optimized ZEND_RETURN opcode to not allocate and copy return value if it is
- not used. (Dmitry)
- - Replaced all flex based scanners with re2c based scanners.
- (Marcus, Nuno, Scott)
- - Added garbage collector. (David Wang, Dmitry).
- - Improved PHP binary size and startup speed with GCC4 visibility control.
- (Nuno)
- - Improved engine stack implementation for better performance and stability.
- (Dmitry)
- - Improved memory usage by moving constants to read only memory.
- (Dmitry, Pierre)
- - Changed exception handling. Now each op_array doesn't contain
- ZEND_HANDLE_EXCEPTION opcode in the end. (Dmitry)
- - Optimized require_once() and include_once() by eliminating fopen(3) on
- second usage. (Dmitry)
- - Optimized ZEND_FETCH_CLASS + ZEND_ADD_INTERFACE into single
- ZEND_ADD_INTERFACE opcode. (Dmitry)
- - Optimized string searching for a single character.
- (Michal Dziemianko, Scott)
- - Optimized interpolated strings to use one less opcode. (Matt)
-
-
-
- - Improved php.ini handling: (Jani)
-
- - Added ".htaccess" style user-defined php.ini files support for CGI/FastCGI.
- - Added support for special [PATH=/opt/httpd/www.example.com/] and
- [HOST=www.example.com] sections. Directives set in these sections can
- not be overridden by user-defined ini-files or during runtime.
- - Added better error reporting for php.ini syntax errors.
- - Allowed using full path to load modules using "extension" directive.
- - Allowed "ini-variables" to be used almost everywhere ini php.ini files.
- - Allowed using alphanumeric/variable indexes in "array" ini options.
- - Added 3rd optional parameter to parse_ini_file() to specify the scanning
- mode of INI_SCANNER_NORMAL or INI_SCANNER_RAW. In raw mode option values
- and section values are treated as-is.
- - Fixed get_cfg_var() to be able to return "array" ini options.
- - Added optional parameter to ini_get_all() to only retrieve the current
- value. (Hannes)
-
-
-
- - Improved Windows support:
-
- - Update all libraries to their latest stable version. (Pierre, Rob, Liz,
- Garrett).
- - Added Windows support for stat(), touch(), filemtime(), filesize() and
- related functions. (Pierre)
- - Re-added socket_create_pair() for Windows in sockets extension. (Kalle)
- - Added inet_pton() and inet_ntop() also for Windows platforms.
- (Kalle, Pierre)
- - Added mcrypt_create_iv() for Windows platforms. (Pierre)
- - Added ACL Cache support on Windows.
- (Kanwaljeet Singla, Pierre, Venkat Raman Don)
- - Added constants based on Windows' GetVersionEx information.
- PHP_WINDOWS_VERSION_* and PHP_WINDOWS_NT_*. (Pierre)
- - Added support for ACL (is_writable, is_readable, reports now correct
- results) on Windows. (Pierre, Venkat Raman Don, Kanwaljeet Singla)
- - Added support for fnmatch() on Windows. (Pierre)
- - Added support for time_nanosleep() and time_sleep_until() on Windows.
- (Pierre)
- - Added support for symlink(), readlink(), linkinfo() and link() on Windows.
- They are available only when the running platform supports them. (Pierre)
- - the GMP extension now relies on MPIR instead of the GMP library. (Pierre)
- - Added Windows support for stream_socket_pair(). (Kalle)
- - Drop all external dependencies for the core features. (Pierre)
- - Drastically improve the build procedure (Pierre, Kalle, Rob):
-
- - VC9 (Visual C++ 2008) or later support
- - Initial experimental x64 support
-
-
- - MSI installer now supports all recent Windows versions, including
- Windows 7. (John, Kanwaljeet Singla)
-
-
-
- - Improved and cleaned CGI code:
-
- - FastCGI is now always enabled and cannot be disabled.
- See sapi/cgi/CHANGES for more details. (Dmitry)
- - Added CGI SAPI -T option which can be used to measure execution
- time of script repeated several times. (Dmitry)
-
-
-
- - Improved streams:
-
- - Fixed confusing error message on failure when no errors are logged. (Greg)
- - Added stream_supports_lock() function. (Benjamin Schulz)
- - Added context parameter for copy() function. (Sara)
- - Added "glob://" stream wrapper. (Marcus)
- - Added "params" as optional parameter for stream_context_create(). (Sara)
- - Added ability to use stream wrappers in include_path. (Gregory, Dmitry)
-
-
-
- - Improved DNS API
-
- - Added Windows support for dns_check_record(), dns_get_mx(), checkdnsrr() and
- getmxrr(). (Pierre)
- - Added support for old style DNS functions (supports OSX and FBSD). (Scott)
- - Added a new "entries" array in dns_check_record() containing the TXT
- elements. (Felipe, Pierre)
-
-
-
- - Improved hash extension:
-
- - Changed mhash to be a wrapper layer around the hash extension. (Scott)
- - Added hash_copy() function. (Tony)
- - Added sha224 hash algorithm to the hash extension. (Scott)
-
-
-
- - Improved IMAP support (Pierre):
-
- - Added imap_gc() to clear the imap cache
- - Added imap_utf8_to_mutf7() and imap_mutf7_to_utf8()
-
-
-
- - Improved mbstring extension:
-
- - Added "mbstring.http_output_conv_mimetypes" INI directive that allows
- common non-text types such as "application/xhtml+xml" to be converted
- by mb_output_handler(). (Moriyoshi)
-
-
-
- - Improved OCI8 extension (Chris Jones/Oracle Corp.):
-
- - Added Database Resident Connection Pooling (DRCP) and Fast
- Application Notification (FAN) support.
- - Added support for Oracle External Authentication (not supported
- on Windows).
- - Improve persistent connection handling of restarted DBs.
- - Added SQLT_AFC (aka CHAR datatype) support to oci_bind_by_name.
- - (Numeric keys for associative arrays are not
- handled properly)
- - (Segmentation fault with query over DB link).
- - Fixed define of SQLT_BDOUBLE and SQLT_BFLOAT constants with Oracle
- 10g ORACLE_HOME builds.
- - Changed default value of oci8.default_prefetch from 10 to 100.
- - (OCI8: oci_connect without ORACLE_HOME defined causes
- segfault) (Chris Jones/Oracle Corp.)
- - (OCI8: sqlnet.ora isn't read with older Oracle
- libraries) (Chris Jones/Oracle Corp.)
- - (Allow "pecl install oci8" command to "autodetect" an
- Instant Client RPM install) (Chris Jones/Oracle Corp.)
- - (OCI8 ping functionality is broken).
- - Allow building (e.g from PECL) the PHP 5.3-based OCI8 code with
- PHP 4.3.9 onwards.
- - Provide separate extensions for Oracle 11g and 10g on Windows.
- (Pierre, Chris)
-
-
-
- - Improved OpenSSL extension:
-
- - Added support for OpenSSL digest and cipher functions. (Dmitry)
- - Added access to internal values of DSA, RSA and DH keys. (Dmitry)
- - Fixed a memory leak on openssl_decrypt(). (Henrique)
- - Fixed segfault caused by openssl_pkey_new(). (Henrique)
- - Fixed bug caused by uninitilized variables in openssl_pkcs7_encrypt() and
- openssl_pkcs7_sign(). (Henrique)
- - Fixed error message in openssl_seal(). (Henrique)
-
-
-
- - Improved pcntl extension: (Arnaud)
-
- - Added pcntl_signal_dispatch().
- - Added pcntl_sigprocmask().
- - Added pcntl_sigwaitinfo().
- - Added pcntl_sigtimedwait().
-
-
-
- - Improved SOAP extension:
-
- - Added support for element names in context of XMLSchema's <any>. (Dmitry)
- - Added ability to use Traversable objects instead of plain arrays.
- (Joshua Reese, Dmitry)
- - Fixed possible crash bug caused by an uninitialized value. (Zdash Urf)
-
-
-
- - Improved SPL extension:
-
- - Added SPL to list of standard extensions that cannot be disabled. (Marcus)
- - Added ability to store associative information with objects in
- SplObjectStorage. (Marcus)
- - Added ArrayAccess support to SplObjectStorage. (Marcus)
- - Added SplDoublyLinkedList, SplStack, SplQueue classes. (Etienne)
- - Added FilesystemIterator. (Marcus)
- - Added GlobIterator. (Marcus)
- - Added SplHeap, SplMinHeap, SplMaxHeap, SplPriorityQueue classes. (Etienne)
- - Added new parameter $prepend to spl_autoload_register(). (Etienne)
- - Added SplFixedArray. (Etienne, Tony)
- - Added delaying exceptions in SPL's autoload mechanism. (Marcus)
- - Added RecursiveTreeIterator. (Arnaud, Marcus)
- - Added MultipleIterator. (Arnaud, Marcus, Johannes)
-
-
-
- - Improved Zend Engine:
-
- - Added "compact" handler for Zend MM storage. (Dmitry)
- - Added "+" and "*" specifiers to zend_parse_parameters(). (Andrei)
- - Added concept of "delayed early binding" that allows opcode caches to
- perform class declaration (early and/or run-time binding) in exactly
- the same order as vanilla PHP. (Dmitry)
-
-
-
- - Improved crypt() function: (Pierre)
-
- - Added Blowfish and extended DES support. (Using Blowfish implementation
- from Solar Designer).
- - Made crypt features portable by providing our own implementations
- for crypt_r and the algorithms which are used when OS does not provide
- them. PHP implementations are always used for Windows builds.
-
-
-
- - Deprecated session_register(), session_unregister() and
- session_is_registered(). (Hannes)
- - Deprecated define_syslog_variables(). (Kalle)
- - Deprecated ereg extension. (Felipe)
-
- - Added new extensions:
-
- - Added Enchant extension as a way to access spell checkers. (Pierre)
- - Added fileinfo extension as replacement for mime_magic extension. (Derick)
- - Added intl extension for Internationalization. (Ed B., Vladimir I.,
- Dmitry L., Stanislav M., Vadim S., Kirti V.)
- - Added mysqlnd extension as replacement for libmysql for ext/mysql, mysqli
- and PDO_mysql. (Andrey, Johannes, Ulf)
- - Added phar extension for handling PHP Archives. (Greg, Marcus, Steph)
- - Added SQLite3 extension. (Scott)
-
-
-
- - Added new date/time functionality: (Derick)
-
- - date_parse_from_format(): Parse date/time strings according to a format.
- - date_create_from_format()/DateTime::createFromFormat(): Create a date/time
- object by parsing a date/time string according to a given format.
- - date_get_last_errors()/DateTime::getLastErrors(): Return a list of warnings
- and errors that were found while parsing a date/time string through:
-
- - strtotime() / new DateTime
- - date_create_from_format() / DateTime::createFromFormat()
- - date_parse_from_format().
-
-
- - support for abbreviation and offset based timezone specifiers for
- the 'e' format specifier, DateTime::__construct(), DateTime::getTimeZone()
- and DateTimeZone::getName().
- - support for selectively listing timezone identifiers by continent or
- country code through timezone_identifiers_list() / DateTimezone::listIdentifiers().
- - timezone_location_get() / DateTimezone::getLocation() for retrieving
- location information from timezones.
- - date_timestamp_set() / DateTime::setTimestamp() to set a Unix timestamp
- without invoking the date parser. (Scott, Derick)
- - date_timestamp_get() / DateTime::getTimestamp() to retrieve the Unix
- timestamp belonging to a date object.
- - two optional parameters to timezone_transitions_get() /
- DateTimeZone::getTranstions() to limit the range of transitions being
- returned.
- - support for "first/last day of <month>" style texts.
- - support for date/time strings returned by MS SQL.
- - support for serialization and unserialization of DateTime objects.
- - support for diffing date/times through date_diff() / DateTime::diff().
- - support for adding/subtracting weekdays with strtotime() and
- DateTime::modify().
- - DateInterval class to represent the difference between two date/times.
- - support for parsing ISO intervals for use with DateInterval.
- - date_add() / DateTime::add(), date_sub() / DateTime::sub() for applying an
- interval to an existing date/time.
- - proper support for "this week", "previous week"/"last week" and "next week"
- phrases so that they actually mean the week and not a seven day period
- around the current day.
- - support for "<xth> <weekday> of" and "last <weekday> of" phrases to be used
- with months - like in "last saturday of februari 2008".
- - support for "back of <hour>" and "front of <hour>" phrases that are used in
- Scotland.
- - DatePeriod class which supports iterating over a DateTime object applying
- DateInterval on each iteration, up to an end date or limited by maximum
- number of occurences.
-
-
-
- - Added compatibility mode in GD, imagerotate, image(filled)ellipse
- imagefilter, imageconvolution and imagecolormatch are now always enabled.
- (Pierre)
- - Added array_replace() and array_replace_recursive() functions. (Matt)
- - Added ReflectionProperty::setAccessible() method that allows non-public
- property's values to be read through ::getValue() and set through
- ::setValue(). (Derick, Sebastian)
- - Added msg_queue_exists() function to sysvmsg extension. (Benjamin Schulz)
- - Added Firebird specific attributes that can be set via PDO::setAttribute()
- to control formatting of date/timestamp columns: PDO::FB_ATTR_DATE_FORMAT,
- PDO::FB_ATTR_TIME_FORMAT and PDO::FB_ATTR_TIMESTAMP_FORMAT. (Lars W)
- - Added gmp_testbit() function. (Stas)
- - Added icon format support to getimagesize(). (Scott)
- - Added LDAP_OPT_NETWORK_TIMEOUT option for ldap_set_option() to allow
- setting network timeout (FR ). (Jani)
- - Added optional escape character parameter to fgetcsv(). (David Soria Parra)
- - Added an optional parameter to strstr() and stristr() for retrieval of either
- the part of haystack before or after first occurrence of needle.
- (Johannes, Felipe)
- - Added xsl->setProfiling() for profiling stylesheets. (Christian)
- - Added long-option feature to getopt() and made getopt() available also on
- win32 systems by adding a common getopt implementation into core.
- (David Soria Parra, Jani)
- - Added support for optional values, and = as separator, in getopt(). (Hannes)
- - Added lcfirst() function. (David C)
- - Added PREG_BAD_UTF8_OFFSET_ERROR constant. (Nuno)
- - Added native support for asinh(), acosh(), atanh(), log1p() and expm1().
- (Kalle)
- - Added LIBXML_LOADED_VERSION constant (libxml2 version currently used). (Rob)
- - Added JSON_FORCE_OBJECT flag to json_encode(). (Scott, Richard Quadling)
- - Added timezone_version_get() to retrieve the version of the used timezone
- database. (Derick)
- - Added 'n' flag to fopen to allow passing O_NONBLOCK to the underlying
- open(2) system call. (Mikko)
- - Added "dechunk" filter which can decode HTTP responses with chunked
- transfer-encoding. HTTP streams use this filter automatically in case
- "Transfer-Encoding: chunked" header is present in response. It's possible to
- disable this behaviour using "http"=>array("auto_decode"=>0) in stream
- context. (Dmitry)
- - Added support for CP850 encoding in mbstring extension.
- (Denis Giffeler, Moriyoshi)
- - Added stream_cast() and stream_set_options() to user-space stream wrappers,
- allowing stream_select(), stream_set_blocking(), stream_set_timeout() and
- stream_set_write_buffer() to work with user-space stream wrappers. (Arnaud)
- - Added header_remove() function. (chsc at peytz dot dk, Arnaud)
- - Added stream_context_get_params() function. (Arnaud)
- - Added optional parameter "new" to sybase_connect(). (Timm)
- - Added parse_ini_string() function. (grange at lemonde dot fr, Arnaud)
- - Added str_getcsv() function. (Sara)
- - Added openssl_random_pseudo_bytes() function. (Scott)
- - Added ability to send user defined HTTP headers with SOAP request.
- (Brian J.France, Dmitry)
- - Added concatenation option to bz2.decompress stream filter.
- (Keisial at gmail dot com, Greg)
- - Added support for using compressed connections with PDO_mysql. (Johannes)
- - Added the ability for json_decode() to take a user specified depth. (Scott)
- - Added support for the mysql_stmt_next_result() function from libmysql.
- (Andrey)
- - Added function preg_filter() that does grep and replace in one go. (Marcus)
- - Added system independent realpath() implementation which caches intermediate
- directories in realpath-cache. (Dmitry)
- - Added optional clear_realpath_cache and filename parameters to
- clearstatcache(). (Jani, Arnaud)
- - Added litespeed SAPI module. (George Wang)
- - Added ext/hash support to ext/session's ID generator. (Sara)
- - Added quoted_printable_encode() function. (Tony)
- - Added stream_context_set_default() function. (Davey Shafik)
- - Added optional "is_xhtml" parameter to nl2br() which makes the function
- output <br> when false and <br /> when true (FR ). (Kalle)
- - Added PHP_MAXPATHLEN constant (maximum length of a path). (Pierre)
- - Added support for SSH via libssh2 in cURL. (Pierre)
- - Added support for gray levels PNG image with alpha in GD extension. (Pierre)
- - Added support for salsa hashing functions in HASH extension. (Scott)
- - Added DOMNode::getLineNo to get line number of parsed node. (Rob)
- - Added table info to PDO::getColumnMeta() with SQLite. (Martin Jansen, Scott)
- - Added mail logging functionality that allows logging of mail sent via
- mail() function. (Ilia)
- - Added json_last_error() to return any error information from json_decode().
- (Scott)
- - Added gethostname() to return the current system host name. (Ilia)
- - Added shm_has_var() function. (Mike)
- - Added depth parameter to json_decode() to lower the nesting depth from the
- maximum if required. (Scott)
- - Added pixelation support in imagefilter(). (Takeshi Abe, Kalle)
- - Added SplObjectStorage::addAll/removeAll. (Etienne)
-
- - (curl progress callback: CURLOPT_PROGRESSFUNCTION).
- (sdteffen[at]gmail[dot].com, Pierre)
- - (Missing cURL option do disable IPv6). (Pierre)
- - (Missing cURL option CURLOPT_FTP_FILEMETHOD). (Pierre)
-
- - Fixed an issue with ReflectionProperty::setAccessible().
- (Sebastian, Roman Borschel)
- - Fixed html_entity_decode() incorrectly converting numeric html entities
- to different characters with cp1251 and cp866. (Scott)
- - Fixed an issue in date() where a : was printed for the O modifier after a P
- modifier was used. (Derick)
- - Fixed exec() on Windows to not eat the first and last double quotes. (Scott)
- - Fixed readlink on Windows in thread safe SAPI (apache2.x etc.). (Pierre)
- - Fixed a bug causing miscalculations with the "last <weekday> of <n> month"
- relative time string. (Derick)
- - Fixed bug causing the algorithm parameter of mhash() to be modified. (Scott)
- - Fixed invalid calls to free when internal fileinfo magic file is used. (Scott)
- - Fixed memory leak inside wddx_add_vars() function. (Felipe)
- - Fixed check in recode extension to allow builing of recode and mysql
- extensions when using a recent libmysql. (Johannes)
-
- - (PDOStatement->nextRowset() doesn't work). (Johannes)
- - (Add support for ATTR_FETCH_TABLE_NAMES). (Johannes)
-
- - (ldap_read() segfaults with invalid parameters). (Felipe)
- - (String functions memory issue). (Dmitry)
- - (tmpfile() uses old parameter parsing).
- (crrodriguez at opensuse dot org)
- - (.user.ini never gets parsed). (Pierre)
- - (X-PHP-Originating-Script assumes no trailing CRLF in
- existing headers). (Ilia)
- - (Can't build 5.3 on FBSD 4.11). (Rasmus)
- - (file_exists returns false when impersonate is used).
- (Kanwaljeet Singla, Venkat Raman Don)
- - (spl_autoload_register() doesn't work correctly when
- prepending functions). (Scott)
- - (Calling a method with the same name as the parent class
- calls the constructor). (Scott)
- - (compile failure with mbstring.c when
- --enable-zend-multibyte is used). (Jani)
- - (Cannot execute a scrollable cursors twice with PDO_PGSQL).
- (Matteo)
- - (warning: value computed is not used in
- pdo_sqlite_stmt_get_col line 271). (Matteo)
- - (call_user_method() invalid free of arguments). (Felipe)
- - (pdo_pgsql - large objects are returned as empty). (Matteo)
- - (PHP crashes when script is 8192 (8KB) bytes long). (Dmitry)
- - (Error handler prevents creation of default object). (Dmitry)
- - (crashes in call_user_func_array()). (Dmitry)
- - (stristr() converts needle to lower-case). (Ilia)
- - (is_callable throws fatal error). (Dmitry)
- - (pcntl tests failing on NetBSD). (Matteo)
- - (Wrong value for SIG_UNBLOCK and SIG_SETMASK constants).
- (Matteo)
- - (Exception during object construction from arg call calls
- object's destructor). (Dmitry)
- - (include_once does not resolve windows symlinks or junctions)
- (Kanwaljeet Singla, Venkat Raman Don)
- - (rename JPG to JPEG in phpinfo). (Pierre)
- - (FILTER_VALIDATE_INT doesn't allow minimum integer). (Dmitry)
- - (autoloading classes inside exception_handler leads to
- crashes). (Dmitry)
- - (Cloning SplObjectStorage instances). (Etienne)
- - (get_class returns NULL instead of FALSE). (Dmitry)
- - (Support more than 127 subpatterns in preg_match). (Nuno)
- - (Bus error on parsing file). (Dmitry)
- - (Undefined constant causes segmentation fault). (Felipe)
- - (explode()'s limit parameter odd behaviour). (Matt)
- - (get_defined_constants() return array with broken array
- categories). (Ilia)
- - (Compilation failure in ps_fetch_from_1_to_8_bytes()).
- (Johannes)
- - (RecursiveDiteratoryIterator::getChildren ignoring
- CURRENT_AS_PATHNAME). (Etienne)
- - (metaphone('scratch') returns wrong result). (Felipe)
- - (mysql_fetch_field ignores zero offset). (Johannes)
- - (PDO_Firebird doesn't implements quoter correctly). (Felipe)
- - (odbc_fetch_into - BC in php 5.3.0). (Felipe)
- - (Use the expected unofficial mimetype for bmp files). (Scott)
- - (gc_collect_cycles causes a segfault when called within a
- destructor in one case). (Dmitry)
- - ($php_errormsg out of scope in functions). (Dmitry)
- - (UMR when trying to activate user config). (Pierre)
- - (OCI8: Crash at shutdown on Windows) (Chris Jones/Oracle
- Corp.)
- - (offsetGet error using incorrect offset). (Etienne)
- - (preg_quote() should escape the '-' char). (Nuno)
- - (Possible memory corruption when passing return value by
- reference). (Dmitry)
- - (Second parameter of mssql_fetch_array()). (Felipe)
- - (rename() returns true even if the file in PHAR does not
- exist). (Greg)
- - (mysqli_poll() modifies improper variables). (Johannes)
- - (SplObjectStorage instances compared with ==). (Etienne)
- - (Memory leak in include). (Dmitry)
- - (Fix constants in DualIterator example). (Etienne)
- - (SoapClient stumbles over WSDL delivered with
- "Transfer-Encoding: chunked"). (Dmitry)
- - (OCI8: CLOB size does not update when using CLOB IN OUT param
- in stored procedure) (Chris Jones/Oracle Corp.)
- - (use with non-compound name *has* effect). (Dmitry)
- - (The tokenizer returns deprecated values). (Felipe)
- - (UTF-8 characters outside the BMP aren't encoded correctly).
- (Scott)
- - (ob_flush() should fail to flush unerasable buffers).
- (David C.)
- - (Cloning DOMDocument doesn't clone the properties). (Rob)
- - (phpinfo() is missing some settings). (Hannes)
- - (php scripts or included files with first line starting
- with # have the 1st line missed from the output). (Ilia)
- - (tokenizer misses last single-line comment (PHP 5.3+, with
- re2c lexer)). (Matt, Shire)
- - (ini_set() doesn't return false on failure). (Hannes)
- - (mb_stristr() wrong output when needle does not exist).
- (Henrique M. Decaria)
- - (warning: use statement with non-compound name). (Dmitry)
- - (xmlrpc_decode_request outputs non-suppressable error when
- given bad data). (Ilia)
- - (Segfault when mb_detect_encoding() fails). (Scott)
- - (Missing validation for the options parameter of the
- imap_fetch_overview() function). (Ilia)
- - (cURL curl_setopt leaks memory in foreach loops). (magicaltux
- [at] php [dot] net)
- - (Creating associative array with long values in the key fails
- on 32bit linux). (Shire)
- - (mkdir() fails silently on PHP 5.3). (Hannes)
- - (can't extend mysqli). (Johannes)
- - (Restrict serialization on some internal classes like Closure
- and SplFileInfo using exceptions). (Etienne)
- - (OCI8: phpinfo doesn't show compile time ORACLE_HOME with
- phpize) (Chris Jones/Oracle Corp.)
- - (strip_tags() does not honor end-of-comment when it
- encounters a single quote). (Felipe)
- - (Segmentation fault when using declare statement with
- non-string value). (Felipe)
- - (Extending PDO class with a __call() function doesn't work as
- expected). (Johannes)
- - (SplFileInfo not correctly handling /). (Etienne)
- - (parse_ini_file() doesn't support * in keys). (Nuno)
- - (DateTime::modify() does not reset relative time values).
- (Derick)
- - (stacked error handlers, internal error handling in general).
- (Etienne)
- - (Segmentation fault on static call with empty string method).
- (Felipe)
- - (ArrayObject with objects as storage serialization).
- (Etienne)
- - (importNode changes the namespace of an XML element). (Rob)
- - (memory leak in ext/phar). (Greg)
- - (SPL - Memory leak when exception is thrown in offsetSet).
- (Felipe)
- - (after stream seek, appending stream filter reads incorrect
- data). (Greg)
- - (php_openssl_tcp_sockop_accept forgets to set context on
- accepted stream) (Mark Karpeles, Pierre)
- - (Memory leak when calling a method using Reflection).
- (Dmitry)
- - (XMLWriter - openmemory() and openuri() leak memory on
- multiple calls). (Ilia)
- - (DateTime - Memory leak when unserializing). (Felipe)
- - (Memory leaks when using global statement). (Dmitry)
- - (Xsltprocessor::setProfiling - memory leak). (Felipe, Rob).
- - (DOMXPath - segfault on destruction of a cloned object).
- (Ilia)
- - (SimpleXML top-level @attributes not part of iterator).
- (David C.)
- - (Mysqli - wrong error message). (Johannes)
- - (memory leaks with reflection of mb_convert_encoding()).
- (Ilia)
- - (ArrayObject iteration is slow). (Arnaud)
- - (Direct instantiation of SQLite3stmt and SQLite3result cause
- a segfault.) (Scott)
- - (Ini files with the UTF-8 BOM are treated as invalid).
- (Scott)
- - (json_decode() doesn't return NULL on certain invalid
- strings). (magicaltux, Scott)
- - (Moved SXE from SPL to SimpleXML). (Etienne)
- - (large scripts from stdin are stripped at 16K border).
- (Christian Schneider, Arnaud)
- - (Cannot disable ext/hash). (Arnaud)
- - (undefined reference to 'PHP_SHA512Init'). (Greg)
- - (custom ArrayObject serialization). (Etienne)
- - (Allow empty keys in ArrayObject). (Etienne)
- - (json_decode() doesn't convert 0e0 to a double). (Scott)
- - (FastCGI process exited unexpectedly). (Dmitry)
- - (FreeBSD4.11 build failure: failed include; stdint.h).
- (Hannes)
- - (property_exists fails to find static protected member in
- child class). (Felipe)
- - (Fileinfo/libmagic build fails, missing err.h and getopt.h).
- (Derick)
- - (Unserialization of classes derived from ArrayIterator
- fails). (Etienne, Dmitry)
- - (Not all DateTime methods allow method chaining). (Derick)
- - (Unable to var_dump(DateInterval)). (Derick)
- - (Filesystem time functions on Vista and server 2008).
- (Pierre)
- - (PDO: persistent connection leak). (Felipe)
- - (ob_start()/ob_end_clean() and memory_limit). (Ilia)
- - (parse_ini_file will result in parse error with no trailing
- newline). (Arnaud)
- - (timeout bug in stream_socket_enable_crypto). (vnegrier at
- optilian dot com, Ilia)
- - (relative paths not resolved correctly). (Dmitry)
- - (scrollable cursor don't work with pgsql). (Matteo)
- - (parse_ini_file keys that start/end with underscore).
- (Arnaud)
- - (parse_ini_file comment # line problems). (Arnaud)
- - (PDO::FETCH_SERIALIZE calls __construct()). (Matteo)
- - (PDO->query() parameter parsing/checking needs an update).
- (Matteo)
- - (pdo->errorInfo() always have three elements in the returned
- array). (David C.)
- - (pdo->errorCode() returns NULL when there are no errors).
- (David C.)
- - (PDO MySQL does not support CLIENT_FOUND_ROWS). (Johannes,
- chx1975 at gmail dot com)
- - (Inconsistent handling of static array declarations with
- duplicate keys). (Dmitry)
- - ($this gets mangled when extending PDO with persistent
- connection). (Felipe)
- - (opendir() fails on Windows directories with parent directory
- unaccessible). (Dmitry)
- - (SoapClient causes 505 HTTP Version not supported error
- message). (Dmitry)
- - (php://filter uris ignore url encoded filternames and can't
- handle slashes). (Arnaud)
- - (HTTP status codes 204 and 304 should not be gzipped).
- (Scott, Edward Z. Yang)
- - (separate STDOUT and STDERR in exec functions). (Kanwaljeet
- Singla, Venkat Raman Don, Pierre)
- - (SoapClient over HTTPS fails to reestablish connection).
- (Dmitry)
- - (max_redirects and ignore_errors). (patch by
- datibbaw@php.net)
- - (touch() works on files but not on directories). (Pierre)
-
-
-
-
-
-
-Version 5.2.17
-
-
-
-- (PHP hangs on numeric value 2.2250738585072011e-308). (CVE-2010-4645) (Rasmus, Scott)
-
-
-
-
-
-
-Version 5.2.16
-
-
-
-- (segfault in pgsql_stmt_execute() when postgres is down). (gyp at balabit dot hu)
-- (Regression in open_basedir handling). (Ilia)
-
-
-
-
-
-
-Version 5.2.15
-
-
-
-- Fixed extract() to do not overwrite $GLOBALS and $this when using EXTR_OVERWRITE. (jorto at redhat dot com)
-- Fixed crash in zip extract method (possible CWE-170). (Maksymilian Arciemowicz, Pierre)
-- Fixed a possible double free in imap extension (Identified by Mateusz Kocielski). (CVE-2010-4150). (Ilia)
-- Fixed possible flaw in open_basedir (CVE-2010-3436). (Pierre)
-- Fixed possible crash in mssql_fetch_batch(). (Kalle)
-- Fixed NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709). (Maksymilian Arciemowicz)
-
-- (fix crash if anti-aliasing steps are invalid). (Pierre)
-- (pdo_firebird getAttribute() crash). (preeves at ibphoenix dot com)
-- (Segfault in filter_var with FILTER_VALIDATE_EMAIL with large amount of data). (CVE-2010-3709). (Adam)
-- (Objects unreferenced in __get, __set, __isset or __unset can be freed too early). (mail_ben_schmidt at yahoo dot com dot au, Dmitry)
-- (var_dump() doesn't check for the existence of get_class_name before calling it). (Kalle, Gustavo)
-- (pdo_dblib segmentation fault when iterating MONEY values). (Felipe, Adam)
-- (Compile error if systems do not have stdint.h) (Sriram Natarajan)
-- (mysqli_report() should be per-request setting). (Kalle)
-- (Zend/tests/bug45877.phpt fails). (Dmitry)
-- (array_diff() takes over 3000 times longer than php 5.2.4). (Felipe)
-- (RFC2616 transgression while HTTPS request through proxy with SoapClient object). (Dmitry)
-
-
-
-
-
-
-Version 5.2.14
-
-
-- Reverted bug fix (PDO fetchObject sets values before calling constructor). (Felipe)
-
-
-- Updated timezone database to version 2010.5. (Derick)
-- Upgraded bundled PCRE to version 8.02. (Ilia)
-
-
-- Rewrote var_export() to use smart_str rather than output buffering, revents data disclosure if a fatal error occurs (CVE-2010-2531). (Scott)
-- Fixed a possible interruption array leak in strrchr(). Reported by Péter Veres. (CVE-2010-2484) (Felipe)
-- Fixed a possible interruption array leak in strchr(), strstr(), substr(), chunk_split(), strtok(), addcslashes(), str_repeat(), trim(). (Felipe)
-- Fixed a possible memory corruption in substr_replace() (Dmitry)
-- Fixed SplObjectStorage unserialization problems (CVE-2010-2225). (Stas)
-- Fixed a possible stack exaustion inside fnmatch(). Reporeted by Stefan Esser (Ilia)
-- Reset error state in PDO::beginTransaction() reset error state. (Ilia)
-- Fixed a NULL pointer dereference when processing invalid XML-RPC requests (Fixes CVE-2010-0397, bug ). (Raphael Geissert)
-- Fixed handling of session variable serialization on certain prefix characters. Reported by Stefan Esser (Ilia)
-- Fixed a possible arbitrary memory access inside sqlite extension. Reported by Mateusz Kocielski. (Ilia)
-- Fixed a crash when calling an inexistent method of a class that inherits PDOStatement if instantiated directly instead of doing by the PDO methods. (Felipe)
-
-
-- (Segmentation fault when using mail() on a rhel 4.x (only 64 bit)). (Adam)
-- (Crash when an Exception occured in iterator_to_array). (Johannes)
-- (Crash when passing the reference of the property of a non-object). (Dmitry)
-- (SplFileObject::fgetss() fails due to parameter that can't be set). (Felipe)
-- (custom request header variables with numbers are removed). (Sriram Natarajan)
-- (Invalid E_STRICT redefined constructor error). (Felipe)
-- (memory_limit above 2G). (Felipe)
-- (Memory leak when writing on uninitialized variable returned from function). (Dmitry)
-- (Concurrent builds fail in install-programs). (seanius at debian dot org, Kalle)
-- (make lcov doesn't support TESTS variable anymore). (Patrick)
-- (open_basedir restrictions mismatch on vacuum command). (Ilia, Felipe)
-- (AIX: Several files are out of ANSI spec). (Kalle, coreystup at gmail dot com)
-- (ReflectionParameter::getDefaultValue() memory leaks with constant array). (Felipe)
-- (ReflectionParameter fails if default value is an array with an access to self::). (Felipe)
-- (Segfault with strange __destruct() for static class variables). (Dmitry)
-- (imagefill does not work correctly for small images). (Pierre)
-- (getColumnMeta causes segfault when re-executing query after calling nextRowset). (Pierrick)
-- (CURLOPT_FOLLOWLOCATION error message is misleading). (Pierre)
-- (PDO PGSQL still broken against PostGreSQL <7.4). (Felipe, wdierkes at 5dollarwhitebox dot org)
-- (PHP crash with wrong HTML in SimpleXML). (Felipe)
-- (pg_copy_to: Invalid results when using fourth parameter). (Felipe)
-- (pg_copy_to: WARNING: nonstandard use of \\ in a string literal). (cbandy at jbandy dot com)
-- (pg_copy_from does not allow schema in the tablename argument). (cbandy at jbandy dot com)
-- (newline in end of header is shown in start of message). (Daniel Egeberg)
-- (query timeout in mssql can not be changed per query). (ejsmont dot artur at gmail dot com)
-- (debug_backtrace() causes segmentation fault and/or memory issues). (Dmitry)
-- (Wrong prototype for SplFileObject::fscanf()). (Etienne)
-- (var_dump() invalid/slow *RECURSION* detection). (Felipe)
-- (DateTime::createFromFormat() fails if format string contains timezone). (Adam)
-- (Wrongly initialized object properties). (Etienne)
-- (URL-Rewriter is still enabled if use_only_cookies is on). (Ilia, j dot jeising at gmail dot com)
-- (Faultstring property does not exist when the faultstring is empty) (Ilia, dennis at transip dot nl)
-- (zlib.output_compression Overwrites Vary Header). (Adam)
-- (imagettftext and rotated text uses wrong baseline) (cschneid at cschneid dot com, Takeshi Abe)
-- (milter SAPI crash on startup). (igmar at palsenberg dot com)
-- (pdo_mssql is trimming value of the money column). (Ilia, alexr at oplot dot com)
-- (FILTER_VALIDATE_URL will invalidate a hostname that includes '-'). (Adam, solar at azrael dot ws).
-- (ftp_put() returns false when transfer was successful). (Ilia)
-- (ext/date/php_date.c fails to compile with Sun Studio). (Sriram Natarajan)
-- (curl_setopt() doesn't output any errors or warnings when an invalid option is provided). (Ilia)
-- (imagefill() doesn't work with large images). (Pierre)
-- (DBA DB4 doesn't work with Berkeley DB 4.8). (Chris Jones)
-- (DBA DB4 uses mismatched headers and libraries). (Chris Jones)
-- (filter doesn't detect int overflows with GCC 4.4). (Raphael Geissert)
-- (in WSDL mode Soap Header handler function only being called if defined in WSDL). (mephius at gmail dot com)
-- (SoapClient should handle wsdls with some incompatiable endpoints). (Justin Dearing)
-- (Exceptions thrown in __call() / __callStatic() do not include file and line in trace). (Felipe)
-- (Firebird - new PDO() returns NULL). (Felipe)
-- (LimitIterator with empty SeekableIterator). (Etienne)
-- (FILTER_VALIDATE_EMAIL filter needs updating) (Rasmus)
-- (PDO returns null when SQLite connection fails). (Felipe)
-- (Linking fails for iconv). (Moriyosh)
-- (xpath() returns FALSE for legitimate query). (Rob)
-- (iconv_mime_encode() quoted-printable scheme is broken).
- (Adam, patch from hiroaki dot kawai at gmail dot com).
-- (iconv_mime_encode(), broken Q scheme). (Rasmus)
-- (getimagesize() fails to detect width/height on certain
- JPEGs). (Ilia)
-- (syslog() truncates messages). (Adam)
-
-
-
-
-
-Version 5.2.13
-
-
-- Security Fixes
-
- - Improved LCG entropy. (Rasmus, Samy Kamkar)
- - Fixed safe_mode validation inside tempnam() when the directory path does not end with a /). (Martin Jansen)
- - Fixed a possible open_basedir/safe_mode bypass in the session extension identified by Grzegorz Stachowiak. (Ilia)
-
-
-
-- Updated timezone database to version 2010.2. (Derick)
-- Upgraded bundled PCRE to version 7.9. (Ilia)
-
-- Removed automatic file descriptor unlocking happening on shutdown and/or stream close (on all OSes excluding Windows). (Tony, Ilia)
-
-- Changed tidyNode class to disallow manual node creation. (Pierrick)
-
-- Added missing host validation for HTTP urls inside FILTER_VALIDATE_URL. (Ilia)
-
-- Fixed bug in bundled libgd causing spurious horizontal lines drawn by gdImageFilledPolygon (libgd #100). (Takeshi Abe)
-- Fixed build of mysqli with MySQL 5.5.0-m2. (Andrey)
-
-- (Custom content-length set incorrectly in Apache sapis). (Brian France, Rasmus)
-- (Wrong date by php_date.c patch with ancient gcc/glibc versions). (Derick)
-- (build fails with openssl 1.0 due to md2 deprecation). (Ilia, hanno at hboeck dot de)
-- (strip_tags() removes all tags greater then 1023 bytes long). (Ilia)
-- (HTTP fopen wrapper does not support passwordless HTTP authentication). (Jani)
-- (ReflectionFunction::isDeprecated producing "cannot be called statically" error). (Jani, Felipe)
-- (Compile failure: Bad logic in defining fopencookie emulation). (Jani)
-- (stream_set_write_buffer() has no effect on socket streams). (vnegrier at optilian dot com, Ilia)
-- (mysqli constructor without parameters does not return a working mysqli object). (Andrey)
-- (system.multiCall crashes in xmlrpc extension). (hiroaki dot kawai at gmail dot com, Ilia)
-- (exec() adds single byte twice to $output array). (Ilia)
-- (All PDOExceptions hardcode 'code' property to 0). (Joey, Ilia)
-- (Accessing mysqli->affected_rows on no connection causes segfault). (Andrey, Johannes)
-- (strtotime() does not support eighth ordinal number). (Ilia)
-- (DOMDocument::loadXML does not allow UTF-16). (Rob)
-- (copy() with an empty (zero-byte) HTTP source succeeds but returns false). (Ilia)
-- (MySQLi_Result sets values before calling constructor). (Pierrick)
-- (filter_input() does not return default value if the variable does not exist). (Ilia)
-- (XML_OPTION_SKIP_TAGSTART option has no effect). (Pierrick)
-- (PDO_PGSQL LOBs are not compatible with PostgreSQL 8.5). (Matteo)
-- (Broken object model when extending tidy). (Pierrick)
-- (Crash while running ldap_next_reference test cases). (Sriram)
-- (compile failure: Conflicting HEADER type declarations). (Jani)
-- (Reference argument converted to value in __call). (Stas)
-- (http wrapper breaks on 1024 char long headers). (Ilia)
-- (imageTTFText text shifted right). (Takeshi Abe)
-- (date_format buffer not long enough for >4 digit years). (Derick, Adam)
-- (setAttributeNS fails setting default namespace). (Rob)
-- (Implementing Iterator and IteratorAggregate). (Etienne)
-- (SoapClient does not honor max_redirects). (Sriram)
-- (Content-type parameter "boundary" is not case-insensitive in HTTP uploads). (Ilia)
-- (defined() requires class to exist when testing for class constants). (Ilia)
-- (extract() problem with array containing word "this"). (Ilia, chrisstocktonaz at gmail dot com)
-- (Field truncation when reading from dbase dbs with more then 1024 fields). (Ilia, sjoerd-php at linuxonly dot nl)
-- (strip_tags() truncates rest of string with invalid attribute). (Ilia, hradtke)
-- (define() allows :: in constant names). (Ilia)
-
-
-
-
-
-Version 5.2.12
-
-
-- Security Fixes
-
- - Fixed a safe_mode bypass in tempnam() identified by Grzegorz Stachowiak. (Rasmus)
- - Fixed a open_basedir bypass in posix_mkfifo() identified by Grzegorz Stachowiak. (Rasmus)
- - Added "max_file_uploads" INI directive, which can be set to limit the number of file uploads per-request to 20 by default, to prevent possible DOS via temporary file exhaustion. (Ilia)
- - Added protection for $_SESSION from interrupt corruption and improved "session.save_path" check, identified by Stefan Esser. (Stas)
- - (insufficient input string validation of htmlspecialchars()). (Moriyoshi, hello at iwamot dot com)
-
-
-
-- Updated timezone database to version 2009.19 (2009s). (Derick)
-
-- Added LIBXML_PARSEHUGE constant to overrides the maximum text size of a single text node when using libxml2.7.3+. (Kalle)
-
-- Changed "post_max_size" php.ini directive to allow unlimited post size by setting it to 0. (Rasmus)
-
-- Fixed error_log() to be binary safe when using message_type 3. (Jani)
-- Fixed unnecessary invocation of setitimer when timeouts have been disabled. (Arvind Srinivasan)
-- Fixed crash in com_print_typeinfo when an invalid typelib is given. (Pierre)
-- Fixed crash in SQLiteDatabase::ArrayQuery() and SQLiteDatabase::SingleQuery() when calling using Reflection. (Felipe)
-- Fixed crash when instantiating PDORow and PDOStatement through Reflection. (Felipe)
-- Fixed memory leak in openssl_pkcs12_export_to_file(). (Felipe)
-
-- (PDO-ODBC stored procedure call from Solaris 64-bit causes seg fault). (davbrown4 at yahoo dot com, Felipe)
-- (nanosleep not detected properly on some solaris versions). (Jani)
-- (Allow use of ; in values via ;; in PDO DSN). (Ilia, Pierrick)
-- (xmlrpc does not preserve keys in encoded indexed arrays). (Felipe)
-- (xmlrpc_encode_request() changes object into array in calling function). (Felipe)
-- (conflicting types for llabs). (Jani)
-- (isset() and empty() silently casts array to object). (Felipe)
-- (soap call Segmentation fault on a redirected url). (Pierrick)
-- (Compiling with libedit cannot find readline.h). (tcallawa at redhat dot com)
-- (segmentation fault when concatenating very large strings on 64bit linux). (Ilia)
-- (pg_copy_to() fails when table name contains schema. (Ilia)
-- (ldap_get_entries() return false instead of an empty array when there is no error). (Jani)
-- (Incorrectly matched docComment). (Felipe)
-- (FastCGI fails with wrong error on HEAD request to non-existent file). (Dmitry)
-- (Memory leak when fetching timestamp column from Oracle database). (Felipe)
-- (FILTER_VALIDATE_EMAIL fails with valid addresses containing = or ?). (Pierrick)
-- (parse_url() incorrect when ? in fragment). (Ilia)
-- (Segfault caused by uksort()). (Felipe)
-- (Throwing through Reflection modified Exception object makes segmentation fault). (Felipe)
-- (SNMP3 warning message about security level printed twice). (Jani)
-- (pdo_pgsql prepare() re-use previous aborted transaction). (ben dot pineau at gmail dot com, Ilia, Matteo)
-- (AppendIterator undefined function crash). (Johannes)
-- (Curl post upload functions changed). (Ilia)
-- (import_request_variables() always returns NULL). (Ilia, sjoerd at php dot net)
-- (exec() fails to return data inside 2nd parameter, given output lines >4095 bytes). (Ilia)
-- (time_sleep_until() is not available on OpenSolaris). (Jani)
-- (long2ip() can return wrong value in a multi-threaded applications). (Ilia, Florian Anderiasch)
-- (calling mcrypt() after mcrypt_generic_deinit() crashes). (Sriram Natarajan)
-- (ReflectionClass::hasProperty returns true for a private property in base class). (Felipe)
-- (Unexpected change in strnatcasecmp()). (Rasmus)
-- (ini parser crashes with apache2 and using ${something} ini variables). (Jani)
-- (libxml 2.7.3+ limits text nodes to 10MB). (Felipe)
-- (DOMUserData does not exist). (Rob)
-- (imap_listscan() function missing). (Felipe)
-- (error_log to specified file does not log time according to date.timezone). (Dmitry)
-- (make install-pear fails). (Hannes)
-- (mb_detect_encoding() returns incorrect results when mbstring.strict_mode is turned on). (Moriyoshi)
-- (CURLOPT_INFILESIZE sometimes causes warning "CURLPROTO_FILE cannot be set"). (Felipe)
-- (UTF-16 strings prefixed by BOMs wrongly converted). (Moriyoshi)
-- (PDO fetchObject sets values before calling constructor). (Pierrick)
-- (cURL's CURLOPT_FILE prevents file from being deleted after fclose()). (Ilia)
-- (Constants defined in Interfaces can be overridden). (Felipe)
-- (mb_strcut() cuts wrong length when offset is in the middle of a multibyte character). (Moriyoshi)
-- (Build error with Snow Leopard). (Scott)
-- (Floating point NaN cause garbage characters). (Sjoerd)
-- (crash when extending PDOStatement and trying to set queryString property). (Felipe)
-- (mysqli segfault on error). (Rasmus)
-- (IPv6 socket transport is not working). (Ilia)
-- (PDO_pgsql::query() always uses implicit prepared statements if v3 proto available). (Matteo, Mark Kirkwood)
-- (importNode doesn't preserve attribute namespaces). (Rob)
-- (PDOStatement->execute() returns true then false for same statement). (Pierrick)
-- (Failure in odbc_exec() using oracle-supplied odbc driver). (tim dot tassonis at trivadis dot com)
-
-
-
-
-
-Version 5.2.11
-
-
-- Security Fixes
-
- - Fixed certificate validation inside php_openssl_apply_verification_policy. (Ryan Sleevi, Ilia)
- - Added missing sanity checks around exif processing. (Ilia)
- - Fixed sanity check for the color index in imagecolortransparent. (Pierre)
- - (popen crashes when an invalid mode is passed). (Pierre)
-
-
-
-- Updated timezone database to version 2009.13 (2009m) (Derick)
-- Fixed zlib.deflate compress filter to actually accept level parameter. (Jani)
-- Fixed leak on error in popen/exec (and related functions) on Windows. (Pierre)
-- Fixed regression in cURL extension that prevented flush of data to output defined as a file handle. (Ilia)
-- Fixed memory leak in stream_is_local(). (Felipe, Tony)
-
-- (FILTER_SANITIZE_EMAIL allows disallowed characters). (Ilia)
-- (php engine needs to correctly check for socket API return status on windows). (Sriram Natarajan)
-- (segfault in php_curl_option_curl). (Pierre)
-- (wordwrap() wraps incorrectly on end of line boundaries). (Ilia, code-it at mail dot ru)
-- (bcmath module doesn't compile with phpize configure). (Jani)
-- (php://input (php_stream_input_read) is broken). (Jani)
-- (Ternary operator fails on Iterator object when used inside foreach declaration). (Etienne, Dmitry)
-- (Missing PHP_SUBST(PDO_MYSQL_SHARED_LIBADD)). (Jani)
-- (Import of schema from different host transmits original authentication details). (Dmitry)
-- (posix_times returns false without error). (phpbugs at gunnu dot us)
-- (Error in dba_exists C code). (jdornan at stanford dot edu)
-- (proc_get_status['exitcode'] fails on win32). (Felipe)
-- (private class static fields can be modified by using reflection). (Jani)
-- (feof never returns true for damaged file in zip). (Pierre)
-- (context option headers freed too early when using --with-curlwrappers). (Jani)
-- (SplFileObject::fscanf() variables passed by reference). (Jani)
-- (proc_open() can bypass safe_mode_protected_env_vars restrictions). (Ilia)
-- (PHP CLI in Interactive mode (php -a) crashes when including files from function). (Stas)
-- (zlib.output_compression does not output HTTP headers when set to a string value). (Jani)
-- (Crash when compiling with pdo_firebird). (Felipe)
-- (cURL does not upload files with specified filename). (Ilia)
-- (Double \r\n after HTTP headers when "header" context option is an array). (David Zülke)
-- (Too long error code strings in pdo_odbc driver). (naf at altlinux dot ru, Felipe)
-- (printf() returns incorrect outputted length). (Jani)
-- (Problem with imagettfbbox). (Takeshi Abe)
-- (RecursiveDirectoryIterator doesn't descend into symlinked directories). (Ilia)
-- (SIGSEGVs when using curl_copy_handle()). (Sriram Natarajan)
-- (ZipArchive produces corrupt archive). (dani dot church at gmail dot com, Pierre)
-- (IPv6 address filter still rejects valid address). (Felipe)
-- (CURLOPT_WRITEHEADER|CURLOPT_FILE|CURLOPT_STDERR warns on files that have been opened with r+). (Ilia)
-- (TTF Bounding box wrong for letters below baseline). (Takeshi Abe)
-- (FILTER_VALIDATE_EMAIL does not allow numbers in domain components). (Ilia)
-- (metaphone and 'wh'). (brettz9 at yahoo dot com, Felipe)
-- (mb_internal_encoding() value gets reset by parse_str()). (Moriyoshi)
-- (ldap_read() segfaults with invalid parameters). (Felipe)
-- (Double declaration of __lambda_func when lambda wrongly formatted). (peter at lvp-media dot com, Felipe)
-- (phpize is broken with non-bash shells). (Jani)
-- (mb_convert_encoding() doesn't understand hexadecimal html-entities). (Moriyoshi)
-- ("file" fopen wrapper is overwritten when using --with-curlwrappers). (Jani)
-- (Error compiling of ext/date on netware). (guenter at php.net, Ilia)
-- (get_defined_constants() ignores categorize parameter). (Felipe)
-- (imap_search ALL segfaults). (Pierre)
-- (Invalid libreadline version not detected during configure). (Jani)
-- (ImageFTBBox() differs from previous versions for texts with new lines) (Takeshi Abe)
-- (pdo_dblib fails to connect, throws empty PDOException "SQLSTATE[] (null)"). (Felipe)
-- (sys_get_temp_dir() possibly inconsistent when using TMPDIR). (Ilia)
-- (Compile failure under IRIX 6.5.30 building gd.c). (Kalle)
-- (imap crashes when closing stream opened with OP_PROTOTYPE flag). (Jani)
-- (hash "adler32" byte order is reversed). (Scott)
-- (date("Y") on big endian machines produces the wrong result). (Scott)
-- (Infinite loop and possible crash during startup with errors when errors are logged). (Jani)
-- (ssl handshake fails during asynchronous socket connection). (Sriram Natarajan)
-- (Fixed build with Openssl 1.0). (Pierre, Al dot Smith at aeschi dot ch dot eu dot org)
-- (pdo_pgsql - large objects are returned as empty). (Matteo)
-- (Only the date fields of the first row are fetched, others are empty). (info at programmiernutte dot net)
-- (natcasesort() does not sort extended ASCII characters correctly). (Herman Radtke)
-- (Memory leak in DateTime). (Derick, Tobias John)
-- (Encoding bug in SoapServer->fault). (Dmitry)
-- (with Sun Java System Web Server 7.0 on HPUX, #define HPUX). (Uwe Schindler)
-- (imagefilledrectangle() clipping error). (markril at hotmail dot com, Pierre)
-- (Reflection of instantiated COM classes causes PHP to crash) (Paul Richards, Kalle)
-- (setcookie will output expires years of >4 digits). (Ilia)
-- (spl_autoload_functions() should return object instance when appropriate). (Hannes, Etienne)
-- (stream_get_meta_data() does not return same mode as used in fopen). (Jani)
-- (ImageLine w/ antialias = 1px shorter). (wojjie at gmail dot com, Kalle)
-- (Sent incorrect RCPT TO commands to SMTP server) (Garrett)
-
-
-
-
-
-
-Version 5.2.10
-
-
- - Security Fixes
-
- - (exif_read_data() segfaults on certain corrupted .jpeg files). (Pierre)
-
-
-
- - Updated timezone database to version 2009.9 (2009i) (Derick)
-
- - Added "ignore_errors" option to http fopen wrapper. (David Zulke, Sara)
- - Added new CURL options CURLOPT_REDIR_PROTOCOLS, CURLOPT_PROTOCOLS, and CURLPROTO_* for redirect fixes in CURL 7.19.4. (Yoram Bar Haim, Stas)
- - Added support for Sun CC (FR and FR ). (David Soria Parra)
-
- - Changed default value of array_unique()'s optional sorting type parameter back to SORT_STRING to fix backwards compatibility breakage introduced in PHP 5.2.9. (Moriyoshi)
-
- - Fixed memory corruptions while reading properties of zip files. (Ilia)
- - Fixed memory leak in ob_get_clean/ob_get_flush. (Christian)
- - Fixed segfault on invalid session.save_path. (Hannes)
- - Fixed leaks in imap when a mail_criteria is used. (Pierre)
- - Fixed missing erealloc() in fix for bug in spl_autoload_register. (Greg)
-
- - (Reference recursion causes segfault when used in wddx_serialize_vars()). (Felipe)
- - (Numeric string keys in Apache Hashmaps are not cast to integers). (David Zuelke)
- - (curl crashes when writing into invalid file handle). (Tony)
- - (cURL extension uses same resource name for simple and multi APIs). (Felipe)
- - (ldap_get_entries() leaks memory on empty search results). (Patrick)
- - (CPPFLAGS not restored properly in phpize.m4). (Jani, spisek at kerio dot com)
- - (Compile failure under IRIX 6.5.30 building cast.c). (Kalle)
- - (ldap_search() sizelimit, timelimit and deref options persist). (Patrick)
- - (Improve memory_get_usage() accuracy). (Arnaud)
- - (Force a cache limit in ereg() to stop excessive memory usage). (Scott)
- - (Crash when exception is thrown while passing function arguments). (Arnaud)
- - (exif_read_data() segfaults on certain corrupted .jpeg files). (Pierre)
- - (Script hangs on snmprealwalk if OID is not increasing). (Ilia, simonov at gmail dot com)
- - (ReflectionProperty::getDeclaringClass() does not work with redeclared property). (patch by Markus dot Lidel at shadowconnect dot com)
- - (constant MSG_DONTWAIT not defined). (Arnaud)
- - (fgetcsv() does not return null for empty rows). (Ilia)
- - (stream_copy_to_stream() and fpasstru() do not update stream position of plain files). (Arnaud)
- - (stream_copy_to_stream() copies 0 bytes when $source is a socket). (Arnaud)
- - (snmp*_real_walk() returns SNMP errors as values). (Ilia, lytboris at gmail dot com)
- - (Crash due to double-linking of history.o). (tstarling at wikimedia dot org)
- - (SIGSEGV when access to private property via &__get). (Felipe)
- - (Crash on errors during startup). (Stas)
- - (DBA Segmentation fault dba_nextkey). (Felipe)
- - (Incorrect shuffle in array_rand). (Etienne)
- - (memory leak when passing invalid xslt parameter). (Felipe)
- - (CURLOPT_(FILE|WRITEHEADER options do not error out when working with a non-writable stream). (Ilia)
- - (Iterating over an invalid data structure with RecursiveIteratorIterator leads to a segfault). (Scott)
- - (xmlwriter_open_uri() does not emit warnings on invalid paths). (Ilia)
- - (Crash when CURLOPT_STDERR is set to regular file). (Jani)
- - (Out of Memory error message when passing invalid file path) (Pierre)
- - (Added support for lcov v1.7). (Ilia)
- - (configure check for curl ssl support fails with --disable-rpath). (Jani)
- - (Don't try to bind ipv4 addresses to ipv6 ips via bindto). (Ilia)
- - (PDO_OCI: Segfault when using persistent connection). (Pierre, Matteo, jarismar dot php at gmail dot com)
- - (Year formatter goes wrong with out-of-int range). (Derick)
- - (odbc_execute changes variables used to form params array). (Felipe)
- - (stream_copy_to_stream returns 1 on empty streams). (Arnaud)
- - (SSL streams fail if error stack contains items). (Mikko)
- - (error handler not called regardless). (Hannes)
- - (ezmlm_hash() returns different values depend on OS). (Ilia)
- - (ImageConvolution overwrites background). (Ilia)
- - (memory leaks in imap_body). (Pierre, Jake Levitt)
- - (system() calls sapi_flush() regardless of output buffering). (Ilia)
- - ("@" operator does not work with string offsets). (Felipe)
- - (CLI aborts on non blocking stdout). (Arnaud)
- - (Non-deep import loses the namespace). (Rob)
- - (PDO_Firebird omits first row from query). (Lars W)
- - (array operator [] inconsistency when the array has PHP_INT_MAX index value). (Matt)
- - (Compile warning for strnlen() in main/spprintf.c). (Ilia, rainer dot jung at kippdata dot de)
- - (openssl_x509_parse() segfaults when a UTF-8 conversion fails). (Scott, Kees Cook, Pierre)
- - (Segfault due to bound callback param). (Felipe)
- - (__call() accessed via parent:: operator is provided incorrect method name). (Felipe)
- - (Strange extends PDO). (Felipe)
- - (FILTER_VALIDATE_INT doesn't allow minimum integer). (Dmitry)
- - (Alignment issues in mbstring and sysvshm extension) (crrodriguez at opensuse dot org, Ilia)
- - (PHP crashes on some "bad" operations with string offsets). (Dmitry)
- - (build error when xmlrpc and iconv are compiled against different iconv versions). (Scott)
- - (ZipArchive::OVERWRITE seems to have no effect). (Mikko, Pierre)
- - (Valid integers are truncated with json_decode()). (Scott)
- - (pg_copy_from() WARNING: nonstandard use of \\ in a string literal). (Ilia)
- - (curl keeps crashing). (Felipe)
- - (FILTER_VALIDATE_EMAIL is locale aware). (Ilia)
- - (pcntl_wexitstatus() returns signed status). (patch by james at jamesreno dot com)
- - (unpacking unsigned long 32bit bit endian returns wrong result). (Ilia)
- - (performance degraded when reading large chunks after fix of bug ). (Arnaud)
- - (enable cli|cgi-only extensions for embed sapi). (Jani)
- - (FILTER_FLAG_NO_PRIV_RANGE does not work with ipv6 addresses in the filter extension). (Ilia)
- - (Errors after writing to nodeValue parameter of an absent previousSibling). (Rob)
- - (ip2long() may allow some invalid values on certain 64bit systems). (Ilia)
- - (Wrong Reflection for extends class). (Felipe)
- - (cgi sapi is incorrectly removing SCRIPT_FILENAME). (Sriram Natarajan, David Soria Parra)
- - (Serialize / Unserialize misbehaviour under OS with different bit numbers). (Matt)
- - (get_class_vars() does not include visible private variable looking at subclass). (Arnaud)
- - (Digest authentication with SOAP module fails against MSSQL SOAP services). (Ilia, lordelph at gmail dot com)
- - (Memory leak when mysqli::init() is called multiple times). (Andrey)
- - (safe_mode bypass with exec/system/passthru (windows only)). (Pierre)
- - (Array key '2147483647' left as string). (Matt)
- - (Near infinite-loops while parsing huge relative offsets). (Derick, Mike Sullivan)
- - (imagepng() crashes on empty image). (Martin McNickle, Takeshi Abe)
- - (isset($arrayObject->p) misbehaves with ArrayObject:: ARRAY_AS_PROPS set). (robin_fernandes at uk dot ibm dot com, Arnaud)
- - (ArrayIterator::current(), ::key() can show 1st private prop of wrapped object). (robin_fernandes at uk dot ibm dot com, Arnaud)
- - (stream_context_create creates bad http request). (Arnaud)
- - (zlib.output_compression can not be set with ini_set()). (Jani)
- - (error_log ignores date.timezone php.ini val when setting logging timestamps). (Derick)
- - (header HTTP context option not being used when compiled using --with-curlwrappers). (Jani)
- - (xmlrpc_decode() ignores time zone on iso8601.datetime). (Ilia, kawai at apache dot org)
- - (define() is missing error checks for class constants). (Ilia)
- - (Crash using preg_replace_callback() and global variables). (Nuno, Scott)
- - (TrueType bounding box is wrong for angle<>0). (Martin McNickle)
- - (gzinflate() try to allocate all memory with truncated data). (Arnaud)
- - (some odbc_*() functions incompatible with Oracle ODBC driver). (jhml at gmx dot net)
- - (HTTP status codes 204 and 304 should not be gzipped). (Scott, Edward Z. Yang)
- - (The constant NAN is reported as 0 on Windows) (Kanwaljeet Singla, Venkat Raman Don)
- - (PDO truncates text from SQL Server text data type field). (Steph)
-
-
-
-
-Version 5.2.9
-
-
- - Security Fixes
-
- - Fixed security issue in imagerotate(), background colour isn't validated correctly with a non truecolour image. Reported by Hamid Ebadi, APA Laboratory (Fixes CVE-2008-5498). (Scott)
- - Fixed a crash on extract in zip when files or directories entry names contain a relative path. (Pierre)
- - Fixed explode() behavior with empty string to respect negative limit. (Shire)
- - Fixed a segfault when malformed string is passed to json_decode(). (Scott)
- - Fixed bug in xml_error_string() which resulted in messages being off by one. (Scott)
-
-
-
- - Changed __call() to be invoked on private/protected method access, similar to properties and __get(). (Andrei)
- - Added optional sorting type flag parameter to array_unique(). Default is SORT_REGULAR. (Andrei)
- - Fixed zip filename property read. (Pierre)
- - Fixed error conditions handling in stream_filter_append(). (Arnaud)
-
- - (modulus operator returns incorrect results on 64 bit linux). (Matt)
- - (mb_check_encoding() returns true for some illegal SJIS characters). (for-bugs at hnw dot jp, Moriyoshi)
- - (crash when creating a lot of objects in object destructor). (Tony)
- - (sscanf %d doesn't work). (Felipe)
- - (FILTER_VALIDATE_EMAIL is marking valid email addresses as invalid). (Ilia)
- - (segfault in dom_document_parser in recovery mode). (Rob)
- - (content-type is not set properly for file uploads). (Ilia)
- - (base64_decode() interprets pad char in mid string as terminator). (Ilia)
- - (Possible memory corruption when passing return value by reference). (Dmitry)
- - (gzseek/fseek using SEEK_END produces strange results). (Felipe)
- - (SOAP Extension ignores "user_agent" ini setting). (Ilia)
- - (Memory leak on $a->{"a"."b"} when $a is not an object). (Etienne, Dmitry)
- - (Linking shared extensions fails with icc). (Jani)
- - (SoapClient::__soapCall causes a segmentation fault). (Dmitry)
- - (Segfault with new pg_meta_data). (Felipe)
- - (PHP cgi sapi is removing SCRIPT_FILENAME for non apache). (Sriram Natarajan)
- - (No error when using fopen with empty string). (Cristian Rodriguez R., Felipe)
- - (dns_get_record returns a garbage byte at the end of a TXT record). (Felipe)
- - (var_export doesn't show numeric indices on ArrayObject). (Derick)
- - (OVERWRITE and binary mode does not work, regression introduced in 5.2.8). (Pierre)
- - (IPv6 address filter rejects valid address). (Felipe)
- - (Fixed pdo_mysql build with older version of MySQL). (Ilia)
- - (Unable to disable PCRE). (Scott)
- - (imap_rfc822_parse_adrlist host part not filled in correctly). (Felipe)
- - (Memory leak in strtotime()). (Derick)
- - (Invalid calls to php_error_docref()). (oeriksson at mandriva dot com, Ilia)
- - (extract($foo) crashes if $foo['foo'] exists). (Arnaud)
- - (CP936 euro symbol is not converted properly). (ty_c at cybozuy dot co dot jp, Moriyoshi)
- - (Crash in mssql extension when retrieving a NULL value inside a binary or image column type). (Ilia)
- - (fastcgi.c parse error). (Matt)
- - (SoapClient doRequest fails when proxy is used). (Felipe)
- - (Segfault when an SSL error has more than one error). (Scott)
- - (array returned by curl_getinfo should contain content_type key). (Mikko)
- - (xml_parse crash when parser is namespace aware). (Rob)
- - (Elements of associative arrays with NULL value are lost). (Dmitry)
- - (Corrupt DBF When Using DATE). (arne at bukkie dot nl)
- - (bz2.decompress/zlib.inflate filter tries to decompress after end of stream). (Greg)
- - (User not consistently logged under Apache2). (admorten at umich dot edu, Stas)
- - (libxml2 2.7 causes breakage with character data in xml_parse()). (Rob)
- - (MySQLI OO does not populate connect_error property on failed connect). (Johannes)
- - (mb_st[r]ripos() offset not handled correctly). (Moriyoshi)
- - (memory leak if offsetGet throws exception). (Greg)
- - (Encoding detector hangs with mbstring.strict_detection enabled). (Moriyoshi)
- - (Reusing a curl handle leaks memory). (Mark Karpeles, Jani)
- - (Improve pcre UTF-8 string matching performance). (frode at coretrek dot com, Nuno)
- - (mb_strrpos() offset is byte count for negative values). (Moriyoshi)
- - (mssql_execute with non fatal errors). (Kalle)
- - (Session cookie expires date format isn't the most compatible. Now matches that of setcookie()). (Scott)
-
-
-
-
-
-
-Version 5.2.8
-
-
- - Reverted bug fix that broke magic_quotes_gpc (Scott)
-
-
-
-
-
-Version 5.2.7
-
-
- - Security Fixes
-
- - Upgraded PCRE to version 7.8 (Fixes CVE-2008-2371) (Ilia)
- - Fixed missing initialization of BG(page_uid) and BG(page_gid), reported by Maksymilian Arciemowicz. (Stas)
- - Fixed incorrect php_value order for Apache configuration, reported by Maksymilian Arciemowicz. (Stas)
- - Fixed a crash inside gd with invalid fonts (Fixes CVE-2008-3658). (Pierre)
- - Fixed a possible overflow inside memnstr (Fixes CVE-2008-3659). (Laurent Gaffie)
- - Fixed security issues detailed in CVE-2008-2665 and CVE-2008-2666. (Christian Hoffmann)
- - (Crash with URI/file..php (filename contains 2 dots)).(Fixes CVE-2008-3660) (Dmitry)
- - (IMAP toolkit crash: rfc822.c legacy routine buffer overflow). (Fixes CVE-2008-2829) (Dmitry)
-
-
-
-- Updated timezone database to version 2008.9. (Derick)
-- Upgraded bundled libzip to 0.9.0. (Pierre)
-
-- Added logging option for error_log to send directly to SAPI. (Stas)
-- Added PHP_MAJOR_VERSION, PHP_MINOR_VERSION, PHP_RELEASE_VERSION,PHP_EXTRA_VERSION, PHP_VERSION_ID, PHP_ZTS and PHP_DEBUG constants. (Pierre)
-- Added "PHP_INI_SCAN_DIR" environment variable which can be used to either disable or change the compile time ini scan directory (FR ). (Jani)
-
-- Fixed memory leak inside sqlite_create_aggregate(). (Felipe)
-- Fixed memory leak inside PDO sqlite's sqliteCreateAggregate() method. (Felipe)
-- Fixed memory leak inside readline_callback_handler_remove() function. (Felipe)
-- Fixed sybase_fetch_*() to continue reading after CS_ROW_FAIL status (Timm)
-- Fixed a bug inside dba_replace() that could cause file truncation with invalid keys. (Ilia)
-- Fixed memory leak inside readline_callback_handler_install() function. (Ilia)
-- Fixed memory leak inside readline_completion_function() function. (Felipe)
-- Fixed stream_get_contents() when using $maxlength and socket is not closed. indeyets [at] php [dot] net on . (Arnaud)
-- Fixed stream_get_line() to behave as documented on non-blocking streams. (Arnaud)
-- Fixed endless loop in PDOStatement::debugDumpParams().(jonah.harris at gmail dot com)
-- Fixed ability to use "internal" heaps in extensions. (Arnaud, Dmitry)
-- Fixed weekdays adding/subtracting algorithm. (Derick)
-- Fixed some ambiguities in the date parser. (Derick)
-- Fixed a bug with the YYYY-MM format not resetting the day correctly. (Derick)
-- Fixed a bug in the DateTime->modify() methods, it would not use the advanced relative time strings. (Derick)
-- Fixed extraction of zip files or directories when the entry name is a relative path. (Pierre)
-- Fixed read or write errors for large zip archives. (Pierre)
-- Fixed simplexml asXML() not to lose encoding when dumping entire document to file. (Ilia)
-- Fixed a crash inside PDO when trying instantiate PDORow manually. (Felipe)
-- Fixed build failure of ext/mysqli with libmysql 6.0 - missing rpl functions. (Andrey)
-- Fixed a regression when using strip_tags() and < is within an attribute. (Scott)
-- Fixed a crash on invalid method in ReflectionParameter constructor. (Christian Seiler)
-- Reverted fix for bug due to behaviour change in minor version. (Felipe)
-
-- (mktime.year description is wrong). (Derick)
-- (cURL fails in upload files with specified content-type). (Ilia)
-- (stream_lock call with wrong parameter). (Arnaud)
-- (Setting array element with that same array produces inconsistent results). (Arnaud)
-- (mb_convert_case does not handle apostrophe correctly). (Ilia)
-- (ibase_trans() memory leaks when using wrong parameters). (Felipe)
-- (Curl ZTS OpenSSL, error in config.m4 fragment). (jd at cpanel dot net)
-- (wddx_serialize treats input as ISO-8859-1). (Mark Karpeles)
-- (SoapClient() stumbles over its "stream_context" parameter). (Dmitry, Herman Radtke)
-- (offset parameter of stream_get_contents() does not workfor "0"). (Felipe)
-- (Unregistering nodeclass throws E_FATAL). (Rob)
-- (NetWare needs small patch for _timezone). (patch by guenter@php.net)
-- (stream_notification_callback inside of object destroys object variables). (Felipe)
-- (wrong $this passed to internal methods causes segfault). (Tony)
-- (Infinite loop when parsing '#' in one line file). (Arnaud)
-- (bad cwd with / as pathinfo). (Dmitry)
-- (TCP_NODELAY constant for socket_{get,set}_option). (bugs at trick dot vanstaveren dot us)
-- (IPv6 address filter accepts invalid address). (Ilia)
-- (DOMText::splitText doesn't handle multibyte characters). (Rob)
-- (compilation of simplexml for NetWare breaks). (Patch by guenter@php.net)
-- (PHP sets default Content-Type header for HTTP 304 response code, in cgi sapi). (Ilia)
-- (Magic quotes broke $_FILES). (Arnaud)
-- (Invalid write when changing property from inside getter). (Dmitry)
-- (PDO::setFetchMode() shouldn't requires the 2nd arg when using FETCH_CLASSTYPE). (Felipe)
-- Fixed bugs , (pdo_pgsql always fill in NULL for empty BLOB and segfaults when returned by SELECT). (Felipe)
-- (local_cert option is not resolved to full path). (Ilia)
-- (ibase_set_event_handler() is allowing to pass callback without event). (Felipe)
-- (difference between call_user_func(array($this, $method))and $this->$method()). (Dmitry)
-- (ArrayObject EG(uninitialized_var_ptr) overwrite). (Etienne)
-- (json_encode mutates its parameter and has some class-specific state). (Felipe)
-- (pg_query_params/pg_execute convert passed values to strings). (Ilia)
-- (BC break: DOMDocument saveXML() doesn't accept null). (Rob)
-- (stream_filter_remove() closes the stream). (Arnaud)
-- (PDOStatement::fetchObject prototype error). (Felipe)
-- (after stream seek, appending stream filter reads incorrect data). (Greg)
-- (PDOStatement->setFetchMode() forgets FETCH_PROPS_LATE). (chsc at peytz dot dk, Felipe)
-- (php_openssl_tcp_sockop_accept forgets to set context on accepted stream). (Mark Karpeles, Pierre)
-- (XMLWriter - openmemory() and openuri() leak memory on multiple calls). (Ilia)
-- (RegexIterator::accept - segfault). (Felipe)
-- (stream_set_blocking() can cause a crash in some circumstances). (Felipe)
-- (Exception when creating ReflectionProperty object on dynamicly created property). (Felipe)
-- (Compile failure under IRIX 6.5.30 building posix.c). (Arnaud)
-- (SplFileObject::seek - Endless loop). (Arnaud)
-- (SplFileInfo::openFile - memory overlap). (Arnaud)
-- (SimpleXML converts empty nodes into object with nested array). (Rob)
-- (Segfault in AppendIterator::next). (Arnaud)
-- (Segfault in DOMText when using with Reflection). (Rob)
-- (bzip2.decompress/zlib.inflate filter tries to decompress after end of stream). (Keisial at gmail dot com, Greg)
-- (stream_select() doesn't return the correct number).(Arnaud)
-- (warnings incorrectly generated for iv in ecb mode). (Felipe)
-- (isset on nonexisting node return unexpected results). (Rob)
-- (parse_ini_file() does not return false with syntax errors in parsed file). (Jani)
-- (wddx_serialize_value crash with SimpleXMLElement object).(Rob)
-- (get_class_vars is inconsistent with 'protected' and 'private' variables). (ilewis at uk dot ibm dot com, Felipe)
-- (header() function fails to correctly replace all Status lines). (Dmitry)
-- (Crash on throwing exception from error handler). (Dmitry)
-- (ReflectionObject with default parameters of self::xxx cause an error). (Felipe)
-- (Using auto_prepend_file crashes (out of scope stack address use)). (basant dot kukreja at sun dot com)
-- (mb_check_encoding() crashes). (Moriyoshi)
-- (rfc822_parse_adrlist() modifies passed address parameter). (Jani)
-- (Some per-dir or runtime settings may leak into other requests). (Moriyoshi)
-- (htmlspecialchars() double encoding &#x hex items). (Arnaud)
-- (levenshtein() crashes with invalid argument). (Ilia)
-- (Segfault with invalid non-string as event handler callback). (Christian Seiler)
-- (ISAPI doesn't properly clear auth_digest in header). (Patch by: navara at emclient dot com)
-- (Return value from callback isn't freed). (Felipe)
-- (Segfault with invalid non-string as register_introspection_callback). (Christian Seiler)
-- (Using XPath to return values for attributes with a namespace does not work). (Rob)
-- (new DateTimeZone() and date_create()->getTimezone() behave different). (Derick)
-- (FCGI_GET_VALUES request does not return supplied values). (Arnaud)
-- (mb_send_mail(); header 'Content-Type: text/plain; charset=' parsing incorrect). (Felipe)
-- (strip_tags and <?XML tag). (Felipe)
-- (imap patch for fromlength fix in imap_headerinfo doesn't accept lengths of 1024). (Felipe, andrew at lifescale dot com)
-- (filesize() regression using ftp wrapper). (crrodriguez at suse dot de)
-- (fastcgi parent process doesn't invoke php_module_shutdown before shutdown). (basant dot kukreja at sun dot com)
-- (session.serialize_handler declared by shared extension fails). (Kalle, oleg dot grenrus at dynamoid dot com)
-- (snmp extension memory leak). (Federico Cuello, Rodrigo Campos)
-- (ob_start()/ob_end_clean() and memory_limit). (Arnaud)
-- (timeout bug in stream_socket_enable_crypto). (Ilia)
-- (php crash on query with errors in params). (Felipe)
-- (Segmentation fault because of tick function on second request). (Dmitry)
-- (Segmentation fault on second request for array functions). (Dmitry)
-- (Opening php:// wrapper in append mode results in a warning). (Arnaud)
-- (double free or corruption with setAttributeNode()). (Rob)
-- Fixed bugs , (xmlrpc_set_type() segfaults and wrong behavior with valid ISO8601 date string). (Jeff Lawsons)
-- (curl_read callback returns -1 when needs to return size_t (unsigned)). (Felipe)
-- (chdir() should clear relative entries in stat cache). (Arnaud)
-- (memory corruption on assignment result of "new" by reference). (Dmitry)
-- (substr() overflow changes). (Felipe)
-- (ReflectionProperty returns incorrect declaring class).(Felipe)
-- ($_FILES['upload']['size'] sometimes return zero and sometimes the filesize). (Arnaud)
-- (CRC32 output endianness is different between crc32() and hash()). (Tony)
-- (pg_insert() does not accept 4 digit timezone format). (Ilia)
-- (Compile Failure With freetds0.82). (jklowden at freetds dot org, matthias at dsx dot at)
-- (gettext functions crash with overly long domain). (Christian Schneider, Ilia)
-- (preg_grep() modifies input array). (Nuno)
-- (OpenSSL extension fails to link with OpenSSL 0.9.6). (jd at cpanel dot net, Pierre)
-- Memory leak using registerPHPFunctions and XSLT Variable as function parameter. (Rob)
-- (SOAP extension object decoding bug). (Dmitry)
-- (Very minor issue with backslash in heredoc). (Matt)
-- (php://memory writeable when opened read only). (Arnaud)
-- (Improve error message when creating a new SoapClient that contains invalid data). (Markus Fischer, David C)
-- (Memory leak assigning value to attribute). (Ilia)
-- (Progress notifications incorrect). (Hannes)
-- (stream_context_set_params segfaults on invalid arguments). (Hannes)
-- (wrong HTML entity output when substitute_character=entity). (Moriyoshi)
-- (stream_get_line unable to correctly identify the "ending" in the stream content). (Arnaud)
-- (Extending PDO/MySQL class with a __call() function doesn'twork). (Johannes)
-- (PDORow::queryString property & numeric offsets / Crash). (Felipe)
-- Fixed bugs , (PDO + quote() + prepare() can result in segfault). (tsteiner at nerdclub dot net)
-- (closedir() accepts a file resource opened by fopen()). (Dmitry, Tony)
-- (extract($a, EXTR_REFS) can fail to split copy-on-write references). (robin_fernandes at uk dot ibm dot com)
-- (extract($a, EXTR_OVERWRITE|EXTR_REFS) can fail to create references to $a). (robin_fernandes at uk dot ibm dot com)
-- (UNIX abstract namespace socket connect does not work). (Jani)
-- (mb_substr_count() behaves differently to substr_count() with overlapping needles). (Moriyoshi)
-- (class name added into the error message). (Dmitry)
-- (json_encode silently cuts non-UTF8 strings). (Stas)
-- (Incorrect argument counter in prepared statements with pgsql). (Felipe)
-- (socket_getpeername: cannot use on stdin with inetd). (Arnaud)
-- (SOAP not sent properly from client for <choice>). (Dmitry)
-- (Added odbc.default_cursortype to control the ODBCcursor model). (Patrick)
-- (Fixed code to use ODBC 3.52 datatypes for 64bit systems). (Patrick)
-- (rfc1867 handler newlength problem). (Arnaud)
-- (strings containing a weekday, or a number plus weekday behaved incorrect of the current day-of-week was the same as the one in the phrase).(Derick)
-- (wrong detection of 'data' wrapper causes notice). (gk at gknw dot de, Arnaud)
-- (Regression: some numbers shown in scientific notation). (int-e at gmx dot de)
-- (SOAP encoding violation on "INF" for type double/float). (Dmitry)
-- (dns_get_record() doesn't return all text from TXT record). (a dot u dot savchuk at gmail dot com)
-- (preg_split('//u') triggers a E_NOTICE with newlines). (Nuno)
-- (FILTER_UNSAFE_RAW not applied when configured as default filter). (Arnaud)
-- ("make test" fails with --with-config-file-scan-dir=path). (Jani)
-- (ob_start php://output and headers). (Arnaud)
-- (problem with nm on AIX, not finding object files). (Dmitry)
-- (Unified solution for round() based on C99 round). (Ilia)
-- (pg_meta_data mix tables metadata from different schemas). (Felipe)
-- (OCI8: allow compilation with Oracle 8.1). (Chris Jones)
-- (enable signing with DSA keys. (gordyf at google dot com, Pierre)
-- (data is returned truncated with BINARY CURSOR). (Tony)
-- (crash in sybase_unbuffered_query() function). (Timm)
-- (pg_* functions doesn't work using schema). (Felipe)
-- (::extractTo 2nd argument is not really optional). (Mark van Der Velden)
-- (Mail() always returns false but mail is sent). (Mikko)
-
-
-
-
-
-
-Version 5.2.6
-
-
- - Security Fixes
-
- - Fixed possible stack buffer overflow in FastCGI SAPI. (Andrei Nigmatulin)
- - Properly address incomplete multibyte chars inside escapeshellcmd() (Ilia, Stefan Esser)
- - Fixed security issue detailed in CVE-2008-0599. (Rasmus)
- - Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz. (Ilia)
- - Upgraded PCRE to version 7.6 (Nuno)
-
-
-- Fixed two possible crashes inside posix extension (Tony)
-- Fixed incorrect heredoc handling when label is used within the block. (Matt)
-- Fixed sending of uninitialized paddings which may contain some information. (Andrei Nigmatulin)
-- Fixed a bug in formatting timestamps when DST is active in the default timezone (Derick)
-- Fix integer overflow in printf(). (Stas, Maksymilian Aciemowicz)
-- Fixed potential memleak in stream filter parameter for zlib filter. (Greg)
-- Added Reflection API metadata for the methods of the DOM classes. (Sebastian)
-- Fixed weird behavior in CGI parameter parsing. (Dmitry, Hannes Magnusson)
-- Fixed a bug with PDO::FETCH_COLUMN|PDO::FETCH_GROUP mode when a column # by which to group by data is specified. (Ilia)
-- Fixed segfault in filter extension when using callbacks. (Arnar Mar Sig, Felipe)
-- Fixed faulty fix for bug (endless loop in zlib.inflate stream filter). (Greg)
-
-- (timezone_offset_get() causes segmentation faults). (Derick)
-- (Prevent crash within session_register()). (Scott)
-- (htmlspecialchars() does not detect bad character set argument). (Andy Wharmby)
-- (With CGI argv/argc starts from arguments, not from script) (Dmitry)
-- (proc_open() does not handle pipes with the mode 'wb' correctly). (Jani)
-- (Crash in imap_mail_compose if "body" parameter invalid). (Ilia)
-- (escapeshellscmd() does not check arg count). (Ilia)
-- (Crash inside imap_headerinfo()). (Ilia, jmessa)
-- (Order issues with Content-Type/Length headers on POST). (Ilia)
-- (imap_open() does not validate # of retries parameter). (Ilia)
-- (imagegif's filename parameter). (Felipe)
-- (Crash in imap_setacl when supplied integer as username) (Thomas Jarosch)
-- (call_user_method_array issues a warning when throwing an exception). (David Soria Parra)
-- (Inconsistent behaviour when assigning new nodes). (Rob, Felipe)
-- (email validator does not handle domains starting/ending with a -). (Ilia)
-- (st_blocks undefined under BeOS). (Felipe)
-- (Last two bytes missing from output). (Felipe)
-- (Crash inside exif_read_data() on invalid images) (Ilia)
-- (PDO_OCI extension compile failed). (Felipe)
-- (SEGFAULT when using mysql_pconnect() with client_flags). (Felipe)
-- (Better detection of MIPS processors on Windows). (Ilia)
-- (metaphone('CMXFXM') crashes PHP). (Felipe)
-- (MSG_PEEK undefined under BeOS R5). (jonathonfreeman at gmail dot com, Ilia)
-- (strftime segfaults on large negative value). (Derick)
-- (strtotime() doesn't support 64 bit timestamps on 64 bit platforms). (Derick)
-- (OCI8 selecting ref cursors leads to ORA-1000 maximum open cursors reached). (Oracle Corp.)
-- (A crash in PDO when no bound targets exists and yet bound parameters are present). (Ilia)
-- (socket array keys lost on socket_select). (Felipe)
-- (preg_grep messes up array index). (Felipe)
-- (PDO setAttribute() does not properly validate values for native numeric options). (Ilia)
-- (Double free of loop-variable on exception). (Dmitry)
-- (Invalid FETCH_COLUMN index does not raise an error). (Ilia)
-- (Parameter handling flaw in PDO::getAvailableDrivers()). (Ilia)
-- (Crash: $pdo->setAttribute(PDO::STATEMENT_ATTR_CLASS, NULL)). (Felipe)
-- (Possible crash with syslog logging on ZTS builds). (Ilia)
-- (private parent constructor callable through static function). (Dmitry)
-- (OCI8 new collection creation can fail with OCI-22303). (Oracle Corp.)
-- (Huge memory usage with concatenation using . instead of .=). (Dmitry)
-- (crash inside array_slice() function with an invalid by-ref offset). (Ilia)
-- (crash inside stream_socket_enable_crypto() when enabling encryption without crypto type). (Ilia)
-- (RecursiveDirectoryIterator options inconsistancy). (Marcus)
-- (OCI8 incorrect usage of OCI-Lob->close crashes PHP). (Oracle Corp.)
-- (Two error messages returned for incorrect encoding for mb_strto[upper|lower]). (Rui)
-- (mb_ereg 'successfully' matching incorrect). (Rui)
-- (Memory leak when sending the same HTTP status code multiple times). (Scott)
-- (koi8r is missing from html_entity_decode()). (andy at demos dot su, Tony)
-- (Interbase column names are truncated to 31 characters). (Ilia)
-- (Two error messages returned for $new and $flag argument in mysql_connect()). (Hannes)
-- (str_word_count() breaks on cyrillic "ya" in locale cp1251). (phprus at gmail dot com, Tony)
-- (mb_strrpos offset is byte count for negative values). (Rui)
-- (mb_strpos bounds check is byte count rather than a character count). (Rui)
-- (date_create never fails (even when it should)). (Derick)
-- (zlib filter is unable to auto-detect gzip/zlib file headers). (Greg)
-- (Signature compatibility check broken). (Dmitry)
-- (Inconsistent behaviour of include_path set with php_value). (manuel at mausz dot at)
-- (Extending PDO class with a __call() function doesn't work). (David Soria Parra)
-- (Make FindFile use PATH_SEPARATOR instead of ";"). (Ilia)
-- (mysql extension ingores INI settings on NULL values passed to mysql_connect()). (Ilia)
-- (Workaround for a bug inside libcurl 7.16.2 that can result in a crash). (Ilia)
-- (incorrect processing of numerical string keys of array in arbitrary serialized data). (Dmitriy Buldakov, Felipe)
-- (define missing depencies of the exif extension). (crrodriguez at suse dot de)
-- (a possible infinite loop in bz2_filter.c). (Greg)
-- (removed bogus declaration of a non-existent php_is_url() function). (Ilia)
-- (array_merge_recursive() doesn't behave as expected with duplicate NULL values). (Felipe, Tony)
-- (escapeshellarg('') returns null). (Ilia)
-- (DateTime created from a timestamp reports environment timezone). (Derick)
-- (stream_get_line() eats additional characters). (Felipe, Ilia, Tony)
-- (SOAPFault HTTP Status 500 - would like to be able to set the HTTP Status). (Dmitry)
-- (Assign by reference bug). (Dmitry)
-- (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
-- (OCI8 XML/getClobVal aka temporary LOBs leak UGA memory). (Chris)
-- (array_merge_recursive() crashes with recursive arrays). (Ilia)
-- (pdo_pgsql does not send username on connect when password is not available). (Ilia)
-- (Under certain conditions, file_exists() never returns). (Dmitry)
-- (get_class_methods() does not list all visible methods). (Dmitry)
-- (array_pad() does not warn on very small pad numbers). (Ilia)
-- (Prepared statement with incorrect parms doesn't throw exception with pdo_pgsql driver). (Ilia)
-- (Memory leak on some functions with implicit object __toString() call). (David C.)
-- (array_globals not reset to 0 properly on init). (Ilia)
-- (PHP crashes with invalid argument for DateTimeZone). (Ilia)
-- (pcntl_fork() should not raise E_ERROR on error). (Ilia)
-- (recursive xincludes don't remove internal xml nodes properly). (Rob, patch from ddb@bitxtender.de)
-- (mb_ereg*_replace() crashes when replacement string is invalid PHP expression and 'e' option is used). (Jani)
-- (crash because of uninitialized SG(sapi_headers).mimetype). (Dmitry)
-- (Multiple segfaults in getopt()). (Hannes)
-- (pg_send_query_params() converts all elements in 'params' to strings). (Ilia)
-- (Incomplete fix for bug , mkdir() under safe_mode). (Ilia)
-- (backward compatibility break in realpath()). (Dmitry)
-- (SimpleXML adding default namespace in addAttribute). (Rob)
-- (stream_is_local() returns false on "file://"). (Dmitry)
-- (Crash on using uninitialized vals and __get/__set). (Dmitry)
-- (file_put_contents() LOCK_EX does not work properly on file truncation). (Ilia)
-- (__destruct() throwing an exception with __call() causes segfault). (Dmitry)
-- (Very long class name causes segfault). (Dmitry)
-- (PHP seems to fail to close open files). (Hannes)
-- (curl_copy_handle() crashes with > 32 chars long URL). (Jani)
-- (Invalid timezone reported for DateTime objects constructed using a timestamp). (Derick)
-- (mismatch between number of bound params and values causes a crash in pdo_pgsql). (Ilia)
-- (preg_split() swallows part of the string). (Nuno)
-- (__call() method not invoked when methods are called on parent from child class). (Dmitry)
-- (REF CURSOR and oci_new_cursor() crash PHP). (Chris)
-- (Wrong results in array_diff_uassoc) (Felipe)
-- (Incorrect forcing from HTTP/1.0 request to HTTP/1.1 response). (Ilia)
-- (xmlrpc_server_call_method() crashes). (Tony)
-- (Procedure 'int1' not present with doc/lit SoapServer). (Dmitry)
-- (mysqli PROCEDURE calls can't return result sets). (Hartmut)
-- (new sendmail default breaks on Netware platform) (Guenter Knauf)
-- (Implicit conversion to string leaks memory). (David C., Rob).
-- (var_export() incorrectly escapes char(0)). (Derick)
-- (Incorrect lengths for date and boolean data types). (Ilia)
-- (Constructing DateTime with TimeZone Indicator invalidates DateTimeZone). (Derick)
-- (Warning "array_merge_recursive(): recursion detected" comes again...). (Felipe)
-- (oci8 extension not lib64 savvy). (Chris)
-- (Failing to call RecursiveIteratorIterator::__construct() causes a sefault). (Etienne)
-- (setTime() fails after modify() is used). (Derick)
-- (SimpleXML memory issue). (Rob)
-- (php_uname() does not return nodename on Netware (Guenter Knauf)
-- (Unexpected creation of cycle). (Dmitry)
-- (OpenSSL stream->fd casts broken in 64-bit build) (stotty at tvnet dot hu)
-
-
-
-
-
-
-Version 5.2.5
-
-
- - Security Fixes
-
- - Fixed dl() to only accept filenames. reported by Laurent Gaffie.
- - Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
- - Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
- - Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
- - Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
- - (automatic session id insertion adds sessions id to non-local forms).
- - (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
-
-
-
-- Upgraded PCRE to version 7.3 (Nuno)
-- Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
-- Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
-- Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
-
-- Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
-
-- Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
-- Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
-- Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
-- Fixed PDO crash when driver returns empty LOB stream. (Stas)
-- Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
-- Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
-- Fixed leaks with multiple connects on one mysqli object. (Andrey)
-- Fixed endianness detection on MacOS when building universal binary. (Uwe Schindler, Christian Speich, Tony)
-- Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
-
-- (array_intersect_assoc() crashes with non-array input). (Jani)
-- (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
-- (rmdir() and rename() do not clear statcache). (Jani)
-- (Bound parameters cannot have - in their name). (Ilia)
-- (XMLWriter::endElement() does not check # of params). (Ilia)
-- (Warning message is missing with shuffle() and more than one argument). (Scott)
-- (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
-- (ext/mssql: Move *timeout initialization from RINIT to connect time). (Ilia)
-- (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
-- (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
-- ($foo = clone(array()); leaks memory). (Dmitry)
-- (clone() on a non-object does not result in a fatal error). (Ilia)
-- (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
-- (pg_insert() does not accept an empty list for insertion). (Ilia)
-- (WSDL error causes HTTP 500 Response). (Dmitry)
-- (Storing $this in a static var fails while handling a cast to string). (Dmitry)
-- (highlight_string() truncates trailing comment). (Ilia)
-- (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
-- (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
-- (PHP_SELF duplicates path). (Dmitry)
-- (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
-- (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
-- (SoapFault : Only http and https are allowed). (Bill Moran)
-- (Dynamically loaded PHP extensions need symbols exported on MacOSX). (jdolecek at NetBSD dot org)
-- (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
-- (session.save_path MODE option does not work). (Ilia)
-- (Make the engine recognize \v and \f escape sequences). (Ilia)
-- (behavior change regarding symlinked .php files). (Dmitry)
-- (apache_reset_timeout() does not exist). (Jani)
-- (ext/mysql failed to compile with libmysql 3.23). (Scott)
-- (PHP_SELF duplicates path). (Dmitry)
-- (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
-- (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
-- (Segmentation when trying to set an attribute in a DOMElement). (Rob)
-- (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
-- (PDO classes do not expose Reflection API information). (Hannes)
-- (Write lock on file_get_contents fails when using a compression stream). (Ilia)
-- (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
-- (mysqli_stmt_bind_result memory exhaustion). (Andrey)
-- (xsd:list type not parsed). (Dmitry)
-- (SoapServer crash). (Dmitry)
-- (SoapServer sends clients internal PHP errors). (Dmitry)
-- (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
-- (XMLReader option constants are broken using XML()). (Rob)
-- (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
-- (Relative includes broken when getcwd() fails). (Ab5602, Jani)
-- (proc_open() append mode doesn't work on windows). (Nuno)
-
-
-
-
-
-
-Version 5.2.4
-
-
-- Security Fixes
-
- - Fixed "Floating point exception" inside wordwrap(). (Mattias Bengtsson, Ilia)
- - Fixed several integer overflows in ImageCreate(), ImageCreateTrueColor(), ImageCopyResampled() and ImageFilledPolygon() reported by Mattias Bengtsson. (Tony)
- - Fixed size calculation in chunk_split(). (Stas)
- - Fixed integer overflow in str[c]spn(). (Stas)
- - Fixed money_format() not to accept multiple %i or %n tokens. (Stas, Ilia)
- - Fixed zend_alter_ini_entry() memory_limit interruption vulnerability. (Ilia)
- - Fixed INFILE LOCAL option handling with MySQL extensions not to be allowed when open_basedir or safe_mode is active. (Stas)
- - Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) (Stas, Maksymilian Arciemowicz)
- - Fixed possible invalid read in glob() win32 implementation (CVE-2007-3806). (Tony)
- - Improved fix for MOPB-03-2007. (Ilia)
- - Corrected fix for CVE-2007-2872. (Ilia)
-
-
-
-- Removed --enable-versioning configure option. (Jani)
-
-- Upgraded PCRE to version 7.2 (Nuno)
-- Updated timezone database to version 2007.6. (Derick)
-
-- Improved openssl_x509_parse() to return extensions in readable form. (Dmitry)
-
-- Enabled changing the size of statement cache for non-persistent OCI8 connections. (Chris Jones, Tony)
-
-- Changed display_errors php.ini option to accept stderr as value which makes the error messages to be outputted to STDERR instead of STDOUT with CGI and CLI SAPIs (). (Jani)
-- Changed error handler to send HTTP 500 instead of blank page on PHP errors. (Dmitry, Andrei Nigmatulin)
-- Changed mail() function to be always available. (Johannes)
-
-- Added check for unknown options passed to configure. (Jani)
-- Added persistent connection status checker to pdo_pgsql. (Elvis Pranskevichus, Ilia)
-- Added support for ATTR_TIMEOUT inside pdo_pgsql driver. (Ilia)
-- Added php_ini_loaded_file() function which returns the path to the actual php.ini in use. (Jani)
-- Added GD version constants GD_MAJOR_VERSION, GD_MINOR_VERSION GD_RELEASE_VERSION, GD_EXTRA_VERSION and GD_VERSION_STRING. (Pierre)
-- Added missing open_basedir checks to CGI. (anight at eyelinkmedia dot com, Tony)
-- Added missing format validator to unpack() function. (Ilia)
-- Added missing error check inside bcpowmod(). (Ilia)
-- Added CURLOPT_PRIVATE & CURLINFO_PRIVATE constants. (Andrey A. Belashkov, Tony)
-- Added missing MSG_EOR and MSG_EOF constants to sockets extension. (Jani)
-- Added PCRE_VERSION constant. (Tony)
-- Added ReflectionExtension::info() function to print the phpinfo() block for an extension. (Johannes)
-
-- (ReflectionClass::getDefaultProperties() does not handle static attributes). (Tony)
-
-- Fixed possible crash in imagepsloadfont(), work around a bug in the pslib on Windows. (Pierre)
-- Fixed oci8 and PDO_OCI extensions to allow configuring with Oracle 11g client libraries. (Chris Jones)
-- Fixed EOF handling in case of reading from file opened in write only mode. (Dmitry)
-- Fixed var_export() to use the new H modifier so that it can generate parseable PHP code for floats, independent of the locale. (Derick)
-- Fixed regression introduced by the fix for the libgd bug #74. (Pierre)
-- Fixed SimpleXML's behavior when used with empty(). (Sara)
-- Fixed crash in OpenSSL extension because of non-string passphrase. (Dmitry)
-
-- (PDO_OCI crash after National language Support "NLS" environment initialization error). (Chris Jones)
-- (crash in ZipArchive::addEmptyDir when a directory already exists). (Pierre)
-
-- (Incorrect error message displayed by pg_escape_string). (Ilia)
-- (glob() crashes and/or accepts way too many flags). (Jani)
-- (Crash when using getRealPath with DirectoryIterator). (Johannes)
-- ($PHP_CONFIG not set for phpized builds). (Jani)
-- (header wrong for date field). (roberto at spadim dot com dot br, Ilia)
-- (SimpleXMLIterator loses ancestry). (Rob)
-- (ldap_parse_result() not defined under win32). (Jani)
-- (copy() does not output an error when the first arg is a dir). (Ilia)
-- (sybase_connect() crashes). (Ilia)
-- (stream_copy_to_stream returns invalid values for mmaped streams). (andrew dot minerd at sellingsource dot com, Ilia)
-- (Problems with æøå in extract()). (Jani)
-- (possible buffer overflow in php_openssl_make_REQ). (Pierre)
-- (property_exists() fails to find protected properties from a parent class). (Dmitry)
-- (substr_replace() crashes when the same array is passed more than once). (crrodriguez at suse dot de, Ilia)
-- (SCRIPT_NAME and PHP_SELF truncated when inside a userdir and using PATH_INFO). (Dmitry)
-- (C++ compiler required always). (Jani)
-- (classmap causes crash in non-wsdl mode). (Dmitry)
-- (oci8 INTERVAL and TIMESTAMP type fixes). (Chris)
-- (__destruct functions not called after catching a SoapFault exception). (Dmitry)
-- (substr_replace() returns FALSE when length > string length). (Ilia)
-- (Second call of session_start() causes creation of SID). (Ilia)
-- (oci_error() returns false after oci_new_collection() fails). (Tony)
-- (array_push($arr,&$obj) doesn't work with zend.ze1_compatibility_mode On). (Dmitry)
-- (bzip2.compress loses data in internal buffer). (Philip, Ilia)
-- (deleting a node produces memory corruption). (Rob)
-- (sscanf broken when using %2$s format parameters). (Jani)
-- (json_decode causes segmentation fault). (Hannes)
-- (NodeList length zero should be empty). (Hannes)
-- (No warning message for clearstatcache() with arguments). (Ilia)
-- (ini scanner allows using NULL as option name). (Jani)
-- (is_file() / is_dir() matches file/dirnames with wildcard char or trailing slash in Windows). (Dmitry)
-- (configure option --with-adabas=DIR does not work). (Jani)
-- (ldap_rename(): server error "DSA is unwilling to perform"). (bob at mroczka dot com, Jani)
-- (is_a() and is_subclass_of() should NOT call autoload, in the same way as "instanceof" operator). (Dmitry)
-- (move_uploaded_file() & relative path in ZTS mode). (Tony)
-- (Hangs on large SoapClient requests). (Dmitry)
-- (Error Fetching http headers terminated by '\n'). (Dmitry)
-- (--with-ldap=shared fails with LDFLAGS="-Wl,--as-needed"). (Nuno)
-- (PDOStatement::fetch and PDOStatement::setFetchMode causes unexpected behavior). (Ilia)
-- (strtotime returns a timestamp for non-time string of pattern '(A|a) .+'). (Derick)
-- (Ensure search for hidden private methods does not stray from class hierarchy). (robin_fernandes at uk dot ibm dot com)
-- (SimpleXML incorrectly registers empty strings as namespaces). (Rob)
-- (Foreach on object does not iterate over all visible properties). (Dmitry)
-- (crash in string to array conversion). (judas dot iscariote at gmail dot com, Ilia)
-- (var_export() is locale sensitive when exporting float values). (Derick)
-- (CFLAGS="-Os" ./configure --enable-debug fails). (christian at hoffie dot info, Tony)
-- (proc_open(): empty env array should cause empty environment to be passed to process). (Jani)
-- (SimpleXML: getName is broken). (Rob)
-- (fputcsv(): 2nd parameter is not optional). (Jani)
-- (SimpleXML: getNamespaces() returns the namespaces of a node's siblings). (Rob)
-- (pgsql extension does not compile with PostgreSQL <7.4). (Ilia)
-- (Format returns incorrect number of digits for negative years -0001 to -0999). (Derick)
-- (Cannot create years < 0100 & negative years with date_create or new DateTime). (Derick)
-- (addChild() on a non-existent node, no node created, getName() segfaults). (Rob)
-- (pdo_sqlite prepared statements convert resources to strings). (Ilia)
-- (Concurrent read/write fails when EOF is reached). (Sascha)
-- (segmentation fault when using string offset as an object). (judas dot iscariote at gmail dot com, Tony)
-- (checkdnsrr does not support DNS_TXT type). (lucas at facebook dot com, Tony)
-- (php_strip_whitespace() sends headers with errors suppressed). (Tony)
-- (SSL: fatal protocol error due to buffer issues). (Ilia)
-- (Recode crashes/does not work on amd64). (nexus at smoula dot net, Stas)
-- (libxml_get_last_error() - errors service request scope). (thekid at php dot net, Ilia)
-- (imagepolygon does not respect thickness). (Pierre)
-- (Persistent memory consumption on win32 since 5.2). (Dmitry)
-- (NULL temporary lobs not supported in OCI8). (Chris Jones, Tony)
-- (strtotime() does not handle 00.00.0000). (Derick)
-- (float parameters truncated to integer in prepared statements). (Ilia)
-- (ArrayObject shows weird behavior in respect to inheritance). (Tony)
-- (ArrayObject::exchangeArray hangs Apache). (Tony)
-- (Omitting length param in array_slice not possible). (Ilia)
-- (array_push() fails to warn when next index is already occupied). (Ilia)
-- (open_basedir bypass via glob()). (Ilia)
-- (get_class_vars produces error on class constants). (Johannes)
-- (SoapServer and zlib.output_compression with FastCGI result in major slowdown). (Dmitry)
-- (Crash instantiating classes with self-referencing constants). (Dmitry)
-- (segfault when an invalid color index is present in the image data). (Reported by Elliot wccoder@gmail dot com) (Pierre)
-- (PHP settings leak between Virtual Hosts in Apache 1.3). (Scott, manuel at mausz dot at)
-- (segfault on a weird code with objects and switch()). (Tony)
-- (url rewriter tags doesn't work with namespaced tags). (Ilia)
-- (Fixed a crash inside pdo_pgsql on some non-well-formed SQL queries). (Ilia)
-- (OCI8 statement cache is flushed too frequently). (Tony)
-- (SimpleXML crashes when accessing newly created element). (Tony)
-- (configure failure when using --without-apxs or some other SAPIs disabling options). (Jani)
-- (json_encode() double conversion is inconsistent with PHP). (Lucas, Ilia)
-- (SOAP Server not properly generating href attributes). (Dmitry)
-- (configure failure: regression caused by fix for ). (Jani)
-- (WDDX deserialize numeric string array key). (Matt, Ilia)
-- (strtotime('0000-00-00 00:00:00') is parsed as 1999-11-30). (Derick)
-- (file_exists() warns of open_basedir restriction on non-existent file). (Tony)
-- (parse_ini_file() has a problem with certain types of integer as sections). (Tony)
-- (DBA: configure fails to include correct db.h for db4). (Jani)
-- (Internal pointer of source array resets during array copying). (Dmitry)
-- (my_thread_global_end() error during request shutdown on Windows). (Scott, Andrey)
-- (get_loaded_extensions() should list Zend extensions). (Johannes)
-- (Memory leak in ldap_{first|next}_attribute functions). (Jani)
-- (get_object_vars get nothing in child class). (Dmitry)
-- (Iterating within function moves original array pointer). (Dmitry)
-- (key() function changed behaviour if global array is used within function). (Dmitry)
-- (Trailing slash in CGI request does not work). (Dmitry)
-- (apache2handler does not call shutdown actions before apache child die). (isk at ecommerce dot com, Gopal, Tony)
-- (ldap_sasl_bind() misses the sasl_authc_id parameter). (diafour at gmail dot com, Jani)
-- (array pointers resetting on copy). (Dmitry)
-- (Symlinks and mod_files session handler allow open_basedir bypass). (Ilia)
-- (Userfilters can leak buckets). (Sara)
-- Fixed bugs , , (stream_set_blocking() does not work). (Jani)
-- (pdo-pgsql should not use pkg-config when not present). (Jani)
-- (PHP_SELF incorrect without cgi.fix_pathinfo, but turning on screws up PATH_INFO). (Dmitry)
-- (socket_read() outputs error with PHP_NORMAL_READ). (Nuno, Jani)
-
-
-
-
-
-
-Version 5.2.3
-
-
-- Security Fixes
-
- - Fixed an integer overflow inside chunk_split() (by Gerhard Wagner, CVE-2007-2872)
- - Fixed possible infinite loop in imagecreatefrompng. (by Xavier Roche, CVE-2007-2756)
- - Fixed ext/filter Email Validation Vulnerability (MOPB-45 by Stefan Esser, CVE-2007-1900)
- - (open_basedir/safe_mode bypass inside realpath()) (by bugs dot php dot net at chsc dot dk)
- - Improved fix for CVE-2007-1887 to work with non-bundled sqlite2 lib.
- - Added mysql_set_charset() to allow runtime altering of connection encoding.
-
-
-
-- Changed CGI install target to php-cgi and 'make install' to install CLI when CGI is selected. (Jani)
-- Changed JSON maximum nesting depth from 20 to 128. (Rasmus)
-
-- Improved compilation of heredocs and interpolated strings. (Matt, Dmitry)
-- Optimized out a couple of per-request syscalls. (Rasmus)
-- Optimized digest generation in md5() and sha1() functions. (Ilia)
-- Upgraded bundled SQLite 3 to version 3.3.17. (Ilia)
-
-- Added "max_input_nesting_level" php.ini option to limit nesting level of input variables. Fix for MOPB-03-2007. (Stas)
-- Added a 4th parameter flag to htmlspecialchars() and htmlentities() that makes the function not encode existing html entities. (Ilia)
-- Added PDO::FETCH_KEY_PAIR mode that will fetch a 2 column result set into an associated array. (Ilia)
-- Added CURLOPT_TIMEOUT_MS and CURLOPT_CONNECTTIMEOUT_MS cURL constants. (Sara)
-- Added --ini switch to CLI that prints out configuration file names. (Marcus)
-
-- (getColumnMeta() should also return table name). (Tony)
-
-- Fixed filetype() and linkinfo() processing of symlinks on ZTS systems. (Oliver Block, Tony, Dmitry)
-- Fixed SOAP extension's handler() to work even when "always_populate_raw_post_data" is off. (Ilia)
-- Fixed altering $this via argument named "this". (Dmitry)
-- Fixed PHP CLI usage of php.ini from the binary location. (Hannes)
-- Fixed segfault in strripos(). (Tony, Joxean Koret)
-- Fixed gd build when used with freetype 1.x (Pierre, Tony)
-- (ReflectionParameter::getPosition() not available). (Marcus)
-- (Compile failure under IRIX 6.5.30 building md5.c). (Jani)
-- (json_decode() incorrectly decodes JSON arrays with empty string keys). (Ilia)
-- (no arginfo about SoapClient::__soapCall()). (Ilia)
-- (ext/dba/config.m4 pollutes global $LIBS and $LDFLAGS). (mmarek at suse dot cz, Tony)
-- (imagegd2() under output control). (Tony)
-- (Fatal error with negative values of maxlen parameter of file_get_contents()). (Tony)
-- (PHP assumes wrongly that certain ciphers are enabled in OpenSSL). (Pierre)
-- (Uncaught exception from a stream wrapper segfaults). (Tony, Dmitry)
-- (json_decode cannot decode floats if localeconv decimal_point is not '.'). (Tony)
-- (wrong unary operator precedence). (Stas)
-- (dbase_create creates file with corrupted header). (Tony)
-- (Clarify error message with invalid protocol scheme). (Scott)
-- (fastcgi protocol lacks support for Reason-Phrase in "Status:" header). (anight at eyelinkmedia dot com, Dmitry)
-- (whole text concats values of wrong nodes). (Rob)
-- (configure cannot determine SSL lib with libcurl >= 7.16.2). (Mike)
-- (crash in openssl_pkcs12_read() on invalid input). (Ilia)
-- (Invalid opcode with foreach ($a[] as $b)). (Dmitry, Tony)
-- (checkdnsrr() segfaults on empty hostname). (Scott)
-- (WSDL parsing doesn't ignore non soap bindings). (Dmitry)
-- (Writing empty tags with Xmlwriter::WriteElement[ns]) (Pierre)
-- (downgrade read errors in getimagesize() to E_NOTICE). (Ilia)
-- (compress.zlib temp files left). (Dmitry)
-- (Fixed creation of HTTP_RAW_POST_DATA when there is no default post handler). (Ilia)
-- (FastCGI does not set SO_REUSEADDR). (fmajid at kefta dot com, Dmitry)
-- (Namespace functions don't allow xmlns definition to be optional). (Rob)
-- (Bug with deserializing array key that are doubles or floats in wddx). (Ilia)
-- (lookupNamespaceURI does not work as expected). (Rob)
-- (Regression in timeout handling of non-blocking SSL connections during reads and writes). (Ilia)
-- (zend_ts_hash_clean not thread-safe). (marco dot cova at gmail dot com, Tony)
-- (ext/soap returning associative array as indexed without using WSDL). (Dmitry)
-- (minOccurs="0" and null class member variable). (Dmitry)
-- (Behavior of require/include different to < 5.2.0). (Dmitry)
-
-
-
-
-
-
-
-Version 5.2.2
-
-
-- Security Fixes
-
- - Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric) (Pierre)
- - Fixed a header injection via Subject and To parameters to the mail() function (MOPB-34 by Stefan Esser) (Ilia)
- - Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser) (Ilia)
- - Fixed wrong length calculation in unserialize S type (MOPB-29 by Stefan Esser) (Stas)
- - Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser) (Ilia)
- - Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser) (Stas)
- - Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser) (Ilia)
- - Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-20, MOPB-21 by Stefan Esser). (Ilia)
- - Fixed substr_compare and substr_count information leak (MOPB-14 by Stefan Esser) (Stas, Ilia)
- - Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser) (Stas)
- - Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team) (Ilia)
- - Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Stefan Esser) (Ilia)
- - Fixed a remotely trigger-able buffer overflow inside make_http_soap_request(). (Ilia)
- - Fixed a buffer overflow inside user_filter_factory_create(). (Ilia)
- - Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (Stas)
-
-
-
-- Improved bundled GD
-
- - Sync to 2.0.35
- - Added imagegrabwindow and imagegrabscreen, capture a screen or a window using its handle (Pierre)
- - colors allocated henceforth from the resulting image overwrite the palette colors (Rob Leslie)
- - Improved thread safety of the gif support (Roman Nemecek, Nuno, Pierre)
-
- - Use the dimension of the GIF frame to create the destination image (Pierre)
- - Load only once the local color map from a GIF data (Pierre)
-
-
-
-
-- Improved thread safety of the freetype cache (Scott MacVicar, Nuno, Pierre)
-
- - imagearc huge CPU usage with large angles, libgd bug #74 (Pierre)
-
-
-- Improved FastCGI SAPI to support external pipe and socket servers on win32. (Dmitry)
-- Improved Zend Memory Manager
-
- - guarantee of reasonable time for worst cases of best-fit free block searching algorithm. (Dmitry)
- - better cache usage and less fragmentation on erealloc() (Tony, Dmitry)
-
-
-- Improved SPL (Marcus)
-
- - Added SplFileInfo::getBasename(), DirectoryIterator::getBasename().
- - Added SplFileInfo::getLinkTarget(), SplFileInfo::getRealPath().
- - Made RecursiveFilterIterator::accept() abstract as stated in documentation.
-
-
-- Improved SOAP
-
- - Added ability to encode arrays with "SOAP-ENC:Array" type instead of WSDL type. To activate the ability use "feature"=>SOAP_USE_XSI_ARRAY_TYPE option in SoapClient/SoapServer constructors. (Rob, Dmitry)
-
-
-- Added GMP_VERSION constant. (Tony)
-- Added --ri switch to CLI which allows to check extension information. (Marcus)
-- Added tidyNode::getParent() method (John, Nuno)
-- Added openbasedir and safemode checks in zip:// stream wrapper and ZipArchive::open (Pierre)
-- Added php_pdo_sqlite_external.dll, a version of the PDO SQLite driver that links against an external sqlite3.dll. This provides Windows users to upgrade their sqlite3 version outside of the PHP release cycle. (Wez, Edin)
-- Added linenumbers to array returned by token_get_all(). (Johannes)
-
-- , allow a single filter as argument for filter_var_array (Pierre)
-- (openssl PKCS#12 support) (Marc Delling, Pierre)
-
-- Upgraded SQLite 3 to version 3.3.16 (Ilia)
-- Upgraded libraries bundled in the Windows distribution. (Edin)
-
- - c-client (imap) to version 2006e
- - libpq (PostgreSQL) to version 8.2.3
- - libmysql (MySQL) to version 5.0.37
- - openssl to version 0.9.8e
-
-
-- Upgraded PCRE to version 7.0 (Nuno)
-- Updated timezone database to version 2007.5. (Derick)
-
-- Fixed commandline handling for CLI and CGI. (Marcus, Johannes)
-- Fixed iterator_apply() with a callback using __call(). (Johannes)
-- Fixed possible multi bytes issues in openssl csr parser (Pierre)
-- Fixed shmop_open() with IPC_CREAT|IPC_EXCL flags on Windows. (Vladimir Kamaev, Tony).
-- Fixed possible leak in ZipArchive::extractTo when safemode checks fails (Ilia)
-- Fixed possible relative path issues in zip_open and TS mode (old API) (Pierre)
-- Fixed zend_llist_remove_tail (Michael Wallner, Dmitry)
-- Fixed a thread safety issue in gd gif read code (Nuno, Roman Nemecek)
-- Fixed crash on op-assign where argument is string offset (Brian, Stas)
-
-
-- (setAttribute return code reversed). (Ilia)
-- (Per Directory Values only work for one key). (Dmitry)
-- (addAttribute() fails to add an attribute with an empty value). (Ilia)
-- (mysql_pconnect() hash does not account for connect flags). (Ilia)
-- (range() overflow handling for large numbers on 32bit machines). (Ilia)
-- (PHP does not handle overflow of octal integers). (Tony)
-- (recursiveiterator.inc says "implements" Iterator instead of "extends"). (Marcus)
-- (TTF usage doesn't work properly under Netware). (Scott, gk at gknw dot de)
-- (magic_quotes_gpc ignores first arrays keys). (Arpad, Ilia)
-- (memleak when creating default object caused exception). (Dmitry)
-- (json_encode() problem with UTF-16 input). (jp at df5ea dot net. Ilia)
-- (chdir doesn't like root paths). (Dmitry)
-- ("visibility error" in ReflectionFunction::export()). (Johannes)
-- (pdo_oci crash when freeing error text with persistent connection). (Tony)
-- (unregister_tick_function() inside the tick function crash PHP). (Tony)
-- (json_encode() ignores null byte started keys in arrays). (Ilia)
-- (segfault when calling "self::method()" in shutdown functions). (Tony)
-- (mcrypt_create_iv() not using random seed). (Ilia)
-- (long session array keys are truncated). (Tony)
-- (pdo_mysql does not raise an exception on empty fetchAll()). (Ilia)
-- (open_basedir bypass via symlink and move_uploaded_file()). (Tony)
-- (php_default_post_reader crashes when post_max_size is exceeded). (trickie at gmail dot com, Ilia)
-- (addcslashes unexpected behavior with binary input). (Tony)
-- (memory leak when nesting list()). (Dmitry)
-- (error_log file not locked). (Ilia)
-- (mysql_query() is allocating memory incorrectly). (Tony)
-- (inconsistency in offsetSet, offsetExists treatment of string enclosed integers). (Marcus)
-- (strtotime() doesn't handle double negative relative time units correctly). (Derick, Ilia)
-- (imap_mail_compose() creates an invalid terminator for multipart e-mails). (Ilia)
-- (sorting issue on 64-bit Solaris). (Wez)
-- (Segfault in ext/dom). (Rob)
-- (Crash when using unset() on an ArrayAccess object retrieved via __get()). (Dmitry)
-- (pdo_mysql does not return rowCount() on select). (Ilia)
-- (using strings like "class::func" and static methods in set_exception_handler() might result in crash). (Tony)
-- (Poor performance of ".="). (Dmitry)
-- (Failure executing function ibase_execute()). (Tony)
-- (cannot disable memory_limit with -1). (Dmitry, Tony)
-- (ReflectionObject::getValues() may crash when used with dynamic properties). (Tony)
-- (Case sensitivity in constructor's fallback). (Tony)
-- (Apache child exits when PHP memory limit reached). (Dmitry)
-- (line thickness not respected for horizontal and vertical lines). (Pierre)
-- (Test fcgi_is_fastcgi() is wrong on windows). (Dmitry)
-- (added substr() & substr_replace() overflow checks). (Ilia)
-- (parse_ini_file() segfaults when a scalar setting is redeclared as an array). (Tony)
-- (openssl stream wrapper ignores default_stream_timeout). (Tony)
-- (segfault in PDO when failed to bind parameters). (Tony)
-- (array_reduce() behaves strange with one item stored arrays). (Ilia)
-- (Resolved a possible namespace conflict between libxmlrpc and MySQL's NDB table handler). (Ilia)
-- (Incorrect results of DateTime equality check). (Mike)
-- (Cross compilation fails). (Tony)
-- (Crash when constructor called inappropriately). (Tony)
-- (Segfaults when using more than one SoapVar in a request). (Rob, Dmitry)
-- (umask is not being restored when request is finished). (Tony)
-- (libxml segfault). (Rob)
-- (list()="string"; gives invalid opcode). (Dmitry)
-- (imagettftext() multithreading issue). (Tony, Pierre)
-- (double values are truncated to 6 decimal digits when encoding). (Tony)
-- (DIR functions do not work on root UNC path). (Dmitry)
-- (SplFileInfo::getOwner/getGroup give a warning on broken symlink). (Marcus)
-- (SplFileInfo::getPathInfo() throws an exception if directory is in root dir). (Marcus)
-- (multithreading issue in zend_strtod()). (Tony)
-- (json_encode() value corruption on 32bit systems with overflown values). (Ilia)
-- (Partial SOAP request sent when XSD sequence or choice include minOccurs=0). (Dmitry)
-- (Ensure that all PHP elements are printed by var_dump). (wharmby at uk dot ibm dot com, Ilia)
-- (session.save_path wont use default-value when safe_mode or open_basedir is enabled). (Ilia)
-- (proc_open() uses wrong command line when safe_mode_exec_dir is set). (Tony)
-- (strip_tags() fails with greater than in attribute). (Ilia)
-- (dynamic properties may cause crash in ReflectionProperty methods). (Tony)
-- (addAttribute() may crash when used with non-existent child node). (Tony)
-- (ArrayObject::offsetExists broke in 5.2.1, works in 5.2.0). (olivier at elma dot fr, Marcus)
-- (imagepstext() doesn't accept optional parameter). (Pierre)
-- (Allow multiple instances of the same named PDO token in prepared statement emulation code). (Ilia)
-- (possible endless fork() loop when running fastcgi). (Dmitry)
-- (ext/posix does not compile on MacOS 10.3.9). (Tony)
-- (memory leaks in PHP milter SAPI). (tuxracer69 at gmail dot com, Tony)
-- (pg_client_encoding() not working on Windows). (Edin)
-- (FCGI_WEB_SERVER_ADDRS function get lost). (Dmitry)
-- (strtotime() returns unexpected result with particular timezone offset). (Derick)
-- (PHP fastcgi with PHP_FCGI_CHILDREN don't kill children when parent is killed). (Dmitry)
-- (Extremely slow data handling due to memory fragmentation). (Dmitry)
-- (php -a function allocation eats memory). (Dmitry)
-- (iptcembed fails on non-jfif jpegs). (Tony)
-- (Latitude and longitude are backwards in date_sun_info()). (Derick)
-- (SplObjectStorage empty after unserialize). (Marcus)
-- (Milliseconds in date()). (Derick)
-- (stream_set_blocking crashes on Win32). (Ilia, maurice at iceblog dot de)
-- (relative include fails on Solaris). (Dmitry, Tony)
-- (proc_terminate() destroys process resource). (Nuno)
-- (crash when assigning objects to SimpleXML attributes). (Tony)
-- (ftp_ssl_connect() falls back to non-ssl connection). (Nuno)
-- (SSL support in imap_open() not working on Windows). (Edin)
-- (Inconsistent handling when passing nillable arrays). (Dmitry)
-- (Avoid crash caused by object store being referenced during RSHUTDOWN). (Andy)
-- (proc_close() hangs when used with two processes). (jdolecek at netbsd dot org, Nuno)
-- (data leakage because of nonexisting boundary checking in statements in mysqli) (Stas)
-- (autocreating element doesn't assign value to first node). (Rob)
-- (server hangs when returning circular object references). (Dmitry)
-- Console window appears when using exec() (Richard Quadling, Stas)
-- (crash in Oracle client when memory limit reached in the callback). (Tony)
-
-
-
-
-
-Version 5.2.1
-
-
-- Added CURLOPT_TCP_NODELAY constant to Curl extension. (Sara)
-- Added support for hex numbers of any size. (Matt)
-- Added function stream_socket_shutdown(). It is a wrapper for system shutdown() function, that shut downs part of a full-duplex connection. (Dmitry)
-- Added internal heap protection (Dmitry)
-
- - memory-limit is always enabled (--enable-memory-limit removed)
- - default value if memory-limit is set to 128M
- - safe unlinking
- - cookies
- - canary protection (debug build only)
- - random generation of cookies and canaries
-
-
-- Added forward support for 'b' prefix in front of string literals. (Andrei)
-- Added three new functions to ext/xmlwriter (Rob, Ilia)
-
- - xmlwriter_start_dtd_entity()
- - xmlwriter_end_dtd_entity()
- - xmlwriter_write_dtd_entity()
-
-
-- Added a meta tag to phpinfo() output to prevent search engines from indexing the page. (Ilia)
-- Added new function, sys_get_temp_dir(). (Hartmut)
-- Added missing object support to file_put_contents(). (Ilia)
-- Added support for md2, ripemd256 and ripemd320 algos to hash(). (Sara)
-- Added forward support for (binary) cast. (Derick)
-- Added optimization for imageline with horizontal and vertical lines (Pierre)
-
-- Removed dependency from SHELL32.DLL. (Dmitry)
-- Removed double "wrong parameter count" warnings in various functions. (Hannes)
-- Moved extensions to PECL:
-
- - ext/informix (Derick, Tony)
-
-
-- Changed double-to-string utilities to use BSD implementation. (Dmitry, Tony)
-- Updated bundled libcURL to version 7.16.0 in the Windows distro. (Edin)
-- Updated timezone database to version 2006.16. (Derick)
-- cgi.* and fastcgi.* directives are moved to INI subsystem. The new directive cgi.check_shebang_line can be used to omitting check for "#! /usr/bin/php" line. (Dmitry).
-- Improved proc_open(). Now on Windows it can run external commands not through CMD.EXE. (Dmitry)
-- VCWD_REALPATH() is improved to use realpath cache without VIRTUAL_DIR. (Dmitry)
-- ext/bcmath initialization code is moved from request startup to module startup. (Dmitry)
-- Zend Memory Manager Improvements (Dmitry)
-
- - use HeapAlloc() instead of VirtualAlloc()
- - use "win32" storage manager (instead of "malloc") on Windows by default
-
-
-- Zip Extension Improvements (Pierre)
-
- - Fixed leak in statName and stateIndex
- - Fixed return setComment (Hannes)
- - Added addEmptyDir method
-
-
-- Filter Extension Improvements (Ilia, Pierre)
-
- - Fixed a bug when callback function returns a non-modified value.
- - Added filter support for $_SERVER in cgi/apache2 sapis.
- - Make sure PHP_SELF is filtered in Apache 1 sapi.
- - (INSTALL_HEADERS contains incorrect reference to php_filter.h).
- - Added "default" option that allows a default value to be set for an invalid or missing value.
- - Invalid filters fails instead of returning unsafe value
- - Fixed possible double encoding problem with sanitizing filters
- - Make use of space-strict strip_tags() function
- - Fixed whitespace trimming
- - Added support for FastCGI environment variables. (Dmitry)
-
-
-- PDO_MySQL Extension Improvements (Ilia)
-
- - Enabled buffered queries by default.
- - Enabled prepared statement emulation by default.
-
-
-
-- Small optimization of the date() function. (Matt,Ilia)
-- Optimized the internal is_numeric_string() function. (Matt,Ilia)
-- Optimized array functions utilizing php_splice(). (Ilia)
-- Windows related optimizations (Dmitry, Stas)
-
- - COM initialization/deinitialization are done only if necessary
- - removed unnecessary checks for ISREG file and corresponding stat() calls
- - opendir() is reimplementation using GetFirstFile/GetNextFile those are faster then _findfirst/_findnext
- - implemented registry cache that prevent registry lookup on each request. In case of modification of corresponding registry-tree PHP will reload it automatic
- - start timeout thread only if necessary
- - stat() is reimplementation using GetFileAttributesEx(). The new implementation is faster then implementation in MS VC CRT, but it doesn't support Windows 95.
-
-
-- Streams optimization (Dmitry)
-
- - removed unnecessary ftell() calls (one call for each included PHP file)
- - disabled calls to read() after EOF
-
-
-
-- Fixed incorrect function names on FreeBSD where inet_pton() was named __inet_pton() and inet_ntop() was named __inet_ntop(). (Hannes)
-- Fixed FastCGI impersonation for persistent connections on Windows. (Dmitry)
-- Fixed wrong signature initialization in imagepng (Takeshi Abe)
-- Fixed ftruncate() with negative size on FreeBSD. (Hannes)
-- Fixed segfault in RegexIterator when given invalid regex. (Hannes)
-- Fixed segfault in SplFileObject->openFile()->getPathname(). (Hannes)
-- Fixed segfault in ZTS mode when OCI8 statements containing sub-statements are destroyed in wrong order. (Tony)
-- Fixed the validate email filter so that the letter "v" can also be used in the user part of the email address. (Derick)
-- (compile failure in ZTS mode when collections support is missing). (Tony)
-- (The PDO prepare parser goes into an infinite loop in some instances). (Ilia)
-- (Sessions fail with numeric root keys). (Ilia)
-- (ob_start call many times - memory error). (Dmitry)
-- (file_exists incorrectly reports false). (Dmitry)
-- (ZipArchive::extractTo does create empty directories recursively). (Pierre)
-- (The FastCgi version has different realpath results than thread safe version). (Dmitry)
-- (use of array_unique() with objects triggers segfault). (Tony)
-- (possible endless loop in zlib.inflate stream filter). (Greg, Tony)
-- (CURLOPT_TCP_NODELAY only available in curl >= 7.11.2). (Tony)
-- (iconv extension doesn't compile with CodeWarrior on Netware). (gk at gknw dot de, Tony)
-- (apache2handler doesn't compile on Netware). (gk at gknw dot de)
-- (PDO_DBLIB driver wont free statements). (Ilia)
-- (php_fopen_primary_script() not thread safe). (Ilia)
-- (chroot() doesn't clear realpath cache). (Dmitry)
-- (spl_autoload_register with 2 instances of the same class). (Ilia)
-- (milter SAPI functions always return false/null). (Tony)
-- (php_get_current_user() not thread safe). (Ilia, wharmby at uk dot ibm dot com)
-- (ORA-01405 when fetching NULL values using oci_bind_array_by_name()). (Tony)
-- (zend_alloc.c: Value of enumeration constant must be in range of signed integer). (Dmitry)
-- (exif_read_data dies on certain images). (Tony, Marcus)
-- (empty() does not work correctly with ArrayObject when using ARRAY_AS_PROPS). (Ilia)
-- (php_date.c doesn't compile on Netware). (gk at gknw dot de, Derick)
-- (http_build_query(array()) returns NULL). (Ilia)
-- (Try/Catch performs poorly). (Dmitry)
-- (tr_TR.UTF-8 locale has problems with PHP). (Ilia)
-- (Cannot "foreach" over overloaded properties). (Dmitry)
-- (type argument of oci_define_by_name() is ignored). (Chris Jones, Tony)
-- (redirect response code in header() could be ignored in CGI sapi). (Ilia)
-- (PGSQL_CONNECT_FORCE_NEW will causes next connect to establish a new connection). (Ilia)
-- (pg_insert/pg_update do not allow now() to be used for timestamp fields). (Ilia)
-- (ini setting short_open_tag has no effect when using --enable-maintainer-zts). (Dmitry)
-- (zip ignoring --with-libdir on zlib checks) (judas dot iscariote at gmail dot com)
-- (References broken). (Dmitry)
-- (Extensions tidy,mcrypt,mhash,pdo_sqlite ignores --with-libdir). (judas dot iscariote at gmail dot com, Derick)
-- (Notice message when executing __halt_compiler() more than once). (Tony)
-- (FILTER_VALIDATE_URL validates \r\n\t etc). (Ilia)
-- (using autoconf 2.6x and --with-layout=GNU breaks PEAR install path). (Tony)
-- (ReflectionParameter::getClass() throws exception for type hint self). (thekid at php dot net)
-- (CURL doesn't compile on Sun Studio Pro). (Ilia)
-- (number_format() breaks with locale & decimal points). (Ilia)
-- (safe_read does not initialize errno). (michiel at boland dot org, Dmitry)
-- (SplFileObject throws contradictory/wrong error messages when trying to open "php://wrong"). (Tony)
-- (Invalid IPv4 treated as valid). (Ilia)
-- (Persistent connections generate a warning in pdo_pgsql). (Ilia)
-- (SOAP Server: parameter not matching the WSDL specified type are set to 0). (Dmitry)
-- (foreach produces memory error). (Dmitry)
-- (apxs2filter ignores httpd.conf & .htaccess php config settings). (Ilia)
-- (SOAP double encoding is not locale-independent). (Dmitry)
-- (virtual() does not reset changed INI settings). (Ilia)
-- (build fails on AIX because crypt_r() uses different data struct). (Tony)
-- (Crash in strtotime() on overly long relative date multipliers). (Ilia)
-- (PHP doesn't work with Apache 2.3). (mv at binarysec dot com).
-- (setTime() on a DateTime constructed with a Weekday yields incorrect results). (Ilia)
-- (PNG image with CRC/data error raises fatal error) (Pierre)
-- (Enable AUTH PLAIN mechanism in underlying libc-client). (michael dot heimpold at s2000 dot tu-chemnitz dot de, Ilia)
-- ("Indirect modification ..." message is not shown). (Dmitry)
-- (magic quotes are applied twice by ext/filter in parse_str()). (Ilia)
-- (cloning fails on nested SimpleXML-Object). (Rob)
-- (Can't use stored procedures fetching multiple result sets in pdo_mysql). (Ilia)
-- (Some POSIX extension functions not thread safe). (Ilia, wharmby at uk dot ibm dot com)
-- (putenv crash on Windows). (KevinJohnHoffman at gmail.com)
-- (oci_bind_array_by_name doesn't work on Solaris 64bit). (Tony)
-- (Broken build due to spl/filter usage of pcre extension). (Tony, Ilia)
-- (possible crash if assert.callback is set in ini). (Ilia)
-- (php crashes in the allocator on linux-m68k). (Dmitry)
-- (iconv() - undefined function). (Hannes)
-- (file_get_contents causes bus error on certain offsets). (Tony)
-- (Memory leak in pg_get_notify() and a possible memory corruption on Windows in pgsql and pdo_pgsql extensions). (Ilia, matteo at beccati dot com)
-- (Segfault when calling asXML() of a cloned SimpleXMLElement). (Rob, Tony)
-- (crash when calling fetch() on a PDO statment object after closeCursor()). (Ilia, Tony)
-- (ext/dba doesn't check for db-4.5 and db-4.4 when db4 support is enabled). (Tony)
-- (Wrong negative results from memory_get_usage()). (Dmitry)
-- (Implementation of PHP functions chown() and chgrp() are not thread safe). (Ilia, wharmby at uk dot ibm dot com)
-- (Segfault with "Allowed memory size exhausted"). (Dmitry)
-- (Apache crashes on importStylesheet call). (Rob)
-- (thread safety fixes on *nix for putenv() & mime_magic). (Ilia, wharmby at uk dot ibm dot com)
-- (str_replace() is not binary safe on strings with equal length). (Tony)
-- (Possible segfault in imap initialization due to missing module dependency). (wharmby at uk dot ibm dot com, Tony)
-- (Use of com.typelib_file in PHP.ini STILL causes A/V). (Rob)
-- (Invalid session.save_handler crashes PHP). (Dmitry)
-- (Creating Variant of type VT_ARRAY). (Rob)
-- (ftp_put() does not change transfer mode to ASCII). (Tony)
-- (array_walk() doesn't separate user data zval). (Tony)
-- (move_uploaded_file() no longer working (safe mode related)). (Tony)
-- (timeout ssl:// connections). (Ilia)
-- (PDO::errorInfo() returns inconsistent information when sqlite3_step() fails). (Tony)
-- (ZMSG_LOG_SCRIPT_NAME not routed to OutputDebugString() on Windows). (Dmitry)
-- (fgetcsv can't handle starting newlines and trailing odd number of backslashes). (David Soria Parra, Pierre)
-- (Error in maths to calculate of ZEND_MM_ALIGNED_MIN_HEADER_SIZE). (wharmby at uk dot ibm dot com, Dmitry)
-- (Failure to retrieve results when multiple unbuffered, prepared statements are used in pdo_mysql). (Ilia)
-- (imagefill crashes with small images 3 pixels or less). (Pierre)
-- (Archive corrupt with ZipArchive::addFile method). (Pierre)
-- (xmlwriter_write_dtd_entity() creates Attlist tag, not entity). (Hannes)
-- (Problem with handling of \ char in prepared statements). (Ilia, suhachov at gmail dot com)
-- (ftp_nlist() returns false on empty dirs). (Nuno)
-- (Returning a SOAP array segfaults PHP). (Dmitry)
-- (getenv() fills other super-globals). (Ilia, Tony)
-- (Overloaded array properties do not work correctly). (Dmitry)
-- (Calling debug_backtrace() in the __toString() function produces a crash). (Dmitry)
-- (Fatal error: Out of memory). (Dmitry)
-- ('foo' instanceof bar gives invalid opcode error). (Sara)
-- (Syntax error while compiling with Sun Workshop Complier). (Johannes)
-- (Booleans are not automatically translated to integers). (Ilia)
-- (Missing check for older variants of openssl). (Ilia)
-- (clearstatcache() doesn't clear realpath cache). (j at pureftpd dot org, Dmitry)
-- (imagerotate does not use alpha with angle > 45 degrees) (Pierre)
-- (Removed warning on empty haystack inside mb_strstr()). (Ilia)
-- (Added an option to imap_open/imap_reopen to control the number of connection retries). (Ilia)
-- Fixed bugs , (mbstring function overloading problem). (Seiji)
-- (Allow building of curl extension against libcurl 7.16.0). (Ilia)
-- (crash with implode("\n", array(false))). (Ilia)
-- (Unnecessary calls to OnModify callback routine for an extension INI directive). (wharmby at uk dot ibm dot com, Dmitry)
-- (ZEND_HASH_APPLY_STOP causes deletion). (Marcus)
-- (spl_autoload triggers Fatal error). (Marcus)
-- (make install fails if wget is not available). (Tony)
-- (Memory corruption because of indirect modification of overloaded array). (Dmitry)
-- (misleading error message when invalid dimensions are given) (Pierre)
-- (imagecopyresized may ignore alpha channel) (Pierre)
-- (Fixed path handling inside mod_files.sh). (michal dot taborsky at gmail dot com, Ilia)
-- (serialNumber might be -1 when the value is too large). (Pierre, Tony)
-- (Inappropriate close of stdin/stdout/stderr). (Wez, Ilia)
-- (Possible crash in Apache 2 with 413 ErrorHandler). (Ilia)
-- (Parse error in recursiveiteratoriterator.php). (Marcus)
-- (Incorrect return array handling in non-wsdl soap client). (Dmitry)
-- (DirectoryFilterDots doxygen docs and example is wrong). (Marcus)
-- (XML-RPC Breaks iconv). (Hannes)
-- (unpack() broken with longs on 64 bit machines). (Ilia, David Soria Parra).
-- (for some keys cdbmake creates corrupted db and cdb can't read valid db). (Marcus)
-- (Added missing handling of basic types in json_decode). (Ilia)
-- (Fixed request time leak inside foreach() when iterating through virtual properties). (Dmitry)
-- (header( "HTTP/1.0 ..." ) does not change proto version). (Ilia)
-- (proc_get_status() returns wrong PID on windows). (Nuno)
-- (SOAP returns an array of values instead of an object). (Dmitry)
-- (Apache2 segfaults when virtual() is called in .php ErrorDocument). (Ilia)
-- (spl_autoload_register() gives wrong line for "class not found"). (Ilia)
-- (Remove bogus warnings from persistent PDO connections). (Ilia)
-- (Memlimit fatal error sent to "wrong" stderr when using fastcgi). (Dmitry)
-- (Incorrect PDO error message on invalid default fetch mode). (Ilia)
-- (Prevent trap when COM extension processes argument of type VT_DISPATCH|VT_REF) (Andy)
-- (iconv_substr() gives "Unknown error" when string length = 1"). (Ilia)
-- (session save_path check checks the parent directory). (Ilia)
-- (proc_open() closes stdin on fork() failure). (jdolecek at NetBSD dot org, Nuno)
-- (COM Property propputref converts to PHP function and can't be accesed). (Rob)
-- (natcasesort() causes array_pop() to misbehave). (Hannes)
-- (pg_execute() modifies input array). (Ilia)
-- (Error parsing named parameters with queries containing high-ascii chars). (Ilia)
-- (possible crash in variant_date_from_timestamp()). (Ilia)
-- (proc_open() / proc_close() leak handles on windows). (jdolecek at NetBSD dot org, Nuno)
-- (wrong number of decimal digits with %e specifier in sprintf). (Matt,Ilia)
-- (__get method works properly only when conditional operator is used). (Dmitry)
-- (Erroneous "Class declarations may not be nested" error raised). (Carl P. Corliss, Dmitry)
-- (nested foreach fails when array variable has a reference). (Dmitry)
-- (COM extension not returning modified "out" argument) (Andy)
-- (Something strange with COM Object). (Rob)
-- (ScriptControl only sees last function of class). (Rob)
-- (Re-assignment by reference does not clear the is_ref flag) (Ilia, Dmitry, Matt Wilmas)
-- (apparent symbol table error with extract($blah, EXTR_REFS)) (Brian)
-- (is_executable() does not honor safe_mode_exec_dir setting). (Ilia)
-- (ORA-01405: fetched column value is NULL on LOB fields). (Tony)
-
-
-
-
-
-
-Version 5.2.0
-
-
-- Updated bundled OpenSSL to version 0.9.8d in the Windows distro. (Edin)
-- Updated Postgresql client libraries to 8.1.4 in the Windows distro. (Edin)
-- Updated PCRE to version 6.7. (Ilia)
-- Updated libsqlite in ext/pdo_sqlite to 3.3.7. (Ilia)
-- Updated bundled MySQL client library to version 5.0.22 in the Windows distribution. (Edin)
-- Updated timezonedb to version 2006.14. (Derick)
-
-- Added ability to make SOAP call userspace PHP<->XML converters. (Dmitry)
-- Added support for character sets in pg_escape_string() for PostgreSQL 8.1.4 and higher. (Ilia)
-- Added support for character sets in PDO quote() method for PostgreSQL 8.1.4 and higher. (Ilia)
-- Added DSA key generation support to openssl_pkey_new(), FR (marci at balabit dot hu, Tony)
-- Added SoapServer::setObject() method (it is a simplified version of SoapServer::setClass() method). (Dmitry)
-- Added support for hexadecimal entity in imagettftext() for the bundled GD. (Pierre)
-- Added support for httpOnly flag for session extension and cookie setting functions. (Scott MacVicar, Ilia)
-- Added version specific registry keys to allow different configurations for different php version. (Richard, Dmitry)
-- Added "PHPINIDir" Apache directive to apache and apache_hooks SAPIs. (Dmitry)
-- Added an optional boolean parameter to memory_get_usage() and memory_get_peak_usage() to get memory size allocated by emalloc() or real size of memory allocated from system. (Dmitry)
-- Added Zip Archive extension. (Pierre)
-- Added RFC1867 fileupload processing hook. (Stefan E.)
-- Added JSON and Filter extensions. (Derick, Rasmus, Pierre, Ilia)
-- Added error messages to disk_free_space() and disk_total_space() functions. FR (Tony)
-- Added PATHINFO_FILENAME option to pathinfo() to get the filename. (Toby S. and Christian S.)
-- Added array_fill_keys() function. (Marcus, Matt Wilmas)
-- Added posix_initgroups() function. (Ilia)
-- Added optional parameter to http_build_query() to allow specification of string separator. (Ilia)
-- Added image_type_to_extension() function. (Hannes, Ilia)
-- Added allow_url_include ini directive to complement allow_url_fopen. (Rasmus)
-- Added automatic module globals management. (Dmitry)
-- Added RFC2397 (data: stream) support. (Marcus)
-- Added new error mode E_RECOVERABLE_ERROR. (Derick, Marcus, Tony)
-- Added support for getenv() input filtering. (Rasmus)
-- Added support for constructors in interfaces to force constructor signature checks in implementations. (Marcus)
-- Added memory_get_peak_usage() function for retrieving peak memory usage of a PHP script. (Ilia)
-- Added pg_field_table() function. (Edin)
-- Added SimpleXMLElement::saveXML() as an alias for SimpleXMLElement::asXML(). (Hannes)
-- Added DOMNode::getNodePath() for getting an XPath for a node. (Christian)
-- Added gmp_nextprime() function. (ants dot aasma at gmail dot com, Tony)
-- Added error_get_last() function. (Mike)
-
-- Removed current working directory from the php.ini search path for CLI and re-added it for other SAPIs (restore to pre 5.1.x behavior). (Edin)
-- Moved extensions to PECL:
-
- - ext/filepro (Derick, Tony)
- - ext/hwapi (Derick, Tony)
-
-
-- Disabled CURLOPT_FOLLOWLOCATION in curl when open_basedir or safe_mode are enabled. (Stefan E., Ilia)
-
-- Increased default memory limit to 16 megabytes to accommodate for a more accurate memory utilization measurement.
-- In addition to path to php.ini, PHPRC now may specify full file name. (Dmitry)
-
-- Optimized array/HashTable copying. (Matt Wilmas, Dmitry)
-- Optimized zend_try/zend_catch macros by eliminating memcpy(3). (Dmitry)
-- Optimized require_once() and include_once() by eliminating fopen(3) on second usage. (Dmitry)
-- Optimized request shutdown sequence. Restoring ini directives now iterates only over modified directives instead of all. (Dmitry)
-
-- Changed priority of PHPRC environment variable on win32 to be higher then value from registry. (Dmitry)
-- Changed __toString() to be called wherever applicable. (Marcus)
-- Changed E_ALL error reporting mode to include E_RECOVERABLE_ERROR. (Marcus)
-- Changed realpath cache to be disabled when "open_basedir" or "safe_mode" are enabled on per-request basis. (Ilia)
-
-- Improved SNMP extension: (Jani)
-
- - Renamed snmp_set_oid_numeric_print() to snmp_set_oid_output_format().
- - Added 2 new constants: SNMP_OID_OUTPUT_FULL and SNMP_OID_OUTPUT_NUMERIC
- - (AES privacy encryption not possible due to net-snmp 5.2 compatibility issue). (Patch: scott dot moynes+php at gmail dot com)
-
-
-- Improved OpenSSL extension: (Pierre)
-
- - Added support for all supported algorithms in openssl_verify
- - Added openssl_pkey_get_details, returns the details of a key
- - Added x509 v3 extensions support
- - Added openssl_csr_get_subject() and openssl_csr_get_public_key()
- - Added 3 new constants OPENSSL_VERSION_TEXT and OPENSSL_VERSION_NUMBER and OPENSSL_KEYTYPE_EC
-
-
-- Improved the Zend memory manager: (Dmitry)
-
- - Removed unnecessary "--disable-zend-memory-manager" configure option.
- - Added "--enable-malloc-mm" configure option which is enabled by default in debug builds to allow using internal and external memory debuggers.
- - Allow tweaking the memory manager with ZEND_MM_MEM_TYPE and ZEND_MM_SEG_SIZE environment variables.
- - For more information: Zend/README.ZEND_MM
-
-
-- Improved safe_mode check for the error_log() function. (Ilia)
-- Improved the error reporting in SOAP extension on request failure. (Ilia)
-- Improved crypt() on win32 to be about 10 times faster and to have friendlier license. (Frank, Dmitry)
-- Improved performance of the implode() function on associated arrays. (Ilia)
-- Improved performance of str_replace() when doing 1 char to 1 char or 1 char to many chars replacement. (Ilia)
-- Improved apache2filter SAPI:
-
- - Allowed PHP to be an arbitrary filter in the chain and read the script from the Apache stream. (John)
- - Added support for apache2filter in the Windows build including binary support for both Apache 2.0.x (php5apache2_filter.dll) and Apache 2.2.x (php5apache2_2_filter.dll). (Edin)
-
-
-- Improved apache2handler SAPI:
-
- - Changed ap_set_content_type() to be called only once. (Mike)
- - Added support for Apache 2.2 handler in the Windows distribution. (Edin)
-
-
-- Improved FastCGI SAPI: (Dmitry)
-
- - Removed source compatibility with libfcgi.
- - Optimized access to FastCGI environment variables by using HashTable instead of linear search.
- - Allowed PHP_FCGI_MAX_REQUESTS=0 that assumes no limit.
- - Allowed PHP_FCGI_CHILDREN=0 that assumes no worker children. (FastCGI requests are handled by main process itself)
-
-
-- Improved CURL:
-
- - Added control character checks for "open_basedir" and "safe_mode" checks. (Ilia)
- - Added implementation of curl_multi_info_read(). (Brian)
-
-
-- Improved PCRE: (Andrei)
-
- - Added run-time configurable backtracking/recursion limits.
- - Added preg_last_error(). (Andrei)
-
-
-- Improved PDO:
-
- - Added new attribute ATTR_DEFAULT_FETCH_MODE. (Pierre)
- - Added FETCH_PROPS_LATE. (Marcus)
-
-
-- Improved SPL: (Marcus)
-
- - Made most iterator code exception safe.
- - Added RegExIterator and RecursiveRegExIterator.
- - Added full caching support and ArrayAccess to CachingIterator.
- - Added array functions to ArrayObject/ArrayIterator and made them faster.
- - Added support for reading csv and skipping empty lines in SplFileObject.
- - Added CachingIterator::TOSTRING_USE_INNER, calls inner iterator __toString.
- - Added ability to set the CSV separator per SplFileObject.
-
-
-- Improved xmlReader: (Rob)
-
- - Added readInnerXml(), xmlReader::setSchema().
- - Added readInnerXML(), readOuterXML(), readString(), setSchema(). (2.6.20+)
- - Changed to passing libxml options when loading reader.
-
-
-- Fixed invalid read in imagecreatefrompng when an empty file is given (Pierre, Tony)
-- Fixed infinite loop when a wrong color index is given to imagefill (Pierre)
-- Fixed mess with CGI/CLI -d option (now it works with cgi; constants are working exactly like in php.ini; with FastCGI -d affects all requests). (Dmitry)
-- Fixed missing open_basedir check inside chdir() function. (Ilia)
-- Fixed overflow on 64bit systems in str_repeat() and wordwrap(). (Stefan E.)
-- Fixed XSLTProcessor::importStylesheet() to return TRUE on success (Christian)
-- Fixed leaks in openssl_csr_sign and openssl_csr_new (Pierre)
-- Fixed phpinfo() cutoff of variables at \0. (Ilia)
-- Fixed a bug in the filter extension that prevented magic_quotes_gpc from being applied when RAW filter is used. (Ilia)
-- Fixed memory leaks in openssl streams context options. (Pierre)
-- Fixed handling of extremely long paths inside tempnam() function. (Ilia)
-- Segmentation fault with list unpacking of string offset). (Dmitry)
-- Not including nsapi.h properly with SJSWS 7). This will make PHP 5.2 compatible to new Sun Webserver. (Uwe)
-- Uncaught exception may cause crash). (Dmitry)
-- Memleak when reflecting non-existing class/method). (Tony)
-- getDeclaringClass() and private properties). (Tony)
-- SSL: fatal protocol error when fetching HTTPS from servers running Google web server). (Ilia)
-- Compatibility issue between DOM and zend.ze1_compatibility_mode). (Rob)
-- curl_exec() with return transfer returns TRUE on empty files). (Ilia)
-- strcspn() stops on null character). (Tony)
-- PHP in FastCGI server mode crashes). (Dmitry)
-- foreach(($obj = new myClass) as $v); echo $obj; segfaults). (Dmitry)
-- Fixed generation of config.nice with autoconf 2.60). (Ilia)
-- __autoload() is called for type hinting). (Dmitry, Tony)
-- ReflectionProperty returns incorrect declaring class for protected properties). (Tony)
-- PDO_MYSQL doesn't check connections for liveness). (Tony)
-- Fixed safe_mode/open_basedir checks for session.save_path, allowing them to account for extra parameters). (Ilia)
-- Absolute path with slash at beginning doesn't work on win). (Dmitry)
-- Can't cast COM objects). (Wez)
-- using FTP URLs in get_headers() causes crash). (Tony)
-- Fixed a possible open_basedir bypass in tempnam()). (Ilia)
-- metaphone() results in segmentation fault on NetBSD). (Tony)
-- Cannot get xmlns value attribute). (Rob)
-- Double old-style-ctor inheritance). (Dmitry)
-- imap extension does not compile against new version of the imap library). (Ilia)
-- move_uploaded_file() cannot read uploaded file outside of open_basedir). (Ilia)
-- apache2filter changes cwd to /). (Ilia, Hannes)
-- get_headers() do not work with curl-wrappers). (Ilia)
-- ldap_connect causes segfault with newer versions of OpenLDAP). (Tony)
-- parse_url() fails if passing '@' in passwd). (Tony)
-- lookupNamespaceURI doesn't return default namespace). (Rob)
-- curl_easy_strerror() is defined only since cURL 7.12.0). (Tony)
-- DOMEntityReference->__construct crashes when called explicitly). (Rob)
-- "maybe ref" issue for current() and others). (Dmitry)
-- engine crashes when require()'ing file with syntax error through userspace stream wrapper). (Tony, Dmitry)
-- inconsistent overriding of methods in different visibility contexts). (Dmitry)
-- PDO sqlite2 empty query causes segfault). (Tony)
-- Invalid memory read in date_parse()). (Tony, Derick)
-- SoapClient::__getTypes never returns). (Dmitry)
-- curl_multi_add_handle() set curl handle to null). (Ilia)
-- sockaddr local storage insufficient for all sock families). (Sara)
-- mixed-case URL breaks url-wrappers). (Ilia)
-- memory leak in ReflectionClass::getConstant()). (Tony)
-- uninit'd optional arg in stream_socket_sendto()). (Sara)
-- curl_copy_handle() fails to fully copy the cURL handle). (Tony, Ilia)
-- Strange warning when incrementing an object property and exception is thrown from __get method). (Tony)
-- leaks in a tricky code with switch() and exceptions). (Dmitry)
-- include_once() may include the same file twice). (Dmitry)
-- missing curl constants and improper constant detection). (Ilia)
-- shutdown_executor() may segfault when memory_limit is too low). (Dmitry)
-- memory corruption in pdo_pgsql driver on error retrieval inside a failed query executed via query() method). (Ilia)
-- segfault when calling setlocale() in userspace session handler). (Tony)
-- strptime() does not initialize the internal date storage structure). (Ilia)
-- Fixed bugs , , (Fixed session extension request shutdown order to ensure it is shutdown before the extensions it may depend on). (Ilia)
-- Access to "php://stdin" and family crashes PHP on win32). (Dmitry)
-- getAttribute select attribute by order, even when prefixed). (Rob)
-- --enable-versioning causes make fail on OS X). (Tony)
-- ReflectionParameter fails if default value is an access to self::). (Johannes)
-- array_count_values() mishandles numeric strings). (Matt Wilmas, Ilia)
-- setting private attribute with __set() produces segfault). (Tony)
-- , (error retrieving columns after long/text columns with PDO_ODBC). (Wez)
-- warning upon disabling handler via xml_set_element_handler). (dtorop933 at gmail dot com, Rob)
-- PDO_MYSQL doesn't compile on Solaris). (Tony)
-- constructor is not called for classes used in userspace stream wrappers). (Tony)
-- DOMNodeList->item(0) segfault on empty NodeList). (Ilia)
-- xmlrpc_get_type() crashes PHP on objects). (Tony)
-- unicode causes xml_parser to misbehave). (Rob)
-- Different attribute assignment if new or existing). (Rob)
-- Use of com.typelib_file may cause a crash). (Ilia)
-- PDO fails to recover from failed prepared statement execution). (Ilia)
-- session_destroy() gives warning after session_regenerate_id()). (Ilia)
-- dbase_open can't open DBase 3 dbf file). (rodrigo at fabricadeideias dot com, Mike)
-- Unwanted reformatting of XML when using AsXML). (Christian)
-- Segmentation fault when using foreach with an unknown/empty SimpleXMLElement). (Tony)
-- reading past array in sscanf() leads to arbitrary code execution). (Tony)
-- Constructing in the destructor causes weird behavior). (Dmitry)
-- spl_autoload_register() suppress all errors silently). (Ilia)
-- configure script ignores --without-cdb,inifile,flatfile). (Marcus)
-- segfault in session_decode() when _SESSION is NULL). (Tony)
-- static variables mess up global vars). (Dmitry)
-- session_cache_expire()'s value does not match phpinfo's session.cache_expire). (Tony)
-- file_exists() works incorrectly with long filenames on Windows). (Ilia, Tony)
-- fopen wrapper doesn't fail on invalid hostname with curlwrappers enabled). (Tony)
-- heap corruption). (Dmitry)
-- openssl_x509_parse() leaks with invalid cert) (Pierre)
-- openssl possible leaks while passing keys) (Pierre)
-- PDO produces segfault with default fetch mode). (Tony)
-- socket_select() and invalid arguments). (Tony)
-- Binary data gets corrupted on multipart/formdata POST). (Ilia)
-- Exception in __clone makes memory leak). (Dmitry, Nuno)
-- strtotime() does not parse YYYY-MM format). (Ilia)
-- session extension can't handle broken cookies). (Ilia)
-- Crash on some object operations). (Dmitry)
-- ReflectionClass::newInstanceArgs() tries to allocate too much memory). (Tony)
-- gif interlace output cannot work). (Pierre)
-- Fixed bugs , , (wddx encoding fails to handle certain characters). (Ilia)
-- Segfault on invalid imagecreatefromgd2part() parameters). (Pierre)
-- variable name and cookie name match breaks script execution). (Dmitry)
-- fclose() unable to close STDOUT and STDERR). (Tony)
-- possible crash when COM reports an exception). (Ilia)
-- ReflectionClass::isSubclassOf() returns TRUE for the class itself). (Ilia)
-- disable_classes=Foobar causes disabled class to be called Foo). (Jani)
-- imagecopy from a palette to a truecolor image loose alpha channel) (Pierre)
-- Freeing nested cursors causes OCI8 to segfault). (Tony)
-- Crash in pdo_pgsql on missing bound parameters). (Ilia)
-- oci_bind_by_name() returns garbage when Oracle didn't set the variable). (Tony)
-- Cannot use array returned from foo::__get('bar') in write context). (Dmitry)
-- ReflectionClass::getStaticProperties() retains \0 in key names). (Ilia)
-- undefined reference to spl_dual_it_free_storage). (Marcus)
-- corrupted gif segfaults) (Pierre)
-- large timeout values ignored on 32bit machines in stream_socket_accept() and stream_socket_client()). (Ilia)
-- stream_copy_to_stream() returns 0 when maxlen is bigger than the actual length). (Tony)
-- boolean arg for mysqli_autocommit() is always true on Solaris). (Tony)
-- Parameters are not decoded from utf-8 when using encoding option). (Dmitry)
-- ignored constructor visibility). (Marcus)
-- Wrong interpretation of boolean parameters). (Dmitry)
-- "file" and "line" sometimes not set in backtrace from inside error handler). (Dmitry)
-- segfault extending mysqli class). (Dmitry)
-- SoapFault faultstring doesn't follow encoding rules). (Dmitry)
-- Parameters in SoapServer are decoded twice). (Dmitry)
-- in classes inherited from MySQLi it's possible to call private constructors from invalid context). (Tony)
-- invalid return of file_exists() in safe mode). (Ilia)
-- zend_ptr_stack reallocation problem). (Dmitry)
-- pathinfo() cannot handle argument with special characters like German "Umlaut"). (Mike)
-- possible crash in OCI8 after database restart when using persistent connections). (Tony)
-- Display constant value in reflection::export). (Johannes)
-- compilation problems on z/OS). (Tony)
-- pgo_pgsql tries to de-allocate unused statements). (Ilia, ce at netage dot bg)
-- file_get_contents() leaks on empty file). (Hannes)
-- Integer pointer comparison to numeric value). (bugs-php at thewrittenword dot com)
-- wordwrap() wraps incorrectly). (ddk at krasn dot ru, Tony)
-- ReflectionProperty does not throw exception when accessing protected attribute). (Marcus)
-- define not using toString on objects). (Marcus)
-- segmentation fault during SOAP schema import). (Tony)
-- weird behavior of object type and comparison). (Marcus)
-- memory leak trying to execute a non existing file (CLI)). (Mike)
-- empty include_path leads to search for files inside /). (jr at terragate dot net, Ilia)
-- strtotime segfaults when given "nextyear"). (Derick)
-- merge_php_config scrambles values). (Mike, pumuckel at metropolis dot de)
-- Possible crash in PDO::errorCode()). (Ilia)
-- clone without assigning leaks memory). (Ilia, Nuno, Dmitri)
-- Semaphore constants not available). (Ilia)
-- MySQLi extension fails to recognize BIT column). (Ilia)
-- Object is not added into array returned by __get). (Marcus)
-- parameter of pcntl signal handler is trashed). (Mike)
-- Protected method access problem). (Marcus)
-- MySQL extensions should link against thread safe client libs if built with ZTS). (Mike)
-- mysqli_ssl_set validation is inappropriate). (Georg)
-- DATE_RFC822 does not product RFC 822 dates). (Hannes Magnusson, Derick)
-- Class name lowercased in error message). (Johannes)
-- var without attribute causes segfault). (Marcus)
-- Bumped minimum PCRE version to 6.6, needed for recursion limit support). (Ilia)
-- oci_bind_array_by_name clobbers input array when using SQLT_AFC, AVC). (Tony)
-- WDDX incorrectly encodes high-ascii characters). (Ilia)
-- Using reflection::export with simplexml causing a crash). (Marcus)
-- AES privacy encryption not possible due to net-snmp 5.2 compatibility issue). (Jani, patch by scott dot moynes+php at gmail dot com)
-- array_key_exists performance is poor for &$array). (Ilia)
-- timeout functionality doesn't work after a second PHP start-up on the same thread). (p dot desarnaud at wanadoo dot fr)
-- oci8 persistent connection corruption). (Tony)
-- namespaces added too late, leads to missing xsi:type attributes. incompatibility with libxml2-2.6.24). (Dmitry)
-- strtotime doesn't assume year correctly). (Derick)
-- session_regenerate_id changes session_id() even on failure). (Hannes)
-- touch() truncates large files). (Ilia)
-- CLI segmentation faults during cleanup with sybase-ct extension enabled). (Tony)
-- FastCGI output buffer overrun). (Piotr, Dmitry)
-- oci_fetch_array() array-type should always default to OCI_BOTH). (Tony)
-- Crash when an exception is thrown in accept() method of FilterIterator). (Marcus)
-- DOMElement->setAttribute() loops forever). (Rob)
-- Fixed crash in pdo_mysql resulting from premature object destruction). (Ilia)
-- PHP crashes on windows if there are start-up errors and event log is used for logging them). (Edin)
-- tidy module crashes on shutdown). (Tony)
-- iterator_to_array() hides exceptions thrown in rewind() method). (Tony)
-- Rejected versions of flex that don't work). (Ilia)
-- recursive mkdir() fails to create nonexistent directories in root dir). (Tony)
-- substr_compare() returns an error when offset equals string length). (Ilia)
-- Unnecessary call to OCITransRollback() at the end of request). (Tony)
-- fastcgi.c compile fail with gcc 2.95.4). (Ilia)
-- Incorrect timestamp returned for strtotime()). (Derick)
-- PDO_MYSQL does not build if no other mysql extension is enabled). (Mike)
-- make PEAR install ignore open_basedir). (Ilia)
-- $_SERVER in included file is shortened to two entries, if $_ENV gets used). (Dmitry)
-- sigemptyset() used without including <signal.h>). (jdolecek)
-- max_execution_time = max_input_time). (Dmitry)
-- SOAP not respecting uri in __soapCall). (Dmitry)
-- Added missing safe_mode & open_basedir checks to imap_body()). (Ilia)
-- var_export() does not escape \0 character). (Ilia)
-- php-fastcgi doesn't handle connection abort). (Dmitry)
-- Added strict flag to base64_decode() that enforces RFC3548 compliance). (Ilia)
-- PHP crashes trying to assign into property of dead object). (Dmitry)
-- invalid internal mysqli objects dtor). (Mike)
-- req/x509 extensions support for openssl_csr_new and openssl_csr_sign) (ben at psc dot edu, Pierre)
-- Objects destructors are invoked in wrong order when script is finished). (Dmitry)
-- pdo_pgsql driver incorrectly ignored some errors). (Wez, Ilia)
-- umask not reset at the end of the request). (Ilia)
-- Unlinking buckets from non-existent brigades). (Sara)
-- Error ORA-24806 occurs when trying to fetch a NCLOB field). (Tony)
-- file_get_contents() fails with some combinations of offset & maxlen). (Nuno)
-- Lack of read permission on main script results in E_WARNING rather then E_ERROR). (Ilia)
-- --with-curlwrappers causes PHP to disregard some HTTP stream context options). (Mike)
-- recursive array_walk causes segfault). (Tony)
-- throw in foreach causes memory leaks). (Dmitry)
-- oci_password_change() fails). (pholdaway at technocom-wireless dot com, Tony)
-- Missing math constants). (Hannes)
-- https:// or ftps:// do not work when --with-curlwrappers is used and ssl certificate is not verifiable). (Ilia)
-- number_format and problem with 0). (Matt Wilmas)
-- openssl_x509_parse() extensions support) (Pierre)
-- (oci8 might reuse wrong persistent connection). (Tony)
-- (issue in php_oci_statement_fetch with more than one piecewise column) (jeff at badtz-maru dot com, Tony)
-- (OCI8 persistent connections misbehave when Apache process times out). (Tony)
-- (error selecting DOUBLE fields with PDO_ODBC). ("slaws", Wez)
-
-
-
-
-
-Version 5.1.6
-
-
- - Fixed memory_limit on 64bit systems. (Stefan E.)
- - (Access to "php://stdin" and family crashes PHP on win32). (Dmitry)
-
-
-
-
-
-Version 5.1.5
-
-
- - Fixed overflow on 64bit systems in str_repeat() and wordwrap(). (Stefan E.)
- - Disabled CURLOPT_FOLLOWLOCATION in curl when open_basedir or safe_mode are enabled. (Stefan E., Ilia)
- - (reading past array in sscanf() leads to arbitrary code execution). (Tony)
- - (undefined reference to spl_dual_it_free_storage). (Marcus)
- - (corrupted gif segfaults) (Pierre)
- - (var without attribute causes segfault). (Marcus)
- - (FastCGI env (cgi vars) table overflow). (Piotr)
- - (FastCGI output buffer overrun). (Piotr, Dmitry)
- - (oci_fetch_array() array-type should always default to OCI_BOTH). (Tony)
- - (iterator_to_array() hides exceptions thrown in rewind() method). (Tony)
- - (Unnecessary call to OCITransRollback() at the end of request). (Tony)
- - ($_SERVER in included file is shortened to two entries, if $_ENV gets used). (Dmitry)
- - (sigemptyset() used without including <signal.h>). (jdolecek)
- - (invalid colormap format) (Pierre)
- - (invalid gif size) (Pierre)
- - (max_execution_time = max_input_time). (Dmitry)
- - (SOAP not respecting uri in __soapCall). (Dmitry)
- - (Added missing safe_mode & open_basedir checks to imap_body()). (Ilia)
- - (php-fastcgi doesn't handle connection abort). (Dmitry)
-
-
-
-
-
-Version 5.1.4
-
-
- - Added "capture_peer_cert" and "capture_peer_cert_chain" context options for SSL streams. (Wez).
- - Added PDO::PARAM_EVT_* family of constants. (Sara)
- - Fixed possible crash in highlight_string(). (Dmitry)
- - (FastCGI now longer works with isapi_fcgi.dll). (Dmitry)
- - (cloning Dom Documents or Nodes does not work). (Rob)
- - (problems with $_POST array). (Dmitry)
- - (bad error reporting for pdo_odbc exec UPDATE). (Wez).
- - (crash when pdo_odbc prepare fails). (Wez).
-
-
-
-
-
-Version 5.1.3
-
-
-- Updated bundled PCRE library to version 6.6. (Andrei)
-- Moved extensions to PECL:
-
- - ext/msession (Derick)
-
-- Reimplemented FastCGI interface. (Dmitry)
-- Improved SPL: (Marcus)
-
- - Fixed issues with not/double calling of constructors of SPL iterators.
- - Fixed issues with info-class/file-class in SPL directory handling classes.
- - Fixed ArrayIterator::seek().
- - Added SimpleXMLIterator::count().
- - Dropped erroneous RecursiveDirectoryIterator::getSubPathInfo().
-
-- Improved SimpleXML: (Marcus, Rob)
-
- - Added SimpleXMLElement::getName() to retrieve name of element.
- - Added ability to create elements on the fly.
- - Added addChild() method for element creation supporting namespaces.
- - Added addAttribute() method for attribute creation supporting namespaces.
- - Added ability to delete specific elements and attributes by offset.
-
-- Improved Reflection API: (Marcus)
-
- - Added ReflectionClass::newInstanceArgs($args).
- - Added ability to analyze extension dependency.
- - Added ReflectionFunction::isDeprecated() and constant IS_DEPRECATED.
- - Added ReflectionParameter::getDeclaringClass().
- - Changed reflection constants to be prefixed with IS_. (Johannes)
-
-- Improved cURL extension: (Ilia)
-
- - Added curl_setopt_array() function that allows setting of multiple options via an associated array.
- - Added the ability to retrieve the request message sent to the server.
-
-- Improved GD extension: (Pierre)
-
- - Added a weak/tolerant mode to the JPEG loader.
- - Added filtering mode option to imagepng() to allow reducing file size.
- - Fixed imagecolorallocate() and imagecolorallocatelapha() to return FALSE on error.
-
-- Changed get_headers() to retrieve headers also from non-200 responses. (Ilia)
-- Changed get_headers() to use the default context. (Ilia)
-- Changed SOAP extension to cache WSDL structure in memory and thus speed up SoapClient/SoapServer construction. (Andrei, Dmitry)
-- Added lchown() and lchgrp() to change user/group ownership of symlinks. (Derick)
-- Added support for exif date format in strtotime(). (Derick)
-- Added a check for special characters in the session name. (Ilia)
-- Added "consumed" stream filter. (Marcus)
-- Added new mysqli constants for BIT and NEW_DECIMAL field types: MYSQLI_TYPE_NEWDECIMAL and MYSQLI_TYPE_BIT. FR . (Georg)
-- Added imap_savebody() that allows message body to be written to a file. (Mike)
-- Added overflow checks to wordwrap() function. (Ilia)
-- Added support for BINARY_DOUBLE and BINARY_FLOAT to PDO_OCI and OCI8 (also fixes bug ). (Tony)
-- Eliminated run-time constant fetching for TRUE, FALSE and NULL. (Dmitry)
-- Removed the E_STRICT deprecation notice from "var". (Ilia)
-- Fixed reading stream filters never notified about EOF. (Mike)
-- Fixed tempnam() 2nd parameter to be checked against path components. (Ilia)
-- Fixed a bug that would not fill in the fifth argument to preg_replace() properly, if the variable was not declared previously. (Andrei)
-- Fixed safe_mode check for source argument of the copy() function. (Ilia)
-- Fixed mysqli bigint conversion under Windows (Georg)
-- Fixed XSS inside phpinfo() with long inputs. (Ilia)
-- Fixed Apache2 SAPIs header handler modifying header strings. (Mike)
-- Fixed 'auto_globals_jit' to work together with 'register_argc_argv'. (Dmitry)
-- Fixed offset/length parameter validation in substr_compare() function. (Ilia)
-- Fixed debug_zval_dump() to support private and protected members. (Dmitry)
-- Fixed SoapFault::getMessage(). (Dmitry)
-- Fixed issue with iconv_mime_decode where the "encoding" would only allow upper case specifiers. (Derick)
-- Fixed tiger hash algorithm generating wrong results on big endian platforms. (Mike)
-- Fixed crash with DOMImplementation::createDocumentType("name:"). (Mike)
-- (Serving binary content/images fails with "comm with server aborted" FastCGI err). (Dmitry)
-- (cc may complain about non-constant initializers in hash_adler.c). (Mike)
-- (chmod takes off sticky bit when safe_mode is On). (Tony)
-- (PDO segfaults when throwing exception from the fetch handler). (Tony)
-- (wddx does not build as a shared extension). (jdolecek at NetBSD dot org, Ilia)
-- (fread behavior changes after calling stream_wrapper_register). (Wez)
-- (__autoload tries to load callback'ed self and parent). (Dmitry)
-- (libmbfl headers not installed). (Jani)
-- (Frequent crashes in SOAP extension with new WSDL caching code in multithread WS). (Andrei, Dmitry)
-- (compile failure on ARM architecture). (Tony)
-- (curl_exec() doesn't zero-terminate binary strings). (Tony)
-- (Type of retval of Countable::count() is not checked). (Johannes)
-- (oci_bind_by_name() doesn't support RAW and LONG RAW fields). (Tony)
-- (xmlrpc_decode() may produce arrays with numeric strings, which are unaccessible). (Tony)
-- (incorrect reference counting for persistent OCI8 connections). (Tony)
-- (SoapClient Error Fetching http headers). (Dmitry)
-- (html_errors with internal classes produces wrong links). (Tony)
-- (foreach breaks static scope). (Dmitry)
-- (Fixed check for special chars for http redirects). (Ilia)
-- (strtotime fails before 13:00:00 with some time zones identifiers). (Derick)
-- (Have to quote literals in INI when concatenating with vars). (Dmitry)
-- (mktime freezes on long numbers). (Derick)
-- (SplFileObject->fgets() ignores max_length). (Tony)
-- (serialize() does not handle recursion). (Ilia)
-- (strncmp & strncasecmp do not return false on negative string length). (Tony)
-- (ArrayIterator does not clone itself). (Marcus)
-- (OCILob->read() doesn't move internal pointer when reading 0's). (Tony)
-- (wsdl default value overrides value in soap request). (Dmitry)
-- (__set() leaks in classes extending internal ones). (Tony, Dmitry)
-- (User filters can leak buckets in some situations). (Ilia)
-- (error messages are printed even though an exception has been thrown). (Tony)
-- (is_*() functions do not account for open_basedir). (Ilia)
-- (session_destroy() fails after call to session_regenerate_id(true)). (Ilia)
-- (memory leak in output buffering when using chunked output). (Tony)
-- (DOMElement crashes when calling __construct when cloning). (Tony)
-- (Added support for partial content fetching to the HTTP streams wrapper). (Ilia)
-- (Documentation and code discrepancies for NULL data in oci_fetch_*() functions). (Tony)
-- (Exceptions thrown in ArrayObject::offsetGet cause segfault). (Tony)
-- (Privileged connection with an Oracle password file fails). (Tony)
-- (__FILE__ behavior changed). (Dmitry)
-- (syslog ident becomes garbage between requests). (Tony)
-- (mysqli_set_charset() crash with a non-open connection). (Ilia)
-- (DOMDocument::removeChild corrupts node). (Rob)
-- (SOAP: 'Error Fetching http body' when using HTTP Proxy). (Dmitry)
-- (No error message when load data local file isn't found). (Georg)
-- (In a class extending XMLReader array properties are not writable). (Tony)
-- (segfault in pdo_pgsql bindValue() when no parameters are defined). (Tony)
-- (The SoapServer is not able to send a header that it didn't receive). (Dmitry)
-- (Transparency is lost when using imagecreatetruecolor). (Pierre)
-- (Removed arbitrary limit on the length of syslog messages). (Ilia)
-- (http_build_query generates invalid URIs due to use of square brackets). (Mike)
-- (strtotime() returns false when 2nd argument < 1). (Derick)
-- (SoapServer::handle() exits on SOAP faults). (Dmitry)
-- (pg_trace() does not work). (iakio at mono-space dot net)
-- (Segfault when using Soap). (Dmitry)
-- (assignment to SimpleXML object attribute changes argument type to string). (Tony)
-- (pg_query_params() changes arguments type to string). (Tony)
-- (DATE_W3C format constant incorrect). (Derick)
-- (SOAP: Incorrect complex type instantiation with hierarchies). (Dmitry)
-- (Added PDO::MYSQL_ATTR_DIRECT_QUERY constant that should be set when executing internal queries like "show master status" via MySQL). (Ilia)
-- (memory_limit setting on win32 has no effect). (Dmitry)
-- (comment will be outputted in last line). (Dmitry)
-- (strtotime() fails to parse date strings with tabs). (Ilia, Derick)
-- (Incorrect adding PHPSESSID to links, which contains \r\n). (Ilia)
-- (sleep() accepts negative values). (Ilia)
-- (DBA problem with Berkeley DB4). (Marcus)
-- (Improper resolution of declaring class name of an inherited property). (Ilia)
-- (segfault when access result->num_rows after calling result->close()). (Ilia,Tony)
-- (oci_execute() no longer supports OCI_DESCRIBE_ONLY). (Tony)
-- (Custom 5xx error does not return correct HTTP response error code). (Tony)
-- (strtotime() fails to parse dates in dd-mm-yyyy format). (Derick)
-- (ext/soap crashes when throwing exception and session persistence). (David)
-- (PDO/PgSQL's getColumnMeta() crashes). (Derick)
-- (splFileObject::fwrite() doesn't write when no data length specified). (Tony)
-- (parse_url() does not parse numeric paths properly). (Ilia)
-- (PDO/MySQL problem loading BLOB over 1MB). (Ilia)
-- (ReflectionProperty fails to return correct visibility). (Ilia)
-- (Added missing documentation about realpath cache INI settings). (Ilia)
-- (ReflectionProperty::getDocComment() does not reflect extended class commentary). (Ilia)
-- (crc32() differ on 32-bit and 64-bit platforms) (anight@eyelinkmedia dot com, Pierre)
-- (foreach on error_zval produces segfault). (Dmitry)
-- (typo in SplFileObject::flock() parameter name). (Tony)
-- (Segfault with SplFileInfo conversion). (Marcus)
-- (SOAPClient Compression Broken). (Dmitry)
-- (Object destructors called even after fatal errors). (Dmitry)
-- (SplFileObject::getPath() may lead to segfault). (Tony)
-- (PHP causes ORA-07445 core dump in Oracle server 9.2.x). (Tony)
-- (Possible memory corruption in stream_select()). (Tony)
-- (ocicolumnname returns false before a successful fetch). (Tony)
-- (Inconsistent handling when passing potential arrays). (Dmitry)
-- (date(DATE_ATOM) gives wrong results). (Derick, Hannes Magnusson)
-- (errorInfo in PDOException is always NULL). (Ilia)
-- (symbol namespace conflicts using bundled gd). (Jakub Moc)
-- (Memory leaks on duplicate cookies). (Dmitry)
-- (str_rot13() crash on non-string parameter). (Pierre)
-- (PDO_PGSQL - PDO::exec() does not return number of rows affected by the operation). (Ilia)
-- (SIGTERM is not handled correctly when running as a FastCGI server). (Dmitry)
-- (problems with curl+ssl and pgsql+ssl in same PHP). (Mike)
-- (unpack("H*hex", $data) is adding an extra character to the end of the string). (Ilia)
-- (DirectoryIterator constructor failed to detect empty directory names). (Ilia)
-- (Reading records of unsupported type causes segfault). (Tony)
-- (oci_result() returns garbage after oci_fetch() failed). (Tony)
-- (SoapClient waits for responses on one-way operations). (Dmitry)
-- (Engine Crash related with 'clone'). (Dmitry)
-- (possible OCI8 crash in multi-threaded environment). (Tony)
-- (parse_ini_file() miscounts lines in multi-line values). (Ilia)
-- (ext/hash compile failure on Mac OSX). (Tony)
-- (heredoc adds extra line number). (Dmitry)
-- (realpath cache memleaks). (Dmitry, Nuno)
-- (Strict errormsg wrong for call_user_func() and the likes). (Marcus)
-- (Segfault when re-creating and re-executing statements with bound parameters). (Tony)
-- (Problem with $this in __destruct()). (Dmitry)
-- (recursive mkdir() does not work with relative path like "foo/bar"). (Tony)
-- (SplFileInfo::getPathname() returns unix style filenames in win32). (Marcus)
-- (Unknown persistent list entry type in module shutdown). (Dmitry)
-- (Fatal com_exception casting object). (Rob)
-- (stream_select() should warning when tv_sec is negative). (Ilia)
-- (SimpleXML causes memory read error zend engine). (Marcus)
-- (empty array onto COM object blows up). (Rob)
-- (sqlite_fetch_column_types() locks the database forever). (Ilia)
-
-
-
-
-
-Version 5.1.2
-
-
-- Updated libsqlite in ext/sqlite to 2.8.17. (Ilia)
-- Updated libsqlite in ext/pdo_sqlite to 3.2.8. (Ilia)
-- Updated to libxml2-2.6.22 and libxslt-1.1.15 in the win32 bundle. (Rob)
-- Added new extensions: (Ilia, Wez)
-
-- Added PNG compression support to GD extension. (Pierre)
-- Added reflection constants as class constants. (Johannes)
-- Added --enable-gcov configure option to enable C-level code coverage. (John, Jani, Ilia, Marcus)
-- Added missing support for 'B' format identifier to date() function. (Ilia)
-- Changed reflection to be an extension. (Marcus)
-- Improved SPL extension: (Marcus)
-
- - Added class SplFileInfo as root class for DirectoryIterator and SplFileObject
- - Added SplTempFileObject
-
-- Improved SimpleXML extension: (Marcus)
-
- - Fixed memleaks
- - Fixed var_dump()
- - Fixed isset/empty/(bool) behavior
- - Fixed iterator edge cases
- - Added methods getNamespaces(), getDocNamespaces()
-
-- Upgraded pear to version 1.4.6. (Greg)
-- Added constants for libxslt and libexslt versions: LIBXSLT_VERSION, LIBXSLT_DOTTED_VERSION, LIBEXSLT_VERSION and LIBEXSLT_DOTTED_VERSION. (Pierre)
-- Added an optional parameter to parse_url() to allow retrieval of distinct URL components. (Ilia)
-- Fixed possible crash in apache_getenv()/apache_setenv() on invalid parameters. (Ilia)
-- Changed errors to warnings in imagecolormatch(). (Pierre)
-- Fixed segfault/leak in imagecolormatch(). (Pierre)
-- Fixed small leak in mysqli_stmt_fetch() when bound variable was empty string. (Andrey)
-- Fixed prepared statement name conflict handling in PDO_PGSQL. (Thies, Ilia)
-- Fixed memory corruption when PDO::FETCH_LAZY mode is being used. (Ilia)
-- Fixed possible leaks in imagecreatefromstring() with invalid data. (Pierre)
-- Fixed possible memory corruption inside mb_strcut(). (Ilia)
-- Fixed possible header injection by limiting each header to a single line. (Ilia)
-- Fixed possible XSS inside error reporting functionality. (Ilia)
-- Fixed many bugs in OCI8. (Tony)
-- Fixed crash and leak in mysqli when using 4.1.x client libraries and connecting to 5.x server. (Andrey)
-- (Duplicate calls to stream_bucket_append() lead to a crash). (Ilia)
-- (curl extension uses undefined GCRY_THREAD_OPTIONS_USER). (Ilia)
-- (PDO_OCI uses hardcoded lib path $ORACLE_HOME/lib). (Tony)
-- (wddx_deserialize not parsing dateTime fields properly). (Derick)
-- (strtotime("NOW") no longer works). (Derick)
-- (array_map() segfaults when exception is throwed from the callback). (Tony)
-- (unpack() does not decode odd number of hexadecimal values). (Ilia)
-- (segfault on PDOStatement::execute() with zend.ze1_compatibility_mode = On). (Tony, Ilia)
-- (stream_filter_append() can cause segfault). (Tony)
-- (sybase_ct doesn't compile on Solaris using old gcc). (Tony)
-- (mysqli_stmt_bind_result() makes huge allocation when column empty). (Andrey)
-- (using date with a timestamp makes httpd segfault). (Derick)
-- (memory leak when including a directory). (Tony)
-- (ext/mssql + freetds: Use correct character encoding and allow setting it). (Frank)
-- (xmlrpc_introspection.c fails compile per C99 std). (Jani)
-- (A final constructor can be overwritten). (Marcus)
-- (getopt() returns array with numeric strings when passed options like '-1'). (Tony)
-- (strtotime() fails to parse soap date format without TZ). (Ilia)
-- (date() can't handle leap years before 1970). (Derick)
-- (Improved error message for invalid fetch mode). (Ilia)
-- (iconv_mime_decode() segmentation fault; with libiconv only). (Tony)
-- (pack() tries to allocate huge memory block when packing float values to strings). (Tony)
-- (imap_mail_compose() crashes with multipart-multiboundary-email). (Ilia)
-- (AIX TZ variable format not understood, yields UTC timezone). (Derick)
-- (whitespace following end of heredoc is lost). (Ilia)
-- (strtotime() crashes on certain relative identifiers). (Ilia)
-- (crash in http:// wrapper on multiple redirects). (Ilia)
-- (strtotime() does not handle 3 character weekdays). (Ilia)
-- (iis6 Access Violation crash). (Dmitry, alacn.uhahaa)
-- (Multiple calls to getopt() may result in a crash). (rabbitt at gmail dot com, Ilia)
-- (Fixed crash in Apache 2 SAPI when more then one php script is loaded via SSI include). (Ilia)
-- (segfault when re-using soap client object). (Dmitry)
-- (mktime() interpreting 3 digit years incorrectly). (Ilia)
-- (php crash when calling non existing method of a class that extends PDO). (Tony)
-- (typo in error message for ErrorException). (Tony)
-- (mysql_field_type() doesn't handle NEWDECIMAL). (Tony)
-- (mysql_stmt_fetch returns NULL on data truncation). (Georg)
-- (string constant as array key has different behavior inside object). (Dmitry)
-- (PDO fails when unknown fetch mode specified). (Tony)
-- (strtotime() does not handle whitespace around the date string). (Ilia)
-- (Crash in mcrypt_generic()/mdecrypt_generic() without proper init). (Ilia)
-- (socket_sendto() unable to handle IPv6 addresses). (Tony)
-- (Ming extension fails to compile with ming 0.3beta1). (Jani)
-- (Segfault or Invalid Opcode 137/1/4). (Dmitry)
-- (Assigning global using variable name from array doesn't function). (Dmitry)
-- (+ 1 [time unit] format did not work). (Ilia)
-- (xml_parse_into_struct() chokes on the UTF-8 BOM). (Rob)
-- (PDO crashes when using LAZY fetch with fetchAll). (Wez)
-- (PDO crashes on incorrect FETCH_FUNC use). (Tony)
-- (str_word_count() handles '-' incorrectly). (Ilia)
-- (idate() function ignores timezone settings). (Ilia)
-- (strtotime() does not parse times with UTC as timezone). (Ilia)
-- (strtotime() no longer works with ordinal suffix). (Ilia)
-- (wddx_deserialize() doesn't handle large ints as keys properly). (Ilia)
-- (undefined reference to 'rl_completion_matches'). (Jani)
-- (Since fix of bug SOAP decoding of soapenc:base64binary fails). (Dmitry)
-- (changing static protected members from outside the class, one more reference issue). (Dmitry)
-- (ssl library is not initialized properly). (Alan)
-- (PDO_SQLITE: undefined reference to "fdatasync"). (Nuno, Jani)
-- (HP-UX "alias not allowed in this configuration"). (Dmitry)
-- (iconv() function defined as libiconv()). (Nuno)
-- (mysqli handles bad unsigned (big)int incorrectly).(Andrey)
-- (socket_read() produces warnings on non blocking sockets). (Nuno, Ilia)
-- (SimpleXML object fails FALSE test). (Marcus)
-- (Crash in ZTS mode under Apache). (Dmitry, Zeev)
-- (Output buffering cannot be turned off with FastCGI). (Dmitry, Ilya)
-- (Possible crash inside fopen http wrapper). (Ilia, Sara, Nuno)
-- (Many Problems with SunFuncs). (Derick)
-- (sun_rise and sun_set don't return a GMT timestamp if one passes an offset). (Derick)
-- (date_sunrise and date_sunset don't handle GMT offset well). (Derick)
-- (is_dir and is_file (incorrectly) return true for any string greater then 255 characters). (Nuno, Ilia)
-- (date_sunrise() & date_sunset() don't handle endless day/night at high latitudes). (Derick)
-- (Remove MessageBox on win32 for E_CORE errors if display_startup_error is off). (Ilia)
-- (mb_strtoupper() / lower() broken with Turkish encoding). (Rui)
-- (mb_substr() and substr() behave differently when "mbstring.func_overload" is enabled). (Rui)
-- (number_format() crashes with large numbers). (Marcus)
-
-
-
-
-
-Version 5.1.1
-
-
-- Disabled native date class to prevent pear::date conflict. (Ilia)
-- Improved safe_mode/open_basedir checks in cURL extension. (Ilia, Jani)
-- Changed reflection constants be both PHP and class constants. (Johannes)
-- Added an additional field $frame['object'] to the result array of debug_backtrace() that contains a reference to the respective object when the frame was called from an object. (Sebastian)
-- (RecursiveDirectoryIterator doesnt appear to recurse with RecursiveFilterIterator). (Marcus)
-- (Removed -dev flag from Zend Engine version). (Ilia)
-- (Regression with \{$ handling). (Ilia)
-- (eval hangs when evall'ed code ends with comment w/o newline). (Marcus)
-- (pdo_mysql::exec does not return number of affected rows). (Tony)
-- (Comment in end of file produces fatal error). (Ilia)
-- (exceptions in interactive mode (php -a) may cause crash). (Dmitry)
-- (Incorrect error messages for PDO class constants). (Ilia)
-- (pdo_pgsql does not handle binary bound params). (Wez)
-- (Application exception trying to create COM object). (Rob)
-- (PHP_AUTH_DIGEST differs under Apache 1.x and 2.x). (Ilia)
-
-
-
-
-
-Version 5.1.0
-
-
-- Added support for class constants and static members for internal classes. (Dmitry, Michael Wallner)
-- Added "new_link" parameter to mssql_connect() (Bug ). (Frank)
-- Added missing safe_mode checks for image* functions and cURL. (Ilia)
-- Added missing safe_mode/open_basedir checks for file uploads. (Ilia)
-- Added PDO_MYSQL_ATTR_USE_BUFFERED_QUERY parameter for pdo_mysql. (Ilia)
-- Added date_timezone_set() function to set the timezone that the date functions will use. (Derick)
-- Added pg_fetch_all_columns() function to fetch all values of a column from a result cursor. (Ilia)
-- Added support for LOCK_EX flag for file_put_contents(). (Ilia)
-- Added bindto socket context option. (Ilia)
-- Added offset parameter to the stream_copy_to_stream() function. (Ilia)
-- Added offset & length parameters to substr_count() function. (Ilia)
-- Added man pages for "phpize" and "php-config" scripts. (Jakub Vrana)
-- Added support for .cc files in extensions. (Brian)
-- Added PHP_INT_MAX and PHP_INT_SIZE as predefined constants. (Andrey)
-- Added user opcode API that allow overloading of opcode handlers. (Dmitry)
-- Added an optional remove old session parameter to session_regenerate_id(). (Ilia)
-- Added array type hinting. (Dmitry)
-- Added the tidy_get_opt_doc() function to return documentation for configuration options in tidy. (Patch by: nlopess@php.net)
-- Added support for .cc files in extensions. (Brian)
-- Added imageconvolution() function which can be used to apply a custom 3x3 matrix convolution to an image. (Pierre)
-- Added optional first parameter to XsltProcessor::registerPHPFunctions to only allow certain functions to be called from XSLT. (Christian)
-- Added the ability to override the autotools executables used by the buildconf script via the PHP_AUTOCONF and PHP_AUTOHEADER environmental variables. (Jon)
-- Added several new functions to support the PostgreSQL v3 protocol introduced in PostgreSQL 7.4. (Christopher)
-
- - pg_transaction_status() - in-transaction status of a database connection.
- - pg_query_params() - execution of parameterized queries.
- - pg_prepare() - prepare named queries.
- - pg_execute() - execution of named prepared queries.
- - pg_send_query_params() - async equivalent of pg_query_params().
- - pg_send_prepare() - async equivalent of pg_prepare().
- - pg_send_execute() - async equivalent of pg_execute().
- - pg_result_error_field() - highly detailed error information, most importantly the SQLSTATE error code.
- - pg_set_error_verbosity() - set verbosity of errors.
-
-- Added optional fifth parameter "count" to preg_replace_callback() and preg_replace() to count the number of replacements made. FR . (Andrey)
-- Added optional third parameter "charlist" to str_word_count() which contains characters to be considered as word part. FR . (Andrey, Ilia)
-- Added interface Serializable. (Stanislav, Marcus)
-- Added pg_field_type_oid() PostgreSQL function. (mauroi at digbang dot com)
-- Added zend_declare_property_...() and zend_update_property_...() API functions for bool, double and binary safe strings. (Hartmut)
-- Added possibility to access INI variables from within .ini file. (Andrei)
-- Added variable $_SERVER['REQUEST_TIME'] containing request start time. (Ilia)
-- Added optional float parameter to gettimeofday(). (Ilia)
-- Added apache_reset_timeout() Apache1 function. (Rasmus)
-- Added sqlite_fetch_column_types() 3rd argument for arrays. (Ilia)
-- Added optional offset parameter to stream_get_contents() and file_get_contents(). (Ilia)
-- Added optional maxlen parameter to file_get_contents(). (Ilia)
-- Added SAPI hook to get the current request time. (Rasmus)
-- Added new functions:
-
- - array_diff_key() (Andrey)
- - array_diff_ukey() (Andrey)
- - array_intersect_key() (Christiano Duarte)
- - array_intersect_ukey() (Christiano Duarte)
- - array_product() (Andrey)
- - DomDocumentFragment::appendXML() (Christian)
- - fputcsv() (David Sklar)
- - htmlspecialchars_decode() (Ilia)
- - inet_pton() (Sara)
- - inet_ntop() (Sara)
- - mysqli::client_info property (Georg)
- - posix_access() (Magnus)
- - posix_mknod() (Magnus)
- - SimpleXMLElement::registerXPathNamespace() (Christian)
- - stream_context_get_default() (Wez)
- - stream_socket_enable_crypto() (Wez)
- - stream_wrapper_unregister() (Sara)
- - stream_wrapper_restore() (Sara)
- - stream_filter_remove() (Sara)
- - time_sleep_until() (Ilia)
-
-- Added DomDocument::$recover property for parsing not well-formed XML Documents. (Christian)
-- Added Cursor support for MySQL 5.0.x in mysqli (Georg)
-- Added proxy support to ftp wrapper via http. (Sara)
-- Added MDTM support to ftp_url_stat. (Sara)
-- Added zlib stream filter support. (Sara)
-- Added bz2 stream filter support. (Sara)
-- Added max_redirects context option that specifies how many HTTP redirects to follow. (Ilia)
-- Added support of parameter=>value arrays to xsl_xsltprocessor_set_parameter(). (Tony)
-- Improved PHP extension loading mechanism with support for module dependencies and conflicts. (Jani, Dmitry)
-- Improved interactive mode of PHP CLI (php -a). (Johannes, Marcus)
-- Improved performance of:
-
- - general execution/compilation. (Andi, Thies, Sterling, Dmitry, Marcus)
- - switch() statement. (Dmitry)
- - several array functions. (Marcus)
- - virtual path handling by adding a realpath() cache. (Andi)
- - variable fetches. (Andi)
- - magic method invocations. (Marcus)
-
-- Improved support for embedded server in mysqli. (Georg)
-- Improved mysqli extension. (Georg)
-
- - added constructor for mysqli_stmt and mysqli_result classes
- - added new function mysqli_get_charset()
- - added new function mysqli_set_charset()
- - added new class mysqli_driver
- - added new class mysqli_warning
- - added new class mysqli_exception
- - added new class mysqli_sql_exception
-
-- Improved SPL extension. (Marcus)
-
- - Moved RecursiveArrayIterator from examples into extension
- - Moved RecursiveFilterIterator from examples into extension
- - Added SplObjectStorage
- - Made all SPL constants class constants
- - Renamed CachingRecursiveIterator to RecursiveCachingIterator to follow Recursive<*>Iterator naming scheme.
- - added standard hierarchy of Exception classes
- - added interface Countable
- - added interfaces Subject and SplObserver
- - added spl_autoload*() functions
- - converted several 5.0 examples into c code
- - added class SplFileObject
- - added possibility to use a string with class_parents() and class_implements(). (Andrey)
-
-- Changed type hints to allow "null" as default value for class and array. (Marcus, Derick, Dmitry)
-- Changed SQLite extension to be a shared module in Windows distribution. (Edin)
-- Changed "instanceof" and "catch" operators, is_a() and is_subclass_of() functions to not call __autoload(). (Dmitry)
-- Changed sha1_file() and md5_file() functions to use streams instead of low level IO. (Uwe)
-- Changed abstract private methods to be not allowed anymore. (Stas)
-- Changed stream_filter_(ap|pre)pend() to return resource. (Sara)
-- Changed mysqli_exception and sqlite_exception to use RuntimeException as base if SPL extension is present. (Georg, Marcus)
-- Upgraded bundled libraries:
-
- - PCRE library to version 6.2. (Andrei)
- - SQLite 3 library in ext/pdo_sqlite to 3.2.7. (Ilia)
- - SQLite 2 library in ext/sqlite to 2.8.16. (Ilia)
-
-- Upgraded bundled libraries in Windows distribution. (Edin)
-
- - zlib 1.2.3
- - curl 7.14.0
- - openssl 0.9.8
- - ming 0.3b
- - libpq (PostgreSQL) 8.0.1
-
-- (Year belonging to ISO week). (Derick)
-- Allowed return by reference from internal functions. (Marcus, Andi, Dmitry)
-- Rewrote strtotime() with support for timezones and many new formats. Implements feature requests , , , , and . (Derick)
-- Moved extensions to PECL:
-
- - ext/cpdf (Tony, Derick)
- - ext/dio (Jani, Derick)
- - ext/fam (Jani, Derick)
- - ext/ingres_ii (Jani, Derick)
- - ext/mnogosearch (Jani, Derick)
- - ext/w32api (Jani, Derick)
- - ext/yp (Jani, Derick)
- - ext/mcve (Jani, Derick, Pierre)
- - ext/oracle (Jani, Derick)
- - ext/ovrimos (Jani, Derick, Pierre)
- - ext/pfpro (Jani, Derick, Pierre)
- - ext/dbx (Jani, Derick)
- - ext/ircg (Jani, Derick)
-
-- Removed php_check_syntax() function which never worked properly. (Ilia)
-- Removed garbage manager in Zend Engine which results in more aggressive freeing of data. (Dmitry, Andi)
-- Fixed "make test" to work for phpized extensions. (Hartmut, Jani)
-- Fixed Apache 2 regression with sub-request handling on non-linux systems. (Ilia, Tony)
-- Fixed PDO shutdown problem (possible infinite loop running rollback on shutdown). (Wez)
-- (PDO: beginTransaction doesn't work if you're in auto-commit mode). (Wez)
-- Fixed ZTS destruction. (Marcus)
-- Fixed __get/__set to allow recursive calls for different properties. (Dmitry)
-- Fixed a bug where stream_get_meta_data() did not return the "uri" element for files opened with tmpname(). (Derick)
-- Fixed a problem with SPL iterators aggregating the inner iterator. (Marcus)
-- Fixed an error in mysqli_fetch_fields (returned NULL instead of an array when row number > field_count). (Georg)
-- Fixed bug in mysql::client_version(). (Georg)
-- Fixed bug in mysqli extension with unsigned int(11) being represented as signed integer in PHP instead of string in 32bit systems. (Andrey)
-- Fixed bug with $HTTP_RAW_POST_DATA not getting set. (Brian)
-- Fixed crash inside stream_get_line() when length parameter equals 0. (Ilia)
-- Fixed ext/mysqli to allocate less memory when fetching bound params of type (MEDIUM|LONG)BLOB/(MEDIUM|LONG)TEXT. (Andrey)
-- Fixed extension initialization to respect dependencies between extensions. (Wez)
-- Fixed failing queries (FALSE returned) with mysqli_query() on 64 bit systems. (Andrey)
-- Fixed fgetcsv() and fputcsv() inconsistency. (Dmitry)
-- Fixed inheritance check to control return by reference and pass by reference correctly (ArrayAccess can no longer support references correctly). (Marcus, Andi, Dmitry)
-- Fixed initializing and argument checking for posix_mknod(). (Derick)
-- Fixed memory corruption in ImageTTFText() with 64bit systems. (Andrey)
-- Fixed memory corruption in pg_copy_from() in case the as_null parameter was passed. (Derick)
-- Fixed memory corruption in stristr(). (Derick)
-- Fixed possible GLOBALS variable override when register_globals are ON. (Ilia, Stefan)
-- Fixed possible INI setting leak via virtual() in Apache 2 sapi. (Ilia)
-- Fixed possible register_globals toggle via parse_str(). (Ilia, Stefan)
-- Fixed potential GLOBALS overwrite via import_request_variables() and possible crash and/or memory corruption. (Ilia)
-- Fixed segfaults when CURL callback functions throw exception. (Tony)
-- Fixed support for shared extensions on AIX. (Dmitry)
-- (isset(DOMNodeList->length) returns false). (Rob)
-- (Fix for bug breaks build with older curl). (Tony)
-- (crash on PDO::FETCH_CLASS + __set()). (Tony)
-- (PDO prepare() crashes with invalid parameters). (Ilia)
-- (PDO segfaults when using persistent connections). (Tony)
-- (Multiple virtual() calls crash Apache 2 php module). (Ilia)
-- (Error in mapping soap - java types). (Dmitry)
-- (compile failure when ext/readline is compiled as shared). (Jani)
-- (sqlite_query() doesn't set error_msg when return value is being used). (Ilia)
-- (php_mblen() crashes when compiled with thread-safety on Linux). (Patch: shulmanb at il dot ibm dot com, Jani)
-- (Objects can lose references). (Dmitry)
-- (call_user_func() crashes when argument_stack is nearly full). (Dmitry)
-- (Destructor is not called). (Tony)
-- (tokenizer extension needs T_HALT_COMPILER). (Greg)
-- (include()/require()/*_once() produce wrong error messages about main()). (Dmitry)
-- (__HALT_COMPILER() breaks with --enable-zend-multibyte). (Dmitry, Moriyoshi)
-- (gettimeofday() ignores current time zone). (Derick)
-- (SOAP Client/Server Complex Object Support). (Dmitry)
-- (PDOStatment without related PDO object may crash). (Ilia)
-- (SoapClient leaks memory). (Dmitry)
-- (stream_set_blocking(true) toggles, not enables blocking). (askalski at gmail dot com, Tony)
-- (configure does not find ldap_start_tls_s). (Jani)
-- (phpinfo() uses improper css enclosure). (Ilia)
-- Fixed bugs , (Regression in the behavior of key() and current() functions). (Ilia)
-- (Exception thrown in error handler may cause unexpected behavior). (Dmitry)
-- (array_product() always returns 0). (Ilia)
-- (ZTS: Persistent resource destruct crashes when extension is compiled as shared). (Dmitry)
-- (ImageTrueColorToPalette() crashes when ncolors is zero). (Tony)
-- (array_walk_recursive() modifies elements outside function scope). (Dmitry)
-- (Compile failure on MacOSX due to use of varargs.h). (Tony)
-- (bz2 extension fails on to build on some win32 setups). (Ilia)
-- (tidy is not binary safe). (Mike)
-- (PHP doesn't respect ACLs for access checks). (Wez)
-- (Unable to get WSDL through proxy). (Dmitry)
-- (dns_get_record() doesn't resolve long hostnames and leaks). (Tony)
-- (Digest authentication does not work with Apache 1). (Ilia)
-- (mysqli::character_set_name() - undefined method). (Tony)
-- (Fixed sqlite extension compile failure). (Ilia)
-- (PHP5.1 overloading, Cannot access private property). (Dmitry)
-- (Possible crash in ext/sqlite when sqlite.assoc_case is being used). (Tony, Ilia)
-- (str_replace, array_map corrupt negative array indexes on 64-bit platforms). (Dmitry)
-- (Segmentation Fault on foreach in object). (Dmitry)
-- (configure fails to detect libiconv's type). (Tony)
-- (ibase_service_attach() segfault on AMD64). (irie at gmx dot de, Tony)
-- (SO_RECVTIMEO and SO_SNDTIMEO socket options expect integer parameter on Windows). (Mike)
-- (--program-suffix and --program-prefix not included in man page names). (Jani)
-- (zlib encoders fail on widely varying binary data on windows). (Mike, Ilia)
-- (several functions crash when invalid mysqli_link object is passed). (Tony)
-- (mysqli::init() and others use wrong $this pointer without checks). (Tony)
-- (FETCH_INTO in PDO crashes without a destination object). (Ilia)
-- (Fixed crash on object instantiation failure). (Ilia)
-- (missing SSL linking in ext/ftp when configured as shared). (Jani)
-- (preg_match_all(), named capturing groups, variable assignment/return => crash). (Dmitry)
-- (SOAP Client not applying correct namespace to generated values). (Dmitry)
-- (SOAP Client not handling boolean types correctly). (Dmitry)
-- (2 @ results in change to error_reporting() to random value) (Dmitry, Tony)
-- (subclassing of mysqli_stmt does not work). (Georg)
-- (token_get_all() gives wrong result). (Dmitry)
-- (Crash in dblib when fetching non-existent error info). (Ilia)
-- (strtotime() fails with 1-12am/pm). (Derick)
-- (Zend Engine 1 Compatibility not copying objects correctly). (Dmitry)
-- (PDO_DBLIB did not implement rowCount()). (Ilia)
-- (iconv_substr() gives "Unknown error" when offset > string length). (Tony)
-- (ftp wrapper failures caused from segmented command transfer). (Ilia)
-- (CLI segmentation faults during cleanup). (Dmitry)
-- (array_count_values() strips leading zeroes). (Tony)
-- (zend.ze1_compatibility_mode = on segfault). (Dmitry)
-- (Infinite recursion due to corrupt JPEG). (Marcus)
-- (__call(), is_callable() and static methods). (Dmitry)
-- (missing support for strtotime("midnight") and strtotime("noon")). (Derick)
-- (ctype corrupts memory when validating large numbers). (Ilia)
-- (wsdl default value has no effect). (Dmitry)
-- (Crash in pdo_mysql on longtext fields). (Ilia)
-- (zend_deactivate: objects_store used after zend_objects_store_destroy is called). (Dmitry)
-- (User defined PDOStatement class can't implement methods). (Marcus)
-- (Segfault with SPL autoload handler). (Marcus)
-- (crash with mod_rewrite). (Tony, Ilia)
-- (mb_send_mail does not fetch mail.force_extra_parameters). (Marco, Ilia)
-- (php -m exits with "error" 1). (Johannes)
-- (Unset doesn't separate container in CV). (Dmitry)
-- (Possible memory corruption when unmangling properties with empty names). (Tony)
-- (Incorrect parsing of url's fragment (#...)). (Dmitry)
-- (foreach + __get + __set inconsistency). (Dmitry)
-- (Possible crash inside pspell extension). (Ilia)
-- (parsing http://www.w3.org/2001/xml.xsd exception). (Dmitry)
-- (Segfault when calling mysqli_close() in destructor). (Tony)
-- (ext/soap: XSD_ANYXML functionality not exposed). (Dmitry)
-- (Possible crash inside curl_multi_remove_handle()). (Ilia)
-- (Fatal error: Cannot re-assign $this). (Dmitry)
-- (php crashes when variables_order is empty). (Ilia)
-- (Possible crash in filter code). (Ilia)
-- (unserialize() crashes with chars above 191 dec). (Nuno)
-- (foreach($arr as $c->d => $x) crashes). (Dmitry)
-- (on_modify handler not called to set the default value if setting from php.ini was invalid). (Andrei)
-- (wddx_serialize_value() crashes with long array keys). (Jani)
-- (date() doesn't have a modifier for ISO Week Day). (Derick)
-- (date('W') do not return leading zeros for week 1 to 9). (Derick)
-- (ReflectionClass::isInstantiable() returns true for abstract classes). (Marcus)
-- (CLI phpinfo showing html on _SERVER["argv"]). (Jani)
-- (array_filter() crashes with references and objects). (Dmitry)
-- (setAttributeNS doesn't work with default namespace). (Rob)
-- (Segfault with callbacks (array_map) + overloading). (Dmitry)
-- (lib64 not handled correctly in ming extension). (Marcus)
-- (Compiling xmlrpc as shared fails other parts). (Jani)
-- (Segfault with autoload). (Marcus)
-- (if($obj)/if(!$obj) inconsistency because of cast handler). (Dmitry, Alex)
-- (ob_gzhandler does not enforce trailing \0). (Ilia)
-- (memory usage remains elevated after memory limit is reached). (Ilia)
-- (+,- and . not supported as parts of scheme). (Ilia)
-- (assigning array element by reference causes binary mess). (Dmitry)
-- (line numbering not maintained in dom document). (Rob)
-- (Reflection API problems in methods with boolean or null default values). (Tony)
-- (Numeric string as array key not cast to integer in wddx_deserialize()). (Ilia)
-- (arr[] as param to function in class gives invalid opcode). (Dmitry)
-- (Crash in catch block when many arguments are used). (Dmitry)
-- (date('U') returns %ld not unix timestamp). (Nuno)
-- (Buffer overflow with serialized object). (Dmitry)
-- (pdo_mysql truncates numeric fields at 4 chars). (Ilia)
-- (object remains object when cast to int). (Dmitry)
-- (No information given for fatal error on passing invalid value to typed argument). (Dmitry)
-- (extract($GLOBALS,EXTR_REFS) crashes PHP). (Dmitry)
-- (php script as ErrorDocument causes crash in Apache 2). (Ilia)
-- (misuse of Exception constructor doesn't display errorfile). (Jani)
-- (Wrong use of reflectionproperty causes a segfault). (Tony)
-- (mssql_bind() fails on input parameters). (Frank)
-- (duplicate cookies and magic_quotes=off may cause a crash). (Ilia)
-- (gmdate('W')/date('W') sometimes returns wrong week number). (Derick)
-- (array_map() fails to pass by reference when called recursively). (Dmitry)
-- (number_format() output with > 1 char separators). (Jani)
-- (input array keys being escaped when magic quotes is off). (Ilia)
-- (spl_autoload_register class method). (Marcus)
-- (CLI: setting extension_dir=some/path extension=foobar.so does not work). (Jani)
-- (CLI was looking for php.ini in wrong path). (Hartmut)
-- (strtotime() problem with "+1days" format). (Ilia)
-- (pdo sqlite driver forgets to update affected column count on execution of prepared statments). (Ilia)
-- (Informix ESQL version numbering schema changed). (Jani)
-- (mime_content_type() returns text/plain for gzip and bzip files). (Derick)
-- (throw Exception in error handler causes crash). (Dmitry)
-- (error_reporting falls to 0 when @ was used inside try/catch block). (Tony)
-- (cURL needs to implement CRYPTO_callback functions to prevent locking). (Mike, Ilia)
-- (Wrong behavior of constants in class and interface extending). (Dmitry)
-- (php_value overrides php_admin_value). (Dmitry)
-- (mb_encode_mimeheader does not work for multibyte chars). (Rui)
-- (ArrayAccess objects does not initialize $this). (Dmitry)
-- (Crash setting some ini directives in httpd.conf). (Rasmus)
-- (Added detection for partially uploaded files). (Ilia)
-- (substr_compare() crashes with negative offset and length). (Tony)
-- (setcookie() "expires" date format doesn't comply with RFC). (Tony)
-- (LDAP: RootDSE query not possible). (Jani)
-- (strtotime() problem with "Oct17" format). (Derick)
-- (strtotime() doesn't understand "11 Oct" format). (Derick)
-- (date("") crashes). (Derick)
-- (warning with nested calls to functions returning by reference). (Dmitry)
-- (strtotime() defaults to now even on non time string). (Derick)
-- (Different output for strftime() and date()). (Derick)
-- (Memory leak in xmlrpc_encode_request()). (Ilia)
-- (crash if safe_mode is on and session.save_path is changed). (Dmitry)
-- (Add missing support for isset()/unset() overloading to complement the property get/set methods). (Dmitry)
-- (crash after extending MySQLi internal class). (Tony)
-- (cURL handle is not closed on curl_close(). (Ilia)
-- (Compile error undefined reference to ifx_checkAPI). (Jani)
-- (strtoll not available on Tru64). (Jani, Derick)
-- (ext/odbc: check if unixODBC header file exists). (Jani)
-- (strtotime() related bugs). (Derick)
-- (Comprehensive list of incorrect days returned after strtotime() / date() tests). (Derick)
-- (double free() when exporting a ReflectionClass). (Marcus)
-- (crash when retrieving empty LOBs). (Tony)
-- (array_reverse() fails after *sort()), introduced by zend_hash_sort() optimizations in HEAD. (Tony)
-- (CLI Crash when calling php:function from XSLT). (Rob)
-- (Cannot build extensions with phpize on Macosx). (Jani)
-- (throw 1; results in Invalid opcode 108/1/8). (Dmitry)
-- (ReflectionParameter methods do not work correctly). (Dmitry)
-- (php:function no longer handles returned dom objects). (Rob, Joe Orton)
-- (nested array_walk() calls and user array compare functions broken; FCI cache). (Andrei, patch from m.bretz@metropolis-ag.de)
-- (private method accessed by child class). (Dmitry)
-- (iconv_strlen() works only with a parameter of < 3 in length). (Ilia)
-- (array_splice() inconsistent when passed function instead of variable). (Dmitry)
-- (ze1_compatibility_mode does not work as expected). (Dmitry)
-- (Mangled error message when stream fails). (Derick)
-- (segfault when CURL handle is closed in a callback). (Tony)
-- (odbc_next_result does not signal SQL errors with 2-statement SQL batches). (rich at kastle dot com, Tony)
-- ([GCC 4]: 'zend_error_noreturn' aliased to external symbol 'zend_error'). (Dmitry)
-- (relax jpeg recursive loop protection). (Ilia)
-- (Crash when fetching some data types). (Frank)
-- (preg_replace(): magic_quotes_sybase=On makes 'e' modifier misbehave). (Jani)
-- (--enable-session=shared does not build). (Jani)
-- (foreach enumerates private fields declared in base classes). (Dmitry)
-- (Possible crash inside pg_fetch_array()). (Ilia)
-- (Soap extension incorrectly detects HTTP/1.1). (Ilia)
-- (cygwin version of setitimer doesn't accept ITIMER_PROF). (Nuno)
-- (crash in mssql_next result). (Frank)
-- (shtool: insecure temporary file creation). (Jani)
-- (method offsetSet in class extended from ArrayObject crash PHP). (Marcus)
-- (imagecopymergegray() produces mosaic rainbow effect). (Pierre)
-- (crash when assigning class name to global variable in __autoload). (Dmitry)
-- (mysqli_prepare() doesn't return an error). (Georg)
-- (str_ireplace() incorrectly counts result string length and may cause segfault). (Tony)
-- (Add a safemode/open_basedir check for runtime "session.save_path" change using session_save_path() function). (Rasmus)
-- (Improved performance of bzdecompress() by several orders of magnitude). (Ilia)
-- (crash when moving xml attribute set in dtd). (Ilia)
-- (Don't send extraneous entity-headers on a 304 as per RFC 2616 section 10.3.5) (Rasmus, Choitel)
-- (socket errors cause memory leaks in php_strerror()). (jwozniak23 at poczta dot onet dot pl, Tony).
-- ("make distclean" gives an error with VPATH build). (Jani)
-- ("next month" was handled wrong while parsing dates). (Derick)
-- (implemented Iterator function current() don't throw exception). (Dmitry)
-- (ReflectionMethod::getStaticVariables() causes apache2.0.54 seg fault). (Dmitry)
-- (mysql_bind_result() doesn't support MYSQL_TYPE_NULL). (Georg)
-- (Incorrect option for mysqli default password). (Georg)
-- (Disabling session.use_cookies doesn't prevent reading session cookies). (Jani, Tony)
-- (Sending structured SOAP fault kills a php). (Dmitry)
-- (open_basedir looses trailing / in the limiter). (Adam Conrad)
-- (http redirects URLs are not checked for control chars). (Ilia)
-- (Cannot extend class "SQLiteDatabase"). (Marcus)
-- (Oracle LDAP: ldap_get_entries(), invalid pointer). (Jani)
-- (class extending DOMDocument doesn't clone properly). (Rob)
-- (file included with "auto_prepend_file" can be included with require_once() or include_once()). (Stas)
-- (pg_get_notify() ignores result_type parameter). (Tony)
-- (Crash with singleton and __destruct when zend.ze1_compatibility_mode = On). (Dmitry)
-- (Invalid opcode). (Dmitry)
-- (parse_url() does not handle scheme-only urls properly). (Ilia)
-- (temporary files not using plain file wrapper). (Ilia)
-- (Missing T1LIB support on Windows). (Edin)
-- (General cookie overrides more specific cookie). (Ilia)
-- Fixed bugs , (ext/odbc: Problems with 64bit systems). (Jani)
-- (crash: calling the corresponding global var during the destruct). (Dmitry)
-- (SOAP doesn't support one-way operations). (Dmitry)
-- (GMP functions break when second parameter is 0). (Stas)
-- (incorrect determination of default value (COM)). (Wez)
-- (Cannot access safearray properties in VB6 objects). (Wez)
-- (Segfault in replaceChild() when DocumentFragment has no children). (Rob)
-- (Undefined constant SQLITE_NOTADB). (Ilia)
-- (segmentation fault when the stream with a wrapper is not closed). (Tony, Dmitry)
-- (pg_affected_rows() was defined when it was not available). (Derick)
-- (Require/include file in destructor causes segfault). (Marcus)
-- (ext/mssql: Error on module shutdown when called from activescript). (Frank)
-- (exception in iterator causes crash). (Dmitry)
-- (Assignment by reference causes crash when field access is overloaded (__get)). (Dmitry)
-- (Using register_shutdown_function() with invalid callback can crash PHP). (Jani)
-- (Segfault in replaceChild() using fragment when previousSibling is NULL). (Rob)
-- (ext/snmp: use of snmp_shutdown() causes snmpapp.conf access errors). (Jani, ric at arizona dot edu)
-- (html_entity_decode() converts single quotes even if ENT_NOQUOTES is given). (Ilia)
-- (Segfault/Memory Leak by getClass (etc) in __destruct). (Dmitry)
-- (ext/mysql: Unsatisfied symbol: ntohs with HP-UX). (Jani)
-- (possible crash inside imap_mail_compose() function). (Ilia)
-- (Possible crash inside imap_mail_compose, with charsets). (Ilia)
-- (Apache2: errors sent to error_log do not include timestamps). (Jani)
-- (configure looks for incorrect db2 library). (Tony)
-- (mmap loads only the 1st 2000000 bytes on Win32). (Ilia)
-- (proc_get_status() returns the incorrect process status). (Ilia)
-- (chunk_split() does not append endstr if chunklen is longer then the original string). (Ilia)
-- (File upload error - unable to create a temporary file). (Uwe Schindler)
-- (wrong setting property to unset value). (Dmitry)
-- (method_exists() always return TRUE if __call method exists). (Dmitry)
-- (The @ warning error suppression operator is broken). (Dmitry)
-- (Interfaces are not allowed 'static' access modifier). (Dmitry)
-- (mysqli::fetch() returns bad data - 64bit problem). (Andrey)
-- (get_class_methods() output has changed between 5.0.2 and 5.0.3). (Dmitry)
-- (Segfault in mysqli_fetch_array on 64-bit). (Georg)
-- (xml_parser_free() in a function assigned to the xml parser gives a segfault). (Rob)
-- (xmlrpc_encode() segfaults with recursive references). (Tony)
-- (Userspace stream wrapper crashes PHP). (Tony, Dmitry)
-- (copying a file into itself leads to data loss). (Ilia)
-- (SOAP client does not auto-handle base64 encoding). (Ilia)
-- ($_POST is not populated in multi-threaded environment). (Moriyoshi)
-- (segfault when assigning object to itself with zend.ze1_compatibility_mode=On). (Dmitry)
-- (Crash caused by range('', 'z')). (Derick)
-- (ext/mysqli bind_result causes fatal error: memory limit). (Andrey)
-- (Memory leak in mssql_fetch_batch). (fmk)
-- (crash when mssql_bind() is called more than once). (Frank)
-- (ftp_login fails on some SSL servers). (frantisek at augusztin dot com)
-- (ISAPI: Custom 5xx error does not return correct HTTP response message). (Jani)
-- (Crash with zend.ze1_compatibility_mode=On). (Dmitry)
-- (multi_query works exactly every other time - multi query d/e flag global and not per connection). (Andrey)
-- (another crash when echoing a COM object). (Wez)
-- (php_std_date() uses short day names in non-y2k_compliance mode). (mike at php dot net)
-- (object reference being dropped. $this getting lost). (Stas, Dmitry)
-- (Wrong deserialization from session when using WDDX serializer). (Dmitry)
-- (segfault with empty() / isset()). (Moriyoshi)
-- (False warning in unpack() when working with *). (Ilia)
-- (broken non-blocking flock()). (ian at snork dot net)
-- (Older GCC versions do not provide portable va_copy()). (Jani)
-- (escape on curly inconsistent). (Dmitry)
-- (PHP_EVAL_LIBLINE configure macro does not handle -pthread). (Jani)
-- (Side effects caused by fix of bug ). (Dmitry)
-- (memory leaks and corruption because of incorrect refcounting). (Dmitry)
-- (array_splice on $GLOBALS crashes). (Dmitry)
-- (safe_mode & open_basedir checks only check first include_path value). (Ilia)
-- (php:function(string, nodeset) with xsl:key crashes PHP). (Rob)
-- (Wrong line number in ReflectionClass getStartLine()). (Dmitry)
-- (Conflict between __get/__set and ++ operator). (Dmitry)
-- (array_count_values() modifying input array). (Tony)
-- (debug_backtrace() reports incorrect class in overridden methods). (Dmitry)
-- (static member conflict with $this->member silently ignored). (Dmitry)
-- (Better support for LDAP SASL bind). (Jani)
-- (magic methods (__sleep/__wakeup/__toString) call __call if object is overloaded). (Dmitry)
-- (Segmentation fault on exception in method). (Stas, Dmitry)
-- (cannot initialize class variable from class constant). (Dmitry)
-- (Output buffers flushed before calling __destruct() functions). (Jani)
-- (Interface not existing says Class not found). (Dmitry)
-- (Strange behavior of default arguments). (Dmitry)
-- (Assignment operators yield wrong result with __get/__set). (Dmitry)
-- (zend.ze1_compatibility_mode isn't fully compatible with array_push()). (Dmitry)
-- (Catching exception in constructor causes lose of $this). (Dmitry)
-- (Problem with array in static properties). (Dmitry)
-- (Enhancement for error message for abstract classes). (Marcus)
-- (gmmktime does not return the current time). (Derick)
-- (Passing array or non array of objects). (Dmitry)
-- (Crash on shutdown after odbc_pconnect()). (Edin)
-- (PHP does not explicitly set mime type & charset). (Ilia)
-- (memory leaks when set_error_handler() is used inside error handler). (Tony)
-- (variables_order behavior). (Dmitry)
-- (Function defined in switch, crashes). (Dmitry)
-- (Backtrace argument list out of sync). (Dmitry)
-- (Reflection API Feature: Default parameter value). (Marcus)
-- (default value of protected member overrides default value of private and other private variable problems in inherited classes). (Stas)
-- (headers_list() returns empty array). (Tony)
-- (crash when echoing a COM object). (M.Sisolak, Wez)
-- (accessing properties without connection). (Georg)
-- (var_export() producing invalid code). (Derick)
-- (unencoded spaces get ignored after certain tags). (Ilia)
-- (fetch functions now use MYSQLI_BOTH as default). (Georg)
-- (win32 mail() provides incorrect Date: header). (Jani)
-- (calling parent constructor in mysqli). (Georg)
-- (__autoload() not called with Reflection->getClass()). (Dmitry)
-- (SOAP HTTP Error when envelop size is more than 24345 bytes). (Dmitry, Wez)
-- (array_diff with $GLOBALS argument fails). (Dmitry)
-- (memory error when wsdl-cache is enabled). (Dmitry)
-- (Function: is_callable - no support for private and protected classes). (Dmitry)
-- (SoapFault exception: [WSDL] Out of memory). (Dmitry)
-- (Function declaration in method doesn't work). (Dmitry)
-- (soap extension segfaults). (Dmitry)
-- (Incorrect behavior of member vars(non string ones)-numeric mem vars and others). (Dmitry)
-- (__getTypes() returning nothing on complex WSDL). (Dmitry)
-- (Wrong data encoding of special characters). (Dmitry)
-- (SIGSEGV in interactive mode (php -a)). (kameshj at fastmail dot fm)
-- (Need to use -[m]ieee option for Alpha CPUs). (Jani)
-- (SAPI::known_post_content_types is not thread safe). (Moriyoshi)
-- (debug_backtrace is intermittently passing args). (Dmitry)
-- (glob wont error if dir is not readable). (Hartmut)
-- (static array with some constant keys will be incorrectly ordered). (Dmitry)
-- (xml default_handlers not being called). (Rob)
-- (list() array key assignment causes HUGE memory leak). (Dmitry)
-- (Bad references accentuated by clone). (Dmitry)
-- (Wrong results from Reflection-API getDocComment() when called via STDIN). (Dmitry)
-- (In error handler, modifying 5th arg (errcontext) may result in seg fault). (Dmitry)
-- (array_multisort() doesn't work in a function if array is global or reference). (Dmitry)
-- (returning reference to uninitialized variable). (Dmitry)
-- (ext/sesssion: catch bailouts of write handler during RSHUTDOWN). (Jani, Xuefer at 21cn dot com)
-- (boolean ini options may be incorrectly displayed as Off when they are On). (Tony)
-- Fixed bugs , , , , , , , , , , (strtotime() related bugs). (Derick)
-
-
-
-
-
-
-Version 5.0.5
-
-
-- Upgraded PCRE library to version 5.0. (Andrei)
-- Removed php_check_syntax() function which never worked properly. (Ilia)
-- Added new function mysqli_set_charset(). (Georg)
-- Added man pages for "phpize" and "php-config" scripts. (Jakub Vrana)
-- Added support for .cc files in extensions. (Brian)
-- Added PHP_INT_MAX and PHP_INT_SIZE as predefined constants. (Andrey)
-- Changed sha1_file() and md5_file() functions to use streams instead of
- low level IO. (Uwe)
-- Changed ming to support official 0.2a and 0.3 library versions. (Marcus)
-- Fixed failing queries problem (FALSE returned) with mysqli_query() on 64 bit.
- (Andrey)
-- Fixed memory corruption in pg_copy_from() in case the as_null parameter was
- passed. (Derick)
-- Fixed ext/mysqli to allocate less memory when fetching bound params
- of type (MEDIUM|LONG)BLOB/(MEDIUM|LONG)TEXT. (Andrey)
-- Fixed memory corruption in ImageTTFText() with 64bit systems. (Andrey)
-- Fixed memory corruption in stristr(). (Derick)
-- Fixed segfaults when CURL callback functions throw exception. (Tony)
-- Fixed various reentrancy bugs in user-sort functions, solves bugs and
- . (Mike Bretz)
-- (on_modify handler not called to set the default value if
- setting from php.ini was invalid). (Andrei)
-- (date('W') do not return leading zeros for week 1 to 9).
- (Derick)
-- (ReflectionClass::isInstantiable() returns true for abstract
- classes). (Marcus)
-- (array_filter() crashes with references and objects).
- (Dmitry)
-- (Segfault with callbacks (array_map) + overloading).
- (Dmitry)
-- (assigning array element by reference causes binary mess).
- (Dmitry)
-- (Reflection API problems in methods with boolean or
- null default values). (Tony)
-- (arr[] as param to function is allowed only if function
- receives argument by reference). (Dmitry)
-- (Crash in catch block when many arguments are used).
- (Dmitry)
-- (extract($GLOBALS,EXTR_REFS) crashes PHP). (Dmitry)
-- (array_map() fails to pass by reference when called
- recursively). (Dmitry)
-- (php:function call __autoload with lowercase param). (Marcus)
-- (throw Exception in error handler causes crash). (Dmitry)
-- (php_value overrides php_admin_value). (Dmitry)
-- (ArrayAccess objects doen't initialize $this). (Dmitry)
-- (LDAP: RootDSE query not possible). (Jani)
-- (warning with nested calls to functions returning by
- reference). (Dmitry)
-- (crash if safe_mode is on and session.save_path is changed).
- (Dmitry)
-- (crash after extending MySQLi internal class). (Tony)
-- (CLI Crash when calling php:function from XSLT). (Rob)
-- (private method accessed by child class). (Dmitry)
-- (iconv_strlen() works only with a parameter of < 3 in
- length). (Ilia)
-- (mysqli_real_escape doesn't work in __construct) (Georg)
-- (array_splice() inconsistent when passed function instead
- of variable). (Dmitry)
-- (ze1_compatibility_mode does not work as expected). (Dmitry)
-- (Mangled error message when stream fails). (Derick)
-- (segfault when CURL handle is closed in a callback). (Tony)
-- (odbc_next_result does not signal SQL errors with
- 2-statement SQL batches). (rich at kastle dot com, Tony)
-- (relax jpeg recursive loop protection). (Ilia)
-- (preg_replace(): magic_quotes_sybase=On makes 'e' modifier
- misbehave). (Jani)
-- (--enable-session=shared does not build). (Jani)
-- (foreach enumerates private fields declared in base
- classes). (Dmitry)
-- (Soap extension incorrectly detects HTTP/1.1). (Ilia)
-- (cygwin version of setitimer doesn't accept ITIMER_PROF).
- (Nuno)
-- (crash when assigning class name to global variable in
- __autoload). (Dmitry)
-- (mysqli_prepare() doesn't return an error). (Georg)
-- (str_ireplace() incorrectly counts result string length
- and may cause segfault). (Tony)
-- (Add a safemode/open_basedir check for runtime
- "session.save_path" change using session_save_path() function). (Rasmus)
-- (Improved performance of bzdecompress() by several orders
- of magnitude). (Ilia)
-- (crash when moving xml attribute set in dtd). (Ilia)
-- (Don't send extraneous entity-headers on a 304 as per
- RFC 2616 section 10.3.5) (Rasmus, Choitel)
-- (socket errors cause memory leaks in php_strerror()).
- (jwozniak23 at poczta dot onet dot pl, Tony).
-- ("make distclean" gives an error with VPATH build). (Jani)
-- ("next month" was handled wrong while parsing dates).
- (Derick)
-- (ReflectionMethod::getStaticVariables() causes apache2.0.54
- seg fault). (Dmitry)
-- (mysql_bind_result() doesn't support MYSQL_TYPE_NULL). (Georg)
-- (Incorrect option for mysqli default password). (Georg)
-- (Disabling session.use_cookies doesn't prevent reading
- session cookies). (Jani, Tony)
-- (Sending structured SOAP fault kills a php). (Dmitry)
-- (http redirects URLs are not checked for control chars). (Ilia)
-- (Cannot extend class "SQLiteDatabase"). (Marcus)
-- (Oracle LDAP: ldap_get_entries(), invalid pointer). (Jani)
-- (class extending DOMDocument doesn't clone properly). (Rob)
-- (pg_get_notify() ignores result_type parameter). (Tony)
-- (Crash with singleton and __destruct when
- zend.ze1_compatibility_mode = On). (Dmitry)
-- (parse_url() does not handle scheme-only urls properly). (Ilia)
-- (temporary files not using plain file wrapper). (Ilia)
-- (Missing T1LIB support on Windows). (Edin)
-- (General cookie overrides more specific cookie). (Ilia)
-- Fixed bugs , (ext/odbc: Problems with 64bit systems). (Jani)
-- (crash: calling the corresponding global var during the
- destruct). (Dmitry)
-- (SOAP doesn't support one-way operations). (Dmitry)
-- (GMP functions break when second parameter is 0). (Stas)
-- (incorrect determination of default value (COM)). (Wez)
-- (Cannot access safearray properties in VB6 objects). (Wez)
-- (Segfault in replaceChild() when DocumentFragment has
- no children). (Rob)
-- (Undefined constant SQLITE_NOTADB). (Ilia)
-- (segmentation fault when the stream with a wrapper
- is not closed). (Tony, Dmitry)
-- (pg_affected_rows() was defined when it was not available).
- (Derick)
-- (Require/include file in destructor causes segfault).
- (Marcus)
-- (ext/mssql: Error on module shutdown when called from
- activescript). (Frank)
-- (exception in iterator causes crash). (Dmitry)
-- (Assignment by reference causes crash when field access is
- overloaded (__get)). (Dmitry)
-- (Using register_shutdown_function() with invalid callback
- can crash PHP). (Jani)
-- (Segfault in replaceChild() using fragment when
- previousSibling is NULL). (Rob)
-- (ext/snmp: use of snmp_shutdown() causes snmpapp.conf
- access errors). (Jani, ric at arizona dot edu)
-- (html_entity_decode() converts single quotes even if
- ENT_NOQUOTES is given). (Ilia)
-- (Segfault/Memory Leak by getClass (etc) in __destruct).
- (Dmitry)
-- (ext/mysql: Unsatisfied symbol: ntohs with HP-UX). (Jani)
-- (Possible crash inside imap_mail_compose, with charsets).
- (Ilia)
-- (Apache2: errors sent to error_log do not include
- timestamps). (Jani)
-- (configure looks for incorrect db2 library). (Tony)
-- (mmap loads only the 1st 2000000 bytes on Win32). (Ilia)
-- (proc_get_status() returns the incorrect process status). (Ilia)
-- (chunk_split() does not append endstr if chunklen is
- longer then the original string). (Ilia)
-- (File upload error - unable to create a temporary file).
- (Uwe Schindler)
-- (mysqli::fetch() returns bad data - 64bit problem). (Andrey)
-- (Segfault in mysqli_fetch_array on 64-bit). (Georg)
-- (get_class_methods() output has changed between 5.0.2 and
- 5.0.3). (Dmitry)
-- (xml_parser_free() in a function assigned to the xml parser
- gives a segfault). (Rob)
-- (Userspace stream wrapper crashes PHP). (Tony, Dmitry)
-- (segfault when assigning object to itself with
- zend.ze1_compatibility_mode=On). (Dmitry)
-- (ext/mysqli bind_result causes fatal error: memory
- limit). (Andrey)
-- (ISAPI: Custom 5xx error does not return correct HTTP
- response message). (Jani)
-- (Crash with zend.ze1_compatibility_mode=On). (Dmitry)
-- (multi_query works exactly every other time - multi query
- d/e flag global and not per connection). (Andrey)
-- (another crash when echoing a COM object). (Wez)
-- (php_std_date() uses short day names in non-y2k_compliance
- mode). (mike at php dot net)
-- (object reference being dropped. $this getting lost).
- (Stas, Dmitry)
-- (Wrong deserialization from session when using WDDX
- serializer). (Dmitry)
-- (False warning in unpack() when working with *). (Ilia)
-- (broken non-blocking flock()). ian at snork dot net
-- (Sideeffects caused by fix of bug . (Dmitry)
-- (array_splice on $GLOBALS crashes). (Dmitry)
-- (Wrong linenumber in ReflectionClass getStartLine()).
- (Dmitry)
-- (Conflict between __get/__set and ++ operator). (Dmitry)
-- (array_count_values() modifying input array). (Tony)
-- (debug_backtrace() reports incorrect class in overridden
- methods). (Dmitry)
-- (static member conflict with $this->member silently
- ignored). (Dmitry)
-- (Better support for LDAP SASL bind). (Jani)
-- (magic methods (__sleep/__wakeup/__toString) call __call if
- object is overloaded). (Dmitry)
-- (Segmentation fault on exception in method). (Stas, Dmitry)
-- (cannot initialize class variable from class constant).
- (Dmitry)
-- (Interface not existing says Class not found). (Dmitry)
-- (Assignment operators yield wrong result with __get/__set).
- (Dmitry)
-- (zend.ze1_compatibility_mode isnt fully compatable with
- array_push()). (Dmitry)
-- (Catching exception in constructor causes lose of $this).
- (Dmitry)
-- (Problem with array in static properties). (Dmitry)
-- (Enhancement for error message for abstract classes).
- (Marcus)
-- (Passing array or non array of objects). (Dmitry)
-- (memory leaks when set_error_handler() is used inside error
- handler). (Tony)
-- (variables_order behaviour). (Dmitry)
-- (Function defined in switch, crashes). (Dmitry)
-- (Backtrace argument list out of sync). (Dmitry)
-- (headers_list() returns empty array). (Tony)
-- (crash when echoing a COM object). (M.Sisolak, Wez)
-- (unencoded spaces get ignored after certain tags). (Ilia)
-- (Function: is_callable - no support for private and
- protected classes). (Dmitry)
-- (Function declaration in method doesn't work). (Dmitry)
-- (Incorrect behavior of member vars(non string ones)-numeric
- mem vars und others). (Dmitry)
-- (SIGSEGV in interactive mode (php -a)).
- (kameshj at fastmail dot fm)
-- (Need to use -[m]ieee option for Alpha CPUs). (Jani)
-- (debug_backtrace is intermittently passing args). (Dmitry)
-- (list() array key assignment causes HUGE memory leak).
- (Dmitry)
-- (Wrong results from Reflection-API getDocComment() when
- called via STDIN). (Dmitry)
-- (In error handler, modifying 5th arg (errcontext) may result
- in seg fault). (Dmitry)
-- (returning reference to uninitialized variable). (Dmitry)
-- (default value of protected member overrides default value of private)
- and other private variable problems in inherited classes (Stas)
-- (array_diff with $GLOBALS argument fails). (Dmitry)
-- Abstract private methods are no longer allowed (Stas)
-
-
-
-
-
-Version 5.0.4
-
-
-- Added SNMPv2 support. (harrie)
-- Added Oracle Instant Client support. (cjbj at hotmail dot com, Tony)
-- Added length and charsetnr for field array and object in mysqli. (Georg)
-- Added checks for negative values to gmp_sqrt(), gmp_powm(), gmp_sqrtrem()
- and gmp_fact() to prevent SIGFPE. (Tony)
-- Changed foreach() to throw an exception if IteratorAggregate::getIterator()
- does not return an Iterator. (Marcus)
-- Changed phpize not to require libtool. (Jani)
-- Updated bundled oniguruma library (used for multibyte regular expression)
- to 3.7.0. (Moriyoshi)
-- Updated bundled libmbfl library (used for multibyte functions). (Moriyoshi)
Fixed bugs:
-
- - Bug (mb_convert_encoding ignores named entity 'alpha')
- - Bug (mb_decode_mimeheader() is case-sensitive to hex escapes)
- - Bug (compiler warnings in libmbfl due to invalid type cast)
- - Bug (incorrect character translations for some ISO8859 charsets)
-
-- Fixed bug preventing from building oci8 as shared.
- (stanislav dot voroniy at portavita dot nl, Tony)
-- Fixed a bug in mysql_affected_rows and mysql_stmt_affected_rows when the
- api function returns -1 (Georg)
-- Fixed several leaks in ext/browscap and sapi/embed. (Andrei)
-- Fixed several leaks in ext/filepro. (Tony)
-- Fixed build system to always use bundled libtool files. (Jani)
-- Fixed a bug in mysqli_stmt_execute() (type conversion with NULL values).
- (Georg)
-- Fixed segfault in mysqli_fetch_field_direct() when invalid field offset
- is passed. (Tony)
-- Fixed posix_getsid() & posix_getpgid() to return sid & pgid instead
- of true. (Tony)
-- (offsetUnset() segfaults in a foreach). (Marcus)
-- (segfault in bzopen() if supplied path to non-existent
- file). (Tony)
-- (Check values of Connection/Transfer-Encoding
- case-incentively in SOAP extension). (Ilia)
-- (call_user_func_array() calls wrong class method within
- child class). (Marcus)
-- (spl_array.c: void function cannot return value). (Johannes)
-- (proc_get_status() sets "running" always to true). (Ilia)
-- (Prevent using both --with-apxs2 and --with-apxs2filter).
- (Jani)
-- (Overloading offsetGet/offsetSet). (Marcus)
-- (ArrayIterator::seek() does not throw an Exception on
- invalid index). (Marcus)
-- (dateTime SOAP encoding of timezone incorrect). (Dmitry)
-- (in mysqli default socket value is not being used). (Ilia)
-- (Crash caused by range('', 'z')). (Derick)
-- (Fragments which replaced Nodes are not globaly useable).
- (Rob)
-- (xml_parse_into_struct() function exceeds maximum
- execution time). (Rob, Moriyoshi)
-- (Unicode exif data not available on Windows). (Edin)
-- (getrusage() does not provide ru_nswap value). (Ilia)
-- (msql_fetch_row() and msql_fetch_array() dropping columns
- with NULL values). (Daniel Convissor)
-- (Segmentation fault using clone keyword on nodes). (Rob)
-- (--disable-cli does not force --without-pear). (Jani)
-- (*date('r') does not return RFC2822 conforming date string).
- (Jani)
-- (SOAP encoding problem with complex types in WSDL mode with
- multiple parts). (Dmitry)
-- (exif_read_data() uses too low nesting limit). (Ilia)
-- (readline completion handler does not handle empty return
- values). (Ilia)
-- (Cannot create SOAP header in no namespace). (Dmitry)
-- (dbase_open() fails for mode = 1). (Mehdi, Derick)
-- (pg_parameter_status() missing on Windows). (Edin)
-- (SOAP Digest Authentication doesn't work with
- "HTTP/1.1 100 Continue" response). (Dmitry)
-- (mb_get_info() causes segfault when no parameters
- specified). (Tony)
-- (Wrong return values for mysqli_autocommit/commit/rollback).
- (Georg)
-- (parse_url() does not recognize http://foo.com#bar). (Ilia)
-- (Cannot redefine endpoint when using WSDL). (Dmitry)
-- (dio_tcsetattr(): misconfigured termios settings).
- (elod at itfais dot com)
-- (changes to $name in __get($name) override future
- parameters). (Dmitry)
-- (unserialize() float problem on non-English locales). (Ilia)
-- (__autoload() problem with static variables). (Marcus)
-- (ReflectionClass::getDefaultProperties segfaults with arrays).
- (Marcus)
-- (OCILogin does not support password grace period).
- (daniel dot beet at accuratesoftware dot com, Tony)
-- (crash in msg_send() when non-string is stored without
- being serialized). (Ilia)
-- (Improve performance of scandir() by factor of 10 or so). (Ilia)
-- (open_basedir uses path_translated rather then cwd for .
- translation). (Ilia)
-- (Possible infinite loop in imap_mail_compose()). (Ilia)
-- (Fixed crash in chunk_split(), when chunklen > strlen). (Ilia)
-- (False warning in unpack() when working with *). (Ilia)
-- (session_set_save_handler crashes PHP when supplied
- non-existent object ref). (Tony)
-- (Memory leak in zend_language_scanner.c).
- (hexer at studentcenter dot org)
-- (unserialize broken on 64-bit systems). (Marcus)
-- ($GLOBALS can be overwritten via GPC when register_globals
- is enabled). (Ilia)
-- (No Error-Logging on SoapServer-Side). (Dmitry)
-- (curl POSTFIELDS crashes on 64-bit platforms). (Joe)
-- (compile fails with gd 2.0.33 without freetype). (Jani)
-- (highlight_file() trims new line after heredoc). (Ilia)
-- (simplexml/domxml segfault when adding node twice). (Rob)
-- (CachingIterator::rewind() leaks). (Marcus)
-- (ArrayIterator::next segfaults). (Marcus)
-- (Unexpected warning then exception is thrown from
- call_user_func_array()). (phpbugs at domain51 dot net, Dmitry)
-- (imap_mail_compose() fails to generate correct output). (Ilia)
-- (XML Parser Functions seem to drop & when parsing). (Rob)
-- (When magic_guotes_gpc are enabled filenames with ' get cutoff).
- (Ilia)
-- (Possible crash in mysql_fetch_field(), if mysql_list_fields()
- was not called previously). (Ilia)
-- , , , (Compile failure of zend_strtod.c).
- (Jani)
-- (PHP 4.3.10 does not compile on Tru64 UNIX 5.1B). (Derick)
-- (Compile failure on Solaris 9 (Intel) and gcc 3.4.3). (Derick)
-- (Better error message when c-client cannot be found). (Ilia)
-- (missing kerberos header file path with --with-openssl). (Jani)
-- (isset() / empty() incorrectly return true in dereference of
- a string type). (Moriyoshi)
-- (broken php_url_encode_hash macro). (Ilia)
-- (var_export() does not output an array element with an empty
- string key). (Derick)
-- (imageftbbox() does not use linespacing parameter). (Jani)
-- (php_std_date() returns invalid formatted date if
- y2k_compliance is On). (Ilia)
-- (apache2filter: per request leak proportional to the full
- path of the request URI). (kameshj at fastmail dot fm)
-- (can't send cookies with soap envelop). (Dmitry)
-- (Misleading warning message for array_combine()). (Andrey)
-- (evaluated pointer comparison in mbregex causes compile
- failure). (Moriyoshi)
-- (Static array with boolean indexes). (Marcus)
-- (-.1 like numbers are not being handled correctly). (Ilia)
-- (PHP segfaults when an exception is thrown in getIterator()
- within foreach). (Marcus)
-- (cURL functions bypass open_basedir). (Jani)
-- (apache2handler: virtual() includes files out of sequence)
-- (odbc_next_result() doesn't bind values and that results
- in segfault). (pdan-php at esync dot org, Tony)
-- (Invalid opcode 137/1/8). (Marcus)
-- (imagettftext() and imagettfbbox() accept too many
- parameters). (Jani)
-- (SOAP cannot not parse 'ref' element. Causes Uncaught
- SoapFault exception). (Dmitry)
-- (type re_registers redefined in oniguruma.h). (Moriyoshi)
-- (enabled debug causes bailout errors with CLI on AIX
- because of fflush() called on already closed filedescriptor). (Tony)
-- (Weird behaviour of __set($name, $value)). (Dmitry)
-- (printf() handles repeated placeholders wrong).
- (bugs dot php dot net at bluetwanger dot de, Ilia)
-- (width and height inverted for JPEG2000 files). (Ilia)
-- (configure for mysqli with shared doesn't work). (Georg)
-- (make test libtool failure on MacOSX). (Jani)
-- (mail(): use "From:" from headers if sendmail_from is empty).
- (Jani)
-- (PHP sources pick wrong header files generated by bison).
- (eggert at gnu dot org, Jani)
-- (__destruct of a class that extends mysqli not called).
- (Marcus)
-- (ini-file section parsing pattern is buggy).
- (wendland at scan-plus dot de)
-- (corrupt EXIF headers have unlimited recursive IFD directory
- entries). (Andrei)
-- (Cannot access undefined property for object with overloaded
- property access). (Dmitry)
-- (Changing a static variables in a class changes it across
- sub/super classes.) (Marcus)
-- (HTTP_SESSION_VARS appear when register_long_arrays is
- Off). (Tony)
-- (FastCGI: stderr should be written in a FCGI stderr stream).
- (chris at ex-parrot dot com)
-- (partially incorrect utf8 to htmlentities mapping). (Derick,
- Benjamin Greiner)
-- (SOAP HTTP Digest Access Authentication). (Dmitry)
-- (Double \r problem on ftp_get in ASCII mode on Win32). (Ilia)
-- (Multiple OUs in x509 certificate not handled properly).
- (Jani)
-
-
-
-
-
-Version 5.0.3
-
-
-- Added the %F modifier to *printf to render a non-locale-aware representation of a float with the . as decimal seperator. (Derick)
-- Fixed error handling in mysqli_multi_query. (Georg)
-- Extended the functionality of is_subclass_of() to accept either a class name or an object as first parameter. (Andrey)
-- Fixed potential problems with unserializing invalid serialize data. (Marcus)
-- (Problem with non-existing iconv header file). (Derick)
-- (snmp extension does not build with net-snmp 5.2). (Ilia)
-- (SOAP server unable to handle request with references). (Dmitry)
-- (allow popen() on *NIX to accept 'b' flag). (Ilia)
-- (properties in extended mysqli classes don't work). (Georg)
-- (When Using WSDL, SoapServer doesn't handle private or protected properties). (Dmitry)
-- (reflective functions crash PHP when interfaces extend themselves). (Tony, Dmitry)
-- (segfault when recording soapclient into session). (Tony, Dmitry)
-- (MySQLi testsuite)
-- (ReflectionClass::getStaticProperties segfaults). (Marcus)
-- ("!" stripped off comments in xml parser). (Rob)
-- (SoapServer doesn't handle private or protected properties). (Dmitry)
-- (Apache crash when using ReflectionFunction:: getStaticVariables()). (Marcus)
-- (Meaningful error message when upload directory is not accessible). (Ilia)
-- (Malformed SOAPClient http header reequest). (Dmitry)
-- (Problem handling exif data in jpeg images at unusual places). (Marcus)
-- (Ensure that temporary files created by GD are removed). (Ilia)
-- (def. multi result set support for mysql_connect). (Georg)
-- (compile with pear error). (Antony)
-- (array_multisort doesn't separate zvals before changing them). (Tony)
-- (crash when comparing SimpleXML attribute to a boolean). (Andi)
-- (attribute namespace URIs are inconsistent when parsing). (Rob)
-- (PEAR installation fails). (Antony)
-- (curl_getinfo() may crash in some situations). (Ilia)
-- (segfault when parsing ?getvariable[][ ). (Tony)
-- (rename across filesystems loses ownership and permission info). (Tony)
-- (stream_socket_client async connect was broken). (vnegrier at esds dot com, Wez).
-- (Strange results with get_class_vars()). (Marcus)
-- (cal_info() does not work without a parameter). (Ilia)
-- (stream_get_line() not handling end string correctly). (Ilia)
-- (SOAP client requests have no port in "Host" field). (Dmitry)
-- (str_ireplace() does not work on all strings). (Ilia)
-- (Reflection::getModifierNames() returns too long strings). (Marcus)
-- (Error Fetching http body, No Content-Length, connection closed or chunked data). (Dmitry)
-- (segfault when using unknown/unsupported session.save_handler and/or session.serialize_handler). (Tony)
-- (Prevent non-wbmp images from being detected as such). (Ilia)
-- (Possible crash in ctype_digit on large numbers). (Ilia)
-- (exception handler not working with objects). (Marcus)
-- (Sybase date strings are sometimes not null terminated). (Ilia)
-- (SOAP results aren't parsed correctly). (Dmitry)
-- (OO sqlite_fetch_object did not reset error handler). (Wez)
-- (get_current_user() crashes on Windows). (Edin)
-- (xml_set_start_namespace_decl_handler not called). (Rob)
-- (did not detect IPV6 on FreeBSD 4.1). (Wez)
-- (strtotime does not use second param). (Derick)
-- (Possible crash inside ftp_get()). (cfield at affinitysolutions dot com)
-- (array_reduce segfaults when initial value is array). (Tony)
-- (isset gives invalid values on strings). (Tony, Dmitry)
-- (Set limit on the size of mmapable data). (Ilia)
-- (strtotime error). (Derick)
-- (double free when openssl_csr_new fails). (Kamesh Jayachandran).
-- (Soapserver always uses std class). (David, Dmitry)
-- (SoapClient doesn't request wsdl through proxy). (Rob)
-- (Var problem when extending domDocument). (Georg)
-- (strtotime fails with zero base time). (Derick)
-- (Lost support for MS Symbol fonts). (Pierre)
-- (mb_strwidth() returns wrong width values for some hangul characters). (Moriyoshi)
-- (NULL decimal separator is not being handled correctly). (Ilia)
-- (strtotime("now")). (Derick)
-- (private / protected variables not exposed by get_object_vars() inside class). (Marcus)
-- (Can't return within a zend_try {} block or the previous bailout state isn't restored. (Andi)
-- (Userland stream wrapper segfaults on stream_write). (Christian)
-
-
-
-
-
-Version 5.0.2
-
-
-- Added new boolean (fourth) parameter to array_slice() that turns on the preservation of keys in the returned array. (Derick)
-- Added the sorting flag SORT_LOCALE_STRING to the sort() functions which makes them sort based on the current locale. (Derick)
-- Added interface_exists() and make class_exists() only return true for real classes. (Andrey)
-- Added PHP_EOL constant that contains the OS way of representing newlines. (Paul Hudson, Derick)
-- Implemented periodic PCRE compiled regexp cache cleanup, to avoid memory exhaustion. (Andrei)
-- Renamed SoapClient->__call() to SoapClinet->__soapCall(). (Dmitry)
-- Fixed bug with raw_post_data not getting set (Brian)
-- Fixed a file-descriptor leak with phpinfo() and other 'special' URLs (Zeev)
-- (ReflectionClass::getMethod() lowercases attribute). (Marcus)
-- (SOAP module processing WSDL file dumps core). (Dmitry)
-- (Cannot pass big integers (> 2147483647) in SOAP requests). (Dmitry)
-- (unserialize()/ __PHP_Incomplete_class does not report correctly class name). (Marcus, Tony)
-- (simplexml_load_file URL limitation 255 char). (Rob)
-- (No defines around pcntl_*priority definitions). (Derick)
-- (SOAP doesn't return the result of a valid SOAP request). (Dmitry)
-- (soapclient return null value). (Dmitry)
-- (incorrect convert (xml:lang to lang)). (Dmitry)
-- (SoapServer::setClass() should not export non-public methods). (Dmitry)
-- (Interfaces no longer work). (Marcus)
-- (Fixed possible crashes in convert_uudecode() on invalid data). (Ilia)
-- (array_count_values() breaks with numeric strings). (Ilia)
-- (HTTP Authentication Issues). (Uwe Schindler)
-- (SegFault with Soap and Amazon's Web Services). (Dmitry)
-- (ip2long should return -1 if IP is 255.255.255.255 and FALSE on error). (Tony)
-- (Changed ext/xml to default to UTF-8 output). (Rob)
-- (opendir() with ftp:// wrapper segfaults if path does not have trailing slash). (Ilia)
-- (xml_* functions throw non descriptive error). (Christian, Rob)
-- (segfault on result and statement properties). (Georg)
-- (foreach/string handling strangeness (crash)). (Dmitry)
-- (Reflection API issues). (Marcus)
-- (Added sslv2 and sslv3 transports). (Wez)
-- (Invalid statement handle in mysqli on execute). (Georg)
-- (parse_url() is now binary safe). (Ilia)
-- (segfault with Soapserver when WSDL-Cache is enabled). (Dmitry)
-- (Apache 2.0 SAPI build against Apache 2 HEAD). (Joe Orton, Derick)
-- (private/protected properties not serialized when user declared method __sleep() exists). E_NOTICE thrown when __sleep() returns name of non-existing member. (Andrey, Curt)
-
-
-
-
-
-Version 5.0.1
-
-
-- Changed destructor mechanism so that destructors are called prior to request shutdown. (Marcus)
-- Rewritten UNIX and Windows install help files. (Documentation Team)
-- Updated several libraries bundled with the windows release which now includes libxml2-2.6.11, libxslt-1.1.7 and iconv-1.9.1. (Rob, Edin)
-- Improved and moved ActiveScript SAPI to PECL. (Wez)
-- Fixed unloading of dynamically loaded extensions. (Marcus, kameshj at fastmail dot fm)
-- Fixed ReflectionClass::getMethod() and ReflectionClass::getProperty() to raise an ReflectionException instead of returning NULL on failure. (Sebastian)
-- Fixed convert.* filters to consume remaining buckets_in on flush. (Sara)
-- Fixed bug in mysqli->client_version. (Georg)
-- (php_strip_whitespace() prints to stdout rather then returning the value). (Ilia)
-- (MYSQLI_CLIENT_FOUND_ROWS undefined) (Georg)
-- (Segmentation fault, when exception thrown within PHP function called from XSLT). (Christian)
-- (accessing properties without connection) (Georg)
-- (get_class_vars() severely broken when used with arrays). (Marcus)
-- (.Net object instantiation failed). (Michael Sisolak).
-- (win32: usleep() doesn't work). (Wez)
-- (win32: feof() hangs on empty tcp stream). (Wez)
-- (Possible crash inside array_walk_recursive()). (Ilia)
-- (crash when parsing invalid address; invalid address returned by stream_socket_recvfrom(), stream_socket_getname()). (Wez)
-- (Segfault in PHP functions called from XSLT). (Rob)
-- (sqlite_escape_string() returns bogus data on empty strings). (Ilia, Tony)
-- (com_dotnet crashes when echo'ing an object). (Wez)
-- (The destructor is called when an exception is thrown from the constructor). (Marcus)
-- (Exception constructor marked as both public and protected). (Marcus)
-- (strtotime() does not handle empty date string properly). (Ilia)
-- (win32 build produces invalid php_ifx.dll). (Edin)
-- (fetch functions now use MYSQLI_BOTH as default) (Georg)
-- (get_class_vars() return names with NULLs). (Marcus)
-- (gettext extension not working). (Edin)
-- (variant_date_from_timestamp() does not honour timezone). (Wez)
-- (error when sending large packets on a socket). (Dmitry)
-- (memory error when wsdl-cache is enabled). (Dmitry)
-- (Compile Error in mnoGoSearch functions). (Sergey, Antony)
-- ($_SERVER["PHP_AUTH_USER"] isn't defined). (Stefan)
-- (html_entity_decode() misbehaves with UTF-8). (Moriyoshi)
-- (SoapFault exception: [WSDL] Out of memory). (Dmitry)
-- (soap extension segfaults). (Dmitry)
-- (__getTypes() returning nothing on complex WSDL). (Dmitry)
-- (Wrong data encoding of special characters). (Dmitry)
-- (ReflectionClass::isAbstract always returns false). (Marcus)
-- (Thread-unsafety in bcmath elementary values). (Sara)
-- (catch() does not catch exceptions by interfaces). (Marcus)
-
-
-
-
-
-Version 5.0.0
-
-
-- Updated PCRE to provide better error handling in certain cases. (Andrei)
-- Changed doc comments to require a single white space after '/**'. (Marcus)
-- Fixed strip_tags() to correctly handle '\0' characters. (Stefan)
-- (Database not closing). (Marcus)
-- (array_combine() does not handle non-numeric/string keys). (Ilia)
-- (fixed behaviour of exec() to work as it did in 4.X). (Ilia)
-- (ReflectionClass::isAbstract always returns false). (Marcus)
-- (Internal filter registry not thread safe). (Sara)
-- (call_user_func_array has typo in error message). (Marcus)
-- (ArrayObject::offsetGet() does the work of offsetUnset()). (Marcus)
-- (ArrayObject::offsetExists() works inverted). (Marcus)
-- (ReflectionProperty getValue() fails on public static members). (Marcus)
-- (Segfault when using xslt and clone). (Rob)
-- (SoapServer does not call _autoload()). (Dmitry)
-- (array_*diff() and array_*intersect() not clearing the fci cache before work). (Andrey)
-- (appendChild() and insertBefore() unset DOMText).(Rob)
-- (SOAP does not parse WSDL service address correctly). (Dmitry)
-- (Reflection api bugs). (Marcus)
-- (ReflectionExtension::getFunctions() crashes PHP). (Marcus)
-- (Allocate enough space to store MSSQL data). (Frank)
-- (Circular references not properly serialised). (Moriyoshi)
-
-
-
-
-
-Version 5.0.0 Release Candidate 3
-
-
-- Moved the PDFLib extension to PECL. (Wez)
-- Added MySQL 4.1.2-alpha and 4.1.3-beta support to MySQLI extension. (Georg)
-- Added support for dumping private/protected properties to var_dump(). (Andrey)
-- Added count() support for COM arrays. (Wez)
-- Added Firebird/InterBase UDF source that allows PHP functions to be called from SQL (Ard)
-- Changed user error handler mechanism to relay to built-in error handler if it returns false. (Andrei)
-- Changed class type hints for function parameters to not allow the passing of NULL values. (Andi)
-- Changed tidy_node to tidyNode and removed tidy_exception. (John)
-- Fixed ip2long() to return FALSE if an IP address passed to this function is not valid. (Derick)
-- Fixed memory leak in memory manager. (Andi)
-- Fixed problem with exceptions returning from include(). (Dmitry)
-- (Instance of Interface). (Marcus)
-- (Extending mysqli class). (Georg)
-- (Transparency detection code is off by 1). (Ilia, pikeman at pikeman dot sytes dot net)
-- (Missing bounds check inside imagefilter()). (Ilia)
-- (Userspace stream/filter names forced to lowercase). (Sara)
-- (stream_*_register() not calling __autoload()). (Sara)
-- (php_image_filter_contrast calls gdImageBrightness). (Ilia)
-- (No results returned on SOAP call, no error given). (Dmitry)
-- (num_rows property for statement object). (Georg)
-- (COM: Array style properties could not be accessed). (Wez)
-- (ArrayObject leaks when accessing elements). (Marcus)
-- (NULL parameter support for mysqli_ssl_set). (Georg)
-- (ArrayObject doesn't implement ArrayAccess). (Marcus)
-- (SPL: change visibility of ArrayIterator::__construct). (Marcus)
-- (memory leak of registered_zend_ini_directives). (Dmitry)
-- (SPL: ArrayObject does not handle PPP correctly). (Marcus)
-
-
-
-
-
-
-Version 5.0.0 Release Candidate 2
-
-
-- Implementing an interface/abstract method with the wrong prototype is now
- a fatal error. (Zeev)
-
-- Reimplemented zend.ze1_compatibility_mode to have better PHP 4 compliance.
- (Dmitry, Andi)
-
-- Under CLI, fclose() on php://stdin, php://stdout and php://stderr will now
- close the real stream. Please update your CLI scripts to use STDIN, STDOUT
- and STDERR constants instead of fopen()/fclose(). (Wez)
-
-- Moved yaz extension to PECL. (Wez)
-
-- Added pty support to proc_open(). (Wez)
-
-- Added possibility to check in which extension an internal class was defined
- in using reflection API. (Marcus)
-
-- Changed tidy error handling to no longer use exceptions and
- renamed the "error_buf" property to errorBuffer. (John)
-
-- Changed class and method names to use studlyCaps convention. (Marcus)
-
-- Changed language parser to throw errors when a non-empty signature is used in
- a destructor definition. (Marcus)
-
-- Changed HTTP file uploads not to throw E_WARNINGs and E_NOTICEs. The error
- value in the $_FILES global should be used for error handling. (Derick)
-
-- Changed __construct() to always take precedence over old style constructor.
- (Dmitry)
-
-- Fixed handling of return values from storred procedures in mssql_execute()
- with multiple result sets returned. (Frank)
-
-- (stream_socket_accept() doesn't work with ssl). (Wez)
-
-- (compile mssql extension with old versions of FreeTDS
- fails). (Frank)
-
-- (SPL: Crash with getInnerIterator()). (Marcus)
-
-- (COM doesn't pass array parameters). (Wez)
-
-- (sqlite incorrectly handles invalid filenames). (Ilia)
-
-- (in some cases using foreach() to iterate over values
- led to a false error message about the key being a reference). (Adam)
-
-- (STDIN, STDOUT, STDERR are dup()d under CLI). (Wez)
-
-- (xml_parse() segfaults when xml_set_object() is called from
- class method). (Andi, Rob)
-
-- (WDSL SOAP Parsing Schema bug). (Dmitry)
-
-- (Segfault on schema without targetNamespace). (Dmitry)
-
-- (mktime issues on and around DST changeover). (Rasmus)
-
-- (soap extension fails without HAVE_TM_GMTOFF). (Dmitry)
-
-- (Object cloning in ze1_compatibility_mode was reimplemented)
- (Dmitry, Andi)
-
-- (Simplify the process of making a POST request via stream
- context). (Ilia)
-
-- (filters not applied to pre-buffered stream data). (Sara)
-
-- (Reflection_Function constructor crashes with non-existant
- function's name). (Marcus)
-
-- (serialize() objects of incomplete class). (Dmitry)
-
-- (handling of numeric indexes in strtr()). (Dmitry)
-
-- (debug_backtrace() not showing function arguments). (Zeev)
-
-- (The last catch statement was sometimes skipped). (Andi)
-
-- (When __set() returned a value it corrupted it). (Andi)
-
-- (shouldn't mmap() files larger than memory_limit). (Wez)
-
-
-
-
-
-
-Version 5.0.0 Release Candidate 1
-
-
-- Fixed numerous bugs with the just-in-time auto-global initialization, that
- could cause $_SERVER, $argv/$argc and other variables not to work properly.
- (Zeev)
-
-- Fixed data corruption with constant assignments to object properties. (Zeev)
-
-- Changed __toString() to be called automatically only with print and echo
- statements. (Andi)
-
-- Replaced the exec_finished hook by the zend_post_deactive hook for
- extensions. The new hook will be run after the symbol table and destructors
- are run. (Derick)
-
-- Fixed possible crash when internal get_method() is not defined. (Andi)
-
-- Fixed calling methods using call_user_func() in conjunction with
- the array("Class","Method") syntax to use the scope of the PHP user function.
- (Dmitry)
-
-- Fixed php-cgi to not ignore command-line switches when run in a web context.
- This fixes our test cases allowing INI with GET sections to work. (Rasmus)
-
-- Fixed getopt() so it works without $_SERVER. (Rasmus, bfrance)
-
-- Added support for PHP 4 style object comparisons which is enabled in
- ze1_compatiblity_mode. (Andi)
-
-- Added support for PHP 4 style object conversion to long, double, and boolean
- values which is enabled in ze1_compatibility_mode. (Andi, Stas)
-
-- Allow object oriented extensions to overload comparison functions and other
- operations. Solves problems using SimpleXML values. (Andi, Zeev)
-
-- Fixed crash when accessing a class constant with a value which in turn is
- also a constant. (Dmitry)
-
-- Fixed object's truth value conversion. It is always true unless
- ze1_compatibility_mode is on in which it behaves like in PHP 4. (Stas)
-
-- Improved out of memory handling in new memory manager. (Stas)
-
-- Fixed crash when an object references itself during destructor call. (Andi)
-
-- Fixed crash in foreach() when iterating over object properties or a method's
- return values. (Andi)
-
-- Fixed crash when an exception is thrown in a destructor. Such exceptions are
- now ignored as destruction happens out of context at no definite time. (Andi)
-
-- Fixed crashes in exception handling. (Dmitry, Andi)
-
-- Changed prototype checks so that they aren't done on constructors. (Andi)
-
-- Changed prototype checks to output an E_STRICT message instead of
- an E_COMPILE_ERROR. (Andi)
-
-- Changed Iterator::has_more() to Iterator::valid(). (Marcus)
-
-- Upgraded bundled oniguruma library to version 2.2.2. (Rui, Moriyoshi)
-
-- Added mb_list_encoding() to return an array with all mbstring supported
- encodings. (Derick)
-
-- Added support for more ISO8601 datetime formats in strtotime(). (Moriyoshi)
-
- - Timezone specifier (ex. "20040301T02:00:00+19:00")
- - Week specifier (ex. "1997W021")
-
-
-- Renamed php.ini option "zend2.implicit_clone" to
- "zend.ze1_compatibility_mode" as it doesn't only affect implicit cloning.
- (Andi, Zeev)
-
-- Methods that override parent methods are now subject to prototype checking,
- and have to be compatible with the method they're overriding - this check is
- disabled in compatibility mode. (Andi, Zeev)
-
-- Fixed crash in php_ini_scanned_files() when no additional INI files were
- actually parsed. (Jon)
-
-- Fixed bug in gdImageFilledRectangle in the bundled GD library, that required
- x1 < x2 and y1 < y2 for coordinates. (Derick)
-
-- Fixed crash with foreach() and temporary objects($obj->method()->a ...) where
- method returns a non-referenced object. (Andi, Zeev)
-
-- Fixed problem preventing startup errors from being displayed. (Marcus)
-
-- Fixed start-up problem if both SPL and SimpleXML were enabled. The double
- initialization of apache 1.3 was causing problems here. (Marcus, Derick)
-
-- (Expression must be a modifiable lvalue compiler error).
- (Derick)
-
-- (pg_fetch_array not returning false). (Marcus)
-
-- (ArrayObject::getIterator crashes with [] assignment).
- (Marcus)
-
-- (Objects pointing to each other segfaults). (Dmitry)
-
-- (Problem with object freeing mechanism). (Dmitry)
-
-- (Visibility bugs in call_user_function()). (Dmitry)
-
-- (handling of numeric indexes in strtr()). (Dmitry)
-
-- (memory leak inside tsrm_virtual_cwd.c on win32). (Ilia)
-
-- (get_browser matches browscap.ini patterns incorrectly).
- (Jay)
-
-- (wddx segfaults during deserialization). (Moriyoshi)
-
-- (session extension crashes when unserializing referenced
- values / objects). (Moriyoshi)
-
-- (Working with simplexml crashes apache2). (Rob)
-
-- (Mixed case class names causes Fatal Error in Constructor
- call). (Marcus)
-
-- (strval() doesn't work for objects with __toString()).
- (Marcus)
-
-- (Fix crash caused by bug in get_object_vars()). (Andi)
-
-- (mbstring compile errors with IRIX compiler).
- (K.Kosako <kosako at sofnec dot co dot jp>, Rui, Moriyoshi)
-
-- (register_long_arrays breaks superglobals). (Zeev)
-
-- (argv and argc not defined). (Zeev)
-
-
-
-
-
-
-Version 5.0.0 Beta 4
-
-
-- Changed exceptions so that they must now inherit from the built-in Exception
-class. This allows for a general catch(Exception $e) statement to catch all
-exceptions. (Andi, Zeev)
-- Added SPL extension. (Marcus, Derick)
-- Added checks for invalid characters in a cookie name and cookie data
-into set[raw]cookie(). (Brian)
-- Added support for ++ and += (and similar) to SimpleXML. (Andi, Zeev)
-- Added infrastructure for ++ and += (and similar) to object overloading
-modules. (Andi, Zeev)
-- Added error message when trying to re-assign to $this variable. (Zeev, Andi)
-- Added support for an interface to extend another interface. (Zeev)
-- Added new pspell functions: (Brian)
-
- - pspell_config_dict_dir()
- - pspell_config_data_dir()
-
-- Added new Interbase functions: (Ard)
-
- - ibase_service_attach() and ibase_service_detach().
- - ibase_backup() and ibase_restore().
- - ibase_maintain_db(), ibase_db_info() and ibase_server_info().
-
-- Added context option "http"/"request_fulluri" to send entire URI in request
-which is required format for some proxies. (Sara)
-- Added optional third parameter 'strict' to array_keys(). (Andrey)
-- Added stream_lock() method to userspace streams interface. (Hartmut, Wez)
-- Added xsltprocessor->registerPHPFunctions(). (Christian)
-- Readded support for using classes before they are declared according to
-the behavior in PHP 4. This won't work with classes who are using PHP 5
-features such as interfaces. (Zeev, Andi)
-- Completely overhauled SimpleXML extension. (Marcus, Rob, Sterling)
-- Upgraded bundled SQLite library to version 2.8.11. (Ilia, Wez)
-- Improved destructor implementation to always call destructors on clean
-shutdown. An order of destruction is not guaranteed. (Zeev, Andi)
-- Redesigned exception support. This fixes many bugs in the previous design
-such as nested try's and problems with overloaded extensions. (Zeev, Andi)
-- Redesigned clone by adding a clone keyword (clone $obj) and copying all
-properties before __clone() is called. Also allows calling parent __clone
-function by using parent::__clone(). (Zeev, Andi)
-- Fixed interfaces to check for function return-by-reference equality when
-inheriting and implementing interfaces. (Andi, Zeev)
-- Fixed foreach() to respect property visibility. (Marcus)
-- Fixed problem with parse error in include() file not stopping PHP's
-execution. (Ilia)
-- Fixed var_export() to show public, protected and private modifiers properly.
-(Derick)
-- Fixed problems with longlong values in mysqli. (Georg)
-- Fixed class name case preserving of user defined classes. (Marcus)
-- (Unmangle private/protected property names before printing
-them inside error messages). (Ilia)
-- (preg_split('//u') incorrectly splits UTF-8 strings into
-octets). (Moriyoshi)
-- (SPL: SeekableIterator seek() broken). (Marcus)
-- (Every class method can be called as static). (Marcus)
-- (exec() has problems reading long lines).
-(Ilia, runekl[at]opoint[dot]com
-- (ext/dom: Crash when using DomDocument::getElementById()).
-(Christian)
-- (crash in sqlite extension when fetching data from empty
-queries). (Ilia)
-- (ext/mime_magic: magic file validation broken). (Jani)
-- (http_build_query() crashes on NULL output). (Ilia)
-- (http_build_query() does not handle private & protected
-object properties correctly). (Ilia)
-- (foreach of (DOM) childnodes crashes when Xinclude is used).
-(Rob)
-- (SQLite causes crashes with other extensions *connect()
-calls). (Marcus)
-- (unserialize() produces lowercase classnames). (Marcus)
-- (getElementsByTagName doesn't work properly). (Rob)
-- (__autoload not invoked for parent classes). (Marcus)
-- (domNode::appendChild() changes child node namespace). (Rob)
-- (calling class_exists() on a nonexistent class in __autoload
-results in segfault). (Marcus)
-- (string index in a switch() crashes with multiple matches).
-(Andi)
-- (Reflection API does not recognize mixed-case class hints).
-(Marcus)
-- (make xsltProcessor->transformToUri use streams wrappers).
-(Ilia)
-- (Added version check in mysqli_report_index). (Georg)
-- (Segfault on ArrayAccess use). (Marcus)
-- (__autoload() not invoked by Reflection classes). (Jani)
-- (call_user_func() broken for self, parent). (Stanislav)
-- (memory leak when new() result is not assigned and no
-constructor is defined). (Stanislav)
-- (Crash when nesting classes). (Marcus)
-- (disallow arrays in class constants). (Stanislav)
-- (sqlite_create_function with method and reference to $this).
-(Marcus)
-- (call_user_func() issues a warning if function throws an
-exception). (Marcus)
-- (__set not triggered when overloading with array).
-(Stanislav)
-- (enabling browscap causes segfault). (Wez)
-
-
-
-
-
-Version 5.0.0 Beta 3
-
-
-- Bundled new tidy extension (John, Wez)
-- Upgraded PCRE library to version 4.5. (Andrei)
-- Dropped Windows 95 support. (Andi)
-- Moved extensions to PECL:
-
- - ext/crack (Jani, Derick)
- - ext/db (Jani, Derick)
- - ext/mcal (Jani, Derick)
- - ext/qtdom (Jani, Derick)
- - ext/notes (Wez)
-
-- Added 'c' modifier to date() which returns the date in the ISO
-8601 format. (Derick, Manuzhai)
-- Added an optional parameter to microtime() to get the time as
-float. (Andrey)
-- Added MacRoman encoding support to htmlentities(). (Derick,
-Marcus Bointon)
-- Added possibility to call PHP functions as XSLT-functions.
-(Christian)
-- Added possibility to prevent PHP from registering variables when
-input filter. support is used. (Derick)
-- Added iconv stream filter (convert.iconv.*). (Moriyoshi)
-- Added EXSLT support in ext/xsl. (Christian)
-- Added qdbm handler for dba extension. (mg at iceni dot pl, Marcus)
-- Added new functions:
-
- - dba_key_split() to split inifile keys in an array. (Marcus)
- - time_nanosleep() signal safe sleep (Magnus, Ilia)
- - headers_list(). (Sara)
- - php_strip_whitespace(). strip whitespace & comments from a
- script. (Ilia)
- - php_check_syntax(). check php script for parse errors. (Ilia)
- - image_type_to_extension(). return extension based on image type.
- (Ilia)
- - stream_socket_sendto() and stream_socket_recvfrom(). (Wez)
- - iconv_mime_decode_headers(). (Moriyoshi)
- - get_declared_interfaces(). (Andrey, Marcus)
- - sqlite_fetch_column_types(). (Ilia)
-
-- Added proxy support to http:// wrapper. (Sara)
-- Added rename(), rmdir() and mkdir() support to userstreams.
-(Sara)
-- Added rename(), rmdir() and mkdir() support to ftp:// wrapper.
-(Sara)
-- Changed rename(), rmdir() and mkdir() to be routed via streams
-API. (Sara)
-- Changed stat() and family to be routed via streams API. (Sara)
-- Fixed include_once() / require_once() on Windows to honor
-case-insensitivity; of files. (Andi)
-- Fixed get_declared_classes() to return only classes. (Andrey,
-Marcus)
-- Fixed __autoload() to preserve case of the passed class name.
-(Andi)
-- () (runekl at opoint dot com, Derick)
-- ("__autoload threw an exception" during an
-uncaught). (Marcus)
-- (stream_get_meta_data() -> Access Violation).
-(Wez)
-- (HTML entities are not being decoded by
-xml_parse()/xml_parse_into_struct()). (Ilia)
-- (Object properties created redundantly). (Andi)
-- (REPLACE_ZVAL_VALUE works on uninit stack-based
-zvals). (Moriyoshi)
-- (Non-working write support in ext/dom). (Ilia)
-- (--disable-libxml does not work). (Jani)
-- (serialize crashes when accessing an overloaded
-object that has no properties (NULL hashtable)). (Wez)
-- (COM crashes when calling a Delphi implementations
-of ITypeInfo). (Wez)
-- (Incorrect behaviour of PPP using foreach).
-(Marcus)
-- (Allow session.use_trans_sid to be
-enabled/disabled from inside the script). (Ilia)
-- (Serializing cross-referenced objects causes
-segfault). (Moriyoshi)
-
-
-
-
-
-Version 5.0.0 Beta 2
-
-
-- Lots and lots of changes in the Zend Engine 2 since beta 1:
-
- - Added Iterators
- - Improved memory manager
- - Added Reflection API
- - Removed the not so working namespaces support
- - Removed support for expressions within constant declerations.
- - You can read about most changes in ZEND_CHANGES under the Zend
- directory.
-
-- Improved the DBX extension: (Marc)
-
- - Added DBX_RESULT_UNBUFFERED flag for dbx_query().
- - Added dbx_fetch_row()
- - Added SQLite support.
-
-- Improved the Interbase extension: (Ard Biesheuvel)
-
- - Added support for multiple databases into ibase_trans()
- - Added support for CREATE DATABASE, SET TRANSACTION and EXECUTE
- PROCEDURE statements into ibase_query()
- - Added ibase_commit_ret() and ibase_rollback_ret()
- - Added ibase_drop_db()
- - Added ibase_gen_id()
- - Added ibase_name_result()
- - Added ibase_errcode()
- - Added ibase_affected_rows() and ibase_num_params()
- - Added ibase_param_info()
- - Added ibase_wait_event()
- - Added ibase_set_event_handler() and ibase_free_event_handler()
-
-- Added new COM extension with integrated .Net support. (Wez)
-- Added new functions:
-
- - setrawcookie(). (Brian)
- - pg_version(). (Marcus)
- - dbase_get_header_info(). (Zak)
- - snmp_read_mib(). (Jani)
- - http_build_query(). (Sara)
- - ftp_alloc(). (Sara)
- - array_udiff(). (Andrey)
- - array_udiff_assoc(). (Andrey)
- - array_udiff_uassoc(). (Andrey)
- - array_diff_uassoc(). (Andrey)
- - convert_uuencode(). (Ilia)
- - convert_uudecode(). (Ilia)
- - substr_compare(). (Ilia)
- - pcntl_wait(). (GeorgeS)
-
-- Added "resume_pos" context option to "ftp://" wrapper. (Sara)
-- Added optional parameter to OCIWriteTemporaryLob() to specify
-the type of LOB (Patch by Novicky Marek <novicky@aarongroup.cz>).
-(Thies)
-- Added reflection API. (Andrei, George, Timm)
-- Changed length parameter in fgetcsv() to be optional. (Moriyoshi)
-- Fixed IPv6 support in MacOSX Panther. (Dan, Marko)
-- Fixed fgetcsv() to correctly handle international (non-ascii)
-characters. (Moriyoshi)
-- Fixed support for <![CDATA[]]> fields within XML documents
-in ext/xml. (Sterling)
-- Fixed visibility of __construct and __clone. (Marcus)
-- (fgetcsv() not binary-safe on null bytes).
-(Moriyoshi)
-- (SimpleXML's validate_schema_file() broken).
-(Moriyoshi)
-- (getimagesize() returns incorrect values on
-bitmap (os2) files). (Marcus)
-- (array_merge*() allows non-arrays as argument).
-(Jay)
-- (strange result array from unpack()). (Moriyoshi)
-- ($obj = new $className; causes crash when
-$className is not set). (Marcus)
-- (cannot read array elements received via
-$_REQUEST). (Zeev)
-- (get_parent_class() returns different values).
-(Sterling, Stanislav)
-- (preg_replace() problem: Using $this when not
-in object context). (Zeev)
-- (PEAR DB isError crash [instanceof_function
-fault?]). (Sterling, Marcus)
-- (foreach ($k=>$v), the key $k is missing). (Zeev)
-- (__get() crash when no value is returned). (Ilia)
-- (undefined variable has a value). (Zeev)
-- (allow fast_call_user_function to support __call).
-(Stanislav)
-- (Warning when switch() and reference are combined).
-(Zeev)
-- (strtotime failed to parse postgresql timestamp).
-(Derick)
-
-
-
-
-
-Version 5.0.0 Beta 1
-
-
-- Switch to using Zend Engine 2, which includes numerous engine level improvements.
-A full overview may be downloaded from http://www.zend.com/engine2/ZendEngine-2.0.pdf (PDF).
-
-- The SQLite (http://www.hwaci.com/sw/sqlite/) extension is now bundled and
-enabled by default. (Wez, Marcus, Tal)
-- Improved the speed of internal functions that use callbacks by 40% due to a
-new internal fast_call_user_function() function. (Sterling)
-- Completely Overhauled XML support (Rob, Sterling, Chregu, Marcus)
-
- - Brand new Simplexml extension
- - New DOM extension
- - New XSL extension
- - Moved the old DOM-XML and XSLT extensions to PECL
- - ext/xml can now use both libxml2 and expat to parse XML
- - Removed bundled expat
-
-
-- Removed the bundled MySQL client library. (Sterling)
-- New php.ini options:
-
- - "session.hash_function" and "session.hash_bits_per_character". (Sascha)
- - "mail.force_extra_paramaters". (Derick)
- - "register_long_arrays". (Zeev)
-
-
-- Improved the streams support: (Wez, Sara, Ilia)
-
- - Improved performance of readfile(), fpassthru() and some internal streams
- operations under Win32.
- - stream_socket_client() - similar to fsockopen(), but more powerful.
- - stream_socket_server() - Creates a server socket.
- - stream_socket_accept() - Accept a client connection.
- - stream_socket_get_name() - Get local or remote name of socket.
- - stream_copy_to_stream()
- - stream_get_line() - Reads either the specified number of bytes or until
- the ending string is found.
- - Added context property to userspace streams object.
- - Added generic crypto interface for streams (supports dynamic loading of
- OpenSSL)
- - Added lightweight streaming input abstraction to the Zend Engine scanners
- to provide uniform support for include()'ing data from PHP streams across
- all platforms.
- - Added 'string.base64' stream filter.
- - Renamed stream_register_wrapper() to stream_wrapper_register().
- - Added "ftp://" wrapper support to opendir(), stat() and unlink().
- - Added context options 'method', 'header' and 'content' for "http://" fopen
- wrapper.
-
-
-- Improved the GD extension: (Pierre-Alain Joye, Ilia)
-
- - imagefilter() - Apply different filters to image. (Only available
- with bundled GD library)
- - Antialiased drawing support:
-
- - imageantialias() - (de)active antialias
- - imageline() and imagepolygon() antialias support
-
-
-
-
-- Changed the length parameter in fgetss() to be optional. (Moriyoshi)
-- Changed ini parser to allow for handling of quoted multi-line values. (Ilia)
-- Changed get_extension_funcs() to return list of the built-in Zend Engine
-functions if "zend" is specified as the module name. (Ilia)
-- Changed array_search() to accept also objects as a needle. (Moriyoshi)
-- Changed ext/mcrypt to require libmcrypt version 2.5.6 or greater. (Derick)
-- Changed uniqid() parameters to be optional and allow any prefix length. (Marcus)
-- Added new iconv functions. (Moriyoshi)
-
- - iconv_strlen()
- - iconv_substr()
- - iconv_strpos()
- - iconv_strrpos()
- - iconv_mime_decode()
- - iconv_mime_encode()
-
-
-- Added misc. new functions:
-
- - ldap_sasl_bind(). (peter_c60@hotmail.com, Jani)
- - imap_getacl(). (Dan, Holger Burbach)
- - file_put_contents(). (Sterling)
- - proc_nice() - Changes priority of the current process. (Ilia)
- - pcntl_getpriority() and pcntl_setpriority(). (Ilia)
- - idate(), date_sunrise() and date_sunset(). (Moshe Doron)
- - strpbrk() - Searches a string for a list of characters. (Ilia)
- - get_headers() - Returns headers sent by the server of the specified URL. (Ilia)
- - str_split() - Breaks down a string into an array of elements based on length. (Ilia)
- - array_walk_recursive(). (Ilia)
- - array_combine(). (Andrey)
-
-
-- Added optional parameter to get_browser() to make it return an array. (Jay)
-- Added optional parameter to openssl_sign() to specify the hashing algorithm.(scott@planetscott.ca, Derick)
-- Added optional parameter to sha1(), sha1_file(), md5() and md5_file() which
-makes them return the digest as binary data. (Michael Bretterklieber, Derick)
-- Added optional parameter to mkdir() to make directory creation recursive. (Ilia)
-- Added optional parameter to file() which makes the result array not contain
-the line endings and to skip empty lines. (Ilia)
-- Added new range() functionality:
-
- - Support for float modifier. (Ilia)
- - Detection of numeric values inside strings passed as high & low. (Ilia)
- - Proper handle the situations where high == low. (Ilia)
- - Added an optional step parameter. (Jon)
-
-
-- Added encoding detection feature for expat XML parser. (Adam Dickmeiss, Moriyoshi)
-- Added missing multibyte (unicode) support and numeric entity support to
-html_entity_decode(). (Moriyoshi)
-- Added IPv6 support to ext/sockets. (Sara)
-- Added input filter support. See README.input_filter for more info. (Rasmus)
-- Added a replace count for str_[i]replace(), see . (Sara)
-- Fixed is_executable() to be available also on Windows. (Shane)
-- Fixed dirname() and strip_tags() to be binary-safe. (Moriyoshi)
-- (crash in pathinfo()). (Ilia)
-- and (various mb_send_mail() issues). (Moriyoshi)
-- (Assign by reference function call changes variable
-contents). (Zeev)
-
-
-
-
-
-
-
-Version 7.4.33
-
-- GD:
-
- - : OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
-
-- Hash:
-
- - : buffer overflow in hash_update() on long parameter. (CVE-2022-37454)
-
-
-
-
-
-
-
-Version 7.4.32
-
-- Core:
-
- - : phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
- - : Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
-
-
-
-
-
-
-
-Version 7.4.30
-
-- mysqlnd:
-
- - : mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
-
-- pgsql:
-
- - : Uninitialized array in pg_query_params(). (CVE-2022-31625)
-
-
-
-
-
-
-
-Version 7.4.29
-
-- Core:
-
- - No source changes to this release. This update allows for re-building the
- Windows binaries against upgraded dependencies which have received security
- updates.
-
-- Date:
-
- - Updated to latest IANA timezone database (2022a).
-
-
-
-
-
-
-
-Version 7.4.28
-
-- Filter:
-
- - Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
-
-
-
-
-
-
-
-Version 7.4.27
-
-- Core:
-
- - (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
-
-- FPM:
-
- - (Future possibility for heap overflow in FPM zlog).
-
-- GD:
-
- - (libpng warning from imagecreatefromstring).
-
-- OpenSSL:
-
- - (./configure: detecting RAND_egd).
-
-- PCRE:
-
- - (Out of bounds in php_pcre_replace_impl).
-
-- Standard:
-
- - (dns_get_record fails on FreeBSD for missing type).
- - (stream_get_contents() may unnecessarily overallocate).
-
-
-
-
-
-
-
-Version 7.4.26
-
-- Core:
-
- - (Header injection via default_mimetype / default_charset).
-
-- Date:
-
- - (Interval serialization regression since 7.3.14 / 7.4.2).
-
-- MBString:
-
- - (mbstring may use pointer from some previous request).
-
-- MySQLi:
-
- - (Stopped unbuffered query does not throw error).
-
-- PCRE:
-
- - (PCRE2 10.35 JIT performance regression).
-
-- Streams:
-
- - (Memory corruption with user_filter).
-
-- XML:
-
- - (special character is breaking the path in xml function). (CVE-2021-21707)
-
-
-
-
-
-
-
-Version 7.4.25
-
-- DOM:
-
- - (DOMElement::setIdAttribute() called twice may remove ID).
-
-- FFI:
-
- - ("TYPE *" shows unhelpful message when type is not defined).
-
-- Fileinfo:
-
- - (High memory usage during encoding detection).
-
-- Filter:
-
- - (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing).
-
-- FPM:
-
- - (PHP-FPM oob R/W in root process leading to privilege escalation) (CVE-2021-21703).
-
-- SPL:
-
- - (Recursive SplFixedArray::setSize() may cause double-free).
-
-- Streams:
-
- - (stream_isatty emits warning with attached stream wrapper).
-
-- XML:
-
- - (XML_OPTION_SKIP_WHITE strips embedded whitespace).
-
-- Zip:
-
- - (ZipArchive::extractTo() may leak memory).
- - (Dirname ending in colon unzips to wrong dir).
-
-
-
-
-
-
-
-Version 7.4.24
-
-- Core:
-
- - (Stream position after stream filter removed).
- - (Non-seekable streams don't update position after write).
- - (Integer Overflow when concatenating strings).
-
-- GD:
-
- - (During resize gdImageCopyResampled cause colors change).
-
-- Opcache:
-
- - (segfault with preloading and statically bound closure).
-
-- Shmop:
-
- - (shmop_open won't attach and causes php to crash).
-
-- Standard:
-
- - (disk_total_space does not work with relative paths).
- - (Unterminated string in dns_get_record() results).
-
-- SysVMsg:
-
- - (Heap Overflow in msg_send).
-
-- XML:
-
- - (xml_parse may fail, but has no error code).
-
-- Zip:
-
- - (ZipArchive::extractTo extracts outside of destination). (CVE-2021-21706)
-
-
-
-
-
-
-
-Version 7.4.23
-
-- Core:
-
- - (php_output_handler_append illegal write access).
- - (Weird behaviour when using get_called_class() with call_user_func()).
- - (Built-in Webserver Drops Requests With "Upgrade" Header).
-
-- BCMath:
-
- - (BCMath returns "-0").
-
-- CGI:
-
- - (HTTP Status header truncation).
-
-- GD:
-
- - (imagefilledellipse does not work for large circles).
-
-- MySQLi:
-
- - (Integer overflow in mysqli_real_escape_string()).
-
-- OpenSSL:
-
- - (Error build openssl extension on php 7.4.22).
-
-- PDO_ODBC:
-
- - (PDO_ODBC doesn't account for SQL_NO_TOTAL).
-
-- Phar:
-
- - : Symlinks are followed when creating PHAR archive.(cmb)
-
-- Shmop:
-
- - (shmop can't read beyond 2147483647 bytes).
-
-- Standard:
-
- - (Integer overflow on substr_replace).
- - (getimagesize returns 0 for 256px ICO images).
- - (Heap buffer overflow via str_repeat).
-
-- Streams:
-
- - (Segfault when removing a filter).
-
-
-
-
-
-
-
-Version 7.4.22
-
-- Core:
-
- - (copy() and stream_copy_to_stream() fail for +4GB files).
- - (incorrect handling of indirect vars in __sleep).
- - (PHP built-in web server resets timeout when it can kill the process).
- - (Built-in Webserver - overwrite $_SERVER['request_uri']).
- - (Using return value of zend_assign_to_variable() is not safe).
- - (--r[fcez] always return zero exit code).
-
-- Intl:
-
- - (Locale::lookup() wrong result with canonicalize option).
- - (IntlDateFormatter fails for "GMT+00:00" timezone).
- - (grapheme_strrpos() broken for negative offsets).
-
-- OpenSSL:
-
- - (openssl_csr_sign truncates $serial).
-
-- PCRE:
-
- - (PCRE2 10.37 shows unexpected result).
- - (Too much memory is allocated for preg_replace()).
-
-- Standard:
-
- - (flock() only locks first byte of file).
-
-
-
-
-
-
-
-Version 7.4.21
-
-- Core:
-
- - (Double free in realpath_cache_clean()).
- - (open_basedir bypass through adding "..").
- - (Typed property performance degradation with .= operator).
- - (Integer underflow in memory limit comparison).
- - (SSRF bypass in FILTER_VALIDATE_URL). (CVE-2021-21705)
-
-- Bzip2:
-
- - (fflush before stream_filter_remove corrupts stream).
-
-- OpenSSL:
-
- - (native Windows cert verification uses CN as server name).
-
-- PDO_Firebird:
-
- - (Stack buffer overflow in firebird_info_cb). (CVE-2021-21704)
- - (SIGSEGV in firebird_handle_doer). (CVE-2021-21704)
- - (SIGSEGV in firebird_stmt_execute). (CVE-2021-21704)
- - (Crash while parsing blob data in firebird_fetch_blob). (CVE-2021-21704)
-
-- Standard:
-
- - (phpinfo(INFO_VARIABLES) "Array to string conversion").
-
-
-
-
-
-
-
-Version 7.4.20
-
-- Core:
-
- - (Method name corruption related to repeated calls to call_user_func_array).
- - (opendir() warning wrong info when failed on Windows).
- - (HTTP Authorization schemes are treated as case-sensitive).
- - (Memory exhaustion on invalid string offset).
-
-- FPM:
-
- - (Events port mechanism).
-
-- FTP:
-
- - (Info leak in ftp extension).
- - (Wrong FTP error messages).
-
-- GD:
-
- - (GD install is affected by external libgd installation).
-
-- MBString:
-
- - (mb_convert_encoding removes references from arrays).
-
-- ODBC:
-
- - (ODBC doesn't account for SQL_NO_TOTAL indicator).
-
-- PDO_MySQL:
-
- - (PDO discards error message text from prepared statement).
-
-- PDO_ODBC:
-
- - (bound parameters ignore explicit type definitions).
-
-- pgsql:
-
- - Fixed php_pgsql_fd_cast() wrt. php_stream_can_cast().
-
-- SPL:
-
- - (SplFileObject::DROP_NEW_LINE is broken for NUL and CR).
-
-- Opcache:
-
- - (switch statement behavior inside function).
- - (Opcache optimization assumes wrong part of ternary operator in if-condition).
-
-- XMLReader:
-
- - (XMLReader: encoding length not checked).
-
-- Zip:
-
- - (ZipArchive::extractTo() ignores references).
-
-
-
-
-
-
-
-Version 7.4.19
-
-- PDO_pgsql:
-
- - Reverted bug fix for #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
-
-
-
-
-
-
-
-Version 7.4.18
-
-- Core:
-
- - (Error handler that throws ErrorException infinite loop).
- - (Flushing streams with compression filter is broken).
-
-- Dba:
-
- - (dba_popen() may cause segfault during RSHUTDOWN).
-
-- DOM:
-
- - (UAF when appending DOMDocument to element).
-
-- FPM:
-
- - (Duplication of info about inherited socket after pool removing).
-
-- FTP:
-
- - (SSL_read on shutdown, ftp/proc_open).
-
-- Imap:
-
- - (imap_mail_compose() header injection).
-
-- Intl:
-
- - (msgfmt_format() does not accept DateTime references).
-
-- LibXML:
-
- - (simplexml_load_file() doesn't use HTTP headers).
- - (Invalid memory access in php_libxml_xmlCheckUTF8).
-
-- MySQLnd:
-
- - (SegFault when disabling ATTR_EMULATE_PREPARES and MySQL 8.0).
- - (Calling stmt_store_result after fetch doesn't throw an error).
- - (mysqlnd's mysql_clear_password does not transmit null-terminated password).
-
-- Opcache:
-
- - (create simple class and get error in opcache.so).
- - (Variables become null in if statements).
-
-- Pcntl:
-
- - (Potential integer overflow in pcntl_exec()).
-
-- PCRE:
-
- - (preg_split ignores limit flag when pattern with \K has 0-width fullstring match).
-
-- PDO_ODBC:
-
- - (PDO ODBC truncates BLOB records at every 256th byte).
-
-- PDO_pgsql:
-
- - (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
-
-- phpdbg:
-
- - (Exit code is 0 when could not open file).
-
-- Session:
-
- - (session_name() problem with backslash).
- - (Cannot set save handler when save_handler is invalid).
-
-- SOAP:
-
- - (SOAP special XML characters in namespace URIs not encoded).
-
-- Standard:
-
- - (http wrapper silently ignores long Location headers).
- - (phpinfo(INFO_CREDITS) displays nothing in CLI).
- - (HTTP wrapper waits for HTTP 1 response after HTTP 101).
- - (Taking a reference to $_SERVER hides its values from phpinfo()).
- - (file_get_contents() maxlen fails above (2**31)-1 bytes).
-
-- MySQLi:
-
- - (x() and y() truncating floats to integers).
-
-- OPcache:
-
- - (opcache doesn't honour pcre.jit option).
-
-- OpenSSL:
-
- - (Providing RSA key size < 512 generates key that crash PHP).
-
-- Phar:
-
- - (Unclear error message wrt. __halt_compiler() w/o semicolon) (cmb)
- - (Phar does not mark UTF-8 filenames in ZIP archives).
- - (Phar cannot compress large archives).
-
-- SPL:
-
- - (Iterating after failed ArrayObject::setIteratorClass() causes Segmentation fault).
-
-- Zip:
-
- - (Fix for bug 79296 should be based on runtime version).
-
-
-
-
-
-Version 7.4.16
-
-- Core:
-
- - (mail(): Headers after Bcc headers may be ignored).
-
-- MySQLnd:
-
- - (mysqlnd's mysql_clear_password does not transmit null-terminated password).
-
-- MySQLi:
-
- - (x() and y() truncating floats to integers).
-
-- OPcache:
-
- - (opcache doesn't honour pcre.jit option).
-
-- OpenSSL:
-
- - (Providing RSA key size < 512 generates key that crash PHP).
-
-- Phar:
-
- - (Unclear error message wrt. __halt_compiler() w/o semicolon) (cmb)
- - (Phar does not mark UTF-8 filenames in ZIP archives).
- - (Phar cannot compress large archives).
-
-- SPL:
-
- - (Iterating after failed ArrayObject::setIteratorClass() causes Segmentation fault).
-
-- Standard:
-
- - (file_get_contents() maxlen fails above (2**31)-1 bytes).
-
-- Zip:
-
- - (Fix for bug 79296 should be based on runtime version).
-
-
-
-
-
-
-
-Version 7.4.15
-
-- Core:
-
- - (bogus parse error on >4GB source code).
- - (filter buffers entire read until file closed).
-
-- Curl:
-
- - (Resetting POSTFIELDS to empty array breaks request).
-
-- Date:
-
- - (last day of the month causes runway cpu usage.
-
-- MySQLi:
-
- - (mysqlnd with MYSQLI_OPT_INT_AND_FLOAT_NATIVE fails to interpret bit columns).
- - (Fetching resultsets from stored procedure with cursor fails).
- - (segfault using prepared statements on stored procedures that use a cursor).
- - (Crash in mysqlnd_fetch_stmt_row_cursor when calling an SP with a cursor).
-
-- Phar:
-
- - (Incorrect locator detection in ZIP-based phars).
- - (Compressed ZIP Phar extractTo() creates garbage files).
-
-- SOAP:
-
- - (Null Dereference in SoapClient). (CVE-2021-21702)
-
-
-
-
-
-
-
-Version 7.4.14
-
-- Core:
-
- - (Can't rebind closure returned by Closure::fromCallable()).
- - (PHPIZE configuration has outdated PHP_RELEASE_VERSION).
- - (White space not unfolded for CC/Bcc headers).
- - (Running dtrace scripts can cause php to crash).
- - (Build of PHP extension fails due to configuration gap with libtool).
- - (configure filtering out -lpthread).
- - (stream filter loses final block of data).
-
-- Fileinfo:
-
- - (finfo_open crafted magic parsing SIGABRT).
-
-- FPM:
-
- - (FPM returns 200 status on request without SCRIPT_FILENAME env).
-
-- Intl:
-
- - (MessageFormatAdapter::getArgTypeList redefined).
-
-- OpenSSL:
-
- - (OpenSSL extension fails to build against LibreSSL due to lack of OCB support).
-
-- Phar:
-
- - (Phar Zip parse crash - mmap fail).
- - (`PharData` says invalid checksum for valid tar).
- - (PharData::addEmptyDir('/') Possible integer overflow).
-
-- PDO MySQL:
-
- - (PDOStatement::fetchAll() throws for upsert queries).
- - (nextRowset() ignores MySQL errors with native prepared statements).
- - (PDO::exec() - Bad error handling with multiple commands).
- - (Unexpected "Cannot execute queries while other unbuffered queries").
- - (Multiple statements in init command triggers unbuffered query error).
- - (PDOStatement cannot be GCed/closeCursor-ed when a PROCEDURE resultset SIGNAL).
-
-- Standard:
-
- - (FILTER_VALIDATE_URL accepts URLs with invalid userinfo). (CVE-2020-7071)
- - (Return Value of zend_fstat() not Checked).
- - (References to null-serialized object break serialize()).
-
-- Tidy:
-
- - (ob_tidyhandler is never reset).
-
-- Zlib:
-
- - (Support for flushing in zlib stream).
-
-
-
-
-
-
-
-Version 7.4.13
-
-- Core:
-
- - (ADD_EXTENSION_DEP() fails for ext/standard and ext/date).
- - (Windows Deduplication Enabled, randon permission errors).
-
-- COM:
-
- - (com_event_sink crashes on certain arguments).
-
-- DOM:
-
- - (loadHTML() truncates at NUL bytes).
-
-- FFI:
-
- - (FFI doesn't handle well PHP exceptions within callback).
-
-- IMAP:
-
- - (imap_sort() does not return FALSE on failure).
- - (segfault on imap_reopen).
- - (imap_rfc822_write_address() leaks memory).
- - Fixed minor regression caused by fixing bug .
- - (imap_mail_compose() segfaults for multipart with rfc822).
-
-- MySQLi:
-
- - (mysqli_store_result does not report error from lock wait timeout).
- - (mysqli::commit does not throw if MYSQLI_REPORT_ERROR enabled and mysqlnd used).
- - (mysqlnd segfault (fetch_row second parameter typemismatch)).
-
-- ODBC:
-
- - (Fetching may rely on uninitialized data).
-
-- Opcache:
-
- - (PHP with Opcache crashes when a file with specific name is included).
- - Fixed run-time binding of preloaded dynamically declared function.
-
-- OpenSSL:
-
- - (openssl_encrypt / openssl_decrypt fail with OCB mode).
-
-- PDO MySQL:
-
- - (No PDOException or errorCode if database becomes unavailable before PDO::commit).
- - (PDOStatement::fetch() does not throw exception on broken server connection).
-
-- SNMP:
-
- - (disable md5 code when it is not supported in net-snmp).
-
-- Standard:
-
- - (parse_url silently drops port number 0).
-
-
-
-
-
-
-
-Version 7.4.12
-
-- Core:
-
- - (Copying large files may have suboptimal performance).
- - (copy command is limited to size of file it can copy).
- - (Covariant return types failing compilation).
- - (Segfault when iterating over FFI object).
-
-- Calendar:
-
- - (jdtounix() fails after 2037).
-
-- IMAP:
-
- - (imap_mail_compose() segfaults on certain $bodies).
- - (imap_mail_compose() may modify by-val parameters).
- - (imap_mail_compose() may leak memory).
- - (imap_mail_compose() leaks envelope on malformed bodies).
- - (imap_mail_compose() does not validate types/encodings).
- - (imap_sort() leaks sortpgm memory).
-
-- MySQLnd:
-
- - (mysqlnd.debug doesn't recognize absolute paths with slashes).
- - (mysqli_query() fails for ~16 MB long query when compression is enabled).
-
-- ODBC:
-
- - (odbc_specialcolumns() no longer accepts $nullable).
- - (BINARY strings may not be properly zero-terminated).
- - (Failure to fetch error message).
- - (odbc_execute() moves internal pointer of $params).
- - (odbc_next_result corrupts prepared resource).
-
-- OPcache:
-
- - (Optimizer pass 6 removes variables used for ibm_db2 data binding).
- - (Assertion failure during block assembly of unreachable free with leading nop).
-
-- PCRE:
-
- - Updated to PCRE 10.35.
- - (Erroneous whitespace match with JIT only).
-
-- PDO_ODBC:
-
- - (NULL Pointer dereference in odbc_handle_preparer).
-
-- Standard:
-
- - (parse_url does not accept URLs with port 0).
- - (Inconsistent stream_wrapper_restore() errors).
- - (Incorrect message in fopen on invalid mode).
-
-- Tidy:
-
- - (tidyNode::isHtml() is completely broken).
-
-
-
-
-
-
-
-Version 7.4.11
-
-- Core:
-
- - (PHP parses encoded cookie names so malicious `__Host-` cookies can be sent). (CVE-2020-7070)
- - (passing value to by-ref param via CUFA crashes).
- - (Typed property must not be accessed before initialization when __get() declared).
- - (Bug has not been fixed for Windows).
- - (Memleak when coercing integers to string via variadic argument).
-
-- Calendar:
-
- - (Potential type confusion in unixtojd() parameter parsing).
-
-- COM:
-
- - (COM obj parameters passed by reference are not updated).
-
-- OPcache:
-
- - (calc free space for new interned string is wrong).
- - (FREE for SWITCH_STRING optimized away).
- - (opcache.file_cache causes SIGSEGV when custom opcode handlers changed).
-
-- OpenSSL:
-
- - (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV). (CVE-2020-7069)
-
-- PDO:
-
- - (Terrible performance using $query->fetch on queries with many bind parameters).
-
-- SOAP:
-
- - (SoapClient stumbles over WSDL delivered with "Transfer-Encoding: chunked").
-
-- Standard:
-
- - (str_ireplace bug with diacritics characters).
- - (getmxrr test bug).
- - (Modifying bucket->data by-ref has no effect any longer).
- - (Omitting the port in bindto setting errors).
-
-
-
-
-
-
-
-Version 7.4.10
-
-- Core:
-
- - (PHP_CONFIG_FILE_PATH is meaningless).
- - (File extensions are case-sensitive).
- - (realpath() erroneously resolves link to link).
- - (PHP_CHECK_GCC_ARG does not allow flags with equal sign).
- - (Stack use-after-scope in define()).
- - (CRLF-only line in heredoc causes parsing error).
- - (Memory leak on invalid offset type in compound assignment).
-
-- COM:
-
- - (com_load_typelib holds reference, fails on second call).
-
-- Exif:
-
- - (Many errors from exif_read_data).
-
-- Gettext:
-
- - (Tests fail due to relying on Linux fallback behavior for gettext()).
-
-- LDAP:
-
-- OPcache:
-
- - (php failed with error after temp folder cleaned up).
- - (File cache segfault with a static variable in inherited method).
-
-- PDO:
-
- - (errorInfo property of PDOException is null when PDO::__construct() fails).
-
-- Session:
-
- - (Return type does not match in ext/session/mod_mm.c).
-
-- Standard:
-
- - (array_merge_recursive() crashes when called with array with single reference).
- - (getmxrr always returns true on Alpine linux).
- - (Memory leak in str_replace of empty string).
-
-- XML:
-
- - (Crash after multiple calls to xml_parser_free()).
-
-
-
-
-
-
-
-Version 7.4.9
-
-- Apache:
-
- - (Upgrade apache2handler's php_apache_sapi_get_request_time to return usec).
-
-- COM:
-
- - (BSTR to PHP string conversion not binary safe).
- - (DCOM does not work with Username, Password parameter).
-
-- Core:
-
- - (serialize() and unserialize() methods can not be called statically).
- - (Segfault in php_str_replace_common).
- - (Assertion failure if dumping closure with unresolved static variable).
- - (Assertion failure when assigning property of string offset by reference).
- - (HT iterators not removed if empty array is destroyed).
- - (Changing array during undef index RW error segfaults).
- - (Use after free if changing array during undef var during array write fetch).
- - (Use after free if string used in undefined index warning is changed).
- - (Public non-static property in child should take priority over private static).
- - (getimagesize function silently truncates after a null byte) (cmb)
-
-- Fileinfo:
-
- - (finfo_file crash (FILEINFO_MIME)).
-
-- FTP:
-
- - (ftp_size on large files).
-
-- Mbstring:
-
- - (mb_strimwidth does not trim string).
-
-- Phar:
-
- - (Use of freed hash key in the phar_parse_zipfile function). (CVE-2020-7068)
-
-- Reflection:
-
- - (::getStaticProperties() ignores property modifications).
- - (::getStaticPropertyValue() throws on protected props).
- - (Use after free when type duplicated into ReflectionProperty gets resolved).
-
-- Standard:
-
- - (Can't copy() large 'data://' with open_basedir).
- - (dns_check_record() always return true on Alpine).
- - (array_walk() does not respect property types).
-
-
-
-
-
-
-
-Version 7.4.8
-
-- Core:
-
- - (zend_init_fpu() alters FPU precision).
- - (php-win.exe 100% cpu lockup).
- - (get_defined_functions(true) may miss functions).
- - (Fake reflection scope affects __toString()).
- - Fixed possibly unsupported timercmp() usage.
-
-- Exif:
-
- - (Sony picture - PHP Warning - Make, Model, MakerNotes).
-
-- Fileinfo:
-
- - (mime_content_type/finfo returning incorrect mimetype).
-
-- Filter:
-
- - (Invalid memory access in php_filter_strip).
-
-- GD:
-
- - (imagescale adds black border with IMG_BICUBIC).
-
-- OpenSSL:
-
- - (default_socket_timeout=-1 causes connection to timeout).
-
-- PDO SQLite:
-
- - (PDOStatement::getColumnMeta fails on empty result set).
-
-- phpdbg:
-
- - (phpdbg will not accept input on restart execution).
- - (phpdbg fails with windows error prompt at "watch array").
- - Fixed several mostly Windows related phpdbg bugs.
-
-- SPL:
-
- - (Reproducible segfault in error_handler during GC involved an SplFileObject).
-
-- Standard:
-
- - (segfault with streams and invalid data).
-
-
-
-
-
-
-Version 7.4.7
-
-- Core:
-
- - (coredump in set_error_handler).
- - (Private SHM is not private on Windows).
- - (.user.ini does not inherit).
- - (Regression in 7.4.6 when yielding an array based generator).
- - ("yield from" hangs when invalid value encountered).
-
-- FFI:
-
- - (FFI: var_dumping unions may segfault).
-
-- GD:
-
- - (Wrong GIF header written in GD GIFEncode).
-
-- MySQLnd:
-
- - (MySQL FLOAT truncates to int some locales).
-
-- Opcache:
-
- - (Boolean opcache settings ignore on/off values).
- - (Preloading segfault with inherited method using static variable).
- - (RTD collision with opcache).
-
-- Standard:
-
- - (dns_get_record() fails with DNS_ALL).
-
-
-
-
-
-Version 7.4.6
-
-- Core:
-
- - (Generator yields no items after valid() call).
- - (casting object into array creates references).
- - (Memory leaks while including unexistent file).
- - (PHP incompatible with 3rd party file system on demand).
- - (Unable to interact with files inside a VFS for Git repository).
- - (Long variables cause OOM and temp files are not cleaned). (CVE-2019-11048).
- - (Long variables in multipart/form-data cause OOM and temp files are not cleaned). (CVE-2019-11048).
-
-- DOM:
-
- - (DOMNode::normalize() doesn't remove empty text nodes).
-
-- EXIF:
-
- - (ext/exif/tests/bug79046.phpt fails on Big endian arch).
-
-- FCGI:
-
- - (Search for .user.ini extends up to root dir).
-
-- MBString:
-
- - (Segfault in mb_chr() if internal encoding is unsupported).
-
-- OpenSSL:
-
- - (stream_socket_client() throws an unknown error sometimes with <1s timeout).
-
-- PCRE:
-
- - Upgraded to PCRE2 10.34.
-
-- Phar:
-
- - (Memory leak on duplicate metadata).
-
-- SimpleXML:
-
- - (Different object of the same xml between 7.4.5 and 7.4.4).
-
-- SPL:
-
- - (__debugInfo() ignored while extending SPL classes).
- - (ArrayObject serialization drops the iterator class).
-
-- Standard:
-
- - (SIGSEGV when closing stream handle with a stream filter appended).
- - (Serializing uninitialized typed properties with __sleep should not throw).
-
-
-
-
-
-
-Version 7.4.5
-
-- Core:
-
- - (When copy empty array, next key is unspecified).
- - (Invalid pointer address).
-
-- CURL:
-
- - (curl_copy_handle() memory leak).
-
-- Date:
-
- - (DateTime hour incorrect during DST jump forward).
- - (DateTimeZone loose comparison always true).
-
-- FPM:
-
- - (Allow numeric [UG]ID in FPM listen.{owner,group}) (Andre Nathan)
-
-- Iconv:
-
- - (Some iconv functions cut Windows-1258).
-
-- OPcache:
-
- - (Opcache chokes and uses 100% CPU on specific script).
-
-- Session:
-
- - (session_create_id() fails for active sessions).
-
-- Shmop:
-
- - (Integer Overflow in shmop_open()).
-
-- SimpleXML:
-
- - (SXE properties may lack attributes and content).
-
-- SOAP:
-
- - (SOAP request segfaults when any request parameter is missing).
-
-- Spl:
-
- - (SplStack::unserialize() behavior).
- - (Null coalescing operator failing with SplFixedArray).
-
-- Standard:
-
- - (shell_exec() silently truncates after a null byte).
- - (system() swallows last chunk if it is exactly 4095 bytes without newline).
- - (OOB Read in urldecode()). (CVE-2020-7067)
-
-- Zip:
-
- - (ZipArchive::open fails on empty file).
- - (php_zip_glob uses gl_pathc after call to globfree).
-
-
-
-
-
-
-Version 7.4.4
-
-- Core:
-
- - (get_headers() silently truncates after a null byte) (CVE-2020-7066)
- - (php crashes during parsing INI file).
- - (restore_error_handler does not restore previous errors mask).
-
-- COM:
-
- - (COMPersistHelper::SaveToFile can save to wrong location).
- - (COM error constants don't match com_exception codes on x86).
- - (Garbage collecting variant objects segfaults).
- - (Traversing empty VT_ARRAY throws com_exception).
- - (com_print_typeinfo prints duplicate variables).
- - (php_istreams are never freed).
- - (com_print_typeinfo() leaks memory).
-
-- CURL:
-
- - (Copied cURL handles upload empty file).
- - (Content-Length missing when posting a curlFile with curl).
-
-- DOM:
-
- - : (Write Access Violation in DomImplementation).
- - (DOMDocumentType::$childNodes is NULL).
-
-- Enchant:
-
- - (enchant_dict_suggest() fails on big endian architecture).
-
-- EXIF:
-
- - (Use-of-uninitialized-value in exif) (CVE-2020-7064).
-
-- Fileinfo:
-
- - (Segfault in libmagic patch contains a buffer overflow).
-
-- FPM:
-
- - (operator displayed instead of the real error message).
- - (PHP-FPM & Primary script unknown).
-
-- MBstring:
-
- - (mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full) (CVE-2020-7065).
-
-- MySQLi:
-
- - (mysqli reports different client_version).
-
-- MySQLnd:
-
- - (Support auth_plugin_caching_sha2_password on Windows).
-
-- Opcache:
-
- - (preloading causes php-fpm to segfault during exit).
-
-- PCRE:
-
- - (Memory corruption in preg_replace/preg_replace_callback and unicode).
- - (Segmentation fault on preg_match()).
- - (Duplicate named groups (?J) prefer last alternative even if not matched).
-
-- PDO_ODBC:
-
- - (PDOStatement::nextRowset() leaks column values).
-
-- Reflection:
-
- - (Property with heredoc default value returns false for getDocComment).
-
-- SQLite3:
-
- - (::columnType() may fail after SQLite3Stmt::reset()).
-
-- Standard:
-
- - (getenv() w/o arguments not showing changes).
- - (Improper injection of Host header when using fopen for http requests).
-
-- Zip:
-
- - (ZipArchive::addFile doesn't honor start/length parameters).
-
-
-
-
-
-
-Version 7.4.3
-
-- Core:
-
- - (cscript can fail to run on some systems).
- - (Property nullability lost when using multiple property definition).
- - (Code 0 is returned on invalid options).
- - (Delayed variance check involving trait segfaults).
- - (cookie values with spaces fail to round-trip).
- - (Use-after-free when accessing already destructed backtrace arguments).
-
-- COM:
-
- - (Garbage collecting variant objects segfaults).
-
-- CURL:
-
- - (Hypothetical use-after-free in curl_multi_add_handle()).
-
-- FFI:
-
- - (FFI Struct Segfault).
-
-- IMAP:
-
- - (IMAP extension can't find OpenSSL libraries at configure time).
-
-- Intl:
-
- - (NumberFormatter::format() may detect wrong type).
-
-- Libxml:
-
- - (Error in SoapClient ctor disables DOMDocument::save()).
-
-- MBString:
-
- - (SEGV in mb_convert_encoding with non-string encodings).
-
-- MySQLi:
-
- - (Properties may emit a warning on var_dump()).
-
-- MySQLnd:
-
- - (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH).
- - (MySQL caching_sha2_password Access denied for password with more than 20 chars).
-
-- Opcache:
-
- - (Eval class during preload causes class to be only half available).
- - (Preloading segfaults if preload_user is used).
- - (Incorrect type inference for self::$field =& $field).
-
-- OpenSSL:
-
- - (openssl memory leak).
-
-- Phar:
-
- - (Files added to tar with Phar::buildFromIterator have all-access permissions). (CVE-2020-7063)
- - (heap-buffer-overflow in phar_extract_file). (CVE-2020-7061)
- - (PharFileInfo::decompress not working).
-
-- Reflection:
-
- - (ReflectionClass::isCloneable call reflected class __destruct).
-
-- Session:
-
- - (Null Pointer Dereference in PHP Session Upload Progress). (CVE-2020-7062)
-
-- Standard:
-
- - (Memory leak when using stream_filter_append).
- - (PASSWORD_DEFAULT should match PASSWORD_BCRYPT instead of being null).
-
-- Testing:
-
- - (bug45161.phpt takes forever to finish).
-
-- XSL:
-
- - (XSL callbacks with nodes as parameter leak memory).
-
-- Zip:
-
- - Add ZipArchive::CM_LZMA2 and ZipArchive::CM_XZ constants (since libzip 1.6.0).
- - Add ZipArchive::RDONLY (since libzip 1.0.0).
- - Add ZipArchive::ER_* missing constants.
- - Add ZipArchive::LIBZIP_VERSION constant.
- - (Wrong return for ZipArchive::addEmptyDir Method).
-
-
-
-
-
-
-Version 7.4.2
-
-- Core:
-
- - Preloading support on Windows has been disabled.
- - (class_exists returns True for classes that are not ready to be used).
- - (plus signs in cookie values are converted to spaces).
- - (Destructor during CV freeing causes segfault if opline never saved).
- - (Abstract method implementation from trait does not check "static").
- - (Cycle leak when using function result as temporary).
- - (General performance regression with PHP 7.4 on Windows).
- - (Serializing uninitialized typed properties with __sleep makes unserialize throw).
-
-- CURL:
-
- - (Curl timeout error with specific url and post).
- - (curl openssl does not respect PKG_CONFIG_PATH).
-
-- Date:
-
- - (undefined-behavior in php_date.c).
-
-- DBA:
-
- - ([LMDB] MDB_MAP_FULL: Environment mapsize limit reached).
-
-- Exif:
-
- - (NaN to int cast undefined behavior in exif).
-
-- Fileinfo:
-
- - (locale information change after mime_content_type).
-
-- GD:
-
- - (gdTransformAffineCopy() may use unitialized values).
- - (gdTransformAffineCopy() changes interpolation method).
-
-- Libxml:
-
- - (Use After Free's in XMLReader / XMLWriter).
-
-- Mbstring:
-
- - (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). (CVE-2020-7060)
-
-- OPcache:
-
- - (erroneous optimization of re-assigned $GLOBALS).
- - (Preloading trait method with static variables).
- - (Conflict in RTD key for closures results in crash).
- - (Opcache segfaults when inheriting ctor from immutable into mutable class).
- - (Warning Opcode handlers are unusable due to ASLR).
- - (Typed property become unknown with OPcache file cache).
-
-- Pcntl:
-
- - (Converting null to string in error message is bad DX).
-
-- PDO_PgSQL:
-
- - (pdo_pgsql config.w32 cannot find libpq-fe.h).
- - (pgsqlGetNotify() overlooks dead connection).
- - (pdo_pgsql returns dead persistent connection).
-
-- Session:
-
- - (heap use-after-free in session_create_id()).
- - (Session unserialization problem).
-
-- Shmop:
-
-- Sqlite3:
-
- - (sqlite does not respect PKG_CONFIG_PATH during compilation).
-
-- Spl:
-
- - (SplFileObject::fputcsv returns -1 on failure).
-
-- Standard:
-
- - (OOB read in php_strip_tags_ex). (CVE-2020-7059)
- - (Non-blocking socket stream reports EAGAIN as error).
- - (Using empty additional_headers adding extraneous CRLF).
-
-
-
-
-
-
-Version 7.4.1
-
-- Bcmath:
-
- - (Buffer underflow in bc_shift_addsub). (CVE-2019-11046).
-
-- Core:
-
- - (link() silently truncates after a null byte on Windows). (CVE-2019-11044).
- - (DirectoryIterator class silently truncates after a null byte). (CVE-2019-11045).
- - (mail() may release string with refcount==1 twice). (CVE-2019-11049).
- - (RW fetches do not throw "uninitialized property" exception).
- - (Calling __autoload() with incorrect EG(fake_scope) value).
- - (is_file fails to detect file).
- - (fgets(STDIN) fails on Windows).
- - (call_user_func(['parent', ...]) fails while other succeed).
- - (Uninitialized property triggers __get()).
- - (Segmentation fault on Symfony cache:clear).
-
-- GD:
-
- - (GD build broken with -D SIGNED_COMPARE_SLOW).
- - (Artifacts when convoluting image with transparency).
-
-- EXIF:
-
- - (Use-after-free in exif parsing under memory sanitizer). (CVE-2019-11050).
- - (Heap-buffer-overflow READ in exif). (CVE-2019-11047).
-
-- FPM:
-
- - (Partially working php-fpm ater incomplete reload).
- - (php-fpm service fails to start).
- - (php-fpm 7.4.0 don't send mail via mail()).
-
-- Intl:
-
- - (INTL Support for accounting format).
-
-- Mysqlnd:
-
- - (ZLIB_LIBS not added to EXTRA_LIBS).
-
-- OPcache:
-
- - Fixed $x = (bool)$x; with opcache (should emit undeclared variable notice).
- - (Preloading removes classes that have dependencies).
-
-- PCRE:
-
- - (preg_match() may return integer > 1).
-
-- Reflection:
-
- - (Reflection detects abstract non-static class as abstract static. IS_IMPLICIT_ABSTRACT is not longer used).
-
-- Standard:
-
- - (var_export'ing certain class instances segfaults).
- - (imploding $GLOBALS crashes).
- - (Integer overflow in pack causes out-of-bound access).
- - (strip_tags allows / in tag name => whitelist bypass).
-
-
-
-
-
-
-Version 7.4.0
-
-
-- Core:
-
- - Implemented RFC: Deprecate curly brace syntax for accessing array elements and string offsets.
- - Implemented RFC: Deprecations for PHP 7.4.
- - (Crash when lexing).
- - (CGI doesn't properly validate shebang line contains #!).
- - (Self-assignment in list() may have inconsistent behavior).
- - (Use After Free in GC with Certain Destructors).
- - (Inconsistent: No warning in some cases when stdObj is created on the fly).
- - (Add array_key_exists() to the list of specially compiled functions).
- - (__METHOD__ inconsistent outside of method).
- - (Aliases during inheritance type checks affected by opcache).
- - (Support custom CFLAGS and LDFLAGS from environment).
- - (Stack Overflow caused by circular reference in garbage collection).
- - (Interactive mode does not support PHP 7.3-style heredoc).
- - (call_user_func() passes $this to static methods).
- - (PHP eats the first byte of a program that comes from process substitution).
- - (Segfault caused by indirect expressions in PHP 7.4a1).
- - (SEND_VAR_NO_REF does not always send reference).
- - (Segmentation fault during by-reference property assignment).
- - (Segfault in built-in webserver).
- - (Can't access OneDrive folder).
- - (Unexpected __set behavior with typed properties).
- - (Deprecation notice during string conversion converted to exception hangs).
- - (Static properties/variables containing cycles report as leak).
- - (Include of stream wrapper not reading whole file).
- - (Segmentation fault on zend_check_protected).
- - (Array returned from ArrayAccess is incorrectly unpacked as argument).
- - (Cast to object confuses GC, causes crash).
- - (fstat mode has unexpected value on PHP 7.4).
- - (Second file_put_contents in Shutdown hangs script).
- - (Broken file includes with user-defined stream filters).
- - (Corruption when __unserializing deeply nested structures).
- - (Parse error due to heredoc identifier followed by digit).
- - (Consecutive numeric separators cause OOM error).
- - (PEAR installation failure).
- - (Crash when using undefined variable as object).
- - (auto_detect_line_endings value not parsed as bool).
- - (token_get_all() does not properly tokenize FOO<?php with short_open_tag=0).
- - (Does not compile with DTRACE anymore).
- - (Out of memory error).
- - (method_exists() in php74 works differently from php73 in checking priv. methods).
- - (SEGFAULT in ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER).
- - (Memory corruption using Closure::bindTo).
- - (Parse errors classified as highest log-level).
- - (stream_write bad error detection).
- - (redefinition of typedef zend_property_info).
- - (./configure generates invalid php_version.h).
- - Fixed incorrect usage of QM_ASSIGN instruction. It must not return IS_VAR. As a side effect, this allowed passing left hand list() "by reference", instead of compile-time error.
-
-
- - CLI:
-
- - The built-in CLI server now reports the request method in log files.
-
-
- - COM:
-
- - Deprecated registering of case-insensitive constants from typelibs.
- - (new COM Crash).
- - (Appending to a variant array causes segfault).
-
-
- - CURL:
-
- - (Use curl_multi_wait() so that timeouts are respected).
- - (CURLFile should support UNICODE filenames).
- - Deprecated CURLPIPE_HTTP1.
- - Deprecated $version parameter of curl_version().
-
-
- - Date:
-
- - Updated timelib to 2018.02.
- - (discrepency between time and microtime).
- - (\DateInterval incorrectly unserialized).
- - (print_r of DateTime creating side-effect).
- - (Casting a DateTime to array no longer returns its properties).
- - (Serialising DatePeriod converts DateTimeImmutable).
-
-
- - Exif:
-
- - (Exif crash (bus error) due to wrong alignment and invalid cast).
- - (heap-buffer-overflow on exif_process_user_comment). (CVE-2019-11042)
- - (heap-buffer-overflow on exif_scan_thumbnail). (CVE-2019-11041)
-
-
- - Fileinfo:
-
- - (finfo_file treats JSON file as text/plain).
- - (finfo_file shows wrong mime-type for .tga file).
-
-
- - Filter:
-
- - The filter extension no longer has the --with-pcre-dir on Unix builds, allowing the extension to be once more compiled as shared using ./configure.
- - Added min_range and max_range options for FILTER_VALIDATE_FLOAT.
-
-
- - FFI:
-
- - Added FFI extension.
- - (OOB in ZEND_FUNCTION(ffi_trampoline)).
- - (is_callable() on FFI\CData throws Exception).
- - (Function name mangling is wrong for some parameter types).
- - (Failing FFI::cast() may leak memory).
- - (Zend memory heap corruption with preload and casting).
- - (Support __vectorcall convention with FFI).
- - Added missing FFI::isNull().
-
-
- - FPM:
-
- - (systemd service should be hardened).
- - (master PHP-fpm is stopped on multiple reloads).
- - (fpm log prefix message includes wrong stdout/stderr notation).
- - (env_path_info underflow in fpm_main.c can lead to RCE). (CVE-2019-11043)
-
-
- - GD:
-
- - Implemented the scatter filter (IMG_FILTER_SCATTER).
- - The bundled libgd behaves now like system libgd wrt. IMG_CROP_DEFAULT never falling back to IMG_CROP_SIDES.
- - The default $mode parameter of imagecropauto() has been changed to IMG_CROP_DEFAULT; passing -1 is now deprecated.
- - Added support for aspect ratio preserving scaling to a fixed height for imagescale().
- - Added TGA read support.
- - (imagecropauto() $threshold differs from external libgd).
- - (cannot detect recent versions of freetype with pkg-config).
- - (missing freetype support/functions with external gd).
-
-
- - GMP:
-
- - (broken shared build).
-
-
- - Hash:
-
-
-
- Iconv:
-
- - (Bus error in configure test for iconv //IGNORE).
- - (Wrong libiconv version displayed).
-
-
- - Libxml:
-
- - (libxml_disable_entity_loader settings is shared between requests (cgi-fcgi)).
-
-
- - InterBase:
-
- - Unbundled the InterBase extension and moved it to PECL.
-
-
- - Intl:
-
- - Raised requirements to ICU ≥ 50.1.
- - Changed ResourceBundle to implement Countable.
- - Changed default of $variant parameter of idn_to_ascii() and idn_to_utf8().
-
-
- - LDAP:
-
- - Deprecated ldap_control_paged_result_response and ldap_control_paged_result
-
-
- - LiteSpeed:
-
- - Updated to LiteSpeed SAPI V7.5 (Fixed clean shutdown).
- - Updated to LiteSpeed SAPI V7.4.3 (increased response header count limit from 100 to 1000, added crash handler to cleanly shutdown PHP request, added CloudLinux mod_lsapi mode).
- - (After "POST data can't be buffered", using php://input makes huge tmp files).
-
-
- - MBString:
-
- - (mb-functions do not respect default_encoding).
- - (mb_decode_numericentity: args number inconsistency).
- - (mb_check_encoding() no longer supports stringable objects).
-
-
- - MySQLi:
-
- - (Reading $dbc->stat modifies $dbc->affected_rows).
- - (SSL settings aren't respected when persistent connections are used).
- - (MariaDB server version incorrectly detected).
- - (Empty row pocket).
-
-
- - MySQLnd:
-
- - Fixed connect_attr issues and added the _server_host connection attribute.
- - (mysqlnd exposes 160 lines of stats in phpinfo).
-
-
- - ODBC:
-
- - (odbc_close() closes arbitrary resources).
-
-
- - Opcache:
-
- - Implemented preloading RFC.
- - Add opcache.preload_user INI directive.
- - Added new INI directive opcache.cache_id (Windows only).
- - (Path resolution fails if opcache disabled during request).
- - (Preloading segfaults at preload time and at runtime).
- - (Opcache stats for cache hits are capped at 32bit NUM).
- - (Invalid result of if-else).
- - (Failure to detect smart branch in DFA pass).
- - (Incorrect preloading of constant static properties).
- - (opcache_compile_file(__FILE__); segfaults).
- - (Cannot make preload work).
- - (Preloading segfaults with inherited typed property).
- - (Incorrectly computed opcache checksum on files with non-ascii characters).
-
-
- - OpenSSL:
-
- - Added TLS 1.3 support to streams including new tlsv1.3 stream.
- - Added openssl_x509_verify function.
- - openssl_random_pseudo_bytes() now throws in error conditions.
- - Changed the default config path (Windows only).
- - (Segmentation fault upon stream_socket_accept of exported socket-to-stream).
- - (Assertion failure in openssl_random_pseudo_bytes).
- - (TLS issues from HTTP request affecting other encrypted connections).
-
-
- - Pcntl:
-
- - (PHP is preventing SIGALRM from specifying SA_RESTART).
-
-
- - PCRE:
-
- - (Support flags in preg_replace_callback).
- - (Repeated UTF-8 validation of same string in UTF-8 mode).
- - (Preg_match_all should return NULLs on trailing optional capture groups).
- - (Array cross-border reading in PCRE).
- - (Bundled pcre2 library missing LICENCE file).
-
-
- - PDO:
-
- - (Allow escaping question mark placeholders). https://wiki.php.net/rfc/pdo_escape_placeholders
- - (Disable cloning of PDO handle/connection objects).
- - (PDO - support username and password specified in DSN).
-
-
- - PDO_Firebird:
-
- - (PDO_Firebird should also support dialect 1).
- - (PDO firebird support type Boolean in input parameters).
-
-
- - PDO_MySQL:
-
- - (SP call yields additional empty result set).
- - (Regression caused by "SP call yields additional empty result set").
-
-
- - PDO_OCI:
-
- - Support Oracle Database tracing attributes ACTION, MODULE, CLIENT_INFO, and CLIENT_IDENTIFIER.
- - (PDO_OCI getColumnMeta() not implemented).
-
-
- - PDO_SQLite:
-
- - Implemented sqlite_stmt_readonly in PDO_SQLite.
- - Raised requirements to SQLite 3.5.0.
- - (SegFault when reuse statement after schema has changed).
- - (Remove -lrt from pdo_sqlite.so).
-
-
- - Phar:
-
- - (Potential UAF in Phar RSHUTDOWN).
-
-
- - phpdbg:
-
- - (phpdbg support for display_errors=stderr).
- - (too many open files).
- - (phpdbg segfaults on listing some conditional breakpoints).
- - (phpdbg build fails when readline is shared).
-
-
- - Recode:
-
- - Unbundled the recode extension.
-
-
- - Reflection:
-
- - (Unserialized reflection objects are broken, they shouldn't be serializable).
- - (\ReflectionReference::fromArrayElement() returns null while item is a reference).
- - (Cannot "manually" unserialize class that is final and extends an internal one).
- - (ReflectionClass::implementsInterface - inaccurate error message with traits).
- - (ReflectionNamedType on Typed Properties Crash).
-
-
- - Session:
-
- - (session_gc return value for user defined session handlers).
-
-
- - SimpleXML:
-
- - (SimpleXMLElement could register as implementing Countable).
- - (Don't set content of elements with only whitespaces).
-
-
- - Sockets:
-
- - (Validate length on socket_write).
- - (Multicasting may leak memory).
-
-
- - sodium:
-
- - (sign_detached() strings not terminated).
- - (Partially uninitialized buffer returned by sodium_crypto_generichash_init()).
- - (password_hash(): Memory cost is not in allowed range).
-
-
- - SPL:
-
- - (SeekableIterator::seek() should accept 'int' typehint as documented).
- - (Segfault when creating instance of ArrayIterator without constructor).
- - (Missing addref in SplPriorityQueue EXTR_BOTH mode).
- - (Segfault when serializing SplDoublyLinkedList).
-
-
- - SQLite3:
-
- - Unbundled libsqlite.
- - Raised requirements to SQLite 3.7.4.
- - Forbid (un)serialization of SQLite3, SQLite3Stmt and SQLite3Result.
- - Added support for the SQLite @name notation.
- - Added SQLite3Stmt::getSQL() to retrieve the SQL of the statement.
- - (Make SQLite3 Online Backup API available).
-
-
- - Standard:
-
- - Implemented RFC password hashing registry.
- - Implemented RFC where password_hash() has argon2i(d) implementations from ext/sodium when PHP is built without libargon.
- - (field enclosure behavior in fputcsv).
- - (fgetcsv should take empty string as an escape).
- - (php_sockop_write() returns 0 on error, can be used to trigger Denial of Service).
- - (Bindto IPv6 works with file_get_contents but fails with stream_socket_client).
- - (stream_get_line skips data if used with data-generating filter).
- - (No way to handle CTRL+C in Windows).
- - (stream_copy_to_stream should use mmap more often).
- - (Make proc_open accept command array).
- - (password_needs_rehash() with an unknown algo should always return true).
- - (touch() does not handle dates after 2038 in PHP 64-bit).
- - (atime and mtime mismatch).
- - (improper memory deallocation on stream_get_contents() with fixed length buffer).
- - (strip_tags no longer handling nested php tags).
- - (Error in a php_user_filter::filter() is not reported).
- - (Stack overflow due to nested serialized input).
- - (array_search in $GLOBALS).
-
-
- - Testing:
-
- - (PCRE bug72463_2 test is sending emails on Linux).
-
-
- - Tidy:
-
- - Added TIDY_TAG_* constants for HTML5 elements.
- - (wrong reflection for tidy_get_head, tidy_get_html, tidy_get_root, and tidy_getopt)
-
-
- - WDDX:
-
- - Deprecated and unbundled the WDDX extension.
-
-
- - Zip:
-
- - (addGlob can modify given remove_path value).
-
-
-
-
-
-
-
-
-Version 7.3.33
-
-- XML:
-
- - (special character is breaking the path in xml function). (CVE-2021-21707)
-
-
-
-
-
-
-
-Version 7.3.32
-
-- FPM:
-
- - (PHP-FPM oob R/W in root process leading to privilege escalation). (CVE-2021-21703)
-
-
-
-
-
-
-
-Version 7.3.31
-
-- Zip:
-
- - (ZipArchive::extractTo extracts outside of destination). (CVE-2021-21706)
-
-
-
-
-
-
-
-Version 7.3.30
-
-- Phar:
-
- - : Symlinks are followed when creating PHAR archive.
-
-
-
-
-
-
-
-Version 7.3.29
-
-- Core:
-
- - : SSRF bypass in FILTER_VALIDATE_URL. (CVE-2021-21705)
-
-- PDO_Firebird:
-
- - : Stack buffer overflow in firebird_info_cb. (CVE-2021-21704)
- - : SIGSEGV in firebird_handle_doer. (CVE-2021-21704)
- - : SIGSEGV in firebird_stmt_execute. (CVE-2021-21704)
- - : Crash while parsing blob data in firebird_fetch_blob. (CVE-2021-21704)
-
-
-
-
-
-
-
-Version 7.3.28
-
-- Imap:
-
- - (imap_mail_compose() header injection).
-
-
-
-
-
-
-
-Version 7.3.27
-
-- SOAP:
-
- - (Null Dereference in SoapClient). (CVE-2021-21702)
-
-
-
-
-
-
-
-Version 7.3.26
-
-- Standard:
-
- - (FILTER_VALIDATE_URL accepts URLs with invalid userinfo). (CVE-2020-7071)
- - (stream_get_contents() fails with maxlength=-1 or default).
-
-
-
-
-
-
-
-Version 7.3.25
-
-- Core:
-
- - (ADD_EXTENSION_DEP() fails for ext/standard and ext/date).
- - (Windows Deduplication Enabled, randon permission errors).
-
-- COM:
-
- - (com_event_sink crashes on certain arguments).
-
-- DOM:
-
- - (loadHTML() truncates at NUL bytes).
-
-- IMAP:
-
- - (imap_sort() does not return FALSE on failure).
- - (segfault on imap_reopen).
- - (imap_rfc822_write_address() leaks memory).
- - Fixed minor regression caused by fixing bug .
- - (imap_mail_compose() segfaults for multipart with rfc822).
-
-- Intl:
-
- - (ext-intl with icu4c 68.1: use of undeclared identifier 'TRUE').
-
-- ODBC:
-
- - (Fetching may rely on uninitialized data).
-
-- SNMP:
-
- - (disable md5 code when it is not supported in net-snmp).
-
-- Standard:
-
- - (parse_url silently drops port number 0).
-
-
-
-
-
-
-
-Version 7.3.24
-
-- Core:
-
- - (copy command is limited to size of file it can copy).
-
-- Calendar:
-
- - (jdtounix() fails after 2037).
-
-- IMAP:
-
- - (imap_mail_compose() segfaults on certain $bodies).
- - (imap_mail_compose() may modify by-val parameters).
- - (imap_mail_compose() may leak memory).
- - (imap_mail_compose() leaks envelope on malformed bodies).
- - (imap_mail_compose() does not validate types/encodings).
- - (imap_sort() leaks sortpgm memory).
-
-- MySQLnd:
-
- - (mysqlnd.debug doesn't recognize absolute paths with slashes).
- - (mysqli_query() fails for ~16 MB long query when compression is enabled).
-
-- ODBC:
-
- - (odbc_specialcolumns() no longer accepts $nullable).
- - (BINARY strings may not be properly zero-terminated).
- - (Failure to fetch error message).
- - (odbc_execute() moves internal pointer of $params).
- - (odbc_next_result corrupts prepared resource).
-
-- OPcache:
-
- - (Optimizer pass 6 removes variables used for ibm_db2 data binding).
-
-- PDO_ODBC:
-
- - (NULL Pointer dereference in odbc_handle_preparer).
-
-- Standard:
-
- - (parse_url does not accept URLs with port 0).
- - (Inconsistent stream_wrapper_restore() errors).
- - (Incorrect message in fopen on invalid mode).
-
-- Tidy:
-
- - (tidyNode::isHtml() is completely broken).
-
-
-
-
-
-
-
-Version 7.3.23
-
-- Core:
-
- - (Bug has not been fixed for Windows).
- - (Memleak when coercing integers to string via variadic argument).
- - (PHP parses encoded cookie names so malicious `__Host-` cookies can be sent). (CVE-2020-7070)
-
-- Calendar:
-
- - (Potential type confusion in unixtojd() parameter parsing).
-
-- COM:
-
- - (COM obj parameters passed by reference are not updated).
-
-- OPcache:
-
- - (calc free space for new interned string is wrong).
- - (opcache.file_cache causes SIGSEGV when custom opcode handlers changed).
-
-- OpenSSL:
-
- - (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV). (CVE-2020-7069)
-
-- PDO:
-
- - (Terrible performance using $query->fetch on queries with many bind parameters).
-
-- SOAP:
-
- - (SoapClient stumbles over WSDL delivered with "Transfer-Encoding: chunked").
-
-- Standard:
-
- - (str_ireplace bug with diacritics characters).
- - (getmxrr test bug).
- - (Modifying bucket->data by-ref has no effect any longer).
- - (Omitting the port in bindto setting errors).
-
-
-
-
-
-
-
-Version 7.3.22
-
-- Core:
-
- - (PHP_CONFIG_FILE_PATH is meaningless).
- - (File extensions are case-sensitive).
- - (realpath() erroneously resolves link to link).
- - (PHP_CHECK_GCC_ARG does not allow flags with equal sign).
- - (Stack use-after-scope in define()).
- - (CRLF-only line in heredoc causes parsing error).
-
-- COM:
-
- - (com_load_typelib holds reference, fails on second call).
-
-- Exif:
-
- - (Many errors from exif_read_data).
-
-- Gettext:
-
- - (Tests fail due to relying on Linux fallback behavior for gettext()).
-
-- LDAP:
-
-- OPcache:
-
- - (php failed with error after temp folder cleaned up).
-
-- PDO:
-
- - (errorInfo property of PDOException is null when PDO::__construct() fails).
-
-- Standard:
-
- - (array_merge_recursive() crashes when called with array with single reference).
- - (getmxrr always returns true on Alpine linux).
- - (Memory leak in str_replace of empty string).
-
-- XML:
-
- - (Crash after multiple calls to xml_parser_free()).
-
-
-
-
-
-
-
-Version 7.3.21
-
-- Apache:
-
- - (Upgrade apache2handler's php_apache_sapi_get_request_time to return usec).
-
-- Core:
-
- - (getimagesize function silently truncates after a null byte).
- - (Assertion failure if dumping closure with unresolved static variable).
- - (HT iterators not removed if empty array is destroyed).
-
-- COM:
-
- - (BSTR to PHP string conversion not binary safe).
- - (DCOM does not work with Username, Password parameter).
-
-- Curl:
-
- - (curl_setopt CURLOPT_POSTFIELDS asserts on object with declared properties).
-
-- Fileinfo:
-
- - (finfo_file crash (FILEINFO_MIME)).
-
-- FTP:
-
- - (ftp_size on large files).
-
-- Mbstring:
-
- - (mb_strimwidth does not trim string).
-
-- Phar:
-
- - (Use of freed hash key in the phar_parse_zipfile function). (CVE-2020-7068)
-
-- Standard:
-
- - (Can't copy() large 'data://' with open_basedir).
- - (str_replace() does not handle INDIRECT elements).
- - (dns_check_record() always return true on Alpine).
-
-
-
-
-
-
-
-Version 7.3.20
-
-- Core:
-
- - (php-win.exe 100% cpu lockup).
- - (get_defined_functions(true) may miss functions).
- - Fixed possibly unsupported timercmp() usage.
-
-- Exif:
-
- - (Sony picture - PHP Warning - Make, Model, MakerNotes).
-
-- Filter:
-
- - (Invalid memory access in php_filter_strip).
-
-- GD:
-
- - (imagescale adds black border with IMG_BICUBIC).
-
-- OpenSSL:
-
- - (default_socket_timeout=-1 causes connection to timeout).
-
-- PDO SQLite:
-
- - (PDOStatement::getColumnMeta fails on empty result set).
-
-- SPL:
-
- - (Reproducible segfault in error_handler during GC involved an SplFileObject).
-
-- Standard:
-
- - (segfault with streams and invalid data).
-
-
-
-
-
-
-
-Version 7.3.19
-
-- Core:
-
- - (Private SHM is not private on Windows).
- - (.user.ini does not inherit).
-
-- GD:
-
- - (Wrong GIF header written in GD GIFEncode).
-
-- MySQLnd:
-
- - (MySQL FLOAT truncates to int some locales).
-
-- Opcache:
-
- - (PHP crashes with specific opcache.optimization_level).
- - (Boolean opcache settings ignore on/off values).
-
-- Standard:
-
- - (dns_get_record() fails with DNS_ALL).
-
-
-
-
-
-
-
-Version 7.3.18
-
-- Core:
-
- - (Long filenames cause OOM and temp files are not cleaned). (CVE-2019-11048)
- - (Long variables in multipart/form-data cause OOM and temp files are not cleaned). (CVE-2019-11048)
- - (PHP 7.3 and PHP-7.4 crash with NULL-pointer dereference on !CS constant).
- - (casting object into array creates references).
- - (PHP incompatible with 3rd party file system on demand).
- - (Unable to interact with files inside a VFS for Git repository).
-
-- DOM:
-
- - (DOMNode::normalize() doesn't remove empty text nodes).
-
-- FCGI:
-
- - (Search for .user.ini extends up to root dir).
-
-- MBString:
-
- - (Segfault in mb_chr() if internal encoding is unsupported).
-
-- OpenSSL:
-
- - (stream_socket_client() throws an unknown error sometimes with <1s timeout).
-
-- Phar:
-
- - (Memory leak on duplicate metadata).
-
-- SimpleXML:
-
- - (Different object of the same xml between 7.4.5 and 7.4.4).
-
-- Standard:
-
- - (SIGSEGV when closing stream handle with a stream filter appended).
-
-
-
-
-
-
-
-Version 7.3.17
-
-- Core:
-
- - (When copy empty array, next key is unspecified).
- - (Invalid pointer address).
-
-- CURL:
-
- - (curl_copy_handle() memory leak).
-
-- Date:
-
- - (DateTime hour incorrect during DST jump forward).
-
-- Iconv:
-
- - (Some iconv functions cut Windows-1258).
-
-- OPcache:
-
- - (Opcache chokes and uses 100% CPU on specific script).
-
-- Session:
-
- - (session_create_id() fails for active sessions).
-
-- Shmop:
-
- - (Integer Overflow in shmop_open()).
-
-- SimpleXML:
-
- - (SXE properties may lack attributes and content).
-
-- Spl:
-
- - (SplStack::unserialize() behavior).
- - (Null coalescing operator failing with SplFixedArray).
-
-- Standard:
-
- - (shell_exec() silently truncates after a null byte).
- - (OOB Read in urldecode()). (CVE-2020-7067)
- - (system() swallows last chunk if it is exactly 4095 bytes without newline).
-
-- Zip:
-
- - (ZipArchive::open fails on empty file).
- - (php_zip_glob uses gl_pathc after call to globfree).
-
-
-
-
-
-
-
-Version 7.3.16
-
-- Core:
-
- - (restore_error_handler does not restore previous errors mask).
-
-- COM:
-
- - (COMPersistHelper::SaveToFile can save to wrong location).
- - (COM error constants don't match com_exception codes on x86).
- - (Traversing empty VT_ARRAY throws com_exception).
- - (com_print_typeinfo prints duplicate variables).
- - (php_istreams are never freed).
- - (com_print_typeinfo() leaks memory).
-
-- DOM:
-
- - : (Write Access Violation in DomImplementation).
- - (DOMDocumentType::$childNodes is NULL).
-
-- Enchant:
-
- - (enchant_dict_suggest() fails on big endian architecture).
-
-- EXIF:
-
- - (Use-of-uninitialized-value in exif). (CVE-2020-7064)
-
-- MBstring:
-
- - (mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full). (CVE-2020-7065)
-
-- MySQLi:
-
- - (mysqli reports different client_version).
-
-- PCRE:
-
- - (Memory corruption in preg_replace/preg_replace_callback and unicode).
-
-- PDO_ODBC:
-
- - (PDOStatement::nextRowset() leaks column values).
-
-- Reflection:
-
- - (Property with heredoc default value returns false for getDocComment).
-
-- SQLite3:
-
- - (::columnType() may fail after SQLite3Stmt::reset()).
-
-- Standard:
-
- - (get_headers() silently truncates after a null byte). (CVE-2020-7066)
- - (getenv() w/o arguments not showing changes).
- - (Improper injection of Host header when using fopen for http requests).
-
-
-
-
-
-
-
-Version 7.3.15
-
-- Core:
-
- - (Memory corruption htmlspecialchars(): charset `*' not supported).
- - (cscript can fail to run on some systems).
- - (Code 0 is returned on invalid options).
- - (Use-after-free when accessing already destructed backtrace arguments).
-
-- CURL:
-
- - (Hypothetical use-after-free in curl_multi_add_handle()).
-
-- Intl:
-
- - (NumberFormatter::format() may detect wrong type).
-
-- Libxml:
-
- - (Error in SoapClient ctor disables DOMDocument::save()).
-
-- MBString:
-
- - (mb_convert_encoding() can modify $from_encoding).
-
-- MySQLnd:
-
- - (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH).
-
-- OpenSSL:
-
- - (openssl memory leak).
-
-- Phar:
-
- - (Files added to tar with Phar::buildFromIterator have all-access permissions). (CVE-2020-7063)
- - (heap-buffer-overflow in phar_extract_file). (CVE-2020-7061)
- - (PharFileInfo::decompress not working).
-
-- Reflection:
-
- - (ReflectionClass::isCloneable call reflected class __destruct).
-
-- Session:
-
- - (Null Pointer Dereference in PHP Session Upload Progress). (CVE-2020-7062)
-
-- SPL:
-
- - (heap use after free caused by spl_dllist_it_helper_move_forward).
-
-- Standard:
-
- - (Memory leak when using stream_filter_append).
-
-- Testing:
-
- - (bug45161.phpt takes forever to finish).
-
-- XSL:
-
- - (XSL callbacks with nodes as parameter leak memory).
-
-
-
-
-
-
-
-Version 7.3.14
-
-- Core:
-
- - (Cycle leak when using function result as temporary).
-
-- CURL:
-
- - (Curl timeout error with specific url and post).
-
-- Date:
-
- - (undefined-behavior in php_date.c).
-
-- DBA:
-
- - ([LMDB] MDB_MAP_FULL: Environment mapsize limit reached).
-
-- Fileinfo:
-
- - (locale information change after mime_content_type).
-
-- GD:
-
- - (Artifacts when convoluting image with transparency).
- - (gdTransformAffineCopy() may use unitialized values).
- - (gdTransformAffineCopy() changes interpolation method).
-
-- Libxml:
-
- - (Use After Free's in XMLReader / XMLWriter).
-
-- Mbstring:
-
- - (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). (CVE-2020-7060)
-
-- OPcache:
-
- - (Warning Opcode handlers are unusable due to ASLR).
-
-- Pcntl:
-
- - (Converting null to string in error message is bad DX).
-
-- PDO_PgSQL:
-
- - (pdo_pgsql config.w32 cannot find libpq-fe.h).
- - (pgsqlGetNotify() overlooks dead connection).
- - (pdo_pgsql returns dead persistent connection).
-
-- Session:
-
- - (heap use-after-free in session_create_id()).
-
-- Shmop:
-
-- Standard:
-
- - (OOB read in php_strip_tags_ex). (CVE-2020-7059)
- - (Using empty additional_headers adding extraneous CRLF).
-
-
-
-
-
-
-
-Version 7.3.13
-
-- Bcmath:
-
- - (Buffer underflow in bc_shift_addsub). (CVE-2019-11046)
-
-- Core:
-
- - (link() silently truncates after a null byte on Windows). (CVE-2019-11044)
- - (DirectoryIterator class silently truncates after a null byte). (CVE-2019-11045)
- - (mail() may release string with refcount==1 twice). (CVE-2019-11049)
- - (Segfault with trait overriding inherited private shadow property).
- - (Calling __autoload() with incorrect EG(fake_scope) value).
- - (is_file fails to detect file).
-
-- EXIF:
-
- - (Use-after-free in exif parsing under memory sanitizer). (CVE-2019-11050)
- - (Heap-buffer-overflow READ in exif) (CVE-2019-11047).
-
-- GD:
-
- - (GD build broken with -D SIGNED_COMPARE_SLOW).
-
-- MBString:
-
- - Upgraded bundled Oniguruma to 6.9.4.
-
-- OPcache:
-
- - Fixed potential ASLR related invalid opline handler issues.
- - Fixed $x = (bool)$x; with opcache (should emit undeclared variable notice).
-
-- PCRE:
-
- - (preg_match() may return integer > 1).
-
-- Standard:
-
- - (array_search in $GLOBALS).
- - (var_export'ing certain class instances segfaults).
- - (imploding $GLOBALS crashes).
- - (Integer overflow in pack causes out-of-bound access).
- - (strip_tags allows / in tag name => whitelist bypass).
-
-
-
-
-
-
-
-Version 7.3.12
-
-- Core:
-
- - (Memory corruption using Closure::bindTo).
- - (Parse errors classified as highest log-level).
- - (Segfault if GC triggered while generator stack frame is being destroyed).
- - (Closure::fromCallable() doesn't handle [Closure, '__invoke']).
-
-- COM:
-
- - (Appending to a variant array causes segfault).
-
-- Date:
-
- - (\DateInterval incorrectly unserialized).
- - (Serialising DatePeriod converts DateTimeImmutable).
-
-- Iconv:
-
- - (Wrong libiconv version displayed).
-
-- OpCache:
-
- - (Incorrectly computed opcache checksum on files with non-ascii characters).
- - (OpCache corrupts custom extension result).
-
-- OpenSSL:
-
- - (TLS issues from HTTP request affecting other encrypted connections).
-
-- Reflection:
-
- - (ReflectionClass::ImplementsInterface - inaccurate error message with traits).
-
-- Sockets:
-
- - (Multicasting may leak memory).
-
-
-
-
-
-
-
-Version 7.3.11
-
-- Core:
-
- - (auto_detect_line_endings value not parsed as bool).
- - (Out of memory error).
-
-- Exif:
-
- - ('Illegal component' on exif_read_data since PHP7) (Kalle)
-
-- FPM:
-
- - (env_path_info underflow in fpm_main.c can lead to RCE). (CVE-2019-11043)
- - (request_terminate_timeout does not take effect after fastcgi_finish_request).
-
-- MBString:
-
- - (Heap buffer overflow (read) in mb_eregi).
- - (mb_decode_numericentity: args number inconsistency).
- - (mb_check_encoding() no longer supports stringable objects).
-
-- MySQLi:
-
- - (SSL settings aren't respected when persistent connections are used).
-
-- Mysqlnd:
-
- - (Memory leak in pdo when reusing native prepared statements).
-
-- PCRE:
-
- - (calling preg_match() before pcntl_fork() will freeze child process).
-
-- PDO_MySQL:
-
- - (Regression caused by "SP call yields additional empty result set").
-
-- Session:
-
- - (session_gc return value for user defined session handlers).
-
-- Standard:
-
- - (file_get_contents waits twice specified timeout).
- - (strtr leaks memory when integer keys are used and the subject string shorter).
- - (stream_get_line skips data if used with data-generating filter).
-
-- Zip:
-
- - (addGlob can modify given remove_path value).
-
-
-
-
-
-
-
-Version 7.3.10
-
-- Core:
-
- - (Can't access OneDrive folder).
- - (Double release of doc comment on inherited shadow property).
- - (Parse error due to heredoc identifier followed by digit).
- - (Interactive mode does not support PHP 7.3-style heredoc).
-
-- FastCGI:
-
- - (FastCGI on_accept hook is not called when using named pipes on Windows).
-
-- FPM:
-
- - (fpm log prefix message includes wrong stdout/stderr notation).
-
-- Intl:
-
- - Ensure IDNA2003 rules are used with idn_to_ascii() and idn_to_utf8() when requested.
-
-- MBString:
-
- - (Heap buffer overflow in mb_eregi).
-
-- MySQLnd:
-
- - Fixed connect_attr issues and added the _server_host connection attribute.
-
-- ODBC:
-
- - (odbc_close() closes arbitrary resources).
-
-- PDO_MySQL:
-
- - (SP call yields additional empty result set).
-
-- sodium:
-
- - (Partially uninitialized buffer returned by sodium_crypto_generichash_init()).
-
-
-
-
-
-
-
-Version 7.3.9
-
-- Core:
-
- - (Buffer overflow in zendparse).
- - (Cast to object confuses GC, causes crash).
- - (Generator incorrectly reports non-releasable $this as GC child).
-
-- Curl:
-
- - (Bad cURL resources returned by curl_multi_info_read()).
-
-- Exif:
-
- - (Exif crash (bus error) due to wrong alignment and invalid cast).
-
-- FPM:
-
- - (Use-after-free in FPM master event handling).
-
-- Iconv:
-
- - (Bus error in configure test for iconv //IGNORE).
-
-- LiteSpeed:
-
- - Updated to LiteSpeed SAPI V7.5 (Fixed clean shutdown).
-
-- MBString:
-
- - (Oniguruma 6.9.3 fixes CVEs). (CVE-2019-13224)
-
-- MySQLnd:
-
- - (MariaDB server version incorrectly detected).
- - (Empty row pocket).
-
-- Opcache:
-
- - (Assertion failure in dce_live_ranges() when silencing is used).
-
-- Standard:
-
- - (Bus error from stream_copy_to_stream (file -> SSL stream) with invalid length).
- - (atime and mtime mismatch).
- - (improper memory deallocation on stream_get_contents() with fixed length buffer).
- - (strip_tags no longer handling nested php tags).
-
-
-
-
-
-
-
-Version 7.3.8
-
-- Core:
-
- - Added syslog.filter=raw option.
- - (Segfault in built-in webserver).
-
-- Date:
-
- - (discrepency between time and microtime).
- - Updated timelib to 2018.02.
-
-- EXIF:
-
- - (heap-buffer-overflow on exif_process_user_comment). (CVE-2019-11042)
- - (heap-buffer-overflow on exif_scan_thumbnail). (CVE-2019-11041)
-
-- FTP:
-
- - (FTP with SSL memory leak).
-
-- Libxml:
-
- - (libxml_disable_entity_loader settings is shared between requests (cgi-fcgi)).
-
-- LiteSpeed:
-
- - Updated to LiteSpeed SAPI V7.4.3 (increased response header count limit from 100 to 1000, added crash handler to cleanly shutdown PHP request, added CloudLinux mod_lsapi mode).
- - (After "POST data can't be buffered", using php://input makes huge tmp files).
-
-- Openssl:
-
- - (Segmentation fault upon stream_socket_accept of exported socket-to-stream).
-
-- Opcache:
-
- - (Failure to detect smart branch in DFA pass).
- - (file cache strips last character of uname hash).
- - (Opcache stats for cache hits are capped at 32bit NUM).
- - (Invalid result of if-else).
- - (opcache_get_configuration doesn't list all directives).
-
-- PCRE:
-
- - (Array cross-border reading in PCRE).
- - (PCRE2 version check in configure fails for "##.##-xxx" version strings).
-
-- PDO_Sqlite:
-
- - (SegFault when reuse statement after schema has changed).
-
-- Phar:
-
- - (Potential UAF in Phar RSHUTDOWN).
-
-- Phpdbg:
-
- - (Include unexistent file memory leak).
-
-- SQLite:
-
- - Upgraded to SQLite 3.28.0.
-
-- Standard:
-
- - (touch() does not handle dates after 2038 in PHP 64-bit).
- - (password_hash uses weak options for argon2).
-
-
-
-
-
-
-
-Version 7.3.7
-
-- Core:
-
- - (Interface gets skipped if autoloader throws an exception).
-
-- DOM:
-
- - (segfault when accessing properties of DOMDocumentType).
-
-- MySQLi:
-
- - (When mysqli.allow_local_infile = Off, use a meaningful error message).
- - (bindParam incorrect processing of bool types).
-
-- MySQLnd:
-
- - (Random segmentation fault in mysqlnd from php-fpm).
-
-- Opcache:
-
- - (Incorrect evaluation of expressions involving partials arrays in SCCP).
- - (Path resolution fails if opcache disabled during request).
-
-- OpenSSL:
-
- - (openssl_encrypt_ccm.phpt fails with OpenSSL 1.1.1c).
-
-- phpdbg:
-
- - (SegFault phpdbg + opcache on include file twice).
-
-- Sockets:
-
- - (Socket_select fails when resource array contains references).
-
-- Sodium:
-
- - (segfault when calling sodium_* functions from eval).
-
-- Standard:
-
- - (Extract with EXTR_SKIP should skip $this).
- - (preg_match failed).
-
-- Zip:
-
-
-
-
-
-
-Version 7.3.6
-
-- cURL:
-
- - (Add missing CURL_VERSION_* constants).
-
-- Date:
-
- - (DatePeriod::__construct() with invalid recurrence count value).
-
-- EXIF:
-
- - (heap-buffer-overflow on php_jpg_get16) (CVE-2019-11040).
-
-- FPM:
-
- - (php-fpm kill -USR2 not working).
- - (static.php.net doesn't work anymore).
-
-- GD:
-
- - (imageantialias($image, false); does not work).
- - (Uninitialized read in gdImageCreateFromXbm) (CVE-2019-11038).
-
-- Iconv:
-
- - (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow) (CVE-2019-11039).
-
-- JSON:
-
- - (Use after free with json serializer).
-
-- Opcache:
-
- - Fixed possible crashes, because of inconsistent PCRE cache and opcache SHM reset.
-
-- PDO_MySQL:
-
- - (Wrong meta pdo_type for bigint on LLP64).
-
-- Reflection:
-
- - (Inconsistent reflection of Closure:::__invoke()).
-
-- Session:
-
- - (Wrong warning for session.sid_bits_per_character).
-
-- SOAP:
-
- - (Segmentation fault when constructing SoapClient with WSDL_CACHE_BOTH).
-
-- SPL:
-
- - (SplFileObject::__toString() may return array).
-
-- SQLite:
-
- - (Bypassing open_basedir restrictions via file uris).
-
-- Standard:
-
- - (Warning for array_map mentions wrong type).
- - (strip_tags output change since PHP 7.3).
-
-
-
-
-Version 7.3.5
-
-- Core:
-
- - (ArrayIterator stops iterating after offsetSet call).
-
-- CLI:
-
- - (Incorrect Date header format in built-in server).
-
-- EXIF:
-
- - (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG) (CVE-2019-11036).
-
-- Interbase:
-
- - (Impossibility of creating multiple connections to Interbase with php 7.x).
-
-- Intl:
-
- - (IntlDateFormatter::create fails in strict mode if $locale = null).
-
-- litespeed:
-
- - LiteSpeed SAPI 7.3.1, better process management, new API function litespeed_finish_request().
-
-- LDAP:
-
- - (Core dump when using server controls) (mcmic)
-
-- Mail:
-
- - (Potential heap corruption in TSendMail()).
-
-- mbstring:
-
- - (Implement regex stack limits for mbregex functions).
-
-- MySQLi:
-
- - (Unbuffered queries leak memory - MySQLi / mysqlnd).
-
-- PCRE:
-
- - (preg_match does not ignore \r in regex flags).
-
-- PDO:
-
- - (Disable cloning of PDO handle/connection objects).
-
-- phpdbg:
-
- - (too many open files).
- - (phpdbg segfaults on listing some conditional breakpoints).
- - (phpdbg build fails when readline is shared).
-
-- Reflection:
-
- - (ReflectionClass::getMethods(null) doesn't work).
- - (Different behavior: always calls destructor).
-
-- Standard:
-
- - (Segmentation fault in extract() when overwriting reference with itself).
- - (Crash due to null pointer in parse_ini_string with INI_SCANNER_TYPED).
- - (Inconsistent substr_compare behaviour with empty haystack).
-
-
-
-
-
-Version 7.3.4
-
-- Core:
-
- - (Nullptr deref in zend_compile_expr).
- - (Segmentation fault on break 2147483648).
- - (Anonymous classes can lose their interface information).
- - (Stack Overflow caused by circular reference in garbage collection).
- - (Wrong value for 'syslog.filter' documented in php.ini).
-
-- Apache2Handler:
-
- - (BOM in sapi/apache2handler/php_functions.c).
-
-- Bcmath:
-
- - (bcpow() implementation related to gcc compiler optimization).
-
-- CLI Server:
-
- - (Incorrect IP set to $_SERVER['REMOTE_ADDR'] on the localhost).
-
-- COM:
-
- - (Crash when php unload).
-
-- EXIF:
-
- - (Heap-buffer-overflow in php_ifd_get32s). (CVE-2019-11034)
- - (Heap-buffer-overflow in exif_iif_add_value). (CVE-2019-11035)
-
-- FPM:
-
- - (FPM fails to build on AIX due to missing WCOREDUMP).
-
-- GD:
-
- - (Writing truecolor images as GIF ignores interlace flag).
-
-- MySQLi:
-
- - (mysqli_fetch_field hangs scripts).
-
-- Opcache:
-
- - (Incorrect pi node insertion for jmpznz with identical successors).
-
-- PCRE:
-
- - (preg_split does not raise an error on invalid UTF-8).
-
-- Phar:
-
- - (Crash on Big_Endian platform).
-
-- phpdbg:
-
- - (phpdbg break cmd aliases listed in help do not match actual aliases).
-
-- sodium:
-
- - (sign_detached() strings not terminated).
-
-- SQLite3:
-
- - Added sqlite3.defensive INI directive.
-
-- Standard:
-
- - (Segmentation fault when using undefined constant in custom wrapper).
- - (Crash in extract() when overwriting extracted array).
- - (var_export() does not create a parsable value for PHP_INT_MIN).
- - (FTP stream wrapper should set the directory as executable).
-
-
-
-
-
-Version 7.3.3
-
-- Core:
-
- - (Core dump using parse_ini_string with numeric sections).
- - (Buffer Overflow via overly long Error Messages).
- - (Disabling class causes segfault on member access).
- - (Custom extension Segmentation fault when declare static property).
- - (PHP crashes when parsing `(2)::class`).
- - (iptcembed broken function).
- - (rename() across the device may allow unwanted access during processing). (CVE-2019-9637)
-
-- COM:
-
- - (Already defined constants are not properly reported).
- - (Persistence confusion in php_com_import_typelib()).
-
-- EXIF:
-
- - (Uninitialized read in exif_process_IFD_in_TIFF). (CVE-2019-9641)
- - (Invalid Read on exif_process_SOFn). (CVE-2019-9640)
- - (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (CVE-2019-9638)
- - (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (CVE-2019-9639)
-
-- Mbstring:
-
- - (mb_ereg_replace() with trailing backslash adds null byte).
-
-- MySQL:
-
- - Disabled LOCAL INFILE by default, can be enabled using php.ini directive mysqli.allow_local_infile for mysqli, or PDO::MYSQL_ATTR_LOCAL_INFILE attribute for pdo_mysql.
-
-- OpenSSL:
-
- - (feof might hang on TLS streams in case of fragmented TLS records).
-
-- PDO_OCI:
-
- - Support Oracle Database tracing attributes ACTION, MODULE, CLIENT_INFO, and CLIENT_IDENTIFIER.
-
-- PHAR:
-
- - (Null Pointer Dereference in phar_create_or_parse_filename).
- - (phar_tar_writeheaders_int() buffer overflow).
-
-- phpdbg:
-
- - (phpdbg support for display_errors=stderr).
-
-- SPL:
-
- - (DirectoryIterator glob:// don't support current path relative queries).
- - (openFile() silently truncates after a null byte).
-
-- Standard:
-
- - (Unintialized php_stream_statbuf in stat functions).
- - (setcookie() sets incorrect SameSite header if all of its options filled).
-
-
-
-
-
-Version 7.3.2
-
-- Core:
-
- - (memcpy with negative length via crafted DNS response). (CVE-2019-9022)
- - (Recursion detection broken when printing GLOBALS).
- - ("undefined function" message no longer includes namespace).
- - (base64_encode / base64_decode doest not work on nested VM).
- - (__callStatic may get incorrect arguments).
- - (__DIR__, __FILE__, realpath() reveal physical path for subst virtual drive).
- - (Segfault when using 2 RecursiveFilterIterator).
- - (PHP 7.3 built with ASAN crashes in zend_cpu_supports_avx2).
- - (Zend engine crashes when calling realpath in invalid working dir).
-
-- Curl:
-
- - (Segfault with H2 server push).
-
-- Fileinfo:
-
- - (webm files incorrectly detected as application/octet-stream).
-
-- FPM:
-
- - (php-fpm crashes with Main process exited, code=dumped, status=11/SEGV).
-
-- GD:
-
- - (imagescale(…, IMG_BILINEAR_FIXED) can cause black border).
- - (gdImageFilledArc() doesn't properly draw pies).
- - (imagescale() may return image resource on failure).
- - (1bpp BMPs may fail to be loaded).
- - (imagewbmp() segfaults with very large images).
-
-- ldap:
-
- - (ldap_bind using ldaps or ldap_start_tls()=exception in libcrypto-1_1-x64.dll).
-
-- Mbstring:
-
- - (mb_ereg_replace() doesn't replace a substitution variable).
- - (mb_scrub() silently truncates after a null byte).
-
-- MySQLnd:
-
- - (Unbuffered queries memory leak).
- - (In mysqlnd_ext_plugin.h the plugin methods family has no external visibility).
-
-- Opcache:
-
- - (Assertion failed in dce_live_ranges).
- - (value of variable assigned in a switch() construct gets lost).
- - (php-fpm workers are segfaulting in zend_gc_addre).
- - (configure fails on 64-bit AIX when opcache enabled).
- - (Opcache literal compaction is incompatible with EXT opcodes).
-
-- PCRE:
-
- - (get_browser with empty string).
-
-- PDO:
-
- - (array_walk_recursive corrupts value types leading to PDO failure).
-
-- PDO MySQL:
-
- - (PDO MySQL segfaults with persistent connection).
-
-- SOAP:
-
- - (Segmentation Fault when executing method with an empty parameter).
-
-- Sockets:
-
- - (socket_recvfrom may return an invalid 'from' address on MacOS).
-
-- SPL:
-
- - (segfault occurs when add property to unserialized empty ArrayObject).
-
-- Standard:
-
- - (segfault about array_multisort).
- - (parse_str segfaults when inserting item into existing array).
-
-
-
-
-
-Version 7.3.1
-
-- Core:
-
- - (Build failure on Mac OS X on 32-bit Intel).
- - (zend_signal_startup() needs ZEND_API).
- - (PHP generates "FE_FREE" opcode on the wrong line).
- - (magic methods inherited from a trait may be ignored).
-
-- CURL:
-
- - (curl_getinfo returning microseconds, not seconds).
-
-- COM:
-
- - (Serializing or unserializing COM objects crashes).
-
-- Exif:
-
- - (Unsigned rational numbers are written out as signed rationals).
-
-- GD:
-
- - (Incorrect error handling of imagecreatefromjpeg()).
- - (auto cropping has insufficient precision).
- - (imagecropauto(…, GD_CROP_SIDES) crops left but not right).
- - (efree() on uninitialized Heap data in imagescale leads to use-after-free). (CVE-2016-10166)
- - (imagecolormatch Out Of Bounds Write on Heap). (CVE-2019-6977)
-
-- MBString:
-
- - (Negative size parameter in mb_split). (CVE-2019-9025)
- - (Buffer overflow on mb regex functions - fetch_token). (CVE-2019-9023)
- - (heap buffer overflow in mb regex functions - compile_string_node). (CVE-2019-9023)
- - (heap buffer overflow in multibyte match_at). (CVE-2019-9023)
- - (heap buffer overflow due to incorrect length in expand_case_fold_string). (CVE-2019-9023)
- - (buffer overflow in fetch_token). (CVE-2019-9023)
- - (Buffer overflow in multibyte case folding - unicode). (CVE-2019-9023)
- - (Heap overflow in utf32be_mbc_to_code). (CVE-2019-9023)
-
-- OCI8:
-
- - (oci_pconnect with OCI_CRED_EXT not working).
- - Added oci_set_call_timeout() for call timeouts.
- - Added oci_set_db_operation() for the DBOP end-to-end-tracing attribute.
-
-- Opcache:
-
- - (CFG assertion failure on multiple finalizing switch frees in one block).
- - (OPcache optimization problem for ArrayAccess->offsetGet).
-
-- PCRE:
-
- - (Infinite loop in preg_replace_callback).
-
-- PDO:
-
- - Handle invalid index passed to PDOStatement::fetchColumn() as error.
-
-- Phar:
-
- - (heap buffer overflow in phar_detect_phar_fname_ext). (CVE-2019-9021)
-
-- Soap:
-
- - (Segfault when using SoapClient with null options).
-
-- Sockets:
-
- - (Unsupported IPV6_RECVPKTINFO constants on macOS).
-
-- Sodium:
-
- - (SodiumException segfaults on PHP 7.3).
-
-- SPL:
-
- - (spl_autoload causes segfault).
- - (class_uses causes segfault).
-
-- SQLite3:
-
- - (Issue with re-binding on SQLite3).
-
-- Xmlrpc:
-
- - (heap out of bounds read in xmlrpc_decode()). (CVE-2019-9020)
- - (Global out of bounds read in xmlrpc base64 code). (CVE-2019-9024)
-
-
-
-
-
-Version 7.3.0
-
-- Core:
-
- - Improved PHP GC.
- - Redesigned the old ext_skel program written in PHP, run: 'php ext_skel.php' for all options. This means there are no dependencies, thus making it work on Windows out of the box.
- - Removed support for BeOS.
- - Add PHP_VERSION to phpinfo() <title/>.
- - Add net_get_interfaces().
- - Implemented flexible heredoc and nowdoc syntax, per RFC https://wiki.php.net/rfc/flexible_heredoc_nowdoc_syntaxes.
- - Added support for references in list() and array destructuring, per RFC https://wiki.php.net/rfc/list_reference_assignment.
- - Improved effectiveness of ZEND_SECURE_ZERO for NetBSD and systems without native similar feature.
- - Added syslog.facility and syslog.ident INI entries for customizing syslog logging.
- - (Memory leak in zend_register_functions() in ZTS mode).
- - (support append mode in temp/memory streams).
- - (Uncaught exceptions not being formatted properly when error_log set to "syslog").
- - (Segfault when calling is_callable on parent).
- - (broken links and unused config items in distributed ini files).
- - (Composed class has fatal error with duplicate, equal const properties).
- - (identical trait methods raise errors during composition).
- - (Clang ignores fastcall calling convention on variadic function).
- - (Remove inconsitency of internal exceptions and user defined exceptions).
- - (Mathematical operations convert objects to integers).
- - (Internal class cast handler uses integer instead of float).
- - (Fatal error instead of Error exception when base class is not found).
- - (Wording: "iterable" is not a scalar type).
- - (config.guess/config.sub do not recognize RISC-V).
- - (Segfault in zend_objects_store_put).
- - (ftruncate fails on files > 2GB).
- - (Inherited static properties can be desynchronized from their parent by ref).
- - (Changed behaviour in unclosed HereDoc).
- - (Constant numeric strings become integers when used as ArrayAccess offset).
- - (Some nullary functions don't check the number of arguments).
- - (Error relocating sapi/cli/php: unsupported relocation type 37).
- - The declaration and use of case-insensitive constants has been deprecated.
- - Added syslog.filter INI entry for syslog filtering.
- - (Segfault with divide-assign op and __get + __set).
- - (RE2C_FLAGS rarely honoured) (Cristian Rodríguez)
- - Fixed broken zend_read_static_property (Laruence)
- - (Traits used on the parent are ignored for child classes).
- - (‘asm’ operand has impossible constraints in zend_operators.h).
- - (Crash in ZEND_COALESCE_SPEC_TMP_HANDLER - assertion in _get_zval_ptr_tmp failed).
- - (Z_COPYABLE invalid definition).
- - (file_exists() stopped working for phar://).
- - (Incorrect bypassing protected method accessibilty check).
- - (Undefined class used by class constant in constexpr generates fatal error).
- - (file_put_contents() blocks the directory of the file (__DIR__)).
- - (define() error message does not mention resources as valid values).
- - (Undefined symbols ___cpuid_count).
- - (undefined symbol zend_string_equal_val in C++ build).
- - (Segfault when using convert.quoted-printable-encode filter).
-
-- BCMath:
-
- - (No way to get current scale in use).
- - (BCMath bcmul ignores scale parameter).
- - (split_bc_num() is pointless).
- - (BCMath errors/warnings bypass PHP's error handling).
-
-- CLI:
-
- - (Output after stdout/stderr closed cause immediate exit with status 0).
- - (php-win.exe corrupts unicode symbols from cli parameters).
-
-- cURL:
-
- - Expose curl constants from curl 7.50 to 7.61.
- - (Fixed finding CURL on systems with multiarch support).
-
-- Date:
-
- - : Add DateTime::createFromImmutable() method.
- - (DateInterval microseconds property always 0).
- - (calling var_dump on a DateTimeZone object modifies it).
- - (mismatch arginfo for date_create).
- - Updated timelib to 2018.01RC1 to address several bugs:
- - (DateTime::createFromFormat does not accept 'v' format specifier).
- - (Wrap around behaviour for microseconds is not working).
- - (DateTime::diff gives wrong diff when the actual diff is less than 1 second).
-
-- DBA:
-
- - (compiler warnings emitted).
-
-- DOM:
-
- - (DOMDocument::formatOutput attribute sometimes ignored).
-
-- Fileinfo:
-
- - (slowness regression in 7.2/7.3 (compared to 7.1)).
-
-- Filter:
-
- - Added the 'add_slashes' sanitization mode (FILTER_SANITIZE_ADD_SLASHES).
-
-- FPM:
-
- - Added fpm_get_status function.
- - (getallheaders() missing with PHP-FPM).
- - (Long messages into stdout/stderr are truncated incorrectly) - added new log related FPM configuration options: log_limit, log_buffering and decorate_workers_output.
-
-- ftp:
-
- - (ftp_close(): SSL_read on shutdown).
-
-- GD:
-
- - Added support for WebP in imagecreatefromstring().
-
-- GMP:
-
- - Export internal structures and accessor helpers for GMP object.
- - Added gmp_binomial(n, k).
- - Added gmp_lcm(a, b).
- - Added gmp_perfect_power(a).
- - Added gmp_kronecker(a, b).
-
-- iconv:
-
- - (iconv_mime_encode() fails to Q-encode UTF-8 string).
- - (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR).
-
-- IMAP:
-
- - (imap_open allows to run arbitrary shell commands via mailbox parameter). (CVE-2018-19518)
- - (null pointer dereference in imap_mail).
-
-- Interbase:
-
- - (Incorrect reflection for ibase_[p]connect).
- - (php+php_interbase.dll crash on module_shutdown).
-
-- intl:
-
- - (UConverter::setDestinationEncoding changes source instead of destination).
- - (Incorrect validation of domain on idn_to_utf8() function).
-
-- JSON:
-
- - Added JSON_THROW_ON_ERROR flag.
-
-- LDAP:
-
- - Added ldap_exop_refresh helper for EXOP REFRESH operation with dds overlay.
- - Added full support for sending and parsing ldap controls.
- - (Fix LDAP path lookup on 64-bit distros).
-
-- libxml2:
-
- - (use pkg-config where available).
-
-- litespeed:
-
- - (Binary directory doesn't get created when building only litespeed SAPI).
- - (Missing program prefix and suffix).
-
-- MBstring:
-
- - Updated to Oniguruma 6.9.0.
- - (mb title case conversion-first word in quotation isn't capitalized).
- - (MB_CASE_TITLE misbehaves with curled apostrophe/quote).
- - (Crash in zif_mb_send_mail).
- - (mbstring functions version 7.1.1 are slow compared to 5.3 on Windows).
- - (mb_strtolower with invalid UTF-8 causes segmentation fault).
- - (use of undeclared identifiers INT_MAX and LONG_MAX).
- - (Bus Error due to unaligned access in zend_ini.c OnUpdateLong).
- - (mbstring.http_output_conv_mimetypes is ignored).
- - (Broken UTF7-IMAP conversion).
- - (mb_strpos throws Unknown encoding or conversion error).
- - (mb_check_encoding crashes when argument given an empty array).
-
-- Mysqlnd:
-
- - (Prepared Statement formatter truncates fractional seconds from date/time column).
-
-- ODBC:
-
- - Removed support for ODBCRouter.
- - Removed support for Birdstep.
- - (odbc_fetch_object has incorrect type signature).
-
-- Opcache:
-
- - (Loop variable confusion).
- - (var has array key type but not value type).
- - (zend_variables.c:73: zend_string_destroy: Assertion `!(zval_gc_flags((str)->gc)).
- - (OPcache enabled triggers false-positive "Illegal string offset").
- - (Type inference in opcache causes side effects).
- - (array_diff_key() - segmentation fault).
-
-- OpenSSL:
-
- - Added openssl_pkey_derive function.
- - Add min_proto_version and max_proto_version ssl stream options as well as related constants for possible TLS protocol values.
-
-- PCRE:
-
- - Implemented https://wiki.php.net/rfc/pcre2-migration.
- - Upgrade PCRE2 to 10.32.
- - (preg_quote() does not quote # control character).
- - (\w no longer includes unicode characters).
- - (Regression in preg_match makes it fail with PREG_JIT_STACKLIMIT_ERROR).
- - (preg_match difference between 7.3 and < 7.3).
-
-- PDO_DBlib:
-
- - (allow 0-column rowsets to be skipped automatically).
- - Expose TDS version as \PDO::DBLIB_ATTR_TDS_VERSION attribute on \PDO instance.
- - Treat DATETIME2 columns like DATETIME.
- - (allow locales.conf to drive datetime format).
-
-- PDO_Firebird:
-
- - (PDO_Firebird returns only NULLs for results with boolean for FIREBIRD >= 3.0).
-
-- PDO_OCI:
-
- - (PDO_PCO with PHP-FPM: OCI environment initialized before PHP-FPM sets it up).
-
-- PDO SQLite:
-
- - Add support for additional open flags
-
-- pgsql:
-
- - Added new error constants for pg_result_error(): PGSQL_DIAG_SCHEMA_NAME, PGSQL_DIAG_TABLE_NAME, PGSQL_DIAG_COLUMN_NAME, PGSQL_DIAG_DATATYPE_NAME, PGSQL_DIAG_CONSTRAINT_NAME and PGSQL_DIAG_SEVERITY_NONLOCALIZED.
- - (pg_convert has a broken regex for the 'TIME WITHOUT TIMEZONE' data type).
-
-- phar:
-
- - (include_path has a 4096 char limit in some cases).
- - (deal with leading slash when adding files correctly).
- - (PharData always creates new files with mode 0666).
- - (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile). (CVE-2018-20783)
-
-- readline:
-
- - Added completion_append_character and completion_suppress_append options to readline_info() if linked against libreadline.
-
-- Session:
-
- - (session fails to start after having headers sent).
-
-- SimpleXML:
-
- - (SimpleXML casts integers wrong).
- - (Assignment of empty string creates extraneous text node).
-
-- Sockets:
-
- - (Validate length on socket_write).
-
-- SOAP:
-
- - (Wrong reflection on SoapClient::__setSoapHeaders).
- - (SoapClient generates E_ERROR even if exceptions=1 is used).
- - (SoapClient can't handle object references correctly).
- - (WSDL_CACHE_MEMORY causes Segmentation fault).
- - (Signedness issue in SOAP when precision=-1).
-
-- SPL:
-
- - (Appending AppendIterator leads to segfault).
- - (incorrect behavior of AppendIterator::append in foreach loop).
- - (autoloading file with syntax error uses next autoloader, may hide parse error).
- - (RecursiveTreeIterator::setPostfix has wrong signature).
- - (strange behavior of AppendIterator).
- - (mismatch arginfo for splarray constructor).
-
-- SQLite3:
-
- - Updated bundled libsqlite to 3.24.0.
-
-- Standard:
-
- - Added is_countable() function.
- - Added support for the SameSite cookie directive, including an alternative signature for setcookie(), setrawcookie() and session_set_cookie_params().
- - Remove superfluous warnings from inet_ntop()/inet_pton().
- - (DNS_CAA record results contain garbage).
- - Fixed unserialize(), to disable creation of unsupported data structures through manually crafted strings.
- - (accept EFAULT in addition to ENOSYS as indicator that getrandom() is missing).
- - (fopen() should accept NULL as context).
- - (path/domain are not sanitized in setcookie).
- - (incorrect url in header for mt_rand).
- - Added hrtime() function, to get high resolution time.
- - (stdClass::__setState is not defined although var_export() uses it).
- - (stream_socket_get_name should enclose IPv6 in brackets).
- - (Disallow excessive parameters after options array).
- - (Segmentation fault caused by property corruption).
- - (setcookie does not accept "double" type for expire time).
- - (improve array_* failure messages exposing what was passed instead of an array).
- - (ftruncate changes file pointer).
- - (Memory corruption and segfault).
- - (ftruncate() changes seek pointer in c mode).
-
-- Testing:
-
- - (Make run-tests.php support --CGI-- sections).
-
-- Tidy:
-
- - Support using tidyp instead of tidy.
- - (Tidy has incorrect ReflectionFunction param counts for functions taking tidy).
- - Fixed arginfo for tidy::__construct().
-
-- Tokenizer:
-
- - (token_get_all with TOKEN_PARSE flag fails to recognise close tag).
- - (Change remaining uncatchable fatal errors for parsing into ParseError).
- - (token_get_all with TOKEN_PARSE flag fails to recognise close tag with newline).
- - (Incorrect tokenization of multiple invalid flexible heredoc strings).
-
-- XML:
-
- - (External entity processing never fails).
-
-- Zlib:
-
- - Added zlib/level context option for compress.zlib wrapper.
-
-
-
-
-
-
-
-Version 7.2.34
-
-- Core:
-
- - (PHP parses encoded cookie names so malicious `__Host-` cookies can be sent). (CVE-2020-7070)
-
-- OpenSSL:
-
- - (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV). (CVE-2020-7069)
-
-
-
-
-
-Version 7.2.33
-
-- Core:
-
- - (getimagesize function silently truncates after a null byte) (cmb)
-
-- Phar:
-
- - (Use of freed hash key in the phar_parse_zipfile function). (CVE-2020-7068)
-
-
-
-
-
-Version 7.2.32
-
-- Windows:
-
- - Rebuild of official Windows binaries with patched libcurl. No PHP source changes.
-
-
-
-
-
-
-
-Version 7.2.31
-
-- Core:
-
- - (Long filenames cause OOM and temp files are not cleaned). (CVE-2019-11048)
- - (Long variables in multipart/form-data cause OOM and temp files are not cleaned). (CVE-2019-11048)
-
-
-
-
-
-Version 7.2.30
-
-- Standard:
-
- - (SIGSEGV when closing stream handle with a stream filter appended).
- - (shell_exec() silently truncates after a null byte).
- - (OOB Read in urldecode()).
-
-
-
-
-
-
-
-Version 7.2.29
-
-- Core:
-
- - (get_headers() silently truncates after a null byte) (CVE-2020-7066) (cmb)
-
-- EXIF:
-
- - (Use-of-uninitialized-value in exif) (CVE-2020-7064) (Nikita)
-
-
-
-
-
-Version 7.2.28
-
-- DOM:
-
- - : (Write Access Violation in DomImplementation).
-
-- Phar:
-
- - (Files added to tar with Phar::buildFromIterator have all-access permissions). (CVE-2020-7063)
-
-- Session:
-
- - (Null Pointer Dereference in PHP Session Upload Progress). (CVE-2020-7062)
-
-
-
-
-
-Version 7.2.27
-
-- Mbstring:
-
- - (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). (CVE-2020-7060)
-
-- Session:
-
- - (heap use-after-free in session_create_id()).
-
-- Standard:
-
- - (OOB read in php_strip_tags_ex). (CVE-2020-7059)
-
-
-
-
-
-Version 7.2.26
-
-- Bcmath:
-
- - (Buffer underflow in bc_shift_addsub). (CVE-2019-11046)
-
-- Core:
-
- - (link() silently truncates after a null byte on Windows). (CVE-2019-11044)
- - (DirectoryIterator class silently truncates after a null byte). (CVE-2019-11045)
-
-- EXIF:
-
- - (Use-after-free in exif parsing under memory sanitizer). (CVE-2019-11050)
- - (Heap-buffer-overflow READ in exif). (CVE-2019-11047)
-
-- GD:
-
- - (GD build broken with -D SIGNED_COMPARE_SLOW).
-
-- Intl:
-
- - (Segmentation fault in Locale::filterMatches).
-
-- OPcache:
-
- - Fixed $x = (bool)$x; with opcache (should emit undeclared variable notice).
-
-- Standard:
-
- - (array_search in $GLOBALS).
- - (Integer overflow in pack causes out-of-bound access).
- - (strip_tags allows / in tag name => whitelist bypass).
-
-
-
-
-
-
-Version 7.2.25
-
-- Core:
-
- - (Parse errors classified as highest log-level).
- - (Segfault if GC triggered while generator stack frame is being destroyed).
- - (Closure::fromCallable() doesn't handle [Closure, '__invoke']).
-
-- COM:
-
- - (Appending to a variant array causes segfault).
-
-- Date:
-
- - (\DateInterval incorrectly unserialized).
- - (Serialising DatePeriod converts DateTimeImmutable).
-
-- Iconv:
-
- - (Wrong libiconv version displayed). (gedas at martynas, cmb).
-
-- OpCache:
-
- - (Incorrectly computed opcache checksum on files with non-ascii characters).
- - (OpCache corrupts custom extension result).
-
-- OpenSSL:
-
- - (TLS issues from HTTP request affecting other encrypted connections).
-
-- Reflection:
-
- - (ReflectionClass::ImplementsInterface - inaccurate error message with traits).
-
-- Sockets:
-
- - (Multicasting may leak memory).
-
-
-
-
-
-
-
-Version 7.2.24
-
-- Core:
-
- - (auto_detect_line_endings value not parsed as bool).
- - (Out of memory error).
-
-- Exif:
-
- - ('Illegal component' on exif_read_data since PHP7) (Kalle)
-
-- FPM:
-
- - (env_path_info underflow in fpm_main.c can lead to RCE). (CVE-2019-11043)
-
-- MBString:
-
- - (mb_decode_numericentity: args number inconsistency).
- - (mb_check_encoding() no longer supports stringable objects).
-
-- MySQLi:
-
- - (SSL settings aren't respected when persistent connections are used).
-
-- PDO_MySQL:
-
- - (Regression caused by "SP call yields additional empty result set").
-
-- Session:
-
- - (session_gc return value for user defined session handlers).
-
-- Standard:
-
- - (file_get_contents waits twice specified timeout).
- - (strtr leaks memory when integer keys are used and the subject string shorter).
- - (stream_get_line skips data if used with data-generating filter).
-
-- Zip:
-
- - (addGlob can modify given remove_path value).
-
-
-
-
-
-Version 7.2.23
-
-- Core:
-
- - (Can't access OneDrive folder).
- - (Generator incorrectly reports non-releasable $this as GC child).
-
-- FastCGI:
-
- - (FastCGI on_accept hook is not called when using named pipes on Windows).
-
-- MySQLnd:
-
- - Fixed connect_attr issues and added the _server_host connection attribute.
-
-- ODBC:
-
- - (odbc_close() closes arbitrary resources).
-
-- PDO_MySQL:
-
- - (SP call yields additional empty result set).
-
-- sodium:
-
- - (Partially uninitialized buffer returned by sodium_crypto_generichash_init()).
-
-- SPL:
-
- - (SplObject isCloneable() returns true but errs on clone).
-
-
-
-
-
-
-
-Version 7.2.22
-
-- Core:
-
- - (Buffer overflow in zendparse).
- - (Cast to object confuses GC, causes crash).
-
-- Curl:
-
- - (Bad cURL resources returned by curl_multi_info_read()).
-
-- Exif:
-
- - (Exif crash (bus error) due to wrong alignment and invalid cast).
-
-- Iconv:
-
- - (Bus error in configure test for iconv //IGNORE).
-
-- LiteSpeed:
-
- - Updated to LiteSpeed SAPI V7.5 (Fixed clean shutdown).
-
-- MySQLnd:
-
- - (MariaDB server version incorrectly detected).
-
-- Opcache:
-
- - (Assertion failure in dce_live_ranges() when silencing is used).
-
-- Standard:
-
- - (Bus error from stream_copy_to_stream (file -> SSL stream) with invalid length).
- - (atime and mtime mismatch).
- - (improper memory deallocation on stream_get_contents() with fixed length buffer).
-
-
-
-
-
-
-
-Version 7.2.21
-
-- Date:
-
- - (discrepency between time and microtime).
-
-- EXIF:
-
- - (heap-buffer-overflow on exif_process_user_comment). (CVE-2019-11042)
- - (heap-buffer-overflow on exif_scan_thumbnail). (CVE-2019-11041)
-
-- Fileinfo:
-
- - (finfo_file shows wrong mime-type for .tga file).
-
-- FTP:
-
- - (FTP with SSL memory leak).
-
-- Libxml:
-
- - (libxml_disable_entity_loader settings is shared between requests (cgi-fcgi)).
-
-- LiteSpeed:
-
- - Updated to LiteSpeed SAPI V7.4.3 (increased response header count limit from 100 to 1000, added crash handler to cleanly shutdown PHP request, added CloudLinux mod_lsapi mode).
- - (After "POST data can't be buffered", using php://input makes huge tmp files).
-
-- Openssl:
-
- - (Segmentation fault upon stream_socket_accept of exported socket-to-stream).
-
-- OPcache:
-
- - (file cache strips last character of uname hash).
- - (Opcache stats for cache hits are capped at 32bit NUM).
- - (opcache_get_configuration doesn't list all directives).
-
-- Phar:
-
- - (Potential UAF in Phar RSHUTDOWN).
-
-- Phpdbg:
-
- - (Include unexistent file memory leak).
-
-- PDO_Sqlite:
-
- - (SegFault when reuse statement after schema has changed).
-
-- SQLite:
-
- - Upgraded to SQLite 3.28.0.
-
-- Standard:
-
- - (touch() does not handle dates after 2038 in PHP 64-bit).
- - (password_hash uses weak options for argon2).
-
-- XMLRPC:
-
- - (XML-RPC mutates immutable objects during encoding).
-
-
-
-
-
-Version 7.2.20
-
-- Core:
-
- - (Interface gets skipped if autoloader throws an exception).
-
-- DOM:
-
- - (segfault when accessing properties of DOMDocumentType).
-
-- MySQLi:
-
- - (When mysqli.allow_local_infile = Off, use a meaningful error message).
- - (bindParam incorrect processing of bool types).
-
-- Opcache:
-
- - (Path resolution fails if opcache disabled during request).
-
-- OpenSSL:
-
- - (openssl_encrypt_ccm.phpt fails with OpenSSL 1.1.1c).
-
-- Sockets:
-
- - (Socket_select fails when resource array contains references).
-
-- Standard:
-
- - (Extract with EXTR_SKIP should skip $this).
- - (preg_match failed).
-
-- Zip:
-
-
-
-
-
-Version 7.2.19
-
-- Date:
-
- - (DatePeriod::__construct() with invalid recurrence count value).
-
-- EXIF:
-
- - (heap-buffer-overflow on php_jpg_get16) (CVE-2019-11040).
-
-- FPM:
-
- - (php-fpm kill -USR2 not working).
- - (static.php.net doesn't work anymore).
-
-- GD:
-
- - (imageantialias($image, false); does not work).
- - (Uninitialized read in gdImageCreateFromXbm) (CVE-2019-11038).
-
-- Iconv:
-
- - (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow) (CVE-2019-11039).
-
-- JSON:
-
- - (Use after free with json serializer).
-
-- Opcache:
-
- - Fixed possible crashes, because of inconsistent PCRE cache and opcache SHM reset.
-
-- PDO_MySQL:
-
- - (Wrong meta pdo_type for bigint on LLP64).
-
-- Reflection:
-
- - (Inconsistent reflection of Closure:::__invoke()).
-
-- Session:
-
- - (Wrong warning for session.sid_bits_per_character).
-
-- SPL:
-
- - (SplFileObject::__toString() may return array).
-
-- SQLite:
-
- - (Bypassing open_basedir restrictions via file uris).
-
-
-
-
-
-Version 7.2.18
-
-- CLI:
-
- - (Incorrect Date header format in built-in server).
-
-- EXIF:
-
- - (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG) (CVE-2019-11036).
-
-- Interbase:
-
- - (Impossibility of creating multiple connections to Interbase with php 7.x).
-
-- Intl:
-
- - (IntlDateFormatter::create fails in strict mode if $locale = null).
-
-- litespeed:
-
- - LiteSpeed SAPI 7.3.1, better process management, new API function litespeed_finish_request().
-
-- Mail:
-
- - (Potential heap corruption in TSendMail()).
-
-- PCRE:
-
- - (preg_match does not ignore \r in regex flags).
-
-- PDO:
-
- - (Disable cloning of PDO handle/connection objects).
-
-- phpdbg:
-
- - (too many open files).
- - (phpdbg segfaults on listing some conditional breakpoints).
- - (phpdbg build fails when readline is shared).
-
-- Reflection:
-
- - (ReflectionClass::getMethods(null) doesn't work).
- - (Different behavior: always calls destructor).
-
-- Standard:
-
- - (recursive mkdir on ftp stream wrapper is incorrect).
- - (Crash due to null pointer in parse_ini_string with INI_SCANNER_TYPED).
- - (Inconsistent substr_compare behaviour with empty haystack).
-
-
-
-
-
-Version 7.2.17
-
-- Core:
-
- - (Nullptr deref in zend_compile_expr).
- - (Segmentation fault on break 2147483648).
- - (Anonymous classes can lose their interface information).
- - (Unable to run tests when building shared extension on AIX).
-
-- Bcmath:
-
- - (bcpow() implementation related to gcc compiler optimization).
-
-- COM:
-
- - (Crash when php unload).
-
-- Date:
-
- - (DateInterval:createDateFromString() silently fails).
- - (Added DatePeriod::getRecurrences() method).
-
-- EXIF:
-
- - (Heap-buffer-overflow in php_ifd_get32s). (CVE-2019-11034)
- - (Heap-buffer-overflow in exif_iif_add_value). (CVE-2019-11035)
-
-- FPM:
-
- - (FPM fails to build on AIX due to missing WCOREDUMP).
-
-- GD:
-
- - (Writing truecolor images as GIF ignores interlace flag).
-
-- MySQLi:
-
- - (mysqli_fetch_field hangs scripts).
-
-- Opcache:
-
- - (Opcache passes wrong value for inline array push assignments).
- - (Incorrect pi node insertion for jmpznz with identical successors).
-
-- phpdbg:
-
- - (phpdbg break cmd aliases listed in help do not match actual aliases).
-
-- sodium:
-
- - (sign_detached() strings not terminated).
-
-- SQLite3:
-
- - Added sqlite3.defensive INI directive.
-
-- Standard:
-
- - (Segmentation fault when using undefined constant in custom wrapper).
- - (Crash in extract() when overwriting extracted array).
- - (var_export() does not create a parsable value for PHP_INT_MIN).
- - (FTP stream wrapper should set the directory as executable).
-
-
-
-
-
-Version 7.2.16
-
-- Core:
-
- - (Core dump using parse_ini_string with numeric sections).
- - (rename() across the device may allow unwanted access during processing). (CVE-2019-9637)
-
-- COM:
-
- - (Already defined constants are not properly reported).
-
-- EXIF:
-
- - (Uninitialized read in exif_process_IFD_in_TIFF). (CVE-2019-9641)
- - (Invalid Read on exif_process_SOFn). (CVE-2019-9640)
- - (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (CVE-2019-9638)
- - (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (CVE-2019-9639)
-
-- PDO_OCI:
-
- - Support Oracle Database tracing attributes ACTION, MODULE, CLIENT_INFO, and CLIENT_IDENTIFIER.
-
-- PHAR:
-
- - (Null Pointer Dereference in phar_create_or_parse_filename).
-
-- SPL:
-
- - (DirectoryIterator glob:// don't support current path relative queries).
- - (openFile() silently truncates after a null byte).
-
-- Standard:
-
- - (Unintialized php_stream_statbuf in stat functions).
-
-- MySQL:
-
- - Disabled LOCAL INFILE by default, can be enabled using php.ini directive mysqli.allow_local_infile for mysqli, or PDO::MYSQL_ATTR_LOCAL_INFILE attribute for pdo_mysql.
-
-
-
-
-
-Version 7.2.15
-
-- Core:
-
- - (__callStatic may get incorrect arguments).
- - (Disabling class causes segfault on member access).
- - (PHP crashes when parsing `(2)::class`).
-
-- Curl:
-
- - (Segfault with H2 server push).
-
-- GD:
-
- - (imagescale(…, IMG_BILINEAR_FIXED) can cause black border).
- - (gdImageFilledArc() doesn't properly draw pies).
- - (imagescale() may return image resource on failure).
- - (1bpp BMPs may fail to be loaded).
- - (imagewbmp() segfaults with very large images).
-
-- ldap:
-
- - (ldap_bind using ldaps or ldap_start_tls()=exception in libcrypto-1_1-x64.dll).
-
-- Mbstring:
-
- - (mb_scrub() silently truncates after a null byte).
-
-- MySQLnd:
-
- - (In mysqlnd_ext_plugin.h the plugin methods family has no external visibility).
-
-- Opcache:
-
- - (configure fails on 64-bit AIX when opcache enabled).
-
-- OpenSSL:
-
- - (feof might hang on TLS streams in case of fragmented TLS records).
-
-- PDO:
-
- - (array_walk_recursive corrupts value types leading to PDO failure).
-
-- Sockets:
-
- - (socket_recvfrom may return an invalid 'from' address on MacOS).
-
-- Standard:
-
- - (segfault about array_multisort).
- - (parse_str segfaults when inserting item into existing array).
-
-
-
-
-
-Version 7.2.14
-
-- Core:
-
- - (memcpy with negative length via crafted DNS response). (CVE-2019-9022)
- - (zend_signal_startup() needs ZEND_API).
- - (PHP generates "FE_FREE" opcode on the wrong line).
-
-- COM:
-
- - (Serializing or unserializing COM objects crashes).
-
-- Date:
-
- - (DateTime::diff gives wrong diff when the actual diff is less than 1 second).
-
-- Exif:
-
- - (Unsigned rational numbers are written out as signed rationals).
-
-- GD:
-
- - (efree() on uninitialized Heap data in imagescale leads to use-after-free). (CVE-2016-10166)
- - (imagecolormatch Out Of Bounds Write on Heap). (CVE-2019-6977)
- - (Incorrect error handling of imagecreatefromjpeg()).
- - (auto cropping has insufficient precision).
- - (imagecropauto(…, GD_CROP_SIDES) crops left but not right).
-
-- IMAP:
-
- - (null pointer dereference in imap_mail).
-
-- Mbstring:
-
- - (Buffer overflow on mb regex functions - fetch_token). (CVE-2019-9023)
- - (heap buffer overflow in mb regex functions - compile_string_node). (CVE-2019-9023)
- - (heap buffer overflow in multibyte match_at). (CVE-2019-9023)
- - (heap buffer overflow due to incorrect length in expand_case_fold_string). (CVE-2019-9023)
- - (buffer overflow in fetch_token). (CVE-2019-9023)
- - (Buffer overflow in multibyte case folding - unicode). (CVE-2019-9023)
- - (Heap overflow in utf32be_mbc_to_code). (CVE-2019-9023)
-
-- OCI8:
-
- - (oci_pconnect with OCI_CRED_EXT not working).
- - Added oci_set_call_timeout() for call timeouts.
- - Added oci_set_db_operation() for the DBOP end-to-end-tracing attribute.
-
-- Opcache:
-
- - (CFG assertion failure on multiple finalizing switch frees in one block).
-
-- PDO:
-
- - Handle invalid index passed to PDOStatement::fetchColumn() as error.
-
-- Phar:
-
- - (heap buffer overflow in phar_detect_phar_fname_ext). (CVE-2019-9021)
-
-- Sockets:
-
- - (Unsupported IPV6_RECVPKTINFO constants on macOS).
-
-- SQLite3:
-
- - (Issue with re-binding on SQLite3).
-
-- Xmlrpc:
-
- - (heap out of bounds read in xmlrpc_decode()). (CVE-2019-9020)
- - (Global out of bounds read in xmlrpc base64 code). (CVE-2019-9024)
-
-
-
-
-
-Version 7.2.13
-
-- ftp:
-
- - (ftp_close(): SSL_read on shutdown).
-
-- CLI:
-
- - (php-win.exe corrupts unicode symbols from cli parameters).
-
-- Fileinfo:
-
- - (slowness regression in 7.2/7.3 (compared to 7.1)).
-
-- iconv:
-
- - (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR).
-
-- Core:
-
- - (Segfault when using convert.quoted-printable-encode filter).
-
-- IMAP:
-
- - (imap_open allows to run arbitrary shell commands via mailbox parameter). (CVE-2018-19518)
-
-- ODBC:
-
- - (odbc_fetch_object has incorrect type signature).
-
-- Opcache:
-
- - (Type inference in opcache causes side effects).
- - (array_diff_key() - segmentation fault).
-
-- Phar:
-
- - (PharData always creates new files with mode 0666).
- - (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile). (CVE-2018-20783)
-
-- PGSQL:
-
- - (pg_convert has a broken regex for the 'TIME WITHOUT TIMEZONE' data type).
-
-- SOAP:
-
- - (SoapClient can't handle object references correctly).
- - (WSDL_CACHE_MEMORY causes Segmentation fault).
- - (Signedness issue in SOAP when precision=-1).
-
-- Sockets:
-
- - (Validate length on socket_write).
-
-
-
-
-
-Version 7.2.12
-
-- Core:
-
- - (Segfault in shutdown function after memory limit error).
- - (Cyclic reference in generator not detected).
- - (The phpize and ./configure create redundant .deps file).
- - (buildconf should output error messages to stderr) (Mizunashi Mana)
-
-- Date:
-
- - Upgraded timelib to 2017.08.
- - (Year component overflow with date formats "c", "o", "r" and "y").
- - (fractions in `diff()` are not correctly normalized).
-
-- FCGI:
-
- - (Failed shutdown/reboot or end session in Windows).
- - (apache_response_headers removes last character from header name).
-
-- FTP:
-
- - (Data truncation due to forceful ssl socket shutdown).
-
-- intl:
-
- - (U_ARGUMENT_TYPE_MISMATCH).
-
-- Reflection:
-
- - (Objects cannot access their private attributes while handling reflection errors).
- - (ReflectionFunction::invoke does not invoke closure with object scope).
-
-- Sodium:
-
- - Some base64 outputs were truncated; this is not the case any more.
- - block sizes >= 256 bytes are now supposed by sodium_pad() even when an old version of libsodium has been installed.
- - (sodium_pad() could read (but not return nor write) uninitialized memory when trying to pad an empty input).
-
-- Standard:
-
- - (INI_SCANNER_RAW doesn't strip trailing whitespace).
-
-- Tidy:
-
- - (tidy::getOptDoc() not available on Windows).
-
-- XML:
-
- - (xml_parse_into_struct() does not resolve entities).
- - Add support for getting SKIP_TAGSTART and SKIP_WHITE options.
-
-- XMLRPC:
-
- - (xmlrpc_encode_request() crashes).
-
-
-
-
-
-Version 7.2.11
-
-- Core:
-
- - (foreach inconsistent if array modified during loop).
- - (method_exists on SPL iterator passthrough method corrupts memory).
-
-- CURL:
-
- - (Use curl_multi_wait() so that timeouts are respected).
-
-- iconv:
-
- - (iconv_mime_encode Q-encoding longer than it should be).
-
-- Opcache:
-
- - (ZendOPcache.MemoryBase periodically deleted by the OS).
- - (Compile-time evaluation of disabled function in opcache causes segfault).
-
-- POSIX:
-
- - (posix_getgrnam fails to print details of group).
-
-- Reflection:
-
- - (Wrong exception being thrown when using ReflectionMethod).
-
-- Standard:
-
- - (Wrong error message when fopen FTP wrapped fails to open data connection).
- - (Bindto IPv6 works with file_get_contents but fails with stream_socket_client).
- - (array_reduce is slow when $carry is large array).
-
-- XMLRPC:
-
- - (Can't build xmlrpc with expat).
-
-- Zlib:
-
- - (php_zlib_inflate_filter() may not update bytes_consumed).
-
-
-
-
-
-Version 7.2.10
-
-- Core:
-
- - (parent private constant in extends class memory leak).
- - (Generate enabled extension).
- - (Memory leak when using class_alias() in non-debug mode).
-
-- Apache2:
-
- - (XSS due to the header Transfer-Encoding: chunked). (CVE-2018-17082)
-
-- Bz2:
-
- - Fixed arginfo for bzcompress.
-
-- gettext:
-
- - (incorrect restoring of LDFLAGS).
-
-- iconv:
-
- - (iconv_mime_decode can return extra characters in a header).
- - (iconv_mime_decode_headers function is skipping headers).
- - (iconv_mime_decode does ignore special characters).
- - (iconv_mime_decode_headers() skips some headers).
-
-- intl:
-
- - (MessageFormatter::formatMessage memory corruption with 11+ named placeholders).
-
-- libxml:
-
- - ("public id" parameter of libxml_set_external_entity_loader callback undefined).
-
-- mbstring:
-
- - (mb_detect_order return value varies based on argument type).
-
-- Opcache:
-
- - (Opcache treats path containing "test.pharma.tld" as a phar file).
-
-- OpenSSL:
-
- - (unusable ssl => peer_fingerprint in stream_context_create()).
-
-- phpdbg:
-
- - (phpdbg man page contains outdated information).
-
-- SPL:
-
- - (Exception in DirectoryIterator::getLinkTarget()).
- - (RegexIterator pregFlags are NULL instead of 0).
-
-- Standard:
-
- - (array_reduce leaks memory if callback throws exception).
-
-- zlib:
-
- - (Zlib version check fails when an include/zlib/ style dir is passed to the --with-zlib configure option).
- - (Minimal required zlib library is 1.2.0.4).
-
-
-
-
-
-Version 7.2.9
-
-- Calendar:
-
- - (jewish.c: compile error under Windows with GBK charset).
-
-- Filter:
-
- - (References in sub-array for filtering breaks the filter).
-
-- PDO_Firebird:
-
- - (Memory leak when fetching a BLOB field).
-
-- PDO_PgSQL:
-
- - (Possible Memory Leak using PDO::CURSOR_SCROLL option).
-
-- SQLite3:
-
- - (SQLite3Stmt::bindValue() with SQLITE3_FLOAT doesn't juggle).
-
-- Standard:
-
- - (Incorrect entries in get_html_translation_table).
- - (array_column: null values in $index_key become incrementing keys in result).
- - (Segmentation fault when using `output_add_rewrite_var`).
-
-- Zip:
-
- - (ZipArchive memory leak (OVERWRITE flag and empty archive)).
-
-
-
-
-
-Version 7.2.8
-
-- Core:
-
- - (PHP hangs on 'illegal string offset on string references with an error handler).
- - (Object creation leaks memory when executed over HTTP).
- - (Chain of mixed exceptions and errors does not serialize properly).
-
-- Date:
-
- - (Undefined property: DateInterval::$f).
-
-- EXIF:
-
- - (heap use after free in _php_stream_free). (CVE-2018-12882)
- - (Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c). (CVE-2018-14883)
- - (heap-buffer-overflow (READ of size 48) while reading exif data). (CVE-2018-14851)
-
-- FPM:
-
- - (Vulnerability in php-fpm by changing stdin to non-blocking).
-
-- GMP:
-
- - (Integer Underflow when unserializing GMP and possible other classes).
-
-- intl:
-
- - (get_debug_info handler for BreakIterator shows wrong type).
-
-- mbstring:
-
- - (Integer overflow and excessive memory usage in mb_strimwidth).
-
-- Opcache:
-
- - (Opcache causes empty return value).
-
-- PGSQL:
-
- - (pg_fetch_result did not fetch the next row).
-
-- phpdbg:
-
- - Fix arginfo wrt. optional/required parameters.
-
-- Reflection:
-
- - (PHP crashes with core dump when throwing exception in error handler).
- - (ReflectionProperty#getValue() incorrectly works with inherited classes).
-
-- Standard:
-
- - (array_merge_recursive() is duplicating sub-array keys).
- - (getimagesize with $imageinfo returns false).
-
-- Win32:
-
- - (windows linkinfo lacks openbasedir check). (CVE-2018-15132)
-
-- ZIP:
-
- - (OPSYS_Z_CPM defined instead of OPSYS_CPM).
-
-
-
-
-
-Version 7.2.7
-
-- Core:
-
- - (segfault when opcache enabled + extension use zend_register_class_alias).
-
-- CLI Server:
-
- - (PHP built-in server does not find files if root path contains special characters).
-
-- OpenSSL:
-
- - (openssl_pkey_get_public does not respect open_basedir).
- - (openssl extension fails to build with LibreSSL 2.7).
-
-- SPL:
-
- - (NoRewindIterator segfault 11).
-
-- Standard:
-
- - (SIGV in zend_mm_alloc_small).
- - ("link(): Bad file descriptor" with non-ASCII path).
-
-
-
-
-
-Version 7.2.6
-
-- EXIF:
-
- - (exif_read_data zend_mm_heap corrupted).
-
-- FPM:
-
- - --with-fpm-acl wrongly tries to find libacl on FreeBSD.
-
-- intl:
-
- - (Locale::parseLocale() broken with some arguments).
-
-- Opcache:
-
- - (PHP-FPM sporadic crash when running Infinitewp).
- - (Assertion failure in file cache when unserializing empty try_catch_array).
- - (Opcache causes incorrect "undefined variable" errors).
-
-- Reflection:
-
- - Fixed arginfo of array_replace(_recursive) and array_merge(_recursive).
-
-- Session:
-
- - (Url Rewriting (trans_sid) not working on urls that start with "#").
-
-
-
-
-
-Version 7.2.5
-
-- Core:
-
- - (Convert valgrind detection to configure option).
-
-- Date:
-
- - (mismatch arginfo for date_create).
-
-- Exif:
-
- - (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value). (CVE-2018-10549)
-
-- FPM:
-
- - (ERROR: failed to reload: execvp() failed: Argument list too long).
- - Fixed incorrect write to getenv result in FPM reload.
-
-- GD:
-
- - (imagedashedline() - dashed line sometimes is not visible).
-
-- iconv:
-
- - (stream filter convert.iconv leads to infinite loop on invalid sequence). (CVE-2018-10546)
-
-- intl:
-
- - (Intl compilation fails with icu4c 61.1).
-
-- ldap:
-
- - (Malicious LDAP-Server Response causes Crash). (CVE-2018-10548)
-
-- mbstring:
-
- - (Wrong cp1251 detection).
- - (mbstring does not build with Oniguruma 6.8.1).
-
-- ODBC:
-
- - (ODBC functions are not available by default on Windows).
-
-- Opcache:
-
- - (Access violation when using opcache).
-
-- Phar:
-
- - (fix for CVE-2018-5712 may not be complete). (CVE-2018-10547)
-
-- phpdbg:
-
- - (Memory corruption: arbitrary NUL overwrite).
-
-- SPL:
-
- - (mismatch arginfo for splarray constructor).
-
-- standard:
-
- - (mail.add_x_header default inconsistent with docs).
- - (incorrect url in header for mt_rand).
-
-
-
-
-
-Version 7.2.4
-
-- Core:
-
- - (Segfault while throwing exception in error_handler).
- - ('date: illegal option -- -' in ./configure on FreeBSD).
-
-- FPM:
-
- - (Dumpable FPM child processes allow bypassing opcache access controls). (CVE-2018-10545)
-
-- FTP:
-
- - Fixed ftp_pasv arginfo.
-
-- GD:
-
- - (signed integer conversion in imagescale()).
- - (null pointer access crashed php).
- - Fixed imagesetinterpolation arginfo.
-
-- iconv:
-
- - (Freeing uninitialized pointer).
-
-- Mbstring:
-
- - (wrong unicode mapping in some charsets).
-
-- Opcache:
-
- - (Assertion failure in live range DCE due to block pass misoptimization).
-
-- OpenSSL:
-
- - Fixed openssl_* arginfos.
-
-- PCNTL:
-
- - (pcntl_wexitstatus returns incorrect on Big_Endian platform (s390x)).
-
-- Phar:
-
- - (Segmentation fault in buildFromIterator when directory name contains a \n).
-
-- Standard:
-
- - (Strange references behavior).
- - Fixed some arginfos.
- - (parse_ini_string fails to parse "[foo]\nbar=1|>baz" with segfault).
-
-
-
-
-
-Version 7.2.3
-
-- Core:
-
- - ("stream_isatty" returns wrong value on s390x).
-
-- Apache2Handler:
-
- - (a simple way for segfaults in threadsafe php just with configuration).
-
-- Date:
-
- - (Timezone gets truncated when formatted).
- - (Argument 2 for `DateTimeZone::listIdentifiers()` should accept `null`).
- - (calling var_dump on a DateTimeZone object modifies it).
-
-- LDAP:
-
- - (Fix LDAP path lookup on 64-bit distros).
-
-- libxml2:
-
- - (use pkg-config where available).
-
-- PGSQL:
-
- - (Memory leak in pg_escape_bytea()).
-
-- Phar:
-
- - (Phar::extractTo() does not accept specific directories to be extracted).
- - (deal with leading slash while adding files correctly).
- - (deal with leading slash when adding files correctly).
-
-- ODBC:
-
- - (Unable to retrieve value of varchar(max) type).
-
-- Opcache:
-
- - (opcache segfault when installing Bitrix).
- - (file_get_contents $http_response_header variable bugged with opcache).
- - (Modulus value not stored in variable).
-
-- SPL:
-
- - (strange behavior of AppendIterator).
-
-- Standard:
-
- - (DNS_CAA record results contain garbage).
- - (stack-buffer-overflow while parsing HTTP response). (CVE-2018-7584)
-
-
-
-
-
-Version 7.2.2
-
-- Core:
-
- - (potential memleak in internal classes's static members).
- - (Path 260 character problem).
- - (Some non-portable == in shell scripts).
- - (segfault when using spread operator on generator passed by reference).
- - (arg of get_defined_functions is optional).
- - (Exit inside generator finally results in fatal error).
-
-- FCGI:
-
- - (getenv() crashes on Windows 7.2.1 when second parameter is false).
-
-- IMAP:
-
- - (imap_append HeapCorruction).
-
-- Opcache:
-
- - (File cache not populated after SHM runs full).
- - (var 8 (TMP) has array key type but not value type).
- - (Using @ crashes php7.2-fpm).
- - (Interned strings buffer overflow may cause crash).
-
-- PDO:
-
- - (PDO extension doesn't allow to be built shared on Darwin).
-
-- PDO MySQL:
-
- - (PDO Mysql module can't be built as module).
-
-- PGSQL:
-
- - (pg_version() crashes when called on a connection to cockroach).
-
-- Readline:
-
- - (readline_read_history segfaults with empty file).
-
-- SAPI:
-
- - ([embed SAPI] Segmentation fault in sapi_register_post_entry).
-
-- SOAP:
-
- - (SoapClient generates E_ERROR even if exceptions=1 is used).
- - (Segmentation fault in zend_string_release).
-
-- SPL:
-
- - (RecursiveArrayIterator does not traverse arrays by reference).
- - (RecursiveArrayIterator doesn't have constants from parent class).
- - (RecursiveArrayIterator does not iterate object properties).
-
-- Standard:
-
- - (substr_count incorrect result).
- - (array_values don't work on empty array).
-
-- Zip:
-
- - Display headers (buildtime) and library (runtime) versions in phpinfo (with libzip >= 1.3.1).
-
-
-
-
-
-Version 7.2.1
-
-- Core:
-
- - (Segmentation fault in 7.1.12 and 7.0.26).
- - (PHP seems incompatible with OneDrive files on demand).
- - (Access Violation in vcruntime140.dll).
- - (Unable to clone instance when private __clone defined).
- - (php-process crash when is_file() is used with strings longer 260 chars).
-
-- CLI server:
-
- - (Directory does not exist).
-
-- FPM:
-
- - (libxml_disable_entity_loader setting is shared between requests).
-
-- GD:
-
- - (Potential infinite loop in gdImageCreateFromGifCtx). (CVE-2018-5711)
-
-- Opcache:
-
- - ("Narrowing occurred during type inference" error).
- - (Interned strings buffer overflow may cause crash).
- - ("Narrowing occurred during type inference" error).
- - (Invalid opcode 138/1/1).
-
-- PCRE:
-
- - (preg_last_error not returning error code after error).
-
-- Phar:
-
- - (Reflected XSS in .phar 404 page). (CVE-2018-5712)
-
-- Standard:
-
- - (fread not free unused buffer).
- - (mt_rand returns value outside [$min,$max]+ on 32-bit) (Remi)
- - (Inappropriately parsing HTTP response leads to PHP segment fault). (CVE-2018-14884)
- - (accept EFAULT in addition to ENOSYS as indicator that getrandom() is missing).
- - (php_ini_scanned_files() not reporting correctly).
- - (putenv does not work properly if parameter contains non-ASCII unicode character).
-
-- Zip:
-
- - (Segfault with libzip 1.3.1).
-
-
-
-
-
-Version 7.2.0
-
-- BCMath:
-
- - (bcmod truncates fractionals).
-
-- CLI:
-
- - (Process is started as interactive shell in PhpStorm).
- - (Interactive shell opening instead of script execution with -f flag).
-
-- CLI server:
-
- - (Random "Invalid request (unexpected EOF)" using a router script).
-
-- Core:
-
- - Added ZEND_COUNT, ZEND_GET_CLASS, ZEND_GET_CALLED_CLASS, ZEND_GET_TYPE, ZEND_FUNC_NUM_ARGS, ZEND_FUNC_GET_ARGS instructions, to implement corresponding builtin functions.
- - "Countable" interface is moved from SPL to Core.
- - Added ZEND_IN_ARRAY instruction, implementing optimized in_array() builtin function, through hash lookup in flipped array.
- - Removed IS_TYPE_IMMUTABLE (it's the same as COPYABLE & !REFCOUNTED).
- - Removed the sql.safe_mode directive.
- - Removed support for Netware.
- - Renamed ReflectionClass::isIterateable() to ReflectionClass::isIterable() (alias original name for BC).
- - (WSA cleanup executes before MSHUTDOWN).
- - (Disallow mail header injections by extra headers) (Yasuo)
- - (proc_nice() for Windows).
- - Fix pthreads detection when cross-compiling (ffontaine)
- - Fixed memory leaks caused by exceptions thrown from destructors. (Bob, Dmitry).
- - (uniqid() should use better random source).
- - (Add ENABLE_VIRTUAL_TERMINAL_PROCESSING flag for php.exe).
- - Implemented "Convert numeric keys in object/array casts" RFC, fixes bugs , , , , , etc.
- - Implemented "Deprecate and Remove Bareword (Unquoted) Strings" RFC.
- - Raised minimum supported Windows versions to Windows 7/Server 2008 R2.
- - Implemented minor optimization in array_keys/array_values().
- - Added PHP_OS_FAMILY constant to determine on which OS we are.
- - (Method compatibility check looks to original definition and not parent).
- - (JSON_OBJECT_AS_ARRAY not respected).
- - (Corrupted class entries on shutdown when a destructor spawns another object).
- - (Filename got limited to MAX_PATH on Win32 when scan directory).
- - , bug , bug , bug and others related to interned strings handling in TS builds.
- - Implemented "Trailing Commas In List Syntax" RFC for group use lists only.
- - (It's possible to override trait property with different loosely-equal value).
- - (Restraining __construct() access level in subclass gives a fatal error).
- - (Cannot override an abstract method with an abstract method).
- - (Traits enforce different inheritance rules).
- - Fixed misparsing of abstract unix domain socket names.
- - Change PHP_OS_FAMILY value from "OSX" to "Darwin".
- - Allow loading PHP/Zend extensions by name in ini files (extension=<name>).
- - Added object type annotation.
- - (crash with a combination of INI entries at startup).
- - (isset on zero-prefixed numeric indexes in array broken).
- - Added new VM instuctions ISSET_ISEMPTY_CV and UNSET_CV. Previously they were implemented as ISSET_ISEMPTY_VAR and UNSET_VAR variants with ZEND_QUICK_SET flag.
- - (unserialize() doesn't handle changes in property visibility).
- - (extension_dir = "./ext" now use current directory for base).
- - (Improved error message on fetching property of non-object).
- - (buildcheck.sh check for autoconf version needs to be updated for v2.64).
- - (Data race in ZTS builds).
- - ("stream_copy_to_stream" doesn't stream anymore).
-
-- cURL:
-
- - (OpenSSL support not detected).
- - Better fix for (use pkg-config instead of curl-config).
-
-- Date:
-
- - (Impossible to prototype DateTime::createFromFormat).
- - (Adding the DateTime constants to the DateTimeInterface interface).
- - (Out-Of-Bounds Read in timelib_meridian()). (CVE-2017-16642)
- - (redefinition of typedefs ttinfo and t1info).
- - (DateInterval microseconds property always 0).
-
-- Dba:
-
- - (flatfile: dba_fetch() fails to read replaced entry).
-
-- DOM:
-
- - (Implement Countable for DomNodeList and DOMNamedNodeMap).
-
-- EXIF:
-
- - Added support for vendor specific tags for the following formats: Samsung, DJI, Panasonic, Sony, Pentax, Minolta, Sigma/Foveon, AGFA, Kyocera, Ricoh & Epson.
- - (exif_read_data() fails to read all data for some images).
- - (Type confusion in exif_read_data() leading to heap overflow in debug mode).
- - (Exif Header component value check error).
- - (Corrupt EXIF header: maximum directory nesting level reached for some cameras).
- - Fixed Redhat bug #1362571 (PHP not returning full results for exif_read_data function).
- - (exif_read_data/thumbnail: add support for stream resource).
- - Deprecated the read_exif_data() alias.
- - (exif_read_data(): "Illegal IFD size" warning occurs with correct exif format).
- - (EXIF thumbnails not read anymore).
- - (php crashes with segfault when exif_read_data called).
- - (exif_read_data(): Illegal IFD offset (works fine with other exif readers).
-
-- Fileinfo:
-
- - Upgrade bundled libmagic to 5.31.
-
-- FPM:
-
- - Configuration to limit fpm slow log trace callers.
- - (php_value acts like php_admin_value).
-
-- FTP:
-
- - Implement MLSD for structured listing of directories.
- - Added ftp_append() function.
-
-- GD:
-
- - Implemented imageresolution as getter and setter (Christoph)
- - (gd.h: stdarg.h include missing for va_list use in gdErrorMethod).
- - (Memory disclosure or DoS via crafted .bmp image).
-
-- GMP:
-
- - (gmp_fact() silently ignores non-integer input).
-
-- Hash:
-
- - Changed HashContext from resource to object.
- - Disallowed usage of non-cryptographic hash functions with HMAC and PBKDF2.
- - (sha3 is not supported on bigendian machine).
-
-- IMAP:
-
- - (imap_mailboxmsginfo() return wrong size).
-
-- Intl:
-
- - (test using Spoofchecker which may be unavailable).
- - ([REGRESSION] IntlDateFormatter::parse() does not change $position argument).
-
-- JSON:
-
- - Add JSON_INVALID_UTF8_IGNORE and JSON_INVALID_UTF8_SUBSTITUTE options for json_encode and json_decode to ignore or replace invalid UTF-8 byte sequences - it addresses request .
- - (Buffer overflow in json_decode() with JSON_INVALID_UTF8_IGNORE or JSON_INVALID).
- - (JSON_PARTIAL_OUTPUT_ON_ERROR can result in JSON with null key).
-
-- LDAP:
-
- - (Support for LDAP EXOP operations)
- - Fixed support for LDAP_OPT_SERVER_CONTROLS and LDAP_OPT_CLIENT_CONTROLS in ldap_get_option
- - Fixed passing an empty array to ldap_set_option for client or server controls.
-
-- Mbstring:
-
- - (mb_chr() and mb_ord()).
- - (mb_scrub()).
- - (enhancement for mb_convert_encoding() that handles multibyte replacement char nicely).
- - Added array input support to mb_convert_encoding().
- - Added array input support to mb_check_encoding().
- - (enhancement for mb_substitute_character).
- - Update to oniguruma version 6.3.0.
- - (mb_strtolower fails on titlecase characters).
-
-- Mcrypt:
-
- - The deprecated mcrypt extension has been moved to PECL.
-
-- Opcache:
-
- - Added global optimisation passes based on data flow analysis using Single Static Assignment (SSA) form: Sparse Conditional Constant Propagation (SCCP), Dead Code Elimination (DCE), and removal of unused local variables (Nikita, Dmitry)
- - Fixed incorect constant conditional jump elimination.
- - (Invalid opcode 49/1/8 using opcache).
- - Fixed bug (assertion fails with extended info generated).
- - Fixed bug (Phi sources removel).
- - (Webserver hangs on valid PHP text).
- - (segfault loading WordPress wp-admin).
-
-- OpenSSL:
-
- - Use TLS_ANY for default ssl:// and tls:// negotiation.
- - Fix leak in openssl_spki_new().
- - Added openssl_pkcs7_read() and pk7 parameter to openssl_pkcs7_verify().
- - Add ssl security_level stream option to support OpenSSL security levels. (Jakub Zelenka).
- - Allow setting SNI cert and private key in separate files.
- - (openssl_pkcs7_encrypt() uses different EOL than before).
- - Automatically load OpenSSL configuration file.
-
-- PCRE:
-
- - Added support for PCRE JIT fast path API.
- - (Inconsistent PCRE captures in match results).
- - (Minor BC break: PCRE_JIT changes output of preg_match()).
- - (preg_grep() is not reporting PREG_BAD_UTF8_ERROR after first input string).
- - (PCRE JIT broken in 7.2).
- - (Broken build when system libpcre don't have jit support).
-
-- phar:
-
- - (phar does not correctly handle names containing dots).
-
-- PDO:
-
- - (Emulated statements let value dictate parameter type).
- - Add "Sent SQL" to debug dump for emulated prepares.
- - Add parameter types for national character set strings.
-
-- PDO_DBlib:
-
- - (bigint columns are returned as strings).
- - Expose DB-Library version as \PDO::DBLIB_ATTR_VERSION attribute on \PDO instance.
- - Add test coverage for bug .
-
-- PDO_OCI:
-
- - (Align --with-pdo-oci configure option with --with-oci8 syntax).
-
-- PDO_Sqlite:
-
- - Switch to sqlite3_prepare_v2() and sqlite3_close_v2() functions (rasmus)
-
-- PHPDBG:
-
- - Added extended_value to opcode dump output.
-
-- Session:
-
- - (Prohibit session save handler recursion).
- - PR Removed register_globals related code and "!" can be used as $_SESSION key name.
- - Improved bug fix. 'user' save handler can only be set by session_set_save_handler()
- - (5 session functions incorrectly warn when calling in read-only/getter mode).
- - (session_cache_expire/cache_limiter/save_path() trigger a warning in read mode).
- - (session fails to start after having headers sent).
-
-- Sodium:
-
- - New cryptographic extension
- - Added missing bindings for libsodium > 1.0.13.
-
-- SPL:
-
- - (Incorrect arginfo for ArrayIterator::__construct).
- - Added spl_object_id().
-
-- SQLite3:
-
- - Implement writing to blobs.
- - Update to Sqlite 3.20.1.
-
-- Standard:
-
- - (closing of fd incorrect when PTS enabled).
- - (unserialize accepts two plus/minus signs for float number exponent part).
- - Compatibility with libargon2 versions 20161029 and 20160821.
- - (mysqli_get_client_info reflection info).
- - Add support for extension name as argument to dl().
- - (uniqid() without more_entropy performs badly).
- - (heap-use-after-free when unserializing invalid array size). (CVE-2017-12932)
- - (A Denial of Service Vulnerability was found when performing deserialization).
- - (mt_rand() bias on 64-bit machines).
- - (Argon2i always throws NUL at the end).
-
-- Streams:
-
- - Default ssl/single_dh_use and ssl/honor_cipher_order to true.
-
-- XML:
-
- - Moved utf8_encode() and utf8_decode() to the Standard extension.
-
-- XMLRPC:
-
- - Use Zend MM for allocation in bundled libxmlrpc (Joe)
-
-- ZIP:
-
- - Add support for encrypted archives.
- - Use of bundled libzip is deprecated, --with-libzip option is recommended.
- - (Reflection of ZipArchive does not show public properties).
- - ZipArchive implements countable, added ZipArchive::count() method.
- - Fix segfault in php_stream_context_get_option call.
- - (new method setEncryptionName() seems not to exist in ZipArchive).
-
-- zlib:
-
- - Expose inflate_get_status() and inflate_get_read_len() functions.
-
-
-
-
-
-
-Version 7.1.33
-
-- FPM:
-
- - (env_path_info underflow in fpm_main.c can lead to RCE). (CVE-2019-11043)
-
-
-
-
-
-Version 7.1.32
-
-- mbstring:
-
- - Fixed CVE-2019-13224 (don't allow different encodings for onig_new_deluxe) (stas)
-
-- pcre:
-
- - (heap use-after-free in pcrelib) (cmb)
-
-
-
-
-
-Version 7.1.31
-
-- SQLite:
-
- - Upgraded to SQLite 3.28.0.
-
-- EXIF:
-
- - (heap-buffer-overflow on exif_process_user_comment). (CVE-2019-11042)
- - (heap-buffer-overflow on exif_scan_thumbnail). (CVE-2019-11041)
-
-- Phar:
-
- - (Potential UAF in Phar RSHUTDOWN).
-
-
-
-
-
-Version 7.1.30
-
-- EXIF:
-
- - (heap-buffer-overflow on php_jpg_get16) (CVE-2019-11040).
-
-- GD:
-
- - (Uninitialized read in gdImageCreateFromXbm) (CVE-2019-11038).
-
-- Iconv:
-
- - (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow) (CVE-2019-11039).
-
-- SQLite:
-
- - (Bypassing open_basedir restrictions via file uris).
-
-
-
-
-
-Version 7.1.29
-
-- EXIF:
-
- - (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG) (CVE-2019-11036).
-
-- Mail:
-
- - (Potential heap corruption in TSendMail()).
-
-
-
-
-
-Version 7.1.28
-
-- EXIF:
-
- - (Heap-buffer-overflow in php_ifd_get32s). (CVE-2019-11034)
- - (Heap-buffer-overflow in exif_iif_add_value). (CVE-2019-11035)
-
-- SQLite3:
-
- - Added sqlite3.defensive INI directive.
-
-
-
-
-
-Version 7.1.27
-
-- Core:
-
- - (rename() across the device may allow unwanted access during processing). (CVE-2019-9637)
-
-- EXIF:
-
- - (Uninitialized read in exif_process_IFD_in_TIFF). (CVE-2019-9641)
- - (Invalid Read on exif_process_SOFn). (CVE-2019-9640)
- - (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (CVE-2019-9638)
- - (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (CVE-2019-9639)
-
-- PHAR:
-
- - (Null Pointer Dereference in phar_create_or_parse_filename).
- - (phar_tar_writeheaders_int() buffer overflow).
-
-- SPL:
-
- - (openFile() silently truncates after a null byte).
-
-
-
-
-
-Version 7.1.26
-
-- Core:
-
- - (memcpy with negative length via crafted DNS response). (CVE-2019-9022)
-
-- GD:
-
- - (efree() on uninitialized Heap data in imagescale leads to use-after-free). (CVE-2016-10166)
- - (imagecolormatch Out Of Bounds Write on Heap). (CVE-2019-6977)
-
-- IMAP:
-
- - (null pointer dereference in imap_mail).
-
-- Mbstring:
-
- - (Buffer overflow on mb regex functions - fetch_token). (CVE-2019-9023)
- - (heap buffer overflow in mb regex functions - compile_string_node). (CVE-2019-9023)
- - (heap buffer overflow in multibyte match_at). (CVE-2019-9023)
- - (heap buffer overflow due to incorrect length in expand_case_fold_string). (CVE-2019-9023)
- - (buffer overflow in fetch_token). (CVE-2019-9023)
- - (Buffer overflow in multibyte case folding - unicode). (CVE-2019-9023)
- - (Heap overflow in utf32be_mbc_to_code). (CVE-2019-9023)
-
-- Phar:
-
- - (heap buffer overflow in phar_detect_phar_fname_ext). (CVE-2019-9021)
-
-- Xmlrpc:
-
- - (heap out of bounds read in xmlrpc_decode()). (CVE-2019-9020)
- - (Global out of bounds read in xmlrpc base64 code). (CVE-2019-9024)
-
-
-
-
-
-
-Version 7.1.25
-
-- Core:
-
- - (zend_signal_startup() needs ZEND_API).
- - (Segfault when using convert.quoted-printable-encode filter).
-
-- ftp:
-
- - (ftp_close(): SSL_read on shutdown).
-
-- iconv:
-
- - (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR).
-
-- IMAP:
-
- - (imap_open allows to run arbitrary shell commands via mailbox parameter). (CVE-2018-19518)
-
-- ODBC:
-
- - (odbc_fetch_object has incorrect type signature).
-
-- Opcache:
-
- - (Type inference in opcache causes side effects).
-
-- Phar:
-
- - (PharData always creates new files with mode 0666).
- - (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile). (CVE-2018-20783)
-
-- PGSQL:
-
- - (pg_convert has a broken regex for the 'TIME WITHOUT TIMEZONE' data type).
-
-- SOAP:
-
- - (WSDL_CACHE_MEMORY causes Segmentation fault).
- - (Signedness issue in SOAP when precision=-1).
-
-- Sockets:
-
- - (Validate length on socket_write).
-
-
-
-
-
-Version 7.1.24
-
-- Core:
-
- - (Cyclic reference in generator not detected).
- - (The phpize and ./configure create redundant .deps file).
- - (buildconf should output error messages to stderr) (Mizunashi Mana)
-
-- Date:
-
- - (Year component overflow with date formats "c", "o", "r" and "y").
-
-- FCGI:
-
- - (Failed shutdown/reboot or end session in Windows).
- - (apache_response_headers removes last character from header name).
-
-- FTP:
-
- - (Data truncation due to forceful ssl socket shutdown).
-
-- intl:
-
- - (U_ARGUMENT_TYPE_MISMATCH).
-
-- Standard:
-
- - (INI_SCANNER_RAW doesn't strip trailing whitespace).
-
-- Tidy:
-
- - (tidy::getOptDoc() not available on Windows).
-
-- XML:
-
- - (xml_parse_into_struct() does not resolve entities).
- - Add support for getting SKIP_TAGSTART and SKIP_WHITE options.
-
-
-
-
-
-Version 7.1.23
-
-- Core:
-
- - (method_exists on SPL iterator passthrough method corrupts memory).
- - (Segfault in shutdown function after memory limit error).
-
-- CURL:
-
- - (Use curl_multi_wait() so that timeouts are respected).
-
-- iconv:
-
- - (iconv_mime_encode Q-encoding longer than it should be).
-
-- Opcache:
-
- - (ZendOPcache.MemoryBase periodically deleted by the OS).
-
-- POSIX:
-
- - (posix_getgrnam fails to print details of group).
-
-- Reflection:
-
- - (Wrong exception being thrown when using ReflectionMethod).
-
-- Standard:
-
- - (Wrong error message when fopen FTP wrapped fails to open data connection).
- - (Bindto IPv6 works with file_get_contents but fails with stream_socket_client).
- - (array_reduce is slow when $carry is large array).
-
-- Zlib:
-
- - (php_zlib_inflate_filter() may not update bytes_consumed).
-
-
-
-
-
-Version 7.1.22
-
-- Core:
-
- - (parent private constant in extends class memory leak).
- - (Generate enabled extension).
-
-- Apache2:
-
- - (XSS due to the header Transfer-Encoding: chunked). (CVE-2018-17082)
-
-- Bz2:
-
- - Fixed arginfo for bzcompress.
-
-- gettext:
-
- - (incorrect restoring of LDFLAGS).
-
-- iconv:
-
- - (iconv_mime_decode can return extra characters in a header).
- - (iconv_mime_decode_headers function is skipping headers).
- - (iconv_mime_decode does ignore special characters).
- - (iconv_mime_decode_headers() skips some headers).
-
-- intl:
-
- - (MessageFormatter::formatMessage memory corruption with 11+ named placeholders).
-
-- libxml:
-
- - ("public id" parameter of libxml_set_external_entity_loader callback undefined).
-
-- mbstring:
-
- - (mb_detect_order return value varies based on argument type).
-
-- Opcache:
-
- - (Opcache treats path containing "test.pharma.tld" as a phar file).
-
-- OpenSSL:
-
- - (unusable ssl => peer_fingerprint in stream_context_create()).
-
-- phpdbg:
-
- - (phpdbg man page contains outdated information).
-
-- SPL:
-
- - (Exception in DirectoryIterator::getLinkTarget()).
- - (RegexIterator pregFlags are NULL instead of 0).
-
-- Standard:
-
- - (array_reduce leaks memory if callback throws exception).
-
-- zlib:
-
- - (Zlib version check fails when an include/zlib/ style dir is passed to the --with-zlib configure option).
- - (Minimal required zlib library is 1.2.0.4).
-
-
-
-
-
-Version 7.1.21
-
-- Calendar:
-
- - (jewish.c: compile error under Windows with GBK charset).
-
-- Filter:
-
- - (References in sub-array for filtering breaks the filter).
-
-- PDO_Firebird:
-
- - (Memory leak when fetching a BLOB field).
-
-- PDO_PgSQL:
-
- - (Possible Memory Leak using PDO::CURSOR_SCROLL option).
-
-- SQLite3:
-
- - (SQLite3Stmt::bindValue() with SQLITE3_FLOAT doesn't juggle).
-
-- Standard:
-
- - (array_column: null values in $index_key become incrementing keys in result).
- - (Incorrect entries in get_html_translation_table).
- - (Segmentation fault when using `output_add_rewrite_var`).
-
-- Zip:
-
- - (ZipArchive memory leak (OVERWRITE flag and empty archive)).
-
-
-
-
-
-Version 7.1.20
-
-- Core:
-
- - (PHP hangs on 'illegal string offset on string references with an error handler).
- - (Chain of mixed exceptions and errors does not serialize properly).
-
-- Date:
-
- - (Undefined property: DateInterval::$f).
-
-- exif:
-
- - (Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c). (CVE-2018-14883)
- - (heap-buffer-overflow (READ of size 48) while reading exif data). (CVE-2018-14851)
-
-- FPM:
-
- - (Vulnerability in php-fpm by changing stdin to non-blocking).
-
-- GMP:
-
- - (Integer Underflow when unserializing GMP and possible other classes).
-
-- intl:
-
- - (get_debug_info handler for BreakIterator shows wrong type).
-
-- mbstring:
-
- - (Integer overflow and excessive memory usage in mb_strimwidth).
-
-- PGSQL:
-
- - (pg_fetch_result did not fetch the next row).
-
-- phpdbg:
-
- - Fix arginfo wrt. optional/required parameters.
-
-- Reflection:
-
- - (PHP crashes with core dump when throwing exception in error handler).
- - (ReflectionProperty#getValue() incorrectly works with inherited classes).
-
-- Standard:
-
- - (array_merge_recursive() is duplicating sub-array keys).
- - (getimagesize with $imageinfo returns false).
-
-- Win32:
-
- - (windows linkinfo lacks openbasedir check). (CVE-2018-15132)
-
-
-
-
-
-Version 7.1.19
-
-- CLI Server:
-
- - (PHP built-in server does not find files if root path contains special characters).
-
-- OpenSSL:
-
- - (openssl_pkey_get_public does not respect open_basedir).
- - (openssl extension fails to build with LibreSSL 2.7).
-
-- SPL:
-
- - (NoRewindIterator segfault 11).
-
-- Standard:
-
- - ("link(): Bad file descriptor" with non-ASCII path).
- - (array_map on $GLOBALS returns IS_INDIRECT).
-
-
-
-
-
-Version 7.1.18
-
-- FPM:
-
- - --with-fpm-acl wrongly tries to find libacl on FreeBSD.
-
-- intl:
-
- - (Locale::parseLocale() broken with some arguments).
-
-- Opcache:
-
- - (PHP-FPM sporadic crash when running Infinitewp).
- - (Assertion failure in file cache when unserializing empty try_catch_array).
- - (Opcache causes incorrect "undefined variable" errors).
-
-- Reflection:
-
- - Fixed arginfo for array_replace(_recursive) and array_merge(_recursive).
-
-
-
-
-
-Version 7.1.17
-
-- Date:
-
- - (mismatch arginfo for date_create).
-
-- Exif:
-
- - (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value). (CVE-2018-10549)
-
-- FPM:
-
- - (ERROR: failed to reload: execvp() failed: Argument list too long).
- - Fixed incorrect write to getenv result in FPM reload.
-
-- GD:
-
- - (imagedashedline() - dashed line sometimes is not visible).
-
-- iconv:
-
- - (stream filter convert.iconv leads to infinite loop on invalid sequence). (CVE-2018-10546)
-
-- intl:
-
- - (Intl compilation fails with icu4c 61.1).
-
-- ldap:
-
- - (Malicious LDAP-Server Response causes Crash). (CVE-2018-10548)
-
-- mbstring:
-
- - (Wrong cp1251 detection).
- - (mbstring does not build with Oniguruma 6.8.1).
-
-- Phar:
-
- - (fix for CVE-2018-5712 may not be complete). (CVE-2018-10547)
-
-- phpdbg:
-
- - (Memory corruption: arbitrary NUL overwrite).
-
-- SPL:
-
- - (mismatch arginfo for splarray constructor).
-
-- standard:
-
- - (incorrect url in header for mt_rand).
-
-
-
-
-
-Version 7.1.16
-
-- Core:
-
- - (Segfault while throwing exception in error_handler).
- - ('date: illegal option -- -' in ./configure on FreeBSD).
-
-- FPM:
-
- - (Dumpable FPM child processes allow bypassing opcache access controls). (CVE-2018-10545)
-
-- GD:
-
- - (signed integer conversion in imagescale()).
-
-- ODBC:
-
- - (ODBC functions are not available by default on Windows).
-
-- Opcache:
-
- - (opcache corrupts variable in for-loop).
-
-- Phar:
-
- - (Segmentation fault in buildFromIterator when directory name contains a \n).
-
-- Standard:
-
- - (mail.add_x_header default inconsistent with docs).
- - (parse_ini_string fails to parse "[foo]\nbar=1|>baz" with segfault).
-
-
-
-
-
-Version 7.1.15
-
-- Apache2Handler:
-
- - (a simple way for segfaults in threadsafe php just with configuration).
-
-- Date:
-
- - (Timezone gets truncated when formatted).
- - (Argument 2 for `DateTimeZone::listIdentifiers()` should accept `null`).
- - (calling var_dump on a DateTimeZone object modifies it).
-
-- PGSQL:
-
- - (Memory leak in pg_escape_bytea()).
-
-- ODBC:
-
- - (Unable to retrieve value of varchar(max) type).
-
-- LDAP:
-
- - (Fix LDAP path lookup on 64-bit distros).
-
-- libxml2:
-
- - (use pkg-config where available).
-
-- Phar:
-
- - (deal with leading slash when adding files correctly).
-
-- SPL:
-
- - (strange behavior of AppendIterator).
-
-- Standard:
-
- - (DNS_CAA record results contain garbage).
- - (stack-buffer-overflow while parsing HTTP response). (CVE-2018-7584)
-
-
-
-
-
-Version 7.1.14
-
-- Core:
-
- - (Path 260 character problem).
- - (segfault when using spread operator on generator passed by reference).
- - (arg of get_defined_functions is optional).
- - (Exit inside generator finally results in fatal error).
- - (self keyword leads to incorrectly generated TypeError when in closure in trait).
-
-- FCGI:
-
- - (getenv() crashes on Windows 7.2.1 when second parameter is false).
-
-- IMAP:
-
- - (imap_append HeapCorruction).
-
-- Opcache:
-
- - (File cache not populated after SHM runs full).
- - (Interned strings buffer overflow may cause crash).
-
-- PGSQL:
-
- - (pg_version() crashes when called on a connection to cockroach).
-
-- Readline:
-
- - (readline_read_history segfaults with empty file).
-
-- SAPI:
-
- - ([embed SAPI] Segmentation fault in sapi_register_post_entry).
-
-- SOAP:
-
- - (SoapClient generates E_ERROR even if exceptions=1 is used).
- - (Segmentation fault in zend_string_release).
-
-- SPL:
-
- - (RecursiveArrayIterator does not traverse arrays by reference).
- - (RecursiveArrayIterator doesn't have constants from parent class).
- - (RecursiveArrayIterator does not iterate object properties).
-
-- Standard:
-
- - (substr_count incorrect result).
-
-
-
-
-
-Version 7.1.13
-
-- Core:
-
- - (Segmentation fault in 7.1.12 and 7.0.26).
- - (PHP seems incompatible with OneDrive files on demand).
- - (Unable to clone instance when private __clone defined).
- - (php-process crash when is_file() is used with strings longer 260 chars).
-
-- CLI Server:
-
- - (Random "Invalid request (unexpected EOF)" using a router script).
- - (Directory does not exist).
-
-- FPM:
-
- - (libxml_disable_entity_loader setting is shared between requests).
-
-- GD:
-
- - (Potential infinite loop in gdImageCreateFromGifCtx). (CVE-2018-5711)
-
-- Opcache:
-
- - ("Narrowing occurred during type inference" error).
- - (Interned strings buffer overflow may cause crash).
- - ("Narrowing occurred during type inference" error).
-
-- PCRE:
-
- - (preg_last_error not returning error code after error).
-
-- Phar:
-
- - (Reflected XSS in .phar 404 page). (CVE-2018-5712)
-
-- Standard:
-
- - (fread not free unused buffer).
- - (mt_rand returns value outside [$min,$max]+ on 32-bit) (Remi)
- - (Inappropriately parsing HTTP response leads to PHP segment fault). (CVE-2018-14884)
- - (accept EFAULT in addition to ENOSYS as indicator that getrandom() is missing).
- - (php_ini_scanned_files() not reporting correctly).
- - (putenv does not work properly if parameter contains non-ASCII unicode character).
-
-- Zip:
-
- - (Segfault with libzip 1.3.1).
-
-
-
-
-
-
-Version 7.1.12
-
-- Core:
-
- - (Crash when modifing property name in __isset for BP_VAR_IS).
- - (mmap/munmap trashing on unlucky allocations).
-
-- CLI:
-
- - (Builtin webserver crash after chdir in a shutdown function).
-
-- Enchant:
-
- - (enchant_broker_get_path crashes if no path is set).
- - (Enchant still reports version 1.1.0).
-
-- Exif:
-
- - (Exif extension has built in revision version).
-
-- GD:
-
- - (imagerotate may alter image dimensions).
- - (Wrong reflection on imagewebp).
-
-- intl:
-
- - (UConverter::setDestinationEncoding changes source instead of destination).
-
-- interbase:
-
- - (Incorrect reflection for ibase_[p]connect).
-
-- Mysqli:
-
- - (Wrong reflection for mysqli_fetch_all function).
-
-- OCI8:
-
- - Fixed valgrind issue.
-
-- OpenSSL:
-
- - (openssl_x509_parse leaks memory).
- - (Wrong reflection for openssl_open function).
-
-- Opcache:
-
- - (Warning Internal error: wrong size calculation).
-
-- PGSQL:
-
- - (Default link incorrectly cleared/linked by pg_close()).
-
-- SOAP:
-
- - (Wrong reflection on SoapClient::__setSoapHeaders).
-
-- Zlib:
-
- - (Wrong reflection on inflate_init and inflate_add).
-
-
-
-
-
-Version 7.1.11
-
-- Core:
-
- - (Null pointer dereference in zend_mm_alloc_small()).
- - (infinite loop when printing an error-message).
- - (Incorrect token formatting on two parse errors in one request).
- - (Segfault when calling is_callable on parent).
- - (debug info of Closures of internal functions contain garbage argument names).
-
-- Date:
-
- - (Out-Of-Bounds Read in timelib_meridian()). (CVE-2017-16642)
-
-- Apache2Handler:
-
- - (error: 'zend_hash_key' has no member named 'arKey' in apache2handler).
-
-- Hash:
-
- - (sha3 hangs on bigendian).
-
-- Intl:
-
- - (The parameter of UConverter::getAliases() is not optional).
-
-- litespeed:
-
- - (Binary directory doesn't get created when building only litespeed SAPI).
- - (Missing program prefix and suffix).
-
-- mcrypt:
-
- - (arcfour encryption stream filter crashes php).
-
-- MySQLi:
-
- - (Data corruption when reading fields of bit type).
-
-- OCI8:
-
- - Fixed incorrect reference counting.
-
-- Opcache:
-
- - (Request hangs and not finish).
-
-- PCRE:
-
- - (applied upstream patch for CVE-2016-1283).
-
-- PDO_mysql:
-
- - (Type 'bit' is fetched as unexpected string).
-
-- SPL:
-
- - (SplDoublyLinkedList::setIteratorMode masks intern flags).
-
-
-
-
-
-Version 7.1.10
-
-- Core:
-
- - (run-tests.php issues with EXTENSION block).
-
-- BCMath:
-
- - (bcpowmod() fails if scale != 0).
- - (BC math handles minus zero incorrectly).
- - (bcpowmod() may return 1 if modulus is 1).
- - (bcpowmod() misbehaves for non-integer base or modulus).
-
-- CLI server:
-
- - (Built-in server truncates headers spanning over TCP packets).
-
-- CURL:
-
- - (OpenSSL support not detected).
-
-- GD:
-
- - (gdImageGrayScale() may produce colors).
- - (libgd/gd_interpolation.c:1786: suspicious if ?).
-
-- Gettext:
-
- - (textdomain(null) throws in strict mode).
-
-- Intl:
-
- - (IntlGregorianCalendar doesn't have constants from parent class).
- - (segfault in collator_convert_object_to_string).
-
-- PDO_OCI:
-
- - (PDO_PCO with PHP-FPM: OCI environment initialized before PHP-FPM sets it up).
-
-- SPL:
-
- - (AppendIterator::append() is broken when appending another AppendIterator).
- - (incorrect behavior of AppendIterator::append in foreach loop).
-
-- Standard:
-
- - (signed integer overflow in parse_iv).
- - (gethostname fails if your host name is 64 chars long).
-
-
-
-
-
-Version 7.1.9
-
-- Core:
-
- - (Segfault in scanner on INF number).
- - (null deref and segfault in zend_generator_resume()).
- - (html_errors=1 breaks unhandled exceptions).
- - (Main CWD initialized with wrong codepage).
- - (NAN comparison).
-
-- cURL:
-
- - (Fixed finding CURL on systems with multiarch support).
-
-- Date:
-
- - (Null Pointer Dereference in timelib_time_clone).
-
-- Intl:
-
- - (Wrong reflection on some locale_* functions).
-
-- Mbstring:
-
- - (Segmentation fault mb_strcut with HTML-ENTITIES encoding).
- - (mb_convert_kana() does not convert iteration marks).
- - (Wrong reflection on mb_eregi_replace).
-
-- MySQLi:
-
- - (PHP crashes when calling mysqli_result::fetch_object with an abstract class).
-
-- OCI8:
-
- - Expose oci_unregister_taf_callback() (Tianfang Yang)
-
-- Opcache:
-
- - (Narrowing occurred during type inference).
-
-- phar:
-
- - (include_path has a 4096 char limit in some cases).
-
-- Reflection:
-
- - (null pointer dereference in _function_string).
-
-- Session:
-
- - (Url Rewriting (trans_sid) not working on urls that start with "#").
- - (SID constant created with wrong module number).
-
-- SimpleXML:
-
- - (nullpointer deref in simplexml_element_getDocNamespaces).
-
-- SPL:
-
- - (spl_autoload_unregister can't handle spl_autoload_functions results).
- - (Unserialize ArrayIterator broken).
- - (Appending AppendIterator leads to segfault).
- - (Crash in recursive iterator destructors).
-
-- Standard:
-
- - (unpack with X* causes infinity loop).
- - (heap-use-after-free when unserializing invalid array size). (CVE-2017-12932)
- - (A Denial of Service Vulnerability was found when performing deserialization).
-
-- WDDX:
-
- - (WDDX uses wrong decimal seperator).
-
-- XMLRPC:
-
- - (Incorrect xmlrpc serialization for classes with declared properties).
-
-
-
-
-
-
-Version 7.1.8
-
-- Core:
-
- - (Loading PHP extension with already registered function name leads to a crash).
- - (parse_url() broken when query string contains colon).
- - (Unary operator expected error on some systems).
- - (Use After Free in unserialize() SplFixedArray).
- - (Crash when crawling through network share).
- - (fixed incorrect poll.h include).
- - (fixed incorrect errno.h include).
-
-- Date:
-
- - (property_exists returns true on unknown DateInterval property).
-
-- OCI8:
-
- - (Integer overflow in oci_bind_array_by_name).
-
-- Opcache:
-
- - (Infinite loop in type inference when using HTMLPurifier).
-
-- OpenSSL:
-
- - (pkcs7_en/decrypt does not work if \x0a is used in content).
- - Added OPENSSL_DONT_ZERO_PAD_KEY constant to prevent key padding and fix bug (openssl_open() returns junk on envelope < 16 bytes) and bug (OpenSSL Blowfish encryption is incorrect for short keys).
-
-- PDO:
-
- - (PDOStatement::debugDumpParams() truncates query).
-
-- SPL:
-
- - (PHP freezes with AppendIterator).
-
-- SQLite3:
-
- - (SQLite3::__construct() produces "out of memory" exception with invalid flags).
-
-- Wddx:
-
- - (huge memleak when wddx_unserialize).
- - (wddx parsing empty boolean tag leads to SIGSEGV). (CVE-2017-11143)
-
-- zlib:
-
- - (dictionary option of inflate_init() does not work).
-
-
-
-
-
-Version 7.1.7
-
-- Core:
-
- - (Multiple [PATH=] and [HOST=] sections not properly parsed).
- - (Undefined constants in array properties result in broken properties).
- - Fixed misparsing of abstract unix domain socket names.
- - (PHP INI Parsing Stack Buffer Overflow Vulnerability). (CVE-2017-11628)
- - (Unserialize Heap Use-After-Free (READ: 1) in zval_get_type). (CVE-2017-12934)
- - (Heap buffer overread (READ: 1) finish_nested_data from unserialize). (CVE-2017-12933)
- - (wddx_deserialize() heap out-of-bound read via php_parse_date()). (CVE-2017-11145)
-
-- Date:
-
- - (implement clone for DatePeriod and DateInterval).
-
-- DOM:
-
- - (References to deleted XPath query results).
-
-- GD:
-
- - (Buffer over-read into uninitialized memory). (CVE-2017-7890)
-
-- Intl:
-
- - (Stack Buffer Overflow in msgfmt_parse_message). (CVE-2017-11362)
- - (Wrong reflection on Collator::getSortKey and collator_get_sort_key).
-
-- Mbstring:
-
- - Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
-
-- OCI8:
-
- - Add TAF callback (PR ).
-
-- Opcache:
-
- - (Segfault with opcache.memory_protect and validate_timestamp).
- - Revert opcache.enable_cli to default disabled.
-
-- OpenSSL:
-
- - (pkcs7_en/decrypt does not work if \x1a is used in content).
- - (negative-size-param (-1) in memcpy in zif_openssl_seal()). (CVE-2017-11144)
-
-- PDO_OCI:
-
- - Support Instant Client 12.2 in --with-pdo-oci configure option.
-
-- Reflection:
-
- - (Segfault when cast Reflection object to string with undefined constant).
-
-- SPL:
-
- - (null coalescing operator failing with SplFixedArray).
-
-- FTP:
-
- - (ftp:// wrapper ignores context arg).
-
-- PHAR:
-
- - (Phar::__construct reflection incorrect).
-
-- SOAP:
-
- - (Incorrect conversion array with WSDL_CACHE_MEMORY).
-
-- Streams:
-
- - (stream_socket_get_name() returns '\0').
-
-
-
-
-
-Version 7.1.6
-
-- Core:
-
- - (crash (SIGSEGV) in _zend_hash_add_or_update_i).
- - (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST).
- - (__DIR__ wrong for unicode character).
-
-- intl:
-
- - (wrong reflection on Collator::sortWithSortKeys).
-
-- MySQLi:
-
- - (mysqli::change_user() doesn't accept null as $database argument w/strict_types).
-
-- Opcache:
-
- - (SIGSEGV with opcache.revalidate_path enabled).
-
-- phar:
-
- - (Phar::webPhar() does not handle requests sent through PUT and DELETE method).
-
-- Readline:
-
- - (readline() moves the cursor to the beginning of the line).
-
-- Standard:
-
- - (win32/sendmail.c anchors CC header but not BCC).
-
-- xmlreader:
-
- - (Wrong reflection on XMLReader::expand).
-
-
-
-
-
-Version 7.1.5
-
-- Core:
-
- - (Endless loop bypassing execution time limit).
- - (Segfault when killing within bash script trap code).
- - (Magic function __get has different behavior in php 7.1.x).
- - (Null coalescing operator fails for undeclared static class properties).
- - (multiple catch freezes in some cases).
- - (stream_select() is broken on Windows Nanoserver).
- - (php-cgi.exe crash on facebook callback).
-
-- Date:
-
- - (Wrong reflection on DateTimeZone::getTransitions).
- - (add constant for RFC7231 format datetime).
-
-- DOM:
-
- - (Wrong reflection on DOMNode::cloneNode).
-
-- Fileinfo:
-
- - (syntax error compile error in libmagic/apprentice.c).
-
-- GD:
-
- - (compile fails on solaris 11 with system gd2 library).
-
-- MySQLnd:
-
- - (Invalid free of persistent results on error/connection loss).
-
-- Intl:
-
- - (Intl does not support DateTimeImmutable).
- - (IntlDateFormatter->format() doesn't return microseconds/fractions).
- - (wrong reflection for Normalizer methods).
- - (wrong reflection for Locale methods).
-
-- Opcache:
-
- - (Segmentation error while running a script in CLI mode).
- - (foreach infinite loop).
- - (Opcached version produces a nested array).
-
-- OpenSSL:
-
- - (null character not allowed in openssl_pkey_get_private).
- - (Segfault in openssl_pkey_new when generating DSA or DH key).
- - (openssl_x509_parse fails to parse ASN.1 UTCTime without seconds).
-
-- phar:
-
- - (phar method parameters reflection correction).
-
-- Readline:
-
- - (readline() immediately returns false in interactive console mode).
-
-- Standard:
-
- - (setcookie allows max-age to be negative).
- - (Compaction in array_rand() violates COW).
-
-- Streams:
-
- - (Remote socket URI with unique persistence identifier broken).
-
-
-
-
-
-Version 7.1.4
-
-- Core:
-
- - (static embed SAPI linkage error).
- - (falsely exits with "Out of Memory" when using USE_ZEND_ALLOC=0).
- - (Leak with instance method calling static method with referenced return).
- - (Resolution of self::FOO in class constants not correct).
- - (Build problems after 7.0.17 release: undefined reference to `isfinite').
- - (yield fromLABEL is over-greedy).
-
-- Apache:
-
- - Reverted patch for bug , fixes bug .
-
-- Date:
-
- - (Swatch time value incorrect for dates before 1970).
-
-- DOM:
-
- - (LIBXML_NOWARNING flag ingnored on loadHTML*).
-
-- iconv:
-
- - (iconv fails to fail on surrogates).
-
-- Opcache:
-
- - (OPcache compilation performance regression in PHP 5.6/7 with huge classes).
-
-- OpenSSL:
-
- - (fwrite() on non-blocking SSL sockets doesn't work).
-
-- PDO MySQL:
-
- - (Expose MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT to PDO interface).
-
-- SPL:
-
- - (ArrayObject can not notice changes).
-
-- SQLite:
-
- - (Allow creation of deterministic sqlite functions).
-
-- Streams:
-
- - (Correctly fail on invalid IP address ports).
-
-- zlib:
-
- - (deflate_add can allocate too much memory).
-
-
-
-
-
-Version 7.1.3
-
-- Core:
-
- - (Segfault with nested generators).
- - (PHP hangs when an invalid value is dynamically passed to typehinted by-ref arg).
- - (Maximum execution time of n+2 seconds exceed not written in error_log).
- - (PHP 7.1 Segfaults within Symfony test suite).
- - (Out of bound read - zend_mm_alloc_small).
- - (Performance problem with processing large post request). (CVE-2017-11142)
- - (array_key_exists fails on arrays created by get_object_vars).
- - (NAN check fails on Alpine Linux with musl).
- - (Generating phar.phar core dump with gcc ASAN enabled build).
-
-- Apache:
-
- - (Incomplete POST does not timeout but is passed to PHP).
-
-- Date:
-
- - ("new DateTime()" sometimes returns 1 second ago value).
-
-- FPM:
-
- - (php-fpm process accounting is broken with keepalive).
-
-- Hash:
-
- - (gost-crypto hash incorrect if input data contains long 0xFF sequence).
-
-- GD:
-
- - (ReflectionFunction for imagepng is missing last two parameters).
-
-- Mysqlnd:
-
- - (fetch_array broken data. Data more then MEDIUMBLOB).
-
-- Opcache:
-
- - (Segfault with list).
-
-- OpenSSL:
-
- - (PHP Fast CGI crashes when reading from a pfx file).
- - (Memory leak with openssl_encrypt()).
-
-- Standard:
-
- - (mail.add_x_header causes RFC-breaking lone line feed).
- - (substr_count with length=0 broken).
- - (is_callable callable name reports misleading value for anonymous classes).
- - (PHP on Linux should use /dev/urandom when getrandom is not available).
-
-- Streams:
-
- - (Invalid memory access in zend_inline_hash_func).
- - (stream_get_contents maxlength>-1 returns empty string).
-
-
-
-
-
-Version 7.1.2
-
-- Core:
-
- - Improved GENERATOR_CREATE opcode handler.
- - (readlink() returns garbage for UTF-8 paths).
- - (Crash when exporting **= in expansion of assign op).
- - (bug with symlink related to cyrillic directory).
- - (segfault in debug_print_backtrace).
- - (arginfo incorrect for unpack).
- - (assertion error in debug_zval_dump).
-
-- DOM:
-
- - (getAttributeNodeNS doesn't get xmlns* attributes).
-
-- DTrace:
-
- - (DTrace reported as enabled when disabled).
-
-- FCGI:
-
- - (php-cgi fails to load -c specified php.ini file).
- - (PHP_FCGI_CHILDREN is not included in phpinfo()).
-
-- FPM:
-
- - (php-fpm does not close stderr when using syslog).
-
-- GD:
-
- - (Premature failing of XBM reading).
-
-- GMP:
-
- - (test for gmp.h needs to test machine includes).
-
-- Hash:
-
- - Added hash_hkdf() function.
- - (environmental build dependency in hash sha3 source).
-
-- Intl:
-
- - (Link use CC instead of CXX).
-
-- LDAP:
-
- - (error/segfault with ldap_mod_replace and opcache).
-
-- MySQLi:
-
- - (leak in mysqli_fetch_object).
-
-- Mysqlnd:
-
- - (segfault on close() after free_result() with mysqlnd).
-
-- Opcache:
-
- - (crash on finish work with phar in cli + opcache).
-
-- OpenSSL:
-
- - (add serial hex to return value array).
- - (Compile ext/openssl with openssl 1.1.0 on Win).
- - (openssl_decrypt triggers bug in PDO).
-
-- PDO_Firebird:
-
- - (All data are fetched as strings).
-
-- PDO_PgSQL:
-
- - (lastInsertId fails to throw an exception for wrong sequence name).
-
-- Phar:
-
- - (PharData::compress() doesn't close temp file).
-
-- posix:
-
- - (configure script incorrectly checks for ttyname_r).
-
-- Session:
-
- - (session not readable by root in CLI).
-
-- SPL:
-
- - (spl_autoload() crashes when calls magic _call()).
-
-- Standard:
-
- - (closing of fd incorrect when PTS enabled).
- - (SoapClient stumbles over WSDL delivered with "Transfer-Encoding: chunked").
- - (imap is undefined service on AIX).
- - (money_format stores wrong length AIX).
- - (intval() with base 0 should detect binary).
- - (mail.log = syslog contains double information).
-
-- ZIP:
-
- - (ZipArchive::addGlob ignores remove_all_path option).
-
-
-
-
-
-Version 7.1.1
-
-
- -
- Core
-
- - (invalid foreach loop hangs script).
- - (Adding settype()ed values to ArrayObject results in references).
- - ("Invalid opcode 65/16/8" occurs with a variable created with list()).
- - (ZEND_MM_BITSET_LEN is "undefined symbol" in zend_bitset.h).
- - (unserialized array pointer not advancing).
- - (SIG_IGN doesn't work when Zend Signals is enabled).
- - (Heap out of bounds read on unserialize in finish_nested_data()). (CVE-2016-10161)
- - (NULL Pointer Dereference while unserialize php object). (CVE-2016-10162)
- - (Use of uninitialized memory in unserialize()). (CVE-2017-5340)
- - (Unserialize use-after-free when resizing object's properties hash table). (CVE-2016-7479)
-
-
- -
- CLI
-
- - (CLI output(japanese) on Windows).
-
-
- -
- COM
-
- - (DOTNET read access violation using invalid codepage).
-
-
- -
- DOM
-
- - (getElementsByTagNameNS filter on default ns).
-
-
- -
- EXIF
-
- - (FPE when parsing a tag format). (CVE-2016-10158)
-
-
- -
- GD
-
- - (Signed Integer Overflow gd_io.c). (CVE-2016-10168)
- - (DOS vulnerability in gdImageCreateFromGd2Ctx()). (CVE-2016-10167)
-
-
- -
- mbstring
-
- - (mb_ereg_search_init null pointer dereference).
-
-
- -
- MySQLi
-
- - (Persistent connections don't set $connect_errno).
-
-
- -
- mysqlnd
-
- - Optimized handling of BIT fields - less memory copies and lower memory usage.
- - (sporadic segfault with MYSQLI_OPT_INT_AND_FLOAT_NATIVE).
-
-
- -
- opcache
-
- - (Strange behavior of class constants in switch/case block).
- - (Method that returns string returns UNKNOWN:0 instead).
- - (Segmentation fault in zend_call_function).
- - ("SIGFPE Arithmetic exception" in opcache when divide by minus 1).
- - (Recursion when a variable is redefined as array).
-
-
- -
- PDO Firebird
-
- - (PDO_FIREBIRD with Firebird 3.0 not work on returning statement).
-
-
- - Phar:
-
- - (Seg fault when loading hostile phar). (CVE-2017-11147)
- - (Memory corruption when loading hostile phar). (CVE-2016-10160)
- - (Crash while loading hostile phar archive). (CVE-2016-10159)
-
- -
- phpdbg
-
- - (Crash (out of memory) when using run and # command separator).
- - (phpdbg shows the wrong line in files with shebang).
-
-
- -
- SQLite3
-
- - Reverted fix for (Unsetting result set may reset other result set).
-
-
- -
- Standard
-
- - (dns_get_record does not populate $additional out parameter).
- - (Unserialize context shared on double class lookup).
- - (serialize object with __sleep function crash).
- - (get_browser function is very slow).
- - (Loading browscap.ini at startup causes high memory usage).
- - (add subject to mail log).
- - (get_defined_functions additional param to exclude disabled functions).
-
-
- -
- zlib
-
- - (deflate_add does not verify that output was not truncated).
-
-
-
-
-
-
-Version 7.1.0
-
-- Core:
-
- - Added nullable types.
- - Added DFA optimization framework based on e-SSA form.
- - Added specialized opcode handlers (e.g. ZEND_ADD_LONG_NO_OVERFLOW).
- - Added [] = as alternative construct to list() =.
- - Added void return type.
- - Added support for negative string offsets in string offset syntax and various string functions.
- - Added a form of the list() construct where keys can be specified.
- - Implemented safe execution timeout handling, that prevents random crashes after "Maximum execution time exceeded" error.
- - Implemented the RFC `Support Class Constant Visibility`.
- - Implemented the RFC `Catching multiple exception types`.
- - Implemented logging to syslog with dynamic error levels.
- - (Support "nmake test" on building extensions by phpize).
- - Implemented RFC: Iterable.
- - Implemented RFC: Closure::fromCallable (Danack)
- - Implemented RFC: Replace "Missing argument" warning with "\ArgumentCountError" exception.
- - Implemented RFC: Fix inconsistent behavior of $this variable.
- - (Logging of "Internal Zend error - Missing class information" missing class name).
- - Fixed memory leak(null coalescing operator with Spl hash).
- - (Slow performance when fetching large dataset with mysqli / PDO).
- - (Use After Free Vulnerability in unserialize()). (CVE-2016-9936)
- - (Ilegal write/read access caused by gdImageAALine overflow).
- - (imagefilltoborder stackoverflow on truecolor images). (CVE-2016-9933)
- - (Exception::__toString() cause circular references).
- - ((Float)"Nano" == NAN).
- - (Segfault in __clone > Exception.toString > __get).
- - Fixed for (Write out of bounds at number_format).
- - Fix pthreads detection when cross-compiling (ffontaine)
- - (try/catch not working with two exceptions inside a same operation).
- - (segfault on undefined function).
- - (PHP hangs if error handler throws while accessing undef const in default value).
- - (parse error: Invalid numeric literal).
- - (parse_str() without a second argument leads to crash).
- - (Heap Buffer Overflow in virtual_popen of zend_virtual_cwd.c).
- - (crypt broken when salt is 'too' long).
- - (Null pointer deref in zval_delref_p).
- - (assign_dim on string doesn't reset hval).
- - (Reference is lost after array_slice()).
- - (Out of bounds global memory read in BF_crypt triggered by password_verify).
- - (Segfault with __get returned by ref).
- - (PHP Segfaults when trying to expand an infinite operator).
- - TypeError messages for arg_info type checks will now say "must be ... or null" where the parameter or return type accepts null.
- - (stream_socket_recvfrom read access violation).
- - (Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization).
- - (PHP Session Data Injection Vulnerability).
- - (memory allocator fails to realloc small block to large one).
- - Fixed URL rewriter. It would not rewrite '//example.com/' URL unconditionally. URL rewrite target hosts whitelist is implemented.
- - (phpize (on Windows) ignores PHP_PREFIX).
- - (getmxrr broken).
- - (Caught exception assignment to variables ignores references).
- - (Calling an earlier instance of an included anonymous class fatals).
- - (previous property undefined in Exception after deserialization).
- - (Different references behavior comparing to PHP 5).
- - (VERIFY_RETURN type casts visible in finally).
- - (Return by reference with finally is not memory safe).
- - (Wrong return value if var modified in finally).
- - (Memory leak when array altered in destructor).
- - (Memory error on $arr[$a] =& $arr[$b] if RHS rehashes).
- - Added new constant PHP_FD_SETSIZE.
- - Added optind parameter to getopt().
- - Added PHP to SAPI error severity mapping for logs.
- - (Unable to set --enable-debug on building extensions by phpize on Windows).
- - (The destructor is called when an exception is thrown from the constructor).
- - Implemented RFC: RNG Fixes.
- - Implemented email validation as per RFC 6531.
- - (Stack-based buffer overflow vulnerability in virtual_file_ex).
- - (HTTP_PROXY is improperly trusted by some PHP libraries and applications).
- - (dtrace issue with reflection (failed test)).
- - (strange references after recursive function call and "switch" statement).
- - (Segmentation fault: RFC list_keys).
- - (list() regression).
- - (TypeError after Generator function w/declared return type finishes).
- - (tempnam() should raise notice if falling back to temp dir).
- - Fixed UTF-8 and long path support on Windows.
- - (Assignment via string index access on an empty string converts to array).
- - (Exceptions can leak temporary variables).
- - (It is possible to stiffen child class members visibility).
- - (Generators don't participate in cycle GC).
- - (Memleak if return in finally block).
- - (Missing separation of properties HT in foreach etc).
- - (Aborted Generators continue after nested finally).
- - (String offset assignment from an empty string inserts null byte).
- - (ASCII 0x7F Delete control character permitted in identifiers).
- - (Nested try/finally blocks losing return value).
- - (Finally leaks on nested exceptions).
- - (php-cgi.exe missing UAC manifest).
- - Change statement and fcall extension handlers to accept frame.
- - Number operators taking numeric strings now emit E_NOTICEs or E_WARNINGs when given malformed numeric strings.
- - (int), intval() where $base is 10 or unspecified, settype(), decbin(), decoct(), dechex(), integer operators and other conversions now always respect scientific notation in numeric strings.
- - Raise a compile-time warning on octal escape sequence overflow.
-
-- Apache2handler:
-
- - Enable per-module logging in Apache 2.4+.
-
-- BCmath:
-
- - (memcpy negative parameter _bc_new_num_ex).
-
-- Bz2:
-
- - (integer overflow in bzdecompress caused heap corruption).
- - (Inadequate error handling in bzread()).
-
-- Calendar:
-
- - Fix integer overflows (Joshua Rogers)
- - (cal_days_month() fails for final month of the French calendar).
- - (AddressSanitizer: global-buffer-overflow in zif_cal_from_jd).
-
-- CLI Server:
-
- - (Unable to work in root with unicode chars).
- - (Built-in webserver does not send Date header).
-
-- COM:
-
- - (Cannot pass parameter 1 by reference).
- - (Invalid free in extension trait).
- - (COM called from PHP does not return out parameters).
- - (DOTNET/COM array parameters broke in PHP7).
- - (variant_date_from_timestamp null dereference).
-
-- Curl:
-
- - Implement support for handling HTTP/2 Server Push.
- - Add curl_multi_errno(), curl_share_errno() and curl_share_strerror() functions.
- - (Heap overflow in curl_escape).
- - (size_t overflow lead to heap corruption). (Stas).
- - (curl_setopt segfault with empty CURLOPT_HTTPHEADER).
- - (CURLINFO_CERTINFO data parsing error).
-
-- Date:
-
- - (DateInterval properties and isset).
- - (createFromFormat with 'z' format char results in incorrect time).
- - (Inconsistent behavior of the u format char).
- - (DateTime parser doesn't set microseconds for "now").
- - (microseconds are missing in DateTime class).
- - (microseconds in DateInterval are missing).
- - (DateTime::createFromFormat() U after u nukes microtime).
- - (Allow DateTime modification with subsecond items).
- - (General DateTime improvments needed for microseconds to become useful).
- - (timelib_meridian doesn't parse dots correctly).
- - (DateTime constructor does not initialise microseconds property).
- - (Use After Free in PHP7 unserialize()).
- - (Memcpy negative size parameter php_resolve_path).
- - (DateTime::createFromFormat 'U' with pre 1970 dates fails parsing).
- - Invalid serialization data for a DateTime or DatePeriod object will now throw an instance of Error from __wakeup() or __set_state() instead of resulting in a fatal error.
- - Timezone initialization failure from serialized data will now throw an instance of Error from __wakeup() or __set_state() instead of resulting in a fatal error.
- - Export date_get_interface_ce() for extension use.
- - (strtotime seems to use both sunday and monday as start of week).
-
-- Dba:
-
- - (Cannot fetch multiple values with group in ini file).
- - Data modification functions (e.g.: dba_insert()) now throw an instance of Error instead of triggering a catchable fatal error if the key is does not contain exactly two elements.
-
-- DOM:
-
- - (missing NULL check in dom_document_save_html).
- - (DOM document dangling reference).
- - Invalid schema or RelaxNG validation contexts will throw an instance of Error instead of resulting in a fatal error.
- - Attempting to register a node class that does not extend the appropriate base class will now throw an instance of Error instead of resulting in a fatal error.
- - Attempting to read an invalid or write to a readonly property will throw an instance of Error instead of resulting in a fatal error.
-
-- DTrace:
-
- - Disabled PHP call tracing by default (it makes significant overhead). This may be enabled again using envirionment variable USE_ZEND_DTRACE=1.
-
-- EXIF:
-
- - (Samsung picture thumb not read (zero size)).
- - (Memory Leakage In exif_process_IFD_in_TIFF).
- - (Out of bound read in exif_process_IFD_in_MAKERNOTE).
- - (NULL Pointer Dereference in exif_process_user_comment).
-
-- Filter:
-
- - (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and FILTER_FLAG_NO_PRIV_RANGE).
- - (default option ignored when object passed to int filter).
- - (FILTER_FLAG_NO_RES_RANGE does not cover whole 127.0.0.0/8 range).
-
-- FPM:
-
- - (using --allow-to-run-as-root should ignore missing user).
-
-- FTP:
-
- - (Cannot upload file using ftp_put to FTPES with require_ssl_reuse).
- - (Option to ignore the returned FTP PASV address).
-
-- GD:
-
- - (Integer overflow in imageline() with antialiasing).
- - (imagescale() is not affected by, but affects imagesetinterpolation()).
- - (Integer overflow in gdImageScaleBilinearPalette()).
- - (Stack Buffer Overflow in GD dynamicGetbuf).
- - (imagettftext broken on transparent background w/o alphablending).
- - (Integer Overflow in gdImageWebpCtx of gd_webp.c).
- - (imagettfbbox gives incorrect values for bounding box).
- - (imagegd2() ignores 3rd param if 4 are given).
- - (imagegd2() writes wrong chunk sizes on boundaries).
- - (imagegd2(): unrecognized formats may result in corrupted files).
- - (imagecreatefromgd2() may leak memory).
- - (imagetruecolortopalette: white is duplicated in palette).
- - (imagecopy does not support 1bit transparency on truecolor images).
- - (imagecopy() loses single-color transparency on palette images).
- - (possible resource leaks in _php_image_convert()).
- - (imagesetstyle() causes OOB read for empty $styles).
- - (select_colors write out-of-bounds).
- - (imagegammacorrect allows arbitrary write access).
- - (imagetypes function won't advertise WEBP support).
- - (imagearc() ignores thickness for full arcs).
- - (500 Server Error but page is fully rendered).
- - (broken transparency of imagearc for truecolor in blendingmode).
- - (gdImageTrueColorToPaletteBody allows arbitrary write/read access).
- - (imagegif/output out-of-bounds access).
- - (Integer overflow error within _gdContributionsAlloc()).
- - (Ilegal write/read access caused by gdImageAALine overflow).
- - (imagecropauto out-of-bounds access).
- - (imagecreatefromjpeg fails on selfie).
- - (Thick styled lines have scrambled patterns).
- - (XBM images require width to be multiple of 8).
- - (imagefilledpolygon doesn't draw horizontal line).
-
-- Hash:
-
- - Added SHA3 fixed mode algorithms (224, 256, 384, and 512 bit).
- - Added SHA512/256 and SHA512/224 algorithms.
-
-- iconv:
-
- - (iconv_substr returns false for empty strings).
-
-- IMAP:
-
- - (Integer Overflow in "_php_imap_mail" leads to crash).
- - An email address longer than 16385 bytes will throw an instance of Error instead of resulting in a fatal error.
-
-- Interbase:
-
- - (Fails to find firebird headers as don't use fb_config output).
-
-- Intl:
-
- - (add locale length check).
- - (add mitigation for ICU int overflow).
- - (grapheme_*() is not Unicode compliant on CR LF sequence).
- - (add locale length check).
- - (Segfault when instantiating class that extends IntlCalendar and adds a property).
- - (Locale::lookup() / locale_lookup() hangs if no match found).
- - Partially fixed (idn_to_ascii for UTS #46 incorrect for long domain names).
- - (locale_accept_from_http out-of-bounds access).
- - Failure to call the parent constructor in a class extending Collator before invoking the parent methods will throw an instance of Error instead of resulting in a recoverable fatal error.
- - Cloning a Transliterator object may will now throw an instance of Error instead of resulting in a fatal error if cloning the internal transliterator fails.
- - Added IntlTimeZone::getWindowsID() and IntlTimeZone::getIDForWindowsID().
- - (IntlDateFormatter formatObject returns wrong utf8 value).
- - (IntlDateFormatter formatObject returns wrong value when time style is NONE).
-
-- JSON:
-
- - Introduced encoder struct instead of global which fixes bugs and related to pretty print indentation.
- - (Segfault with throwing JsonSerializable).
- - Implemented earlier return when json_encode fails, fixes bugs (Stacking exceptions thrown by JsonSerializable) and (On recursion error, json_encode can eat up all system memory).
- - ("_empty_" key in objects).
- - Exported JSON parser API including json_parser_method that can be used for implementing custom logic when parsing JSON.
- - Escaped U+2028 and U+2029 when JSON_UNESCAPED_UNICODE is supplied as json_encode options and added JSON_UNESCAPED_LINE_TERMINATORS to restore the previous behaviour.
-
-- LDAP:
-
- - Providing an unknown modification type to ldap_batch_modify() will now throw an instance of Error instead of resulting in a fatal error.
-
-- Mbstring:
-
- - (Null pointer dereference in mb_eregi).
- - (mb_convert_variables() cannot detect recursion).
- - (mbstring.internal_encoding doesn't inherit default_charset).
- - (mb_substr only takes 32-bit signed integer).
- - (`mb_ereg` does not clear the `$regs` parameter on failure).
- - (mb_ereg_search raises a warning if a match zero-width).
- - (mb_ereg_search increments search position when a match zero-width).
- - (mb_ereg_search_setpos does not accept a string's last position).
- - (`mb_ereg` causes buffer overflow on regexp compile error).
- - Deprecated mb_ereg_replace() eval option.
- - (mb_ereg should reject ill-formed byte sequence).
- - (mb_ereg_replace - mbc_to_code (oniguruma) - oob read access).
- - (Use-After-Free in MBString (search_re)).
- - mb_ereg() and mb_eregi() will now throw an instance of ParseError if an invalid PHP expression is provided and the 'e' option is used.
-
-- Mcrypt:
-
- - Deprecated ext/mcrypt.
- - (Heap Overflow due to integer overflows).
- - , bug (In correct casting from size_t to int lead to heap overflow in mdecrypt_generic).
- - mcrypt_encrypt() and mcrypt_decrypt() will throw an instance of Error instead of resulting in a fatal error if mcrypt cannot be initialized.
-
-- Mysqli:
-
- - Attempting to read an invalid or write to a readonly property will throw an instance of Error instead of resulting in a fatal error.
-
-- Mysqlnd:
-
- - (Add missing mysqlnd.* parameters to php.ini-*).
- - (Segfault when EXPLAIN with "Unknown column" error when using MariaDB).
- - (mysqli_get_host_info() wrong output).
-
-- OCI8:
-
- - (Bind reference overwritten on PHP 7).
- - Fixed invalid handle error with Implicit Result Sets.
- - (Binding null values triggers ORA-24816 error).
-
-- ODBC:
-
- - (odbc_errormsg returns trash, always 513 bytes).
-
-- Opcache:
-
- - (Segfaults when conditionally declared class and function have the same name).
- - (check cached files permissions)
- - (Memory leak in zend_accel_blacklist_update_regexp() function).
- - (Typo in opcache error message).
- - (Infinite loop while parsing a file with opcache enabled).
- - (Opcache restart with kill_all_lockers does not work).
-
-- OpenSSL:
-
- - (openssl_pkey_new() generates wrong pub/priv keys with Diffie Hellman).
- - (crash in openssl_random_pseudo_bytes function).
- - (Invalid path SNI_server_certs causes segfault).
- - (ext/openssl build failure with OpenSSL 1.1.0).
- - Bumped a minimal version to 1.0.1.
- - Dropped support for SSL2.
- - (Add elliptic curve support for OpenSSL).
- - (Added AEAD support [CCM and GCM modes] to openssl_encrypt and openssl_decrypt).
- - Implemented error storing to the global queue and cleaning up the OpenSSL error queue (resolves bugs and ).
-
-- Pcntl:
-
- - Implemented asynchronous signal handling without TICKS.
- - Added pcntl_signal_get_handler() that returns the current signal handler for a particular signal. Addresses FR .
- - Add siginfo to pcntl_signal() handler args (Bishop Bettini, David Walker)
-
-- PCRE:
-
- - (Segmentation fault on pcre_replace_callback).
- - (preg_*() may leak memory).
- - (A use-after-free in zend allocator management).
- - (Bundled PCRE doesn't compile because JIT isn't supported on s390).
- - (preg_match missing group names in matches).
- - Downgraded to PCRE 8.38.
- - (Memleak in jit_stack).
- - (mail fails with invalid argument).
- - Upgraded to PCRE 8.39.
-
-- PDO:
-
- - (Invalid memory access when using persistent PDO connection).
- - (Memory leak in PDO persistent connection handling).
- - (call to empty() on NULL result using PDO::FETCH_LAZY returns false).
-
-- PDO_DBlib:
-
- - (Never quote values as raw binary data).
- - Allow \PDO::setAttribute() to set query timeouts.
- - Handle SQLDECIMAL/SQLNUMERIC types, which are used by later TDS versions.
- - Add common PDO test suite.
- - Free error and message strings when cleaning up PDO instances.
- - (\PDOStatement::nextRowset() should succeed when all rows in current rowset haven't been fetched).
- - Ignore potentially misleading dberr values.
- - Implemented stringify 'uniqueidentifier' fields.
-
-- PDO_Firebird:
-
- - , , (Memory corruption in bindParam).
- - (Integer returned as a 64bit integer on X86_64).
-
-- PDO_pgsql:
-
- - (PDO statement fails to throw exception).
- - (Segmentation fault when binding parameters on a query without placeholders).
- - (Postgres PDO lastInsertId() should work without specifying a sequence).
-
-- Phar:
-
- - (Out of bound when verify signature of zip phar in phar_parse_zipfile).
- - (Out of bound when verify signature of tar phar in phar_parse_tarfile).
-
-- phpdbg:
-
- - Added generator command for inspection of currently alive generators.
-
-- Postgres:
-
- - (Incorrect SQL generated for pg_copy_to()).
- - (pg_last_notice() is needed to get all notice messages).
- - (Allow pg_fetch_all() to index numerically).
-
-- Readline:
-
- - (readline_redisplay crashes php).
-
-- Reflection:
-
- - Undo backwards compatiblity break in ReflectionType->__toString() and deprecate via documentation instead.
- - Reverted prepending \ for class names.
- - (invoke() and invokeArgs() static method calls should match). (cmb).
- - Add ReflectionNamedType::getName(). This method should be used instead of ReflectionType::__toString()
- - Prepend \ for class names and ? for nullable types returned from ReflectionType::__toString().
- - (ReflectionType::__toString crashes with iterable).
- - (ReflectionClass::export doesn't handle array constants).
- - Failure to retrieve a reflection object or retrieve an object property will now throw an instance of Error instead of resulting in a fatal error.
- - (ReflectionProperty::getValue() doesn't fail if object doesn't match type).
-
-- Session:
-
- - (session_unset() empties values from all variables in which is $_session stored).
- - (session_destroy null dereference in ps_files_path_create).
- - (Session does not report invalid uid for files save handler).
- - (SID always return "name=ID", even if session cookie exist).
- - Implemented session_gc() (Yasuo) https://wiki.php.net/rfc/session-create-id
- - Implemented session_create_id() (Yasuo) https://wiki.php.net/rfc/session-gc
- - Implemented RFC: Session ID without hashing. (Yasuo) https://wiki.php.net/rfc/session-id-without-hashing
- - (ps_files_cleanup_dir Buffer overflow).
- - Custom session handlers that do not return strings for session IDs will now throw an instance of Error instead of resulting in a fatal error when a function is called that must generate a session ID.
- - An invalid setting for session.hash_function will throw an instance of Error instead of resulting in a fatal error when a session ID is created.
- - (Use After Free in unserialize() with Unexpected Session Deserialization).
- - Improved fix for bug (Empty session IDs do still start sessions).
- - (session_start() returns TRUE on failure). Session save handlers must return 'string' always for successful read. i.e. Non-existing session read must return empty string. PHP 7.0 is made not to tolerate buggy return value.
- - (session_regenerate_id() must close opened session on errors).
-
-- SimpleXML:
-
- - (NULL pointer dereference in SimpleXMLElement::asXML()).
- - (SimpleXML isset/unset do not respect namespace).
- - (Null coalescing operator doesn't behave as expected with SimpleXMLElement).
- - (Using global var doesn't work while accessing SimpleXML element).
- - Creating an unnamed or duplicate attribute will throw an instance of Error instead of resulting in a fatal error.
-
-- SNMP:
-
- - (php_snmp_parse_oid integer overflow in memory allocation).
- - (Use After Free Vulnerability in SNMP with GC and unserialize()).
-
-- Soap:
-
- - (SoapClient::__setSoapHeaders doesn't overwrite SOAP headers).
- - (Segfault (Regression for )).
- - (SoapServer reports Bad Request when gzipped).
- - (Nested object in "any" element overwrites other fields).
- - (Peer verification fails when using a proxy with SoapClient).
- - (Soap Server Member variables reference bug).
- - (Using references in arrays doesn't work like expected).
-
-- SPL:
-
- - (Reproducible crash with GDB backtrace).
- - (Segfault on clone on splFileObject).
- - (Missing type check when unserializing SplArray).
- - (SplFileObject::getCsvControl does not return the escape character).
- - (AppendIterator segfault with closed generator).
- - Attempting to clone an SplDirectory object will throw an instance of Error instead of resulting in a fatal error.
- - Calling ArrayIterator::append() when iterating over an object will throw an instance of Error instead of resulting in a fatal error.
- - (GlobIterator throws LogicException).
-
-- SQLite3:
-
- - Update to SQLite 3.15.1.
- - (Unsetting result set may reset other result set).
- - (2147483647 is fetched as string).
- - (Spurious warning when exception is thrown in user defined function).
- - (SQLite should allow opening with empty filename).
- - (Clearing bindings on an SQLite3 statement doesn't work).
- - (Upgraded bundled SQLite lib to 3.9.2).
-
-- Standard:
-
- - (HTTP stream wrapper should ignore HTTP 100 Continue).
- - (Scope not inherited by eval in assert()).
- - (parse_url return wrong hostname).
- - (passing additional_parameters causes mail to fail).
- - (passing additional_parameters causes mail to fail).
- - (Accessing a private constant using constant() creates an exception AND warning).
- - (get_browser() incorrectly parses entries with "+" sign).
- - (Negative ftruncate() on php://memory exhausts memory).
- - (substr_compare NULL length interpreted as 0).
- - (getimagesize returning FALSE on valid jpg).
- - (unset array item in array_walk_recursive cause inconsistent array).
- - (array_walk_recursive move internal pointer).
- - (Exchanging array during array_walk -> memory errors).
- - (Use After Free Vulnerability in array_walk()/ array_walk_recursive()).
- - (array_walk + array_replace_recursive create references from nothing).
- - (CSV fields incorrectly split if escape char followed by UTF chars).
- - Implemented RFC: More precise float values.
- - array_multisort now uses zend_sort instead zend_qsort.
- - (readfile() mangles files larger than 2G).
- - assert() will throw a ParseError when evaluating a string given as the first argument if the PHP code is invalid instead of resulting in a catchable fatal error.
- - Calling forward_static_call() outside of a class scope will now throw an instance of Error instead of resulting in a fatal error.
- - Added is_iterable() function.
- - (Heap overflow through proc_open and $env parameter).
- - (long2ip() doesn't accept integers in strict mode).
- - (Add an option to pass a custom stream context to get_headers()).
- - Additional validation for parse_url() for login/pass components).
- - (Provide a way to fetch the current environment variables).
- - unpack() function accepts an additional optional argument $offset.
- - stream context socket option tcp_nodelay (Joe)
-
-- Streams:
-
- - (php_user_filter::$stream is not set to the stream the filter is working on).
- - (stream_set_blocking doesn't work).
- - (Out-of-bound read in php_stream_filter_create).
- - (Multiple small packets send for HTTP request).
- - (ftps:// opendir wrapper data channel encryption fails with IIS FTP 7.5, 8.5).
- - (Missing SKIP_ONLINE_TESTS checks).
- - (Problems with the ftps wrapper).
- - (opendir() does not work with ftps:// wrapper).
- - (opendir() with ftp:// attempts to open data stream for non-existent directories).
- - (ftps:// wrapper is vulnerable to protocol downgrade attack).
- - (stream_socket_get_name crashes).
- - (Stream socket with remote address leads to a segmentation fault).
-
-- sysvshm:
-
- - (shm_attach null dereference).
-
-- Tidy:
-
- - Implemented support for libtidy 5.0.0 and above.
- - Creating a tidyNode manually will now throw an instance of Error instead of resulting in a fatal error.
-
-- Wddx:
-
- - (NULL Pointer Dereference in WDDX Packet Deserialization with PDORow). (CVE-2016-9934)
- - (WDDX Packet Injection Vulnerability in wddx_serialize_value()).
- - (wddx_deserialize allows illegal memory access).
- - (wddx_deserialize null dereference).
- - (wddx_deserialize null dereference with invalid xml).
- - (wddx_deserialize null dereference in php_wddx_pop_element).
- - (wddx_deserialize use-after-free).
- - (Out-Of-Bounds Read in php_wddx_push_element).
- - (boolean always deserialized as "true").
- - A circular reference when serializing will now throw an instance of Error instead of resulting in a fatal error.
-
-- XML:
-
- - (malformed XML causes fault).
- - (_xml_startElementHandler() segmentation fault).
- - (SEGV on unknown address zif_xml_parse).
-
-- XMLRPC:
-
- - (xmlrpc_encode() unexpected output after referencing array elements).
- - (heap-buffer-overflow (write) simplestring_addn simplestring.c).
- - A circular reference when serializing will now throw an instance of Error instead of resulting in a fatal error.
-
-- Zip:
-
- - (impossible to compile php with zip support).
- - (NULL Pointer dereference in zend_virtual_cwd).
- - (Stack-based buffer overflow vulnerability in php_stream_zip_opener).
- - ZipArchive::addGlob() will throw an instance of Error instead of resulting in a fatal error if glob support is not available.
-
-
-
-
-
-
-Version 7.0.33
-
-- Core:
-
- - (Segfault when using convert.quoted-printable-encode filter).
-
-- IMAP:
-
- - (null pointer dereference in imap_mail).
- - (imap_open allows to run arbitrary shell commands via mailbox parameter). (CVE-2018-19518)
-
-- Phar:
-
- - (PharData always creates new files with mode 0666).
- - (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile). (CVE-2018-20783)
-
-
-
-
-
-
-Version 7.0.32
-
-- Apache2:
-
- - (XSS due to the header Transfer-Encoding: chunked). (CVE-2018-17082)
-
-
-
-
-
-Version 7.0.31
-
-- Exif:
-
- - (Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c). (CVE-2018-14883)
- - (heap-buffer-overflow (READ of size 48) while reading exif data). (CVE-2018-14851)
-
-- Win32:
-
- - (windows linkinfo lacks openbasedir check). (CVE-2018-15132)
-
-
-
-
-
-
-Version 7.0.30
-
-- Exif:
-
- - (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value). (CVE-2018-10549)
-
-- iconv:
-
- - (stream filter convert.iconv leads to infinite loop on invalid sequence). (CVE-2018-10546)
-
-- LDAP:
-
- - (Malicious LDAP-Server Response causes Crash). (CVE-2018-10548)
-
-- Phar:
-
- - (fix for CVE-2018-5712 may not be complete). (CVE-2018-10547)
-
-
-
-
-
-Version 7.0.29
-
-- FPM:
-
- - (Dumpable FPM child processes allow bypassing opcache access controls). (CVE-2018-10545)
-
-
-
-
-
-
-Version 7.0.28
-
-- Standard:
-
- - (stack-buffer-overflow while parsing HTTP response). (CVE-2018-7584)
-
-
-
-
-
-Version 7.0.27
-
-- CLI Server:
-
- - (Random "Invalid request (unexpected EOF)" using a router script).
-
-- Core:
-
- - (PHP seems incompatible with OneDrive files on demand).
- - (Segmentation fault in 7.1.12 and 7.0.26).
-
-- FPM:
-
- - (libxml_disable_entity_loader setting is shared between requests).
-
-- GD:
-
- - (Potential infinite loop in gdImageCreateFromGifCtx). (CVE-2018-5711)
-
-- Opcache:
-
- - (Interned strings buffer overflow may cause crash).
-
-- PCRE:
-
- - (preg_last_error not returning error code after error).
-
-- Phar:
-
- - (Reflected XSS in .phar 404 page). (CVE-2018-5712)
-
-- Standard:
-
- - (Inappropriately parsing HTTP response leads to PHP segment fault). (CVE-2018-14884)
- - (accept EFAULT in addition to ENOSYS as indicator that getrandom() is missing).
-
-- Zip:
-
- - (Segfault with libzip 1.3.1).
-
-
-
-
-
-
-Version 7.0.26
-
-- Core:
-
- - (Crash when modifing property name in __isset for BP_VAR_IS).
- - (mmap/munmap trashing on unlucky allocations).
-
-- CLI:
-
- - (Builtin webserver crash after chdir in a shutdown function).
-
-- Enchant:
-
- - (enchant_broker_get_path crashes if no path is set).
- - (Enchant still reports version 1.1.0).
-
-- Exif:
-
- - (Exif extension has built in revision version).
-
-- GD:
-
- - (imagerotate may alter image dimensions).
- - (Wrong reflection on imagewebp).
-
-- intl:
-
- - (UConverter::setDestinationEncoding changes source instead of destination).
-
-- interbase:
-
- - (Incorrect reflection for ibase_[p]connect).
-
-- Mysqli:
-
- - (Wrong reflection for mysqli_fetch_all function).
-
-- OCI8:
-
- - Fixed valgrind issue.
-
-- Opcache:
-
- - (Warning Internal error: wrong size calculation).
-
-- OpenSSL:
-
- - (openssl_x509_parse leaks memory).
- - (Wrong reflection for openssl_open function).
-
-- PGSQL:
-
- - (Default link incorrectly cleared/linked by pg_close()).
-
-- SOAP:
-
- - (Wrong reflection on SoapClient::__setSoapHeaders).
-
-- Zlib:
-
- - (Wrong reflection on inflate_init and inflate_add).
-
-
-
-
-
-Version 7.0.25
-
-- Core:
-
- - (Null pointer dereference in zend_mm_alloc_small()).
- - (infinite loop when printing an error-message).
- - (Incorrect token formatting on two parse errors in one request).
- - (Segfault when calling is_callable on parent).
- - (debug info of Closures of internal functions contain garbage argument names).
-
-- Apache2Handler:
-
- - (error: 'zend_hash_key' has no member named 'arKey' in apache2handler).
-
-- Date:
-
- - (Out-Of-Bounds Read in timelib_meridian()). (CVE-2017-16642)
-
-- Intl:
-
- - (The parameter of UConverter::getAliases() is not optional).
-
-- mcrypt:
-
- - (arcfour encryption stream filter crashes php).
-
-- OCI8:
-
- - Fixed incorrect reference counting.
-
-- PCRE:
-
- - (applied upstream patch for CVE-2016-1283).
-
-- litespeed:
-
- - (Binary directory doesn't get created when building only litespeed SAPI).
- - (Missing program prefix and suffix).
-
-- SPL:
-
- - (SplDoublyLinkedList::setIteratorMode masks intern flags).
-
-
-
-
-
-Version 7.0.24
-
-- Core:
-
- - (run-tests.php issues with EXTENSION block).
-
-- BCMath:
-
- - (bcpowmod() fails if scale != 0).
- - (BC math handles minus zero incorrectly).
- - (bcpowmod() may return 1 if modulus is 1).
- - (bcpowmod() misbehaves for non-integer base or modulus).
-
-- CLI server:
-
- - (Built-in server truncates headers spanning over TCP packets).
-
-- CURL:
-
- - (OpenSSL support not detected).
-
-- GD:
-
- - (gdImageGrayScale() may produce colors).
- - (libgd/gd_interpolation.c:1786: suspicious if ?).
-
-- Gettext:
-
- - (textdomain(null) throws in strict mode).
-
-- Intl:
-
- - (IntlGregorianCalendar doesn't have constants from parent class).
-
-- PDO_OCI:
-
- - (PDO_PCO with PHP-FPM: OCI environment initialized before PHP-FPM sets it up).
-
-- SPL:
-
- - (incorrect behavior of AppendIterator::append in foreach loop).
-
-- Standard:
-
- - (gethostname fails if your host name is 64 chars long).
-
-
-
-
-
-Version 7.0.23
-
-- Core:
-
- - (Segfault in scanner on INF number).
- - (null deref and segfault in zend_generator_resume()).
- - (html_errors=1 breaks unhandled exceptions).
- - (NAN comparison).
-
-- cURL:
-
- - (Fixed finding CURL on systems with multiarch support).
-
-- Date:
-
-- (Null Pointer Dereference in timelib_time_clone).
-
-- Intl:
-
- - (Wrong reflection on some locale_* functions).
-
-- Mbstring:
-
- - (Segmentation fault mb_strcut with HTML-ENTITIES encoding).
- - (mb_convert_kana() does not convert iteration marks).
- - (Wrong reflection on mb_eregi_replace).
-
-- MySQLi:
-
- - (PHP crashes when calling mysqli_result::fetch_object with an abstract class).
-
-- OCI8:
-
- - Expose oci_unregister_taf_callback() (Tianfang Yang)
-
-- phar:
-
- - (include_path has a 4096 char limit in some cases).
-
-- Reflection:
-
- - (null pointer dereference in _function_string).
-
-- Session:
-
- - (SID constant created with wrong module number).
-
-- SimpleXML:
-
- - (nullpointer deref in simplexml_element_getDocNamespaces).
-
-- SPL:
-
- - (spl_autoload_unregister can't handle spl_autoload_functions results).
- - (Unserialize ArrayIterator broken).
- - (Crash in recursive iterator destructors).
-
-- Standard:
-
- - (unpack with X* causes infinity loop).
- - (heap-use-after-free when unserializing invalid array size). (CVE-2017-12932)
- - (A Denial of Service Vulnerability was found when performing deserialization).
-
-- WDDX:
-
- - (WDDX uses wrong decimal seperator).
-
-- XMLRPC:
-
- - (Incorrect xmlrpc serialization for classes with declared properties).
-
-
-
-
-
-Version 7.0.22
-
-- Core:
-
- - (Loading PHP extension with already registered function name leads to a crash).
- - (parse_url() borken when query string contains colon).
- - (Unary operator expected error on some systems).
- - (Use After Free in unserialize() SplFixedArray).
- - (fixed incorrect poll.h include).
- - (fixed incorrect errno.h include).
-
-- Date:
-
- - (property_exists returns true on unknown DateInterval property).
-
-- OCI8:
-
- - (Integer overflow in oci_bind_array_by_name).
-
-- Opcache:
-
- - (Opcache overwrites argument of GENERATOR_RETURN within finally).
-
-- PDO:
-
- - (PDOStatement::debugDumpParams() truncates query).
-
-- SPL:
-
- - (PHP freezes with AppendIterator).
-
-- SQLite3:
-
- - (SQLite3::__construct() produces "out of memory" exception with invalid flags).
-
-- Wddx:
-
- - (huge memleak when wddx_unserialize).
- - (wddx parsing empty boolean tag leads to SIGSEGV). (CVE-2017-11143)
-
-- zlib:
-
- - (dictionary option of inflate_init() does not work).
-
-
-
-
-
-Version 7.0.21
-
-- Core:
-
- - (Multiple [PATH=] and [HOST=] sections not properly parsed).
- - (Undefined constants in array properties result in broken properties).
- - Fixed misparsing of abstract unix domain socket names.
- - (Unserialize Heap Use-After-Free (READ: 1) in zval_get_type). (CVE-2017-12934)
- - (Heap buffer overread (READ: 1) finish_nested_data from unserialize). (CVE-2017-12933)
- - (PHP INI Parsing Stack Buffer Overflow Vulnerability). (CVE-2017-11628)
- - (wddx_deserialize() heap out-of-bound read via php_parse_date()). (CVE-2017-11145)
-
-- DOM:
-
- - (References to deleted XPath query results).
-
-- GD:
-
- - (Buffer over-read into uninitialized memory). (CVE-2017-7890)
-
-- Intl:
-
- - (Stack Buffer Overflow in msgfmt_parse_message). (CVE-2017-11362)
- - (Wrong reflection on Collator::getSortKey and collator_get_sort_key).
- - (grapheme_strpos illegal memory access).
-
-- Mbstring:
-
- - Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
-
-- OCI8:
-
- - Add TAF callback (PR ).
-
-- Opcache:
-
- - (Segfault with opcache.memory_protect and validate_timestamp).
-
-- OpenSSL:
-
- - (negative-size-param (-1) in memcpy in zif_openssl_seal()). (CVE-2017-11144)
-
-- PCRE:
-
- - (Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)).
-
-- PDO_OCI:
-
- - Support Instant Client 12.2 in --with-pdo-oci configure option.
-
-- Reflection:
-
- - (Segfault when cast Reflection object to string with undefined constant).
-
-- SPL:
-
- - (null coalescing operator failing with SplFixedArray).
-
-- Standard:
-
- - (Invalid Reflection signatures for random_bytes and random_int).
- - (Heap buffer overflow in substr).
-
-- FTP:
-
- - (ftp:// wrapper ignores context arg).
-
-- PHAR:
-
- - (Phar::__construct reflection incorrect).
-
-- SOAP:
-
- - (Incorrect conversion array with WSDL_CACHE_MEMORY).
-
-- Streams:
-
- - (stream_socket_get_name() returns '\0').
-
-
-
-
-
-
-Version 7.0.20
-
-- Core:
-
- - (crash (SIGSEGV) in _zend_hash_add_or_update_i).
- - (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST).
-
-- intl:
-
- - (wrong reflection on Collator::sortWithSortKeys).
-
-- MySQLi:
-
- - (mysqli::change_user() doesn't accept null as $database argument w/strict_types).
-
-- Opcache:
-
- - (SIGSEGV with opcache.revalidate_path enabled).
-
-- phar:
-
- - (Phar::webPhar() does not handle requests sent through PUT and DELETE method).
-
-- Standard:
-
- - (win32/sendmail.c anchors CC header but not BCC).
-
-- xmlreader:
-
- - (Wrong reflection on XMLReader::expand).
-
-
-
-
-
-Version 7.0.19
-
-- Core:
-
- - (Null coalescing operator fails for undeclared static class properties).
- - (Endless loop bypassing execution time limit).
- - (stream_select() is broken on Windows Nanoserver).
- - (php-cgi.exe crash on facebook callback).
- - Patch for bug was reverted.
-
-- Date:
-
- - (Wrong reflection on DateTimeZone::getTransitions).
- - (add constant for RFC7231 format datetime).
-
-- DOM:
-
- - (Wrong reflection on DOMNode::cloneNode).
-
-- Fileinfo:
-
- - (syntax error compile error in libmagic/apprentice.c).
-
-- GD:
-
- - (compile fails on solaris 11 with system gd2 library).
-
-- intl:
-
- - (wrong reflection for Normalizer methods).
- - (wrong reflection for Locale methods).
-
-- MySQLi:
-
- - (mysqli_connect adding ":3306" to $host if $port parameter not given).
-
-- MySQLnd:
-
- - Added support for MySQL 8.0 types.
- - (Invalid free of persistent results on error/connection loss).
-
-- OpenSSL:
-
- - (null character not allowed in openssl_pkey_get_private).
- - (Segfault in openssl_pkey_new when generating DSA or DH key).
- - (openssl_x509_parse fails to parse ASN.1 UTCTime without seconds).
- - Added OpenSSL 1.1.0 support.
-
-- phar:
-
- - (phar method parameters reflection correction).
-
-- Standard:
-
- - (Reflection information for ini_get_all() is incomplete).
- - (setcookie allows max-age to be negative).
-
-- Streams:
-
- - (Remote socket URI with unique persistence identifier broken).
-
-- SQLite3:
-
- - (incorrect reflection for SQLite3::enableExceptions).
-
-
-
-
-
-Version 7.0.18
-
-- Core:
-
- - (falsely exits with "Out of Memory" when using USE_ZEND_ALLOC=0).
- - (Leak with instance method calling static method with referenced return).
- - (Build problems after 7.0.17 release: undefined reference to `isfinite').
- - (yield fromLABEL is over-greedy).
-
-- Apache:
-
- - Reverted patch for bug , fixes bug .
-
-- Date:
-
- - (Swatch time value incorrect for dates before 1970).
-
-- DOM:
-
- - (LIBXML_NOWARNING flag ingnored on loadHTML*).
-
-- iconv:
-
- - (iconv fails to fail on surrogates).
-
-- OpenSSL:
-
- - (fwrite() on non-blocking SSL sockets doesn't work).
-
-- PDO MySQL:
-
- - (Expose MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT to PDO interface).
-
-- Streams:
-
- - (Correctly fail on invalid IP address ports).
-
-- Zlib:
-
- - (deflate_add can allocate too much memory).
-
-
-
-
-
-Version 7.0.17
-
-- Core:
-
- - (PHP 7.1 Segfaults within Symfony test suite).
- - (Out of bound read - zend_mm_alloc_small).
- - (Performance problem with processing large post request). (CVE-2017-11142)
- - (array_key_exists fails on arrays created by get_object_vars).
- - (NAN check fails on Alpine Linux with musl).
- - (is_infinite(-INF) returns false).
- - (Generating phar.phar core dump with gcc ASAN enabled build).
-
-- Apache:
-
- - (Incomplete POST does not timeout but is passed to PHP).
-
-- Date:
-
- - (Relative datetime format ignores weekday on sundays only).
- - (DateTime wrong when date string is negative).
- - (wrong timestamp when call setTimeZone multi times with UTC offset).
- - (first/last day of' flag is not being reset).
- - ($date->modify('Friday this week') doesn't return a Friday if $date is a Sunday).
- - (wrong day when using "this week" in strtotime).
-
-- FPM:
-
- - (php-fpm process accounting is broken with keepalive).
-
-- Hash:
-
- - (gost-crypto hash incorrect if input data contains long 0xFF sequence).
-
-- GD:
-
- - (ReflectionFunction for imagepng is missing last two parameters).
-
-- Mysqlnd:
-
- - (fetch_array broken data. Data more then MEDIUMBLOB).
-
-- Opcache:
-
- - (if statement says true to a null variable).
- - (Segfault with list).
-
-- OpenSSL:
-
- - (PHP Fast CGI crashes when reading from a pfx file).
-
-- Standard:
-
- - (ReflectionFunction incorrectly reports the number of arguments).
- - (mail.add_x_header causes RFC-breaking lone line feed).
- - (is_callable callable name reports misleading value for anonymous classes).
- - (PHP on Linux should use /dev/urandom when getrandom is not available).
-
-- Streams:
-
- - (Invalid memory access in zend_inline_hash_func).
- - (stream_get_contents maxlength>-1 returns empty string).
-
-
-
-
-
-Version 7.0.16
-
-- Core:
-
- - (zend_print_flat_zval_r doesn't consider reference).
- - (Crash when exporting **= in expansion of assign op).
- - (segfault in debug_print_backtrace).
- - (assertion error in debug_zval_dump).
-
-- DOM:
-
- - (getAttributeNodeNS doesn't get xmlns* attributes).
-
-- DTrace:
-
- - (DTrace reported as enabled when disabled).
-
-- FPM:
-
- - (double fastcgi_end_request on max_children limit).
- - (php-fpm does not close stderr when using syslog).
-
-- GD:
-
- - (Premature failing of XBM reading).
-
-- GMP:
-
- - (test for gmp.h needs to test machine includes).
-
-- Intl:
-
-- (Link use CC instead of CXX).
-
-- LDAP:
-
- - (error/segfault with ldap_mod_replace and opcache).
-
-- MySQLi:
-
- - (leak in mysqli_fetch_object).
-
-- Mysqlnd:
-
- - (segfault on close() after free_result() with mysqlnd).
-
-- Opcache:
-
- - (crash on finish work with phar in cli + opcache).
-
-- OpenSSL:
-
- - (add serial hex to return value array).
-
-- PDO_Firebird:
-
- - (All data are fetched as strings).
-
-- PDO_PgSQL:
-
- - (lastInsertId fails to throw an exception for wrong sequence name).
-
-- Phar:
-
- - (PharData::compress() doesn't close temp file).
-
-- posix:
-
- - (configure script incorrectly checks for ttyname_r).
-
-- Session:
-
- - (session not readable by root in CLI).
-
-- SPL:
-
- - (spl_autoload() crashes when calls magic _call()).
-
-- Standard:
-
- - (closing of fd incorrect when PTS enabled).
- - (SoapClient stumbles over WSDL delivered with "Transfer-Encoding: chunked").
- - (imap is undefined service on AIX).
- - (money_format stores wrong length AIX).
-
-- ZIP:
-
- - (ZipArchive::addGlob ignores remove_all_path option).
-
-
-
-
-
-Version 7.0.15
-
-- Core:
-
- - (invalid foreach loop hangs script).
- - ("Invalid opcode 65/16/8" occurs with a variable created with list()).
- - (Logging of "Internal Zend error - Missing class information" missing class name).
- - (unserialized array pointer not advancing).
- - (Heap out of bounds read on unserialize in finish_nested_data()). (CVE-2016-10161)
- - (NULL Pointer Dereference while unserialize php object). (CVE-2016-10162)
- - (Use of uninitialized memory in unserialize()). (CVE-2017-5340)
- - (Unserialize use-after-free when resizing object's properties hash table). (CVE-2016-7479)
- - (Use After Free in unserialize()).
- - (Type Confusion in Object Deserialization).
-
-- COM:
-
- - (DOTNET read access violation using invalid codepage).
-
-- DOM:
-
- - (getElementsByTagNameNS filter on default ns).
-
-- EXIF:
-
-- (FPE when parsing a tag format). (CVE-2016-10158)
-
-- GD:
-
- - (Signed Integer Overflow gd_io.c). (CVE-2016-10168)
- - (DOS vulnerability in gdImageCreateFromGd2Ctx()). (CVE-2016-10167)
-
-- GMP:
-
- - (GMP Deserialization Type Confusion Vulnerability).
-
-- Mysqli:
-
- - (Persistent connections don't set $connect_errno).
-
-- Mysqlnd:
-
- - Fixed issue with decoding BIT columns when having more than one rows in the result set. 7.0+ problem.
- - (sporadic segfault with MYSQLI_OPT_INT_AND_FLOAT_NATIVE).
-
-- PCRE:
-
- - (preg_*() may leak memory).
-
-- PDO_Firebird:
-
- - (PDO_FIREBIRD with Firebird 3.0 not work on returning statement).
-
-- Phar:
-
- - (Seg fault when loading hostile phar). (CVE-2017-11147)
- - (Memory corruption when loading hostile phar). (CVE-2016-10160)
- - (Crash while loading hostile phar archive). (CVE-2016-10159)
-
-- Phpdbg:
-
- - (phpdbg without option never load .phpdbginit at startup).
- - Fixed issue getting executable lines from custom wrappers.
- - (phpdbg shows the wrong line in files with shebang).
-
-- Reflection:
-
- - (ReflectionObject memory leak).
-
-- Streams:
-
- - (php_user_filter::$stream is not set to the stream the filter is working on).
-
-- SQLite3:
-
-- Reverted fix for (Unsetting result set may reset other result set).
-
-- Standard:
-
- - (dns_get_record does not populate $additional out parameter).
- - (Unserialize context shared on double class lookup).
- - (serialize object with __sleep function crash).
- - (get_browser function is very slow).
- - (Loading browscap.ini at startup causes high memory usage).
- - (get_defined_functions additional param to exclude disabled functions).
-
-- Zlib:
-
- - (deflate_add does not verify that output was not truncated).
-
-
-
-
-
-Version 7.0.14
-
-- Core:
-
- - Fixed memory leak(null coalescing operator with Spl hash).
- - (Slow performance when fetching large dataset with mysqli / PDO).
- - (Use After Free Vulnerability in unserialize()). (CVE-2016-9936)
-
-- Calendar:
-
- - (Fix integer overflows).
-
-- Date:
-
- - (DateInterval properties and isset).
-
-- DTrace:
-
- - Disabled PHP call tracing by default (it makes significant overhead). This may be enabled again using envirionment variable USE_ZEND_DTRACE=1.
-
-- JSON:
-
- - (php_json_encode depth issue).
-
-- Mysqlnd:
-
- - (Add missing mysqlnd.* parameters to php.ini-*).
-
-- ODBC:
-
- - (odbc_errormsg returns trash, always 513 bytes).
-
-- Opcache:
-
- - (check cached files permissions).
- - (Logging for opcache has an empty file name).
-
-- PCRE:
-
- - (Segmentation fault on pcre_replace_callback).
- - (A use-after-free in zend allocator management).
-
-- PDO_Firebird:
-
- - , , (Memory corruption in bindParam).
-
-- Phar:
-
- - (Phar::isValidPharFilename illegal memory access).
-
-- Postgres:
-
- - (Incorrect SQL generated for pg_copy_to()).
-
-- Soap:
-
- - (SoapClient::__setSoapHeaders doesn't overwrite SOAP headers).
- - (Segfault (Regression for )).
-
-- SPL:
-
- - (Reproducible crash with GDB backtrace).
-
-- SQLite3:
-
- - (Unsetting result set may reset other result set).
-
-- Standard:
-
- - (HTTP stream wrapper should ignore HTTP 100 Continue).
- - (version_compare illegal write access).
-
-- Wddx:
-
- - (Invalid read when wddx decodes empty boolean element). (CVE-2016-9935)
-
-- XML:
-
- - (malformed XML causes fault).
-
-
-
-
-
-Version 7.0.13
-
-- Core:
-
- - (Exception::__toString() cause circular references).
- - (parse_str() without a second argument leads to crash).
- - (Autoload with Opcache allows importing conflicting class name to namespace).
- - ((Sub-)Namespaces unexpected behaviour).
- - Fix pthreads detection when cross-compiling.
- - (try/catch not working with two exceptions inside a same operation).
- - (Exception thrown from error handler causes valgrind warnings (and crashes)).
- - ((Float)"Nano" == NAN).
-
-- GD:
-
- - (Integer overflow in imageline() with antialiasing).
- - (imagescale() is not affected by, but affects imagesetinterpolation()).
- - (Integer overflow in gdImageScaleBilinearPalette()).
- - (Stack Buffer Overflow in GD dynamicGetbuf).
- - (Ilegal write/read access caused by gdImageAALine overflow).
- - (imagefilltoborder stackoverflow on truecolor images). (CVE-2016-9933)
-
-- IMAP:
-
- - (Integer Overflow in "_php_imap_mail" leads to crash).
-
-- OCI8:
-
- - (Bind reference overwritten on PHP 7).
-
-- phpdbg:
-
- - Properly allow for stdin input from a file.
- - Add -s command line option / stdin command for reading script from stdin.
- - Ignore non-executable opcodes in line mode of phpdbg_end_oplog().
- - (Simple SIGINT does not have any effect with -rr).
- - (INI files are loaded even invoked as -n --version).
-
-- Session:
-
- - (session_unset() empties values from all variables in which is $_session stored).
-
-- SOAP:
-
- - (SoapServer reports Bad Request when gzipped).
- - (Nested object in "any" element overwrites other fields).
- - (Peer verification fails when using a proxy with SoapClient)
-
-- SQLite3:
-
- - (2147483647 is fetched as string).
-
-- Standard:
-
- - (passing additional_parameters causes mail to fail).
- - (array_replace_recursive sometimes mutates its parameters).
- - (parse_url return wrong hostname).
-
-- Wddx:
-
- - (NULL Pointer Dereference in WDDX Packet Deserialization with PDORow). (CVE-2016-9934)
-
-
-
-
-
-Version 7.0.12
-
-- Core:
-
- - (Heap Buffer Overflow in virtual_popen of zend_virtual_cwd.c).
- - (Out of bounds global memory read in BF_crypt triggered by password_verify).
- - (crypt broken when salt is 'too' long).
- - (Invalid free in extension trait).
- - (segfault on undefined function).
- - (PHP hangs if error handler throws while accessing undef const in default value).
- - (parse error: Invalid numeric literal).
- - (Write out of bounds at number_format).
- - (Use After Free in PHP7 unserialize()).
- - (Memcpy negative size parameter php_resolve_path).
-
-- BCmath:
-
-- (memcpy negative parameter _bc_new_num_ex).
-
-- COM:
-
- - (Cannot pass parameter 1 by reference).
-
-- Date:
-
- - (Unserializing DateInterval object may lead to __toString invocation).
-
-- DOM:
-
- - (missing NULL check in dom_document_save_html).
-
-- Filter:
-
- - (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and FILTER_FLAG_NO_PRIV_RANGE).
- - (default option ignored when object passed to int filter).
-
-- GD:
-
- - (imagetruecolortopalette: white is duplicated in palette).
- - (imagettftext broken on transparent background w/o alphablending).
- - (Integer Overflow in gdImageWebpCtx of gd_webp.c).
- - (imagettfbbox gives incorrect values for bounding box).
- - (imagegd2() ignores 3rd param if 4 are given).
- - (imagegd2() writes wrong chunk sizes on boundaries).
- - (imagegd2(): unrecognized formats may result in corrupted files).
- - (imagecreatefromgd2() may leak memory).
-
-- Intl:
-
- - (add mitigation for ICU int overflow).
-
-- Mbstring:
-
- - (mb_substr only takes 32-bit signed integer).
- - (mb_convert_variables() cannot detect recursion).
- - (mbstring.internal_encoding doesn't inherit default_charset).
-
-- Mysqlnd:
-
- - (PHP Crashes When Modifying Array Containing MySQLi Result Data).
-
-- Opcache:
-
- - (Memory leak in zend_accel_blacklist_update_regexp() function).
-
-- OpenSSL:
-
- - (Invalid path SNI_server_certs causes segfault).
- - (crash in openssl_random_pseudo_bytes function).
- - (crash in openssl_encrypt function).
-
-- PCRE:
-
- - (Bundled PCRE doesn't compile because JIT isn't supported on s390).
- - (heap overflow in php_pcre_replace_impl).
-
-- PDO_DBlib:
-
- - (Never quote values as raw binary data).
- - Allow \PDO::setAttribute() to set query timeouts.
- - Handle SQLDECIMAL/SQLNUMERIC types, which are used by later TDS versions.
- - Add common PDO test suite.
- - Free error and message strings when cleaning up PDO instances.
- - (\PDOStatement::nextRowset() should succeed when all rows in current rowset haven't been fetched).
- - Ignore potentially misleading dberr values.
-
-- phpdbg:
-
- - (phpdbg_prompt.c undefined reference to DL_LOAD).
- - Fixed next command not stopping when leaving function.
-
-- Session:
-
- - (Session does not report invalid uid for files save handler).
- - (session_destroy null dereference in ps_files_path_create).
-
-- SimpleXML:
-
- - (NULL pointer dereference in SimpleXMLElement::asXML()).
-
-- SOAP:
-
- - (Soap Server Member variables reference bug).
- - (Using references in arrays doesn't work like expected).
-
-- SPL:
-
-- , (SplObjectStorage unserialize allows use of non-object as key).
-
-- SQLite3:
-
- - Updated bundled SQLite3 to 3.14.2.
-
-- Zip:
-
- - (Depacking with wrong password leaves 0 length files).
-
-
-
-
-
-Version 7.0.11
-
-- Core:
-
- - (Null pointer deref in zval_delref_p).
- - (assign_dim on string doesn't reset hval).
- - (Memleak in zend_binary_assign_op_obj_helper).
- - (Segfault with __get returned by ref).
- - (PHP Segfaults when trying to expand an infinite operator).
- - (PHP Crashes on duplicate destructor call).
- - (stream_socket_recvfrom read access violation).
-
-- COM:
-
- - (COM called from PHP does not return out parameters).
-
-- Dba:
-
- - (Cannot fetch multiple values with group in ini file).
-
-- FTP:
-
- - (Cannot upload file using ftp_put to FTPES with require_ssl_reuse).
-
-- GD:
-
- - (imagesetstyle() causes OOB read for empty $styles).
- - (imagecopy does not support 1bit transparency on truecolor images).
- - (imagecopy() loses single-color transparency on palette images).
- - (possible resource leaks in _php_image_convert()).
-
-- iconv:
-
- - (iconv_substr returns false for empty strings).
-
-- IMAP:
-
- - (imap_mail null dereference).
-
-- Intl:
-
- - (grapheme_*() is not Unicode compliant on CR LF sequence).
- - (add locale length check). (CVE-2016-7416)
-
-- Mysqlnd:
-
- - (Heap overflow in mysqlnd related to BIT fields). (CVE-2016-7412)
-
-- OCI8:
-
- - Fixed invalid handle error with Implicit Result Sets.
- - (Binding null values triggers ORA-24816 error).
-
-- Opcache:
-
- - (Typo in opcache error message).
-
-- PDO:
-
- - (Invalid memory access when using persistent PDO connection).
- - (Memory leak in PDO persistent connection handling).
- - (call to empty() on NULL result using PDO::FETCH_LAZY returns false).
-
-- PDO_DBlib:
-
- - Implemented stringify 'uniqueidentifier' fields.
-
-- PDO_pgsql:
-
- - (Postgres PDO lastInsertId() should work without specifying a sequence).
- - (Regression in pgo_pgsql).
-
-- Phar:
-
- - (Out of bound when verify signature of zip phar in phar_parse_zipfile). (CVE-2016-7414)
- - (Out of bound when verify signature of tar phar in phar_parse_tarfile).
-
-- Reflection:
-
- - (getConstant for a array constant with constant values returns NULL/NFC/UKNOWN).
-
-- Session:
-
- - (PHP7: session-uploadprogress kills httpd).
- - (SID always return "name=ID", even if session cookie exist).
-
-- SimpleXML:
-
- - (SimpleXML isset/unset do not respect namespace).
- - (Null coalescing operator doesn't behave as expected with SimpleXMLElement).
-
-- SPL:
-
- - (Missing type check when unserializing SplArray). (CVE-2016-7417)
-
-- Standard:
-
- - (substr_compare NULL length interpreted as 0).
- - (getimagesize returning FALSE on valid jpg).
- - (get_browser() incorrectly parses entries with "+" sign).
-
-- Streams:
-
- - (stream_set_blocking doesn't work).
- - (ftps:// opendir wrapper data channel encryption fails with IIS FTP 7.5, 8.5).
- - (Negative ftruncate() on php://memory exhausts memory).
-
-- SQLite3:
-
-- Downgraded bundled SQLite to 3.8.10.2, see
-
-- Sysvshm:
-
- - (shm_attach null dereference).
-
-- Wddx:
-
- - (wddx_deserialize use-after-free). (CVE-2016-7413)
- - (Out-Of-Bounds Read in php_wddx_push_element). (CVE-2016-7418)
-
-- XML:
-
- - (SEGV on unknown address zif_xml_parse).
- - (_xml_startElementHandler() segmentation fault).
-
-- ZIP:
-
- - (impossible to compile php with zip support).
-
-
-
-
-
-Version 7.0.10
-
-- Core:
-
- - (Caught exception assignment to variables ignores references).
- - (Calling an earlier instance of an included anonymous class fatals).
- - (previous property undefined in Exception after deserialization).
- - (Cannot declare public method with signature incompatible with parent private method).
- - (microtime() leaks memory).
- - (Unable to set --enable-debug on building extensions by phpize on Windows).
- - Fixed bug causing ClosedGeneratorException being thrown into the calling code instead of the Generator yielding from.
- - (Support "nmake test" on building extensions by phpize).
- - (phpize (on Windows) ignores PHP_PREFIX).
- - Fixed potential segfault in object storage freeing in shutdown sequence.
- - (Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization). (CVE-2016-7124)
- - (PHP Session Data Injection Vulnerability). (CVE-2016-7125)
- - (getmxrr broken).
- - (memory allocator fails to realloc small block to large one). (CVE-2016-7133)
-
-- Bz2:
-
- - (integer overflow in bzdecompress caused heap corruption).
-
-- Calendar:
-
- - (cal_days_month() fails for final month of the French calendar).
- - (AddressSanitizer: global-buffer-overflow in zif_cal_from_jd).
-
-- COM:
-
- - (DOTNET/COM array parameters broke in PHP7).
-
-- CURL:
-
- - (curl_setopt segfault with empty CURLOPT_HTTPHEADER).
- - (CURLINFO_CERTINFO data parsing error).
- - (Heap overflow in curl_escape). (CVE-2016-7134)
-
-- DOM:
-
- - (DOM document dangling reference).
-
-- EXIF:
-
- - (Samsung picture thumb not read (zero size)).
- - (Memory Leakage In exif_process_IFD_in_TIFF). (CVE-2016-7128)
-
-- Filter:
-
- - (FILTER_FLAG_NO_RES_RANGE does not cover whole 127.0.0.0/8 range).
-
-- FPM:
-
- - (using --allow-to-run-as-root should ignore missing user).
-
-- GD:
-
- - (imagetypes function won't advertise WEBP support).
- - (imagearc() ignores thickness for full arcs).
- - (500 Server Error but page is fully rendered).
- - (broken transparency of imagearc for truecolor in blendingmode).
- - (Always false condition in ext/gd/libgd/gdkanji.c).
- - (suspicious if-else statements).
- - (select_colors write out-of-bounds). (CVE-2016-7126)
- - (imagegammacorrect allows arbitrary write access). (CVE-2016-7127)
- - (imagecropauto out-of-bounds access)
-
-- Intl:
-
- - (Segfault when instantiating class that extends IntlCalendar and adds a property).
- - Partially fixed (idn_to_ascii for UTS #46 incorrect for long domain names).
-
-- mbstring:
-
- - (mb_ereg_search raises a warning if a match zero-width).
- - (mb_ereg_search increments search position when a match zero-width).
- - (mb_ereg_search_setpos does not accept a string's last position).
- - (`mb_ereg` causes buffer overflow on regexp compile error).
-
-- Mcrypt:
-
- - (Heap Overflow due to integer overflows).
-
-- Opcache:
-
- - (Opcache restart with kill_all_lockers does not work).
-
-- PCRE:
-
- - (preg_match missing group names in matches).
-
-- PDO_pgsql:
-
- - (PDO statement fails to throw exception).
-
-- Reflection:
-
- - (ReflectionClass::export doesn't handle array constants).
-
-- SimpleXML:
-
- - (Using global var doesn't work while accessing SimpleXML element).
-
-- SNMP:
-
- - (php_snmp_parse_oid integer overflow in memory allocation).
-
-- SPL:
-
- - (GlobIterator throws LogicException).
- - (SplFileObject::getCsvControl does not return the escape character).
- - (AppendIterator segfault with closed generator).
-
-- SQLite3:
-
- - (Spurious warning when exception is thrown in user defined function).
- - (SQLite3::bindValue, SQLite3::bindParam crash).
- - (SQLite should allow opening with empty filename).
- - Updated to SQLite3 3.13.0.
-
-- Standard:
-
- - (array_walk + array_replace_recursive create references from nothing).
- - (base64_decode $strict fails to detect null byte).
- - (base64_decode skips a character after padding in strict mode).
- - (base64_decode $strict fails with whitespace between padding).
- - (CSV fields incorrectly split if escape char followed by UTF chars).
-
-- Streams:
-
- - (Problems with the ftps wrapper).
- - (opendir() does not work with ftps:// wrapper).
- - (opendir() with ftp:// attempts to open data stream for non-existent directories).
- - (ftps:// wrapper is vulnerable to protocol downgrade attack).
-
-- XMLRPC:
-
- - (xmlrpc_encode() unexpected output after referencing array elements).
-
-- Wddx:
-
- - (boolean always deserialized as "true").
- - (WDDX Packet Injection Vulnerability in wddx_serialize_value()).
- - (wddx_deserialize allows illegal memory access). (CVE-2016-7129)
- - (wddx_deserialize null dereference). (CVE-2016-7130)
- - (wddx_deserialize null dereference with invalid xml). (CVE-2016-7131)
- - (wddx_deserialize null dereference in php_wddx_pop_element). (CVE-2016-7132)
-
-- Zip:
-
- - (NULL Pointer dereference in zend_virtual_cwd).
-
-
-
-
-
-Version 7.0.9
-
-- Core:
-
- - (strange references after recursive function call and "switch" statement).
- - (Stack-based buffer overflow vulnerability in virtual_file_ex). (CVE-2016-6289)
- - (HTTP_PROXY is improperly trusted by some PHP libraries and applications). (CVE-2016-5385)
-
-- bz2:
-
- - (Inadequate error handling in bzread()). (CVE-2016-5399)
-
-- CLI:
-
- - (SCRIPT_FILENAME shows wrong path if the user specify router.php).
-
-- COM:
-
- - (variant_date_from_timestamp null dereference).
-
-- Curl:
-
- - (size_t overflow lead to heap corruption).
-
-- Date:
-
- - (DateTime::createFromFormat 'U' with pre 1970 dates fails parsing).
-
-- Exif:
-
- - (Out of bound read in exif_process_IFD_in_MAKERNOTE). (CVE-2016-6291)
- - (NULL Pointer Dereference in exif_process_user_comment). (CVE-2016-6292)
-
-- GD:
-
- - (Thick styled lines have scrambled patterns).
- - (XBM images require width to be multiple of 8).
- - (imagefilledpolygon doesn't draw horizontal line).
- - (gdImageTrueColorToPaletteBody allows arbitrary write/read access).
- - (imagegif/output out-of-bounds access).
- - (Integer overflow error within _gdContributionsAlloc()). (CVE-2016-6207)
- - (Ilegal write/read access caused by gdImageAALine overflow).
- - (imagecropauto out-of-bounds access).
-
-- Intl:
-
-
- - (locale_accept_from_http out-of-bounds access). (CVE-2016-6294)
-
-- Mbstring:
-
- - (mb_ereg_replace - mbc_to_code (oniguruma) - oob read access).
- - (Use-After-Free in MBString (search_re)).
-
-- mcrypt:
-
- - , bug (Incorrect casting from size_t to int lead to heap overflow in mdecrypt_generic).
-
-- PDO_pgsql:
-
- - (Segmentation fault when binding parameters on a query without placeholders).
-
-- PCRE:
-
- - (Memleak in jit_stack).
- - (mail fails with invalid argument).
-
-- Readline:
-
- - (readline_redisplay crashes php).
-
-- Standard:
-
- - (readfile() mangles files larger than 2G).
- - (Heap overflow through proc_open and $env parameter).
-
-- Session:
-
- - (ps_files_cleanup_dir Buffer overflow).
- - (Use After Free in unserialize() with Unexpected Session Deserialization).
-
-- SNMP:
-
- - (Use After Free Vulnerability in SNMP with GC and unserialize()). (CVE-2016-6295)
-
-- Streams:
-
- - (Stream socket with remote address leads to a segmentation fault).
-
-- XMLRPC:
-
- - (heap-buffer-overflow (write) simplestring_addn simplestring.c). (CVE-2016-6296)
-
-- Zip:
-
- - (Stack-based buffer overflow vulnerability in php_stream_zip_opener). (CVE-2016-6297)
-
-
-
-
-
-Version 7.0.8
-
-- Core:
-
- - (If host name cannot be resolved then PHP 7 crashes).
- - (segfault, past-the-end access).
- - (Integer Overflow in nl2br()).
- - (Integer Overflow in json_encode()/json_decode()/ json_utf8_to_utf16()).
- - (Integer Overflow in addcslashes/addslashes).
- - (Integer Overflow in Length of String-typed ZVAL).
-
-- Date:
-
- - (strtotime seems to use both sunday and monday as start of week).
-
-- FPM:
-
- - (fastcgi_finish_request and logging environment variables).
-
-- GD:
-
- - (pass2_no_dither out-of-bounds access).
- - (invalid dimensions can lead to crash).
- - (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (CVE-2016-5766)
- - (NULL Pointer Dereference at _gdScaleVert).
- - (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (CVE-2016-5767)
-
-- Intl:
-
- - (selectordinal doesn't work with named parameters).
-
-- mbstring:
-
- - (_php_mb_regex_ereg_replace_exec - double free). (CVE-2016-5768)
-
-- mcrypt:
-
- - (Heap Overflow due to integer overflows). (CVE-2016-5769)
-
-- OpenSSL:
-
- - (segfault after calling ERR_free_strings()).
-
-- PCRE:
-
- - (preg_replace uses int instead of size_t).
-
-- PDO_pgsql:
-
- - (Segfault (core dumped) if paramno beyond bound).
- - (Segmentation fault/invalid pointer in connection with pgsql_stmt_dtor).
-
-- Phar:
-
- - (invalid free in phar_extract_file()). (CVE-2016-4473)
-
-- Phpdbg:
-
- - (phpdbg fatal errors with coverage).
-
-- Postgres:
-
- - (pg_pconnect/pg_connect cause use-after-free).
- - (pg_lo_create arbitrary read).
-
-- Standard:
-
- - (range() with float step produces unexpected result).
- - (dns_get_record returns array containing elements of type 'unknown').
- - (Wrong reference when serialize/unserialize an object).
- - (ignore_user_abort(false) has no effect).
-
-- WDDX:
-
- - (Double Free Courruption in wddx_deserialize). (CVE-2016-5772)
-
-- XML:
-
- - (xml_parser_create/xml_parser_free leaks mem).
-
-- XMLRPC:
-
- - (use-after-free caused by get_zval_xmlrpc_type).
-
-- Zip:
-
- - (ZipArchive converts filenames to unrecoverable form).
- - (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5773)
-
-
-
-
-
-Version 7.0.7
-
-- Core:
-
- - (use-after-free - error_reporting).
- - Add compiler option to disable special case function calls.
- - (crash on complex code).
- - (implode() inserts garbage into resulting string when joins very big integer).
- - (PHP Hangs when using custom error handler and typehint).
- - (Function calls with values to a by-ref parameter don't always throw a notice).
- - (Memory leak in closure with parameter named $this).
- - (?? is not allowed on constant expressions).
- - (Imported Class Overrides Local Class Name).
-
-- Curl:
-
- - (Define CURLE_SSL_CACERT_BADFILE).
-
-- DBA:
-
- - (use-after-free caused by dba_open).
-
-- GD:
-
- - (imagescale out-of-bounds read). (CVE-2013-7456)
-
-- Intl:
-
- - (Add intl.use_exceptions to php.ini-*).
- - (get_icu_value_internal out-of-bounds read). (CVE-2016-5093)
-
-- JSON:
-
- - (Behavior \JsonSerializable different from json_encode).
-
-- Mbstring:
-
- - (Null Pointer Dereference - mb_ereg_replace).
-
-- OCI8:
-
- - (oci_fetch_all segfaults when selecting more than eight columns).
-
-- Opcache:
-
- - (Including a file with anonymous classes multiple times leads to fatal error).
-
-- OpenSSL:
-
- - (Null pointer dereference - openssl_csr_new).
-
-- PCNTL:
-
- - (pcntl_wait/pcntl_waitpid array internal structure overwrite).
-
-- POSIX:
-
- - (php_posix_group_to_array crashes if gr_passwd is NULL).
-
-- Postgres:
-
- - (pg_query_params(): NULL converts to empty string).
- - (pg_convert() doesn't accept ISO 8601 for datatype timestamp).
- - (mysqli_fetch_object changed behaviour). Patch to is reverted.
-
-- Reflection:
-
- - (ReflectionProperty#getValue() causes __isset call).
-
-- Session:
-
- - (Cyclic references causing session_start(): Failed to decode session object).
-
-- Sockets:
-
- - Added socket_export_stream() function for getting a stream compatible resource from a socket resource.
-
-- SPL:
-
- - (The reference in CallbackFilterIterator doesn't work as expected).
-
-- SQLite3:
-
- - (bindValue is not using the right data type).
-
-- Standard:
-
- - (Referencing socket resources breaks stream_select).
- - (array_column() against an array of objects discards all values matching null).
-
-
-
-
-
-Version 7.0.6
-
-- Core:
-
- - (_zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed).
- - (Crash on assert(new class{})).
- - (Reference is lost in "switch").
- - (Interfaces allow final and abstract functions).
- - (zend_objects_store_call_destructors operates on realloced memory, crashing).
- - (EG(error_zval) is not handled well).
- - (Multiple Heap Overflows in php_raw_url_encode/ php_url_encode).
- - (Null coalescing operator and ArrayAccess).
- - (Segmentation fault on ZTS with gethostbyname).
- - (Inheritance, traits and interfaces).
- - (Null coalescing operator and magic).
- - (Cannot access array keys while uksort()).
- - (ArrayAccess, isset() and the offsetExists method).
- - (__debugInfo with empty string for key gives error).
- - (ArrayObject and isset are not friends).
- - (Decorated/Nested Generator is Uncloseable in Finally).
-
-- BCmath:
-
- - (bcpowmod accepts negative scale and corrupts _one_ definition). (CVE-2016-4537, CVE-2016-4538)
-
-- Curl:
-
- - (CURLOPT_NOPROXY applied as long instead of string).
-
-- Date:
-
- - (DateInterval::format Segmentation fault).
-
-- EXIF:
-
- - (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
-
-- GD:
-
- - (libgd: signedness vulnerability). (CVE-2016-3074)
-
-- Intl:
-
- - (IntlDateFormatter looses locale if pattern is set via constructor).
- - (Missing constant: IntlChar::NO_NUMERIC_VALUE).
- - , (Inconsistencies in return values of IntlChar methods).
- - (Stackoverflow in datefmt_create).
- - (Locale::lookup incorrectly returns en or en_US if locale is empty).
- - (selectordinal doesn't work with named parameters).
- - (Out-of-bounds reads in zif_grapheme_stripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
-
-- ODBC:
-
- - (Script hangs after max_execution_time).
-
-- Opcache:
-
- - (null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER).
-
-- PDO:
-
- - (Own PDOStatement implementation ignore __call()).
- - (Quotes inside comments not properly handled).
-
-- PDO_DBlib:
-
- - (dblib_handle_quoter needs to allocate an extra byte).
- - Add DBLIB-specific attributes for controlling timeouts.
-
-- PDO_pgsql:
-
- - (pdo_pgsql inefficient when getColumnMeta() is used).
-
-- Postgres:
-
- - (pg_fetch_object binds parameters before call constructor).
- - (Function pg_insert does not insert when column type = inet).
-
-- SOAP:
-
- - (Nested foreach assign-by-reference creates broken variables).
-
-- SPL:
-
- - (Deserializing serialized SPLObjectStorage-Object can't access properties in PHP).
- - (Double-free in SplDoublyLinkedList::offsetSet).
- - (Cloned SplObjectStorage with overwritten getHash fails offsetExists()).
- - (SPL autoloader breaks class_exists()).
-
-- Standard:
-
- - (array_fill optimization breaks implementation).
- - (Returning the same var twice from __sleep() produces broken serialized data).
- - (Unserialize crushes on restore object reference).
- - (str_replace returns an incorrect resulting array after a foreach by reference).
- - (header_register_callback() and register_shutdown_function()).
- - (Null pointer deref (segfault) in stream_context_get_default).
- - (Unserialize accepts wrongly data).
- - (Wrong arrays behaviour).
- - (substr_replace bug, string length).
- - (php_crypt() crashes if crypt_r() does not exist or _REENTRANT is not defined).
-
-- XML:
-
- - (xml_parse_into_struct segmentation fault). (CVE-2016-4539)
-
-- Zip:
-
- - (integer overflow in ZipArchive::getFrom*). (CVE-2016-3078)
-
-
-
-
-
-Version 7.0.5
-
-- Core:
-
- - Huge pages disabled by default.
- - Added ability to enable huge pages in Zend Memory Manager through the environment variable USE_ZEND_ALLOC_HUGE_PAGES=1.
- - (Call-by-reference widens scope to uninvolved functions when used in switch).
- - (Possible crash in zend_bin_strtod, zend_oct_strtod, zend_hex_strtod).
- - (Global variables are reserved before execution).
- - (Out-of-bounds access in php_url_decode in context php_stream_url_wrap_rfc2397).
- - (Strings used in pass-as-reference cannot be used to invoke C::$callable()).
- - (Segmentation fault on ZTS with date function (setlocale)).
- - (Integer overflow in zend_mm_alloc_heap()).
- - (Leaked 1 hashtable iterators).
- - (ISO C does not allow extra ‘;’ outside of a function).
- - (yield from does not count EOLs).
- - (ReflectionMethod::getDocComment returns the wrong comment).
- - (php_strip_whitespace() fails on some numerical values).
- - (`php -R` (PHP_MODE_PROCESS_STDIN) is broken).
-
-- CLI Server:
-
- - (Support MKCALENDAR request method).
-
-- Curl:
-
- - (Support constant CURLM_ADDED_ALREADY).
-
-- Date:
-
- - (DatePeriod::getEndDate segfault).
-
-- Fileinfo:
-
- - (Buffer over-write in finfo_open with malformed magic file). (CVE-2015-8865)
-
-- libxml:
-
- - (Access Violation crashes php-cgi.exe).
-
-- mbstring:
-
- - (AddressSanitizer: negative-size-param (-1) in mbfl_strcut). (CVE-2016-4073)
-
-- ODBC:
-
- - , (Executing prepared statements is succesfull only for the first two statements).
-
-- PCRE:
-
- - (segmentation fault in pcre running twig tests).
-
-- PDO_DBlib:
-
- - (PDO::MSSQL forces format of datetime fields).
-
-- Phar:
-
- - (Crash in php7.dll with bad phar filename).
- - (PharData fails to open specific file).
- - (Invalid memory write in phar on filename with \0 in name). (CVE-2016-4072)
-
-- phpdbg:
-
- - Fixed crash when advancing (except step) inside an internal function.
-
-- Session:
-
- - (Null pointer dereference in zend_hash_str_find_bucket).
-
-- SNMP:
-
- - (php_snmp_error() Format String Vulnerability). (CVE-2016-4071)
-
-- SPL:
-
- - (private properties lost when unserializing ArrayObject).
-
-- Standard:
-
- - (array_column behaves incorrectly after foreach by reference).
- - (Integer Overflow in php_raw_url_encode). (CVE-2016-4070)
-
-- Zip:
-
- - Update bundled libzip to 1.1.2.
-
-
-
-
-
-Version 7.0.4
-
-- Core:
-
- - Fixed bug (Low probability segfault in zend_arena).
- - (Typehinted Generator with return in try/finally crashes).
- - (forward_static_call crash).
- - (Segfault using built-in webserver with intl using symfony).
- - (An integer overflow bug in php_implode()).
- - (An integer overflow bug in php_str_to_str_ex()).
- - (Crash because of VM stack corruption on Magento2).
- - (Return typehint on internal func causes Fatal error when it throws exception).
- - (Variable references on array elements don't work when using count).
- - (finally block not executed after yield from).
- - (Multiple Heap Overflow due to integer overflows in xml/filter_url/addcslashes). (CVE-2016-4344, CVE-2016-4345, CVE-2016-4346)
-
-- CLI server:
-
- - (Built-in HTTP server, we can download file in web by bug).
-
-- CURL:
-
- - (Copied handle with new option CURLOPT_HTTPHEADER crashes while curl_multi_exec).
- - Fixed memory leak in curl_getinfo().
-
-- Date:
-
- - (Calls to date_modify will mutate timelib_rel_time, causing date_date_set issues).
-
-- Fileinfo:
-
- - (finfo throws notice for specific python file).
-
-- FPM:
-
- - (FPM not working with Apache httpd 2.4 balancer/fcgi setup).
- - (php-fpm dumped core).
-
-- Opcache:
-
- - (Possible use-after-free of ZCG(cwd) in Zend Opcache).
-
-- PCRE:
-
- - (PCRE segfault from Opcache).
-
-- phpdbg:
-
- - Fixed inherited functions from unspecified files being included in phpdbg_get_executable().
-
-- SOAP:
-
- - (Type Confusion Vulnerability - SOAP / make_http_soap_request()). (CVE-2016-3185)
-
-- Standard:
-
- - (compact() maintains references in php7).
- - (strip_tags improper php code parsing).
-
-- XMLRPC:
-
- - (xmlrpc_encode_request ignores encoding option).
-
-- Zip:
-
- - (NULL pointer dereference in Zip::ExtractTo).
-
-
-
-
-
-Version 7.0.3
-
-- Core:
-
- - Added support for new HTTP 451 code.
- - (exec functions ignore length but look for NULL termination).
- - (No check to duplicate zend_extension).
- - (round() segfault on 64-bit builds).
- - (Null pointer deref (segfault) in get_defined_vars via ob_start).
- - (Wrong interface is enforced).
- - (A wrong ext directory setup in php.ini leads to crash).
- - (Bad method called on cloning an object having a trait).
- - (Memory leak with consecutive yield from).
- - (Segfault in zend_fetch_string_offset).
- - (var_export(INF) prints INF.0).
- - (Output of stream_get_meta_data can be falsified by its input).
- - (Wrong is_ref on properties as exposed via get_object_vars()).
- - (Integer overflow in iptcembed()).
-
-- Apache2handler:
-
- - Fix >2G Content-Length headers in apache2handler.
-
-- CURL:
-
- - (Can't compile php_curl statically).
- - (curl_setopt() fails to set CURLOPT_POSTFIELDS with reference to CURLFile).
-
-- GD:
-
- - Improved fix for bug .
-
-- Interbase:
-
- - (Crash when optional resource is omitted).
-
-- LDAP:
-
- - (ldap_mod_replace/ldap_mod_add store value as string "Array").
-
-- mbstring:
-
- - (mb_send_mail segmentation fault).
-
-- OpenSSL:
-
- - (openssl_seal() uninitialized memory usage).
-
-- PCRE:
-
- - Upgraded bundled PCRE library to 8.38. (CVE-2015-8383, CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)
-
-- Phar:
-
- - (Heap corruption in tar/zip/phar parser). (CVE-2016-4342)
- - (Uninitialized pointer in phar_make_dirstream()). (CVE-2016-4343)
- - (NULL Pointer Dereference in phar_tar_setupmetadata()).
- - (Stack overflow when decompressing tar archives). (CVE-2016-2554)
-
-- SOAP:
-
- - (crash with bad soap request).
-
-- SPL:
-
- - (segfault if clean spl_autoload_funcs while autoloading).
- - (Autoload function registered by another not activated immediately).
- - (Use-after-free vulnerability in SPL(ArrayObject, unserialize)).
- - (Use-after-free vulnerability in SPL(SplObjectStorage, unserialize)).
-
-- Standard:
-
- - (Error message contains hexadecimal instead of decimal number).
- - (file_put_contents() returns unexpected value when filesystem runs full).
- - (file_get_contents() ignores "header" context option if it's a reference).
- - (Null pointer deref (segfault) in compact via ob_start).
- - (substr_replace converts integers in original $search array to strings).
- - (str_replace converts integers in original $search array to strings).
- - , (range() segfaults).
-
-- WDDX:
-
- - (Type Confusion in WDDX Packet Deserialization).
-
-
-
-
-
-Version 7.0.2
-
-- Core:
-
- - (-DGC_BENCH=1 doesn't work on PHP7).
- - (Segmentation Fault: cleanup_unfinished_calls).
- - (ZEND_MOD_CONFLICTS("xdebug") doesn't work).
- - (Segmentation fault with return type hinting).
- - Fixed bug memleak in header_register_callback.
- - (Local object in class method stays in memory for each call).
- - (configure fails utf8_to_mutf7 test).
- - (Extension tests fail on dynamic ext dependency).
- - (No check to duplicate zend_extension).
- - (Invalid numeric literal parse error within highlight_string() function).
- - (Incorrect HT iterator invalidation causes iterator reuse).
- - (Negating zero does not produce negative zero).
- - (var_export() exports float as integer).
- - (Unary add on negative zero produces positive zero).
-
-- CURL:
-
- - (Sementation fault when using cURL with ZTS).
-
-- DBA:
-
- - Fixed key leak with invalid resource.
-
-- Filter:
-
- - (filter_input(INPUT_ENV, ..) does not work).
-
-- FTP:
-
- - (Option to ignore the returned FTP PASV address).
-
-- FPM:
-
- - (fpm_log.c memory leak and buffer overflow). (CVE-2016-5114)
-
-- GD:
-
- - (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds). (CVE-2016-1903)
-
-- Mbstring:
-
- - (mb_send_mail: Program terminated with signal SIGSEGV, Segmentation fault).
-
-- Opcache:
-
- - (Define in auto_prepend_file is overwrite).
-
-- PCRE:
-
- - (preg_replace with arrays creates [0] in replace array if not already set).
-
-- Readline:
-
- - (readline_completion_function corrupts static array on second TAB).
-
-- Session:
-
- - (Session GC may not remove obsolete session data).
-
-- SPL:
-
- - (ReflectionMethod for ArrayObject constructor returns wrong number of parameters).
- - (Performance Degradation in ArrayIterator with large arrays).
-
-- Standard:
-
- - (Heap BufferOver Flow in escapeshell functions). (CVE-2016-1904)
-
-- WDDX:
-
- - (Use After Free Vulnerability in WDDX Packet Deserialization).
- - (Session WDDX Packet Deserialization Type Confusion Vulnerability).
-
-- XMLRPC:
-
- - (Type Confusion Vulnerability in PHP_to_XMLRPC_worker).
-
-
-
-
-
-Version 7.0.1
-
-- Core:
-
- - (Format String Vulnerability in Class Name Error Message). (CVE-2015-8617)
- - (Compile fails on system with 160 CPUs).
- - (symbol referencing errors on Sparc/Solaris).
- - (When using parentClass:: instead of parent::, static context changed).
- - (Segfault when combining error handler with output buffering).
- - (Weird error handling for __toString when Error is thrown).
- - (Invalid opcode while using ::class as trait method paramater default value).
- - (try{ } finally{} can create infinite chains of exceptions).
- - (Two errors messages are in conflict).
- - (yield from incorrectly marks valid generator as finished).
- - (buildconf failure in extensions).
- - (SAPI build problem on AIX: Undefined symbol: php_register_internal_extensions).
- - Fixed \int (or generally every scalar type name with leading backslash) to not be accepted as type name.
- - Fixed exception not being thrown immediately into a generator yielding from an array.
- - (static::class within Closure::call() causes segfault).
- - (Incorrect exception handler with yield from).
- - Fixed double free in error condition of format printer.
-
-- CLI server:
-
- - (Segfault in php_cli_server_dispatch_router()).
-
-- Intl:
-
- - (Use after free in Collator::sortWithSortKeys). (CVE-2015-8616)
-
-- Mysqlnd:
-
- - (LOAD DATA LOCAL INFILE / open_basedir restriction).
- - (MySQLi does not provide way to disable peer certificate validation) by introducing MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT connection flag.
-
-- OCI8:
-
- - Fixed LOB implementation size_t/zend_long mismatch reported by gcov.
-
-- Opcache:
-
- - (Unable to use PHP 7.0 x64 side-by-side with PHP 5.6 x32 on the same server).
- - (zend_file_cache.c:710: error: array type has incomplete element type).
- - (Segmentation fault with opcache.huge_code_pages=1).
-
-- PDO_Firebird:
-
- - (Integer returned as a 64bit integer on X64_86).
-
-- Phpdbg:
-
- - Fixed stderr being written to stdout.
-
-- Reflection:
-
- - (ReflectionProperty::setValue() behavior changed).
- - (setStaticPropertyValue behaviors inconsistently with 5.6).
-
-- Soap:
-
- - (Array key references break argument processing).
-
-- SPL:
-
- - (Undefined index with ArrayIterator).
-
-- SQLite3:
-
- - (SQLite3Stmt::execute() releases bound parameter instead of internal buffer).
-
-- Standard:
-
- - (php_random_bytes: called object is not a function).
- - (ReflectionFunction for array_unique returns wrong number of parameters).
-
-- Streams/Socket:
-
- - Add IPV6_V6ONLY constant / make it usable in stream contexts.
-
-
-
-
-
-Version 7.0.0
-
-- Core:
-
- - (INI parser segfault with INI_SCANNER_TYPED).
- - (zend_throw_or_error() format string vulnerability).
- - (Null ptr dereference instantiating class with invalid array property).
- - , (null ptr deref and segfault with crafted calable).
- - (Segmentation fault while running PHPUnit tests on phpBB 3.2-dev).
- - (Segmentation faults whilst running Drupal 8 test suite).
- - (Persistent Stream Segmentation Fault).
- - (Several functions do not check return code of php_stream_copy_to_mem()).
- - (Incorect logic to increment_function for proxy objects).
- - (Regression in zend_fetch_debug_backtrace() can cause segfaults).
- - (Regression on private static properties access).
- - (Segfault in ini_lex () at Zend/zend_ini_scanner.l).
- - (Exception handler does not work as expected).
- - (Stack buffer overflow in zend_language_parser()).
- - (null ptr deref and segfault (zend_get_class_fetch_type)).
- - (Infinite loop due to exception during identical comparison).
- - (Closure::call/bind() crash with ReflectionFunction-> getClosure()).
- - (Duplicate array key via undefined index error handler).
- - (Segfault when binding $this of internal instance method to null).
- - (Segfault for getClosure() internal method rebind with invalid $this).
- - Added zend_internal_function.reserved[] fields.
- - (Memleak on return type verifying failed).
- - (fun_get_arg() on unsetted vars return UNKNOW).
- - (Redundant information printed in case of uncaught engine exception).
- - (unsetting function variables corrupts backtrace).
- - (assert() with instanceof adds apostrophes around class name).
- - (Memory leak in auto_global_copy_ctor() in ZTS build).
- - (Memory leak in php_ini.c).
- - (**= does no longer work).
- - (SIGSEGV, Segmentation fault zend_ast_destroy_ex).
- - (Wrong behavior while returning reference on object).
- - (Syntactical inconsistency with new group use syntax).
- - (Magic getter breaks reference to array property).
- - (Notice: unserialize(): Unexpected end of serialized data).
- - (From field incorrectly parsed from headers).
- - (Bundled libtool.m4 doesn't handle FreeBSD 10 when building extensions).
- - Fixed bug causing exception traces with anon classes to be truncated.
- - (Segmentation fault when using Closure::call and yield).
- - (Memleak while assigning object offsetGet result).
- - (Apache crash related to ZEND_SEND_REF).
- - (Accessing array crashes PHP 7.0beta3).
- - (Segfault if do_resize fails to allocated memory).
- - (segfault at _efree () in zend_alloc.c:1389).
- - (Segfault when doing unset($var());).
- - (Incrementing value returned by magic getter).
- - (Segfault when __invoke is static).
- - (Finally is broken with opcache).
- - (ZVAL_COPY_VALUE_EX broken for 32bit Solaris Sparc).
- - (SAPI may truncate POST data).
- - (Checking liveness does not work as expected).
- - , (Skipped assertions affect Generator returns).
- - (Creating a huge array doesn't result in exhausted, but segfault).
- - Fixed "finally" issues.
- - (Real memory usage doesn't decrease).
- - (__CLASS__ is lost in closures).
- - (Segfault in zend_find_alias_name).
- - (null ptr deref / seg fault in ZEND_HANDLE_EXCEPTION).
- - (Unexpected return type error).
- - (Inheritance by anonymous class).
- - (SIGSEGV array.c:953).
- - (__COMPILER_HALT_OFFSET__ under namespace is not defined).
- - (sometimes empty $_SERVER['QUERY_STRING']).
- - ($this refcount issue).
- - ('asm' operand has impossible constraints).
- - (null pointer deref (segfault) in zend_eval_const_expr).
- - (Segfault in ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER).
- - (Remotely triggerable stack exhaustion via recursive method calls).
- - (Different arrays compare indentical due to integer key truncation).
- - (unserialize() could lead to unexpected methods execution / NULL pointer deref).
- - (segfault at ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HANDLER ()).
- - (Build failure on 32-bit Mac OS X 10.6.8: recursive inlining).
- - (Exception lost with nested finally block).
- - (Changing the property of a cloned object affects the original).
- - (Use after free with assign by ref to overloaded objects).
- - (cli - function with default arg = STDOUT crash output).
- - (Segfault in gc_collect_cycles()).
- - Improved zend_string API.
- - (Segfault when trying to combine [] and assign-op on ArrayAccess object).
- - (Different ways of handling div/mod/intdiv).
- - (Too long timeout on pipes).
- - (uninitialised value in strtr with array).
- - (Invalid read of size 1 in zend_compile_short_circuiting).
- - (Broken output of apache_request_headers).
- - (iconv_substr() doesn't work with UTF-16BE).
- - (PHP 7.0.0alpha1 segmentation fault when exactly 33 extensions are loaded).
- - (null ptr deref and seg fault in zend_resolve_class_name).
- - (Reflection on Closure::__invoke borks type hint class name).
- - (Serialization of anonymous classes should be prevented).
- - (parse_ini_file() and parse_ini_string() segmentation fault).
- - (phpinfo() reports Professional Editions of Windows 7/8/8.1/10 as "Business").
- - (phpinfo() does not report many Windows SKUs).
- - (Null coalesce operator doesn't work for string offsets).
- - (Unexpected array comparison result).
- - (Different arrays compare indentical due to integer key truncation).
- - (Strict comparison between integer and empty string keys crashes).
- - (Default parameter value with wrong type segfaults).
- - (Fatal error: Nesting level too deep - recursive dependency ? with ===).
- - (Item added to array not being removed by array_pop/shift ).
- - (Add support for $callable() sytnax with 'Class::method').
- - (Double free on zend_list_dtor).
- - (Segfault on magic method __call of private method in superclass).
- - Improved __call() and __callStatic() magic method handling. Now they are called in a stackless way using ZEND_CALL_TRAMPOLINE opcode, without additional stack frame.
- - Optimized strings concatenation.
- - Fixed weird operators behavior. Division by zero now emits warning and returns +/-INF, modulo by zero and intdid() throws an exception, shifts by negative offset throw exceptions. Compile-time evaluation of division by zero is disabled.
- - (Hash table collision leads to inaccessible array keys).
- - (Invalid read of size 8 in zend_std_read_property).
- - (segfault in Zend/zend_hash.c in function _zend_hash_del_el).
- - (Closure executed via static autoload incorrectly marked as static).
- - (Cannot access static::class in lambda, writen outside of a class).
- - (call a private function in closure failed).
- - Added PHP_INT_MIN constant.
- - Added Closure::call() method.
- - (Segfault when calling phpversion('spl')).
- - Implemented the RFC `Catchable "Call to a member function bar() on a non-object"`.
- - Added options parameter for unserialize allowing to specify acceptable classes (https://wiki.php.net/rfc/secure_unserialize).
- - (Garbage collector can free zvals that are still referenced).
- - Removed ZEND_ACC_FINAL_CLASS, promoting ZEND_ACC_FINAL as final class modifier.
- - is_long() & is_integer() is now an alias of is_int().
- - (phpinfo: PHP Variables with $ and single quotes).
- - Added ?? operator.
- - Added <=> operator.
- - Added \u{xxxxx} Unicode Codepoint Escape Syntax.
- - Fixed oversight where define() did not support arrays yet const syntax did.
- - Use "integer" and "float" instead of "long" and "double" in ZPP, type hint and conversion error messages.
- - (E_RECOVERABLE_ERROR when output buffering in output buffering handler).
- - Removed scoped calls of non-static methods from an incompatible $this context.
- - Removed support for #-style comments in ini files.
- - Removed support for assigning the result of new by reference.
- - Invalid octal literals in source code now produce compile errors, fixes PHPSadness #31.
- - Removed dl() function on fpm-fcgi.
- - Removed support for hexadecimal numeric strings.
- - Removed obsolete extensions and SAPIs. See the full list in UPGRADING.
- - Added NULL byte protection to exec, system and passthru.
- - Added error_clear_last() function.
- - (Number 2.2250738585072012e-308 converted incorrectly).
- - Improved zend_qsort(using hybrid sorting algo) for better performance, and also renamed zend_qsort to zend_sort.
- - Added stable sorting algo zend_insert_sort.
- - Improved zend_memnchr(using sunday algo) for better performance.
- - Implemented the RFC `Scalar Type Decalarations v0.5`.
- - Implemented the RFC `Group Use Declarations`.
- - Implemented the RFC `Continue Output Buffering`.
- - Implemented the RFC `Constructor behaviour of internal classes`.
- - Implemented the RFC `Fix "foreach" behavior`.
- - Implemented the RFC `Generator Delegation`.
- - Implemented the RFC `Anonymous Class Support`.
- - Implemented the RFC `Context Sensitive Lexer`.
- - (Off-by-one buffer overflow in php_sys_readlink).
-
-- CLI server:
-
- - (404 on urls with '+').
- - (Sets HTTP_CONTENT_TYPE but not CONTENT_TYPE).
- - (CLI server directory traversal).
- - (php -S changes MKCALENDAR request method to MKCOL).
- - (304 responses return Content-Type header).
- - Refactor MIME type handling to use a hash table instead of linear search.
- - Update the MIME type list from the one shipped by Apache HTTPD.
- - Added support for SEARCH WebDav method.
-
-- COM:
-
- - (Casting object to bool returns false).
-
-- Curl:
-
- - (Segmentation Fault with multiple "curl_copy_handle").
- - (curl_setopt_array() type confusion).
- - (curl_getinfo() returns corrupted values).
- - (Segmentation fault in curl_getinfo).
- - (Segfault in curl_multi_exec).
- - Removed support for unsafe file uploads.
-
-- Date:
-
- - (strtotime does not emit warning when 2nd parameter is object or string).
- - (DateInterval::__construct.interval_spec is not supposed to be optional).
- - (new DateTimeZone($foo) is ignoring text after null byte).
- - Fixed day_of_week function as it could sometimes return negative values internally.
- - Removed $is_dst parameter from mktime() and gmmktime().
- - Removed date.timezone warning (https://wiki.php.net/rfc/date.timezone_warning_removal).
- - Added "v" DateTime format modifier to get the 3-digit version of fraction of seconds.
- - (Added DateTime::RFC3339_EXTENDED to output in RFC3339 Extended format which includes fraction of seconds).
-
-- DBA:
-
- - (dba_delete returns true on missing item (inifile)).
- - (useless comparisons).
-
-- DOM:
-
- - ("Couldn't fetch" error in DOMDocument::registerNodeClass()).
- - (Assigning to DOMNode::textContent does additional entity encoding).
- - (Segmenation fault (access violation) when iterating over DOMNodeList).
- - Made DOMNode::textContent writeable.
-
-- EXIF:
-
- - (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).
-
-- Fileinfo:
-
- - (libmagic: don't assume char is signed).
-
-- Filter:
-
- - New FILTER_VALIDATE_DOMAIN and better RFC conformance for FILTER_VALIDATE_URL.
- - (Wrong return value from FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE).
-
-- FPM:
-
- - ("php-fpm -i" crashes).
- - (HTTP Authorization Header is sometimes passed to newer reqeusts).
- - (Unknown admin values segfault pools).
- - (Cannot specify config lines longer than 1024 bytes).
- - (Split main fpm config).
-
-- FTP:
-
- - (FTPS support on Windows).
-
-- GD:
-
- - (imagerectangle problem with point ordering).
- - (Stack overflow with imagefilltoborder). (CVE-2015-8874)
- - (imagecreatefromwebm() shifts colors).
- - (imagewebp() doesn't pad to even length).
- - (imagerotate by -90 degrees truncates image by 1px).
- - (imagescale(..., IMG_BICUBIC) leaks memory).
- - (imagescale segfault with palette based image).
- - (Zero-height rectangle has whiskers).
- - (imagecrop() add a black line when cropping).
- - (copy 'n paste error).
- - (PHP segfaults in imagexbm).
- - (gd_info() doesn't report WebP support).
- - Replace libvpx with libwebp for bundled libgd.
- - (imagegammacorrect function loses alpha channel).
- - Made fontFetch's path parser thread-safe.
- - Removed T1Lib support.
-
-- GMP:
-
- - (Use after free vulnerability in unserialize() with GMP).
-
-- hash:
-
- - (HAVAL gives wrong hashes in specific cases).
-
-- IMAP:
-
- - (Building with static imap fails).
- - (curl multi leaking memory).
-
-- Intl:
-
- - (IntlChar::foldCase() incorrect arguments and missing constants).
- - (IntlChar::forDigit second parameter should be optional).
- - Removed deprecated aliases datefmt_set_timezone_id() and IntlDateFormatter::setTimeZoneID().
-
-- JSON:
-
- - (json_decode produces invalid byte-sequences).
- - (json_decode() Fatal error: Cannot access property started with '\0').
- - Replace non-free JSON parser with a parser from Jsond extension, fixes (JSON extension includes a problematic license statement).
- - (json_decode() decodes empty string without error).
-
-- LDAP:
-
- - (Implement LDAP_OPT_DIAGNOSTIC_MESSAGE).
-
-- LiteSpeed:
-
- - Updated LiteSpeed SAPI code from V5.5 to V6.6.
-
-- libxml:
-
- - Fixed handling of big lines in error messages with libxml >= 2.9.0.
-
-- Mcrypt:
-
- - (mcrypt_encrypt() won't return data when no IV was specified under RC4).
- - (mcrypt fd caching not working).
- - Fixed possible read after end of buffer and use after free.
- - Removed mcrypt_generic_end() alias.
- - Removed mcrypt_ecb(), mcrypt_cbc(), mcrypt_cfb(), mcrypt_ofb().
-
-- Mysqli:
-
- - (constructor of mysqli has wrong name).
-
-- Mysqlnd:
-
- - (SQL Result Sets With NULL Can Cause Fatal Memory Errors).
- - (mysqli_real_query():Unknown type 245 sent by the server).
- - (mysqlnd doesn't activate TCP keep-alive when connecting to a server).
- - segfault in mysqlnd_connect.
- - (mysqli_stmt::fetch doesn't assign null values to bound variables).
-
-- OCI8:
-
- - Fixed memory leak with LOBs.
- - (OCI int overflow).
- - Corrected oci8 hash destructors to prevent segfaults, and a few other fixes.
-
-- ODBC:
-
- - (PHP segfaults when accessing nvarchar(max) defined columns. (CVE-2015-8879)
-
-- Opcache:
-
- - (require() statement broken after opcache_reset() or a few hours of use).
- - (Segmentation fault on MacOSX with opcache.file_cache_only=1).
- - (Undefined Symbols from opcache.so on Mac OS X 10.10).
- - Fixed compatibility with Windows 10 (see also bug ).
- - Attmpt to fix "Unable to reattach to base address" problem.
- - (Warning Internal error: wrong size calculation).
- - (Empty while and do-while segmentation fault with opcode on CLI enabled).
- - (Segfault when a function uses both an explicit return type and an explicit cast).
- - (Build fails when building for i386).
- - (Crash with opcache using opcache.file_cache_only=1).
- - Removed opcache.load_comments configuration directive. Now doc comments loading costs nothing and always enabled.
- - (Wrong size calculation for function table).
- - (segfault with eval and opcache fast shutdown).
- - Added experimental (disabled by default) file based opcode cache.
- - Fixed bug with try blocks being removed when extended_info opcode generation is turned on.
- - (strlen incorrect : mbstring + func_overload=2 +UTF-8 + Opcache).
-
-- OpenSSL:
-
- - Require at least OpenSSL version 0.9.8.
- - (Lookup for openssl.cnf causes a message box).
- - (openssl extension does not get the DH parameters from DH key resource).
- - (Missing ARG_INFO for openssl_seal()).
- - (openssl_seal fails with AES).
- - (Add IV parameter for openssl_seal and openssl_open).
- - (openssl_random_pseudo_bytes() is not cryptographically secure). (CVE-2015-8867)
- - (OpenSSL error "key values mismatch" after openssl_pkcs12_read with extra cert).
- - Added "alpn_protocols" SSL context option allowing encrypted client/server streams to negotiate alternative protocols using the ALPN TLS extension when built against OpenSSL 1.0.2 or newer. Negotiated protocol information is accessible through stream_get_meta_data() output.
- - Removed "CN_match" and "SNI_server_name" SSL context options. Use automatic detection or the "peer_name" option instead.
-
-- Pcntl:
-
- - (Can't compile on NetBSD because of missing WCONTINUED and WIFCONTINUED).
- - (pcntl_signal doesn't decrease ref-count of old handler when setting SIG_DFL).
- - (Added wifcontinued and wcontinued).
- - Added rusage support to pcntl_wait() and pcntl_waitpid().
-
-- PCRE:
-
- - (Incorrect bump-along behavior with \K and empty string match).
- - (Multiple vulnerabilities related to PCRE functions).
- - (Incorrect bump-along behavior with \K and empty string match).
- - (preg_replace: * qualifier on unicode replace garbles the string).
- - (Segfault in preg_replace_callback).
- - Removed support for the /e (PREG_REPLACE_EVAL) modifier.
-
-- PDO:
-
- - (Segmentation fault in pdo_parse_params() during Drupal 8 test suite).
- - (PDO constructor changes unrelated variables).
- - (Segfault in pdo_mysql).
- - (persistent sqlite connection + custom function segfaults).
- - (./configure fails with "Cannot find php_pdo_driver.h").
-
-- PDO_DBlib:
-
- - (Segmentation fault on nextRowset).
-
-- PDO_mysql:
-
- - (Add new PDO mysql connection attr to control multi statements option).
-
-- PDO_OCI:
-
- - (PDO::ATTR_PREFETCH is ignored).
-
-- PDO_pgsql:
-
- - (PDOStatement::execute() leaks memory with DML Statements when closeCuror() is u).
- - Removed PGSQL_ATTR_DISABLE_NATIVE_PREPARED_STATEMENT attribute in favor of ATTR_EMULATE_PREPARES).
-
-- Phar:
-
- - (Null pointer dereference in phar_get_fp_offset()).
- - (Uninitialized pointer in phar_make_dirstream when zip entry filename is "/").
- - Improved fix for bug .
- - (Files extracted from archive may be placed outside of destination directory).
-
-- Phpdbg:
-
- - (incorrect exit code in -rr mode with Exceptions).
- - (phpdbg must respect set_exception_handler).
- - (Run and quit mode (-qrr) should not fallback to interactive mode).
- - (Help overview (-h) does not rpint anything under Windows).
- - (PHP won't compile on 10.4 and 10.5 because of missing constants).
- - (FASYNC not defined, needs sys/file.h include).
- - (Segfault when displaying memory leaks).
-
-- Reflection:
-
- - (Wrong docblock assignment).
- - (ReflectionFunction::getClosure() leaks memory when used for internal functions).
- - Fixed bug causing bogus traces for ReflectionGenerator::getTrace().
- - Fixed inheritance chain of Reflector interface.
- - Added ReflectionGenerator class.
- - Added reflection support for return types and type declarations.
-
-- Session:
-
- - (Segmentation fault when regenerating session id with strict mode).
- - (Session read causes "String is not zero-terminated" error).
- - (Reference to $_SESSION is lost after a call to session_regenerate_id()).
- - (Data integrity issues accessing superglobals by reference).
- - (Regression in session_regenerate_id()).
- - (mod_files.sh is a bash-script).
-
-- SOAP:
-
- - (Segfault in soap / type_to_string).
- - (SoapClient systematic out of memory error).
- - (Segmentation fault if wsdl has no targetNamespace attribute).
- - (Segmentation fault inside soap client).
- - (SOAP Client generates Segfault).
- - (SOAP serialize_function_call() type confusion / RCE).
- - (SoapClient info leak / null pointer dereference via multiple type confusions).
- - (Segmentation fault after more than 100 SoapClient calls).
- - (make_http_soap_request calls zend_hash_get_current_key_ex(,,,NULL).
- - (Segmentation fault on SoapClient::__getTypes).
-
-- SPL:
-
- - (ArrayObject unserialize does not restore protected fields).
- - (SplFixedArray throws exception when using ref variable as index).
- - (PCRE JIT and pattern reuse segfault).
- - (Incorrect ArrayObject serialization if unset is called in serialize()).
- - (Cloning SplPriorityQueue leads to memory leaks).
- - (Incorrect constructor reflection for ArrayObject).
- - (Dangling pointer in the unserialization of ArrayObject items).
- - (Use After Free Vulnerability in unserialize() with SPLArrayObject).
- - (Use After Free Vulnerability in unserialize() with SplObjectStorage).
- - (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList).
- - (MutlitpleIterator array-keys incompatible change in PHP 7).
- - (Use-after-free vulnerability in spl_recursive_it_move_forward_ex()).
- - (ArrayObject with ARRAY_AS_PROPS broken).
- - Changed ArrayIterator implementation using zend_hash_iterator_... API. Allowed modification of iterated ArrayObject using the same behavior as proposed in `Fix "foreach" behavior`. Removed "Array was modified outside object and internal position is no longer valid" hack.
- - (SplPriorityQueue/SplHeap doesn't expose extractFlags nor curruption state).
- - (RecursiveDirectoryIterator::CURRENT_AS_PATHNAME breaks the RecursiveIterator).
-
-- SQLite3:
-
- - (Memory leak in sqlite3_do_callback).
- - (Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk()).
- - (segfault when manually constructing SQLite3Result).
- - (SQLite3Result::fetchArray declares wrong required_num_args).
-
-- Standard:
-
- - Fixed count on symbol tables.
- - (Unserialize shows UNKNOWN in result).
- - (extract() breaks variable references).
- - (array_merge_recursive corrupts memory of unset items).
- - (strtr() causes invalid writes and a crashes).
- - (array_keys() doesn't respect references when $strict is true).
- - Implemented the RFC `Random Functions Throwing Exceptions in PHP 7`.
- - (pack('x') produces an error).
- - (changing configuration with ignore_user_abort(true) isn't working).
- - (Segmentation fault with setrawcookie).
- - (setcookie() conditional for empty values not met).
- - (Use-after-free vulnerability in unserialize() with SplObjectStorage).
- - (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList).
- - (extract() turns array elements to references).
- - (php 7 ZEND_HASH_IF_FULL_DO_RESIZE use after free).
- - (Assert breaking access on objects).
- - (str_ireplace/php_string_tolower - Arbitrary Code Execution).
- - (Allow "dirname" to go up various times).
- - (scandir duplicates file name at every 65535th file).
- - (Repeated iptcembed() adds superfluous FF bytes).
- - (exec does not strip all whitespace).
- - (get_browser fails with user agent of null).
- - (Unable to parse "all" urls with colon char).
- - (escapeshell*() doesn't cater to !).
- - (Truncating entire string should result in string).
- - (Passing parameters by reference and array_column).
- - (Cookie name cannot be empty).
- - (php_copy_file_ex does not pass the argument).
- - (Regression in array_filter's $flag argument in PHP 7).
- - Removed call_user_method() and call_user_method_array() functions.
- - Fixed user session handlers (See rfc:session.user.return-value).
- - Added intdiv() function.
- - Improved precision of log() function for base 2 and 10.
- - Remove string category support in setlocale().
- - Remove set_magic_quotes_runtime() and its alias magic_quotes_runtime().
- - (flock() out parameter not set correctly in windows).
- - Added preg_replace_callback_array function.
- - Deprecated salt option to password_hash.
- - (password_verify reports back error on PHP7 will null string).
- - Added Windows support for getrusage().
- - Removed hardcoded limit on number of pipes in proc_open().
-
-- Streams:
-
- - (HTTP stream wrapper doesn't close keep-alive connections).
- - (convert.base64-encode omits padding bytes).
- - Removed set_socket_blocking() in favor of its alias stream_set_blocking().
-
-- Tokenizer:
-
- - (token_get_all has new irrecoverable errors).
-
-- XMLReader:
-
- - (XmlReader read generates extra output).
-
-- XMLRPC:
-
- - (xmlrpc_set_type returns false on success).
-
-- XSL:
-
- - (PHP7 returns true when false is expected).
- - (XSLT: free(): invalid pointer).
- - (NULL pointer dereference).
- - (The XSLT extension is not thread safe).
- - Removed xsl.security_prefs ini option.
-
-- Zlib:
-
- - Added deflate_init(), deflate_add(), inflate_init(), inflate_add() functions allowing incremental/streaming compression/decompression.
-
-- Zip:
-
- - (ZipArchive::close() doesn't indicate errors).
- - (ZipArchive::extractTo allows for directory traversal when creating directories). (CVE-2014-9767)
- - Added ZipArchive::setCompressionName and ZipArchive::setCompressionIndex methods.
- - Update bundled libzip to 1.0.1.
- - (ZipArchive::getStream() returns NULL for certain file).
-
-
-
-
-
-
-
-
-
-Version 8.5.7
-
-- CLI:
-
- - Fixed bug (Stale getopt() optional value).
-
-- Date:
-
- - Fixed bug (int overflow in php_date_llabs).
-
-- DOM:
-
- - Fixed bug (UAF in custom XPath function).
-
-- Opcache:
-
- - Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
- - Fixed bug (Segfault with tracing JIT).
- - Fixed bug (Assertion failure at ext/opcache/jit/zend_jit_trace.c).
- - Fixed tailcall VM crash when a VM interrupt is handled from a VM helper.
-
-- OpenSSL:
-
- - Fix compatibility issues with OpenSSL 4.0.
-
-- Standard:
-
- - Fixed bug (version_compare() incorrectly handles versions ending with a dot).
-
-- URI:
-
- - Fixed CVE-2026-44927 (In uriparser before 1.0.2, there is pointer difference truncation to int in various places). (CVE-2026-44927)
- - Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928)
-
-
-
-
-
-
-
-Version 8.5.6
-
-- Core:
-
- - Fixed bug (GC assertion failure with fibers, generators and destructors).
- - Fixed ZEND_API mismatch on zend_ce_closure forward decl for Windows+Clang.
- - Fixed bug (Incorrect RC-handling for ZEND_EXT_STMT op1).
- - Fixed bug (Forward property operations to real instance for initialized lazy proxies).
- - Fixed bug (Missing addref for Countable::count()).
- - Fixed bug (Assertion failure in shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws).
- - Fixed bug (Missing addref for __unset).
- - Fixed bug (Trait with class constant name conflict against enum case causes SEGV).
-
-- CLI:
-
- - Fixed bug (`--rf` command line option with a method triggers ext/reflection deprecation warnings).
-
-- Curl:
-
- - Add support for brotli and zstd on Windows.
-
-- DOM:
-
- - Fixed and (Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS()). (CVE-2026-7263)
-
-- FPM:
-
- - Fixed (XSS within status endpoint). (CVE-2026-6735)
-
-- Iconv:
-
- - Fixed bug (iconv memory leak on bailout).
-
-- Lexbor:
-
- - Upgrade to lexbor v2.7.0.
-
-- MBString:
-
- - Fixed (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (CVE-2026-7259)
- - Fixed (Out-of-bounds access in mbfl_name2encoding_ex()). (CVE-2026-6104)
-
-- Opcache:
-
- - Fixed bug (JIT: Assertion jit->ra[var].flags & (1<<0) failed in zend_jit_use_reg).
- - Fixed bug (Borked function JIT JMPNZ smart branch).
- - Fixed bug (COND optimization regression).
- - Fixed faulty returns out of zend_try block in zend_jit_trace().
-
-- OpenSSL:
-
- - Fix memory leak regression in openssl_pbkdf2().
- - Fix a bunch of memory leaks and crashes on edge cases.
-
-- PDO_Firebird:
-
- - Fixed (SQL injection via NUL bytes in quoted strings). (CVE-2025-14179)
-
-- PDO_PGSQL:
-
- - Fixed bug (pdo_pgsql throws with ATTR_PREFETCH=0 on empty result set).
-
-- Phar:
-
- - Restore is_link handler in phar_intercept_functions_shutdown.
- - Fixed bug (phar: NULL dereference in Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment).
- - Fix memory leak in Phar::offsetGet().
- - Fix memory leak in phar_add_file().
- - Fixed bug (phar: propagate phar_stream_flush return value from phar_stream_close).
- - Fix memory leak in phar_verify_signature() when md_ctx is invalid.
-
-- Random:
-
- - Fixed bug (Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state).
-
-- Session:
-
- - Fixed memory leak when session GC callback return a refcounted value.
-
-- SOAP:
-
- - Fixed (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (CVE-2026-6722)
- - Fixed (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (CVE-2026-7261)
- - Fixed (Broken Apache map value NULL check). (CVE-2026-7262)
-
-- SPL:
-
- - Fixed bug (RecursiveArrayIterator getChildren UAF after parent free).
- - Fix concurrent iteration and deletion issues in SplObjectStorage.
-
-- Sqlite3:
-
- - Fixed wrong free list comparator pointer type.
-
-- Standard:
-
- - Fixed (Signed integer overflow of char array offset). (CVE-2026-7568)
- - Fixed (Consistently pass unsigned char to ctype.h functions). (CVE-2026-7258)
-
-- Streams:
-
- - Fixed bug (Segfault in file_get_contents w/ a https URL and a proxy set).
-
-- URI:
-
- - Fixed CVE-2026-42371 (uriparser before 1.0.1 has numeric truncation in text range comparison). (CVE-2026-42371)
-
-
-
-
-
-
-
-Version 8.5.5
-
-- Core:
-
- - Fixed bug (Incorrect property_info sizing for locally shadowed trait properties).
- - Fixed bugs , , (Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies).
-
-- Bz2:
-
- - Fix truncation of total output size causing erroneous errors.
-
-- DOM:
-
- - Fixed bug (Dom\HTMLDocument parser mangles xml:space and xml:lang attributes).
-
-- FFI:
-
- - Fixed resource leak in FFI::cdef() onsymbol resolution failure.
-
-- GD:
-
- - Fixed bug (phpinfo() to display libJPEG 10.0 support).
-
-- Opcache:
-
- - Fixed bug (Preloaded constant erroneously propagated to file-cached script).
- - Fixed bug (JIT compiler produces wrong arithmetic results).
- - Fixed bug (JIT tracing: infinite loop on FETCH_OBJ_R with IS_UNDEF property in polymorphic context).
- - Fixed bug (uaf in jit).
-
-- OpenSSL:
-
- - Fixed bug (Skip private_key_bits validation for EC/curve-based keys).
- - Fix missing error propagation for BIO_printf() calls.
-
-- PCNTL:
-
- - Fixed signal handler installation on AIX by bumping the storage size of the num_signals global.
-
-- PCRE:
-
- - Fixed re-entrancy issue on php_pcre_match_impl, php_pcre_replace_impl, php_pcre_split_impl, and php_pcre_grep_impl.
-
-- Phar:
-
- - Fixed bug (use after free when unlinking entries during iteration of a compressed phar).
-
-- SNMP:
-
- - Fixed bug (SNMP::setSecurity() undefined behavior with NULL arguments).
-
-- SOAP:
-
- - Fixed Set-Cookie parsing bug wrong offset while scanning attributes.
-
-- SPL:
-
- - Fixed bug (missing write lock validation in SplHeap).
-
-- Standard:
-
- - Fixed bug (Assertion failure when messing up output buffers).
- - Fixed bug (Cannot identify some avif images with getimagesize).
-
-- Sysvshm:
-
- - Fix memory leak in shm_get_var() when variable is corrupted.
-
-- XSL:
-
- - Fix (XSLTProcessor works with DOMDocument, but fails with Dom\XMLDocument).
- - Fixed bug (UAF in dom_objects_free_storage).
-
-
-
-
-
-
-
-Version 8.5.4
-
-- Core:
-
- - Fixed bug (zend_mm_heap corrupted on Aarch64, LTO builds).
- - Fixed bug (Segfault when preloading constant AST closure).
- - Fixed bug (Crash on (unset) cast in constant expression).
- - Fix deprecation now showing when accessing null key of an array with JIT.
- - Fixed bug (Assertion failure in zend_lazy_object_get_info triggered by setRawValueWithoutLazyInitialization() and newLazyGhost()).
- - Fixed bug (Assertion failure in zend_get_property_guard when accessing properties on Reflection LazyProxy via isset()).
- - Fixed OSS-Fuzz #478009707 (Borked assign-op/inc/dec on untyped hooked property backing value).
- - Fixed bug (Build fails with -std=).
- - Fixed bug (Build system installs libtool wrappers when using slibtool).
-
-- Curl:
-
- - Don't truncate length.
-
-- Date:
-
- - Fixed bug (DatePeriod::__set_state() cannot handle null start).
- - Fix timezone offset with seconds losing precision.
-
-- DOM:
-
- - Fixed bug (Accessing Dom\Node::baseURI can throw TypeError).
- - Fixed bug (Accessing Dom\Node properties can can throw TypeError).
-
-- LDAP:
-
- - Fixed bug (ldap_modify() too strict controls argument validation makes it impossible to unset attribute).
-
-- MBString:
-
- - Fixed bug ; mb_guess_encoding no longer crashes when passed huge list of candidate encodings (with 200,000+ entries).
-
-- Opcache:
-
- - Fixed bug ("Insufficient shared memory" when using JIT on Solaris).
- - Fixed bug (Borked SCCP of array containing partial object).
-
-- OpenSSL:
-
- - Fix a bunch of leaks and error propagation.
-
-- Windows:
-
- - Fixed compilation with clang (missing intrin.h include).
-
-
-
-
-
-
-
-Version 8.5.3
-
-- Core:
-
- - Fixed bug (preserve_none feature compatiblity with LTO).
- - Fixed bug (build failure with musttail/preserve_none feature on macOs).
- - Fixed bug (NULL dereference when calling ob_start() in shutdown function triggered by bailout in php_output_lock_error()).
- - Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber).
- - Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization).
- - Fixed bug (Internal enums can be cloned and compared).
- - Fix OSS-Fuzz #474613951 (Leaked parent property default value).
- - Fixed bug (ReflectionProperty does not return the PHPDoc of a property if it contains an attribute with a Closure).
- - Fixed bug (Use-after-free in FE_FREE with GC interaction).
- - Fix OSS-Fuzz #471486164 (Broken by-ref assignment to uninitialized hooked backing value).
- - Fix OSS-Fuzz #438780145 (Nested finally with repeated return type check may uaf).
- - Fixed bug (Lazy proxy bailing __clone assertion).
- - Fixed bug (Hooked object properties overflow).
-
-- Date:
-
- - Update timelib to 2022.16.
-
-- DOM:
-
- - Fixed (Dom\HTMLDocument corrupts closing tags within scripts).
-
-- MbString:
-
- - Fixed bug (mb_str_pad() divide by zero if padding string is invalid in the encoding).
- - Fixed bug (Stack overflow in mb_convert_variables with recursive array references).
-
-- Opcache:
-
- - Fixed bug (Segfault in Tracing JIT with object reference).
-
-- OpenSSL:
-
- - Fix memory leaks when sk_X509_new_null() fails.
- - Fix crash when in openssl_x509_parse() when i2s_ASN1_INTEGER() fails.
- - Fix crash in openssl_x509_parse() when X509_NAME_oneline() fails.
-
-- Phar:
-
- - Fixed bug (buildFromIterator breaks with missing base directory).
-
-- PGSQL:
-
- - Fixed INSERT/UPDATE queries building with PQescapeIdentifier() and possible UB.
-
-- Readline:
-
- - Fixed bug (Memory leak when overriding some settings via readline_info()).
-
-- SPL:
-
- - Fixed bug (heap-use-after-free in SplDoublyLinkedList iterator when modifying during iteration).
-
-- Standard:
-
- - (lchown fails to change ownership of symlink with ZTS) (Jakub Zelenka)
- - Fixed bug (var_dump() crash with nested objects) (David Carlier)
-
-
-
-
-
-
-
-Version 8.5.2
-
-- Core:
-
- - Fix OSS-Fuzz #465488618 (Wrong assumptions when dumping function signature with dynamic class const lookup default argument).
- - Fixed bug (Assertion failure in normalize_value() when parsing malformed INI input via parse_ini_string()).
- - Fixed bug (Uncatchable exception thrown in generator).
- - Fixed bug (UAF in php_output_handler_free via re-entrant ob_start() during error deactivation).
- - Fixed bug ("Casting out of range floats to int" applies to strings).
-
-- DOM:
-
- - Fixed bug (Null pointer dereference in DOM namespace node cloning via clone on malformed objects).
- - Fixed bug (Dom\XMLDocument::C14N() seems broken compared to DOMDocument::C14N()).
-
-- EXIF:
-
- - Fixed bug (Integer underflow in exif HEIF parsing when pos.size < 2).
-
-- Intl:
-
- - Fix leak in umsg_format_helper().
-
-- LDAP:
-
- - Fix memory leak in ldap_set_options().
-
-- Lexbor:
-
- - Fixed bug (\Uri\WhatWg\Url::withHost() crashes (SEGV) for URLs using the file: scheme).
-
-- Mbstring:
-
- - Fixed bug (mb_decode_mimeheader does not handle separator).
-
-- PCNTL:
-
- - Fixed bug with pcntl_getcpuaffinity() on solaris regarding invalid process ids handling.
-
-- Phar:
-
- - Fixed bug (Phar::LoadPhar undefined behavior when reading fails).
- - Fix SplFileInfo::openFile() in write mode.
- - Fix build on legacy OpenSSL 1.1.0 systems.
- - (Phar extractTo creates empty files).
-
-- Session:
-
- - Fix support for MM module.
-
-- Sqlite3:
-
- - Fixed bug (SQLite3Result fetchArray return array|false, null returned).
-
-- Standard:
-
- - Fix error check for proc_open() command.
- - Fix memory leak in mail() when header key is numeric.
- - Fixed bug (Heap Buffer Overflow in iptcembed).
-
-- URI:
-
- - Fixed bug (Assertion failure when getUnicodeHost() returns empty string).
-
-- Zlib:
-
- - Fix OOB gzseek() causing assertion failure.
-
-
-
-
-
-
-
-Version 8.5.1
-
-- Core:
-
- - Sync all boost.context files with release 1.86.0.
- - Fixed bug (SensitiveParameter doesn't work for named argument passing to variadic parameter).
- - Fixed bug (preserve_none attribute configure check on macOs issue).
- - Fixed bug (use-after-destroy during userland stream_close()).
-
-- Bz2:
-
- - Fix assertion failures resulting in crashes with stream filter object parameters.
-
-- DOM:
-
- - Fix memory leak when edge case is hit when registering xpath callback.
- - Fixed bug (querySelector and querySelectorAll requires elements in $selectors to be lowercase).
- - Fix missing NUL byte check on C14NFile().
-
-- Fibers:
-
- - Fixed bug (ASAN stack overflow with fiber.stack_size INI small value).
-
-- Intl:
-
- - Fixed bug (Spoofchecker::setRestrictionLevel() error message suggests missing constants).
-
-- Lexbor:
-
- - Fixed bug (\Uri\WhatWg\Url lose host after calling withPath() or withQuery()).
- - Fixed bug (\Uri\WhatWg\Url crashes (SEGV) when parsing malformed URL due to Lexbor memory corruption).
-
-- LibXML:
-
- - Fix some deprecations on newer libxml versions regarding input buffer/parser handling.
-
-- MySQLnd:
-
- - Fixed bug (Regression breaks mysql connexion using an IPv6 address enclosed in square brackets).
-
-- Opcache:
-
- - Fixed bug (opcache.file_cache broken with full interned string buffer).
-
-- PDO:
-
- - Fixed bug (PDO::FETCH_CLASSTYPE ignores $constructorArgs in PHP 8.5.0).
- - Fixed (PDO quoting result null deref). (CVE-2025-14180)
-
-- Phar:
-
- - Fixed bug (Phar does not respect case-insensitiveness of __halt_compiler() when reading stub).
- - Fix broken return value of fflush() for phar file entries.
- - Fix assertion failure when fseeking a phar file out of bounds.
-
-- PHPDBG:
-
- - Fixed ZPP type violation in phpdbg_get_executable() and phpdbg_end_oplog().
-
-- SPL:
-
- - Fixed bug (SplFixedArray incorrectly handles references in deserialization).
-
-- Standard:
-
- - Fix memory leak in array_diff() with custom type checks.
- - Fixed bug (Stack overflow in http_build_query via deep structures).
- - Fixed (Null byte termination in dns_get_record()).
- - Fixed (Heap buffer overflow in array_merge()). (CVE-2025-14178)
- - Fixed (Information Leak of Memory in getimagesize). (CVE-2025-14177)
-
-- URI:
-
- - Fixed bug (ext/uri incorrectly throws ValueError when encountering null byte).
- - Fixed CVE-2025-67899 (uriparser through 0.9.9 allows unbounded recursion and stack consumption).
-
-- XML:
-
- - Fixed bug (xml_set_default_handler() does not properly handle special characters in attributes when passing data to callback).
-
-- Zip:
-
- - Fix crash in property existence test.
- - Don't truncate return value of zip_fread() with user sizes.
-
-- Zlib:
-
- - Fix assertion failures resulting in crashes with stream filter object parameters.
-
-
-
-
-
-
-
-Version 8.5.0
-
-- Core:
-
- - Added the #[\NoDiscard] attribute to indicate that a function's return value is important and should be consumed.
- - Added the (void) cast to indicate that not using a value is intentional.
- - Added get_error_handler(), get_exception_handler() functions.
- - Added support for casts in constant expressions.
- - Added the pipe (|>) operator.
- - Added the #[\DelayedTargetValidation] attribute to delay target errors for internal attributes from compile time to runtime.
- - Added support for `final` with constructor property promotion.
- - Added support for configuring the URI parser for the FTP/FTPS as well as the SSL/TLS stream wrappers as described in https://wiki.php.net/rfc/url_parsing_api#plugability.
- - Added PHP_BUILD_PROVIDER constant.
- - Added PHP_BUILD_DATE constant.
- - Added support for Closures and first class callables in constant expressions.
- - Add support for backtraces for fatal errors.
- - Add clone-with support to the clone() function.
- - Add RFC 3986 and WHATWG URL compliant APIs for URL parsing and manipulation (kocsismate, timwolla)
- - Fixed AST printing for immediately invoked Closure.
- - Properly handle __debugInfo() returning an array reference.
- - Properly handle reference return value from __toString().
- - Improved error message of UnhandledMatchError for zend.exception_string_param_max_len=0.
- - Fixed bug and (Bind traits before parent class).
- - Fixed bug (memory_limit is not always limited by max_memory_limit).
- - Fixed bug (Stale EG(opline_before_exception) pointer through eval).
- - Fixed bug (Missing new Foo(...) error in constant expressions).
- - Fixed bug (Don't bail when closing resources on shutdown).
- - Fixed bug (Accessing overridden private property in get_object_vars() triggers assertion error).
- - Fix OSS-Fuzz #447521098 (Fatal error during sccp shift eval).
- - Fixed bug (Broken build on *BSD with MSAN).
- - Fixed bug (Cross-compilation with musl C library).
- - Fixed bug (object_properties_load() bypasses readonly property checks).
- - Fixed hard_timeout with --enable-zend-max-execution-timers.
- - Fixed bug (Incorrect HASH_FLAG_HAS_EMPTY_IND flag on userland array).
- - Fixed bug (register_argc_argv deprecation emitted twice when using OPcache).
- - Fixed bug (error_log php.ini cannot be unset when open_basedir is configured).
- - Fixed bug (Allow empty statements before declare(strict_types)).
- - Fixed bug (CGI with auto_globals_jit=0 causes uouv).
- - Fixed bug (Stale array iterator pointer).
- - Fixed bug (zend_ssa_range_widening may fail to converge).
- - Fixed bug (PHP_EXPAND_PATH broken with bash 5.3.0).
- - Fixed bug (Repeated inclusion of file with __halt_compiler() triggers "Constant already defined" warning).
- - Fixed bug (pipe operator fails to correctly handle returning by reference).
- - Fixed bug (Wrong lineno in property error with constructor property promotion).
- - Fixed bug (Relax missing trait fatal error to error exception).
- - Fixed bug (NULL-ptr dereference when using register_tick_function in destructor).
- - Fixed bug (Improve "expecting token" error for ampersand).
- - The report_memleaks INI directive has been deprecated.
- - Fixed OSS-Fuzz #439125710 (Pipe cannot be used in write context).
- - Fixed bug (Shared memory violation on property inheritance).
- - Fixed bug (GC treats ZEND_WEAKREF_TAG_MAP references as WeakMap references).
- - Fixed bug (Don't substitute self/parent with anonymous class).
- - Fix support for non-userland stream notifiers.
- - Fixed bug (Operands may be being released during comparison).
- - Fixed bug (Generator can be resumed while fetching next value from delegated Generator).
- - Fixed bug (Calling Generator::throw() on a running generator with a non-Generator delegate crashes).
- - Fix OSS-Fuzz #427814452 (pipe compilation fails with assert).
- - Fixed bug (\array and \callable should not be usable in class_alias).
- - Use `clock_gettime_nsec_np()` for high resolution timer on macOS if available.
- - Make `clone()` a function.
- - Introduced the TAILCALL VM, enabled by default when compiling with Clang>=19 on x86_64 or aarch64.
- - Enacted the follow-up phase of the "Path to Saner Increment/Decrement operators" RFC, meaning that incrementing non-numeric strings is now deprecated. (Girgias).
- - Various closure binding issues are now deprecated.
- - Constant redeclaration has been deprecated.
- - Marks the stack as non-executable on Haiku.
- - Deriving $_SERVER['argc'] and $_SERVER['argv'] from the query string is now deprecated.
- - Using null as an array offset or when calling array_key_exists() is now deprecated.
- - The disable_classes INI directive has been removed.
- - The locally predefined variable $http_response_header is deprecated.
- - Non-canonical cast names (boolean), (integer), (double), and (binary) have been deprecated.
- - The $exclude_disabled parameter of the get_defined_functions() function has been deprecated, as it no longer has any effect since PHP 8.0.
- - Terminating case statements with a semicolon instead of a colon has been deprecated.
- - The backtick operator as an alias for shell_exec() has been deprecated.
- - Returning null from __debugInfo() has been deprecated.
- - Support #[\Override] on properties.
- - Destructing non-array values (other than NULL) using [] or list() now emits a warning.
- - Casting floats that are not representable as ints now emits a warning.
- - Casting NAN to other types now emits a warning.
- - Implement (Enhance zend_dump_op_array to properly represent non-printable characters in string literals).
- - Fixed bug (Engine UAF with reference assign and dtor).
- - Do not use RTLD_DEEPBIND if dlmopen is available.
- - Implement (It is now allowed to substitute static with self or the concrete class name
- in final subclasses)
-
-- BCMath:
-
- - Simplify `bc_divide()` code.
- - If the result is 0, n_scale is set to 0.
- - If size of BC_VECTOR array is within 64 bytes, stack area is now used.
- - Fixed bug (Power of 0 of BcMath number causes UB).
-
-- Bz2:
-
- - Fixed bug (Broken bzopen() stream mode validation).
-
-- CLI:
-
- - Add --ini=diff to print INI settings changed from the builtin default.
- - Drop support for -z CLI/CGI flag.
- - Fixed - development server 404 page does not adapt to mobiles.
- - Fix useless "Failed to poll event" error logs due to EAGAIN in CLI server with PHP_CLI_SERVER_WORKERS.
- - Fixed bug (Improve error message on listening error with IPv6 address).
-
-- COM:
-
- - Fixed property access of PHP objects wrapped in variant.
- - Fixed method calls for PHP objects wrapped in variant.
-
-- Curl:
-
- - Added CURLFOLLOW_ALL, CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY values for CURLOPT_FOLLOWLOCATION curl_easy_setopt option.
- - Added curl_multi_get_handles().
- - Added curl_share_init_persistent().
- - Added CURLINFO_USED_PROXY, CURLINFO_HTTPAUTH_USED, and CURLINFO_PROXYAUTH_USED support to curl_getinfo.
- - Add support for CURLINFO_CONN_ID in curl_getinfo() (thecaliskan)
- - Add support for CURLINFO_QUEUE_TIME_T in curl_getinfo() (thecaliskan)
- - Add support for CURLOPT_SSL_SIGNATURE_ALGORITHMS.
- - The curl_close() function has been deprecated.
- - The curl_share_close() function has been deprecated.
- - Fix cloning of CURLOPT_POSTFIELDS when using the clone operator instead of the curl_copy_handle() function to clone a CurlHandle.
-
-- Date:
-
- - Fix undefined behaviour problems regarding integer overflow in extreme edge cases.
- - The DATE_RFC7231 and DateTimeInterface::RFC7231 constants have been deprecated.
- - Fixed date_sunrise() and date_sunset() with partial-hour UTC offset.
- - Fixed : "P" format for ::createFromFormat swallows string literals.
- - The __wakeup() magic method of DateTimeInterface, DateTime, DateTimeImmutable, DateTimeZone, DateInterval, and DatePeriod has been deprecated in favour of the __unserialize() magic method.
-
-- DOM:
-
- - Added Dom\Element::$outerHTML.
- - Added Dom\Element::insertAdjacentHTML().
- - Added $children property to ParentNode implementations.
- - Make cloning DOM node lists, maps, and collections fail.
- - Added Dom\Element::getElementsByClassName().
- - Fixed bug (\Dom\HTMLDocument querySelectorAll selecting only the first when using ~ and :has).
- - Fix getNamedItemNS() incorrect namespace check.
-
-- Enchant:
-
- - Added enchant_dict_remove_from_session().
- - Added enchant_dict_remove().
- - Fix missing empty string checks.
-
-- EXIF:
-
- - Add OffsetTime* Exif tags.
- - Added support to retrieve Exif from HEIF file.
- - Fix OSS-Fuzz #442954659 (zero-size box in HEIF file causes infinite loop).
- - Fix OSS-Fuzz #442954659 (Crash in exif_scan_HEIF_header).
- - Various hardening fixes to HEIF parsing.
-
-- FileInfo:
-
- - The finfo_close() function has been deprecated.
- - The $context parameter of the finfo_buffer() function has been deprecated as it is ignored.
- - Upgrade to file 5.46.
- - Change return type of finfo_close() to true.
-
-- Filter:
-
- - Added support for configuring the URI parser for FILTER_VALIDATE_URL as described in https://wiki.php.net/rfc/url_parsing_api#plugability.
- - Fixed bug (filter_var_array with FILTER_VALIDATE_INT|FILTER_NULL_ON_FAILURE should emit warning for invalid filter usage).
-
-- FPM:
-
- - Fixed bug (Decode SCRIPT_FILENAME issue in php 8.5).
- - Fixed bug (PHP 8.5 FPM access log lines also go to STDERR).
- - Fixed (FPM with httpd ProxyPass does not decode script path).
- - Make FPM access log limit configurable using log_limit.
- - Fixed failed debug assertion when php_admin_value setting fails.
- - Fixed (post_max_size evaluates .user.ini too late in php-fpm).
-
-- GD:
-
- - (Transparent artifacts when using imagerotate).
- - (ZTS GD fails to find system TrueType font).
- - Fix incorrect comparison with result of php_stream_can_cast().
- - The imagedestroy() function has been deprecated.
-
-- Iconv:
-
- - Extends the ICONV_CONST preprocessor for illumos/solaris.
-
-- Intl:
-
- - Bumped ICU requirement to ICU >= 57.1.
- - IntlDateFormatter::setTimeZone()/datefmt_set_timezone() throws an exception with uninitialised classes or clone failure.
- - Added DECIMAL_COMPACT_SHORT/DECIMAL_COMPACT_LONG for NumberFormatter class.
- - Added Locale::isRightToLeft to check if a locale is written right to left.
- - Added null bytes presence in locale inputs for Locale class.
- - Added grapheme_levenshtein() function.
- - Added Locale::addLikelySubtags/Locale::minimizeSubtags to handle adding/removing likely subtags to a locale.
- - Added IntlListFormatter class to format a list of items with a locale, operands types and units.
- - Added grapheme_strpos(), grapheme_stripos(), grapheme_strrpos(), grapheme_strripos(), grapheme_substr(), grapheme_strstr(), grapheme_stristr() and grapheme_levenshtein() functions add $locale parameter (Yuya Hamada).
- - Fixed bug (Fix locale strings canonicalization for IntlDateFormatter and NumberFormatter).
- - Fixed bug ([intl] Weird numeric sort in Collator).
- - Fix return value on failure for resourcebundle count handler.
- - Fixed bug (PGO builds of shared ext-intl are broken).
- - Intl's internal error mechanism has been modernized so that it indicates more accurately which call site caused what error. Moreover, some ext/date exceptions have been wrapped inside a IntlException now.
- - The intl.error_level INI setting has been deprecated.
-
-- LDAP:
-
- - Allow ldap_get_option to retrieve global option by allowing NULL for connection instance ($ldap).
-
-- MBstring:
-
- - Updated Unicode data tables to Unicode 17.0.
-
-- MySQLi:
-
- - Fixed bugs and (calling mysqli::__construct twice).
- - The mysqli_execute() alias function has been deprecated.
-
-- MySQLnd:
-
- - Added mysqlnd.collect_memory_statistics to ini quick reference.
-
-- ODBC:
-
- - Removed driver-specific build flags and support.
- - Remove ODBCVER and assume ODBC 3.5.
-
-- Opcache:
-
- - Make OPcache non-optional (Arnaud, timwolla)
- - Added opcache.file_cache_read_only.
- - Updated default value of opcache.jit_hot_loop.
- - Log a warning when opcache lock file permissions could not be changed.
- - Fixed bug (heap buffer overflow in jit).
- - Partially fixed bug (Avoid calling wrong function when reusing file caches across differing environments).
- - Disallow changing opcache.memory_consumption when SHM is already set up.
- - Fixed bug (Compiling opcache statically into ZTS PHP fails).
- - Fixed bug (OPcache bypasses the user-defined error handler for deprecations).
- - Fixed bug (opcache build failure).
- - Fixed bug (access to uninitialized vars in preload_load()).
- - Fixed bug (JIT broken in ZTS builds on MacOS 15).
- - Fixed bug (JIT 1205 segfault on large file compiled in subprocess).
- - Fixed segfault in function JIT due to NAN to bool warning.
- - Fixed bug (Double-free of EG(errors)/persistent_script->warnings on persist of already persisted file).
- - Fixed bug (race condition in zend_runtime_jit(), zend_jit_hot_func()).
- - Fixed bug (assertion failure in zend_jit_trace_type_to_info_ex).
- - Fixed bug (function JIT may not deref property value).
- - Fixed bug (Incorrect opline after deoptimization).
- - Fixed bug (Wrong JIT stack setup on aarch64/clang).
- - Fixed bug (Broken opcache.huge_code_pages).
- - Fixed bug (Build fails on non-glibc/musl/freebsd/macos/win platforms).
- - Fixed ZTS OPcache build on Cygwin.
- - Fixed bug (JIT variable not stored before YIELD).
-
-- OpenSSL:
-
- - Added openssl.libctx INI that allows to select the OpenSSL library context type and convert various parts of the extension to use the custom libctx.
- - Add $digest_algo parameter to openssl_public_encrypt() and openssl_private_decrypt() functions.
- - Implement #81724 (openssl_cms_encrypt only allows specific ciphers).
- - Implement #80495 (Enable to set padding in openssl_(sign|verify).
- - Implement #47728 (openssl_pkcs7_sign ignores new openssl flags).
- - Fixed bug (openssl_get_cipher_methods inconsistent with fetching).
- - Fixed build when --with-openssl-legacy-provider set.
- - Fixed bug (8.5 | Regression in openssl_sign() - support for alias algorithms appears to be broken).
- - The $key_length parameter for openssl_pkey_derive() has been deprecated.
-
-- Output:
-
- - Fixed calculation of aligned buffer size.
-
-- PCNTL:
-
- - Extend pcntl_waitid with rusage parameter.
-
-- PCRE:
-
- - Remove PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK from pcre compile options.
-
-- PDO:
-
- - Fixed bug (Incorrect class name in deprecation message for PDO mixins).
- - Driver specific methods and constants in the PDO class are now deprecated.
- - The "uri:" DSN scheme has been deprecated due to security concerns with DSNs coming from remote URIs.
-
-- PDO_ODBC:
-
- - Fetch larger block sizes and better handle SQL_NO_TOTAL when calling SQLGetData.
-
-- PDO_PGSQL:
-
- - Added Iterable support for PDO::pgsqlCopyFromArray.
- - Implement Pdo\Pgsql::setAttribute(PDO::ATTR_PREFETCH, 0) or Pdo\Pgsql::prepare(…, [ PDO::ATTR_PREFETCH => 0 ]) make fetch() lazy instead of storing the whole result set in memory (Guillaume Outters)
-
-- PDO_SQLITE:
-
- - Add PDO\Sqlite::ATTR_TRANSACTION_MODE connection attribute.
- - Implement : Add setAuthorizer to Pdo\Sqlite.
- - PDO::sqliteCreateCollation now throws a TypeError if the callback has a wrong return type.
- - Added Pdo_Sqlite::ATTR_BUSY_STATEMENT constant to check if a statement is currently executing.
- - Added Pdo_Sqlite::ATTR_EXPLAIN_STATEMENT constant to set a statement in either EXPLAIN_MODE_PREPARED, EXPLAIN_MODE_EXPLAIN, EXPLAIN_MODE_EXPLAIN_QUERY_PLAN modes.
- - Fix bug (sqlite PDO::quote silently corrupts strings with null bytes) by throwing on null bytes.
-
-- PGSQL:
-
- - Added pg_close_stmt to close a prepared statement while allowing its name to be reused.
- - Added Iterable support for pgsql_copy_from.
- - pg_connect checks if connection_string contains any null byte, pg_close_stmt check if the statement contains any null byte.
- - Added pg_service to get the connection current service identifier.
- - Fix segfaults when attempting to fetch row into a non-instantiable class name.
-
-- Phar:
-
- - Fix potential buffer length truncation due to usage of type int instead of type size_t.
- - Fixed memory leaks when verifying OpenSSL signature.
-
-- POSIX:
-
- - Added POSIX_SC_OPEN_MAX constant to get the number of file descriptors a process can handle.
- - posix_ttyname() sets last_error to EBADF on invalid file descriptors, posix_isatty() raises E_WARNING on invalid file descriptors, posix_fpathconf checks invalid file descriptors.
- - posix_kill and posix_setpgid throws a ValueError on invalid process_id.
- - posix_setpgid throws a ValueError on invalid process_group_id, posix_setrlimit throws a ValueError on invalid soft_limit and hard_limit arguments.
-
-- Random:
-
- - Moves from /dev/urandom usage to arc4random_buf on Haiku.
-
-- Reflection:
-
- - Added ReflectionConstant::getExtension() and ::getExtensionName().
- - Added ReflectionProperty::getMangledName() method.
- - ReflectionConstant is no longer final.
- - The setAccessible() methods of various Reflection objects have been deprecated, as those no longer have an effect.
- - ReflectionClass::getConstant() for constants that do not exist has been deprecated.
- - ReflectionProperty::getDefaultValue() for properties without default values has been deprecated.
- - Fixed bug (ReflectionClass::getStaticPropertyValue() returns UNDEF zval for uninitialized typed properties).
- - Fixed bug (ReflectionClass::__toString() should have better output for enums).
- - Fix (getModifierNames() not reporting asymmetric visibility).
- - Fixed bug (Reflection: have some indication of property hooks in `_property_string()`).
- - Fixed bug (ReflectionNamedType::getName() prints nullable type when retrieved from ReflectionProperty::getSettableType()).
- - Fixed bug (ReflectionClass::isIterable() incorrectly returns true for classes with property hooks).
-
-- SAPI:
-
- - Fixed bug and #81451: http_response_code() does not override the status code generated by header().
-
-- Session:
-
- - session_start() throws a ValueError on option argument if not a hashmap or a TypeError if read_and_close value is not compatible with int.
- - Added support for partitioned cookies.
- - Fix RC violation of session SID constant deprecation attribute.
- - Fixed : build broken with ZEND_STRL usage with memcpy when implemented as macro.
-
-- SimpleXML:
-
- - Fixed bug (SimpleXML xpath should warn when returning other return types than node lists).
-
-- SNMP:
-
- - snmpget, snmpset, snmp_get2, snmp_set2, snmp_get3, snmp_set3 and SNMP::__construct() throw an exception on invalid hostname, community timeout and retries arguments.
-
-- SOAP:
-
- - Added support for configuring the URI parser for SoapClient::__doRequest() as described in https://wiki.php.net/rfc/url_parsing_api#plugability.
- - Implement request #55503 (Extend __getTypes to support enumerations).
- - Implement request #61105 (Support Soap 1.2 SoapFault Reason Text lang attribute).
- - (SoapServer calls wrong function, although "SOAP action" header is correct).
- - Fix namespace handling of WSDL and XML schema in SOAP, fixing at least and bug #68576.
- - (Segmentation fault on invalid WSDL cache).
- - Fixed bug (SIGSEGV due to uninitialized soap_globals->lang_en).
- - Fixed bug (Segfault when spawning new thread in soap extension).
-
-- Sockets:
-
- - Added IPPROTO_ICMP/IPPROTO_ICMPV6 to create raw socket for ICMP usage.
- - Added TCP_FUNCTION_BLK to change the TCP stack algorithm on FreeBSD.
- - Added IP_BINDANY for a socket to bind to any address.
- - Added SO_BUSY_POOL to reduce packets poll latency.
- - Added UDP_SEGMENT support to optimise multiple large datagrams over UDP if the kernel and hardware supports it.
- - Added SHUT_RD, SHUT_WR and SHUT_RDWR constants for socket_shutdown().
- - Added TCP_FUNCTION_ALIAS, TCP_REUSPORT_LB_NUMA, TCP_REUSPORT_LB_NUMA_NODOM, TCP_REUSPORT_LB_CURDOM, TCP_BBR_ALGORITHM constants.
- - socket_set_option() catches possible overflow with SO_RCVTIMEO/SO_SNDTIMEO with timeout setting on windows.
- - socket_create_listen() throws an exception on invalid port value.
- - socket_bind() throws an exception on invalid port value.
- - socket_sendto() throws an exception on invalid port value.
- - socket_addrinfo_lookup throws an exception on invalid hints value types.
- - socket_addrinfo_lookup throws an exception if any of the hints value overflows.
- - socket_addrinfo_lookup throws an exception if one or more hints entries has an index as numeric.
- - socket_set_option with the options MCAST_LEAVE_GROUP/MCAST_LEAVE_SOURCE_GROUP will throw an exception if its value is not a valid array/object.
- - socket_getsockname/socket_create/socket_bind handled AF_PACKET family socket.
- - socket_set_option for multicast context throws a ValueError when the socket family is not of AF_INET/AF_INET6 family.
-
-- Sodium:
-
- - Fix overall theoretical overflows on zend_string buffer allocations.
-
-- SPL:
-
- - Fixed bug (SplHeap/SplPriorityQueue serialization exposes INDIRECTs).
- - Improve __unserialize() hardening for SplHeap/SplPriorityQueue.
- - Deprecate ArrayObject and ArrayIterator with objects.
- - Unregistering all autoloaders by passing the spl_autoload_call() function as a callback argument to spl_autoload_unregister() has been deprecated. Instead if this is needed, one should iterate over the return value of spl_autoload_functions() and call spl_autoload_unregister() on each value.
- - The SplObjectStorage::contains(), SplObjectStorage::attach(), and SplObjectStorage::detach() methods have been deprecated in favour of SplObjectStorage::offsetExists(), SplObjectStorage::offsetSet(), and SplObjectStorage::offsetUnset() respectively.
-
-- Sqlite:
-
- - Added Sqlite3Stmt::busy to check if a statement is still being executed.
- - Added Sqlite3Stmt::explain to produce an explain query plan from the statement.
- - Added Sqlite3Result::fetchAll to return all results at once from a query.
-
-- Standard:
-
- - Add HEIF/HEIC support to getimagesize.
- - Added support for partitioned cookies.
- - Implement #71517 (Implement SVG support for getimagesize() and friends).
- - Implement : Add support for new INI mail.cr_lf_mode.
- - Optimized PHP html_entity_decode function.
- - Minor optimization to array_chunk().
- - Optimized pack().
- - Fixed crypt() tests on musl when using --with-external-libcrypt (Michael Orlitzky).
- - Fixed bug (is_callable(func(...), callable_name: $name) for first class callables returns wrong name).
- - Added array_first() and array_last().
- - Fixed bug (setlocale's 2nd and 3rd argument ignores strict_types).
- - Fixed exit code handling of sendmail cmd and added warnings.
- - Fixed bug (printf: empty precision is interpreted as precision 6, not as precision 0).
- - Fixed bug (mail() heap overflow with an empty message in lf mode).
- - Fixed bug (AVIF images misdetected as HEIF after introducing HEIF support in getimagesize()).
- - Fixed bug (reset internal pointer earlier while splicing array while COW violation flag is still set).
- - Fixed bug (leaks in var_dump() and debug_zval_dump()).
- - Fixed (SplPriorityQueue, SplMinHeap, and SplMaxHeap lost their data on serialize()).
- - Fixed (Deprecation warnings in functions taking as argument).
- - Fixed bug (Avoid integer overflow when using a small offset and PHP_INT_MAX with LimitIterator).
- - Fixed bug (#[\Attribute] validation should error on trait/interface/enum/abstract class).
- - Fixed bug (setlocale($type, NULL) should not be deprecated).
- - Fixed bug (UAF during array_splice).
- - Passing strings which are not one byte long to ord() is now deprecated.
- - Passing integers outside the interval [0, 255] to chr() is now deprecated.
- - The socket_set_timeout() alias function has been deprecated.
- - Passing null to readdir(), rewinddir(), and closedir() to use the last opened directory has been deprecated.
-
-- Streams:
-
- - Fixed bug (stream_select() timeout useless for pipes on Windows).
- - Fixed bug : XP_SOCKET XP_SSL (Socket stream modules): Incorrect condition for Win32/Win64.
- - Fixed bug (Closing a userspace stream inside a userspace handler causes heap corruption).
- - Avoid double conversion to string in php_userstreamop_readdir().
-
-- Tests:
-
- - Allow to shuffle tests even in non-parallel mode.
-
-- Tidy:
-
- - tidy::__construct/parseFile/parseString methods throw an exception if the configuration argument is invalid.
- - Fixed (improved tidyOptGetCategory detection).
-
-- Tokenizer:
-
- - Fixed bug (Corrupted result after recursive tokenization during token_get_all()).
-
-- URI:
-
- - Add new URI extension.
-
-- Windows:
-
- - Fixed bug (Improper long path support for relative paths).
- - Fixed bug (Windows phpize builds ignore source subfolders).
- - Fix (_get_osfhandle asserts in debug mode when given a socket).
-
-- XML:
-
- - The xml_parser_free() function has been deprecated.
-
-- XMLWriter:
-
- - Improved performance and reduce memory consumption.
-
-- XSL:
-
- - Implement request #30622 (make $namespace parameter functional).
-
-- Zlib:
-
- - gzfile, gzopen and readgzfile, their "use_include_path" argument is now a boolean.
- - Fixed bug (gzopen() does not use the default stream context when opening HTTP URLs).
- - Implemented (zlib streams should support locking).
-
-- Zip:
-
- - Fixed missing zend_release_fcall_info_cache on the following methods ZipArchive::registerProgressCallback() and ZipArchive::registerCancelCallback() on failure.
-
-
-
-
-
-
-
-
-
-Version 8.4.22
-
-- Date:
-
- - Fixed bug (int overflow in php_date_llabs).
-
-- Intl:
-
- - Fix incorrect argument positions in out-of-bounds errors for IntlCalendar::set(), IntlCalendar::setDate(), IntlCalendar::setDateTime(), and IntlGregorianCalendar date/time construction.
- - Expose Spoofchecker restriction-level APIs on all supported ICU versions.
- - Fix SpoofChecker::setAllowedChars() and IntlDateFormatter::__construct() to report PHP constant names instead of ICU constant names in user-visible error messages.
-
-- MySQLnd:
-
- - Fix persistent free of non-persistent connect_attr key (David Carlier).
-
-- Opcache:
-
- - Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
- - Fixed bug (Assertion failure at ext/opcache/jit/zend_jit_trace.c).
-
-- OpenSSL:
-
- - Fix compatibility issues with OpenSSL 4.0.
-
-- SPL:
-
- - Fix SplFixedArray::setSize leak when destructor grows during clear.
- - Fixed bug (use after free of self-freeing MultipleIterator children).
-
-- Standard:
-
- - Fixed bug (version_compare() incorrectly handles versions ending with a dot).
- - Fixed ip2long() leading zeros handling inconsistency on AIX.
-
-
-
-
-
-
-
-Version 8.4.21
-
-- Core:
-
- - Fixed bug (GC assertion failure with fibers, generators and destructors).
- - Fixed bug (Forward property operations to real instance for initialized lazy proxies).
- - Fixed bug (Missing addref for Countable::count()).
- - Fixed bug (Assertion failure in shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws).
- - Fixed bug (Missing addref for __unset).
- - Fixed bug (Trait with class constant name conflict against enum case causes SEGV).
-
-- CLI:
-
- - Fixed bug (`--rf` command line option with a method triggers ext/reflection deprecation warnings).
-
-- Curl:
-
- - Add support for brotli and zstd on Windows.
-
-- DOM:
-
- - Fixed and (Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS()). (CVE-2026-7263)
- - Fixed bug (segmentation fault on empty HTMLDocument).
- - Upgrade to lexbor v2.7.0.
-
-- FPM:
-
- - Fixed (XSS within status endpoint). (CVE-2026-6735)
-
-- Iconv:
-
- - Fixed bug (iconv memory leak on bailout).
-
-- MBString:
-
- - Fixed (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (CVE-2026-7259)
- - Fixed (Out-of-bounds access in mbfl_name2encoding_ex()). (CVE-2026-6104)
-
-- Opcache:
-
- - Fixed bug (JIT: Assertion jit->ra[var].flags & (1<<0) failed in zend_jit_use_reg).
- - Fixed bug (Borked function JIT JMPNZ smart branch).
- - Fixed bug (COND optimization regression).
- - Fixed faulty returns out of zend_try block in zend_jit_trace().
-
-- OpenSSL:
-
- - Fix a bunch of memory leaks and crashes on edge cases.
-
-- PDO_Firebird:
-
- - Fixed (SQL injection via NUL bytes in quoted strings). (CVE-2025-14179)
-
-- Phar:
-
- - Restore is_link handler in phar_intercept_functions_shutdown.
- - Fixed bug (phar: NULL dereference in Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment).
- - Fix memory leak in Phar::offsetGet().
- - Fix memory leak in phar_add_file().
- - Fixed bug (phar: propagate phar_stream_flush return value from phar_stream_close).
- - Fix memory leak in phar_verify_signature() when md_ctx is invalid.
-
-- Random:
-
- - Fixed bug (Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state).
-
-- Session:
-
- - Fixed memory leak when session GC callback return a refcounted value.
-
-- SOAP:
-
- - Fixed (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (CVE-2026-6722)
- - Fixed (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (CVE-2026-7261)
- - Fixed (Broken Apache map value NULL check). (CVE-2026-7262)
-
-- SPL:
-
- - Fixed bug (RecursiveArrayIterator getChildren UAF after parent free).
- - Fix concurrent iteration and deletion issues in SplObjectStorage.
-
-- Standard:
-
- - Fixed (Signed integer overflow of char array offset). (CVE-2026-7568)
- - Fixed (Consistently pass unsigned char to ctype.h functions). (CVE-2026-7258)
-
-- Streams:
-
- - Fixed bug (Segfault in file_get_contents w/ a https URL and a proxy set).
-
-- XSL:
-
- - Fixed bug (Segfault on module shutdown).
-
-- Zip:
-
- - Fixed bug (memory leak with ZipArchive::addGlob() early return statements).
-
-
-
-
-
-
-
-Version 8.4.20
-
-- Bz2:
-
- - Fix truncation of total output size causing erroneous errors.
-
-- Core:
-
- - Fixed bugs , , (Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies).
-
-- DOM:
-
- - Fixed bug (Dom\HTMLDocument parser mangles xml:space and xml:lang attributes).
-
-- FFI:
-
- - Fixed resource leak in FFI::cdef() onsymbol resolution failure.
-
-- GD:
-
- - Fixed bug (phpinfo() to display libJPEG 10.0 support).
-
-- Opcache:
-
- - Fixed bug (JIT compiler produces wrong arithmetic results).
- - Fixed bug (JIT tracing: infinite loop on FETCH_OBJ_R with IS_UNDEF property in polymorphic context).
- - Fixed bug (uaf in jit).
-
-- OpenSSL:
-
- - Fixed bug (Skip private_key_bits validation for EC/curve-based keys).
- - Fix missing error propagation for BIO_printf() calls.
-
-- PCRE:
-
- - Fixed re-entrancy issue on php_pcre_match_impl, php_pcre_replace_impl, php_pcre_split_impl, and php_pcre_grep_impl.
-
-- PGSQL:
-
- - Fixed preprocessor silently guarding PGSQL_SUPPRESS_TIMESTAMPS support due to a typo.
-
-- SNMP:
-
- - Fixed bug (SNMP::setSecurity() undefined behavior with NULL arguments).
-
-- SOAP:
-
- - Fixed Set-Cookie parsing bug wrong offset while scanning attributes.
-
-- SPL:
-
- - Fixed bug (missing write lock validation in SplHeap).
-
-- Standard:
-
- - Fixed bug (Assertion failure when messing up output buffers).
- - Fixed bug (Cannot identify some avif images with getimagesize).
-
-- Sysvshm:
-
- - Fix memory leak in shm_get_var() when variable is corrupted.
-
-- XSL:
-
- - Fix (XSLTProcessor works with DOMDocument, but fails with Dom\XMLDocument).
- - Fixed bug (UAF in dom_objects_free_storage).
-
-
-
-
-
-
-
-Version 8.4.19
-
-- Core:
-
- - Fixed bug (zend_mm_heap corrupted on Aarch64, LTO builds).
- - Fixed bug (Assertion failure in zend_lazy_object_get_info triggered by setRawValueWithoutLazyInitialization() and newLazyGhost()).
- - Fixed bug (Assertion failure in zend_get_property_guard when accessing properties on Reflection LazyProxy via isset()).
- - Fixed OSS-Fuzz #478009707 (Borked assign-op/inc/dec on untyped hooked property backing value).
- - Fixed bug (Build fails with -std=).
- - Fixed bug (Build system installs libtool wrappers when using slibtool).
-
-- Curl:
-
- - Fixed bug (CURLOPT_XFERINFOFUNCTION crash with a null callback).
- - Don't truncate length.
-
-- Date:
-
- - Fixed bug (DatePeriod::__set_state() cannot handle null start).
- - Fix timezone offset with seconds losing precision.
-
-- DOM:
-
- - Fixed bug (Accessing Dom\Node::baseURI can throw TypeError).
- - Fixed bug (Accessing Dom\Node properties can can throw TypeError).
-
-- MBString:
-
- - Fixed bug ; mb_guess_encoding no longer crashes when passed huge list of candidate encodings (with 200,000+ entries).
-
-- Opcache:
-
- - Fixed bug ("Insufficient shared memory" when using JIT on Solaris).
- - Fixed bug (Borked SCCP of array containing partial object).
- - Fixed bug (Preloaded constant erroneously propagated to file-cached script).
-
-- OpenSSL:
-
- - Fix a bunch of leaks and error propagation.
-
-- PCNTL:
-
- - Fixed pcntl_setns() internal errors handling regarding errnos.
- - Fixed cpuset leak in pcntl_setcpuaffinity on out-of-range CPU ID on NetBSD/Solaris platforms.
- - Fixed pcntl_signal() signal table registering the callback first OS-wise before the internal list.
- - Fixed pcntl_signal_dispatch() stale pointer and exception handling.
-
-- PCRE:
-
- - Fixed preg_match memory leak with invalid regexes.
-
-- PDO_PGSQL:
-
- - Fixed bug (connection attribute status typo for GSS negotiation).
-
-- PGSQL:
-
- - Fixed bug (pg_connect() memory leak on error).
-
-- Sockets:
-
- - Fixed bug (socket_set_option() crash with array 'addr' entry as null).
- - Fixed possible addr length overflow with socket_connect() and AF_UNIX family sockets.
-
-- Windows:
-
- - Fixed compilation with clang (missing intrin.h include).
-
-
-
-
-
-
-
-Version 8.4.18
-
-- Core:
-
- - Fixed bug (NULL dereference when calling ob_start() in shutdown function triggered by bailout in php_output_lock_error()).
- - Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber).
- - Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization).
- - Fixed bug GH- (Internal enums can be cloned and compared).
- - Fix OSS-Fuzz #474613951 (Leaked parent property default value).
- - Fixed bug (Use-after-free in FE_FREE with GC interaction).
- - Fix OSS-Fuzz #471486164 (Broken by-ref assignment to uninitialized hooked backing value).
- - Fix OSS-Fuzz #438780145 (Nested finally with repeated return type check may uaf).
- - Fixed bug (Lazy proxy bailing __clone assertion).
- - Fixed bug (Hooked object properties overflow).
-
-- Date:
-
- - Update timelib to 2022.16.
-
-- DOM:
-
- - Fixed (Dom\HTMLDocument corrupts closing tags within scripts).
-
-- MbString:
-
- - Fixed bug (mb_str_pad() divide by zero if padding string is invalid in the encoding).
- - Fixed bug (Stack overflow in mb_convert_variables with recursive array references).
-
-- Opcache:
-
- - Fixed bug (Segfault in Tracing JIT with object reference).
-
-- OpenSSL:
-
- - Fix memory leaks when sk_X509_new_null() fails.
- - Fix crash when in openssl_x509_parse() when i2s_ASN1_INTEGER() fails.
- - Fix crash in openssl_x509_parse() when X509_NAME_oneline() fails.
-
-- Phar:
-
- - Fixed bug (buildFromIterator breaks with missing base directory).
-
-- PGSQL:
-
- - Fixed INSERT/UPDATE queries building with PQescapeIdentifier() and possible UB.
-
-- Readline:
-
- - Fixed bug (Memory leak when overriding some settings via readline_info()).
-
-- SPL:
-
- - Fixed bug (heap-use-after-free in SplDoublyLinkedList iterator when modifying during iteration).
-
-- Standard:
-
- - (lchown fails to change ownership of symlink with ZTS) (Jakub Zelenka)
- - Fixed bug (var_dump() crash with nested objects) (David Carlier)
-
-
-
-
-
-
-
-Version 8.4.17
-
-- Core:
-
- - Fix OSS-Fuzz #465488618 (Wrong assumptions when dumping function signature with dynamic class const lookup default argument).
- - Fixed bug (Assertion failure in normalize_value() when parsing malformed INI input via parse_ini_string()).
- - Fixed bug (Uncatchable exception thrown in generator).
- - Fixed bug (UAF in php_output_handler_free via re-entrant ob_start() during error deactivation).
-
-- Bz2:
-
- - Fixed bug (bzcompress overflow on large source size).
-
-- DOM:
-
- - Fixed bug (Null pointer dereference in DOM namespace node cloning via clone on malformed objects).
- - Fixed bug (Dom\XMLDocument::C14N() seems broken compared to DOMDocument::C14N()).
-
-- GD:
-
- - Fixed bug (imagestring/imagestringup overflow).
-
-- Intl:
-
- - Fix leak in umsg_format_helper().
-
-- LDAP:
-
- - Fix memory leak in ldap_set_options().
-
-- Mbstring:
-
- - Fixed bug (mb_decode_mimeheader does not handle separator).
-
-- PCNTL:
-
- - Fixed bug with pcntl_getcpuaffinity() on solaris regarding invalid process ids handling.
-
-- Phar:
-
- - Fixed bug (Phar::LoadPhar undefined behavior when reading fails).
- - Fix SplFileInfo::openFile() in write mode.
- - Fix build on legacy OpenSSL 1.1.0 systems.
- - (Phar extractTo creates empty files).
-
-- POSIX:
-
- - Fixed crash on posix groups to php array creation on macos.
-
-- SPL:
-
- - Fixed bug (resource created by GlobIterator crashes with fclose()).
-
-- Sqlite3:
-
- - Fixed bug (SQLite3Result fetchArray return array|false, null returned).
-
-- Standard:
-
- - Fix error check for proc_open() command.
- - Fix memory leak in mail() when header key is numeric.
- - Fixed bug (Heap Buffer Overflow in iptcembed).
-
-- Zlib:
-
- - Fix OOB gzseek() causing assertion failure.
-
-
-
-
-
-
-
-Version 8.4.16
-
-- Core:
-
- - Sync all boost.context files with release 1.86.0.
- - Fixed bug (SensitiveParameter doesn't work for named argument passing to variadic parameter).
- - Fixed bug (use-after-destroy during userland stream_close()).
-
-- Bz2:
-
- - Fix assertion failures resulting in crashes with stream filter object parameters.
-
-- Date:
-
- - Fix crashes when trying to instantiate uninstantiable classes via date static constructors.
-
-- DOM:
-
- - Fix memory leak when edge case is hit when registering xpath callback.
- - Fixed bug (querySelector and querySelectorAll requires elements in $selectors to be lowercase).
- - Fix missing NUL byte check on C14NFile().
-
-- Fibers:
-
- - Fixed bug (ASAN stack overflow with fiber.stack_size INI small value).
-
-- FTP:
-
- - Fixed bug (ftp_connect overflow on timeout).
-
-- GD:
-
- - Fixed bug (imagegammacorrect out of range input/output values).
- - Fixed bug (imagescale overflow with large height values).
-
-- Intl:
-
- - Fixed bug (Spoofchecker::setRestrictionLevel() error message suggests missing constants).
-
-- LibXML:
-
- - Fix some deprecations on newer libxml versions regarding input buffer/parser handling.
-
-- MbString:
-
- - Fixed bug (SLES15 compile error with mbstring oniguruma).
- - Fixed bug (mbstring compile warning due to non-strings).
-
-- MySQLnd:
-
- - Fixed bug (Regression breaks mysql connexion using an IPv6 address enclosed in square brackets).
-
-- Opcache:
-
- - Fixed bug (opcache.file_cache broken with full interned string buffer).
-
-- PDO:
-
- - Fixed (PDO quoting result null deref). (CVE-2025-14180)
-
-- Phar:
-
- - Fixed bug (Phar does not respect case-insensitiveness of __halt_compiler() when reading stub).
- - Fix broken return value of fflush() for phar file entries.
- - Fix assertion failure when fseeking a phar file out of bounds.
-
-- PHPDBG:
-
- - Fixed ZPP type violation in phpdbg_get_executable() and phpdbg_end_oplog().
-
-- SPL:
-
- - Fixed bug (SplFixedArray incorrectly handles references in deserialization).
-
-- Standard:
-
- - Fix memory leak in array_diff() with custom type checks.
- - Fixed bug (Stack overflow in http_build_query via deep structures).
- - Fixed (Null byte termination in dns_get_record()).
- - Fixed (Heap buffer overflow in array_merge()). (CVE-2025-14178)
- - Fixed (Information Leak of Memory in getimagesize). (CVE-2025-14177)
-
-- Tidy:
-
- - Fixed bug (PHP with tidy and custom-tags).
-
-- XML:
-
- - Fixed bug (xml_set_default_handler() does not properly handle special characters in attributes when passing data to callback).
-
-- Zip:
-
- - Fix crash in property existence test.
- - Don't truncate return value of zip_fread() with user sizes.
-
-- Zlib:
-
- - Fix assertion failures resulting in crashes with stream filter object parameters.
-
-
-
-
-
-
-
-Version 8.4.15
-
-- Core:
-
- - Fixed bug (CGI with auto_globals_jit=0 causes uouv).
- - Fixed bug (Assertion failure in WeakMap offset operations on reference).
- - Fixed bug (Assertion failure when combining lazy object get_properties exception with foreach loop).
- - Fixed bug (Don't bail when closing resources on shutdown).
- - Fixed bug (Accessing overridden private property in get_object_vars() triggers assertion error).
- - Fixed bug (Broken parent hook call with named arguments).
- - Fixed bug (Stale EG(opline_before_exception) pointer through eval).
-
-- DOM:
-
- - Partially fixed bug (DOM classes do not allow __debugInfo() overrides to work).
- - Fixed bug (\Dom\Document::getElementById() is inconsistent after nodes are removed).
-
-- Exif:
-
- - Fix possible memory leak when tag is empty.
-
-- FPM:
-
- - Fixed bug (fpm_status_export_to_zval segfault for parallel execution).
-
-- FTP:
-
- - Fixed bug (FTP with SSL: ftp_fput(): Connection timed out on successful writes).
-
-- GD:
-
- - Fixed bug (Return type violation in imagefilter when an invalid filter is provided).
-
-- Intl:
-
- - Fix memory leak on error in locale_filter_matches().
-
-- LibXML:
-
- - Fix not thread safe schema/relaxng calls.
-
-- MySQLnd:
-
- - Fixed bug (SSL certificate verification fails (port doubled)).
- - Fixed bug (getColumnMeta() for JSON-column in MySQL).
-
-- Opcache:
-
- - Fixed bug (access to uninitialized vars in preload_load()).
- - Fixed bug (JIT broken in ZTS builds on MacOS 15).
- - Fixed bug (JIT 1205 segfault on large file compiled in subprocess).
- - Fixed bug (heap buffer overflow in jit).
- - Partially fixed bug (Avoid calling wrong function when reusing file caches across differing environments).
-
-- PgSql:
-
- - Fix memory leak when first string conversion fails.
- - Fix segfaults when attempting to fetch row into a non-instantiable class name.
-
-- Phar:
-
- - Fix memory leak of argument in webPhar.
- - Fix memory leak when setAlias() fails.
- - Fix a bunch of memory leaks in phar_parse_zipfile() error handling.
- - Fix file descriptor/memory leak when opening central fp fails.
- - Fix memleak+UAF when opening temp stream in buildFromDirectory() fails.
- - Fix potential buffer length truncation due to usage of type int instead of type size_t.
- - Fix memory leak when openssl polyfill returns garbage.
- - Fix file descriptor leak in phar_zip_flush() on failure.
- - Fix memory leak when opening temp file fails while trying to open gzip-compressed archive.
- - Fixed bug (Freeing a phar alias may invalidate PharFileInfo objects).
-
-- Random:
-
- - Fix Randomizer::__serialize() w.r.t. INDIRECTs.
-
-- Reflection:
-
- - Fixed bug (ReflectionClass::isIterable() incorrectly returns true for classes with property hooks).
-
-- SimpleXML:
-
- - Partially fixed bug (SimpleXML does not allow __debugInfo() overrides to work).
-
-- Streams:
-
- - Fixed bug : XP_SOCKET XP_SSL (Socket stream modules): Incorrect condition for Win32/Win64.
-
-- Tidy:
-
- - Fixed (improved tidyOptGetCategory detection).
- - Fix UAF in tidy when tidySetErrorBuffer() fails.
-
-- XMLReader:
-
- - Fix arginfo/zpp violations when LIBXML_SCHEMAS_ENABLED is not available.
-
-- Windows:
-
- - Fix (_get_osfhandle asserts in debug mode when given a socket).
-
-
-
-
-
-
-
-Version 8.4.14
-
-- Core:
-
- - Fixed bug (object_properties_load() bypasses readonly property checks).
- - Fixed hard_timeout with --enable-zend-max-execution-timers.
- - Fixed bug (SCCP causes UAF for return value if both warning and exception are triggered).
- - Fixed bug (Closure named argument unpacking between temporary closures can cause a crash).
- - Fixed bug (Incorrect HASH_FLAG_HAS_EMPTY_IND flag on userland array).
- - Fixed bug (error_log php.ini cannot be unset when open_basedir is configured).
- - Fixed bug (Broken build on *BSD with MSAN).
-
-- CLI:
-
- - Fix useless "Failed to poll event" error logs due to EAGAIN in CLI server with PHP_CLI_SERVER_WORKERS.
-
-- Curl:
-
- - Fix cloning of CURLOPT_POSTFIELDS when using the clone operator instead of the curl_copy_handle() function to clone a CurlHandle.
- - Fix curl build and test failures with version 8.16.
-
-- Date:
-
- - Fixed : "P" format for ::createFromFormat swallows string literals.
-
-- DOM:
-
- - Fix macro name clash on macOS.
- - Fixed bug (docker-php-ext-install DOM failed).
-
-- GD:
-
- - Fixed (imagefttext() memory leak).
-
-- MySQLnd:
-
- - (mysqli compiled with mysqlnd does not take ipv6 adress as parameter).
-
-- Opcache:
-
- - Fixed bug (assertion failure in zend_jit_trace_type_to_info_ex).
- - Fixed bug (function JIT may not deref property value).
- - Fixed bug (race condition in zend_runtime_jit(), zend_jit_hot_func()).
-
-- Phar:
-
- - Fix memory leak and invalid continuation after tar header writing fails.
- - Fix memory leaks when creating temp file fails when applying zip signature.
-
-- SimpleXML:
-
- - Fixed bug (zend_string_init with NULL pointer in simplexml (UB)).
-
-- Soap:
-
- - Fixed bug (SoapServer memory leak).
- - Fixed bug (Array of SoapVar of unknown type causes crash).
-
-- Standard:
-
- - Fixed bug (Cloning an object breaks serialization recursion).
- - Fixed bug (Serialize/deserialize loses some data).
- - Fixed bug (leaks in var_dump() and debug_zval_dump()).
- - Fixed bug (array_unique assertion failure with RC1 array causing an exception on sort).
- - Fixed bug (reset internal pointer earlier while splicing array while COW violation flag is still set).
- - Fixed bug (unable to fseek in /dev/zero and /dev/null).
-
-- Streams:
-
- - Fixed bug (Use strerror_r instead of strerror in main).
- - Fixed bug (Bug #35916 was not completely fixed).
- - Fixed bug (segmentation when attempting to flush on non seekable stream.
-
-- XMLReader:
-
- - Fixed bug (XMLReader leak on RelaxNG schema failure).
-
-- Zip:
-
- - Fixed bug (Remove pattern overflow in zip addGlob()).
- - Fixed bug (Memory leak in zip setEncryptionName()/setEncryptionIndex()).
-
-
-
-
-
-
-
-Version 8.4.13
-
-- Core:
-
- - Fixed bug (Repeated inclusion of file with __halt_compiler() triggers "Constant already defined" warning).
- - Partially fixed bug (Scanning of string literals >=2GB will fail due to signed int overflow).
- - Fixed bug (GC treats ZEND_WEAKREF_TAG_MAP references as WeakMap references).
- - Fixed bug (Stale array iterator pointer).
- - Fixed bug (zend_ssa_range_widening may fail to converge).
- - Fixed bug (PHP_EXPAND_PATH broken with bash 5.3.0).
- - Fixed bug (Assertion failure when error handler throws when accessing a deprecated constant).
-
-- CLI:
-
- - Fixed bug (Improve error message on listening error with IPv6 address).
-
-- Date:
-
- - Fixed date_sunrise() and date_sunset() with partial-hour UTC offset.
-
-- DBA:
-
- - Fixed bug (dba stream resource mismanagement).
-
-- DOM:
-
- - Fixed bug (Mitigate libxml2 tree dictionary bug).
-
-- FPM:
-
- - Fixed failed debug assertion when php_admin_value setting fails.
-
-- Intl:
-
- - Fixed bug (Fix locale strings canonicalization for IntlDateFormatter and NumberFormatter).
-
-- Opcache:
-
- - Fixed bug (JIT variable not stored before YIELD).
-
-- OpenSSL:
-
- - Fixed bug (Success error message on TLS stream accept failure).
-
-- PGSQL:
-
- - Fixed bug (potential use after free when using persistent pgsql connections).
-
-- Phar:
-
- - Fixed memory leaks when verifying OpenSSL signature.
- - Fix memory leak in phar tar temporary file error handling code.
- - Fix metadata leak when phar convert logic fails.
- - Fix memory leak on failure in phar_convert_to_other().
- - Fixed bug (Phar decompression with invalid extension can cause UAF).
-
-- Standard:
-
- - Fixed bug (UAF during array_splice).
- - Fixed bug (Avoid integer overflow when using a small offset and PHP_INT_MAX with LimitIterator).
-
-- Streams:
-
- - Remove incorrect call to zval_ptr_dtor() in user_wrapper_metadata().
- - Fix OSS-Fuzz #385993744.
-
-- Zip:
-
- - Fix memory leak in zip when encountering empty glob result.
-
-
-
-
-
-
-
-Version 8.4.12
-
-- Core:
-
- - Fixed build issue with C++17 and ZEND_STATIC_ASSERT macro.
- - Fixed bug (Duplicate property slot with hooks and interface property).
- - Fixed bug (Protected properties are not scoped according to their prototype).
- - Fixed bug (Coerce numeric string keys from iterators when argument unpacking).
- - Fixed OSS-Fuzz #434346548 (Failed assertion with throwing __toString in binary const expr).
- - Fixed bug (Operands may be being released during comparison).
- - Fixed bug (Unpacking empty packed array into uninitialized array causes assertion failure).
- - Fixed bug (Generator can be resumed while fetching next value from delegated Generator).
- - Fixed bug (Calling Generator::throw() on a running generator with a non-Generator delegate crashes).
- - Fixed bug (Stale array iterator position on rehashing).
- - Fixed bug (Circumvented type check with return by ref + finally).
- - Fixed bug (Long match statement can segfault compiler during recursive SSA renaming).
-
-- Calendar:
-
- - Fixed bug (integer overflow in calendar.c).
-
-- FTP:
-
- - Fix theoretical issues with hrtime() not being available.
-
-- GD:
-
- - Fix incorrect comparison with result of php_stream_can_cast().
-
-- Hash:
-
- - Fix crash on clone failure.
-
-- Intl:
-
- - Fix memleak on failure in collator_get_sort_key().
- - Fix return value on failure for resourcebundle count handler.
-
-- LDAP:
-
- - Fixed bug (additional inheriting of TLS int options).
-
-- LibXML:
-
- - Fixed bug (libxml<2.13 segmentation fault caused by php_libxml_node_free).
-
-- MbString:
-
- - Fixed bug (mb_list_encodings() can cause crashes on shutdown).
-
-- Opcache:
-
- - Reset global pointers to prevent use-after-free in zend_jit_status().
- - Fix issue with JIT restart and hooks.
- - Fix crash with dynamic function defs in hooks during preload.
-
-- OpenSSL:
-
- - Fixed bug (OpenSSL backend: incorrect RAND_{load,write}_file() return value check).
- - Fix error return check of EVP_CIPHER_CTX_ctrl().
- - Fixed bug (openssl_pkey_derive segfaults for DH derive with low key_length param).
-
-- PDO Pgsql:
-
- - Fixed dangling pointer access on _pdo_pgsql_trim_message helper.
-
-- SOAP:
-
- - Fixed bug (heap-use-after-free ext/soap/php_encoding.c:299:32 in soap_check_zval_ref).
-
-- Sockets:
-
- - Fix some potential crashes on incorrect argument value.
-
-- Standard:
-
- - Fixed OSS Fuzz #433303828 (Leak in failed unserialize() with opcache).
- - Fix theoretical issues with hrtime() not being available.
- - Fixed bug (Nested array_multisort invocation with error breaks).
-
-- Windows:
-
- - Free opened_path when opened_path_len >= MAXPATHLEN.
-
-
-
-
-
-
-
-Version 8.4.11
-
-- Calendar:
-
- - Fixed jewishtojd overflow on year argument.
-
-- Core:
-
- - Fixed bug (Use after free with weakmaps dependent on destruction order).
- - Fixed bug (Leak when creating cycle in hook).
- - Fix OSS-Fuzz #427814456.
- - Fix OSS-Fuzz #428983568 and #428760800.
- - Fixed bug (-Wuseless-escape warnings emitted by re2c).
- - Fixed bug (Undefined symbol 'execute_ex' on Windows ARM64).
-
-- Curl:
-
- - Fix memory leaks when returning refcounted value from curl callback.
- - Remove incorrect string release.
-
-- DOM:
-
- - Fixed bug (Dom\XMLDocument::createComment() triggers undefined behavior with null byte).
-
-- LDAP:
-
- - Fixed ldap_exop/ldap_exop_sync assert triggered on empty request OID.
-
-- MbString:
-
- - Fixed bug (integer overflow mb_split).
-
-- Opcache:
-
- - Fixed bug (Internal class aliases can break preloading + JIT).
- - Fixed bug (JIT function crash when emitting undefined variable warning and opline is not set yet).
- - Fixed bug (Segmentation fault on unknown address 0x600000000018 in ext/opcache/jit/zend_jit.c).
- - Fixed bug (SEGV zend_jit_op_array_hot with property hooks and preloading).
-
-- OpenSSL:
-
- - (It is not possible to get client peer certificate with stream_socket_server).
-
-- PCNTL:
-
- - Fixed bug (Fatal error during shutdown after pcntl_rfork() or pcntl_forkx() with zend-max-execution-timers).
-
-- Phar:
-
- - Fix stream double free in phar.
- - Fix phar crash and file corruption with SplFileObject.
-
-- SOAP:
-
- - Fixed bug , bug #81029, bug #47314 (SOAP HTTP socket not closing on object destruction).
- - Fix memory leak when URL parsing fails in redirect.
-
-- SPL:
-
- - Fixed bug (Attaching class with no Iterator implementation to MultipleIterator causes crash).
-
-- Standard:
-
- - Fix misleading errors in printf().
- - Fix RCN violations in array functions.
- - Fixed pack() overflow with h/H format and INT_MAX repeater value.
-
-- Streams:
-
- - Fixed (fgets() and stream_get_line() do not return false on filter fatal error).
-
-- Zip:
-
- - Fix leak when path is too long in ZipArchive::extractTo().
-
-
-
-
-
-
-
-Version 8.4.10
-
-- BcMath:
-
- - Fixed bug (Accessing a BcMath\Number property by ref crashes).
-
-- Core:
-
- - Fixed bugs and (Infinite recursion on deprecated attribute evaluation) and (Recursion protection for deprecation constants not released on bailout).
- - Fixed (zend_ast_export() - float number is not preserved).
- - Fix handling of references in zval_try_get_long().
- - Do not delete main chunk in zend_gc.
- - Fix compile issues with zend_alloc and some non-default options.
-
-- Curl:
-
- - Fix memory leak when setting a list via curl_setopt fails.
-
-- Date:
-
- - Fix leaks with multiple calls to DatePeriod iterator current().
-
-- DOM:
-
- - Fixed bug (classList works not correctly if copy HTMLElement by clone keyword).
-
-- FPM:
-
- - Fixed (fpm_get_status segfault).
-
-- Hash:
-
- - Fixed bug (PGO build fails with xxhash).
-
-- Intl:
-
- - Fix memory leak in intl_datetime_decompose() on failure.
- - Fix memory leak in locale lookup on failure.
-
-- Opcache:
-
- - Fixed bug (Incompatibility in Inline TLS Assembly on Alpine 3.22).
-
-- ODBC:
-
- - Fix memory leak on php_odbc_fetch_hash() failure.
-
-- OpenSSL:
-
- - Fix memory leak of X509_STORE in php_openssl_setup_verify() on failure.
- - (Requests through http proxy set peer name).
-
-- PGSQL:
-
- - Fixed (pgsql extension does not check for errors during escaping). (CVE-2025-1735)
- - Fix warning not being emitted when failure to cancel a query with pg_cancel_query().
-
-- PDO ODBC:
-
- - Fix memory leak if WideCharToMultiByte() fails.
-
-- PDO Sqlite:
-
- - Fixed memory leak with Pdo_Sqlite::createCollation when the callback has an incorrect return type.
-
-- Phar:
-
- - Add missing filter cleanups on phar failure.
- - Fixed bug (Signed integer overflow in ext/phar fseek).
-
-- PHPDBG:
-
- - Fix 'phpdbg --help' segfault on shutdown with USE_ZEND_ALLOC=0.
-
-- Random:
-
- - Fix reference type confusion and leak in user random engine.
-
-- Readline:
-
- - Fix memory leak when calloc() fails in php_readline_completion_cb().
-
-- SimpleXML:
-
- - Fixed bug (Heap-buffer-overflow in zend_alloc.c when assigning string with UTF-8 bytes).
-
-- SOAP:
-
- - Fix memory leaks in php_http.c when call_user_function() fails.
- - Fixed (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491)
-
-- Standard:
-
- - Fixed (Null byte termination in hostnames). (CVE-2025-1220)
-
-- Tidy:
-
- - Fix memory leak in tidy output handler on error.
- - Fix tidyOptIsReadonly deprecation, using tidyOptGetCategory.
-
-
-
-
-
-
-
-Version 8.4.8
-
-- Core:
-
- - Fixed (array_splice with large values for offset/length arguments).
- - Partially fixed (nested object comparisons leading to stack overflow).
- - Fixed OSS-Fuzz #417078295.
- - Fixed OSS-Fuzz #418106144.
-
-- Curl:
-
- - Fixed (curl_easy_setopt with CURLOPT_USERPWD/CURLOPT_USERNAME/ CURLOPT_PASSWORD set the Authorization header when set to NULL).
-
-- Date:
-
- - Fixed bug (Since PHP 8, the date_sun_info() function returns inaccurate sunrise and sunset times, but other calculated times are correct) (JiriJozif).
- - Fixed bug (date_sunrise with unexpected nan value for the offset).
-
-- DOM:
-
- - Backport lexbor/lexbor#274.
-
-- Intl:
-
- - Fix various reference issues.
-
-- LDAP:
-
- - Fixed bug (ldap no longer respects TLS_CACERT from ldaprc in ldap_start_tls()).
-
-- Opcache:
-
- - Fixed bug (Windows SHM reattachment fails when increasing memory_consumption or jit_buffer_size).
- - Fixed bug (Exception not handled when jit guard is triggered).
- - Fixed bug (Snapshotted poly_func / poly_this may be spilled).
- - Fixed bug (Preloading with internal class alias triggers assertion failure).
- - Fixed bug (FPM exit code 70 with enabled opcache and hooked properties in traits).
- - Fix leak of accel_globals->key.
-
-- OpenSSL:
-
- - Fix missing checks against php_set_blocking() in xp_ssl.c.
-
-- SPL:
-
- - Fixed bug (Integer overflow with large numbers in LimitIterator).
-
-- Standard:
-
- - Fixed bug (Potential deadlock when putenv fails).
- - Fixed bug (http_build_query type error is inaccurate).
- - Fixed bug (Dynamic calls to assert() ignore zend.assertions).
-
-- Windows:
-
- - Fix leak+crash with sapi_windows_set_ctrl_handler().
-
-- Zip:
-
- - Fixed bug (Registering ZIP progress callback twice doesn't work).
- - Fixed bug (Handling of empty data and errors in ZipArchive::addPattern).
-
-
-
-
-
-
-
-Version 8.4.7
-
-- Core:
-
- - Fixed bug (Lazy proxy calls magic methods twice).
- - Fixed bug (Use-after-free in extract() with EXTR_REFS).
- - Fixed bug (Segfault in array_walk() on object with added property hooks).
- - Fixed bug (Changing the properties of a DateInterval through dynamic properties triggers a SegFault).
- - Fix some leaks in php_scandir.
-
-- DBA:
-
- - FIxed bug dba_popen() memory leak on invalid path.
-
-- Filter:
-
- - Fixed bug (ipv6 filter integer overflow).
-
-- GD:
-
- - Fixed imagecrop() overflow with rect argument with x/width y/heigh usage in gdImageCrop().
- - Fixed imagettftext() overflow/underflow on font size value.
-
-- Intl:
-
- - Fix reference support for intltz_get_offset().
-
-- LDAP:
-
- - Fixed bug (LDAP_OPT_X_TLS_* options can't be overridden).
- - Fix NULL deref on high modification key.
-
-- libxml:
-
- - Fixed custom external entity loader returning an invalid resource leading to a confusing TypeError message.
-
-- Opcache:
-
- - Fixed bug (assertion failure zend_jit_ir.c).
- - Fixed bug (Fix segfault in JIT).
- - Fixed bug (tracing JIT floating point register clobbering on Windows and ARM64).
-
-- OpenSSL:
-
- - Fix memory leak in openssl_sign() when passing invalid algorithm.
- - Fix potential leaks when writing to BIO fails.
-
-- PDO Firebird:
-
- - Fixed bug (persistent connection - "zend_mm_heap corrupted" with setAttribute()) (SakiTakamachi).
- - Fixed bug (PDOException has wrong code and message since PHP 8.4) (SakiTakamachi).
-
-- PDO Sqlite:
-
- - Fix memory leak on error return of collation callback.
-
-- PgSql:
-
- - Fix uouv in pg_put_copy_end().
-
-- SPL:
-
- - Fixed bug (SplObjectStorage debug handler mismanages memory).
-
-- Standard:
-
- - Fixed bug (php8ts crashes in php_clear_stat_cache()).
- - Fix resource leak in iptcembed() on error.
-
-- Tests:
-
- - Address deprecated PHP 8.4 session options to prevent test failures.
-
-- Zip:
-
- - Fix uouv when handling empty options in ZipArchive::addGlob().
- - Fix memory leak when handling a too long path in ZipArchive::addGlob().
-
-
-
-
-
-
-
-Version 8.4.6
-
-- BCMath:
-
- - Fixed pointer subtraction for scale.
-
-- Core:
-
- - Fixed property hook backing value access in multi-level inheritance.
- - Fixed accidentally inherited default value in overridden virtual properties.
- - Fixed bug (Broken JIT polymorphism for property hooks added to child class).
- - Fixed bug (ReflectionFunction::isDeprecated() returns incorrect results for closures created from magic __call()).
- - Fixed bug (Stack-use-after-return with lazy objects and hooks).
- - Fixed bug (Incorrect handling of hooked props without get hook in get_object_vars()).
- - Fixed bug (Skipped lazy object initialization on primed SIMPLE_WRITE cache).
- - Fixed bug (Assignment to backing value in set hook of lazy proxy calls hook again).
- - Fixed bug (use-after-free during dl()'ed module class destruction).
- - Fixed bug (dl() of module with aliased class crashes in shutdown).
- - Fixed OSS-Fuzz #403308724.
- - Fixed bug again (Significant performance degradation in 'foreach').
-
-- DBA:
-
- - Fixed assertion violation when opening the same file with dba_open multiple times.
-
-- DOM:
-
- - Fixed bug (Assertion failure dom_attr_value_write).
- - Fix weird unpack behaviour in DOM.
- - Fixed bug (DOM: Svg attributes and tag names are being lowercased).
- - Fix xinclude destruction of live attributes.
-
-- Fuzzer:
-
- - Fixed bug (Memory leaks in error paths of fuzzer SAPI).
-
-- GD:
-
- - Fixed bug (calls with arguments as array with references).
-
-- LDAP:
-
- - Fixed bug (Error messages for ldap_mod_replace are confusing).
-
-- Mbstring:
-
- - Fixed bug (mb_output_handler crash with unset http_output_conv_mimetypes).
-
-- Opcache:
-
- - Fixed bug (Segfault with hook "simple get" cache slot and minimal JIT).
- - Fixed bug (Symfony JIT 1205 assertion failure).
- - Fixed bug (SEGV Zend/zend_execute.c).
- - Fixed bug (IN_ARRAY optimization in DFA pass is broken).
- - Fixed bug (stack-buffer-overflow ext/opcache/jit/ir/ir_sccp.c).
- - Fixed bug (NULL access with preloading and INI option).
- - Fixed bug (Opcache CFG jmp optimization with try-finally breaks the exception table).
-
-- PDO:
-
- - Fix memory leak when destroying PDORow.
-
-- Standard:
-
- - Fix memory leaks in array_any() / array_all().
-
-- SOAP:
-
- - (Typemap can break parsing in parse_packet_soap leading to a segfault) .
-
-- SPL:
-
- - Fixed bug (RC1 data returned from offsetGet causes UAF in ArrayObject).
-
-- Treewide:
-
- - Fixed bug (Assertion failure zend_reference_destroy()).
-
-- Windows:
-
- - Fixed bug (zend_vm_gen.php shouldn't break on Windows line endings).
-
-
-
-
-
-
-
-Version 8.4.5
-
-- BCMath:
-
- - Fixed bug (bcmul memory leak).
-
-- Core:
-
- - Fixed bug (Broken stack overflow detection for variable compilation).
- - Fixed bug (UnhandledMatchError does not take zend.exception_ignore_args=1 into account).
- - Fix fallback paths in fast_long_{add,sub}_function.
- - Fixed bug OSS-Fuzz #391975641 (Crash when accessing property backing value by reference).
- - Fixed bug (Calling static methods on an interface that has `__callStatic` is allowed).
- - Fixed bug (ReflectionProperty::getRawValue() and related methods may call hooks of overridden properties).
- - Fixed bug (Final abstract properties should error).
- - Fixed bug (zend_mm_heap corrupted error after upgrading from 8.4.3 to 8.4.4).
- - Fixed (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)
-
-- DOM:
-
- - Fixed bug (Typo in error message: Dom\NO_DEFAULT_NS instead of Dom\HTML_NO_DEFAULT_NS).
- - Fixed bug (\Dom\HTMLDocument querySelector attribute name is case sensitive in HTML).
- - Fixed bug (xinclude destroys live node).
- - Fix using Dom\Node with Dom\XPath callbacks.
-
-- GD:
-
- - Fixed bug (imagescale with both width and height negative values triggers only an Exception on width).
- - Fixed bug (imagepalettetotruecolor crash with memory_limit=2M).
-
-- FFI:
-
- - Fix FFI Parsing of Pointer Declaration Lists.
-
-- FPM:
-
- - Fixed bug (FPM with httpd ProxyPass encoded PATH_INFO env).
-
-- LDAP:
-
- - Fixed bug (ldap_search fails when $attributes contains a non-packed array with numerical keys).
-
-- LibXML:
-
- - Fixed (Reocurrence of #72714).
- - Fixed (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
-
-- MBString:
-
- - Fixed bug (Undefined float conversion in mb_convert_variables).
-
-- Opcache:
-
- - Fixed bug (Multiple classes using same trait causes function JIT crash).
- - Fixed bug (JIT packed type guard crash).
- - Fixed bug (Exception on reading property in register-based FETCH_OBJ_R breaks JIT).
- - Fixed bug (Null pointer deref in observer API when calling cases() method on preloaded enum).
- - Fixed bug (Cannot allocate memory with tracing JIT on 8.4.4).
-
-- PDO_SQLite:
-
- - Fixed ()::getColumnMeta() on unexecuted statement segfaults).
- - Fix cycle leak in sqlite3 setAuthorizer().
- - Fix memory leaks in pdo_sqlite callback registration.
-
-- Phar:
-
- - Fixed bug : PharFileInfo refcount bug.
-
-- PHPDBG:
-
- - Partially fixed bug (Trivial crash in phpdbg lexer).
- - Fix memory leak in phpdbg calling registered function.
-
-- Reflection:
-
- - Fixed bug (Core dumped in ext/reflection/php_reflection.c).
- - Fixed missing final and abstract flags when dumping properties.
-
-- Standard:
-
- - (stat cache clearing inconsistent between file:// paths and plain paths).
-
-- Streams:
-
- - Fixed bug (realloc with size 0 in user_filters.c).
- - Fix memory leak on overflow in _php_stream_scandir().
- - Fixed (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
- - Fixed (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
- - Fixed (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
- - Fixed (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
-
-- Windows:
-
- - Fixed phpize for Windows 11 (24H2).
- - Fixed (CURL_STATICLIB flag set even if linked with shared lib).
-
-- Zlib:
-
- - Fixed bug (zlib extension incorrectly handles object arguments).
- - Fix memory leak when encoding check fails.
- - Fix zlib support for large files.
-
-
-
-
-
-
-
-Version 8.4.4
-
-- Core:
-
- - Fixed bug (Numeric parent hook call fails with assertion).
- - Fixed bug (ini_parse_quantity() fails to parse inputs starting with 0x0b).
- - Fixed bug (ini_parse_quantity() fails to emit warning for 0x+0).
- - Fixed bug (__PROPERTY__ magic constant does not work in all constant expression contexts).
- - Fixed bug (Relax final+private warning for trait methods with inherited final).
- - Fixed NULL arithmetic during system program execution on Windows.
- - Fixed potential OOB when checking for trailing spaces on Windows.
- - Fixed bug (Assertion failure Zend/zend_exceptions.c).
- - Fix may_have_extra_named_args flag for ZEND_AST_UNPACK.
- - Fix NULL arithmetic in System V shared memory emulation for Windows.
- - Fixed bug (#[\Deprecated] does not work for __call() and __callStatic()).
-
-- DOM:
-
- - Fixed bug (Assertion failure ext/dom/php_dom.c).
- - Fixed bug (Incorrect error line numbers reported in Dom\HTMLDocument::createFromString).
- - Fixed bug (UTF-8 corruption in \Dom\HTMLDocument).
- - Fixed bug (Segfault with requesting nodeName on nameless doctype).
- - Fixed bug (upstream fix, Self-closing tag on void elements shouldn't be a parse error/warning in \Dom\HTMLDocument).
- - Fixed bug (getElementsByTagName returns collections with tagName-based indexing).
-
-- Enchant:
-
- - Fix crashes in enchant when passing null bytes.
-
-- FTP:
-
- - Fixed bug (ftp functions can abort with EINTR).
-
-- GD:
-
- - Fixed bug (Tiled truecolor filling looses single color transparency).
- - Fixed bug (imagefttext() ignores clipping rect for palette images).
- - Ported fix for libgd 223 (gdImageRotateGeneric() does not properly interpolate).
- - Added support for reading GIFs without colormap to bundled libgd.
-
-- Gettext:
-
- - Fixed bug (bindtextdomain SEGV on invalid domain).
-
-- Intl:
-
- - Fixed bug (intl causing segfault in docker images).
-
-- Opcache:
-
- - Fixed bug (Segfault with frameless jumps and minimal JIT).
- - Fixed bug (Internal closure causes JIT failure).
- - Fixed bug (Assertion failure ext/opcache/jit/zend_jit_ir.c:8940).
- - Fixed bug (Potential UB when reading from / writing to struct padding).
-
-- PCNTL:
-
- - Fixed pcntl_setcpuaffinity exception type from ValueError to TypeError for the cpu mask argument with entries type different than int/string.
-
-- PCRE:
-
- - Fixed bug (memory leak in regex).
-
-- PDO:
-
- - Fixed a memory leak when the GC is used to free a PDOStatment.
- - Fixed a crash in the PDO Firebird Statement destructor.
- - Fixed UAFs when changing default fetch class ctor args.
-
-- PgSql:
-
- - Fixed build failure when the constant PGRES_TUPLES_CHUNK is not present in the system.
-
-- Phar:
-
- - Fixed bug (offset overflow phar extractTo()).
-
-- PHPDBG:
-
- - Fix crashes in function registration + test.
-
-- Session:
-
- - Fix type confusion with session SID constant.
- - Fixed bug (ext/session NULL pointer dereferencement during ID reset).
-
-- SimpleXML:
-
- - Fixed bug (Assertion failure Zend/zend_hash.c:1730).
-
-- SNMP:
-
- - Fixed bug (SNMP::setSecurity segfault on closed session).
-
-- SPL:
-
- - Fixed bug (Segmentation fault (access null pointer) in ext/spl/spl_array.c).
- - Fixed bug (SplFileTempObject::getPathInfo() Undefined behavior on invalid class).
-
-- Standard:
-
- - Fixed bug (Assertion failure when array popping a self addressing variable).
-
-- Windows:
-
- - Fixed clang compiler detection.
-
-- Zip:
-
- - Fixed bug (Fix zip_entry_name() crash on invalid entry).
-
-
-
-
-
-
-
-Version 8.4.3
-
-- BcMath:
-
- - Fixed bug (Correctly compare 0 and -0).
- - Fixed bug (Now Number::round() does not remove trailing zeros).
- - Fixed bug (Correctly round rounding mode with zero edge case).
- - Fixed bug (Fixed the calculation logic of dividend scale).
-
-- Core:
-
- - Fixed bug OSS-Fuzz #382922236 (Duplicate dynamic properties in hooked object iterator properties table).
- - Fixed unstable get_iterator pointer for hooked classes in shm on Windows.
- - Fixed bug (ZEND_MATCH_ERROR misoptimization).
- - Fixed bug (zend_array_try_init() with dtor can cause engine UAF).
- - Fixed bug (AST->string does not reproduce constructor property promotion correctly).
- - Fixed bug (Incorrect dynamic prop offset in hooked prop iterator).
- - Fixed bug (Trampoline crash on error).
-
-- DBA:
-
- - Skip test if inifile is disabled.
-
-- DOM:
-
- - Fixed bug (DOM memory leak).
- - Fixed bug (Dom\TokenList issues with interned string replace).
- - Fixed bug (UAF in importNode).
-
-- Embed:
-
- - Make build command for program using embed portable.
-
-- FFI:
-
- - (FFI header parser chokes on comments).
- - Fix memory leak on ZEND_FFI_TYPE_CHAR conversion failure.
- - Fixed bug and bug #80857 (Big endian issues).
-
-- Fileinfo:
-
- - Fixed bug (PHP 8.4: Incorrect MIME content type).
-
-- FPM:
-
- - Fixed bug (FPM: ERROR: scoreboard: failed to lock (already locked)).
- - Fixed bug (Macro redefinitions).
- - Fixed bug (bug64539-status-json-encoding.phpt fail on 32-bits).
-
-- GD:
-
- - Fixed bug (Unexpected nan value in ext/gd/libgd/gd_filter.c).
- - Ported fix for libgd bug 276 (Sometimes pixels are missing when storing images as BMPs).
-
-- Gettext:
-
- - Fixed bug (Segmentation fault ext/gettext/gettext.c bindtextdomain()).
-
-- Iconv:
-
- - Fixed bug (UAF on iconv filter failure).
-
-- LDAP:
-
- - Fixed bug (ldap_search() fails when $attributes array has holes).
-
-- LibXML:
-
- - Fixed bug (Memory leak in libxml encoding handling).
-
-- MBString:
-
- - Fixed bug (Macro redefinitions).
-
-- Opcache:
-
- - opcache_get_configuration() properly reports jit_prof_threshold.
- - Fixed bug (Assertion failure in JIT trace exit with ZEND_FETCH_DIM_FUNC_ARG).
- - Fixed bug (Incorrect RC inference of op1 of FETCH_OBJ and INIT_METHOD_CALL).
- - Fixed bug (GC during SCCP causes segfault).
- - Fixed bug (UBSAN warning in ext/opcache/jit/zend_jit_vm_helpers.c).
-
-- PCNTL:
-
- - Fix memory leak in cleanup code of pcntl_exec() when a non stringable value is encountered past the first entry.
-
-- PgSql:
-
- - Fixed bug (pg_fetch_result Shows Incorrect ArgumentCountError Message when Called With 1 Argument).
- - Fixed further ArgumentCountError for calls with flexible number of arguments.
-
-- Phar:
-
- - Fixed bug (Segmentation fault ext/phar/phar.c).
-
-- SimpleXML:
-
- - Fixed bug (SimpleXML's unset can break DOM objects).
- - Fixed bug (SimpleXML crash when using autovivification on document).
-
-- Sockets:
-
- - Fixed bug (socket_strerror overflow handling with INT_MIN).
- - Fixed overflow on SO_LINGER values setting, strengthening values check on SO_SNDTIMEO/SO_RCVTIMEO for socket_set_option().
-
-- SPL:
-
- - Fixed bug (SplFixedArray assertion failure with get_object_vars).
- - Fixed bug (NULL deref in spl_directory.c).
-
-- Streams:
-
- - Fixed bug (UAF in user filter when adding existing filter name due to incorrect error handling).
- - Fixed bug (overflow on fopen HTTP wrapper timeout value).
- - Fixed bug (glob:// wrapper doesn't cater to CWD for ZTS builds).
-
-- Windows:
-
- - Hardened proc_open() against cmd.exe hijacking.
-
-- XML:
-
- - Fixed bug (unreachable program point in zend_hash).
-
-
-
-
-
-
-
-Version 8.4.2
-
-- BcMath:
-
- - Fixed bug (Avoid unnecessary padding with leading zeros) (Saki Takamachi)
-
-- Calendar:
-
- - Fixed jdtogregorian overflow.
- - Fixed cal_to_jd julian_days argument overflow.
-
-- COM:
-
- - Fixed bug (Getting typeinfo of non DISPATCH variant segfaults).
-
-- Core:
-
- - Fail early in *nix configuration build script.
- - Fixed bug (setRawValueWithoutLazyInitialization() and skipLazyInitialization() may change initialized proxy).
- - Fixed bug (Opcache bad signal 139 crash in ZTS bookworm (frankenphp)).
- - Fixed bug (Assertion failure at Zend/zend_vm_execute.h:7469).
- - Fixed bug (UAF in lexer with encoding translation and heredocs).
- - Fix is_zend_ptr() huge block comparison.
- - Fixed potential OOB read in zend_dirname() on Windows.
- - Fixed bug (printf() can strip sign of -INF).
-
-- Curl:
-
- - Fixed bug (open_basedir bypass using curl extension).
- - Fix various memory leaks in curl mime handling.
-
-- DBA:
-
- - Fixed bug (dba_list() is now zero-indexed instead of using resource ids) (kocsismate)
-
-- DOM:
-
- - Fixed bug (Calling the constructor again on a DOM object after it is in a document causes UAF).
- - Fixed bug (Reloading document can cause UAF in iterator).
-
-- FPM:
-
- - Fixed (PHP-FPM 8.2 SIGSEGV in fpm_get_status).
- - Fixed bug (wrong FPM status output).
-
-- GD:
-
- - Fixed (imagecreatefromstring overflow).
-
-- GMP:
-
- - Fixed bug (array_sum() with GMP can loose precision (LLP64)).
-
-- Hash:
-
- - Fixed : Segfault in mhash().
-
-- Opcache:
-
- - Fixed bug (JIT_G(enabled) not set correctly on other threads).
- - Fixed bug (Set of opcache tests fail zts+aarch64).
- - Fixed bug (JIT dead code skipping does not update call_level).
-
-- OpenSSL:
-
- - Prevent unexpected array entry conversion when reading key.
- - Fix various memory leaks related to openssl exports.
- - Fix memory leak in php_openssl_pkey_from_zval().
-
-- PDO:
-
- - Fixed memory leak of `setFetchMode()`.
-
-- Phar:
-
- - Fixed bug (phar:// tar parser and zero-length file header blocks).
-
-- PHPDBG:
-
- - Fixed bug (Segfault with breakpoint map and phpdbg_clear()).
-
-- SAPI:
-
- - Fixed bug (UBSAN warning in rfc1867).
-
-- SimpleXML:
-
- - Fixed bug (Segmentation fault in RecursiveIteratorIterator ->current() with a xml element input).
-
-- SOAP:
-
- - Fix make check being invoked in ext/soap.
-
-- Standard:
-
- - Fixed bug (Internal iterator functions can't handle UNDEF properties).
- - Fixed bug (Assertion failure in array_shift with self-referencing array).
-
-- Streams:
-
- - Fixed network connect poll interuption handling.
-
-- Windows:
-
- - Fixed bug (Error dialog causes process to hang).
- - Windows Server 2025 is now properly reported.
-
-
-
-
-
-
-
-Version 8.4.1
-
-- BcMath:
-
- - [RFC] Add bcfloor, bcceil and bcround to BCMath.
- - Improve performance.
- - Adjust bcround()'s $mode parameter to only accept the RoundingMode enum.
- - Fixed LONG_MAX in BCMath ext.
- - Fixed bcdiv() div by one.
- - [RFC] Support object types in BCMath.
- - bcpow() performance improvement.
- - ext/bcmath: Check for scale overflow.
- - [RFC] ext/bcmath: Added bcdivmod.
- - Fix (Avoid converting objects to strings in operator calculations).
- - Fixed bug (Added early return case when result is 0) (Saki Takamachi).
- - Fixed bug (Fixed a bug where size_t underflows) (Saki Takamachi).
- - Fixed (Fixed a bug in BcMath\Number::pow() and bcpow() when raising negative powers of 0) (Saki Takamachi).
-
-- Core:
-
- - Added zend_call_stack_get implementation for NetBSD, DragonFlyBSD, Solaris and Haiku.
- - Enabled ifunc checks on FreeBSD from the 12.x releases.
- - Changed the type of PHP_DEBUG and PHP_ZTS constants to bool.
- - Fixed bug (Undefined variable name is shortened when contains \0).
- - Fixed bug (Iterator positions incorrect when converting packed array to hashed).
- - Fixed zend fiber build for solaris default mode (32 bits).
- - Fixed zend call stack size for macOs/arm64.
- - Added support for Zend Max Execution Timers on FreeBSD.
- - Ensure fiber stack is not backed by THP.
- - Implement (Dump wrapped object in WeakReference class).
- - Added sparc64 arch assembly support for zend fiber.
- - Fixed no space available for TLS on NetBSD.
- - Added fiber Sys-V loongarch64 support.
- - Adjusted closure names to include the parent function's name.
- - Improve randomness of uploaded file names and files created by tempnam().
- - Added gc and shutdown callbacks to zend_mm custom handlers.
- - Fixed bug (Compute the size of pages before allocating memory).
- - Fixed bug (The --enable-re2c-cgoto doesn't add the -g flag).
- - Added the #[\Deprecated] attribute.
- - Fixed (Allow suspending fibers in destructors).
- - Fixed bug (Fix build for armv7).
- - Implemented property hooks RFC.
- - Fix (The xmlreader extension phpize build).
- - Throw Error exception when encountering recursion during comparison, rather than fatal error.
- - Added missing cstddef include for C++ builds.
- - Updated build system scripts config.guess to 2024-07-27 and config.sub to 2024-05-27.
- - Fixed bug (Infinite recursion in trait hook).
- - Fixed bug (Missing variance check for abstract set with asymmetric type).
- - Fixed bug (Disabled output handler is flushed again).
- - Passing E_USER_ERROR to trigger_error() is now deprecated.
- - Fixed bug (Dynamic AVX detection is broken for MSVC).
- - Using "_" as a class name is now deprecated.
- - Exiting a namespace now clears seen symbols.
- - The exit (and die) language constructs now behave more like a function. They can be passed liked callables, are affected by the strict_types declare statement, and now perform the usual type coercions instead of casting any non-integer value to a string. As such, passing invalid types to exit/die may now result in a TypeError being thrown.
- - Fixed bug (Hooks on constructor promoted properties without visibility are ignored).
- - Fixed bug (Missing readonly+hook incompatibility check for readonly classes).
- - Fixed bug (Various hooked object iterator issues).
- - Fixed bug (Crash in get_class_vars() on virtual properties).
- - Fixed bug (Windows HAVE_<header>_H macros defined to 1 or undefined).
- - Implemented asymmetric visibility for properties.
- - Fixed bug (Asymmetric visibility doesn't work with hooks).
- - Implemented lazy objects RFC.
- - Fixed bug (Building shared iconv with external iconv library).
- - Fixed missing error when adding asymmetric visibility to unilateral virtual property.
- - Fixed bug (Unnecessary include in main.c bloats binary).
- - Fixed bug (AllowDynamicProperties validation should error on enums).
- - Fixed bug (Use-after-free of object released in hook).
- - Fixed bug (Reuse of dtor fiber during shutdown).
- - Fixed bug (zend_std_write_property() assertion failure with lazy objects).
- - Fixed bug (Foreach edge cases with lazy objects).
- - Fixed bug (Various hooked object iterator issues).
- - Fixed bug OSS-Fuzz #371445205 (Heap-use-after-free in attr_free).
- - Fixed missing error when adding asymmetric visibility to static properties.
- - Fixed bug OSS-Fuzz #71407 (Null-dereference WRITE in zend_lazy_object_clone).
- - Fixed bug (Incorrect error "undefined method" messages).
- - Fixed bug (EG(strtod_state).freelist leaks with opcache.preload).
- - Fixed bug (Assertion failure in zend_std_read_property).
- - Fixed bug (Added ReflectionProperty::isLazy()).
- - Fixed bug (Incorrect access check for non-hooked props in hooked object iterator).
-
-- Curl:
-
- - Deprecated the CURLOPT_BINARYTRANSFER constant.
- - Bumped required libcurl version to 7.61.0.
- - Added feature_list key to the curl_version() return value.
- - Added constants CURL_HTTP_VERSION_3 (libcurl 7.66) and CURL_HTTP_VERSION_3ONLY (libcurl 7.88) as options for CURLOPT_HTTP_VERSION (Ayesh Karunaratne)
- - Added CURLOPT_TCP_KEEPCNT to set the number of probes to send before dropping the connection.
- - Added CURLOPT_PREREQFUNCTION Curl option to set a custom callback after the connection is established, but before the request is performed.
- - Added CURLOPT_SERVER_RESPONSE_TIMEOUT, which was formerly known as CURLOPT_FTP_RESPONSE_TIMEOUT.
- - The CURLOPT_DNS_USE_GLOBAL_CACHE option is now silently ignored.
- - Added CURLOPT_DEBUGFUNCTION as a Curl option.
- - Fixed bug (crash with curl_setopt* CURLOPT_WRITEFUNCTION without null callback).
- - Fixed bug (CURLMOPT_PUSHFUNCTION issues).
-
-- Date:
-
- - Added DateTime[Immutable]::createFromTimestamp.
- - Added DateTime[Immutable]::[get|set]Microsecond.
- - Constants SUNFUNCS_RET_TIMESTAMP, SUNFUNCS_RET_STRING, and SUNFUNCS_RET_DOUBLE are now deprecated.
- - Fixed bug (DatePeriod not taking into account microseconds for end date).
-
-- DBA:
-
- - Passing null or false to dba_key_split() is deprecated.
-
-- Debugging:
-
- - Fixed bug (GDB: Python Exception <class 'TypeError'>: exceptions must derive from BaseException).
-
-- DOM:
-
- - Added DOMNode::compareDocumentPosition().
- - Implement #53655 (Improve speed of DOMNode::C14N() on large XML documents).
- - Fix cloning attribute with namespace disappearing namespace.
- - Implement DOM HTML5 parsing and serialization RFC.
- - Fix DOMElement->prefix with empty string creates bogus prefix.
- - Handle OOM more consistently.
- - Implemented "Improve callbacks in ext/dom and ext/xsl" RFC.
- - Added DOMXPath::quote() static method.
- - Implemented opt-in ext/dom spec compliance RFC.
- - (getElementById does not correctly work with duplicate definitions).
- - Implemented "New ext-dom features in PHP 8.4" RFC.
- - Fixed (segfault on DOM node dereference).
- - Improve support for template elements.
- - Fix trampoline leak in xpath callables.
- - Throw instead of silently failing when creating a too long text node in (DOM)ParentNode and (DOM)ChildNode.
- - Fixed bug (Segmentation fault in dom extension (html5_serializer)).
- - Deprecated DOM_PHP_ERR constant.
- - Removed DOMImplementation::getFeature().
- - Fixed bug (Element::$substitutedNodeValue test failed).
- - Fixed bug (Segmentation fault (access null pointer) in ext/dom/html5_serializer.c).
- - Fixed bug (Storing DOMElement consume 4 times more memory in PHP 8.1 than in PHP 8.0).
- - Fix XML serializer errata: xmlns="" serialization should be allowed.
- - Fixed bug (Assertion failure in ext/dom/element.c).
- - Fix unsetting DOM properties.
- - Fixed bug (Using reflection to call Dom\Node::__construct causes assertion failure).
- - Fix edge-case in DOM parsing decoding.
- - Fixed bug (Heap buffer overflow in DOMNode->getElementByTagName).
- - Fixed bug (Assertion failure in DOM -> before).
-
-- Fileinfo:
-
- - Update to libmagic 5.45.
- - (PHP fails to compile ext/fileinfo).
-
-- FPM:
-
- - Implement (flush headers without body when calling flush()).
- - Added DragonFlyBSD system to the list which set FPM_BACKLOG_DEFAULT to SOMAXCONN.
- - /dev/poll events.mechanism for Solaris/Illumos setting had been retired.
- - Added memory peak to the scoreboard / status page.
-
-- FTP:
-
- - Removed the deprecated inet_ntoa call support.
- - (Upload speed 10 times slower with PHP).
-
-- GD:
-
- - Fix parameter numbers and missing alpha check for imagecolorset().
- - imagepng/imagejpeg/imagewep/imageavif now throw an exception on invalid quality parameter.
- - Check overflow/underflow for imagescale/imagefilter.
- - Added gdImageClone to bundled libgd.
-
-- Gettext:
-
- - bind_textdomain_codeset, textdomain and d(*)gettext functions now throw an exception on empty domain.
-
-- GMP:
-
- - The GMP class is now final and cannot be extended anymore.
- - RFC: Change GMP bool cast behavior.
-
-- Hash:
-
- - Changed return type of hash_update() to true.
- - Added HashContext::__debugInfo().
- - Deprecated passing incorrect data types for options to ext/hash functions.
- - Added SSE2 and SHA-NI implementation of SHA-256.
- - Fix (Build fails on Alpine / Musl for amd64).
- - Fixed bug (php_hash_sha.h incompatible with C++).
-
-- IMAP:
-
-- Intl:
-
- - Added IntlDateFormatter::PATTERN constant.
- - Fixed Numberformatter::__construct when the locale is invalid, now throws an exception.
- - Added NumberFormatter::ROUND_TOWARD_ZERO and ::ROUND_AWAY_FROM_ZERO as aliases for ::ROUND_DOWN and ::ROUND_UP.
- - Added NumberFormatter::ROUND_HALFODD.
- - Added PROPERTY_IDS_UNARY_OPERATOR, PROPERTY_ID_COMPAT_MATH_START and PROPERTY_ID_COMPAT_MATH_CONTINUE constants.
- - Added IntlDateFormatter::getIanaID/intltz_get_iana_id method/function.
- - Set to C++17 standard for icu 74 and onwards.
- - resourcebundle_get(), ResourceBundle::get(), and accessing offsets on a ResourceBundle object now throw: - TypeError for invalid offset types - ValueError for an empty string - ValueError if the integer index does not fit in a signed 32 bit integer
- - ResourceBundle::get() now has a tentative return type of: ResourceBundle|array|string|int|null
- - Added the new Grapheme function grapheme_str_split.
- - Added IntlDateFormatter::parseToCalendar.
- - Added SpoofChecker::setAllowedChars to set unicode chars ranges.
-
-- LDAP:
-
- - Added LDAP_OPT_X_TLS_PROTOCOL_MAX/LDAP_OPT_X_TLS_PROTOCOL_TLS1_3 constants.
-
-- LibXML:
-
- - Added LIBXML_RECOVER constant.
- - libxml_set_streams_context() now throws immediately on an invalid context instead of at the use-site.
- - Added LIBXML_NO_XXE constant.
-
-- MBString:
-
- - Added mb_trim, mb_ltrim and mb_rtrim.
- - Added mb_ucfirst and mb_lcfirst.
- - Updated Unicode data tables to Unicode 15.1.
- - Fixed bug (mb_detect_encoding(): Argument $encodings contains invalid encoding "UTF8").
- - Updated Unicode data tables to Unicode 16.0.
-
-- Mysqli:
-
- - The mysqli_ping() function and mysqli::ping() method are now deprecated, as the reconnect feature was removed in PHP 8.2.
- - The mysqli_kill() function and mysqli::kill() method are now deprecated. If this functionality is needed a SQL "KILL" command can be used instead.
- - The mysqli_refresh() function and mysqli::refresh() method are now deprecated. If this functionality is needed a SQL "FLUSH" command can be used instead.
- - Passing explicitly the $mode parameter to mysqli_store_result() has been deprecated. As the MYSQLI_STORE_RESULT_COPY_DATA constant was only used in conjunction with this function it has also been deprecated.
-
-- MySQLnd:
-
- - Fixed bug (PDO quote bottleneck).
- - Fixed bug (Apache crash on Windows when using a self-referencing anonymous function inside a class with an active mysqli connection).
-
-- Opcache:
-
- - Added large shared segments support for FreeBSD.
- - If JIT is enabled, PHP will now exit with a fatal error on startup in case of JIT startup initialization issues.
- - Increased the maximum value of opcache.interned_strings_buffer to 32767 on 64bit archs.
- - Fixed bug (Applying non-zero offset 36 to null pointer in zend_jit.c).
- - Fixed bug (Deep recursion in zend_cfg.c causes segfault).
- - Fixed bug (PHP 8.4 min function fails on typed integer).
- - Fixed bug (Building of callgraph modifies preloaded symbols).
- - Fixed bug (Assertion in tracing JIT on hooks).
- - Fixed bug (Segmentation fault in dasm_x86.h).
- - Added opcache_jit_blacklist() function.
- - Fixed bug (Segmentation fault with frameless functions and undefined CVs).
- - Fixed bug (Assertion failure in Zend/zend_operators.c).
- - Fixed bug (Incorrect result with reflection in low-trigger JIT).
- - Fixed (Error on building Opcache JIT for Windows ARM64).
-
-- OpenSSL:
-
- - (OpenSSL sets Subject wrong with extraattribs parameter).
- - Implement request #48520 (openssl_csr_new - allow multiple values in DN).
- - Introduced new serial_hex parameter to openssl_csr_sign.
- - Added X509_PURPOSE_OCSP_HELPER and X509_PURPOSE_TIMESTAMP_SIGN constants.
- - Bumped minimum required OpenSSL version to 1.1.1.
- - Added compile-time option --with-openssl-legacy-provider to enable legacy provider.
- - Added support for Curve25519 + Curve448 based keys.
- - Fixed bug (openssl_x509_parse should not allow omitted seconds in UTCTimes).
- - Bumped minimum required OpenSSL version to 1.1.0.
- - Implement PASSWORD_ARGON2 from OpenSSL 3.2.
-
-- Output:
-
- - Clear output handler status flags during handler initialization.
- - Fixed bug with url_rewriter.hosts not used by output_add_rewrite_var().
-
-- PCNTL:
-
- - Added pcntl_setns for Linux.
- - Added pcntl_getcpuaffinity/pcntl_setcpuaffinity.
- - Updated pcntl_get_signal_handler signal id upper limit to be more in line with platforms limits.
- - Added pcntl_getcpu for Linux/FreeBSD/Solaris/Illumos.
- - Added pcntl_getqos_class/pcntl_setqos_class for macOs.
- - Added SIGCKPT/SIGCKPTEXIT constants for DragonFlyBSD.
- - Added FreeBSD's SIGTRAP handling to pcntl_siginfo_to_zval.
- - Added POSIX pcntl_waitid.
- - Fixed bug : (pcntl_sigwaitinfo aborts on signal value as reference).
-
-- PCRE:
-
- - Upgrade bundled pcre2lib to version 10.43.
- - Add "/r" modifier.
- - Upgrade bundled pcre2lib to version 10.44.
- - Fixed (underflow on offset argument).
- - Fix UAF issues with PCRE after request shutdown.
-
-- PDO:
-
- - Fixed setAttribute and getAttribute.
- - Implemented PDO driver-specific subclasses RFC.
- - Added support for PDO driver-specific SQL parsers.
- - Fixed bug (Compilation failure on pdo_* extensions).
- - mysqlnd: support ER_CLIENT_INTERACTION_TIMEOUT.
- - The internal header php_pdo_int.h is no longer installed; it is not supposed to be used by PDO drivers.
- - Fixed bug (Prevent mixing PDO sub-classes with different DSN).
- - Fixed bug ("Pdo\Mysql object is uninitialized" when opening a persistent connection).
-
-- PDO_DBLIB:
-
- - Fixed setAttribute and getAttribute.
- - Added class Pdo\DbLib.
-
-- PDO_Firebird:
-
- - Fixed setAttribute and getAttribute.
- - Feature: Add transaction isolation level and mode settings to pdo_firebird.
- - Added class Pdo\Firebird.
- - Added Pdo\Firebird::ATTR_API_VERSION.
- - Added getApiVersion() and removed from getAttribute().
- - Supported Firebird 4.0 datatypes.
- - Support proper formatting of time zone types.
- - Fixed (Always make input parameters nullable).
-
-- PDO_MYSQL:
-
- - Fixed setAttribute and getAttribute.
- - Added class Pdo\Mysql.
- - Added custom SQL parser.
- - Fixed (PDO_MySQL not properly quoting PDO_PARAM_LOB binary data).
-
-- PDO_ODBC:
-
- - Added class Pdo\Odbc.
-
-- PDO_PGSQL:
-
- - Fixed , DSN credentials being prioritized over the user/password PDO constructor arguments.
- - Fixed native float support with pdo_pgsql query results.
- - Added class Pdo\Pgsql.
- - Retrieve the memory usage of the query result resource.
- - Added Pdo\Pgsql::setNoticeCallBack method to receive DB notices.
- - Added custom SQL parser.
- - Fixed (Double-free due to Pdo\Pgsql::setNoticeCallback()).
- - Fixed (Using PQclosePrepared when available instead of the DEALLOCATE command to free statements resources).
- - Remove PGSQL_ATTR_RESULT_MEMORY_SIZE constant as it is provided by the new PDO Subclass as Pdo\Pgsql::ATTR_RESULT_MEMORY_SIZE.
-
-- PDO_SQLITE:
-
- - Added class Pdo\Sqlite.
- - (PDO::inTransaction reports false when in transaction).
- - Added custom SQL parser.
-
-- PHPDBG:
-
- - array out of bounds, stack overflow handled for segfault handler on windows.
- - Fixed bug (Support stack limit in phpdbg).
-
-- PGSQL:
-
- - Added the possibility to have no conditions for pg_select.
- - Persistent connections support the PGSQL_CONNECT_FORCE_RENEW flag.
- - Added pg_result_memory_size to get the query result memory usage.
- - Added pg_change_password to alter an user's password.
- - Added pg_put_copy_data/pg_put_copy_end to send COPY commands and signal the end of the COPY.
- - Added pg_socket_poll to poll on the connection.
- - Added pg_jit to get infos on server JIT support.
- - Added pg_set_chunked_rows_size to fetch results per chunk.
- - pg_convert/pg_insert/pg_update/pg_delete ; regexes are now cached.
-
-- Phar:
-
- - Fixed bug (PharData created from zip has incorrect timestamp).
-
-- POSIX:
-
- - Added POSIX_SC_CHILD_MAX and POSIX_SC_CLK_TCK constants.
- - Updated posix_isatty to set the error number on file descriptors.
-
-- PSpell:
-
-- Random:
-
- - Fixed bug (php_random_default_engine() is not C++ conforming).
- - lcg_value() is now deprecated.
-
-- Readline:
-
- - Fixed readline_info, rl_line_buffer_length/rl_len globals on update.
- - (Shared readline build fails).
- - Fixed UAF with readline_info().
-
-- Reflection:
-
- - Implement (Show attribute name/class in ReflectionAttribute dump).
- - Make ReflectionGenerator::getFunction() legal after generator termination.
- - Added ReflectionGenerator::isClosed().
- - Fixed bug (Segfault on ReflectionProperty::get{Hook,Hooks}() on dynamic properties).
- - Fixed bug (ReflectionProperty::isInitialized() is incorrect for hooked properties).
- - Add missing ReflectionProperty::hasHook[s]() methods.
- - Add missing ReflectionProperty::isFinal() method.
- - Fixed bug (The return value of ReflectionFunction::getNamespaceName() and ReflectionFunction::inNamespace() for closures is incorrect).
- - Fixed bug (No ReflectionProperty::IS_VIRTUAL) (DanielEScherzer)
- - Fixed the name of the second parameter of ReflectionClass::resetAsLazyGhost().
-
-- Session:
-
- - INI settings session.sid_length and session.sid_bits_per_character are now deprecated.
- - Emit warnings for non-positive values of session.gc_divisor and negative values of session.gc_probability.
- - Fixed bug (UAF in session_encode()).
-
-- SimpleXML:
-
- - Fix signature of simplexml_import_dom().
-
-- SNMP:
-
- - Removed the deprecated inet_ntoa call support.
-
-- SOAP:
-
- - Add support for clark notation for namespaces in class map.
- - Mitigate #51561 (SoapServer with a extented class and using sessions, lost the setPersistence()).
- - (SoapClient::__getLastResponseHeaders returns NULL if wsdl operation !has output).
- - (PHP DateTime not converted to xsd:datetime).
- - Fixed bug (soap with session persistence will silently fail when "session" built as a shared object).
- - Passing an int to SoapServer::addFunction() is now deprecated. If all PHP functions need to be provided flatten the array returned by get_defined_functions().
- - The SOAP_FUNCTIONS_ALL constant is now deprecated.
- - (SOAP functions require at least one space after HTTP header colon).
- - Implement request #47317 (SoapServer::__getLastResponse()).
-
-- Sockets:
-
- - Removed the deprecated inet_ntoa call support.
- - Added the SO_EXECLUSIVEADDRUSE windows constant.
- - Added the SOCK_CONN_DGRAM/SOCK_DCCP netbsd constants.
- - Added multicast group support for ipv4 on FreeBSD.
- - Added the TCP_SYNCNT constant for Linux to set number of attempts to send SYN packets from the client.
- - Added the SO_EXCLBIND constant for exclusive socket binding on illumos/solaris.
- - Updated the socket_create_listen backlog argument default value to SOMAXCONN.
- - Added the SO_NOSIGPIPE constant to control the generation of SIGPIPE for macOs and FreeBSD.
- - Added SO_LINGER_SEC for macOs, true equivalent of SO_LINGER in other platforms.
- - Add close-on-exec on socket created with socket_accept on unixes.
- - Added IP_PORTRANGE* constants for BSD systems to control ephemeral port ranges.
- - Added SOCK_NONBLOCK/SOCK_CLOEXEC constants for socket_create and socket_create_pair to apply O_NONBLOCK/O_CLOEXEC flags to the newly created sockets.
- - Added SO_BINDTOIFINDEX to bind a socket to an interface index.
-
-- Sodium:
-
- - Add support for AEGIS-128L and AEGIS-256.
- - Enable AES-GCM on aarch64 with the ARM crypto extensions.
-
-- SPL:
-
- - Implement SeekableIterator for SplObjectStorage.
- - The SplFixedArray::__wakeup() method has been deprecated as it implements __serialize() and __unserialize() which need to be overwritten instead.
- - Passing a non-empty string for the $escape parameter of: - SplFileObject::setCsvControl() - SplFileObject::fputcsv() - SplFileObject::fgetcsv() is now deprecated.
-
-- Standard:
-
- - Implement (Indication for the int size in phpinfo()).
- - Partly fix (Incorrect round() result for 0.49999999999999994).
- - Fix (round(): Validate the rounding mode).
- - Increase the default BCrypt cost to 12.
- - Fixed bug (strcspn() odd behaviour with NUL bytes and empty mask).
- - Removed the deprecated inet_ntoa call support.
- - Cast large floats that are within int range to int in number_format so the precision is not lost.
- - Add support for 4 new rounding modes to the round() function.
- - debug_zval_dump() now indicates whether an array is packed.
- - Fix (Optimize round).
- - Changed return type of long2ip to string from string|false.
- - Fix (Extend the maximum precision round can handle by one digit).
- - Added the http_get_last_response_headers() and http_clear_last_response_headers() that allows retrieving the same content as the magic $http_response_header variable.
- - Add php_base64_encode_ex() API.
- - Implemented "Raising zero to the power of negative number" RFC.
- - Added array_find(), array_find_key(), array_all(), and array_any().
- - Change highlight_string() and print_r() return type to string|true.
- - Fix references in request_parse_body() options array.
- - Add RoundingMode enum.
- - Unserializing the uppercase 'S' tag is now deprecated.
- - Enables crc32 auxiliary detection on OpenBSD.
- - Passing a non-empty string for the $escape parameter of: - fputcsv() - fgetcsv() - str_getcsv() is now deprecated.
- - The str_getcsv() function now throws ValueErrors when the $separator and $enclosure arguments are not one byte long, or if the $escape is not one byte long or the empty string. This aligns the behaviour to be identical to that of fputcsv() and fgetcsv().
- - php_uname() now throws ValueErrors on invalid inputs.
- - The "allowed_classes" option for unserialize() now throws TypeErrors and ValueErrors if it is not an array of class names.
- - Implemented (improve proc_open error reporting on Windows).
- - Add support for backed enums in http_build_query().
- - Fixed bug (Assertion failure with array_find when references are involved).
- - Fixed parameter names of fpow() to be identical to pow().
-
-- Streams:
-
- - Implemented (Stream context is lost when custom stream wrapper is being filtered).
-
-- Tidy:
-
- - Failures in the constructor now throw exceptions rather than emitting warnings and having a broken object.
- - Add tidyNode::getNextSibling() and tidyNode::getPreviousSibling().
-
-- Windows:
-
- - Update the icon of the Windows executables, e.g. php.exe.
- - Fixed bug (GREP_HEADER() is broken).
-
-- XML:
-
- - Added XML_OPTION_PARSE_HUGE parser option.
- - (xml_get_current_byte_index limited to 32-bit numbers on 64-bit builds).
- - The xml_set_object() function has been deprecated.
- - Passing non-callable strings to the xml_set_*_handler() functions is now deprecated.
-
-- XMLReader:
-
- - Declares class constant types.
- - Add XMLReader::fromStream(), XMLReader::fromUri(), XMLReader::fromString().
- - Fixed bug (var_dump doesn't actually work on XMLReader).
-
-- XMLWriter:
-
- - Add XMLWriter::toStream(), XMLWriter::toUri(), XMLWriter::toMemory().
-
-- XSL:
-
- - Implement request #64137 (XSLTProcessor::setParameter() should allow both quotes to be used).
- - Implemented "Improve callbacks in ext/dom and ext/xsl" RFC.
- - Added XSLTProcessor::$maxTemplateDepth and XSLTProcessor::$maxTemplateVars.
- - Fix trampoline leak in xpath callables.
-
-- Zip:
-
- - Added ZipArchive::ER_TRUNCATED_ZIP added in libzip 1.11.
-
-
-
-
-
-
-
-
-
-Version 8.3.31
-
-- Curl:
-
- - Add support for brotli and zstd on Windows.
-
-- FPM:
-
- - Fixed (XSS within status endpoint). (CVE-2026-6735)
-
-- MBString:
-
- - Fixed (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (CVE-2026-7259)
-
-- OpenSSL:
-
- - Fix compatibility issues with OpenSSL 4.0.
-
-- PDO_Firebird:
-
- - Fixed (SQL injection via NUL bytes in quoted strings). (CVE-2025-14179)
-
-- SOAP:
-
- - Fixed (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (CVE-2026-6722)
- - Fixed (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (CVE-2026-7261)
- - Fixed (Broken Apache map value NULL check). (CVE-2026-7262)
-
-- Standard:
-
- - Fixed (Signed integer overflow of char array offset). (CVE-2026-7568)
- - Fixed (Consistently pass unsigned char to ctype.h functions). (CVE-2026-7258)
-
-
-
-
-
-
-
-Version 8.3.30
-
-- Core:
-
- - Fix OSS-Fuzz #465488618 (Wrong assumptions when dumping function signature with dynamic class const lookup default argument).
- - Fixed bug (Assertion failure in normalize_value() when parsing malformed INI input via parse_ini_string()).
- - Fixed bug (Uncatchable exception thrown in generator).
- - Fixed bug (UAF in php_output_handler_free via re-entrant ob_start() during error deactivation).
-
-- Bz2:
-
- - Fixed bug (bzcompress overflow on large source size).
-
-- DOM:
-
- - Fixed bug (Null pointer dereference in DOM namespace node cloning via clone on malformed objects).
-
-- GD:
-
- - Fixed bug (imagestring/imagestringup overflow).
-
-- Intl:
-
- - Fix leak in umsg_format_helper().
-
-- LDAP:
-
- - Fix memory leak in ldap_set_options().
-
-- Mbstring:
-
- - Fixed bug (mb_decode_mimeheader does not handle separator).
-
-- Phar:
-
- - Fixed bug (Phar::LoadPhar undefined behavior when reading fails).
- - Fix SplFileInfo::openFile() in write mode.
- - Fix build on legacy OpenSSL 1.1.0 systems.
-
-- POSIX:
-
- - Fixed crash on posix groups to php array creation on macos.
-
-- SPL:
-
- - Fixed bug (resource created by GlobIterator crashes with fclose()).
-
-- Sqlite3:
-
- - Fixed bug (SQLite3Result fetchArray return array|false, null returned).
-
-- Standard:
-
- - Fix error check for proc_open() command.
- - Fixed bug (Heap Buffer Overflow in iptcembed).
-
-- Zlib:
-
- - Fix OOB gzseek() causing assertion failure.
-
-
-
-
-
-
-
-Version 8.3.29
-
-- Core:
-
- - Sync all boost.context files with release 1.86.0.
- - Fixed bug (SensitiveParameter doesn't work for named argument passing to variadic parameter).
- - Fixed bug (use-after-destroy during userland stream_close()).
-
-- Bz2:
-
- - Fix assertion failures resulting in crashes with stream filter object parameters.
-
-- Date:
-
- - Fix crashes when trying to instantiate uninstantiable classes via date static constructors.
-
-- DOM:
-
- - Fix missing NUL byte check on C14NFile().
-
-- Fibers:
-
- - Fixed bug (ASAN stack overflow with fiber.stack_size INI small value).
-
-- FTP:
-
- - Fixed bug (ftp_connect overflow on timeout).
-
-- GD:
-
- - Fixed bug (imagegammacorrect out of range input/output values).
- - Fixed bug (imagescale overflow with large height values).
-
-- Intl:
-
- - Fixed bug (Spoofchecker::setRestrictionLevel() error message suggests missing constants).
-
-- LibXML:
-
- - Fix some deprecations on newer libxml versions regarding input buffer/parser handling.
-
-- MbString:
-
- - Fixed bug (SLES15 compile error with mbstring oniguruma).
- - Fixed bug (mbstring compile warning due to non-strings).
-
-- MySQLnd:
-
- - Fixed bug (Regression breaks mysql connexion using an IPv6 address enclosed in square brackets).
-
-- Opcache:
-
- - Fixed bug (opcache.file_cache broken with full interned string buffer).
-
-- PDO:
-
- - Fixed (PDO quoting result null deref). (CVE-2025-14180)
-
-- Phar:
-
- - Fixed bug (Phar does not respect case-insensitiveness of __halt_compiler() when reading stub).
- - Fix broken return value of fflush() for phar file entries.
- - Fix assertion failure when fseeking a phar file out of bounds.
-
-- PHPDBG:
-
- - Fixed ZPP type violation in phpdbg_get_executable() and phpdbg_end_oplog().
-
-- SPL:
-
- - Fixed bug (SplFixedArray incorrectly handles references in deserialization).
-
-- Standard:
-
- - Fix memory leak in array_diff() with custom type checks.
- - Fixed bug (Stack overflow in http_build_query via deep structures).
- - Fixed (Null byte termination in dns_get_record()).
- - Fixed (Heap buffer overflow in array_merge()). (CVE-2025-14178)
- - Fixed (Information Leak of Memory in getimagesize). (CVE-2025-14177)
-
-- Tidy:
-
- - Fixed bug (PHP with tidy and custom-tags).
-
-- XML:
-
- - Fixed bug (xml_set_default_handler() does not properly handle special characters in attributes when passing data to callback).
-
-- Zip:
-
- - Fix crash in property existence test.
- - Don't truncate return value of zip_fread() with user sizes.
-
-- Zlib:
-
- - Fix assertion failures resulting in crashes with stream filter object parameters.
-
-
-
-
-
-
-
-Version 8.3.28
-
-- Core:
-
- - Fixed bug (CGI with auto_globals_jit=0 causes uouv).
- - Fixed bug (Assertion failure in WeakMap offset operations on reference).
- - Fixed bug (Don't bail when closing resources on shutdown).
- - Fixed bug (Accessing overridden private property in get_object_vars() triggers assertion error).
- - Fixed bug (Stale EG(opline_before_exception) pointer through eval).
-
-- DOM:
-
- - Partially fixed bug (DOM classes do not allow __debugInfo() overrides to work).
-
-- Exif:
-
- - Fix possible memory leak when tag is empty.
-
-- FPM:
-
- - Fixed bug (fpm_status_export_to_zval segfault for parallel execution).
-
-- FTP:
-
- - Fixed bug (FTP with SSL: ftp_fput(): Connection timed out on successful writes).
-
-- GD:
-
- - Fixed bug (Return type violation in imagefilter when an invalid filter is provided).
-
-- Intl:
-
- - Fix memory leak on error in locale_filter_matches().
-
-- LibXML:
-
- - Fix not thread safe schema/relaxng calls.
-
-- MySQLnd:
-
- - Fixed bug (SSL certificate verification fails (port doubled)).
- - Fixed bug (getColumnMeta() for JSON-column in MySQL).
-
-- Opcache:
-
- - Fixed bug (access to uninitialized vars in preload_load()).
- - Fixed bug (JIT broken in ZTS builds on MacOS 15).
-
-- PgSql:
-
- - Fix memory leak when first string conversion fails.
- - Fix segfaults when attempting to fetch row into a non-instantiable class name.
-
-- Phar:
-
- - Fix memory leak of argument in webPhar.
- - Fix memory leak when setAlias() fails.
- - Fix a bunch of memory leaks in phar_parse_zipfile() error handling.
- - Fix file descriptor/memory leak when opening central fp fails.
- - Fix memleak+UAF when opening temp stream in buildFromDirectory() fails.
- - Fix potential buffer length truncation due to usage of type int instead of type size_t.
- - Fix memory leak when openssl polyfill returns garbage.
- - Fix file descriptor leak in phar_zip_flush() on failure.
- - Fix memory leak when opening temp file fails while trying to open gzip-compressed archive.
- - Fixed bug (Freeing a phar alias may invalidate PharFileInfo objects).
-
-- Random:
-
- - Fix Randomizer::__serialize() w.r.t. INDIRECTs.
-
-- SimpleXML:
-
- - Partially fixed bug (SimpleXML does not allow __debugInfo() overrides to work).
-
-- Standard:
-
- - Fix shm corruption with coercion in options of unserialize().
-
-- Streams:
-
- - Fixed bug : XP_SOCKET XP_SSL (Socket stream modules): Incorrect condition for Win32/Win64.
-
-- Tidy:
-
- - Fixed (improved tidyOptGetCategory detection).
- - Fix UAF in tidy when tidySetErrorBuffer() fails.
-
-- XMLReader:
-
- - Fix arginfo/zpp violations when LIBXML_SCHEMAS_ENABLED is not available.
-
-- Windows:
-
- - Fix (_get_osfhandle asserts in debug mode when given a socket).
-
-- Zip:
-
- - Fix memory leak when passing enc_method/enc_password is passed as option for ZipArchive::addGlob()/addPattern() and with consecutive calls.
-
-
-
-
-
-
-
-Version 8.3.27
-
-- Core:
-
- - Fixed bug (object_properties_load() bypasses readonly property checks).
- - Fixed hard_timeout with --enable-zend-max-execution-timers.
- - Fixed bug (SCCP causes UAF for return value if both warning and exception are triggered).
- - Fixed bug (Closure named argument unpacking between temporary closures can cause a crash).
- - Fixed bug (Incorrect HASH_FLAG_HAS_EMPTY_IND flag on userland array).
- - Fixed bug (error_log php.ini cannot be unset when open_basedir is configured).
- - Fixed bug (Broken build on *BSD with MSAN).
-
-- CLI:
-
- - Fix useless "Failed to poll event" error logs due to EAGAIN in CLI server with PHP_CLI_SERVER_WORKERS.
-
-- Curl:
-
- - Fix cloning of CURLOPT_POSTFIELDS when using the clone operator instead of the curl_copy_handle() function to clone a CurlHandle.
- - Fix curl build and test failures with version 8.16.
-
-- Date:
-
- - Fixed : "P" format for ::createFromFormat swallows string literals.
-
-- DBA:
-
- - Fixed (dba_fetch() overflow on skip argument).
-
-- GD:
-
- - Fixed (imagefttext() memory leak).
-
-- MySQLnd:
-
- - (mysqli compiled with mysqlnd does not take ipv6 adress as parameter).
-
-- Phar:
-
- - Fix memory leak and invalid continuation after tar header writing fails.
- - Fix memory leaks when creating temp file fails when applying zip signature.
-
-- SimpleXML:
-
- - Fixed bug (zend_string_init with NULL pointer in simplexml (UB)).
-
-- Soap:
-
- - Fixed bug (SoapServer memory leak).
- - Fixed bug (Array of SoapVar of unknown type causes crash).
-
-- Standard:
-
- - Fixed bug (Cloning an object breaks serialization recursion).
- - Fixed bug (Serialize/deserialize loses some data).
- - Fixed bug (leaks in var_dump() and debug_zval_dump()).
- - Fixed bug (array_unique assertion failure with RC1 array causing an exception on sort).
- - Fixed bug (reset internal pointer earlier while splicing array while COW violation flag is still set).
- - Fixed bug (unable to fseek in /dev/zero and /dev/null).
-
-- Streams:
-
- - Fixed bug (Use strerror_r instead of strerror in main).
- - Fixed bug (Bug #35916 was not completely fixed).
- - Fixed bug (segmentation when attempting to flush on non seekable stream.
-
-- XMLReader:
-
- - Fixed bug (XMLReader leak on RelaxNG schema failure).
-
-- Zip:
-
- - Fixed bug (Remove pattern overflow in zip addGlob()).
- - Fixed bug (Memory leak in zip setEncryptionName()/setEncryptionIndex()).
-
-- Zlib:
-
- - Fixed bug (Double free on gzopen).
-
-
-
-
-
-
-
-Version 8.3.26
-
-- Core:
-
- - Fixed bug (Repeated inclusion of file with __halt_compiler() triggers "Constant already defined" warning).
- - Partially fixed bug (Scanning of string literals >=2GB will fail due to signed int overflow).
- - Fixed bug (GC treats ZEND_WEAKREF_TAG_MAP references as WeakMap references).
- - Fixed bug (Stale array iterator pointer).
- - Fixed bug (zend_ssa_range_widening may fail to converge).
- - Fixed bug (PHP_EXPAND_PATH broken with bash 5.3.0).
- - Fixed bug (Assertion failure when error handler throws when accessing a deprecated constant).
-
-- CLI:
-
- - Fixed bug (Improve error message on listening error with IPv6 address).
-
-- Date:
-
- - Fixed date_sunrise() and date_sunset() with partial-hour UTC offset.
-
-- DOM:
-
- - Fixed bug (Mitigate libxml2 tree dictionary bug).
-
-- FPM:
-
- - Fixed failed debug assertion when php_admin_value setting fails.
-
-- GD:
-
- - Fixed bug (imagefilledellipse underflow on width argument).
-
-- Intl:
-
- - Fixed bug (Fix locale strings canonicalization for IntlDateFormatter and NumberFormatter).
-
-- OpenSSL:
-
- - Fixed bug (Success error message on TLS stream accept failure).
-
-- PGSQL:
-
- - Fixed bug (potential use after free when using persistent pgsql connections).
-
-- Phar:
-
- - Fixed memory leaks when verifying OpenSSL signature.
- - Fix memory leak in phar tar temporary file error handling code.
- - Fix metadata leak when phar convert logic fails.
- - Fix memory leak on failure in phar_convert_to_other().
- - Fixed bug (Phar decompression with invalid extension can cause UAF).
-
-- Standard:
-
- - Fixed bug (UAF during array_splice).
- - Fixed bug (Avoid integer overflow when using a small offset and PHP_INT_MAX with LimitIterator).
-
-- Streams:
-
- - Remove incorrect call to zval_ptr_dtor() in user_wrapper_metadata().
- - Fix OSS-Fuzz #385993744.
-
-- Tidy:
-
- - Fixed build issue with libtidy in regard of tidyOptIsReadonly deprecation and TidyInternalCategory being available later than tidyOptGetCategory.
-
-- Zip:
-
- - Fix memory leak in zip when encountering empty glob result.
-
-
-
-
-
-
-
-Version 8.3.25
-
-- Core:
-
- - Fixed build issue with C++17 and ZEND_STATIC_ASSERT macro.
- - Fixed bug (Coerce numeric string keys from iterators when argument unpacking).
- - Fixed OSS-Fuzz #434346548 (Failed assertion with throwing __toString in binary const expr).
- - Fixed bug (Operands may be being released during comparison).
- - Fixed bug (Unpacking empty packed array into uninitialized array causes assertion failure).
- - Fixed bug (Generator can be resumed while fetching next value from delegated Generator).
- - Fixed bug (Calling Generator::throw() on a running generator with a non-Generator delegate crashes).
- - Fixed bug (Circumvented type check with return by ref + finally).
- - Fixed zend call stack size for macOs/arm64.
- - Fixed bug (Long match statement can segfault compiler during recursive SSA renaming).
-
-- Calendar:
-
- - Fixed bug (integer overflow in calendar.c).
-
-- FTP:
-
- - Fix theoretical issues with hrtime() not being available.
-
-- GD:
-
- - Fix incorrect comparison with result of php_stream_can_cast().
-
-- Hash:
-
- - Fix crash on clone failure.
-
-- Intl:
-
- - Fixed : msgfmt_parse_message leaks on message creation failure.
- - Fix return value on failure for resourcebundle count handler.
-
-- LDAP:
-
- - Fixed bug (additional inheriting of TLS int options).
-
-- LibXML:
-
- - Fixed bug (libxml<2.13 segmentation fault caused by php_libxml_node_free).
-
-- MbString:
-
- - Fixed bug (mb_list_encodings() can cause crashes on shutdown).
-
-- Opcache:
-
- - Reset global pointers to prevent use-after-free in zend_jit_status().
-
-- OpenSSL:
-
- - Fixed bug (OpenSSL backend: incorrect RAND_{load,write}_file() return value check).
- - Fix error return check of EVP_CIPHER_CTX_ctrl().
- - Fixed bug (openssl_pkey_derive segfaults for DH derive with low key_length param).
-
-- PDO Pgsql:
-
- - Fixed dangling pointer access on _pdo_pgsql_trim_message helper.
-
-- Readline:
-
- - Fixed bug and bug #51360 (Invalid conftest for rl_pending_input).
-
-- SOAP:
-
- - Fixed bug (heap-use-after-free ext/soap/php_encoding.c:299:32 in soap_check_zval_ref).
-
-- Sockets:
-
- - Fix some potential crashes on incorrect argument value.
-
-- Standard:
-
- - Fixed OSS Fuzz #433303828 (Leak in failed unserialize() with opcache).
- - Fix theoretical issues with hrtime() not being available.
- - Fixed bug (Nested array_multisort invocation with error breaks).
-
-- Windows:
-
- - Free opened_path when opened_path_len >= MAXPATHLEN.
-
-
-
-
-
-
-
-Version 8.3.24
-
-- Calendar:
-
- - Fixed jewishtojd overflow on year argument.
-
-- Core:
-
- - Fixed bug (Use after free with weakmaps dependent on destruction order).
- - Fix OSS-Fuzz #427814456.
- - Fix OSS-Fuzz #428983568 and #428760800.
- - Fixed bug -Wuseless-escape warnings emitted by re2c.
-
-- Curl:
-
- - Fix memory leaks when returning refcounted value from curl callback.
- - Remove incorrect string release.
-
-- LDAP:
-
- - Fixed ldap_exop/ldap_exop_sync assert triggered on empty request OID.
-
-- MbString:
-
- - Fixed bug (integer overflow mb_split).
-
-- OCI8:
-
- - Fixed bug (OCI_RETURN_LOBS flag causes oci8 to leak memory).
-
-- Opcache:
-
- - Fixed bug (Internal class aliases can break preloading + JIT).
- - Fixed bug (Segmentation fault on unknown address 0x600000000018 in ext/opcache/jit/zend_jit.c).
-
-- OpenSSL:
-
- - (It is not possible to get client peer certificate with stream_socket_server).
-
-- PCNTL:
-
- - Fixed bug (Fatal error during shutdown after pcntl_rfork() or pcntl_forkx() with zend-max-execution-timers).
-
-- Phar:
-
- - Fix stream double free in phar.
- - Fix phar crash and file corruption with SplFileObject.
-
-- SOAP:
-
- - Fixed bug , bug #81029, bug #47314 (SOAP HTTP socket not closing on object destruction).
- - Fix memory leak when URL parsing fails in redirect.
-
-- SPL:
-
- - Fixed bug (Attaching class with no Iterator implementation to MultipleIterator causes crash).
-
-- Standard:
-
- - Fix misleading errors in printf().
- - Fix RCN violations in array functions.
- - Fixed pack() overflow with h/H format and INT_MAX repeater value.
-
-- Streams:
-
- - Fixed (fgets() and stream_get_line() do not return false on filter fatal error).
-
-- Zip:
-
- - Fix leak when path is too long in ZipArchive::extractTo().
-
-
-
-
-
-
-
-Version 8.3.23
-
-- Core:
-
- - Fixed (zend_ast_export() - float number is not preserved).
- - Do not delete main chunk in zend_gc.
- - Fix compile issues with zend_alloc and some non-default options.
-
-- Curl:
-
- - Fix memory leak when setting a list via curl_setopt fails.
- - Fix incorrect OpenSSL version detection.
-
-- Date:
-
- - Fix leaks with multiple calls to DatePeriod iterator current().
-
-- FPM:
-
- - Fixed (fpm_get_status segfault).
-
-- Hash:
-
- - Fixed bug (PGO build fails with xxhash).
-
-- Intl:
-
- - Fix memory leak in intl_datetime_decompose() on failure.
- - Fix memory leak in locale lookup on failure.
-
-- ODBC:
-
- - Fix memory leak on php_odbc_fetch_hash() failure.
-
-- Opcache:
-
- - Fixed bug (Incompatibility in Inline TLS Assembly on Alpine 3.22).
-
-- OpenSSL:
-
- - Fix memory leak of X509_STORE in php_openssl_setup_verify() on failure.
- - (Requests through http proxy set peer name).
-
-- PGSQL:
-
- - Fixed (pgsql extension does not check for errors during escaping). (CVE-2025-1735)
- - Fix warning not being emitted when failure to cancel a query with pg_cancel_query().
-
-- Phar:
-
- - Add missing filter cleanups on phar failure.
- - Fixed bug (Signed integer overflow in ext/phar fseek).
-
-- PHPDBG:
-
- - Fix 'phpdbg --help' segfault on shutdown with USE_ZEND_ALLOC=0.
-
-- PDO ODBC:
-
- - Fix memory leak if WideCharToMultiByte() fails.
-
-- Random:
-
- - Fix reference type confusion and leak in user random engine.
-
-- Readline:
-
- - Fix memory leak when calloc() fails in php_readline_completion_cb().
-
-- SOAP:
-
- - Fix memory leaks in php_http.c when call_user_function() fails.
- - Fixed (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491)
-
-- Standard:
-
- - Fixed (Null byte termination in hostnames). (CVE-2025-1220)
-
-- Tidy:
-
- - Fix memory leak in tidy output handler on error.
- - Fix tidyOptIsReadonly deprecation, using tidyOptGetCategory.
-
-
-
-
-
-
-
-Version 8.3.22
-
-- Core:
-
- - Fixed (array_splice with large values for offset/length arguments).
- - Partially fixed (nested object comparisons leading to stack overflow).
- - Fixed OSS-Fuzz #417078295.
- - Fixed OSS-Fuzz #418106144.
-
-- Curl:
-
- - Fixed (curl_easy_setopt with CURLOPT_USERPWD/CURLOPT_USERNAME/ CURLOPT_PASSWORD set the Authorization header when set to NULL).
-
-- Date:
-
- - Fixed bug (Since PHP 8, the date_sun_info() function returns inaccurate sunrise and sunset times, but other calculated times are correct) (JiriJozif).
- - Fixed bug (date_sunrise with unexpected nan value for the offset).
-
-- Intl:
-
- - Fix various reference issues.
-
-- LDAP:
-
- - Fixed bug (ldap no longer respects TLS_CACERT from ldaprc in ldap_start_tls()).
-
-- Opcache:
-
- - Fixed bug (Windows SHM reattachment fails when increasing memory_consumption or jit_buffer_size).
- - Fixed bug (Preloading with internal class alias triggers assertion failure).
- - Fix leak of accel_globals->key.
-
-- OpenSSL:
-
- - Fix missing checks against php_set_blocking() in xp_ssl.c.
-
-- PDO_OCI:
-
- - Fixed bug (PDO OCI segfault in statement GC).
-
-- SPL:
-
- - Fixed bug (Integer overflow with large numbers in LimitIterator).
-
-- Standard:
-
- - Fixed bug (Potential deadlock when putenv fails).
- - Fixed bug (Dynamic calls to assert() ignore zend.assertions).
-
-- Windows:
-
- - Fix leak+crash with sapi_windows_set_ctrl_handler().
-
-- Zip:
-
- - Fixed bug (Registering ZIP progress callback twice doesn't work).
- - Fixed bug (Handling of empty data and errors in ZipArchive::addPattern).
-
-
-
-
-
-
-
-Version 8.3.21
-
-- Core:
-
- - Fixed bug (Changing the properties of a DateInterval through dynamic properties triggers a SegFault).
- - Fix some leaks in php_scandir.
-
-- Filter:
-
- - Fixed bug (ipv6 filter integer overflow).
-
-- GD:
-
- - Fixed imagecrop() overflow with rect argument with x/width y/heigh usage in gdImageCrop().
- - Fixed imagettftext() overflow/underflow on font size value.
-
-- Intl:
-
- - Fix reference support for intltz_get_offset().
-
-- LDAP:
-
- - Fixed bug (LDAP_OPT_X_TLS_* options can't be overridden).
- - Fix NULL deref on high modification key.
-
-- libxml:
-
- - Fixed custom external entity loader returning an invalid resource leading to a confusing TypeError message.
-
-- OpenSSL:
-
- - Fix memory leak in openssl_sign() when passing invalid algorithm.
- - Fix potential leaks when writing to BIO fails.
-
-- PDO Firebird:
-
- - Fixed - persistent connection - "zend_mm_heap corrupted" with setAttribute() (SakiTakamachi).
-
-- SPL:
-
- - Fixed bug (SplObjectStorage debug handler mismanages memory).
-
-- Standard:
-
- - Fixed bug (php8ts crashes in php_clear_stat_cache()).
- - Fixed bug (Use-after-free in extract() with EXTR_REFS).
- - Fixed bug (fseek with SEEK_CUR whence value and negative offset leads to negative stream position).
- - Fix resource leak in iptcembed() on error.
-
-- Zip:
-
- - Fix uouv when handling empty options in ZipArchive::addGlob().
- - Fix memory leak when handling a too long path in ZipArchive::addGlob().
-
-
-
-
-
-
-
-Version 8.3.20
-
-- Core:
-
- - Fixed bug (use-after-free during dl()'ed module class destruction).
- - Fixed bug (dl() of module with aliased class crashes in shutdown).
- - Fixed bug again (Significant performance degradation in 'foreach').
-
-- DOM:
-
- - Fix weird unpack behaviour in DOM.
- - Fix xinclude destruction of live attributes.
-
-- Embed:
-
- - Fixed bug (Unable to link dynamic libphp on Mac).
-
-- Fuzzer:
-
- - Fixed bug (Memory leaks in error paths of fuzzer SAPI).
-
-- GD:
-
- - Fixed bug (calls with arguments as array with references).
-
-- Intl:
-
- - Fix locale_compose and locale_lookup to work with their array argument with values as references.
- - Fix dateformat_format when the time is an array of references.
- - Fix UConverter::transcode with substitutes as references.
-
-- Mbstring:
-
- - Fixed bug (mb_output_handler crash with unset http_output_conv_mimetypes).
-
-- Opcache:
-
- - Fixed bug (NULL access with preloading and INI option).
- - Fixed bug (Opcache CFG jmp optimization with try-finally breaks the exception table).
-
-- PDO:
-
- - Fix memory leak when destroying PDORow.
-
-- SOAP:
-
- - (Typemap can break parsing in parse_packet_soap leading to a segfault) .
-
-- SPL:
-
- - Fixed bug (RC1 data returned from offsetGet causes UAF in ArrayObject).
-
-- Treewide:
-
- - Fixed bug (Assertion failure zend_reference_destroy()).
-
-- Windows:
-
- - Fixed bug (zend_vm_gen.php shouldn't break on Windows line endings).
-
-
-
-
-
-
-
-Version 8.3.19
-
-- BCMath:
-
- - Fixed bug (bcmul memory leak).
-
-- Core:
-
- - Fixed bug (Broken stack overflow detection for variable compilation).
- - Fixed bug (UnhandledMatchError does not take zend.exception_ignore_args=1 into account).
- - Fix fallback paths in fast_long_{add,sub}_function.
- - Fixed bug (Calling static methods on an interface that has `__callStatic` is allowed).
- - Fixed bug (zend_test_compile_string crash on invalid script path).
- - Fixed (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)
-
-- DOM:
-
- - Fixed bug (xinclude destroys live node).
-
-- FFI:
-
- - Fix FFI Parsing of Pointer Declaration Lists.
-
-- FPM:
-
- - Fixed bug (FPM with httpd ProxyPass encoded PATH_INFO env).
-
-- GD:
-
- - Fixed bug (imagepalettetotruecolor crash with memory_limit=2M).
-
-- LDAP:
-
- - Fixed bug (ldap_search fails when $attributes contains a non-packed array with numerical keys).
-
-- LibXML:
-
- - Fixed (Reocurrence of #72714).
- - Fixed (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
-
-- MBString:
-
- - Fixed bug (Undefined float conversion in mb_convert_variables).
-
-- Opcache:
-
- - Fixed bug (Multiple classes using same trait causes function JIT crash).
- - Fixed bug (JIT packed type guard crash).
- - Fixed bug (zend_test_compile_string with invalid path when opcache is enabled).
- - Fixed bug (Cannot allocate memory with tracing JIT).
-
-- PDO_SQLite:
-
- - Fixed ()::getColumnMeta() on unexecuted statement segfaults).
- - Fix cycle leak in sqlite3 setAuthorizer().
-
-- Phar:
-
- - Fixed bug : PharFileInfo refcount bug.
-
-- PHPDBG:
-
- - Partially fixed bug (Trivial crash in phpdbg lexer).
- - Fix memory leak in phpdbg calling registered function.
-
-- Reflection:
-
- - Fixed bug (Core dumped in ext/reflection/php_reflection.c).
-
-- Standard:
-
- - (stat cache clearing inconsistent between file:// paths and plain paths).
-
-- Streams:
-
- - Fixed bug (realloc with size 0 in user_filters.c).
- - Fix memory leak on overflow in _php_stream_scandir().
- - Fixed (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
- - Fixed (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
- - Fixed (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
- - Fixed (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
-
-- Windows:
-
- - Fixed phpize for Windows 11 (24H2).
- - Fixed (CURL_STATICLIB flag set even if linked with shared lib).
-
-- Zlib:
-
- - Fixed bug (zlib extension incorrectly handles object arguments).
- - Fix memory leak when encoding check fails.
- - Fix zlib support for large files.
-
-
-
-
-
-
-
-Version 8.3.17
-
-- Core:
-
- - Fixed bug (ini_parse_quantity() fails to parse inputs starting with 0x0b).
- - Fixed bug (ini_parse_quantity() fails to emit warning for 0x+0).
- - Fixed bug (Relax final+private warning for trait methods with inherited final).
- - Fixed NULL arithmetic during system program execution on Windows.
- - Fixed potential OOB when checking for trailing spaces on Windows.
- - Fixed bug (Assertion failure Zend/zend_exceptions.c).
- - Fix may_have_extra_named_args flag for ZEND_AST_UNPACK.
- - Fix NULL arithmetic in System V shared memory emulation for Windows.
-
-- DOM:
-
- - Fixed bug (Segfault with requesting nodeName on nameless doctype).
-
-- Enchant:
-
- - Fix crashes in enchant when passing null bytes.
-
-- FTP:
-
- - Fixed bug (ftp functions can abort with EINTR).
-
-- GD:
-
- - Fixed bug (Tiled truecolor filling looses single color transparency).
- - Fixed bug (imagefttext() ignores clipping rect for palette images).
- - Ported fix for libgd 223 (gdImageRotateGeneric() does not properly interpolate).
-
-- Intl:
-
- - Fixed bug (intl causing segfault in docker images).
- - Fixed bug (UConverter::transcode always emit E_WARNING on invalid encoding).
-
-- Opcache:
-
- - Fixed bug (Internal closure causes JIT failure).
- - Fixed bug (Potential UB when reading from / writing to struct padding).
-
-- PDO:
-
- - Fixed a memory leak when the GC is used to free a PDOStatment.
- - Fixed a crash in the PDO Firebird Statement destructor.
- - Fixed UAFs when changing default fetch class ctor args.
-
-- Phar:
-
- - Fixed bug (offset overflow phar extractTo()).
-
-- PHPDBG:
-
- - Fix crashes in function registration + test.
-
-- Session:
-
- - Fix type confusion with session SID constant.
- - Fixed bug (ext/session NULL pointer dereferencement during ID reset).
-
-- SimpleXML:
-
- - Fixed bug (Assertion failure Zend/zend_hash.c:1730).
-
-- SNMP:
-
- - Fixed bug (SNMP::setSecurity segfault on closed session).
-
-- SPL:
-
- - Fixed bug (crash on SplTempFileObject::ftruncate with negative value).
-
-- Zip:
-
- - Fixed bug (Fix zip_entry_name() crash on invalid entry).
-
-
-
-
-
-
-
-Version 8.3.16
-
-- Core:
-
- - Fixed bug (ZEND_MATCH_ERROR misoptimization).
- - Fixed bug (zend_array_try_init() with dtor can cause engine UAF).
- - Fixed bug (AST->string does not reproduce constructor property promotion correctly).
- - Fixed bug (observer segfault on function loaded with dl()).
- - Fixed bug (Trampoline crash on error).
-
-- Date:
-
- - Fixed bug DatePeriod::__construct() overflow on recurrences.
-
-- DBA:
-
- - Skip test if inifile is disabled.
-
-- DOM:
-
- - Fixed bug (UAF in importNode).
-
-- Embed:
-
- - Make build command for program using embed portable.
-
-- FFI:
-
- - (FFI header parser chokes on comments).
- - Fix memory leak on ZEND_FFI_TYPE_CHAR conversion failure.
- - Fixed bug and bug #80857 (Big endian issues).
-
-- Filter:
-
- - Fixed bug (Fix filtering special IPv4 and IPv6 ranges, by using information from RFC 6890).
-
-- FPM:
-
- - Fixed bug (FPM: ERROR: scoreboard: failed to lock (already locked)).
- - Fixed bug (Macro redefinitions).
- - Fixed bug (bug64539-status-json-encoding.phpt fail on 32-bits).
-
-- GD:
-
- - Fixed bug (Unexpected nan value in ext/gd/libgd/gd_filter.c).
- - Ported fix for libgd bug 276 (Sometimes pixels are missing when storing images as BMPs).
-
-- Gettext:
-
- - Fixed bug (Segmentation fault ext/gettext/gettext.c bindtextdomain()).
-
-- Iconv:
-
- - Fixed bug (UAF on iconv filter failure).
-
-- LDAP:
-
- - Fixed bug (ldap_search() fails when $attributes array has holes).
-
-- LibXML:
-
- - Fixed bug (Memory leak in libxml encoding handling).
-
-- MBString:
-
- - Fixed bug (Macro redefinitions).
-
-- Opcache:
-
- - opcache_get_configuration() properly reports jit_prof_threshold.
- - Fixed bug (GC during SCCP causes segfault).
-
-- PCNTL:
-
- - Fix memory leak in cleanup code of pcntl_exec() when a non stringable value is encountered past the first entry.
-
-- PgSql:
-
- - Fixed bug (pg_fetch_result Shows Incorrect ArgumentCountError Message when Called With 1 Argument).
- - Fixed further ArgumentCountError for calls with flexible number of arguments.
-
-- Phar:
-
- - Fixed bug (Segmentation fault ext/phar/phar.c).
-
-- SimpleXML:
-
- - Fixed bug (SimpleXML's unset can break DOM objects).
- - Fixed bug (SimpleXML crash when using autovivification on document).
-
-- Sockets:
-
- - Fixed bug (socket_strerror overflow handling with INT_MIN).
- - Fixed overflow on SO_LINGER values setting, strengthening values check on SO_SNDTIMEO/SO_RCVTIMEO for socket_set_option().
-
-- SPL:
-
- - Fixed bug (NULL deref in spl_directory.c).
-
-- Streams:
-
- - Fixed bug (UAF in user filter when adding existing filter name due to incorrect error handling).
- - Fixed bug (overflow on fopen HTTP wrapper timeout value).
- - Fixed bug (glob:// wrapper doesn't cater to CWD for ZTS builds).
-
-- Windows:
-
- - Hardened proc_open() against cmd.exe hijacking.
-
-- XML:
-
- - Fixed bug (unreachable program point in zend_hash).
-
-
-
-
-
-
-
-Version 8.3.15
-
-- Calendar:
-
- - Fixed jdtogregorian overflow.
- - Fixed cal_to_jd julian_days argument overflow.
-
-- COM:
-
- - Fixed bug (Getting typeinfo of non DISPATCH variant segfaults).
-
-- Core:
-
- - Fail early in *nix configuration build script.
- - Fixed bug (Opcache bad signal 139 crash in ZTS bookworm (frankenphp)).
- - Fixed bug (Assertion failure at Zend/zend_vm_execute.h:7469).
- - Fixed bug (UAF in lexer with encoding translation and heredocs).
- - Fix is_zend_ptr() huge block comparison.
- - Fixed potential OOB read in zend_dirname() on Windows.
-
-- Curl:
-
- - Fixed bug (open_basedir bypass using curl extension).
- - Fix various memory leaks in curl mime handling.
-
-- DOM:
-
- - Fixed bug (Calling the constructor again on a DOM object after it is in a document causes UAF).
- - Fixed bug (Reloading document can cause UAF in iterator).
-
-- FPM:
-
- - Fixed (PHP-FPM 8.2 SIGSEGV in fpm_get_status).
-
-- GD:
-
- - Fixed (imagecreatefromstring overflow).
-
-- GMP:
-
- - Fixed bug (array_sum() with GMP can loose precision (LLP64)).
-
-- Hash:
-
- - Fixed : Segfault in mhash().
-
-- Opcache:
-
- - Fixed bug (Tracing JIT type mismatch when returning UNDEF).
- - Fixed bug (JIT_G(enabled) not set correctly on other threads).
- - Fixed bug (Set of opcache tests fail zts+aarch64).
-
-- OpenSSL:
-
- - Prevent unexpected array entry conversion when reading key.
- - Fix various memory leaks related to openssl exports.
- - Fix memory leak in php_openssl_pkey_from_zval().
-
-- PDO:
-
- - Fixed memory leak of `setFetchMode()`.
-
-- Phar:
-
- - Fixed bug (phar:// tar parser and zero-length file header blocks).
-
-- PHPDBG:
-
- - Fixed bug (Segfault with breakpoint map and phpdbg_clear()).
-
-- SAPI:
-
- - Fixed bug (UBSAN warning in rfc1867).
-
-- SimpleXML:
-
- - Fixed bug (Segmentation fault in RecursiveIteratorIterator ->current() with a xml element input).
-
-- SOAP:
-
- - Fix make check being invoked in ext/soap.
-
-- Standard:
-
- - Fixed bug (Internal iterator functions can't handle UNDEF properties).
- - Fixed bug (Assertion failure in array_shift with self-referencing array).
-
-- Streams:
-
- - Fixed network connect poll interuption handling.
-
-- Windows:
-
- - Fixed bug (Error dialog causes process to hang).
-
-
-
-
-
-
-
-
-
-
-
-Version 8.3.13
-
-- Calendar:
-
- - Fixed : jdtounix overflow on argument value.
- - Fixed : easter_days/easter_date overflow on year argument.
- - Fixed : jddayofweek overflow.
- - Fixed : jewishtojd overflow.
-
-- CLI:
-
- - Fixed bug : duplicate http headers when set several times by the client.
-
-- Core:
-
- - Fixed bug (Segmentation fault when resizing hash table iterator list while adding).
- - Fixed bug (Assertion failure for TRACK_VARS_SERVER).
- - Fixed bug (Failed assertion when promoting Serialize deprecation to exception).
- - Fixed bug (Segfault when printing backtrace during cleanup of nested generator frame).
- - Fixed bug (Core dumped in Zend/zend_generators.c).
- - Fixed bug (Assertion failure in Zend/zend_exceptions.c).
- - Fixed bug (Observer segfault when calling user function in internal function via trampoline).
-
-- DOM:
-
- - Fixed bug (Segmentation fault (access null pointer) in ext/dom/parentnode/tree.c).
- - Fixed bug (Null pointer dereference in DOMElement->getAttributeNames()).
- - Fixed bug (Assertion failure in ext/dom/parentnode/tree.c).
- - Fixed bug (Use after free in php_dom.c).
- - Fixed bug (Memory leak in DOMProcessingInstruction/DOMDocument).
-
-- JSON:
-
- - Fixed bug (stack overflow in json_encode()).
-
-- GD:
-
- - Fixed bug (bitshift overflow on wbmp file content reading / fix backport from upstream).
- - Fixed bug (overflow/underflow on imagerotate degrees value) (David Carlier)
- - Fixed bug (imagescale underflow on RBG channels / fix backport from upstream).
-
-- LDAP:
-
- - Fixed bug (Various NULL pointer dereferencements in ldap_modify_batch()).
- - Fixed bug (Segfault in ldap_list(), ldap_read(), and ldap_search() when LDAPs array is not a list).
- - Fix (php_ldap_do_modify() attempts to free pointer not allocated by ZMM.).
- - Fix (Memory leak in php_ldap_do_modify() when entry is not a proper dictionary).
-
-- MBString:
-
- - Fixed bug (Reference invariant broken in mb_convert_variables()).
-
-- OpenSSL:
-
- - Fixed stub for openssl_csr_new.
-
-- PCRE:
-
- - Fixed bug (underflow on offset argument).
- - Fixed bug (UBSan address overflowed in ext/pcre/php_pcre.c).
-
-- PHPDBG:
-
- - Fixed bug (phpdbg: Assertion failure on i funcs).
- - Fixed bug (phpdbg: exit in exception handler reports fatal error).
-
-- Reflection:
-
- - Fixed bug (Assertion failure in ext/reflection/php_reflection.c).
-
-- SAPI:
-
- - Fixed bug (php-fpm: zend_mm_heap corrupted with cgi-fcgi request).
-
-- SimpleXML:
-
- - Fixed bug (Segmentation fault in ext/simplexml/simplexml.c).
-
-- Sockets:
-
- - Fixed bug (socket_strerror overflow on errno argument).
-
-- SOAP:
-
- - (PHP SOAPClient does not support stream context HTTP headers in array form).
- - (Wrong namespace on xsd import error message).
- - Fixed bug (SoapClient can't convert BackedEnum to scalar value).
- - Fixed bug (Segmentation fault when cloning SoapServer).
- - Fix Soap leaking http_msg on error.
- - Fixed bug (Assertion failure in ext/soap/php_encoding.c:460).
- - Fixed bug (Soap segfault when classmap instantiation fails).
-
-- SPL:
-
- - Fixed bug (Assertion failure in ext/spl/spl_fixedarray.c).
-
-- Standard:
-
- - Fixed bug (Assertion failure in Zend/zend_hash.c).
- - Fixed bug (stack overflow when var serialization in ext/standard/var).
-
-- Streams:
-
- - Fixed bugs and (leak / assertion failure in streams.c).
- - Fixed bug (Signed integer overflow in main/streams/streams.c).
-
-- TSRM:
-
- - Prevent closing of unrelated handles.
-
-- Windows:
-
- - Fixed minimal Windows version.
-
-
-
-
-
-
-
-Version 8.3.12
-
-- CGI:
-
- - Fixed bug (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
- - Fixed bug (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
-
-- Core:
-
- - Fixed bug (MSan false-positve on zend_max_execution_timer).
- - Fixed bug (Configure error grep illegal option q).
- - Fixed bug (Configure error: genif.sh: syntax error).
- - Fixed bug (--disable-ipv6 during compilation produces error EAI_SYSTEM not found).
- - Fixed bug (CRC32 API build error on arm 32-bit).
- - Fixed bug (Do not scan generator frames more than once).
- - Fixed uninitialized lineno in constant AST of internal enums.
-
-- Curl:
-
- - FIxed bug (curl_multi_select overflow on timeout argument).
-
-- DOM:
-
- - Fixed bug (Segmentation fault (access null pointer) in ext/dom/xml_common.h).
- - Fixed bug (Signed integer overflow in ext/dom/nodelist.c).
-
-- Fileinfo:
-
- - Fixed bug (Incorrect error message for finfo_file with an empty filename argument).
-
-- FPM:
-
- - Fixed bug (Logs from childrens may be altered). (CVE-2024-9026)
-
-- MySQLnd:
-
- - Fixed bug (Heap corruption when querying a vector).
-
-- Opcache:
-
- - Fixed bug (Access null pointer in Zend/Optimizer/zend_inference.c).
- - Fixed bug (Segmentation fault in Zend/zend_vm_execute.h).
-
-- SAPI:
-
- - Fixed bug (Erroneous parsing of multipart form data). (CVE-2024-8925)
-
-- Standard:
-
- - Fixed bug (Signed integer overflow in ext/standard/scanf.c).
-
-- Streams:
-
- - Fixed bug (php_stream_memory_get_buffer() not zero-terminated).
-
-
-
-
-
-
-
-Version 8.3.11
-
-- Core:
-
- - Fixed bug (Memory leak in Zend/Optimizer/escape_analysis.c).
- - Fixed bug (Memory leak in Zend/zend_ini.c).
- - Fixed bug (Append -Wno-implicit-fallthrough flag conditionally).
- - Fix uninitialized memory in network.c.
- - Fixed bug (Segfault when destroying generator during shutdown).
- - Fixed bug (Crash during GC of suspended generator delegate).
-
-- Curl:
-
- - Fixed case when curl_error returns an empty string.
-
-- DOM:
-
- - Fix UAF when removing doctype and using foreach iteration.
-
-- FFI:
-
- - Fixed bug (ffi enum type (when enum has no name) make memory leak).
-
-- Hash:
-
- - Fix crash when converting array data for array in shm in xxh3.
-
-- Intl:
-
- - Fixed bug (IntlChar::foldCase()'s $option is not optional).
-
-- Opcache:
-
- - Fixed bug (Segmentation fault for enabled observers after pass 4).
- - Fixed bug (Memory leak possibly related to opcache SHM placement).
-
-- Output:
-
- - Fixed bug (Segmentation fault (null pointer dereference) in ext/standard/url_scanner_ex.re).
-
-- PDO_Firebird:
-
- - Fix bogus fallthrough path in firebird_handle_get_attribute().
-
-- PHPDBG:
-
- - Fixed bug (EOF emits redundant prompt in phpdbg local console mode with libedit/readline).
- - Fixed bug (heap buffer overflow in phpdbg (zend_hash_num_elements() Zend/zend_hash.h)).
- - Fixed bug use-after-free on watchpoint allocations.
-
-- Soap:
-
- - (Digest autentication dont work).
- - Fix SoapFault property destruction.
- - Fixed bug (SOAP XML broken since PHP 8.3.9 when using classmap constructor option).
-
-- Standard:
-
- - Fix passing non-finite timeout values in stream functions.
- - Fixed p(f)sockopen timeout overflow.
-
-- Streams:
-
- - Fixed bug (Memory leak in ext/phar/stream.c).
- - Fixed bug (Integer overflow on stream_notification_callback byte_max parameter with files bigger than 2GB).
- - Reverted fix for (Custom stream wrapper dir_readdir output truncated to 255 characters).
-
-- Tidy:
-
- - Fix memory leaks in ext/tidy basedir restriction code.
-
-
-
-
-
-
-
-Version 8.3.10
-
-- Core:
-
- - Fixed bug (Fixed support for systems with sysconf(_SC_GETPW_R_SIZE_MAX) == -1).
- - Fixed bug (Fix is_zend_ptr() for huge blocks).
- - Fixed bug (Memory leak in FPM test gh13563-conf-bool-env.phpt.
- - Fixed OSS-Fuzz #69765.
- - Fixed bug (Segmentation fault in Zend/zend_types.h).
- - Fixed bug (Use-after-free in property coercion with __toString()).
-
-- Dom:
-
- - Fixed bug (DOMDocument::xinclude() crash).
-
-- Fileinfo:
-
- - Fixed bug (README.REDIST.BINS refers to non-existing LICENSE).
-
-- Gd:
-
- - ext/gd/tests/gh10614.phpt: skip if no PNG support.
- - restored warning instead of fata error.
-
-- LibXML:
-
- - Fixed bug (Build failure with libxml2 v2.13.0).
-
-- Opcache:
-
- - Fixed bug (No warning message when Zend DTrace is enabled that opcache.jit is implictly disabled).
-
-- Output:
-
- - Fixed bug (Unexpected null pointer in Zend/zend_string.h with empty output buffer).
-
-- PDO:
-
- - Fixed bug (Crash with PDORow access to null property).
-
-- Phar:
-
- - Fixed bug (null string from zip entry).
-
-- PHPDBG:
-
- - Fixed bug (crashes with ASAN and ZEND_RC_DEBUG=1).
- - Fixed bug (echo output trimmed at NULL byte).
-
-- Shmop:
-
- - Fixed bug (shmop Windows 11 crashes the process).
-
-- SPL:
-
- - Fixed bug (Member access within null pointer in ext/spl/spl_observer.c).
-
-- Standard:
-
- - Fixed bug (range function overflow with negative step argument).
- - Fix 32-bit wordwrap test failures.
- - Fixed bug (time_sleep_until overflow).
-
-- Streams:
-
- - Fixed bug (Custom stream wrapper dir_readdir output truncated to 255 characters in PHP 8.3).
-
-- Tidy:
-
- - Fix memory leak in tidy_repair_file().
-
-- Treewide:
-
- - Fix compatibility with libxml2 2.13.2.
-
-- XML:
-
- - Move away from to-be-deprecated libxml fields.
- - Fixed bug (Error installing PHP when --with-pear is used).
-
-
-
-
-
-
-
-Version 8.3.9
-
-- Core:
-
- - Fixed bug (Incompatible pointer type warnings).
- - Fixed bug (max_execution_time reached too early on MacOS 14 when running on Apple Silicon).
- - Fixed bug (Crash when stack walking in destructor of yielded from values during Generator->throw()).
- - Fixed bug (Attempting to initialize class with private constructor calls destructor).
- - Fixed bug (memleak due to missing pthread_attr_destroy()-call).
- - Fixed bug (Incompatible function pointer type for fclose).
-
-- BCMatch:
-
- - Fixed bug (bcpowmod() with mod = -1 returns 1 when it must be 0).
-
-- Curl:
-
- - Fixed bug (Test curl_basic_024 fails with curl 8.8.0).
-
-- DOM:
-
- - Fixed bug (Memory leak in xml and dom).
-
-- FPM:
-
- - Fixed bug (PHP-FPM ping.path and ping.response config vars are ignored in status pool).
-
-- GD:
-
- - Fix parameter numbers for imagecolorset().
-
-- Intl:
-
- - Fix reference handling in SpoofChecker.
-
-- MySQLnd:
-
- - Partially fix bug (Apache crash on Windows when using a self-referencing anonymous function inside a class with an active mysqli connection).
-
-- Opcache:
-
- - Fixed bug (opcache.jit=off does not allow enabling JIT at runtime).
- - Fixed TLS access in JIT on FreeBSD/amd64.
- - Fixed bug (Error when building TSRM in ARM64).
-
-- PDO ODBC:
-
- - Fixed bug (incompatible SDWORD type with iODBC).
-
-- PHPDBG:
-
- - Fixed bug (segfault on watchpoint addition failure).
-
-- Soap:
-
- - (PHPClient can't decompress response).
- - Fix missing error restore code.
- - Fix memory leak if calling SoapServer::setObject() twice.
- - Fix memory leak if calling SoapServer::setClass() twice.
- - Fix reading zlib ini settings in ext-soap.
- - Fix memory leaks with string function name lookups.
- - (SoapClient classmap doesn't support fully qualified class name).
- - (SoapClient Cookie Header Semicolon).
- - Fixed memory leaks when calling SoapFault::__construct() twice.
-
-- Sodium:
-
- - Fix memory leaks in ext/sodium on failure of some functions.
-
-- SPL:
-
- - Fixed bug (Member access within null pointer in extension spl).
-
-- Standard:
-
- - Fixed bug (Fixed off-by-one error in checking length of abstract namespace Unix sockets).
-
-- Streams:
-
- - Fixed bug (PHP Fatal error triggers pointer being freed was not allocated and malloc: double free for ptr errors).
-
-
-
-
-
-
-
-Version 8.3.8
-
-- CGI:
-
- - Fixed buffer limit on Windows, replacing read call usage by _read.
- - Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
-
-- CLI:
-
- - Fixed bug (PHP Interactive shell input state incorrectly handles quoted heredoc literals.).
-
-- Core:
-
- - Fixed bug (Incorrect validation of #[Attribute] flags type for non-compile-time expressions).
-
-- DOM:
-
- - Fix crashes when entity declaration is removed while still having entity references.
- - Fix references not handled correctly in C14N.
- - Fix crash when calling childNodes next() when iterator is exhausted.
- - Fix crash in ParentNode::append() when dealing with a fragment containing text nodes.
-
-- Filter:
-
- - Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
-
-- FPM:
-
- - Fix bug (Show decimal number instead of scientific notation in systemd status).
-
-- Hash:
-
- - ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__` (Saki Takamachi)
-
-- Intl:
-
- - Fixed build regression on systems without C++17 compilers.
-
-- MySQLnd:
-
- - Fix bug (mysqli_fetch_assoc reports error from nested query).
-
-- Opcache:
-
- - Fixed bug (Fix accidental persisting of internal class constant in shm).
-
-- OpenSSL:
-
- - The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.
-
-- Standard:
-
- - Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
-
-- XML:
-
- - Fixed bug (Segmentation fault with XML extension under certain memory limit).
-
-- XMLReader:
-
- - Fixed bug (XMLReader::open() can't be overridden).
-
-
-
-
-
-
-
-Version 8.3.7
-
-- Core:
-
- - Fixed zend_call_stack build with Linux/uclibc-ng without thread support.
- - Fixed bug (Invalid execute_data->opline pointers in observer fcall handlers when JIT is enabled).
- - Fixed bug (Applying zero offset to null pointer in Zend/zend_opcode.c).
- - Fixed bug (Align the behavior of zend-max-execution-timers with other timeout implementations).
- - Fixed bug (Broken cleanup of unfinished calls with callable convert parameters).
- - Fixed bug (Erroneous dnl appended in configure).
- - Fixed bug (If autoloading occurs during constant resolution filename and lineno are identified incorrectly).
- - Fixed bug (Missing void keyword).
-
-- Fibers:
-
- - Fixed bug (ASAN false positive underflow when executing copy()).
-
-- Fileinfo:
-
- - Fixed bug (Test failing in ext/fileinfo/tests/bug78987.phpt on big-endian PPC).
-
-- FPM:
-
- - Fixed bug (Setting bool values via env in FPM config fails).
-
-- Intl:
-
- - Fixed build for icu 74 and onwards.
-
-- MySQLnd:
-
- - Fix shift out of bounds on 32-bit non-fast-path platforms.
-
-- Opcache:
-
- - Fixed bug (Segmentation Fault in zend_class_init_statics when using opcache.preload).
- - Fixed incorrect assumptions across compilation units for static calls.
-
-- OpenSSL:
-
- - Fixed bug (feof on OpenSSL stream hangs indefinitely).
-
-- PDO SQLite:
-
- - Fix (Buffer size is now checked before memcmp).
- - Fix (Manage refcount of agg_context->val correctly).
-
-- Phar:
-
- - Fixed bug (Renaming a file in a Phar to an already existing filename causes a NULL pointer dereference).
- - Fixed bug (Applying zero offset to null pointer in zend_hash.c).
- - Fix potential NULL pointer dereference before calling EVP_SignInit.
-
-- PHPDBG:
-
- - Fixed bug (Null pointer access of type 'zval' in phpdbg_frame).
-
-- Posix:
-
- - Fix usage of reentrant functions in ext/posix.
-
-- Session:
-
- - Fixed bug (Member access within null pointer of type 'ps_files' in ext/session/mod_files.c).
- - Fixed bug (memleak and segfault when using ini_set with session.trans_sid_hosts).
- - Fixed buffer _read/_write size limit on windows for the file mode.
-
-- Streams:
-
- - Fixed file_get_contents() on Windows fails with "errno=22 Invalid argument".
- - Fixed bug (Part 1 - Memory leak on stream filter failure).
- - Fixed bug (Incorrect PHP_STREAM_OPTION_CHECK_LIVENESS case in ext/openssl/xp_ssl.c - causing use of dead socket).
- - Fixed bug (Build fails on musl 1.2.4 - lfs64).
-
-- Treewide:
-
- - Fix gcc-14 Wcalloc-transposed-args warnings.
-
-
-
-
-
-
-
-Version 8.3.6
-
-- Core:
-
- - Fixed (GC buffer unnecessarily grows up to GC_MAX_BUF_SIZE when scanning WeakMaps).
- - Fixed bug (Corrupted memory in destructor with weak references).
- - Fixed bug (Restore exception handler after it finishes).
- - Fixed bug (AX_GCC_FUNC_ATTRIBUTE failure).
- - Fixed bug (GC does not scale well with a lot of objects created in destructor).
-
-- DOM:
-
- - Add some missing ZPP checks.
- - Fix potential memory leak in XPath evaluation results.
-
-- FPM:
-
- - Fixed (FPM: config test runs twice in daemonised mode).
- - Fix incorrect check in fpm_shm_free().
-
-- GD:
-
- - Fixed bug (add GDLIB_CFLAGS in feature tests).
-
-- Gettext:
-
- - Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL.
-
-- MySQLnd:
-
- - Fix (Fixed handshake response [mysqlnd]).
- - Fix incorrect charset length in check_mb_eucjpms().
-
-- Opcache:
-
- - Fixed (JITed QM_ASSIGN may be optimized out when op1 is null).
- - Fixed (Segmentation fault for enabled observers when calling trait method of internal trait when opcache is loaded).
-
-- Random:
-
- - Fixed bug (Pre-PHP 8.2 compatibility for mt_srand with unknown modes).
- - Fixed bug (Global Mt19937 is not properly reset in-between requests when MT_RAND_PHP is used).
-
-- Session:
-
- - Fixed bug (Segfault with session_decode and compilation error).
-
-- SPL:
-
- - Fixed bug (Unexpected null pointer in zend_string.h).
-
-- Standard:
-
- - Fixed bug (Live filesystem modified by tests).
- - Fixed (Added validation of `\n` in $additional_headers of mail()).
- - Fixed bug (file_put_contents fail on strings over 4GB on Windows).
- - Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
- - Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
- - Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)
- - Fixed bug GHSA-fjp9-9hwx-59fq (mb_encode_mimeheader runs endlessly for some inputs). (CVE-2024-2757)
- - Fix bug (Attempt to fix mbstring on windows build) (msvc).
-
-
-
-
-
-
-
-Version 8.3.4
-
-- Core:
-
- - Fix ZTS persistent resource crashes on shutdown.
-
-- Curl:
-
- - Fix failing tests due to string changes in libcurl 8.6.0.
-
-- DOM:
-
- - Fix unlikely memory leak in case of namespace removal with extremely deep trees.
- - Fix reference access in dimensions for DOMNodeList and DOMNodeMap.
-
-- Fileinfo:
-
- - Fixed bug (finfo::buffer(): Failed identify data 0:(null), backport).
-
-- FPM:
-
- - (getenv in php-fpm should not read $_ENV, $_SERVER).
-
-- GD:
-
- - Fixed bug (detection of image formats in system gd library).
-
-- MySQLnd:
-
- - Fixed bug ([mysqlnd] Fixed not to set CR_MALFORMED_PACKET to error if CR_SERVER_GONE_ERROR is already set).
-
-- PDO:
-
- - Fix various PDORow bugs.
-
-- PGSQL:
-
- - Fixed bug (pg_execute/pg_send_query_params/pg_send_execute with null value passed by reference).
-
-- SPL:
-
- - Fixed bug (Unable to resize SplfixedArray after being unserialized in PHP 8.2.15).
-
-- Standard:
-
- - Fixed bug (Instable array during in-place modification in uksort).
- - Fixed array key as hash to string (case insensitive) comparison typo for the second operand buffer size (albeit unused for now).
-
-- XML:
-
- - Fixed bug (Multiple test failures when building with --with-expat).
-
-
-
-
-
-
-
-Version 8.3.3
-
-- Core:
-
- - Fixed timer leak in zend-max-execution-timers builds.
- - Fixed bug (linking failure on ARM with mold).
- - Fixed bug (Anonymous class reference in trigger_error / thrown Exception).
- - Fixed bug (PHP 8.3.2: final private constructor not allowed when used in trait).
- - Fixed bug (GCC 14 build failure).
-
-- Curl:
-
- - Fix missing error check in curl_multi_init().
-
-- FPM:
-
- - Fixed bug (Incorrect SCRIPT_NAME with Apache ProxyPassMatch when plus in path).
-
-- GD:
-
- - Fixed bug (imagettfbbox(): Could not find/open font UNC path).
- - Fixed bug (imagerotate will turn the picture all black, when rotated 90).
-
-- LibXML:
-
- - Fix crashes with entity references and predefined entities.
-
-- MySQLnd:
-
- - Fixed bug (When running a stored procedure (that returns a result set) twice, PHP crashes).
-
-- Opcache:
-
- - Fixed bug (strtok() is not comptime).
- - Fixed type inference of range().
- - Fixed bug (Segmentation fault will be reported when JIT is off but JIT_debug is still on).
-
-- OpenSSL:
-
- - Fixed LibreSSL undefined reference when OPENSSL_NO_ENGINE not set. (David Carlier).
-
-- PDO_Firebird:
-
- - Fix (Changed to convert float and double values into strings using `H` format).
-
-- Phar:
-
- - (PHAR doesn't know about litespeed).
- - Fixed bug (PharData incorrectly extracts zip file).
-
-- Random:
-
- - Fixed bug (Randomizer::pickArrayKeys() does not detect broken engines).
-
-- Session:
-
- - Fixed bug (Corrupted session written when there's a fatal error in autoloader).
-
-- Standard:
-
- - Fixed bug (range(9.9, '0') causes segmentation fault).
-
-- Streams:
-
- - Fixed bug (Copying large files using mmap-able source streams may exhaust available memory and fail).
-
-
-
-
-
-
-
-Version 8.3.2
-
-- Core:
-
- - Fixed bug (false positive SSA integrity verification failed when loading composer classmaps with more than 11k elements).
- - Fixed bug (zend_strnlen build when strnlen is unsupported).
- - Fixed bug (missing cross-compiling 3rd argument so Autoconf doesn't emit warnings).
- - Fixed bug (8.3 - as final trait-used method does not correctly report visibility in Reflection).
-
-- Cli:
-
- - Fix incorrect timeout in built-in web server when using router script and max_input_time.
-
-- DOM:
-
- - Fixed bug (Creating an xmlns attribute results in a DOMException).
- - Fix crash when toggleAttribute() is used without a document.
- - Fix crash in adoptNode with attribute references.
- - Fixed bug (DOMNode::isEqualNode() is incorrect when attribute order is different).
-
-- FFI:
-
- - Fixed bug (stream_wrapper_register crashes with FFI\CData).
- - Fixed bug (FFI::new interacts badly with observers).
-
-- Intl:
-
- - Fixed (IntlDateFormatter::__construct accepts 'C' as valid locale).
-
-- Hash:
-
- - Fixed bug (hash() function hangs endlessly if using sha512 on strings >= 4GiB).
-
-- ODBC:
-
- - Fix crash on Apache shutdown with persistent connections.
-
-- Opcache:
-
- - Fixed oss-fuzz #64727 (JIT undefined array key warning may overwrite DIM with NULL when DIM is the same var as result).
- - Added workaround for SELinux mprotect execheap issue. See https://bugzilla.kernel.org/show_bug.cgi?id=218258.
-
-- OpenSSL:
-
- - Fixed bug (openssl_csr_sign might leak new cert on error).
-
-- PDO:
-
- - Fix (Fixed PDO::getAttribute() to get PDO::ATTR_STRINGIFY_FETCHES).
-
-- PDO_ODBC:
-
- - Fixed bug (Unable to turn on autocommit mode with setAttribute()).
-
-- PGSQL:
-
- - Fixed auto_reset_persistent handling and allow_persistent type.
- - Fixed bug (Apache crashes on shutdown when using pg_pconnect()).
-
-- Phar:
-
- - (Segmentation fault on including phar file).
-
-- PHPDBG:
-
- - Fixed bug (Double free of init_file in phpdbg_prompt.c).
-
-- SimpleXML:
-
- - Fix getting the address of an uninitialized property of a SimpleXMLElement resulting in a crash.
- - Fixed bug (SimpleXMLElement with stream_wrapper_register can segfault).
-
-- Tidy:
-
- - Fixed bug (tidynode.props.attribute is missing "Boolean Attributes" and empty attributes).
-
-
-
-
-
-
-
-Version 8.3.1
-
-- Core:
-
- - Fixed bug / (Invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC).
- - Fix various missing NULL checks.
- - Fixed bug (Leak of call->extra_named_params on internal __call).
- - Fixed bug (Weird pointers issue in nested loops).
-
-- FPM:
-
- - Fixed bug (Segmentation fault in fpm_status_export_to_zval).
-
-- FTP:
-
- - Fixed bug (FTP & SSL session reuse).
-
-- LibXML:
-
- - Fixed test failures for libxml2 2.12.0.
-
-- MySQLnd:
-
- - Avoid using uninitialised struct.
- - Fixed bug (Possible dereference of NULL in MySQLnd debug code).
-
-- Opcache:
-
- - Fixed JIT bug (Function JIT emits "Uninitialized string offset" warning at the same time as invalid offset Error).
- - Fixed JIT bug (JIT emits "Attempt to assign property of non-object" warning at the same time as Error is being thrown).
-
-- PDO PGSQL:
-
- - Fixed the default value of $fetchMode in PDO::pgsqlGetNotify() (kocsismate)
-
-- SOAP:
-
- - Fixed bug ([SOAP] Temporary WSDL cache files not being deleted).
-
-- Standard:
-
- - Fixed (http_build_query() default null argument for $arg_separator is implicitly coerced to string).
-
-
-
-
-
-
-
-Version 8.3.0
-
-- Bcmath:
-
- - Fixed (removing trailing zeros from numbers) (jorgsowa)
-
-- CLI:
-
- - Added pdeathsig to builtin server to terminate workers when the master process is killed.
- - Fixed bug (STDIN/STDOUT/STDERR is not available for CLI without a script).
- - Implement (support linting multiple files at once using php -l).
-
-- Core:
-
- - Fix (Allow "final" modifier when importing a method from a trait).
- - Fixed bug (segfault with unpacking and magic method closure).
- - Fixed bug (Improve unset property and __get type incompatibility error message).
- - SA_ONSTACK is now set for signal handlers to be friendlier to other in-process code such as Go's cgo.
- - SA_ONSTACK is now set when signals are disabled.
- - Fix : Signal handlers now do a no-op instead of crashing when executed on threads not managed by TSRM.
- - Added shadow stack support for fibers.
- - Fix bug (Fix accidental caching of default arguments with side effects).
- - Implement (Use strlen() for determining the class_name length).
- - Fix bug (Improve line numbers for errors in constant expressions).
- - Fix bug (Allow comments between & and parameter).
- - Zend Max Execution Timers is now enabled by default for ZTS builds on Linux.
- - Fix bug (Disallow .. in open_basedir paths set at runtime).
- - Fix bug , (Various segfaults with destructors and VM return values).
- - Fix bug (Use of trait doesn't redeclare static property if class has inherited it from its parent).
- - Fix bug (Negative indices on empty array don't affect next chosen index).
- - Fix bug (Implement delayed early binding for classes without parents).
- - Fix bug #79836 (Segfault in concat_function).
- - Fix bug #81705 (type confusion/UAF on set_error_handler with concat operation).
- - Fix (Closure created from magic method does not accept named arguments).
- - Fix (Allow "final" modifier when importing a method from a trait).
- - Fixed bug (segfault with unpacking and magic method closure).
- - Fixed bug (String concatenation performance regression in 8.3).
- - Fixed (Missing "Optional parameter before required" deprecation on union null type).
- - Implement the #[\Override] attribute RFC.
- - Fixed bug (Incorrect handling of unwind and graceful exit exceptions).
- - Added zend_call_stack_get implementation for OpenBSD.
- - Add stack limit check in zend_eval_const_expr().
- - Expose time spent collecting cycles in gc_status().
- - Remove WeakMap entries whose key is only reachable through the entry value.
- - Resolve open_basedir paths on INI update.
- - Fixed oss-fuzz #60741 (Leak in open_basedir).
- - Fixed segfault during freeing of some incompletely initialized objects due to OOM error (PDO, SPL, XSL).
- - Introduced Zend guard recursion protection to fix __debugInfo issue.
- - Fixed oss-fuzz #61712 (assertion failure with error handler during binary op).
- - Fixed (DTrace enabled build is broken).
- - Fixed OSS Fuzz #61865 (Undef variable in ++/-- for declared property that is unset in error handler).
- - Fixed warning emitted when checking if a user stream is castable.
- - Fixed bug (Compile error on MacOS with C++ extension when using ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX).
- - Fixed bug (#[Override] attribute in trait does not check for parent class implementations).
- - Fixed OSS Fuzz #62294 (Unsetting variable after ++/-- on string variable warning).
- - Fixed buffer underflow when compiling memoized expression.
- - Fixed oss-fuzz #63802 (OP1 leak in error path of post inc/dec).
-
-- Curl:
-
- - Added Curl options and constants up to (including) version 7.87.
-
-- Date:
-
- - Implement More Appropriate Date/Time Exceptions RFC.
-
-- DOM:
-
- - Fix bug (DOMAttr unescapes character reference).
- - Fix bug (getElementsByTagName() is O(N^2)).
- - Fix #79700 (wrong use of libxml oldNs leads to performance problem).
- - Fix #77894 (DOMNode::C14N() very slow on generated DOMDocuments even after normalisation).
- - Revert changes to DOMAttr::$value and DOMAttr::$nodeValue expansion.
- - Fixed bug (Namespace reuse in createElementNS() generates wrong output).
- - Implemented DOMDocument::adoptNode(). Previously this always threw a "not yet implemented" exception.
- - Fixed bug (Implicitly removing nodes from \DOMDocument breaks existing references).
- - Added DOMNode::contains() and DOMNameSpaceNode::contains().
- - Added DOMElement::getAttributeNames().
- - Added DOMNode::getRootNode().
- - Added DOMElement::className and DOMElement::id.
- - Added DOMParentNode::replaceChildren().
- - Added DOMNode::isConnected and DOMNameSpaceNode::isConnected.
- - Added DOMNode::parentElement and DOMNameSpaceNode::parentElement.
- - Added DOMNode::isEqualNode().
- - Added DOMElement::insertAdjacentElement() and DOMElement::insertAdjacentText().
- - Added DOMElement::toggleAttribute().
- - Fixed bug (LIBXML_NOXMLDECL is not implemented or broken).
- - adoptNode now respects the strict error checking property.
- - Align DOMChildNode parent checks with spec.
- - (Removing documentElement after creating attribute node: possible use-after-free).
- - Fix various namespace prefix conflict resolution bugs.
- - Fix calling createAttributeNS() without prefix causing the default namespace of the element to change.
- - Fixed (Confusing warning when blocking entity loading via libxml_set_external_entity_loader).
- - Fix broken cache invalidation with deallocated and reallocated document node.
- - Fix compile error when php_libxml.h header is included in C++.
- - (No way of removing redundant xmlns: declarations).
-
-- Exif:
-
- - Removed unneeded codepaths in exif_process_TIFF_in_JPEG().
-
-- FFI:
-
- - Implement (Allow to pass CData into struct and/or union fields).
-
-- Fileinfo:
-
- - Upgrade bundled libmagic to 5.43.
- - Fix (Unable to build PHP 8.3.0 alpha 1 / fileinfo extension).
-
-- FPM:
-
- - The status.listen shared pool now uses the same php_values (including expose_php) and php_admin_value as the pool it is shared with.
- - Added warning to log when fpm socket was not registered on the expected path.
- - (system() function call leaks php-fpm listening sockets).
- - Fixed (PHP 8.3.0RC1 borked socket-close-on-exec.phpt).
-
-- GD:
-
- - Removed imagerotate "ignore_transparent" argument since it has no effect.
-
-- Intl:
-
- - Added pattern format error infos for numfmt_set_pattern.
- - Added MIXED_NUMBERS and HIDDEN_OVERLAY constants for the Spoofchecker's class.
- - Updated datefmt_set_timezone/IntlDateformatter::setTimezone returns type. (David Carlier).
- - Updated IntlBreakInterator::setText return type.
- - Updated IntlChar::enumCharNames return type.
- - Removed the BC break on IntlDateFormatter::construct which threw an exception with an invalid locale.
-
-- JSON:
-
- - Added json_validate().
-
-- LDAP:
-
- - Deprecate calling ldap_connect() with separate hostname and port.
-
-- LibXML:
-
- - Fix compile error with -Werror=incompatible-function-pointer-types and old libxml2.
-
-- MBString:
-
- - mb_detect_encoding is better able to identify the correct encoding for Turkish text.
- - mb_detect_encoding's "non-strict" mode now behaves as described in the documentation. Previously, it would return false if the same byte (for example, the first byte) of the input string was invalid in all candidate encodings. More generally, it would eliminate candidate encodings from consideration when an invalid byte was seen, and if the same input byte eliminated all remaining encodings still under consideration, it would return false. On the other hand, if all candidate encodings but one were eliminated from consideration, it would return the last remaining one without regard for how many encoding errors might be encountered later in the string. This is different from the behavior described in the documentation, which says: "If strict is set to false, the closest matching encoding will be returned." (Alex Dowad)
- - mb_strtolower, mb_strtotitle, and mb_convert_case implement conditional casing rules for the Greek letter sigma. For mb_convert_case, conditional casing only applies to MB_CASE_LOWER and MB_CASE_TITLE modes, not to MB_CASE_LOWER_SIMPLE and MB_CASE_TITLE_SIMPLE.
- - mb_detect_encoding is better able to identify UTF-8 and UTF-16 strings with a byte-order mark.
- - mb_decode_mimeheader interprets underscores in QPrint-encoded MIME encoded words as required by RFC 2047; they are converted to spaces. Underscores must be encoded as "=5F" in such MIME encoded words.
- - mb_encode_mimeheader no longer drops NUL (zero) bytes when QPrint-encoding the input string. This previously caused strings in certain text encodings, especially UTF-16 and UTF-32, to be corrupted by mb_encode_mimeheader.
- - Implement mb_str_pad() RFC.
- - Fixed bug (PHP 8.3 build fails with --enable-mbstring enabled).
- - Fix use-after-free of mb_list_encodings() return value.
- - Fixed bug (utf_encodings.phpt fails on Windows 32-bit).
-
-- mysqli:
-
- - mysqli_fetch_object raises a ValueError instead of an Exception.
-
-- Opcache:
-
- - Added start, restart and force restart time to opcache's phpinfo section.
- - Fix : Allow FFI in opcache.preload when opcache.preload_user=root.
- - Made opcache.preload_user always optional in the cli and phpdbg SAPIs.
- - Allows W/X bits on page creation on FreeBSD despite system settings.
- - Added memfd api usage, on Linux, for zend_shared_alloc_create_lock() to create an abstract anonymous file for the opcache's lock.
- - Avoid resetting JIT counter handlers from multiple processes/threads.
- - Fixed COPY_TMP type inference for references.
-
-- OpenSSL:
-
- - Added OPENSSL_CMS_OLDMIMETYPE and PKCS7_NOOLDMIMETYPE contants to switch between mime content types.
- - Fixed : Reset OpenSSL errors when using a PEM public key.
- - Added support for additional EC parameters in openssl_pkey_new.
-
-- PCNTL:
-
- - SA_ONSTACK is now set for pcntl_signal.
- - Added SIGINFO constant.
-
-- PCRE:
-
- - Update bundled libpcre2 to 10.42.
-
-- PGSQL:
-
- - pg_fetch_object raises a ValueError instead of an Exception.
- - pg_cancel use thread safe PQcancel api instead.
- - pg_trace new PGSQL_TRACE_SUPPRESS_TIMESTAMPS/PGSQL_TRACE_REGRESS_MODE contants support.
- - pg_set_error_verbosity adding PGSQL_ERRORS_STATE constant.
- - pg_convert/pg_insert E_WARNING on type errors had been converted to ValueError/TypeError exceptions.
- - Added pg_set_error_context_visibility to set the context's visibility within the error messages.
-
-- Phar:
-
- - Fix memory leak in phar_rename_archive().
-
-- POSIX:
-
- - Added posix_sysconf.
- - Added posix_pathconf.
- - Added posix_fpathconf.
- - Fixed zend_parse_arg_long's bool pointer argument assignment.
- - Added posix_eaccess.
-
-- Random:
-
- - Added Randomizer::getBytesFromString().
- - Added Randomizer::nextFloat(), ::getFloat(), and IntervalBoundary.
- - Enable getrandom() for NetBSD (from 10.x).
- - Deprecate MT_RAND_PHP.
- - Fix Randomizer::getFloat() returning incorrect results under certain circumstances.
-
-- Reflection:
-
- - Fix (ReflectionMethod constructor should not find private parent method).
- - Fix (ReflectionClass::getStaticProperties doesn't need null return type).
-
-- SAPI:
-
- - Fixed (Could not open input file: should be sent to stderr).
-
-- Session:
-
- - Fixed bug (Crash after dealing with an Apache request).
-
-- SimpleXML:
-
- - Fixed bug (SimpleXML infinite loop when getName() is called within foreach).
- - Fixed bug (SimpleXML infinite loop when a cast is used inside a foreach).
- - (SimpleXML iteration produces infinite loop).
-
-- Sockets:
-
- - Added SO_ATTACH_REUSEPORT_CBPF socket option, to give tighter control over socket binding for a cpu core.
- - Added SKF_AD_QUEUE for cbpf filters.
- - Added socket_atmark if send/recv needs using MSG_OOB.
- - Added TCP_QUICKACK constant, to give tigher control over ACK delays.
- - Added DONTFRAGMENT support for path MTU discovery purpose.
- - Added AF_DIVERT for raw socket for divert ports.
- - Added SOL_UPDLITE, UDPLITE_RECV_CSCOV and UDPLITE_SEND_CSCOV for updlite protocol support.
- - Added SO_RERROR, SO_ZEROIZE and SO_SPLICE netbsd and openbsd constants.
- - Added TCP_REPAIR for quietly close a connection.
- - Added SO_REUSEPORT_LB freebsd constant.
- - Added IP_BIND_ADDRESS_NO_PORT.
-
-- SPL:
-
- - Fixed (RecursiveDirectoryIterator::hasChildren is slow).
-
-- Standard:
-
- - E_NOTICEs emitted by unserialize() have been promoted to E_WARNING.
- - unserialize() now emits a new E_WARNING if the input contains unconsumed bytes.
- - Make array_pad's $length warning less confusing.
- - E_WARNING emitted by strtok in the caase both arguments are not provided when starting tokenisation.
- - password_hash() will now chain the original RandomException to the ValueError on salt generation failure.
- - Fix (proc_close after proc_get_status always returns -1).
- - Improve the warning message for unpack() in case not enough values were provided.
- - Fix (parse_ini_string() now preserves formatting of unquoted strings starting with numbers when the INI_SCANNER_TYPED flag is specified).
- - Fix (http_response_code emits no error when headers were already sent).
- - Added support for rounding negative places in number_format().
- - Prevent precision loss on formatting decimal integers in number_format().
- - Added usage of posix_spawn for proc_open when supported by OS.
- - Added $before_needle argument to strrchr().
- - Fixed (str_getcsv returns null byte for unterminated enclosure).
- - Fixed str_decrement() on "1".
-
-- Streams:
-
- - : blocking fread() will block even if data is available.
- - Added storing of the original path used to open xport stream.
- - Implement (STREAM_NOTIFY_COMPLETED over HTTP never emitted).
- - Fix bug (fgets on a redis socket connection fails on PHP 8.3).
- - Implemented (_php_stream_copy_to_mem: Allow specifying a maximum length without allocating a buffer of that size).
- - (fseek() on memory stream behavior different than file).
- - (Can read "non-existant" files).
-
-- XSLTProcessor:
-
- - (DomNode::getNodePath() returns invalid path).
-
-- ZIP:
-
- - zip extension version 1.22.0 for libzip 1.10.0.
- - add new error macros (ER_DATA_LENGTH and ER_NOT_ALLOWED).
- - add new archive global flags (ER_AFL_*).
- - add ZipArchive::setArchiveFlag and ZipArchive::getArchiveFlag methods.
-
-
-
-
-
-
-
-
-
-Version 8.2.31
-
-- Curl:
-
- - Add support for brotli and zstd on Windows.
-
-- FPM:
-
- - Fixed (XSS within status endpoint). (CVE-2026-6735)
-
-- MBString:
-
- - Fixed (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (CVE-2026-7259)
-
-- OpenSSL:
-
- - Fix compatibility issues with OpenSSL 4.0.
-
-- PDO_Firebird:
-
- - Fixed (SQL injection via NUL bytes in quoted strings). (CVE-2025-14179)
-
-- SOAP:
-
- - Fixed (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (CVE-2026-6722)
- - Fixed (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (CVE-2026-7261)
- - Fixed (Broken Apache map value NULL check). (CVE-2026-7262)
-
-- Standard:
-
- - Fixed (Signed integer overflow of char array offset). (CVE-2026-7568)
- - Fixed (Consistently pass unsigned char to ctype.h functions). (CVE-2026-7258)
-
-
-
-
-
-
-
-Version 8.2.30
-
-- Curl:
-
- - Fix curl build and test failures with version 8.16.
-
-- Opcache:
-
- - Reset global pointers to prevent use-after-free in zend_jit_status().
-
-- PDO:
-
- - Fixed (PDO quoting result null deref). (CVE-2025-14180)
-
-- Standard:
-
- - Fixed (Null byte termination in dns_get_record()).
- - Fixed (Heap buffer overflow in array_merge()). (CVE-2025-14178)
- - Fixed (Information Leak of Memory in getimagesize). (CVE-2025-14177)
-
-
-
-
-
-
-
-Version 8.2.29
-
-- PGSQL:
-
- - Fixed (pgsql extension does not check for errors during escaping). (CVE-2025-1735)
-
-- SOAP:
-
- - Fixed (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491)
-
-- Standard:
-
- - Fixed (Null byte termination in hostnames). (CVE-2025-1220)
-
-
-
-
-
-
-
-Version 8.2.28
-
-- Core:
-
- - Fixed bug (observer segfault on function loaded with dl()).
-
-- LibXML:
-
- - Fixed (Reocurrence of #72714).
- - Fixed (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
-
-- Streams:
-
- - Fixed (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
- - Fixed (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
- - Fixed (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
- - Fixed (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
-
-- Windows:
-
- - Fixed phpize for Windows 11 (24H2).
-
-
-
-
-
-
-
-Version 8.2.27
-
-- Calendar:
-
- - Fixed jdtogregorian overflow.
- - Fixed cal_to_jd julian_days argument overflow.
-
-- COM:
-
- - Fixed bug (Getting typeinfo of non DISPATCH variant segfaults).
-
-- Core:
-
- - Fail early in *nix configuration build script.
- - Fixed bug (Opcache bad signal 139 crash in ZTS bookworm (frankenphp)).
- - Fixed bug (Assertion failure at Zend/zend_vm_execute.h:7469).
- - Fixed bug (UAF in lexer with encoding translation and heredocs).
- - Fix is_zend_ptr() huge block comparison.
- - Fixed potential OOB read in zend_dirname() on Windows.
-
-- Curl:
-
- - Fix various memory leaks in curl mime handling.
-
-- FPM:
-
- - Fixed (PHP-FPM 8.2 SIGSEGV in fpm_get_status).
-
-- GD:
-
- - Fixed (imagecreatefromstring overflow).
-
-- GMP:
-
- - Revert gmp_pow() overly restrictive overflow checks.
-
-- Hash:
-
- - Fixed : Segfault in mhash().
-
-- Opcache:
-
- - Fixed bug (Tracing JIT type mismatch when returning UNDEF).
- - Fixed bug (JIT_G(enabled) not set correctly on other threads).
- - Fixed bug (Set of opcache tests fail zts+aarch64).
-
-- OpenSSL:
-
- - Prevent unexpected array entry conversion when reading key.
- - Fix various memory leaks related to openssl exports.
- - Fix memory leak in php_openssl_pkey_from_zval().
-
-- PDO:
-
- - Fixed memory leak of `setFetchMode()`.
-
-- Phar:
-
- - Fixed bug (phar:// tar parser and zero-length file header blocks).
-
-- PHPDBG:
-
- - Fixed bug (Segfault with breakpoint map and phpdbg_clear()).
-
-- SAPI:
-
- - Fixed bug (UBSAN warning in rfc1867).
-
-- SimpleXML:
-
- - Fixed bug (Segmentation fault in RecursiveIteratorIterator ->current() with a xml element input).
-
-- SNMP:
-
- - Fixed bug (snmget modifies the object_id array).
-
-- Standard:
-
- - Fixed bug (Internal iterator functions can't handle UNDEF properties).
-
-- Streams:
-
- - Fixed network connect poll interuption handling.
-
-- Windows:
-
- - Fixed bug (Error dialog causes process to hang).
-
-
-
-
-
-
-
-Version 8.2.26
-
-- CLI:
-
- - Fixed bug (Shebang is not skipped for router script in cli-server started through shebang).
- - Fixed bug (Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface).
-
-- COM:
-
- - Fixed out of bound writes to SafeArray data.
-
-- Core:
-
- - Fixed bug (php 8.1 and earlier crash immediately when compiled with Xcode 16 clang on macOS 15).
- - Fixed bug (Assertion failure in Zend/zend_weakrefs.c:646).
- - Fixed bug (Incorrect propagation of ZEND_ACC_RETURN_REFERENCE for call trampoline).
- - Fixed bug (Incorrect line number in function redeclaration error).
- - Fixed bug (Incorrect line number in inheritance errors of delayed early bound classes).
- - Fixed bug (Use-after-free during array sorting).
-
-- Curl:
-
- - Fixed bug (CurlMultiHandle holds a reference to CurlHandle if curl_multi_add_handle fails).
-
-- Date:
-
- - Fixed bug (Unhandled INF in date_sunset() with tiny $utcOffset).
- - Fixed bug (Assertion failure in ext/date/php_date.c).
- - Fixed bug (date_sun_info() fails for non-finite values).
-
-- DBA:
-
- - Fixed bug (dba_open() can segfault for "pathless" streams).
-
-- DOM:
-
- - Fixed bug (DOMXPath breaks when not initialized properly).
- - Fixed bug (dom_import_simplexml stub is wrong).
- - Fixed bug (Segfault when adding attribute to parent that is not an element).
- - Fixed bug (UAF when using document as a child).
- - Fixed bug (Assertion failure in DOM->replaceChild).
- - Fixed bug (Another UAF in DOM -> cloneNode).
-
-- EXIF:
-
- - Fixed bug (Segfault in exif_thumbnail when not dealing with a real file).
-
-- FFI:
-
- - Fixed bug (Segmentation fault when comparing FFI object).
-
-- Filter:
-
- - Fixed bug (FILTER_FLAG_HOSTNAME accepts ending hyphen).
-
-- FPM:
-
- - Fixed bug (FPM logs are getting corrupted with this log statement).
-
-- GD:
-
- - Fixed bug (imageaffine overflow on matrix elements).
- - Fixed bug (Unchecked libavif return values).
- - Fixed bug (UBSan abort in ext/gd/libgd/gd_interpolation.c:1007).
-
-- GMP:
-
- - Fixed floating point exception bug with gmp_pow when using large exposant values. (David Carlier).
- - Fixed bug (gmp_export() can cause overflow).
- - Fixed bug (gmp_random_bits() can cause overflow).
- - Fixed gmp_pow() overflow bug with large base/exponents.
- - Fixed segfaults and other issues related to operator overloading with GMP objects.
-
-- LDAP:
-
- - Fixed bug (OOB access in ldap_escape). (CVE-2024-8932)
-
-- MBstring:
-
- - Fixed bug (mb_substr overflow on start/length arguments).
-
-- MySQLnd:
-
- - Fixed bug (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
-
-- OpenSSL:
-
- - Fixed bug (openssl may modify member types of certificate arrays).
- - Fixed bug (Large values for openssl_csr_sign() $days overflow).
- - Fix various memory leaks on error conditions in openssl_x509_parse().
-
-- PDO DBLIB:
-
- - Fixed bug (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
-
-- PDO Firebird:
-
- - Fixed bug (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
-
-- PDO ODBC:
-
- - Fixed bug (PDO_ODBC can inject garbage into field values).
-
-- Phar:
-
- - Fixed bug (Assertion failure in ext/phar/phar.c:2808).
-
-- PHPDBG:
-
- - Fixed bug (Empty string is an invalid expression for ev).
-
-- Reflection:
-
- - Fixed bug (Memory leak in Reflection constructors).
-
-- Session:
-
- - Fixed bug (Unexpected null returned by session_set_cookie_params).
- - Fixed bug (overflow on cookie_lifetime ini value).
-
-- SOAP:
-
- - Fixed bug (Segmentation fault access null pointer in SoapClient).
-
-- Sockets:
-
- - Fixed bug with overflow socket_recvfrom $length argument.
-
-- SPL:
-
- - Fixed bug (Use-after-free in SplHeap).
- - Fixed bug (Use-after-free in SplDoublyLinkedList::offsetSet()).
- - Fixed bug (Use-after-free in SplObjectStorage::setInfo()).
- - Fixed bug (Use-after-free in SplFixedArray::unset()).
- - Fixed bug (UAF in Observer->serialize).
- - Fix (Segmentation fault when calling __debugInfo() after failed SplFileObject::__constructor).
- - Fixed bug (UAF in SplDoublyLinked->serialize()).
- - Fixed bug (segfault on SplObjectIterator instance).
- - Fixed bug (Memory leaks in SPL constructors).
- - Fixed bug (UAF in ArrayObject::unset() and ArrayObject::exchangeArray()).
-
-- Standard:
-
- - Fixed bug (Failed assertion when throwing in assert() callback with bail enabled).
-
-- Streams:
-
- - Fixed bug (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
- - Fixed bug (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
-
-- SysVMsg:
-
- - Fixed bug (msg_send() crashes when a type does not properly serialized).
-
-- SysVShm:
-
- - Fixed bug (Assertion error in shm_put_var).
-
-- XMLReader:
-
- - Fixed bug (Segmentation fault in ext/xmlreader/php_xmlreader.c).
-
-- Zlib:
-
- - Fixed bug (Memory management is broken for bad dictionaries.) (cmb)
-
-
-
-
-
-
-
-Version 8.2.25
-
-- Calendar:
-
- - Fixed : jdtounix overflow on argument value.
- - Fixed : easter_days/easter_date overflow on year argument.
- - Fixed : jddayofweek overflow.
- - Fixed : jewishtojd overflow.
-
-- CLI:
-
- - Fixed bug : duplicate http headers when set several times by the client.
-
-- Core:
-
- - Fixed bug : zend_strtod overflow with precision INI set on large value.
- - Fixed bug (Assertion failure for TRACK_VARS_SERVER).
- - Fixed bug (Failed assertion when promoting Serialize deprecation to exception).
- - Fixed bug (Segfault when printing backtrace during cleanup of nested generator frame).
- - Fixed bug (Core dumped in Zend/zend_generators.c).
- - Fixed bug (Assertion failure in Zend/zend_exceptions.c).
- - Fixed bug (Observer segfault when calling user function in internal function via trampoline).
-
-- Date:
-
- - Fixed bug : Crash when not calling parent constructor of DateTimeZone.
- - Fixed regression where signs after the first one were ignored while parsing a signed integer, with the DateTimeInterface::modify() function.
-
-- DOM:
-
- - Fixed bug (Segmentation fault (access null pointer) in ext/dom/parentnode/tree.c).
- - Fixed bug (Assertion failure in ext/dom/parentnode/tree.c).
-
-- GD:
-
- - Fixed bug (bitshift overflow on wbmp file content reading / fix backport from upstream).
- - Fixed bug (overflow/underflow on imagerotate degrees value) (David Carlier)
- - Fixed bug (imagescale underflow on RBG channels / fix backport from upstream).
-
-- LDAP:
-
- - Fixed bug (Various NULL pointer dereferencements in ldap_modify_batch()).
- - Fixed bug (Segfault in ldap_list(), ldap_read(), and ldap_search() when LDAPs array is not a list).
- - Fix (php_ldap_do_modify() attempts to free pointer not allocated by ZMM.).
- - Fix (Memory leak in php_ldap_do_modify() when entry is not a proper dictionary).
-
-- MBString:
-
- - Fixed bug (Reference invariant broken in mb_convert_variables()).
-
-- OpenSSL:
-
- - Fixed stub for openssl_csr_new.
-
-- PCRE:
-
- - Fixed bug (underflow on offset argument).
- - Fixed bug (UBSan address overflowed in ext/pcre/php_pcre.c).
-
-- PHPDBG:
-
- - Fixed bug (phpdbg: Assertion failure on i funcs).
- - Fixed bug (phpdbg: exit in exception handler reports fatal error).
-
-- Reflection:
-
- - Fixed bug (Assertion failure in ext/reflection/php_reflection.c).
-
-- SAPI:
-
- - Fixed bug (php-fpm: zend_mm_heap corrupted with cgi-fcgi request).
-
-- SimpleXML:
-
- - Fixed bug (Segmentation fault in ext/simplexml/simplexml.c).
-
-- Sockets:
-
- - Fixed bug (socket_strerror overflow on errno argument).
-
-- SOAP:
-
- - (Wrong namespace on xsd import error message).
- - Fixed bug (Segmentation fault when cloning SoapServer).
- - Fix Soap leaking http_msg on error.
- - Fixed bug (Assertion failure in ext/soap/php_encoding.c:460).
- - Fixed bug (Soap segfault when classmap instantiation fails).
-
-- Standard:
-
- - Fixed bug (overflow on unpack call hex string repeater).
- - Fixed bug (overflow on stream timeout option value).
- - Fixed bug (Assertion failure in Zend/zend_hash.c).
-
-- Streams:
-
- - Fixed bugs and (leak / assertion failure in streams.c).
- - Fixed bug (Signed integer overflow in main/streams/streams.c).
-
-- TSRM:
-
- - Prevent closing of unrelated handles.
-
-- XML:
-
- - Fixed bug (Assertion failure in xml_parse_into_struct after exception).
-
-
-
-
-
-
-
-Version 8.2.24
-
-- CGI:
-
- - Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
- - Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
-
-- Core:
-
- - Fixed bug (MSan false-positve on zend_max_execution_timer).
- - Fixed bug (Configure error grep illegal option q).
- - Fixed bug (Configure error: genif.sh: syntax error).
- - Fixed bug (--disable-ipv6 during compilation produces error EAI_SYSTEM not found).
- - Fixed bug (CRC32 API build error on arm 32-bit).
- - Fixed bug (Do not scan generator frames more than once).
- - Fixed uninitialized lineno in constant AST of internal enums.
-
-- Curl:
-
- - FIxed bug (curl_multi_select overflow on timeout argument).
-
-- DOM:
-
- - Fixed bug (Segmentation fault (access null pointer) in ext/dom/xml_common.h).
-
-- Fileinfo:
-
- - Fixed bug (Incorrect error message for finfo_file with an empty filename argument).
-
-- FPM:
-
- - Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
-
-- MySQLnd:
-
- - Fixed bug (Heap corruption when querying a vector).
-
-- Opcache:
-
- - Fixed bug (Access null pointer in Zend/Optimizer/zend_inference.c).
- - Fixed bug (Segmentation fault in Zend/zend_vm_execute.h).
-
-- SAPI:
-
- - Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
-
-- SOAP:
-
- - (PHP SOAPClient does not support stream context HTTP headers in array form).
-
-- Standard:
-
- - Fixed bug (Signed integer overflow in ext/standard/scanf.c).
-
-- Streams:
-
- - Fixed bug (php_stream_memory_get_buffer() not zero-terminated).
-
-
-
-
-
-
-
-Version 8.2.23
-
-- Core:
-
- - Fixed bug (Memory leak in Zend/Optimizer/escape_analysis.c).
- - Fixed bug (Memory leak in Zend/zend_ini.c).
- - Fixed bug (Append -Wno-implicit-fallthrough flag conditionally).
- - Fix uninitialized memory in network.c.
- - Fixed bug (Segfault when destroying generator during shutdown).
- - Fixed bug (Crash during GC of suspended generator delegate).
-
-- Curl:
-
- - Fixed case when curl_error returns an empty string.
-
-- DOM:
-
- - Fix UAF when removing doctype and using foreach iteration.
-
-- FFI:
-
- - Fixed bug (ffi enum type (when enum has no name) make memory leak).
-
-- Hash:
-
- - Fix crash when converting array data for array in shm in xxh3.
-
-- Intl:
-
- - Fixed bug (IntlChar::foldCase()'s $option is not optional).
-
-- Opcache:
-
- - Fixed bug (Segmentation fault for enabled observers after pass 4).
- - Fixed bug (Memory leak possibly related to opcache SHM placement).
-
-- Output:
-
- - Fixed bug (Segmentation fault (null pointer dereference) in ext/standard/url_scanner_ex.re).
-
-- PDO_Firebird:
-
- - Fix bogus fallthrough path in firebird_handle_get_attribute().
-
-- PHPDBG:
-
- - Fixed bug (EOF emits redundant prompt in phpdbg local console mode with libedit/readline).
- - Fixed bug (heap buffer overflow in phpdbg (zend_hash_num_elements() Zend/zend_hash.h)).
- - Fixed bug use-after-free on watchpoint allocations.
-
-- Soap:
-
- - (Digest autentication dont work).
- - Fix SoapFault property destruction.
- - Fixed bug (SOAP XML broken since PHP 8.3.9 when using classmap constructor option).
-
-- Standard:
-
- - Fix passing non-finite timeout values in stream functions.
- - Fixed p(f)sockopen timeout overflow.
-
-- Streams:
-
- - Fixed bug (Memory leak in ext/phar/stream.c).
- - Fixed bug (Integer overflow on stream_notification_callback byte_max parameter with files bigger than 2GB).
-
-- Tidy:
-
- - Fix memory leaks in ext/tidy basedir restriction code.
-
-
-
-
-
-
-
-Version 8.2.22
-
-- Core:
-
- - Fixed bug (Fixed support for systems with sysconf(_SC_GETPW_R_SIZE_MAX) == -1).
- - Fixed bug (Fix is_zend_ptr() for huge blocks).
- - Fixed bug (Memory leak in FPM test gh13563-conf-bool-env.phpt.
- - Fixed OSS-Fuzz #69765.
- - Fixed bug (Segmentation fault in Zend/zend_types.h).
- - Fixed bug (Use-after-free in property coercion with __toString()).
-
-- Dom:
-
- - Fixed bug (DOMDocument::xinclude() crash).
-
-- Gd:
-
- - ext/gd/tests/gh10614.phpt: skip if no PNG support.
- - restored warning instead of fata error.
-
-- LibXML:
-
- - Fixed bug (Build failure with libxml2 v2.13.0).
-
-- Opcache:
-
- - Fixed bug (No warning message when Zend DTrace is enabled that opcache.jit is implictly disabled).
-
-- Output:
-
- - Fixed bug (Unexpected null pointer in Zend/zend_string.h with empty output buffer).
-
-- PDO:
-
- - Fixed bug (Crash with PDORow access to null property).
-
-- Phar:
-
- - Fixed bug (null string from zip entry).
-
-- PHPDBG:
-
- - Fixed bug (crashes with ASAN and ZEND_RC_DEBUG=1).
- - Fixed bug (echo output trimmed at NULL byte).
-
-- Shmop:
-
- - Fixed bug (shmop Windows 11 crashes the process).
-
-- SimpleXML:
-
- - Fixed bug (null dereference after XML parsing failure).
-
-- SPL:
-
- - Fixed bug (Member access within null pointer in ext/spl/spl_observer.c).
-
-- Standard:
-
- - Fix 32-bit wordwrap test failures.
- - Fixed bug (time_sleep_until overflow).
-
-- Tidy:
-
- - Fix memory leak in tidy_repair_file().
-
-- Treewide:
-
- - Fix compatibility with libxml2 2.13.2.
-
-- XML:
-
- - Move away from to-be-deprecated libxml fields.
- - Fixed bug (Error installing PHP when --with-pear is used).
-
-
-
-
-
-
-
-Version 8.2.21
-
-- Core:
-
- - Fixed bug (Incompatible pointer type warnings).
- - Fixed bug (max_execution_time reached too early on MacOS 14 when running on Apple Silicon).
- - Fixed bug (Crash when stack walking in destructor of yielded from values during Generator->throw()).
- - Fixed bug (Attempting to initialize class with private constructor calls destructor).
- - Fixed bug (Incompatible function pointer type for fclose).
-
-- BCMatch:
-
- - Fixed bug (bcpowmod() with mod = -1 returns 1 when it must be 0).
-
-- Curl:
-
- - Fixed bug (Test curl_basic_024 fails with curl 8.8.0).
-
-- DOM:
-
- - Fixed bug (Memory leak in xml and dom).
-
-- FPM:
-
- - Fixed bug (PHP-FPM ping.path and ping.response config vars are ignored in status pool).
-
-- GD:
-
- - Fix parameter numbers for imagecolorset().
-
-- Intl:
-
- - Fix reference handling in SpoofChecker.
-
-- MySQLnd:
-
- - Partially fix bug (Apache crash on Windows when using a self-referencing anonymous function inside a class with an active mysqli connection).
-
-- Opcache:
-
- - Fixed bug (opcache.jit=off does not allow enabling JIT at runtime).
- - Fixed TLS access in JIT on FreeBSD/amd64.
- - Fixed bug (Error when building TSRM in ARM64).
-
-- PDO ODBC:
-
- - Fixed bug (incompatible SDWORD type with iODBC).
-
-- PHPDBG:
-
- - Fixed bug (segfault on watchpoint addition failure).
-
-- Soap:
-
- - (PHPClient can't decompress response).
- - Fix missing error restore code.
- - Fix memory leak if calling SoapServer::setObject() twice.
- - Fix memory leak if calling SoapServer::setClass() twice.
- - Fix reading zlib ini settings in ext-soap.
- - Fix memory leaks with string function name lookups.
- - (SoapClient classmap doesn't support fully qualified class name).
- - (SoapClient Cookie Header Semicolon).
- - Fixed memory leaks when calling SoapFault::__construct() twice.
-
-- Sodium:
-
- - Fix memory leaks in ext/sodium on failure of some functions.
-
-- SPL:
-
- - Fixed bug (Member access within null pointer in extension spl).
-
-- Standard:
-
- - Fixed bug (Fixed off-by-one error in checking length of abstract namespace Unix sockets).
-
-- Streams:
-
- - Fixed bug (PHP Fatal error triggers pointer being freed was not allocated and malloc: double free for ptr errors).
-
-
-
-
-
-
-
-Version 8.2.20
-
-- CGI:
-
- - Fixed buffer limit on Windows, replacing read call usage by _read.
- - Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
-
-- CLI:
-
- - Fixed bug (PHP Interactive shell input state incorrectly handles quoted heredoc literals.).
-
-- Core:
-
- - Fixed bug (Incorrect validation of #[Attribute] flags type for non-compile-time expressions).
- - Fixed bug (Floating point bug in range operation on Apple Silicon hardware).
-
-- DOM:
-
- - Fix crashes when entity declaration is removed while still having entity references.
- - Fix references not handled correctly in C14N.
- - Fix crash when calling childNodes next() when iterator is exhausted.
- - Fix crash in ParentNode::append() when dealing with a fragment containing text nodes.
-
-- FFI:
-
- - Fixed bug (Cannot use FFI::load on CRLF header file with apache2handler).
-
-- Filter:
-
- - Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
-
-- FPM:
-
- - Fix bug (Show decimal number instead of scientific notation in systemd status).
-
-- Hash:
-
- - ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__` (Saki Takamachi)
-
-- Intl:
-
- - Fixed build regression on systems without C++17 compilers.
-
-- Ini:
-
- - Fixed bug (Corrected spelling mistake in php.ini files).
-
-- MySQLnd:
-
- - Fix bug (mysqli_fetch_assoc reports error from nested query).
-
-- Opcache:
-
- - Fixed bug (Fix accidental persisting of internal class constant in shm).
-
-- OpenSSL:
-
- - The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.
-
-- Standard:
-
- - Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
-
-- XML:
-
- - Fixed bug (Segmentation fault with XML extension under certain memory limit).
-
-- XMLReader:
-
- - Fixed bug (XMLReader::open() can't be overridden).
-
-
-
-
-
-
-
-Version 8.2.19
-
-- Core:
-
- - Fixed bug (Invalid execute_data->opline pointers in observer fcall handlers when JIT is enabled).
- - Fixed bug (Applying zero offset to null pointer in Zend/zend_opcode.c).
- - Fixed bug (Align the behavior of zend-max-execution-timers with other timeout implementations).
- - Fixed bug (Broken cleanup of unfinished calls with callable convert parameters).
- - Fixed bug (Erroneous dnl appended in configure).
- - Fixed bug (If autoloading occurs during constant resolution filename and lineno are identified incorrectly).
- - Fixed bug (Missing void keyword).
-
-- Fibers:
-
- - Fixed bug (ASAN false positive underflow when executing copy()).
-
-- FPM:
-
- - Fixed bug (Setting bool values via env in FPM config fails).
-
-- Intl:
-
- - Fixed build for icu 74 and onwards.
-
-- MySQLnd:
-
- - Fix shift out of bounds on 32-bit non-fast-path platforms.
-
-- Opcache:
-
- - Fixed incorrect assumptions across compilation units for static calls.
-
-- OpenSSL:
-
- - Fixed bug (feof on OpenSSL stream hangs indefinitely).
-
-- PDO SQLite:
-
- - Fix (Buffer size is now checked before memcmp).
- - Fix (Manage refcount of agg_context->val correctly).
-
-- Phar:
-
- - Fixed bug (Renaming a file in a Phar to an already existing filename causes a NULL pointer dereference).
- - Fixed bug (Applying zero offset to null pointer in zend_hash.c).
- - Fix potential NULL pointer dereference before calling EVP_SignInit.
-
-- PHPDBG:
-
- - Fixed bug (Null pointer access of type 'zval' in phpdbg_frame).
-
-- Posix:
-
- - Fix usage of reentrant functions in ext/posix.
-
-- Session:
-
- - Fixed bug (Member access within null pointer of type 'ps_files' in ext/session/mod_files.c).
- - Fixed bug (memleak and segfault when using ini_set with session.trans_sid_hosts).
- - Fixed buffer _read/_write size limit on windows for the file mode.
-
-- Streams:
-
- - Fixed file_get_contents() on Windows fails with "errno=22 Invalid argument".
- - Fixed bug (Part 1 - Memory leak on stream filter failure).
- - Fixed bug (Incorrect PHP_STREAM_OPTION_CHECK_LIVENESS case in ext/openssl/xp_ssl.c - causing use of dead socket).
- - Fixed bug (Build fails on musl 1.2.4 - lfs64).
-
-- Treewide:
-
- - Fix gcc-14 Wcalloc-transposed-args warnings.
-
-
-
-
-
-
-
-Version 8.2.18
-
-- Core:
-
- - Fixed bug (Corrupted memory in destructor with weak references).
- - Fixed bug (AX_GCC_FUNC_ATTRIBUTE failure).
- - Fixed bug (GC does not scale well with a lot of objects created in destructor).
-
-- DOM:
-
- - Add some missing ZPP checks.
- - Fix potential memory leak in XPath evaluation results.
- - Fix phpdoc for DOMDocument load methods.
-
-- FPM:
-
- - Fix incorrect check in fpm_shm_free().
-
-- GD:
-
- - Fixed bug (add GDLIB_CFLAGS in feature tests).
-
-- Gettext:
-
- - Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL.
-
-- MySQLnd:
-
- - Fix (Fixed handshake response [mysqlnd]).
- - Fix incorrect charset length in check_mb_eucjpms().
-
-- Opcache:
-
- - Fixed (JITed QM_ASSIGN may be optimized out when op1 is null).
- - Fixed (Segmentation fault for enabled observers when calling trait method of internal trait when opcache is loaded).
-
-- PDO:
-
- - Fix various PDORow bugs.
-
-- Random:
-
- - Fixed bug (Pre-PHP 8.2 compatibility for mt_srand with unknown modes).
- - Fixed bug (Global Mt19937 is not properly reset in-between requests when MT_RAND_PHP is used).
-
-- Session:
-
- - Fixed bug (Segfault with session_decode and compilation error).
-
-- Sockets:
-
- - Fixed bug (socket_getsockname returns random characters in the end of the socket name).
-
-- SPL:
-
- - Fixed bug (Unable to resize SplfixedArray after being unserialized in PHP 8.2.15).
- - Fixed bug (Unexpected null pointer in zend_string.h).
-
-- Standard:
-
- - Fixed bug (Live filesystem modified by tests).
- - Fixed (Added validation of `\n` in $additional_headers of mail()).
- - Fixed bug (file_put_contents fail on strings over 4GB on Windows).
- - Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
- - Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
- - Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)
-
-- XML:
-
- - Fixed bug (Multiple test failures when building with --with-expat).
-
-
-
-
-
-
-
-Version 8.2.17
-
-- Core:
-
- - Fix ZTS persistent resource crashes on shutdown.
-
-- Curl:
-
- - Fix failing tests due to string changes in libcurl 8.6.0.
-
-- DOM:
-
- - Fix reference access in dimensions for DOMNodeList and DOMNodeMap.
-
-- Fileinfo:
-
- - Fixed bug (finfo::buffer(): Failed identify data 0:(null), backport).
-
-- FPM:
-
- - (getenv in php-fpm should not read $_ENV, $_SERVER).
-
-- GD:
-
- - Fixed bug (detection of image formats in system gd library).
-
-- MySQLnd:
-
- - Fixed bug ([mysqlnd] Fixed not to set CR_MALFORMED_PACKET to error if CR_SERVER_GONE_ERROR is already set).
-
-- PGSQL:
-
- - Fixed bug (pg_execute/pg_send_query_params/pg_send_execute with null value passed by reference).
-
-- Standard:
-
- - Fixed array key as hash to string (case insensitive) comparison typo for the second operand buffer size (albeit unused for now).
-
-
-
-
-
-
-
-Version 8.2.16
-
-- Core:
-
- - Fixed timer leak in zend-max-execution-timers builds.
- - Fixed bug (linking failure on ARM with mold).
- - Fixed bug (Anonymous class reference in trigger_error / thrown Exception).
- - Fixed bug (GCC 14 build failure).
-
-- Curl:
-
- - Fix missing error check in curl_multi_init().
-
-- FPM:
-
- - Fixed bug (Incorrect SCRIPT_NAME with Apache ProxyPassMatch when plus in path).
-
-- GD:
-
- - Fixed bug (imagettfbbox(): Could not find/open font UNC path).
- - Fixed bug (imagerotate will turn the picture all black, when rotated 90).
-
-- MySQLnd:
-
- - Fixed bug (When running a stored procedure (that returns a result set) twice, PHP crashes).
-
-- Opcache:
-
- - Fixed bug (Segmentation fault will be reported when JIT is off but JIT_debug is still on).
-
-- OpenSSL:
-
- - Fixed LibreSSL undefined reference when OPENSSL_NO_ENGINE not set. (David Carlier).
-
-- PDO_Firebird:
-
- - Fix (Changed to convert float and double values into strings using `H` format).
-
-- Phar:
-
- - (PHAR doesn't know about litespeed).
- - Fixed bug (PharData incorrectly extracts zip file).
-
-- Random:
-
- - Fixed bug (Randomizer::pickArrayKeys() does not detect broken engines).
-
-- Session:
-
- - Fixed bug (Corrupted session written when there's a fatal error in autoloader).
-
-- Streams:
-
- - Fixed bug (Copying large files using mmap-able source streams may exhaust available memory and fail).
-
-
-
-
-
-
-
-Version 8.2.15
-
-- Core:
-
- - Fixed bug (false positive SSA integrity verification failed when loading composer classmaps with more than 11k elements).
- - Fixed bug (missing cross-compiling 3rd argument so Autoconf doesn't emit warnings).
-
-- Cli:
-
- - Fix incorrect timeout in built-in web server when using router script and max_input_time.
-
-- FFI:
-
- - Fixed bug (stream_wrapper_register crashes with FFI\CData).
- - Fixed bug (FFI::new interacts badly with observers).
-
-- Intl:
-
- - Fixed (IntlDateFormatter::__construct accepts 'C' as valid locale).
-
-- Hash:
-
- - Fixed bug (hash() function hangs endlessly if using sha512 on strings >= 4GiB).
-
-- ODBC:
-
- - Fix crash on Apache shutdown with persistent connections.
-
-- Opcache:
-
- - Fixed oss-fuzz #64727 (JIT undefined array key warning may overwrite DIM with NULL when DIM is the same var as result).
- - Added workaround for SELinux mprotect execheap issue. See https://bugzilla.kernel.org/show_bug.cgi?id=218258.
-
-- OpenSSL:
-
- - Fixed bug (openssl_csr_sign might leak new cert on error).
-
-- PDO:
-
- - Fix (Fixed PDO::getAttribute() to get PDO::ATTR_STRINGIFY_FETCHES).
-
-- PDO_ODBC:
-
- - Fixed bug (Unable to turn on autocommit mode with setAttribute()).
-
-- PGSQL:
-
- - Fixed auto_reset_persistent handling and allow_persistent type.
- - Fixed bug (Apache crashes on shutdown when using pg_pconnect()).
-
-- Phar:
-
- - (Segmentation fault on including phar file).
-
-- PHPDBG:
-
- - Fixed bug (Double free of init_file in phpdbg_prompt.c).
-
-- SimpleXML:
-
- - Fix getting the address of an uninitialized property of a SimpleXMLElement resulting in a crash.
-
-- Tidy:
-
- - Fixed bug (tidynode.props.attribute is missing "Boolean Attributes" and empty attributes).
-
-
-
-
-
-
-
-Version 8.2.14
-
-- Core:
-
- - Fixed oss-fuzz #54325 (Use-after-free of name in var-var with malicious error handler).
- - Fixed oss-fuzz #64209 (In-place modification of filename in php_message_handler_for_zend).
- - Fixed bug / (Invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC).
- - Fix various missing NULL checks.
- - Fixed bug (Leak of call->extra_named_params on internal __call).
-
-- Date:
-
- - Fixed improbably integer overflow while parsing really large (or small) Unix timestamps.
-
-- DOM:
-
- - Fixed bug (DOM: Removing XMLNS namespace node results in invalid default: prefix).
-
-- FPM:
-
- - Fixed bug (Segmentation fault in fpm_status_export_to_zval).
-
-- FTP:
-
- - Fixed bug (FTP & SSL session reuse).
-
-- Intl:
-
- - Fixed bug (Test bug69398.phpt fails with ICU 74.1).
-
-- LibXML:
-
- - Fixed bug (libxml2 2.12.0 issue building from src).
- - Fixed test failures for libxml2 2.12.0.
-
-- MySQLnd:
-
- - Avoid using uninitialised struct.
- - Fixed bug (Possible dereference of NULL in MySQLnd debug code).
-
-- Opcache:
-
- - Fixed JIT bug (Function JIT emits "Uninitialized string offset" warning at the same time as invalid offset Error).
- - Fixed JIT bug (JIT emits "Attempt to assign property of non-object" warning at the same time as Error is being thrown).
-
-- OpenSSL:
-
- - (openssl_pkcs7_verify() may ignore untrusted CAs).
-
-- PCRE:
-
- - Fixed bug (The gh11374 test fails on Alpinelinux).
-
-- PDO PGSQL:
-
- - Fixed the default value of $fetchMode in PDO::pgsqlGetNotify() (kocsismate)
-
-- PGSQL:
-
- - Fixed bug wrong argument type for pg_untrace.
-
-- PHPDBG:
-
- - Fixed bug (MEMORY_LEAK in phpdbg_prompt.c).
-
-- SOAP:
-
- - Fixed bug ([SOAP] Temporary WSDL cache files not being deleted).
-
-- SPL:
-
- - Fixed bug (SplFileInfo::getFilename() segfault in combination with GlobIterator and no directory separator).
-
-- SQLite3:
-
- - Fixed bug (sqlite3_defensive.phpt fails with sqlite 3.44.0).
-
-- Standard:
-
- - Fix memory leak in syslog device handling.
- - Fixed bug (browscap segmentation fault when configured in the vhost).
- - Fixed bug (proc_open() does not take into account references in the descriptor array).
-
-- Streams:
-
- - (Stream wrappers in imagecreatefrompng causes segfault).
-
-- Zip:
-
- - Fixed bug (Inconsistency in ZipArchive::addGlob remove_path Option Behavior).
-
-
-
-
-
-
-
-Version 8.2.13
-
-- Core:
-
- - Fixed double-free of non-interned enum case name.
- - Fixed bug (Incorrect result of stripos with single character needle).
- - Fixed bug (Double-free of doc_comment when overriding static property via trait).
- - Fixed segfault caused by weak references to FFI objects.
- - Fixed max_execution_time: don't delete an unitialized timer.
- - Fixed bug (Arginfo soft-breaks with namespaced class return type if the class name starts with N).
-
-- DOM:
-
- - Fix registerNodeClass with abstract class crashing.
- - Add missing NULL pointer error check.
- - Fix validation logic of php:function() callbacks.
-
-- Fiber:
-
- - Fixed bug (ReflectionFiber segfault).
-
-- FPM:
-
- - Fixed bug (Loading ext in FPM config does not register module handlers).
- - Fixed bug (FPM: segfault dynamically loading extension without opcache).
- - (FastCGI terminates conn after FCGI_GET_VALUES).
-
-- Intl:
-
- - Removed the BC break on IntlDateFormatter::construct which threw an exception with an invalid locale.
-
-- Opcache:
-
- - Added warning when JIT cannot be enabled.
- - Fixed bug (Crashes in zend_accel_inheritance_cache_find since upgrading to 8.1.3 due to corrupt on-disk file cache).
-
-- OpenSSL:
-
- - Fixed bug (Missing sigbio creation checking in openssl_cms_verify).
-
-- PCRE:
-
- - Fixed bug (Backport upstream fix, Different preg_match result with -d pcre.jit=0).
-
-- SOAP:
-
- - Fixed bug (Segmentation fault on SoapClient::__getTypes).
- - (SOAP WSDL cache race condition causes Segmentation Fault).
- - (SOAP leaves incomplete cache file on ENOSPC).
- - Fix incorrect uri check in SOAP caching.
- - Fix segfault and assertion failure with refcounted props and arrays.
- - Fix potential crash with an edge case of persistent encoders.
- - (Memleak in SoapClient).
-
-- Streams:
-
- - (getimagesize with "&$imageinfo" fails on StreamWrappers).
-
-- XMLReader:
-
- - Add missing NULL pointer error check.
-
-- XMLWriter:
-
- - Add missing NULL pointer error check.
-
-- XSL:
-
- - Add missing module dependency.
- - Fix validation logic of php:function() callbacks.
-
-
-
-
-
-
-
-Version 8.2.12
-
-- Core:
-
- - Fixed bug (memory leak when class using trait with doc block).
- - Fixed bug (Module entry being overwritten causes type errors in ext/dom).
- - Fixed bug (__builtin_cpu_init check).
- - (ZTS + preload = segfault on shutdown).
-
-- CLI:
-
- - Ensure a single Date header is present.
-
-- CType:
-
- - Fixed bug (ctype_alnum 5 times slower in PHP 8.1 or greater).
-
-- DOM:
-
- - Restore old namespace reconciliation behaviour.
- - Fixed bug (DOMNode serialization on PHP ^8.1).
-
-- Fileinfo:
-
- - Fixed bug (fileinfo returns text/xml for some svg files).
-
-- Filter:
-
- - Fix explicit FILTER_REQUIRE_SCALAR with FILTER_CALLBACK (ilutov)
-
-- Hash:
-
- - Fixed bug (segfault copying/cloning a finalized HashContext).
-
-- Intl:
-
- - Fixed bug (segfault on IntlDateFormatter::construct).
- - Fixed bug (IntlDateFormatter::construct should throw an exception on an invalid locale).
-
-- MySQLnd:
-
- - Fixed bug (PHP Startup: Invalid library (maybe not a PHP library) 'mysqlnd.so' in Unknown on line).
-
-- Opcache:
-
- - Fixed opcache_invalidate() on deleted file.
- - Fixed bug (JIT+private array property access inside closure accesses private property in child class).
-
-- PCRE:
-
- - Fixed bug (Backport upstream fix, PCRE regular expressions with JIT enabled gives different result).
-
-- SimpleXML:
-
- - Fixed bug (Can't use xpath with comments in SimpleXML).
- - Fixed bug (Entity reference produces infinite loop in var_dump/print_r).
- - Fixed bug (Unable to get processing instruction contents in SimpleXML).
- - Fixed bug (Unable to get comment contents in SimpleXML).
-
-- Streams:
-
- - Fixed bug (binding ipv4 address with both address and port at 0).
-
-- XML:
-
- - Fix return type of stub of xml_parse_into_struct().
- - Fix memory leak when calling xml_parse_into_struct() twice.
-
-- XSL:
-
- - Fix type error on XSLTProcessor::transformToDoc return value with SimpleXML.
-
-
-
-
-
-
-
-Version 8.2.11
-
-- Core:
-
- - Fixed bug (Constant ASTs containing objects).
- - Fixed bug (On riscv64 require libatomic if actually needed).
- - Fixed bug : ini_parse_quantity() accepts invalid quantities.
- - Fixed bug (Segfault when freeing incompletely initialized closures).
- - Fixed bug (Internal iterator rewind handler is called twice).
- - Fixed bug (Incorrect compile error when using array access on TMP value in function call).
-
-- DOM:
-
- - Fix memory leak when setting an invalid DOMDocument encoding.
-
-- Iconv:
-
- - Fixed build for NetBSD which still uses the old iconv signature.
-
-- Intl:
-
- - Fixed bug (intl_get_error_message() broken after MessageFormatter::formatMessage() fails).
-
-- MySQLnd:
-
- - Fixed bug (Invalid error message when connection via SSL fails: "trying to connect via (null)").
-
-- ODBC:
-
- - Fixed memory leak with failed SQLPrepare.
- - Fixed persistent procedural ODBC connections not getting closed.
-
-- SimpleXML:
-
- - (XPath processing-instruction() function is not supported).
-
-- SPL:
-
- - Fixed bug (RecursiveCallbackFilterIterator regression in 8.1.18).
-
-- SQLite3:
-
- - Fixed bug (SQLite3 callback functions cause a memory leak with a callable array).
-
-
-
-
-
-
-
-Version 8.2.10
-
-- CLI:
-
- - Fixed bug (cli server crashes on SIGINT when compiled with ZEND_RC_DEBUG=1).
- - Fixed bug (Improve man page about the built-in server).
-
-- Date:
-
- - Fixed bug (Crash with DatePeriod when uninitialised objects are passed in).
-
-- Core:
-
- - Fixed strerror_r detection at configuration time.
- - Fixed trait typed properties using a DNF type not being correctly bound.
- - Fixed trait property types not being arena allocated if copied from an internal trait.
- - Fixed deep copy of property DNF type during lazy class load.
- - Fixed memory freeing of DNF types for non arena allocated types.
-
-- DOM:
-
- - Fix DOMEntity field getter bugs.
- - Fix incorrect attribute existence check in DOMElement::setAttributeNodeNS.
- - Fix DOMCharacterData::replaceWith() with itself.
- - Fix empty argument cases for DOMParentNode methods.
- - Fixed bug (Wrong default value of DOMDocument::xmlStandalone).
- - Fix json_encode result on DOMDocument.
- - Fix manually calling __construct() on DOM classes.
- - Fixed bug (ParentNode methods should perform their checks upfront).
- - Fix viable next sibling search for replaceWith.
- - Fix segfault when DOMParentNode::prepend() is called when the child disappears.
-
-- FFI:
-
- - Fix leaking definitions when using FFI::cdef()->new(...).
-
-- Hash:
-
- - Fix use-of-uninitialized-value in hash_pbkdf2(), fix missing $options parameter in signature.
-
-- MySQLnd:
-
- - Fixed bug (authentication to a sha256_password account fails over SSL).
- - Fixed bug (mysqlnd fails to authenticate with sha256_password accounts using passwords longer than 19 characters).
- - Fixed bug (MySQL Statement has a empty query result when the response field has changed, also Segmentation fault).
- - Fixed invalid error message "Malformed packet" when connection is dropped.
-
-- Opcache:
-
- - Fixed bug (opcache.interned_strings_buffer either has no effect or opcache_get_status() / phpinfo() is wrong).
- - Avoid adding an unnecessary read-lock when loading script from shm if restart is in progress.
-
-- PCNTL:
-
- - Revert behaviour of receiving SIGCHLD signals back to the behaviour before 8.1.22.
-
-- SPL:
-
- - (SplFixedArray::setSize() causes use-after-free).
-
-- Standard:
-
- - Prevent int overflow on $decimals in number_format.
- - Fixed bug (Fix off-by-one bug when truncating tempnam prefix) (athos-ribeiro)
-
-
-
-
-
-
-
-Version 8.2.9
-
-- Build:
-
- - Fixed bug (PHP version check fails with '-' separator).
-
-- CLI:
-
- - Fix interrupted CLI output causing the process to exit.
-
-- Core:
-
- - Fixed oss-fuzz #60011 (Mis-compilation of by-reference nullsafe operator).
- - Fixed line number of JMP instruction over else block.
- - Fixed use-of-uninitialized-value with ??= on assert.
- - Fixed oss-fuzz #60411 (Fix double-compilation of arrow-functions).
- - Fixed build for FreeBSD before the 11.0 releases.
-
-- Curl:
-
- - Fix crash when an invalid callback function is passed to CURLMOPT_PUSHFUNCTION.
-
-- Date:
-
- - Fixed bug (Date modify returns invalid datetime).
- - Fixed bug (Can't parse time strings which include (narrow) non-breaking space characters).
- - Fixed bug (DateTime:createFromFormat stopped parsing datetime with extra space).
-
-- DOM:
-
- - Fixed bug (DOMElement::replaceWith() doesn't replace node with DOMDocumentFragment but just deletes node or causes wrapping <></> depending on libxml2 version).
-
-- Fileinfo:
-
- - Fixed bug (finfo returns wrong mime type for xz files).
-
-- FTP:
-
- - Fix context option check for "overwrite".
- - Fixed bug (Memory leak and invalid state with consecutive ftp_nb_fget).
-
-- GD:
-
- - Fix most of the external libgd test failures.
-
-- Intl:
-
- - Fix memory leak in MessageFormatter::format() on failure.
-
-- Libxml:
-
- - Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
-
-- MBString:
-
- - Fix (license issue: restricted unicode license headers).
-
-- Opcache:
-
- - Fixed bug (OPCache with Enum and Callback functions results in segmentation fault).
- - Prevent potential deadlock if accelerated globals cannot be allocated.
-
-- PCNTL:
-
- - Fixed bug (SIGCHLD is not always returned from proc_open).
-
-- PDO:
-
- - Fix (After php8.1, when PDO::ATTR_EMULATE_PREPARES is true and PDO::ATTR_STRINGIFY_FETCHES is true, decimal zeros are no longer filled).
-
-- PDO SQLite:
-
- - Fix (Make test failure: ext/pdo_sqlite/tests/bug_42589.phpt).
-
-- Phar:
-
- - Add missing check on EVP_VerifyUpdate() in phar util.
- - Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)
-
-- PHPDBG:
-
- - Fixed bug (phpdbg -h options doesn't list the -z option).
-
-- Session:
-
- - Removed broken url support for transferring session ID.
-
-- Standard:
-
- - Fix serialization of RC1 objects appearing in object graph twice.
-
-- Streams:
-
- - Fixed bug (Use-after-free when unregistering user stream wrapper from itself).
-
-- SQLite3:
-
- - Fix replaced error handling in SQLite3Stmt::__construct.
-
-- XMLReader:
-
- - Fix (Argument corruption when calling XMLReader::open or XMLReader::XML non-statically with observer active).
-
-
-
-
-
-
-
-Version 8.2.8
-
-- CLI:
-
- - Fixed bug (cli/get_set_process_title fails on MacOS).
-
-- Core:
-
- - Fixed build for the riscv64 architecture/GCC 12.
-
-- Curl:
-
- - Fixed bug (Unable to set CURLOPT_ACCEPT_ENCODING to NULL).
-
-- Date:
-
- - Fixed bug (Segmentation fault with custom object date properties).
-
-- DOM:
-
- - Fixed bugs and and and (DOMExceptions and segfaults with replaceWith).
- - Fixed bug (Setting DOMAttr::textContent results in an empty attribute value).
- - Fix return value in stub file for DOMNodeList::item.
- - Fix spec compliance error with '*' namespace for DOMDocument::getElementsByTagNameNS.
- - Fix DOMElement::append() and DOMElement::prepend() hierarchy checks.
- - Fixed bug (Memory leak when calling a static method inside an xpath query).
- - (append_node of a DOMDocumentFragment does not reconcile namespaces).
- - (DOMChildNode::replaceWith() bug when replacing a node with itself).
- - (Removed elements are still returned by getElementById).
- - (print_r() on DOMAttr causes Segfault in php_libxml_node_free_list()).
- - (Crash in DOMNameSpace debug info handlers).
- - Fix lifetime issue with getAttributeNodeNS().
- - Fix "invalid state error" with cloned namespace declarations.
- - and #47530 and #47847 (various namespace reconciliation issues).
- - (Completely broken array access functionality with DOMNamedNodeMap).
-
-- Opcache:
-
- - Fix allocation loop in zend_shared_alloc_startup().
- - Access violation on smm_shared_globals with ALLOC_FALLBACK.
- - Fixed bug (php still tries to unlock the shared memory ZendSem with opcache.file_cache_only=1 but it was never locked).
-
-- OpenSSL:
-
- - Fixed bug Incomplete validation of IPv6 Address fields in subjectAltNames (James Lucas, Jakub Zelenka).
-
-- PCRE:
-
- - Fix preg_replace_callback_array() pattern validation.
-
-- PGSQL:
-
- - Fixed intermittent segfault with pg_trace.
-
-- Phar:
-
- - Fix cross-compilation check in phar generation for FreeBSD.
-
-- SPL:
-
- - Fixed bug (SplFileInfo empty getBasename with more than one slash).
-
-- Standard:
-
- - Fix access on NULL pointer in array_merge_recursive().
- - Fix exception handling in array_multisort().
-
-- SQLite3:
-
- - Fixed bug (Invalid associative array containing duplicate keys).
-
-
-
-
-
-
-
-Version 8.2.7
-
-- Core:
-
- - Fixed bug (Unable to alias namespaces containing reserved class names).
- - Fixed bug (Conditional jump or move depends on uninitialised value(s)).
- - Fixed bug (Exceeding memory limit in zend_hash_do_resize leaves the array in an invalid state).
- - Fixed bug (Compilation error on old GCC versions).
- - Fixed bug (foreach by-ref may jump over keys during a rehash).
-
-- Date:
-
- - Fixed bug (DateTimeZone::getName() does not include seconds in offset).
-
-- Exif:
-
- - Fixed bug (exif_read_data() cannot read smaller stream wrapper chunk sizes).
-
-- FPM:
-
- - Fixed bug (PHP-FPM segfault due to after free usage of child->ev_std(out|err)).
- - (FPM status page: query_string not properly JSON encoded).
- - Fixed memory leak for invalid primary script file handle.
-
-- Hash:
-
- - Fixed bug (hash_file() appears to be restricted to 3 arguments).
-
-- LibXML:
-
- - Fixed bug (Few tests failed building with new libxml 2.11.0).
-
-- MBString:
-
- - Fix bug (Segfault in mb_strrpos / mb_strripos when using negative offset and ASCII encoding).
-
-- Opcache:
-
- - Fixed bug (Incorrect match default branch optimization).
- - Fixed too wide OR and AND range inference.
- - Fixed missing class redeclaration error with OPcache enabled.
- - Fixed bug (In some specific cases SWITCH with one default statement will cause segfault).
-
-- PCNTL:
-
- - Fixed maximum argument count of pcntl_forkx().
-
-- PGSQL:
-
- - Fixed parameter parsing of pg_lo_export().
-
-- Phar:
-
- - Fixed bug (Generating phar.php during cross-compile can't be done).
-
-- Soap:
-
- - Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP). (CVE-2023-3247)
- - Fixed bug (make test fail while soap extension build).
-
-- SPL:
-
- - Fixed bug (Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18)).
-
-- Standard:
-
- - Fixed bug (move_uploaded_file() emits open_basedir warning for source file).
- - Fixed bug (POST/PATCH request switches to GET after a HTTP 308 redirect).
-
-- Streams:
-
- - Fixed bug ([Stream] STREAM_NOTIFY_PROGRESS over HTTP emitted irregularly for last chunk of data).
- - Fixed bug (Stream Socket Timeout).
- - Fixed bug (ASAN UndefinedBehaviorSanitizer when timeout = -1 passed to stream_socket_accept/stream_socket_client).
-
-
-
-
-
-
-
-Version 8.2.6
-
-- Core:
-
- - Fix inconsistent float negation in constant expressions.
- - Fixed bug (php-cli core dump calling a badly formed function).
- - Fixed bug (PHP 8.1.16 segfaults on line 597 of sapi/apache2handler/sapi_apache2.c).
- - Fixed bug (Heap Buffer Overflow in zval_undefined_cv.).
- - Fixed bug (Incorrect CG(memoize_mode) state after bailout in ??=).
-
-- Date:
-
- - Fixed bug where the diff() method would not return the right result around DST changeover for date/times associated with a timezone identifier.
- - Fixed out-of-range bug when converting to/from around the LONG_MIN unix timestamp.
-
-- DOM:
-
- - (Segfault when using DOMChildNode::before()).
- - Fixed incorrect error handling in dom_zvals_to_fragment().
-
-- Exif:
-
- - Fixed bug (exif read : warnings and errors : Potentially invalid endianess, Illegal IFD size and Undefined index).
-
-- Intl:
-
- - Fixed bug (TZData version not displayed anymore).
-
-- PCRE:
-
- - Fixed bug (Segfault in preg_replace_callback_array()).
-
-- Reflection:
-
- - Fixed bug (State-dependant segfault in ReflectionObject::getProperties).
-
-- SPL:
-
- - Handle indirect zvals and use up-to-date properties in SplFixedArray::__serialize.
-
-- Standard:
-
- - Fixed bug (mail() throws TypeError after iterating over $additional_headers array by reference).
- - Fixed bug (Duplicates returned by array_unique when using enums).
-
-- Streams:
-
- - Fixed bug (feof() behavior change for UNIX based socket resources).
-
-
-
-
-
-
-
-Version 8.2.5
-
-- Core:
-
- - Added optional support for max_execution_time in ZTS/Linux builds (Kévin Dunglas)
- - Fixed use-after-free in recursive AST evaluation.
- - Fixed bug (Memory leak PHP FPM 8.1).
- - Re-add some CTE functions that were removed from being CTE by a mistake.
- - Remove CTE flag from array_diff_ukey(), which was added by mistake.
- - Fixed bug (Named arguments in CTE functions cause a segfault).
- - Fixed bug (PHP 8.0.20 (ZTS) zend_signal_handler_defer crashes on apache).
- - Fixed bug (zend_signal_handler_defer crashes on apache shutdown).
- - Fixed bug (Fix NUL byte terminating Exception::__toString()).
- - Fix potential memory corruption when mixing __callStatic() and FFI.
-
-- Date:
-
- - Fixed bug (Private and protected properties in serialized Date* objects throw).
-
-- FPM:
-
- - Fixed bug (fpm_env_init_main leaks environ).
- - Destroy file_handle in fpm_main.
- - (Incorrect SCRIPT_NAME with apache ProxyPassMatch when spaces are in path).
-
-- FTP:
-
- - Propagate success status of ftp_close().
- - Fixed bug (ftp_get/ftp_nb_get resumepos offset is maximum 10GB).
-
-- IMAP:
-
- - Fix build failure with Clang 16.
-
-- MySQLnd:
-
- - Fixed bug (Possible Memory Leak with SSL-enabled MySQL connections).
-
-- Opcache:
-
- - Fixed build for macOS to cater with pkg-config settings.
- - Fixed bug (opcache.consistency_checks > 0 causes segfaults in PHP >= 8.1.5 in fpm context).
-
-- OpenSSL:
-
- - Add missing error checks on file writing functions.
-
-- PDO Firebird:
-
- - Fixed bug (Bus error with PDO Firebird on RPI with 64 bit kernel and 32 bit userland).
-
-- Phar:
-
- - Fixed bug (PharData archive created with Phar::Zip format does not keep files metadata (datetime)).
- - Add missing error checks on EVP_MD_CTX_create() and EVP_VerifyInit().
-
-- PDO ODBC:
-
- - Fixed missing and inconsistent error checks on SQLAllocHandle.
-
-- PGSQL:
-
- - Fixed typo in the array returned from pg_meta_data (extended mode).
-
-- SPL:
-
- - Fixed bug (Array Data Address Reference Issue).
- - Fixed bug (Unable to serialize processed SplFixedArrays in PHP 8.2.4).
- - Fixed bug (ArrayIterator allows modification of readonly props).
-
-- Standard:
-
- - Fixed bug (stream_socket_server context leaks).
- - Fixed bug (Browscap crashes PHP 8.1.12 on request shutdown (apache2)).
- - Fixed oss-fuzz #57392 (Buffer-overflow in php_fgetcsv() with \0 delimiter and enclosure).
- - Fixed undefined behaviour in unpack().
-
-
-
-
-
-
-
-Version 8.2.4
-
-- Core:
-
- - Fixed incorrect check condition in ZEND_YIELD.
- - Fixed incorrect check condition in type inference.
- - Fix incorrect check in zend_internal_call_should_throw().
- - Fixed overflow check in OnUpdateMemoryConsumption.
- - Fixed bug (Entering shutdown sequence with a fiber suspended in a Generator emits an unavoidable fatal error or crashes).
- - Fixed bug (Segfault/assertion when using fibers in shutdown function after bailout).
- - Fixed SSA object type update for compound assignment opcodes.
- - Fixed language scanner generation build.
- - Fixed zend_update_static_property() calling zend_update_static_property_ex() misleadingly with the wrong return type.
- - Fix bug (Fixed unknown string hash on property fetch with integer constant name).
- - Fixed php_fopen_primary_script() call resulted on zend_destroy_file_handle() freeing dangling pointers on the handle as it was uninitialized.
-
-- Curl:
-
- - Fixed deprecation warning at compile time.
- - Fixed bug (Unable to return CURL_READFUNC_PAUSE in readfunc callback).
-
-- Date:
-
- - Fix ('p' format specifier does not yield 'Z' for 00:00).
- - Fix (Custom properties of Date's child classes are not serialised).
- - Fixed bug (Private and protected properties in serialized Date* objects throw).
-
-- FFI:
-
- - Fixed incorrect bitshifting and masking in ffi bitfield.
-
-- Fiber:
-
- - Fixed assembly on alpine x86.
- - Fixed bug (segfault when garbage collector is invoked inside of fiber).
-
-- FPM:
-
- - Fixed bug (FPM unknown child alert not valid).
- - Fixed bug (FPM successful config test early exit).
-
-- GMP:
-
- - Properly implement GMP::__construct().
-
-- Intl:
-
- - Fixed bug (Spoolchecker isSuspicious/areConfusable methods error code's argument always returning NULL0.
-
-- JSON:
-
- - Fixed JSON scanner and parser generation build.
-
-- MBString:
-
- - ext/mbstring: fix new_value length check.
- - Fix bug (mb_convert_encoding crashes PHP on Windows).
-
-- Opcache:
-
- - Fix incorrect page_size check.
-
-- OpenSSL:
-
- - Fixed php_openssl_set_server_dh_param() DH params errors handling.
-
-- PDO OCI:
-
- - (Reading a multibyte CLOB caps at 8192 chars).
-
-- PHPDBG:
-
- - Fixed bug (heap buffer overflow on --run option misuse).
-
-- PGSQL:
-
- - Fix (pg_lo_open segfaults in the strict_types mode).
-
-- Phar:
-
- - Fix incorrect check in phar tar parsing.
-
-- Random:
-
- - Fix (Do not trust arc4random_buf() on glibc).
- - Fix (Made the default value of the first param of srand() and mt_srand() unknown).
-
-- Reflection:
-
- - Fixed bug (Reflection::getClosureUsedVariables opcode fix with variadic arguments).
- - Fix Segfault when using ReflectionFiber suspended by an internal function.
-
-- Session:
-
- - Fixed ps_files_cleanup_dir() on failure code paths with -1 instead of 0 as the latter was considered success by callers. (nielsdos).
-
-- Standard:
-
- - Fixed bug (Introduce mail.mixed_lf_and_crlf INI).
- - Fixed bug (Made the default value of the first param of srand() and mt_srand() unknown).
- - Fix incorrect check in cs_8559_5 in map_from_unicode().
- - Fix bug for reset/end/next/prev() attempting to move pointer of properties table for certain internal classes such as FFI classes
- - Fix incorrect error check in browsecap for pcre2_match().
-
-- Streams:
-
- - Fixed bug (File corruption in _php_stream_copy_to_stream_ex when using copy_file_range).
- - Fixed bug (copy() fails on cifs mounts because of incorrect copy_file_range() len).
-
-- Tidy:
-
- - Fix memory leaks when attempting to open a non-existing file or a file over 4GB.
- - Add missing error check on tidyLoadConfig.
-
-- Zlib:
-
- - Fixed output_handler directive value's length which counted the string terminator.
-
-
-
-
-
-
-
-Version 8.2.3
-
-- Core:
-
- - (Password_verify() always return true with some hash). (CVE-2023-0567)
- - (1-byte array overrun in common path resolve code). (CVE-2023-0568)
-
-- SAPI:
-
- - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)
-
-
-
-
-
-
-
-Version 8.2.2
-
-- Core:
-
- - Fixed bug (zif_get_object_vars: Assertion `!(((__ht)->u.flags & (1<<2)) != 0)' failed).
- - Fix (Assertion `(flag & (1<<3)) == 0' failed).
- - Fix (Assertion failure when adding more than 2**30 elements to an unpacked array).
- - Fix (Fiber stack variables do not participate in cycle collector).
- - Fix (Broken run_time_cache init for internal enum methods).
-
-- FPM:
-
- - (Missing separator in FPM FastCGI errors).
- - Fixed bug (FPM does not reset fastcgi.error_header).
- - (Configuration test does not perform UID lookups).
- - Fixed memory leak when running FPM config test.
- - (Wrong owner:group for listening unix socket).
-
-- Hash:
-
- - Handle exceptions from __toString in XXH3's initialization (nielsdos)
-
-- LDAP:
-
- - Fixed bug (LDAP\Connection::__construct() refers to ldap_create()).
-
-- Opcache:
-
- - Fix inverted bailout value in zend_runtime_jit() (Max Kellermann).
- - Fix access to uninitialized variable in accel_preload().
- - Fix zend_jit_find_trace() crashes.
- - Added missing lock for EXIT_INVALIDATE in zend_jit_trace_exit.
-
-- Phar:
-
- - Fix wrong flags check for compression method in phar_object.c (nielsdos)
-
-- PHPDBG:
-
- - Fix undefined behaviour in phpdbg_load_module_or_extension().
- - Fix NULL pointer dereference in phpdbg_create_conditional_breal().
- - Fix : phpdbg memory leaks by option "-h" (nielsdos)
- - Fix phpdbg segmentation fault in case of malformed input (nielsdos)
-
-- Posix:
-
- - Fix memory leak in posix_ttyname() (girgias)
-
-- Random:
-
- - Fixed bug (Theoretical file descriptor leak for /dev/urandom).
-
-- Standard:
-
- - Fix (Segfault in stripslashes() with arm64).
- - Fixed bug (Incomplete validation of object syntax during unserialize()).
- - Fix substr_replace with slots in repl_ht being UNDEF.
-
-- XMLWriter:
-
- - Fix missing check for xmlTextWriterEndElement (nielsdos)
-
-
-
-
-
-
-
-Version 8.2.1
-
-- Core:
-
- - Fixed bug (constant() behaves inconsistent when class is undefined).
- - Fixed bug (License information for xxHash is not included in README.REDIST.BINS file).
- - Fixed bug (OpenSSL legacy providers not available on Windows).
- - Fixed bug (Can't initialize heap: [0x000001e7]).
- - Fixed potentially undefined behavior in Windows ftok(3) emulation.
- - Fixed (Misleading error message for unpacking of objects).
-
-- Apache:
-
- - Fixed bug (Partial content on incomplete POST request).
-
-- FPM:
-
- - Fixed bug (Solaris port event mechanism is still broken after bug #66694).
- - (Setting fastcgi.error_header can result in a WARNING).
- - (FPM numeric user fails to set groups).
- - Fixed bug (Random crash of FPM master process in fpm_stdio_child_said).
-
-- Imap:
-
- - Fixed bug (IMAP: there's no way to check if a IMAP\Connection is still open).
-
-- MBString:
-
- - Fixed bug (The behavior of mb_strcut in mbstring has been changed in PHP8.1).
-
-- Opcache:
-
- - Fixed bug (Segmentation Fault during OPCache Preload).
-
-- OpenSSL:
-
- - Fixed bug (OpenSSL engine clean up segfault).
- - Fixed bug (PHP fails to build if openssl was built with --no-ec).
- - Fixed bug (OpenSSL test failures when OpenSSL compiled with no-dsa).
-
-- Pcntl:
-
- - Fixed bug (Signal handler called after rshutdown leads to crash).
-
-- PDO_Firebird:
-
- - Fixed bug (Incorrect NUMERIC value returned from PDO_Firebird).
-
-- PDO/SQLite:
-
- - (PDO::quote() may return unquoted string). (CVE-2022-31631)
-
-- Session:
-
- - Fixed (session name silently fails with . and [).
-
-- SPL:
-
- - Fixed (SplFileObject::__toString() reads next line).
- - Fixed (Trampoline autoloader will get reregistered and cannot be unregistered).
-
-- SQLite3:
-
- - (open_basedir bypass in SQLite3 by using file URI).
-
-- TSRM:
-
- - Fixed Windows shmget() wrt. IPC_PRIVATE.
-
-
-
-
-
-
-
-Version 8.2.0
-
-- CLI:
-
- - (Server logs incorrect request method).
- - Updated the mime-type table for the builtin-server.
- - Fixed potential overflow for the builtin server via the PHP_CLI_SERVER_WORKERS environment variable.
- - Fixed by changing STDOUT, STDERR and STDIN to not close on resource destruction.
- - Implement built-in web server responding without body to HEAD request on a static resource.
- - Implement built-in web server responding with HTTP status 405 to DELETE/PUT/PATCH request on a static resource.
- - Fixed bug (Null pointer dereference with -w/-s options).
-
-- COM:
-
- - Fixed bug (Can not create VT_ERROR variant type).
-
-- Core:
-
- - (Observer may not be initialized properly).
- - Fixed bug (Fix filename/lineno of constant expressions).
- - Fixed bug (Improve class type in error messages).
- - Support huge pages on MacOS.
- - Fixed bug (Casting an object to array does not unwrap refcount=1 references).
- - Fixed bug (Nullsafe in coalesce triggers undefined variable warning).
- - Fixed bug and (Allow arbitrary const expressions in backed enums).
- - Fixed bug (Incorrect lineno in backtrace of multi-line function calls).
- - Optimised code path for newly created file with the stream plain wrapper.
- - Uses safe_perealloc instead of perealloc for the ZEND_PTR_STACK_RESIZE_IF_NEEDED to avoid possible overflows.
- - Reduced the memory footprint of strings returned by var_export(), json_encode(), serialize(), iconv_*(), mb_ereg*(), session_create_id(), http_build_query(), strstr(), Reflection*::__toString().
- - Fixed bug (WeakMap object reference offset causing TypeError).
- - Added error_log_mode ini setting.
- - Updated request startup messages.
- - Fixed bug (Arrow function with never return type compile-time errors).
- - Fixed incorrect double to long casting in latest clang.
- - Added support for defining constants in traits.
- - Stop incorrectly emitting false positive deprecation notice alongside unsupported syntax fatal error for `"{$g{'h'}}"`.
- - Fix unexpected deprecated dynamic property warning, which occurred when exit() in finally block after an exception was thrown without catching.
- - Fixed bug (Crash in ZEND_RETURN/GC/zend_call_function) (Tim Starling)
- - Fixed bug (Trailing dots and spaces in filenames are ignored).
- - Fixed bug (Traits cannot be used in readonly classes).
- - Fixed bug (@strict-properties can be bypassed using unserialization).
- - Fixed bug (Using dnf type with parentheses after readonly keyword results in a parse error).
- - Fixed bug ((A&B)|D as a param should allow AB or D. Not just A).
- - Fixed observer class notify with Opcache file_cache_only=1.
- - Fixes segfault with Fiber on FreeBSD i386 architecture.
- - Fixed bug (Pure intersection types cannot be implicitly nullable) (Girgias)
- - Fixed bug (dl() segfaults when module is already loaded).
- - Fixed bug (Generator crashes when interrupted during argument evaluation with extra named params).
- - Fixed bug (Generator crashes when memory limit is exceeded during initialization).
- - Fixed a bug with preloaded enums possibly segfaulting.
- - Fixed bug (Don’t reset func in zend_closure_internal_handler).
- - Fixed potential NULL pointer dereference Windows shm*() functions.
- - Fix target validation for internal attributes with constructor property promotion.
- - Fixed bug (Generator memory leak when interrupted during argument evaluation.
- - Move observer_declared_function_notify until after pass_two().
- - Do not report MINIT stage internal class aliases in extensions.
-
-- Curl:
-
- - Added support for CURLOPT_XFERINFOFUNCTION.
- - Added support for CURLOPT_MAXFILESIZE_LARGE.
- - Added new constants from cURL 7.62 to 7.80.
- - New function curl_upkeep().
-
-- Date:
-
- - Fixed (DateInterval::createFromDateString does not throw if non-relative items are present).
- - (Allow including end date in DatePeriod iterations) (Daniel Egeberg, Derick)
- - idate() now accepts format specifiers "N" (ISO Day-of-Week) and "o" (ISO Year).
- - Fixed bug (DateTime::diff miscalculation is same time zone of different type).
- - Fixed bug (DateTime object comparison after applying delta less than 1 second).
- - Fixed bug (DateInterval 1.5s added to DateTimeInterface is rounded down since PHP 8.1.0).
- - (Datetime fails to unserialize "extreme" dates).
- - (DateTime Object with 5-digit year can't unserialized).
- - (Wrong result from DateTimeImmutable::diff).
- - Fixed bug (DateTime::getLastErrors() not returning false when no errors/warnings).
- - Fixed bug with parsing large negative numbers with the @ notation.
-
-- DBA:
-
- - Fixed LMDB driver hanging when attempting to delete a non-existing key (Girgias)
- - Fixed LMDB driver memory leak on DB creation failure (Girgias)
- - Fixed (dba: lmdb: allow to override the MDB_NOSUBDIR flag).
-
-- FFI:
-
- - Fixed bug (Support assigning function pointers in FFI).
-
-- Fileinfo:
-
- - Fixed bug (finfo returns wrong mime type for woff/woff2 files).
-
-- Filter:
-
- - Added FILTER_FLAG_GLOBAL_RANGE to filter Global IPs.
-
-- FPM:
-
- - Emit error for invalid port setting.
- - Added extra check for FPM proc dumpable on SELinux based systems.
- - Added support for listening queue on macOS.
- - Changed default for listen.backlog on Linux to -1.
- - Added listen.setfib pool option to set route FIB on FreeBSD.
- - Added access.suppress_path pool option to filter access log entries.
- - Fixed on fpm scoreboard occasional warning on acquisition failure.
- - Fixed bug (SaltStack (using Python subprocess) hangs when running php-fpm 8.1.11).
-
-- FTP:
-
- - Fix datetime format string to follow POSIX spec in ftp_mdtm().
-
-- GD:
-
- - : OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
-
-- GMP:
-
- - Fixed bug (GMP throws the wrong error when a GMP object is passed to gmp_init()).
-
-- Hash:
-
- - : buffer overflow in hash_update() on long parameter. (CVE-2022-37454)
-
-- Intl:
-
- - Update all grandfathered language tags with preferred values
- - Fixed (Cannot unserialize IntlTimeZone objects).
- - Fixed build for ICU 69.x and onwards.
- - Declared Transliterator::$id as readonly to unlock subclassing it.
- - Fixed bug (Incorrect argument number for ValueError in NumberFormatter).
-
-- MBString:
-
- - Fixed bug (Segmentation fault in mb_strimwidth()).
-
-- mysqli:
-
- - Fixed bug (mysqli_query throws warning despite using silenced error mode).
-
-- MySQLnd:
-
- - Fixed potential heap corruption due to alignment mismatch.
-
-- OCI8:
-
- - Added oci8.prefetch_lob_size directive to tune LOB query performance
- - Support for building against Oracle Client libraries 10.1 and 10.2 has been dropped. Oracle Client libraries 11.2 or newer are now required.
-
-- ODBC:
-
- - Fixed bug (User input not escaped when building connection string).
- - Fixed bug (Current ODBC liveness checks may be inadequate).
-
-- Opcache:
-
- - Allocate JIT buffer close to PHP .text segemnt to allow using direct IP-relative calls and jumps.
- - Added initial support for JIT performance profiling generation for macOs Instrument.
- - Fixed bug (Segfault with JIT and large match/switch statements).
- - Added JIT support improvement for macOs for segments and executable permission bit handling.
- - Added JIT buffer allocation near the .text section on FreeNSD.
- - Fixed bug (Crash with JIT on mac arm64) (jdp1024/David Carlier)
- - Fixed bug (opcache.interned_strings_buffer setting integer overflow).
- - Added indirect call reduction for jit on x86 architectures.
- - Fixed bug (Segfault in zend_accel_class_hash_copy).
- - Fix opcache preload with observers enabled.
-
-- OpenSSL:
-
- - Discard poll calls on socket when no timeout/non blocking/MSG_DONTWAIT.
- - Fixed bug (SSL local_cert and local_pk do not respect open_basedir).
- - Implement FR #76935 ("chacha20-poly1305" is an AEAD but does not work like AEAD).
- - Added openssl_cipher_key_length function.
- - Fixed bug (Compilation error openssl extension related to PR ).
- - Fixed missing clean up of OpenSSL engine list - attempt to fix .
- - Fixed bug (OpenSSL compiled with no-md2, no-md4 or no-rmd160 does not build).
-
-- PCNTL:
-
- - Fixed pcntl_(get|set)priority error handling for MacOS.
-
-- PCRE:
-
- - (Allow null character in regex patterns).
- - Updated bundled libpcre to 10.40.
-
-- PDO:
-
- - Fixed bug (Initialize run time cache in PDO methods).
-
-- PDO_Firebird:
-
- - Fixed bug (Bad interpretation of length when char is UTF-8).
-
-- PDO_ODBC:
-
- - (crash with persistent connections in PDO_ODBC).
- - Fixed bug (User input not escaped when building connection string).
- - Fixed bug (Current ODBC liveness checks may be inadequate).
- - Fixed bug (HY010 when binding overlong parameter).
-
-- PDO_PGSQL:
-
- - Fixed bug (PgSQL large object resource is incorrectly closed).
-
-- Random:
-
- - Added new random extension.
- - Fixed bug (random extension is not thread safe).
- - Fixed bug (segmentation fault if user engine throws).
- - Fixed bug (signed integer overflow).
- - Fixed bug (undefined behavior during shifting).
- - Fixed bug , (incorrect expansion of bytes when generating uniform integers within a given range).
- - Fixed bug (Fix memory leak on Randomizer::__construct() call twice).
- - Fixed bug (PcgOneseq128XslRr64::jump() should not allow negative $advance).
- - Changed Mt19937 to throw a ValueError instead of InvalidArgumentException for invalid $mode.
- - Splitted Random\Randomizer::getInt() (without arguments) to Random\Randomizer::nextInt().
- - Fixed bug (non-existant $sequence parameter in stub for PcgOneseq128XslRr64::__construct()).
- - Fixed bug , (undefined behavior for MT_RAND_PHP when handling large ranges).
- - Fixed bug (Xoshiro256StarStar does not reject the invalid all-zero state).
- - Removed redundant RuntimeExceptions from Randomizer methods. The exceptions thrown by the engines will be exposed directly.
- - Added extension specific Exceptions/Errors (RandomException, RandomError, BrokenRandomEngineError).
- - Fixed bug (Randomizer::getInt(0, 2**32 - 1) with Mt19937 always returns 1).
- - Fixed Randomizer::getInt() consistency for 32-bit engines.
- - Fixed bug (build on older macOs releases).
- - Fixed bug (Pre-PHP 8.2 output compatibility for non-mt_rand() functions for MT_RAND_PHP).
-
-- Reflection:
-
- - Added ReflectionFunction::isAnonymous().
- - Added ReflectionMethod::hasPrototype().
- - Narrow ReflectionEnum::getBackingType() return type to ReflectionNamedType.
- - Fixed bug (ReflectionFunction provides no way to get the called class of a Closure).
-
-- Session:
-
- - Fixed bug (Improve session write failure message for user error handlers).
- - Fixed (setcookie has an obsolete expires date format).
- - Fixed (Avoid memory corruption when not unregistering custom session handler).
- - Fixed bug (session_create_id() fails with user defined save handler that doesn't have a validateId() method).
-
-- SOAP:
-
- - Fixed bug (Null pointer dereference while serializing the response).
-
-- Sockets:
-
- - Added TCP_NOTSENT_LOWAT socket option.
- - Added SO_MEMINFO socket option.
- - Added SO_RTABLE socket option (OpenBSD), equivalent of SO_MARK (Linux).
- - Added TCP_KEEPALIVE, TCP_KEEPIDLE, TCP_KEEPINTVL, TCP_KEEPCNT socket options.
- - Added ancillary data support for FreeBSD.
- - Added ancillary data support for NetBSD.
- - Added SO_BPF_EXTENSIONS socket option.
- - Added SO_SETFIB socket option.
- - Added TCP_CONGESTION socket option.
- - Added SO_ZEROCOPY/MSG_ZEROCOPY options.
- - Added SOL_FILTER socket option for Solaris.
- - Fixed socket constants regression as of PHP 8.2.0beta3.
-
-- Sodium:
-
- - Added sodium_crypto_stream_xchacha20_xor_ic().
-
-- SPL:
-
- - Uses safe_erealloc instead of erealloc to handle heap growth for the SplHeap::insert method to avoid possible overflows.
- - Widen iterator_to_array() and iterator_count()'s $iterator parameter to iterable.
- - (READ_CSV|DROP_NEW_LINE drops newlines within fields).
- - (GlobIterator incorrect handling of open_basedir check).
-
-- SQLite3:
-
- - Changed sqlite3.defensive from PHP_INI_SYSTEM to PHP_INI_USER.
-
-- Standard:
-
- - net_get_interfaces() also reports wireless network interfaces on Windows.
- - Finished AVIF support in getimagesize().
- - Fixed bug (stripos with large haystack has bad performance).
- - New function memory_reset_peak_usage().
- - Fixed parse_url(): can not recognize port without scheme.
- - Deprecated utf8_encode() and utf8_decode().
- - Fixed the crypt_sha256/512 api build with clang > 12.
- - Uses safe_erealloc instead of erealloc to handle options in getopt to avoid possible overflows.
- - Implemented FR (str_split should return empty array for empty string).
- - Added ini_parse_quantity function to convert ini quantities shorthand notation to int.
- - Enable arc4random_buf for Linux glibc 2.36 and onwards for the random_bytes.
- - Uses CCRandomGenerateBytes instead of arc4random_buf on macOs. (David Carlier).
- - (glob() basedir check is inconsistent).
- - Fixed (setcookie has an obsolete expires date format).
- - Fixed (Segfault with array_multisort + array_shift).
- - Fixed bug (`ksort` behaves incorrectly on arrays with mixed keys).
- - Marked crypt()'s $string parameter as #[\SensitiveParameter].
- - Fixed bug (build on older macOs releases).
- - Fixed bug (Disabling IPv6 support disables unrelated constants).
- - Revert "Fixed parse_url(): can not recognize port without scheme." (andypost)
- - Fix crash reading module_entry after DL_UNLOAD() when module already loaded.
-
-- Streams:
-
- - Set IP_BIND_ADDRESS_NO_PORT if available when connecting to remote host.
- - Fixed bug (stream_wrapper_unregister() leaks memory).
- - Discard poll calls on socket when no timeout/non blocking/MSG_DONTWAIT.
- - Fixed bug ($http_response_header is wrong for long status line).
- - Fixed bug (stream_select does not abort upon exception or empty valid fd set).
- - Fixed bug (file copy between different filesystems).
- - Fixed bug (stream_copy_to_stream fails if dest in append mode).
-
-- Windows:
-
- - Added preliminary support for (cross-)building for ARM64.
-
-- XML:
-
- - Added libxml_get_external_entity_loader() function.
-
-- Zip:
-
- - add ZipArchive::clearError() method
- - add ZipArchive::getStreamName() method
- - add ZipArchive::getStreamIndex() method
- - On Windows, the Zip extension is now built as shared library (DLL) by default.
- - Implement fseek for zip stream when possible with libzip 1.9.1.
-
-
-
-
-
-
-
-
-
-Version 8.1.34
-
-- Curl:
-
- - Fix curl build and test failures with version 8.16.
-
-- Opcache:
-
- - Reset global pointers to prevent use-after-free in zend_jit_status().
-
-- PDO:
-
- - Fixed (PDO quoting result null deref). (CVE-2025-14180)
-
-- Standard:
-
- - Fixed (Null byte termination in dns_get_record()).
- - Fixed (Heap buffer overflow in array_merge()). (CVE-2025-14178)
- - Fixed (Information Leak of Memory in getimagesize). (CVE-2025-14177)
-
-
-
-
-
-
-
-Version 8.1.33
-
-- PGSQL:
-
- - Fixed (pgsql extension does not check for errors during escaping). (CVE-2025-1735)
-
-- SOAP:
-
- - Fixed (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491)
-
-- Standard:
-
- - Fixed (Null byte termination in hostnames). (CVE-2025-1220)
-
-
-
-
-
-
-
-Version 8.1.32
-
-- LibXML:
-
- - Fixed (Reocurrence of #72714).
- - Fixed (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
-
-- Streams:
-
- - Fixed (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
- - Fixed (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
- - Fixed (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
- - Fixed (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
-
-- Windows:
-
- - Fixed phpize for Windows 11 (24H2).
-
-
-
-
-
-
-
-Version 8.1.31
-
-- CLI:
-
- - Fixed bug (Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface).
-
-- LDAP:
-
- - Fixed bug (OOB access in ldap_escape). (CVE-2024-8932)
-
-- MySQLnd:
-
- - Fixed bug (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
-
-- PDO DBLIB:
-
- - Fixed bug (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
-
-- PDO Firebird:
-
- - Fixed bug (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
-
-- Streams:
-
- - Fixed bug (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
- - Fixed bug (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
-
-
-
-
-
-
-
-Version 8.1.30
-
-- CGI:
-
- - Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
- - Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
-
-- FPM:
-
- - Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
-
-- SAPI:
-
- - Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
-
-
-
-
-
-
-
-Version 8.1.29
-
-- CGI:
-
- - Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
-
-- Filter:
-
- - Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
-
-- OpenSSL:
-
- - The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.
-
-- Standard:
-
- - Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
-
-
-
-
-
-
-
-Version 8.1.28
-
-- Standard:
-
- - Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
- - Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
- - Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)
-
-
-
-
-
-
-
-Version 8.1.27
-
-- Core:
-
- - Fixed oss-fuzz #54325 (Use-after-free of name in var-var with malicious error handler).
- - Fixed oss-fuzz #64209 (In-place modification of filename in php_message_handler_for_zend).
- - Fixed bug / (Invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC).
-
-- DOM:
-
- - Fixed bug (DOM: Removing XMLNS namespace node results in invalid default: prefix).
-
-- FPM:
-
- - Fixed bug (Segmentation fault in fpm_status_export_to_zval).
-
-- Intl:
-
- - Fixed bug (Test bug69398.phpt fails with ICU 74.1).
-
-- LibXML:
-
- - Fixed bug (libxml2 2.12.0 issue building from src).
-
-- MySQLnd:
-
- - Avoid using uninitialised struct.
-
-- OpenSSL:
-
- - (openssl_pkcs7_verify() may ignore untrusted CAs).
-
-- PCRE:
-
- - Fixed bug (The gh11374 test fails on Alpinelinux).
-
-- PGSQL:
-
- - Fixed bug wrong argument type for pg_untrace.
-
-- PHPDBG:
-
- - Fixed bug (MEMORY_LEAK in phpdbg_prompt.c).
-
-- SQLite3:
-
- - Fixed bug (sqlite3_defensive.phpt fails with sqlite 3.44.0).
-
-- Standard:
-
- - Fix memory leak in syslog device handling.
- - Fixed bug (browscap segmentation fault when configured in the vhost).
- - Fixed bug (proc_open() does not take into account references in the descriptor array).
-
-- Streams:
-
- - (Stream wrappers in imagecreatefrompng causes segfault).
-
-- Zip:
-
- - Fixed bug (Inconsistency in ZipArchive::addGlob remove_path Option Behavior).
-
-
-
-
-
-
-
-Version 8.1.26
-
-- Core:
-
- - Fixed bug (Double-free of doc_comment when overriding static property via trait).
- - Fixed segfault caused by weak references to FFI objects.
- - Fixed max_execution_time: don't delete an unitialized timer.
-
-- DOM:
-
- - Fix registerNodeClass with abstract class crashing.
- - Add missing NULL pointer error check.
- - Fix validation logic of php:function() callbacks.
-
-- Fiber:
-
- - Fixed bug (ReflectionFiber segfault).
-
-- FPM:
-
- - Fixed bug (Loading ext in FPM config does not register module handlers).
- - Fixed bug (FPM: segfault dynamically loading extension without opcache).
-
-- Intl:
-
- - Removed the BC break on IntlDateFormatter::construct which threw an exception with an invalid locale.
-
-- Opcache:
-
- - Added warning when JIT cannot be enabled.
- - Fixed bug (Crashes in zend_accel_inheritance_cache_find since upgrading to 8.1.3 due to corrupt on-disk file cache).
-
-- OpenSSL:
-
- - Fixed bug (Missing sigbio creation checking in openssl_cms_verify).
-
-- PCRE:
-
- - Fixed bug (Backport upstream fix, Different preg_match result with -d pcre.jit=0).
-
-- SOAP:
-
- - Fixed bug (Segmentation fault on SoapClient::__getTypes).
- - (SOAP WSDL cache race condition causes Segmentation Fault).
- - (SOAP leaves incomplete cache file on ENOSPC).
- - Fix incorrect uri check in SOAP caching.
- - Fix segfault and assertion failure with refcounted props and arrays.
- - Fix potential crash with an edge case of persistent encoders.
- - (Memleak in SoapClient).
-
-- Streams:
-
- - (getimagesize with "&$imageinfo" fails on StreamWrappers).
-
-- XMLReader:
-
- - Add missing NULL pointer error check.
-
-- XMLWriter:
-
- - Add missing NULL pointer error check.
-
-- XSL:
-
- - Add missing module dependency.
- - Fix validation logic of php:function() callbacks.
-
-
-
-
-
-
-
-Version 8.1.25
-
-- Core:
-
- - Fixed bug (memory leak when class using trait with doc block).
- - Fixed bug (Module entry being overwritten causes type errors in ext/dom).
- - Fixed bug (__builtin_cpu_init check).
- - (ZTS + preload = segfault on shutdown).
-
-- CLI:
-
- - Ensure a single Date header is present.
-
-- CType:
-
- - Fixed bug (ctype_alnum 5 times slower in PHP 8.1 or greater).
-
-- DOM:
-
- - Restore old namespace reconciliation behaviour.
- - Fixed bug (DOMNode serialization on PHP ^8.1).
-
-- Fileinfo:
-
- - Fixed bug (fileinfo returns text/xml for some svg files).
-
-- Filter:
-
- - Fix explicit FILTER_REQUIRE_SCALAR with FILTER_CALLBACK (ilutov)
-
-- Hash:
-
- - Fixed bug (segfault copying/cloning a finalized HashContext).
-
-- Intl:
-
- - Fixed bug (segfault on IntlDateFormatter::construct).
- - Fixed bug (IntlDateFormatter::construct should throw an exception on an invalid locale).
-
-- MySQLnd:
-
- - Fixed bug (PHP Startup: Invalid library (maybe not a PHP library) 'mysqlnd.so' in Unknown on line).
-
-- Opcache:
-
- - Fixed opcache_invalidate() on deleted file.
- - Fixed bug (JIT+private array property access inside closure accesses private property in child class).
-
-- PCRE:
-
- - Fixed bug (Backport upstream fix, PCRE regular expressions with JIT enabled gives different result).
-
-- SimpleXML:
-
- - Fixed bug (Can't use xpath with comments in SimpleXML).
- - Fixed bug (Entity reference produces infinite loop in var_dump/print_r).
- - Fixed bug (Unable to get processing instruction contents in SimpleXML).
- - Fixed bug (Unable to get comment contents in SimpleXML).
-
-- Streams:
-
- - Fixed bug (binding ipv4 address with both address and port at 0).
-
-- XML:
-
- - Fix return type of stub of xml_parse_into_struct().
- - Fix memory leak when calling xml_parse_into_struct() twice.
-
-- XSL:
-
- - Fix type error on XSLTProcessor::transformToDoc return value with SimpleXML.
-
-- Sockets:
-
- - Fix socket_export_stream() with wrong protocol (twosee)
-
-
-
-
-
-
-
-Version 8.1.24
-
-- Core:
-
- - Fixed bug (Constant ASTs containing objects).
- - Fixed bug (On riscv64 require libatomic if actually needed).
- - Fixed bug (Segfault when freeing incompletely initialized closures).
- - Fixed bug (Internal iterator rewind handler is called twice).
- - Fixed bug (Incorrect compile error when using array access on TMP value in function call).
-
-- DOM:
-
- - Fix memory leak when setting an invalid DOMDocument encoding.
-
-- Iconv:
-
- - Fixed build for NetBSD which still uses the old iconv signature.
-
-- Intl:
-
- - Fixed bug (intl_get_error_message() broken after MessageFormatter::formatMessage() fails).
-
-- MySQLnd:
-
- - Fixed bug (Invalid error message when connection via SSL fails: "trying to connect via (null)").
-
-- ODBC:
-
- - Fixed memory leak with failed SQLPrepare.
- - Fixed persistent procedural ODBC connections not getting closed.
-
-- SimpleXML:
-
- - (XPath processing-instruction() function is not supported).
-
-- SPL:
-
- - Fixed bug (RecursiveCallbackFilterIterator regression in 8.1.18).
-
-- SQLite3:
-
- - Fixed bug (SQLite3 callback functions cause a memory leak with a callable array).
-
-
-
-
-
-
-
-Version 8.1.23
-
-- CLI:
-
- - Fixed bug (cli server crashes on SIGINT when compiled with ZEND_RC_DEBUG=1).
- - Fixed bug (Improve man page about the built-in server).
-
-- Core:
-
- - Fixed strerror_r detection at configuration time.
-
-- Date:
-
- - Fixed bug : Crash with DatePeriod when uninitialised objects are passed in.
-
-- DOM:
-
- - Fix DOMEntity field getter bugs.
- - Fix incorrect attribute existence check in DOMElement::setAttributeNodeNS.
- - Fix DOMCharacterData::replaceWith() with itself.
- - Fix empty argument cases for DOMParentNode methods.
- - Fixed bug (Wrong default value of DOMDocument::xmlStandalone).
- - Fix json_encode result on DOMDocument.
- - Fix manually calling __construct() on DOM classes.
- - Fixed bug (ParentNode methods should perform their checks upfront).
- - Fix segfault when DOMParentNode::prepend() is called when the child disappears.
-
-- FFI:
-
- - Fix leaking definitions when using FFI::cdef()->new(...).
-
-- MySQLnd:
-
- - Fixed bug (authentication to a sha256_password account fails over SSL).
- - Fixed bug (mysqlnd fails to authenticate with sha256_password accounts using passwords longer than 19 characters).
- - Fixed bug (MySQL Statement has a empty query result when the response field has changed, also Segmentation fault).
- - Fixed invalid error message "Malformed packet" when connection is dropped.
-
-- Opcache:
-
- - Fixed bug (opcache.interned_strings_buffer either has no effect or opcache_get_status() / phpinfo() is wrong).
- - Avoid adding an unnecessary read-lock when loading script from shm if restart is in progress.
-
-- PCNTL:
-
- - Revert behaviour of receiving SIGCHLD signals back to the behaviour before 8.1.22.
-
-- SPL:
-
- - (SplFixedArray::setSize() causes use-after-free).
-
-- Standard:
-
- - Prevent int overflow on $decimals in number_format.
- - Fixed bug (Fix off-by-one bug when truncating tempnam prefix) (athos-ribeiro)
-
-
-
-
-
-
-
-Version 8.1.22
-
-- Build:
-
- - Fixed bug (PHP version check fails with '-' separator).
-
-- CLI:
-
- - Fix interrupted CLI output causing the process to exit.
-
-- Core:
-
- - Fixed oss-fuzz #60011 (Mis-compilation of by-reference nullsafe operator).
- - Fixed use-of-uninitialized-value with ??= on assert.
- - Fixed build for FreeBSD before the 11.0 releases.
-
-- Curl:
-
- - Fix crash when an invalid callback function is passed to CURLMOPT_PUSHFUNCTION.
-
-- Date:
-
- - Fixed bug (Date modify returns invalid datetime).
-
-- DOM:
-
- - Fixed bug (DOMElement::replaceWith() doesn't replace node with DOMDocumentFragment but just deletes node or causes wrapping <></> depending on libxml2 version).
-
-- Fileinfo:
-
- - Fixed bug (finfo returns wrong mime type for xz files).
-
-- FTP:
-
- - Fix context option check for "overwrite".
- - Fixed bug (Memory leak and invalid state with consecutive ftp_nb_fget).
-
-- GD:
-
- - Fix most of the external libgd test failures.
-
-- Hash:
-
- - Fix use-of-uninitialized-value in hash_pbkdf2(), fix missing $options parameter in signature.
-
-- Intl:
-
- - Fix memory leak in MessageFormatter::format() on failure.
-
-- Libxml:
-
- - Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
-
-- MBString:
-
- - Fix (license issue: restricted unicode license headers).
-
-- Opcache:
-
- - Fixed bug (OPCache with Enum and Callback functions results in segmentation fault).
- - Prevent potential deadlock if accelerated globals cannot be allocated.
-
-- PCNTL:
-
- - Fixed bug (SIGCHLD is not always returned from proc_open).
-
-- PCRE:
-
- - Mangle PCRE regex cache key with JIT option.
-
-- PDO:
-
- - Fix (After php8.1, when PDO::ATTR_EMULATE_PREPARES is true and PDO::ATTR_STRINGIFY_FETCHES is true, decimal zeros are no longer filled).
-
-- PDO SQLite:
-
- - Fix (Make test failure: ext/pdo_sqlite/tests/bug_42589.phpt).
-
-- Phar:
-
- - Add missing check on EVP_VerifyUpdate() in phar util.
- - Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)
-
-- PHPDBG:
-
- - Fixed bug (phpdbg -h options doesn't list the -z option).
-
-- Session:
-
- - Removed broken url support for transferring session ID.
-
-- Standard:
-
- - Fix serialization of RC1 objects appearing in object graph twice.
-
-- SQLite3:
-
- - Fix replaced error handling in SQLite3Stmt::__construct.
-
-
-
-
-
-
-
-Version 8.1.21
-
-- CLI:
-
- - Fixed bug (cli/get_set_process_title fails on MacOS).
-
-- Core:
-
- - Fixed build for the riscv64 architecture/GCC 12.
-
-- Curl:
-
- - Fixed bug (Unable to set CURLOPT_ACCEPT_ENCODING to NULL).
-
-- DOM:
-
- - Fixed bugs and and and (DOMExceptions and segfaults with replaceWith).
- - Fixed bug (Setting DOMAttr::textContent results in an empty attribute value).
- - Fix return value in stub file for DOMNodeList::item.
- - Fix spec compliance error with '*' namespace for DOMDocument::getElementsByTagNameNS.
- - Fix DOMElement::append() and DOMElement::prepend() hierarchy checks.
- - Fixed bug (Memory leak when calling a static method inside an xpath query).
- - (append_node of a DOMDocumentFragment does not reconcile namespaces).
- - (DOMChildNode::replaceWith() bug when replacing a node with itself).
- - (Removed elements are still returned by getElementById).
- - (print_r() on DOMAttr causes Segfault in php_libxml_node_free_list()).
- - (Crash in DOMNameSpace debug info handlers).
- - Fix lifetime issue with getAttributeNodeNS().
- - Fix "invalid state error" with cloned namespace declarations.
- - and #47530 and #47847 (various namespace reconciliation issues).
- - (Completely broken array access functionality with DOMNamedNodeMap).
-
-- Opcache:
-
- - Fix allocation loop in zend_shared_alloc_startup().
- - Access violation on smm_shared_globals with ALLOC_FALLBACK.
- - Fixed bug (php still tries to unlock the shared memory ZendSem with opcache.file_cache_only=1 but it was never locked).
-
-- OpenSSL:
-
- - Fixed bug Incomplete validation of IPv6 Address fields in subjectAltNames (James Lucas, Jakub Zelenka).
-
-- PGSQL:
-
- - Fixed intermittent segfault with pg_trace.
-
-- Phar:
-
- - Fix cross-compilation check in phar generation for FreeBSD.
-
-- SPL:
-
- - Fixed bug (SplFileInfo empty getBasename with more than one slash).
-
-- Standard:
-
- - Fix access on NULL pointer in array_merge_recursive().
- - Fix exception handling in array_multisort().
-
-
-
-
-
-
-
-Version 8.1.20
-
-- Core:
-
- - Fixed bug (Conditional jump or move depends on uninitialised value(s)).
- - Fixed bug (Exceeding memory limit in zend_hash_do_resize leaves the array in an invalid state).
- - Fixed bug (foreach by-ref may jump over keys during a rehash).
-
-- Date:
-
- - Fixed bug (DateTimeZone::getName() does not include seconds in offset).
-
-- Exif:
-
- - Fixed bug (exif_read_data() cannot read smaller stream wrapper chunk sizes).
-
-- FPM:
-
- - Fixed bug (PHP-FPM segfault due to after free usage of child->ev_std(out|err)).
- - (FPM status page: query_string not properly JSON encoded).
- - Fixed memory leak for invalid primary script file handle.
-
-- Hash:
-
- - Fixed bug (hash_file() appears to be restricted to 3 arguments).
-
-- LibXML:
-
- - Fixed bug (Few tests failed building with new libxml 2.11.0).
-
-- Opcache:
-
- - Fixed bug (Incorrect match default branch optimization).
- - Fixed too wide OR and AND range inference.
- - Fixed bug (In some specific cases SWITCH with one default statement will cause segfault).
-
-- PGSQL:
-
- - Fixed parameter parsing of pg_lo_export().
-
-- Phar:
-
- - Fixed bug (Generating phar.php during cross-compile can't be done).
-
-- Soap:
-
- - Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP). (CVE-2023-3247)
- - Fixed bug (make test fail while soap extension build).
-
-- SPL:
-
- - Fixed bug (Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18)).
-
-- Standard:
-
- - Fixed bug (move_uploaded_file() emits open_basedir warning for source file).
- - Fixed bug (POST/PATCH request switches to GET after a HTTP 308 redirect).
-
-- Streams:
-
- - Fixed bug ([Stream] STREAM_NOTIFY_PROGRESS over HTTP emitted irregularly for last chunk of data).
- - Fixed bug (Stream Socket Timeout).
- - Fixed bug (ASAN UndefinedBehaviorSanitizer when timeout = -1 passed to stream_socket_accept/stream_socket_client).
-
-
-
-
-
-
-
-Version 8.1.19
-
-- Core:
-
- - Fix inconsistent float negation in constant expressions.
- - Fixed bug (php-cli core dump calling a badly formed function).
- - Fixed bug (PHP 8.1.16 segfaults on line 597 of sapi/apache2handler/sapi_apache2.c).
- - Fixed bug (Heap Buffer Overflow in zval_undefined_cv.).
- - Fixed bug (Incorrect CG(memoize_mode) state after bailout in ??=).
-
-- DOM:
-
- - (Segfault when using DOMChildNode::before()).
- - Fixed incorrect error handling in dom_zvals_to_fragment().
-
-- Exif:
-
- - Fixed bug (exif read : warnings and errors : Potentially invalid endianess, Illegal IFD size and Undefined index).
-
-- Intl:
-
- - Fixed bug (TZData version not displayed anymore).
-
-- PCRE:
-
- - Fixed bug (Segfault in preg_replace_callback_array()).
-
-- Standard:
-
- - Fixed bug (mail() throws TypeError after iterating over $additional_headers array by reference).
- - Fixed bug (Duplicates returned by array_unique when using enums).
-
-
-
-
-
-
-
-Version 8.1.18
-
-- Core:
-
- - Added optional support for max_execution_time in ZTS/Linux builds.
- - Fixed use-after-free in recursive AST evaluation.
- - Fixed bug (Memory leak PHP FPM 8.1).
- - Fixed bug (Named arguments in CTE functions cause a segfault).
- - Fixed bug (PHP 8.0.20 (ZTS) zend_signal_handler_defer crashes on apache).
- - Fixed bug (zend_signal_handler_defer crashes on apache shutdown).
- - Fixed bug (Fix NUL byte terminating Exception::__toString()).
- - Fix potential memory corruption when mixing __callStatic() and FFI.
-
-- Date:
-
- - Fixed bug (DateTime modify with tz pattern should not update linked timezone).
-
-- FPM:
-
- - Fixed bug (fpm_env_init_main leaks environ).
- - Destroy file_handle in fpm_main.
- - (Incorrect SCRIPT_NAME with apache ProxyPassMatch when spaces are in path).
-
-- FTP:
-
- - Propagate success status of ftp_close().
- - Fixed bug (ftp_get/ftp_nb_get resumepos offset is maximum 10GB).
-
-- IMAP:
-
- - Fix build failure with Clang 16.
-
-- MySQLnd:
-
- - Fixed bug (Possible Memory Leak with SSL-enabled MySQL connections).
-
-- Opcache:
-
- - Fixed build for macOS to cater with pkg-config settings.
- - Fixed bug (opcache.consistency_checks > 0 causes segfaults in PHP >= 8.1.5 in fpm context).
-
-- OpenSSL:
-
- - Add missing error checks on file writing functions.
-
-- PDO Firebird:
-
- - Fixed bug (Bus error with PDO Firebird on RPI with 64 bit kernel and 32 bit userland).
-
-- PDO ODBC:
-
- - Fixed missing and inconsistent error checks on SQLAllocHandle.
-
-- Phar:
-
- - Fixed bug (PharData archive created with Phar::Zip format does not keep files metadata (datetime)).
- - Add missing error checks on EVP_MD_CTX_create() and EVP_VerifyInit().
-
-- PGSQL:
-
- - Fixed typo in the array returned from pg_meta_data (extended mode).
-
-- SPL:
-
- - Fixed bug (Array Data Address Reference Issue).
- - Fixed bug (ArrayIterator allows modification of readonly props).
-
-- Standard:
-
- - Fixed bug (stream_socket_server context leaks).
- - Fixed bug (Browscap crashes PHP 8.1.12 on request shutdown (apache2)).
- - Fixed oss-fuzz #57392 (Buffer-overflow in php_fgetcsv() with \0 delimiter and enclosure).
- - Fixed undefined behaviour in unpack().
-
-
-
-
-
-
-
-Version 8.1.17
-
-- Core:
-
- - Fixed incorrect check condition in ZEND_YIELD.
- - Fixed incorrect check condition in type inference.
- - Fixed overflow check in OnUpdateMemoryConsumption.
- - Fixed bug (Entering shutdown sequence with a fiber suspended in a Generator emits an unavoidable fatal error or crashes).
- - Fixed bug (Segfault/assertion when using fibers in shutdown function after bailout).
- - Fixed SSA object type update for compound assignment opcodes.
- - Fixed language scanner generation build.
- - Fixed zend_update_static_property() calling zend_update_static_property_ex() misleadingly with the wrong return type.
- - Fix bug (Fixed unknown string hash on property fetch with integer constant name).
- - Fixed php_fopen_primary_script() call resulted on zend_destroy_file_handle() freeing dangling pointers on the handle as it was uninitialized.
-
-- Curl:
-
- - Fixed deprecation warning at compile time.
- - Fixed bug (Unable to return CURL_READFUNC_PAUSE in readfunc callback).
-
-- Date:
-
- - Fix ('p' format specifier does not yield 'Z' for 00:00).
-
-- FFI:
-
- - Fixed incorrect bitshifting and masking in ffi bitfield.
-
-- Fiber:
-
- - Fixed assembly on alpine x86.
- - Fixed bug (segfault when garbage collector is invoked inside of fiber).
-
-- FPM:
-
- - Fixed bug (FPM unknown child alert not valid).
- - Fixed bug (FPM successful config test early exit).
-
-- Intl:
-
- - Fixed bug (Spoolchecker isSuspicious/areConfusable methods error code's argument always returning NULL0.
-
-- JSON:
-
- - Fixed JSON scanner and parser generation build.
-
-- MBString:
-
- - ext/mbstring: fix new_value length check.
- - Fix bug (mb_convert_encoding crashes PHP on Windows).
-
-- Opcache:
-
- - Fix incorrect page_size check.
-
-- OpenSSL:
-
- - Fixed php_openssl_set_server_dh_param() DH params errors handling.
-
-- PDO OCI:
-
- - (Reading a multibyte CLOB caps at 8192 chars).
-
-- PHPDBG:
-
- - Fixed bug (heap buffer overflow on --run option misuse).
-
-- PGSQL:
-
- - Fix (pg_lo_open segfaults in the strict_types mode).
-
-- Phar:
-
- - Fix incorrect check in phar tar parsing.
-
-- Reflection:
-
- - Fixed bug (Reflection::getClosureUsedVariables opcode fix with variadic arguments).
- - Fix Segfault when using ReflectionFiber suspended by an internal function.
-
-- Session:
-
- - Fixed ps_files_cleanup_dir() on failure code paths with -1 instead of 0 as the latter was considered success by callers. (nielsdos).
-
-- Standard:
-
- - Fixed bug (Made the default value of the first param of srand() and mt_srand() unknown).
- - Fix incorrect check in cs_8559_5 in map_from_unicode().
- - Fix bug for reset/end/next/prev() attempting to move pointer of properties table for certain internal classes such as FFI classes
- - Fix incorrect error check in browsecap for pcre2_match().
-
-- Tidy:
-
- - Fix memory leaks when attempting to open a non-existing file or a file over 4GB.
- - Add missing error check on tidyLoadConfig.
-
-- Zlib:
-
- - Fixed output_handler directive value's length which counted the string terminator.
-
-
-
-
-
-
-
-Version 8.1.16
-
-- Core:
-
- - (Password_verify() always return true with some hash).
- - (1-byte array overrun in common path resolve code).
-
-- SAPI:
-
- - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)
-
-
-
-
-
-
-
-Version 8.1.15
-
-- Apache:
-
- - Fixed bug (Partial content on incomplete POST request).
-
-- Core:
-
- - Fixed bug (PHP crashes when execute_ex is overridden and a __call trampoline is used from internal code).
- - Fix (Assertion `(flag & (1<<3)) == 0' failed).
- - Fix wrong comparison in block optimisation pass after opcode update.
-
-- Date:
-
- - Fixed bug (DateTime modify with unixtimestamp (@) must work like setTimestamp).
- - Fixed bug (DateTimeZone fails to parse time zones that contain the "+" character).
-
-- Fiber:
-
- - Fix assertion on stack allocation size.
-
-- FPM:
-
- - Fixed bug (FPM does not reset fastcgi.error_header).
- - (Wrong owner:group for listening unix socket).
-
-- Hash:
-
- - Handle exceptions from __toString in XXH3's initialization (nielsdos)
-
-- LDAP:
-
- - Fixed bug (LDAP\Connection::__construct() refers to ldap_create()).
-
-- MBString:
-
- - Fixed: mb_strlen (and a couple of other mbstring functions) would wrongly treat 0x80, 0xFD, 0xFE, 0xFF, and certain other byte values as the first byte of a 2-byte SJIS character.
-
-- Opcache:
-
- - Fix inverted bailout value in zend_runtime_jit() (Max Kellermann).
- - Fix access to uninitialized variable in accel_preload().
- - Fix zend_jit_find_trace() crashes.
- - Added missing lock for EXIT_INVALIDATE in zend_jit_trace_exit.
-
-- Phar:
-
- - Fix wrong flags check for compression method in phar_object.c (nielsdos)
-
-- PHPDBG:
-
- - Fix undefined behaviour in phpdbg_load_module_or_extension().
- - Fix NULL pointer dereference in phpdbg_create_conditional_breal().
- - Fix : phpdbg memory leaks by option "-h" (nielsdos)
- - Fix phpdbg segmentation fault in case of malformed input (nielsdos)
-
-- Posix:
-
- - Fix memory leak in posix_ttyname() (girgias)
-
-- Standard:
-
- - Fix (Segfault in stripslashes() with arm64).
- - Fix substr_replace with slots in repl_ht being UNDEF.
-
-- TSRM:
-
- - Fixed Windows shmget() wrt. IPC_PRIVATE.
-
-- XMLWriter:
-
- - Fix missing check for xmlTextWriterEndElement (nielsdos)
-
-
-
-
-
-
-
-Version 8.1.14
-
-- Core:
-
- - Fixed bug (constant() behaves inconsistent when class is undefined).
- - Fixed bug (License information for xxHash is not included in README.REDIST.BINS file).
- - Fixed bug (Can't initialize heap: [0x000001e7]).
- - Fixed potentially undefined behavior in Windows ftok(3) emulation.
-
-- Date:
-
- - Fixed bug (DateTimeImmutable::diff differences in 8.1.10 onwards - timezone related).
- - Fixed bug (DateTime::createFromFormat: Parsing TZID string is too greedy).
- - Fixed bug (Time zone bug with \DateTimeInterface::diff()).
- - Fixed bug (DateTime diff returns wrong sign on day count when using a timezone).
-
-- FPM:
-
- - Fixed bug (Solaris port event mechanism is still broken after bug #66694).
- - (Setting fastcgi.error_header can result in a WARNING).
- - Fixed bug (Random crash of FPM master process in fpm_stdio_child_said).
-
-- MBString:
-
- - Fixed bug (The behavior of mb_strcut in mbstring has been changed in PHP8.1).
-
-- Opcache:
-
- - Fixed bug (Segmentation Fault during OPCache Preload).
-
-- OpenSSL:
-
- - Fixed bug (PHP fails to build if openssl was built with --no-ec).
- - Fixed bug (OpenSSL test failures when OpenSSL compiled with no-dsa).
-
-- Pcntl:
-
- - Fixed bug (Signal handler called after rshutdown leads to crash).
-
-- PDO_Firebird:
-
- - Fixed bug (Incorrect NUMERIC value returned from PDO_Firebird).
-
-- PDO/SQLite:
-
- - (PDO::quote() may return unquoted string). (CVE-2022-31631)
-
-- Session:
-
- - Fixed (session name silently fails with . and [).
-
-- SPL:
-
- - Fixed (SplFileObject::__toString() reads next line).
- - Fixed (Trampoline autoloader will get reregistered and cannot be unregistered).
-
-- SQLite3:
-
- - (open_basedir bypass in SQLite3 by using file URI).
-
-
-
-
-
-
-
-Version 8.1.13
-
-- CLI:
-
- - Fixed bug (Null pointer dereference with -w/-s options).
-
-- Core:
-
- - Fixed bug (Generator crashes when interrupted during argument evaluation with extra named params).
- - Fixed bug (Generator crashes when memory limit is exceeded during initialization).
- - Fixed potential NULL pointer dereference Windows shm*() functions.
- - Fixed bug (Generator memory leak when interrupted during argument evaluation.
-
-- Date:
-
- - Fixed bug (DateTimeZone ctr mishandles input and adds null byte if the argument is an offset larger than 100*60 minutes).
-
-- FPM:
-
- - Fixed bug (SaltStack (using Python subprocess) hangs when running php-fpm 8.1.11).
-
-- mysqli:
-
- - Fixed bug (mysqli_query throws warning despite using silenced error mode).
-
-- MySQLnd:
-
- - Fixed potential heap corruption due to alignment mismatch.
-
-- OpenSSL:
-
- - Fixed bug (OpenSSL compiled with no-md2, no-md4 or no-rmd160 does not build).
-
-- SOAP:
-
- - Fixed (Null pointer dereference while serializing the response).
-
-
-
-
-
-
-
-Version 8.1.12
-
-- Core:
-
- - Fixes segfault with Fiber on FreeBSD i386 architecture.
-
-- Fileinfo:
-
- - Fixed bug (finfo returns wrong mime type for woff/woff2 files).
-
-- GD:
-
- - : OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
-
-- Hash:
-
- - : buffer overflow in hash_update() on long parameter. (CVE-2022-37454)
-
-- MBString:
-
- - Fixed bug (Problem when ISO-2022-JP-MS is specified in mb_ encode_mimeheader).
-
-- Opcache:
-
- - Added indirect call reduction for jit on x86 architectures.
-
-- Session:
-
- - Fixed bug (session_create_id() fails with user defined save handler that doesn't have a validateId() method).
-
-- Streams:
-
- - Fixed bug (stream_select does not abort upon exception or empty valid fd set).
-
-
-
-
-
-
-
-Version 8.1.11
-
-- Core:
-
- - : phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
- - : Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
- - Fixed bug (Crash in ZEND_RETURN/GC/zend_call_function) (Tim Starling)
- - Fixed bug (Segmentation fault on script exit #9379).
- - Fixed bug (Invalid class FQN emitted by AST dump for new and class constants in constant expressions).
-
-- DOM:
-
- - (DOMDocument->replaceChild on doctype causes double free).
-
-- FPM:
-
- - Fixed bug (FPM access.log with stderr begins to write logs to error_log after daemon reload).
- - ("Headers already sent..." when previous connection was aborted).
-
-- GMP:
-
- - Fixed bug (GMP throws the wrong error when a GMP object is passed to gmp_init()).
-
-- Intl:
-
- - Fixed bug (Incorrect argument number for ValueError in NumberFormatter).
-
-- PCRE:
-
- - Fixed pcre.jit on Apple Silicon.
-
-- PDO_PGSQL:
-
- - Fixed bug (PgSQL large object resource is incorrectly closed).
-
-- Reflection:
-
- - Fixed bug (ReflectionFunction provides no way to get the called class of a Closure).
-
-- Streams:
-
- - Fixed bug ($http_response_header is wrong for long status line).
-
-
-
-
-
-
-
-Version 8.1.10
-
-- Core:
-
- - Fixed --CGI-- support of run-tests.php.
- - Fixed incorrect double to long casting in latest clang.
- - Fixed bug (GC root buffer keeps growing when dtors are present).
-
-- Date:
-
- - Fixed bug (DateTime::diff miscalculation is same time zone of different type).
- - Fixed bug (DateTime object comparison after applying delta less than 1 second).
- - Fixed bug : (DateInterval 1.5s added to DateTimeInterface is rounded down since PHP 8.1.0).
- - (Wrong result from DateTimeImmutable::diff).
-
-- DBA:
-
- - Fixed LMDB driver memory leak on DB creation failure.
- - Fixed bug (dba_open("non-existing", "c-", "flatfile") segfaults).
-
-- IMAP:
-
- - Fixed bug (Segfault when connection is used after imap_close()).
-
-- Intl:
-
- - Fixed IntlDateFormatter::formatObject() parameter type.
-
-- MBString:
-
- - Fixed bug (mb_detect_encoding(): wrong results with null $encodings).
-
-- OPcache:
-
- - Fixed bug (Loading blacklist file can fail due to negative length).
- - Fixed bug (Segfault in zend_accel_class_hash_copy).
-
-- PDO_SQLite:
-
- - Fixed bug (SQLite3 authorizer crashes on NULL values).
-
-- SQLite3:
-
- - Fixed bug (SQLite3 authorizer crashes on NULL values).
-
-- Streams:
-
- - Fixed bug (The resource returned by stream_socket_accept may have incorrect metadata).
- - Fixed bug (SSL handshake timeout leaves persistent connections hanging).
-
-
-
-
-
-
-
-Version 8.1.9
-
-- CLI:
-
- - Fixed potential overflow for the builtin server via the PHP_CLI_SERVER_WORKERS environment variable.
- - Fixed (Intentionally closing std handles no longer possible).
-
-- Core:
-
- - Fixed bug (error_log on Windows can hold the file write lock).
- - Fixed bug (WeakMap object reference offset causing TypeError).
-
-- Date:
-
- - (DatePeriod doesn't warn with custom DateTimeImmutable).
-
-- FPM:
-
- - Fixed zlog message prepend, free on incorrect address.
- - Fixed possible double free on configuration loading failure. (Heiko Weber).
-
-- GD:
-
- - Fixed bug (imagecopyresized() error refers to the wrong argument).
-
-- Intl:
-
- - Fixed build for ICU 69.x and onwards.
-
-- OPcache:
-
- - Fixed bug (PHP hanging infinitly at 100% cpu when check php syntax of a valid file).
- - Fixed bug (Segfault with JIT and large match/switch statements).
-
-- Reflection:
-
- - Fixed bug (Fixed Reflection::getModifierNames() with readonly modifier).
-
-- Standard:
-
- - Fixed the crypt_sha256/512 api build with clang > 12.
- - Uses CCRandomGenerateBytes instead of arc4random_buf on macOs. (David Carlier).
- - Fixed bug (php_stream_sock_open_from_socket could return NULL).
-
-
-
-
-
-
-
-Version 8.1.8
-
-- Core:
-
- - Fixed bug (Intel CET is disabled unintentionally).
- - Fixed leak in Enum::from/tryFrom for internal enums when using JIT
- - Fixed calling internal methods with a static return type from extension code.
- - Fixed bug (Casting an object to array does not unwrap refcount=1 references).
- - Fixed potential use after free in php_binary_init().
-
-- CLI:
-
- - Fixed (Intentionally closing std handles no longer possible).
-
-- COM:
-
- - Fixed bug (Integer arithmethic with large number variants fails).
-
-- Curl:
-
- - Fixed CURLOPT_TLSAUTH_TYPE is not treated as a string option.
-
-- Date:
-
- - (Null-byte injection in CreateFromFormat and related functions).
- - (DST timezone abbreviation has incorrect offset).
- - (Weekdays are calculated incorrectly for negative years).
- - (timezone_open accepts invalid timezone string argument).
-
-- Fileinfo:
-
- - (Heap buffer overflow in finfo_buffer). (CVE-2022-31627)
-
-- FPM:
-
- - (fpm: syslog.ident don't work).
-
-- GD:
-
- - Fixed imagecreatefromavif() memory leak.
-
-- MBString:
-
- - mb_detect_encoding recognizes all letters in Czech alphabet
- - mb_detect_encoding recognizes all letters in Hungarian alphabet
- - Fixed bug (pcre not ready at mbstring startup).
- - Backwards-compatible mappings for 0x5C/0x7E in Shift-JIS are restored, after they had been changed in 8.1.0.
-
-- ODBC:
-
- - Fixed handling of single-key connection strings.
-
-- OPcache:
-
- - Fixed bug (tracing JIT crash after private instance method change).
-
-- OpenSSL:
-
- - (Several openssl functions ignore the VCWD).
- - (NULL byte injection in several OpenSSL functions working with certificates).
-
-- PDO_ODBC:
-
- - Fixed handling of single-key connection strings.
-
-- Zip:
-
- - Fixed bug (ZipArchive::close deletes zip file without updating stat cache).
-
-
-
-
-
-
-
-Version 8.1.7
-
-- CLI:
-
- - Fixed bug (CLI closes standard streams too early).
-
-- Date:
-
- - (strtotime plurals / incorrect time).
- - (Datetime fails to parse an ISO 8601 ordinal date (extended format)).
- - (DateTime object does not support short ISO 8601 time format - YYYY-MM-DDTHH)
- - (Timezones and offsets are not properly used when working with dates)
- - (date parsing fails when provided with timezones including seconds).
- - Fixed bug (Problems with negative timestamps and fractions).
-
-- FPM:
-
- - Fixed ACL build check on MacOS.
- - : php-fpm writes empty fcgi record causing nginx 502.
-
-- mysqlnd:
-
- - : mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
-
-- OPcache:
-
- - Fixed bug (tracing JIT crash after function/method change).
-
-- OpenSSL:
-
- - (error:14095126:SSL routines:ssl3_read_n:unexpected eof while reading).
-
-- Pcntl:
-
-- pgsql:
-
- - : Uninitialized array in pg_query_params(). (CVE-2022-31625)
-
-- Soap:
-
- - Fixed bug (Error on wrong parameter on SoapHeader constructor).
- - Fixed bug (SoapClient may strip parts of nmtokens).
-
-- SPL:
-
- - Fixed bug (iterator_count() may run indefinitely).
-
-- Standard:
-
- - Fixed bug (Crash during unloading of extension after dl() in ZTS).
-
-- Zip:
-
- - Fixed type for index in ZipArchive::replaceFile.
-
-
-
-
-
-
-
-Version 8.1.6
-
-- Core:
-
- - Fixed bug (Registry settings are no longer recognized).
- - Fixed potential race condition during resource ID allocation.
- - Fixed bug (Preloading of constants containing arrays with enums segfaults).
- - Fixed Haiku ZTS builds.
-
-- Date:
-
- - Fixed bug (DateTimeZone::getTransitions() returns insufficient data).
- - Fixed bug (Timezone doesn't work as intended).
- - (DateTimeZone::getTransitions() returns invalid data).
- - Fixed bug (Exceptions thrown within a yielded from iterator are not rethrown into the generator).
-
-- FFI:
-
- - Fixed bug (Assigning function pointers to structs in FFI leaks).
-
-- FPM:
-
- - (FPM /status reports wrong number of active processe).
- - (FPM cannot shutdown processes).
- - Fixed comment in kqueue remove callback log message.
-
-- Hash:
-
- - (segfault when serializing finalized HashContext).
-
-- Iconv:
-
- - Fixed bug (ob_end_clean does not reset Content-Encoding header).
-
-- Intl:
-
- - Fixed bug (msgfmt_format $values may not support references).
-
-- MBString:
-
- - Number of error markers emitted for invalid UTF-8 text matches WHATWG specification. This is a return to the behavior of PHP 8.0 and earlier.
-
-- MySQLi:
-
- - Fixed bug (MySQLi uses unsupported format specifier on Windows).
-
-- SPL:
-
- - Fixed bug (ArrayIterator may leak when calling __construct()).
- - Fixed bug (SplFileObject: key() returns wrong value).
-
-- Streams:
-
- - Fixed php://temp does not preserve file-position when switched to temporary file.
-
-- zlib:
-
- - Fixed bug (ob_end_clean does not reset Content-Encoding header).
-
-
-
-
-
-
-
-Version 8.1.5
-
-- Core:
-
- - Fixed bug (Enum values in property initializers leak).
- - Fixed freeing of internal attribute arguments.
- - Fixed bug (memory leak of internal function attribute hash).
- - Fixed bug (ZTS support on Alpine is broken).
-
-- Filter:
-
- - Fixed signedness confusion in php_filter_validate_domain().
-
-- Intl:
-
- - Fixed bug (Can't catch arg type deprecation when instantiating Intl classes).
- - Fixed bug (Compilation error on cygwin).
- - Fixed bug (Fix IntlPartsIterator key off-by-one error and first key).
-
-- MBString:
-
- - Fixed bug (mb_encode_mimeheader: $indent functionality broken).
-
-- MySQLi:
-
- - Fixed bug (mysqli_fetch_object creates inaccessible properties).
-
-- Pcntl:
-
- - Fixed bug (Compilation error on cygwin).
-
-- PgSQL:
-
- - Fixed result_type related stack corruption on LLP64 architectures.
- - Fixed bug (pg_insert() fails for references).
-
-- Sockets:
-
- - Fixed Solaris builds.
-
-- SPL:
-
- - Fixed bug (SplFileObject - seek and key with csv file inconsistent).
- - Fixed bug (Cannot override DirectoryIterator::current() without return typehint in 8.1).
-
-- Standard:
-
- - Fixed bug (Force macOS to use statfs).
-
-
-
-
-
-
-
-Version 8.1.4
-
-- Core:
-
- - Fixed Haiku ZTS build.
- - Fixed bug arginfo not regenerated for extension.
- - Fixed bug Segfault when dumping uncalled fake closure with static variables.
- - Fixed bug (Nested CallbackFilterIterator is leaking memory).
- - Fixed bug (Wrong type inference of range() result).
- - Fixed bug (Wrong first class callable by name optimization).
- - Fixed bug (op_arrays with temporary run_time_cache leak memory when observed).
-
-- GD:
-
- - Fixed libpng warning when loading interlaced images.
-
-- FPM:
-
- - (Unsafe access to fpm scoreboard).
-
-- Iconv:
-
- - Fixed bug (ob_clean() only does not set Content-Encoding).
- - Fixed bug (Unexpected result for iconv_mime_decode).
-
-- MBString:
-
- - Fixed bug (mb_check_encoding wrong result for 7bit).
-
-- MySQLnd:
-
- - Fixed bug (NULL pointer dereference in mysqlnd package).
-
-- Reflection:
-
- - Fixed bug (ReflectionClass::getConstants() depends on def. order).
-
-- Zlib:
-
- - Fixed bug (ob_clean() only does not set Content-Encoding).
-
-
-
-
-
-
-
-Version 8.1.3
-
-- Core:
-
- - (Attribute instantiation leaves dangling pointer).
- - Fixed bug (Environment vars may be mangled on Windows).
- - Fixed bug (Segfault when INI file is not readable).
-
-- FFI:
-
- - Fixed bug (FFI::cast() from pointer to array is broken).
-
-- Filter:
-
- - Fix #81708: UAF due to php_filter_float() failing for ints. (CVE-2021-21708)
-
-- FPM:
-
- - Fixed memory leak on invalid port.
- - Fixed bug (Invalid OpenMetrics response format returned by FPM status page.
-
-- MBString:
-
- - Fixed bug (mb_send_mail may delimit headers with LF only).
-
-- MySQLnd:
-
- - Fixed bug (MariaDB version prefix 5.5.5- is not stripped).
-
-- pcntl:
-
- - Fixed pcntl_rfork build for DragonFlyBSD.
-
-- Sockets:
-
- - Fixed bug (sockets extension compilation errors).
-
-- Standard:
-
- - Fixed bug (Regression in unpack for negative int value).
- - Fixed bug (mails are sent even if failure to log throws exception).
-
-
-
-
-
-
-
-Version 8.1.2
-
-- Core:
-
- - (Nullsafe operator leaks dynamic property name).
- - (Using null coalesce assignment with $GLOBALS["x"] produces opcode error).
- - (GCC-11 silently ignores -R).
- - (Misleading "access type ... must be public" error message on final or abstract interface methods).
- - (cached_chunks are not counted to real_size on shutdown).
- - Fixed bug (Multi-inherited final constant causes fatal error).
- - Fixed zend_fibers.c build with ZEND_FIBER_UCONTEXT.
- - Added riscv64 support for fibers.
-
-- Filter:
-
- - Fixed FILTER_FLAG_NO_RES_RANGE flag.
-
-- Hash:
-
- - Fixed bug (Incorrect return types for hash() and hash_hmac()).
- - Fixed bug (Inconsistent argument name in hash_hmac_file and hash_file).
-
-- MBString:
-
- - (mb_check_encoding(7bit) segfaults).
-
-- MySQLi:
-
- - (MYSQL_OPT_LOAD_DATA_LOCAL_DIR not available in MariaDB).
- - Introduced MYSQLI_IS_MARIADB.
- - Fixed bug (mysqli_sql_exception->getSqlState()).
-
-- MySQLnd:
-
- - Fixed bug where large bigints may be truncated.
-
-- OCI8:
-
- - Fixed bug (php_oci_cleanup_global_handles segfaults at second call).
-
-- OPcache:
-
- - (Tracing JIT crashes on reattaching).
-
-- Readline:
-
- - (Cannot input unicode characters in PHP 8 interactive shell).
-
-- Reflection:
-
- - (ReflectionEnum throwing exceptions).
-
-- PDO_PGSQL:
-
- - Fixed error message allocation of PDO PgSQL.
-
-- Sockets:
-
- - Avoid void* arithmetic in sockets/multicast.c on NetBSD.
- - Fixed ext/sockets build on Haiku.
-
-- Spl:
-
- - (SplFileObject::seek broken with CSV flags).
- - Fixed bug (Cloning a faked SplFileInfo object may segfault).
-
-- Standard:
-
- - Fixed bug (gethostbyaddr outputs binary string).
- - Fixed bug (php_uname doesn't recognise latest Windows versions).
-
-
-
-
-
-
-
-Version 8.1.1
-
-- IMAP:
-
- - (imap_(un)delete accept sequences, not single numbers).
-
-- PCRE:
-
- - Update bundled PCRE2 to 10.39.
- - (Out of bounds in php_pcre_replace_impl).
-
-- Standard:
-
- - (stream_get_contents() may unnecessarily overallocate).
-
-
-
-
-
-
-
-
-
-
-
-
-
-Version 8.0.30
-
-- Libxml:
-
- - Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
-
-- Phar:
-
- - Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)
-
-
-
-
-
-
-
-Version 8.0.29
-
-- Soap:
-
- - Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP). (CVE-2023-3247)
-
-
-
-
-
-
-
-Version 8.0.28
-
-- Core:
-
- - (Password_verify() always return true with some hash).
- - (1-byte array overrun in common path resolve code).
-
-- SAPI:
-
- - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)
-
-
-
-
-
-
-
-Version 8.0.27
-
-- PDO/SQLite:
-
- - (PDO::quote() may return unquoted string). (CVE-2022-31631)
-
-
-
-
-
-
-
-Version 8.0.26
-
-- CLI:
-
- - Fixed bug (Null pointer dereference with -w/-s options).
-
-- Core:
-
- - Fixed bug (Generator crashes when interrupted during argument evaluation with extra named params).
- - Fixed bug (Generator crashes when memory limit is exceeded during initialization).
- - Fixed potential NULL pointer dereference in Windows shm*() functions.
- - Fixed bug (Generator memory leak when interrupted during argument evaluation.
-
-- Date:
-
- - Fixed bug (DateTimeZone ctr mishandles input and adds null byte if the argument is an offset larger than 100*60 minutes).
-
-- FPM:
-
- - Fixed bug (SaltStack (using Python subprocess) hangs when running php-fpm 8.1.11).
-
-- mysqli:
-
- - Fixed bug (mysqli_query throws warning despite using silenced error mode).
-
-- OpenSSL:
-
- - Fixed bug (OpenSSL compiled with no-md2, no-md4 or no-rmd160 does not build).
-
-- SOAP:
-
- - Fixed (Null pointer dereference while serializing the response).
-
-
-
-
-
-
-
-Version 8.0.25
-
-- GD:
-
- - : OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
-
-- Hash:
-
- - : buffer overflow in hash_update() on long parameter. (CVE-2022-37454)
-
-- Session:
-
- - Fixed bug (session_create_id() fails with user defined save handler that doesn't have a validateId() method).
-
-- Streams:
-
- - Fixed bug (stream_select does not abort upon exception or empty valid fd set).
-
-
-
-
-
-
-
-Version 8.0.24
-
-- Core:
-
- - Fixed bug (Crash in ZEND_RETURN/GC/zend_call_function) (Tim Starling)
- - Fixed bug (Segmentation fault on script exit #9379).
- - Fixed bug (LSP error in eval'd code refers to wrong class for static type).
- - : Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
-
-- DOM:
-
- - (DOMDocument->replaceChild on doctype causes double free).
-
-- FPM:
-
- - Fixed bug (FPM access.log with stderr begins to write logs to error_log after daemon reload).
- - ("Headers already sent..." when previous connection was aborted).
-
-- GMP:
-
- - Fixed bug (GMP throws the wrong error when a GMP object is passed to gmp_init()).
-
-- Intl:
-
- - Fixed bug (Incorrect argument number for ValueError in NumberFormatter).
-
-- Phar:
-
- - : phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
-
-- PDO_PGSQL:
-
- - Fixed bug (PgSQL large object resource is incorrectly closed).
-
-- Reflection:
-
- - Fixed bug (ReflectionFunction provides no way to get the called class of a Closure).
- - Fixed bug (Private method is incorrectly dumped as "overwrites").
-
-- Streams:
-
- - Fixed bug ($http_response_header is wrong for long status line).
-
-
-
-
-
-
-
-Version 8.0.23
-
-- Core:
-
- - Fixed incorrect double to long casting in latest clang.
-
-- DBA:
-
- - Fixed LMDB driver memory leak on DB creation failure.
- - Fixed bug (dba_open("non-existing", "c-", "flatfile") segfaults).
-
-- Intl:
-
- - Fixed IntlDateFormatter::formatObject() parameter type.
-
-- OPcache:
-
- - Fixed bug (Loading blacklist file can fail due to negative length).
-
-- PDO_SQLite:
-
- - Fixed bug (SQLite3 authorizer crashes on NULL values).
-
-- SQLite3:
-
- - Fixed bug (SQLite3 authorizer crashes on NULL values).
-
-- Standard:
-
- - Fixed bug (php_stream_sock_open_from_socket could return NULL).
-
-- Streams:
-
- - Fixed bug (The resource returned by stream_socket_accept may have incorrect metadata).
- - Fixed bug (SSL handshake timeout leaves persistent connections hanging).
-
-
-
-
-
-
-
-Version 8.0.22
-
-- CLI:
-
- - Fixed potential overflow for the builtin server via the PHP_CLI_SERVER_WORKERS environment variable.
-
-- Core:
-
- - Fixed bug (error_log on Windows can hold the file write lock).
- - Fixed bug (WeakMap object reference offset causing TypeError).
-
-- Date:
-
- - (DatePeriod doesn't warn with custom DateTimeImmutable).
-
-- DBA:
-
- - Fixed LMDB driver hanging when attempting to delete a non-existing key.
-
-- FPM:
-
- - Fixed zlog message prepend, free on incorrect address.
- - Fixed possible double free on configuration loading failure.
-
-- GD:
-
- - Fixed bug (imagecopyresized() error refers to the wrong argument).
-
-- Intl:
-
- - Fixed build for ICU 69.x and onwards.
-
-- OPcache:
-
- - Fixed bug (PHP hanging infinitly at 100% cpu when check php syntaxe of a valid file).
-
-- Standard:
-
- - Fixed the crypt_sha256/512 api build with clang > 12.
- - Uses CCRandomGenerateBytes instead of arc4random_buf on macOs.
-
-
-
-
-
-
-
-Version 8.0.21
-
-- Core:
-
- - Fixed potential use after free in php_binary_init().
-
-- CLI:
-
- - Fixed (Intentionally closing std handles no longer possible).
-
-- COM:
-
- - Fixed bug (Integer arithmethic with large number variants fails).
-
-- Curl:
-
- - Fixed CURLOPT_TLSAUTH_TYPE is not treated as a string option.
-
-- Date:
-
- - (DST timezone abbreviation has incorrect offset).
- - (Weekdays are calculated incorrectly for negative years).
- - (timezone_open accepts invalid timezone string argument).
-
-- FPM:
-
- - (fpm: syslog.ident don't work).
-
-- MBString:
-
- - Fixed bug (pcre not ready at mbstring startup).
-
-- ODBC:
-
- - Fixed handling of single-key connection strings.
-
-- OpenSSL:
-
- - (Several openssl functions ignore the VCWD).
- - (NULL byte injection in several OpenSSL functions working with certificates).
-
-- PDO_ODBC:
-
- - Fixed errorInfo() result on successful PDOStatement->execute().
- - Fixed handling of single-key connection strings.
-
-- Zip:
-
- - Fixed bug (ZipArchive::close deletes zip file without updating stat cache).
-
-
-
-
-
-
-
-Version 8.0.20
-
-- CLI:
-
- - Fixed bug (CLI closes standard streams too early).
-
-- Core:
-
- - Fixed Haiku ZTS builds.
-
-- Date:
-
- - Fixed bug (Segmentation fault when converting immutable and mutable DateTime instances created using reflection).
-
-- FPM:
-
- - Fixed ACL build check on MacOS.
- - : php-fpm writes empty fcgi record causing nginx 502.
-
-- Mysqlnd:
-
- - : mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
-
-- OPcache:
-
- - Fixed bug (ini_get() is optimized out when the option does not exist).
-
-- Pcntl:
-
-- Pgsql:
-
- - : Uninitialized array in pg_query_params(). (CVE-2022-31625)
-
-- Soap:
-
- - Fixed bug (Error on wrong parameter on SoapHeader constructor).
- - Fixed bug (SoapClient may strip parts of nmtokens).
-
-- SPL:
-
- - Fixed bug (iterator_count() may run indefinitely).
-
-- Zip:
-
- - Fixed type for index in ZipArchive::replaceFile.
-
-
-
-
-
-
-
-Version 8.0.19
-
-- Core:
-
- - Fixed bug (Exceptions thrown within a yielded from iterator are not rethrown into the generator).
-
-- Date:
-
- - Fixed bug (DatePeriod iterator advances when checking if valid).
-
-- FFI:
-
- - Fixed bug (Assigning function pointers to structs in FFI leaks).
-
-- FPM:
-
- - (FPM /status reports wrong number of active processe).
- - (FPM cannot shutdown processes).
- - Fixed comment in kqueue remove callback log message.
-
-- Iconv:
-
- - Fixed bug (ob_end_clean does not reset Content-Encoding header).
-
-- Intl:
-
- - Fixed bug (msgfmt_format $values may not support references).
-
-- MySQLi:
-
- - Fixed bug (MySQLi uses unsupported format specifier on Windows).
-
-- SPL:
-
- - Fixed bug (ArrayIterator may leak when calling __construct()).
- - Fixed bug (SplFileObject: key() returns wrong value).
-
-- Streams:
-
- - Fixed php://temp does not preserve file-position when switched to temporary file.
-
-- zlib:
-
- - Fixed bug (ob_end_clean does not reset Content-Encoding header).
-
-
-
-
-
-
-
-Version 8.0.18
-
-- Core:
-
- - Fixed freeing of internal attribute arguments.
- - Fixed bug (memory leak of internal function attribute hash).
- - Fixed bug (ZTS support on Alpine is broken).
-
-- Filter:
-
- - Fixed signedness confusion in php_filter_validate_domain().
-
-- Intl:
-
- - Fixed bug (Compilation error on cygwin).
-
-- MBString:
-
- - Fixed bug (mb_encode_mimeheader: $indent functionality broken).
-
-- MySQLi:
-
- - Fixed bug (mysqli_fetch_object creates inaccessible properties).
-
-- Pcntl:
-
- - Fixed bug (Compilation error on cygwin).
-
-- PgSQL:
-
- - Fixed result_type related stack corruption on LLP64 architectures.
- - Fixed bug (pg_insert() fails for references).
-
-- Sockets:
-
- - Fixed Solaris builds.
-
-- SPL:
-
- - Fixed bug (SplFileObject - seek and key with csv file inconsistent).
-
-- Standard:
-
- - Fixed bug (Force macOS to use statfs).
-
-
-
-
-
-
-
-Version 8.0.17
-
-- Core:
-
- - Fixed Haiku ZTS build.
-
-- GD:
-
- - Fixed libpng warning when loading interlaced images.
-
-- FPM:
-
- - (Unsafe access to fpm scoreboard).
-
-- Iconv:
-
- - Fixed bug (ob_clean() only does not set Content-Encoding).
- - Fixed bug (Unexpected result for iconv_mime_decode).
-
-- MySQLnd:
-
- - Fixed bug (NULL pointer dereference in mysqlnd package).
-
-- OPcache:
-
- - Fixed bug (Wrong type inference of range() result).
-
-- Reflection:
-
- - Fixed bug (ReflectionClass::getConstants() depends on def. order).
-
-- Zlib:
-
- - Fixed bug (ob_clean() only does not set Content-Encoding).
-
-
-
-
-
-
-
-Version 8.0.16
-
-- Core:
-
- - (Attribute instantiation leaves dangling pointer).
- - Fixed bug (Environment vars may be mangled on Windows).
-
-- FFI:
-
- - Fixed bug (FFI::cast() from pointer to array is broken).
-
-- Filter:
-
- - Fix #81708: UAF due to php_filter_float() failing for ints.
-
-- FPM:
-
- - Fixed memory leak on invalid port.
-
-- MBString:
-
- - Fixed bug (mb_send_mail may delimit headers with LF only).
-
-- MySQLnd:
-
- - Fixed bug (MariaDB version prefix 5.5.5- is not stripped).
-
-- Sockets:
-
- - Fixed ext/sockets build on Haiku.
- - Fixed bug (sockets extension compilation errors).
-
-- Standard:
-
- - Fixed bug (mails are sent even if failure to log throws exception).
-
-
-
-
-
-
-
-Version 8.0.15
-
-- Core:
-
- - (GCC-11 silently ignores -R).
- - (cached_chunks are not counted to real_size on shutdown).
-
-- Filter:
-
- - Fixed FILTER_FLAG_NO_RES_RANGE flag.
-
-- Hash:
-
- - Fixed bug (Incorrect return types for hash() and hash_hmac()).
- - Fixed bug (Inconsistent argument name in hash_hmac_file and hash_file).
-
-- MySQLnd:
-
- - Fixed bug where large bigints may be truncated.
-
-- OCI8:
-
- - Fixed bug (php_oci_cleanup_global_handles segfaults at second call).
-
-- OPcache:
-
- - (Tracing JIT crashes on reattaching).
-
-- PDO_PGSQL:
-
- - Fixed error message allocation of PDO PgSQL.
-
-- Sockets:
-
- - Avoid void* arithmetic in sockets/multicast.c on NetBSD.
-
-- Spl:
-
- - (SplFileObject::seek broken with CSV flags).
-
-
-
-
-
-
-
-Version 8.0.14
-
-- Core:
-
- - (Stringable not implicitly declared if __toString() came from a trait).
- - (Fatal Error not properly logged in particular cases).
- - (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
- - (::class with dynamic class name may yield wrong line number).
-
-- FPM:
-
- - (Future possibility for heap overflow in FPM zlog).
-
-- GD:
-
- - (libpng warning from imagecreatefromstring).
-
-- IMAP:
-
- - (imap_(un)delete accept sequences, not single numbers).
-
-- OpenSSL:
-
- - (./configure: detecting RAND_egd).
-
-- PCRE:
-
- - (Out of bounds in php_pcre_replace_impl).
-
-- SPL:
-
- - (MultipleIterator Segmentation fault w/ SimpleXMLElement attached).
-
-- Standard:
-
- - (dns_get_record fails on FreeBSD for missing type).
- - (stream_get_contents() may unnecessarily overallocate).
-
-
-
-
-
-
-
-Version 8.0.13
-
-- Core:
-
- - (Header injection via default_mimetype / default_charset).
-
-- Date:
-
- - (Interval serialization regression since 7.3.14 / 7.4.2).
-
-- DBA:
-
- - (TokyoCabinet driver leaks memory).
-
-- MBString:
-
- - (mbstring may use pointer from some previous request).
-
-- Opcache:
-
- - (Unexpected behavior with arrays and JIT).
-
-- PCRE:
-
- - (PCRE2 10.35 JIT performance regression).
-
-- XML:
-
- - (special character is breaking the path in xml function). (CVE-2021-21707)
-
-- XMLReader:
-
- - (XMLReader::getParserProperty may throw with a valid property).
-
-
-
-
-
-
-
-Version 8.0.12
-
-- CLI:
-
- - (Server logs incorrect request method).
-
-- Core:
-
- - (Observer current_observed_frame may point to an old (overwritten) frame).
- - (Observer may not be initialized properly).
-
-- DOM:
-
- - (DOMElement::setIdAttribute() called twice may remove ID).
-
-- FFI:
-
- - ("TYPE *" shows unhelpful message when type is not defined).
-
-- FPM:
-
- - (PHP-FPM oob R/W in root process leading to privilege escalation) (CVE-2021-21703).
-
-- Fileinfo:
-
- - (High memory usage during encoding detection).
-
-- Filter:
-
- - (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing).
-
-- Opcache:
-
- - (Cannot support large linux major/minor device number when read /proc/self/maps).
-
-- Reflection:
-
- - ReflectionAttribute is no longer final.
-
-- SPL:
-
- - (Recursive SplFixedArray::setSize() may cause double-free).
- - (LimitIterator + SplFileObject regression in 8.0.1).
-
-- Standard:
-
- - (Change Error message of sprintf/printf for missing/typo position specifier).
-
-- Streams:
-
- - (stream_isatty emits warning with attached stream wrapper).
-
-- XML:
-
- - (XML_OPTION_SKIP_WHITE strips embedded whitespace).
-
-- Zip:
-
- - (ZipArchive::extractTo() may leak memory).
- - (Dirname ending in colon unzips to wrong dir).
-
-
-
-
-
-
-
-Version 8.0.11
-
-- Core:
-
- - (Stream position after stream filter removed).
- - (Non-seekable streams don't update position after write).
- - (Integer Overflow when concatenating strings).
-
-- GD:
-
- - (During resize gdImageCopyResampled cause colors change).
-
-- Opcache:
-
- - (segfault with preloading and statically bound closure).
-
-- Shmop:
-
- - (shmop_open won't attach and causes php to crash).
-
-- Standard:
-
- - (disk_total_space does not work with relative paths).
- - (Unterminated string in dns_get_record() results).
-
-- SysVMsg:
-
- - (Heap Overflow in msg_send).
-
-- XML:
-
- - (xml_parse may fail, but has no error code).
-
-- Zip:
-
- - (ZipArchive::getStream doesn't use setPassword).
- - (ZipArchive::extractTo extracts outside of destination).
-
-
-
-
-
-
-
-Version 8.0.10
-
-- Core:
-
- - (php_output_handler_append illegal write access).
- - (Weird behaviour when using get_called_class() with call_user_func()).
- - (Built-in Webserver Drops Requests With "Upgrade" Header).
-
-- BCMath:
-
- - (BCMath returns "-0").
-
-- CGI:
-
- - (HTTP Status header truncation).
-
-- Date:
-
- - (Error parsing when AM/PM not at the end).
- - (DateTimeZone accepting invalid UTC timezones).
- - (date_create_from_format misses leap year).
- - (DateTime::modify() loses time with 'weekday' parameter).
-
-- GD:
-
- - (imagefilledellipse does not work for large circles).
-
-- MySQLi:
-
- - (Integer overflow in mysqli_real_escape_string()).
-
-- Opcache:
-
- - (Wrong result with pow operator with JIT enabled).
- - (Intermittent property assignment failure with JIT enabled).
- - (Multiple PHP processes crash with JIT enabled).
- - (Segfault in var[] after array_slice with JIT).
- - (Memory leak in PHPUnit with functional JIT).
- - (Infinite loop in building cfg during JIT compilation) (Nikita, Dmitry)
- - (Integer overflow behavior is different with JIT enabled).
-
-- OpenSSL:
-
- - (Error build openssl extension on php 7.4.22).
-
-- PDO_ODBC:
-
- - (PDO_ODBC doesn't account for SQL_NO_TOTAL).
-
-- Phar:
-
- - : Symlinks are followed when creating PHAR archive
-
-- Shmop:
-
- - (shmop can't read beyond 2147483647 bytes).
-
-- SimpleXML:
-
- - (Segfault in zif_simplexml_import_dom).
-
-- Standard:
-
- - (Integer overflow on substr_replace).
- - (getimagesize returns 0 for 256px ICO images).
- - (Heap buffer overflow via str_repeat).
-
-- Streams:
-
- - (Segfault when removing a filter).
-
-
-
-
-
-
-
-Version 8.0.9
-
-- Core:
-
- - (copy() and stream_copy_to_stream() fail for +4GB files).
- - (incorrect handling of indirect vars in __sleep).
- - (Object to int warning when using an object as a string offset).
- - (PHP built-in web server resets timeout when it can kill the process).
- - (Built-in Webserver - overwrite $_SERVER['request_uri']).
- - (Using return value of zend_assign_to_variable() is not safe).
- - (--r[fcez] always return zero exit code).
-
-- Intl:
-
- - (Locale::lookup() wrong result with canonicalize option).
- - (IntlDateFormatter fails for "GMT+00:00" timezone).
- - (grapheme_strrpos() broken for negative offsets).
-
-- OpenSSL:
-
- - (openssl_csr_sign truncates $serial).
-
-- PCRE:
-
- - (PCRE2 10.37 shows unexpected result).
- - (Too much memory is allocated for preg_replace()).
-
-- Reflection:
-
- - (Segmentation fault while create newInstance from attribute).
-
-- Standard:
-
- - (flock() only locks first byte of file).
-
-
-
-
-
-
-
-Version 8.0.8
-
-- Core:
-
- - (incorrect debug info on Closures with implicit binds).
- - (Double free in realpath_cache_clean()).
- - (open_basedir bypass through adding "..").
- - (Typed property performance degradation with .= operator).
- - (Integer underflow in memory limit comparison).
- - (SSRF bypass in FILTER_VALIDATE_URL). (CVE-2021-21705)
-
-- Bzip2:
-
- - (fflush before stream_filter_remove corrupts stream).
-
-- Fileinfo:
-
- - (implicit declaration of function 'magic_stream' is invalid).
-
-- GMP:
-
- - (GMP operators throw errors with wrong parameter names).
-
-- OCI8:
-
- - (error in regression test for oci_fetch_object() and oci_fetch_array()).
-
-- Opcache:
-
- - (Broken property type handling after incrementing reference).
- - (JIT segfault with return from required file).
-
-- OpenSSL:
-
- - (native Windows cert verification uses CN as server name).
-
-- MySQLnd:
-
- - (PDO uses too much memory).
-
-- PDO_Firebird:
-
- - (Stack buffer overflow in firebird_info_cb). (CVE-2021-21704)
- - (SIGSEGV in firebird_handle_doer). (CVE-2021-21704)
- - (SIGSEGV in firebird_stmt_execute). (CVE-2021-21704)
- - (Crash while parsing blob data in firebird_fetch_blob). (CVE-2021-21704)
-
-- readline:
-
- - (invalid read in readline completion).
-
-- Standard:
-
- - (phpinfo(INFO_VARIABLES) "Array to string conversion").
- - (method_exists on Closure::__invoke inconsistency).
-
-- Windows:
-
- - (PGO data for main PHP DLL are not used).
-
-
-
-
-
-
-
-Version 8.0.7
-
-- Core:
-
- - (opendir() warning wrong info when failed on Windows).
- - (HTTP Authorization schemes are treated as case-sensitive).
- - (Memory exhaustion on invalid string offset).
-
-- FPM:
-
- - (Events port mechanism).
-
-- FTP:
-
- - (Info leak in ftp extension).
- - (Wrong FTP error messages).
-
-- GD:
-
- - (GD install is affected by external libgd installation).
-
-- Intl:
-
- - (Unable to clone NumberFormatter after failed parse()).
-
-- MBString:
-
- - (mb_convert_encoding removes references from arrays).
-
-- ODBC:
-
- - (ODBC doesn't account for SQL_NO_TOTAL indicator).
-
-- Opcache:
-
- - (JIT "not supported" on 32-bit x86 -- build problem?).
- - (Opcache optimization assumes wrong part of ternary operator in if-condition).
- - (Literal compaction merges non-equal related literals).
-
-- PDO_MySQL:
-
- - (PDO discards error message text from prepared statement).
-
-- PDO_ODBC:
-
- - (bound parameters ignore explicit type definitions).
-
-- pgsql:
-
- - Fixed php_pgsql_fd_cast() wrt. php_stream_can_cast().
-
-- SPL:
-
- - (SplFileObject::DROP_NEW_LINE is broken for NUL and CR).
-
-- XMLReader:
-
- - (XMLReader: encoding length not checked).
-
-- Zip:
-
- - (ZipArchive::extractTo() ignores references).
-
-
-
-
-
-
-
-Version 8.0.6
-
-- PDO_pgsql:
-
- - Revert " (PDO::PARAM_INT is treated the same as PDO::PARAM_STR)"
-
-
-
-
-
-
-
-Version 8.0.5
-
-- Core:
-
- - (Flushing streams with compression filter is broken).
- - (Function exec without $output but with $restult_code parameter crashes).
- - (threaded mod_php won't load on FreeBSD: No space available for static Thread Local Storage).
- - Changed PowerPC CPU registers used by Zend VM to work around GCC bug. Old registers (r28/r29) might be clobbered by _restgpr routine used for return from C function compiled with -Os.
-
-- Dba:
-
- - (dba_popen() may cause segfault during RSHUTDOWN).
-
-- DOM:
-
- - (UAF when appending DOMDocument to element).
-
-- FFI:
-
- - (CData structs with fields of type struct can't be passed as C function argument).
-
-- FPM:
-
- - (Duplication of info about inherited socket after pool removing).
-
-- FTP:
-
- - (SSL_read on shutdown, ftp/proc_open).
-
-- IMAP:
-
- - (imap_open() fails when the flags parameter includes CL_EXPUNGE).
- - (imap_mail_compose() header injection).
-
-- Intl:
-
- - (msgfmt_format() does not accept DateTime references).
-
-- LibXML:
-
- - (Invalid memory access in php_libxml_xmlCheckUTF8).
- - (simplexml_load_file() doesn't use HTTP headers).
-
-- MySQLnd:
-
- - (Calling stmt_store_result after fetch doesn't throw an error).
-
-- Opcache:
-
- - (PHP problem with JIT).
- - (erronous array key overflow in 2D array with JIT).
- - (PHP crash using JIT).
- - (DASM_S_RANGE_VREG on PHP_INT_MIN-1).
-
-- Pcntl:
-
- - (Potential integer overflow in pcntl_exec()).
-
-- PCRE:
-
- - (preg_split ignores limit flag when pattern with \K has 0-width fullstring match).
-
-- PDO_ODBC:
-
- - (PDO ODBC truncates BLOB records at every 256th byte).
-
-- PDO_pgsql:
-
- - (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
-
-- Session:
-
- - (Cannot set save handler when save_handler is invalid).
- - (session_name() problem with backslash).
-
-- SOAP:
-
- - (SOAP special XML characters in namespace URIs not encoded).
-
-- Standard:
-
- - (Taking a reference to $_SERVER hides its values from phpinfo()).
- - ('getdir' accidentally defined as an alias of 'dir').
- - (phpinfo(INFO_CREDITS) displays nothing in CLI).
- - (http wrapper silently ignores long Location headers).
- - (HTTP wrapper waits for HTTP 1 response after HTTP 101).
-
-- Zip:
-
- - (ZipArchive::isCompressionMethodSupported does not exist).
-
-
-
-
-
-
-
-Version 8.0.3
-
-- Core:
-
- - (mail(): Headers after Bcc headers may be ignored).
-
-- DOM:
-
- - (DOMChildNode::remove() doesn't work on CharacterData nodes).
-
-- Gettext:
-
- - (bindtextdomain with null dir doesn't return old value).
-
-- MySQLnd:
-
- - (mysqlnd's mysql_clear_password does not transmit null-terminated password).
- - (SegFault when disabling ATTR_EMULATE_PREPARES and MySQL 8.0).
-
-- MySQLi:
-
- - (x() and y() truncating floats to integers).
-
-- Opcache:
-
- - (write_property handler of internal classes is skipped on preloaded JITted code).
- - (opcache doesn't honour pcre.jit option).
- - (Opcache JIT makes some boolean logic unexpectedly be true).
- - (JIT produces Assert failure and UNKNOWN:0 var_dumps in code involving bitshifts).
-
-- OpenSSL:
-
- - (Providing RSA key size < 512 generates key that crash PHP).
-
-- Phar:
-
- - (Unclear error message wrt. __halt_compiler() w/o semicolon)
- - (Phar does not mark UTF-8 filenames in ZIP archives).
- - (Phar cannot compress large archives).
-
-- Socket:
-
- - (Different sockets compare as equal (regression in 8.0)).
-
-- SPL:
-
- - (Iterating after failed ArrayObject::setIteratorClass() causes Segmentation fault).
-
-- Standard:
-
- - (file_get_contents() maxlen fails above (2**31)-1 bytes).
- - (ext/standard/dl.c fallback code path with syntax error).
-
-
-
-
-
-
-
-Version 8.0.2
-
-- Core:
-
- - (bogus parse error on >4GB source code).
- - (filter buffers entire read until file closed).
- - (Invalid union type TypeError in anonymous classes).
- - (GCC throws warning about type narrowing in ZEND_TYPE_INIT_CODE).
-
-- BCMath:
-
- - (bcadd('a', 'a') doesn't throw an exception).
-
-- Curl:
-
- - (Resetting POSTFIELDS to empty array breaks request).
-
-- Date:
-
- - (last day of the month causes runway cpu usage).
-
-- DOM:
-
- - (Wrong parameter type in DOMElement::removeAttributeNode stub).
-
-- Filter:
-
- - (0x and 0X are considered valid hex numbers by filter_var()).
-
-- GMP:
-
- - (Strings containing only a base prefix return 0 object).
-
-- Intl:
-
- - (Missing resource causes subsequent get() calls to fail).
-
-- MySQLi:
-
- - (mysqlnd with MYSQLI_OPT_INT_AND_FLOAT_NATIVE fails to interpret bit columns).
- - (Fetching resultsets from stored procedure with cursor fails).
- - (segfault using prepared statements on stored procedures that use a cursor).
- - (Crash in mysqlnd_fetch_stmt_row_cursor when calling an SP with a cursor).
-
-- ODBC:
-
- - (all floats are the same in ODBC parameters).
-
-- Opcache:
-
- - (php_opcache.dll crashes when using Apache 2.4 with JIT).
-
-- PDO_Firebird:
-
- - (Parameters with underscores no longer recognized).
-
-- Phar:
-
- - (zip-based phar does not respect phar.require_hash).
- - (Incorrect locator detection in ZIP-based phars).
- - (Compressed ZIP Phar extractTo() creates garbage files).
-
-- Phpdbg:
-
- - Reverted fix for bug (Access violation near NULL on source operand).
-
-- SOAP:
-
- - (Null Dereference in SoapClient). (CVE-2021-21702)
-
-
-
-
-
-
-
-Version 8.0.1
-
-- Core:
-
- - (PHPIZE configuration has outdated PHP_RELEASE_VERSION).
- - (White space not unfolded for CC/Bcc headers).
- - (Iterable not covariant to mixed).
- - (Build of PHP extension fails due to configuration gap with libtool).
- - (stream filter loses final block of data).
-
-- Fileinfo:
-
- - (finfo_open crafted magic parsing SIGABRT).
-
-- FPM:
-
- - (FPM returns 200 status on request without SCRIPT_FILENAME env).
-
-- IMAP:
-
- - (imap_msgno() incorrectly warns and return false on valid UIDs in PHP 8).
- - Fix a regression with valid UIDs in imap_savebody().
- - Make warnings for invalid message numbers/UIDs between functions consistent.
-
-- Intl:
-
- - (MessageFormatAdapter::getArgTypeList redefined).
-
-- Opcache:
-
- - (Incorrect range inference result when division results in float).
- - (Opcache misses executor_globals).
- - (Unable to disable the use of the AVX command when using JIT).
- - (Strange out of memory error when running with JIT).
- - (Segmentation fault with JIT enabled).
- - (Immediate SIGSEGV upon ini_set("opcache.jit_debug", 1)).
-
-- OpenSSL:
-
- - (OpenSSL extension fails to build against LibreSSL due to lack of OCB support).
-
-- PDO MySQL:
-
- - (PDOStatement::fetchAll() throws for upsert queries).
- - (nextRowset() ignores MySQL errors with native prepared statements).
- - (PDO::exec() - Bad error handling with multiple commands).
- - (Multiple rowsets not returned unless PDO statement object is unset()).
- - (Unexpected "Cannot execute queries while other unbuffered queries").
- - (Multiple statements in init command triggers unbuffered query error).
- - (PDOStatement cannot be GCed/closeCursor-ed when a PROCEDURE resultset SIGNAL).
- - (Can't execute query with pending result sets).
- - (PDO does not throw an exception when parameter values are missing).
- - (PdoStatement->execute() fails but does not throw an exception).
- - (LOAD DATA INFILE broken).
- - (Executing PDOStatement::fetch() more than once prevents releasing resultset).
- - (PDO re-uses parameter values from earlier calls to execute()).
-
-- Phar:
-
- - (Phar Zip parse crash - mmap fail).
- - (`PharData` says invalid checksum for valid tar).
- - (PharData::addEmptyDir('/') Possible integer overflow).
-
-- Phpdbg:
-
- - (Access violation near NULL on source operand).
-
-- SPL:
-
- - (SplFileObject: fgets after seek returns wrong line).
-
-- Standard:
-
- - (Return Value of zend_fstat() not Checked).
- - (FILTER_VALIDATE_URL accepts URLs with invalid userinfo). (CVE-2020-7071)
-
-- Tidy:
-
- - (ob_tidyhandler is never reset).
-
-- Tokenizer:
-
- - (Nullsafe operator tokenize with TOKEN_PARSE flag fails).
-
-- XML:
-
- - XmlParser opaque object renamed to XMLParser for consistency with other XML objects.
-
-- Zlib:
-
- - (Support for flushing in zlib stream).
-
-
-
-
-
-
-
-
- true]);
+site_header("News Archive - 1998", ["cache" => true, 'force_new' => true]);
?>
News Archive - 1998
diff --git a/archive/1999.php b/archive/1999.php
index dd2e53baf1..d10d680ede 100644
--- a/archive/1999.php
+++ b/archive/1999.php
@@ -2,7 +2,7 @@
$_SERVER['BASE_PAGE'] = 'archive/1999.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 1999", ["cache" => true]);
+site_header("News Archive - 1999", ["cache" => true, 'force_new' => true]);
?>
News Archive - 1999
diff --git a/archive/2000.php b/archive/2000.php
index 90aac82375..261c6a2c81 100644
--- a/archive/2000.php
+++ b/archive/2000.php
@@ -2,7 +2,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2000.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2000", ["cache" => true]);
+site_header("News Archive - 2000", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2000
diff --git a/archive/2001.php b/archive/2001.php
index 7d510dd608..545b64c81a 100644
--- a/archive/2001.php
+++ b/archive/2001.php
@@ -2,7 +2,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2001.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2001", ["cache" => true]);
+site_header("News Archive - 2001", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2001
diff --git a/archive/2002.php b/archive/2002.php
index b3f2da5af2..e98a943da7 100644
--- a/archive/2002.php
+++ b/archive/2002.php
@@ -2,7 +2,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2002.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2002", ["cache" => true]);
+site_header("News Archive - 2002", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2002
diff --git a/archive/2003.php b/archive/2003.php
index 72c0653c87..bcbd8f370c 100644
--- a/archive/2003.php
+++ b/archive/2003.php
@@ -2,7 +2,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2003.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2003", ["cache" => true]);
+site_header("News Archive - 2003", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2003
@@ -165,7 +165,7 @@
list' lookup option and start typing in a function name in the search field.
You can autocomplete the name with the space key and navigate in the dropdown
with the up and down cursor keys. We welcome feedback on this feature at
- the webmasters email address, but
+ the webmasters email address, but
please submit any bugs you find in the
bug system classifying them as a "PHP.net website problem" and providing
as much information as possible (OS, Browser version, Javascript errors, etc..).
diff --git a/archive/2004.php b/archive/2004.php
index 9d65257ec6..b3096bfc79 100644
--- a/archive/2004.php
+++ b/archive/2004.php
@@ -2,7 +2,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2004.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2004", ["cache" => true]);
+site_header("News Archive - 2004", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2004
diff --git a/archive/2005.php b/archive/2005.php
index 1f9f664e3b..2a5d70cb59 100644
--- a/archive/2005.php
+++ b/archive/2005.php
@@ -2,7 +2,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2005.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2005", ["cache" => true]);
+site_header("News Archive - 2005", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2005
diff --git a/archive/2006.php b/archive/2006.php
index 61c43adb63..6aae2c1c56 100644
--- a/archive/2006.php
+++ b/archive/2006.php
@@ -2,7 +2,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2006.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2006", ["cache" => true]);
+site_header("News Archive - 2006", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2006
diff --git a/archive/2007.php b/archive/2007.php
index a6ed7679d5..c618f7aabe 100644
--- a/archive/2007.php
+++ b/archive/2007.php
@@ -2,7 +2,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2007.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2007", ["cache" => true]);
+site_header("News Archive - 2007", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2007
diff --git a/archive/2008.php b/archive/2008.php
index 3d6888aeac..86b8f278ea 100644
--- a/archive/2008.php
+++ b/archive/2008.php
@@ -2,7 +2,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2008.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2008", ["cache" => true]);
+site_header("News Archive - 2008", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2008
diff --git a/archive/2009.php b/archive/2009.php
index bef2fcbeae..a8901edbc3 100644
--- a/archive/2009.php
+++ b/archive/2009.php
@@ -2,7 +2,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2009.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2009", ["cache" => true]);
+site_header("News Archive - 2009", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2009
diff --git a/archive/2010.php b/archive/2010.php
index 25c908af01..6796cff38e 100644
--- a/archive/2010.php
+++ b/archive/2010.php
@@ -2,7 +2,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2010.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2010", ["cache" => true]);
+site_header("News Archive - 2010", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2010
diff --git a/archive/2011.php b/archive/2011.php
index c530488d40..f2796a77a3 100644
--- a/archive/2011.php
+++ b/archive/2011.php
@@ -2,7 +2,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2011.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2011", ["cache" => true]);
+site_header("News Archive - 2011", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2011
diff --git a/archive/2012.php b/archive/2012.php
index db9fb2f61b..123f0befb4 100644
--- a/archive/2012.php
+++ b/archive/2012.php
@@ -2,7 +2,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2012.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2012", ["cache" => true]);
+site_header("News Archive - 2012", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2012
diff --git a/archive/2013.php b/archive/2013.php
index 6a780564e1..00affc8285 100644
--- a/archive/2013.php
+++ b/archive/2013.php
@@ -3,7 +3,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2013.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2013", ["cache" => true]);
+site_header("News Archive - 2013", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2013
diff --git a/archive/2014.php b/archive/2014.php
index cf99a21494..5e8d3d404b 100644
--- a/archive/2014.php
+++ b/archive/2014.php
@@ -3,7 +3,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2014.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2014", ["cache" => true]);
+site_header("News Archive - 2014", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2014
diff --git a/archive/2015.php b/archive/2015.php
index b71a865e4b..8aa740f175 100644
--- a/archive/2015.php
+++ b/archive/2015.php
@@ -5,7 +5,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2015.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2015");
+site_header("News Archive - 2015", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2015
diff --git a/archive/2016.php b/archive/2016.php
index 228f0ea9a2..81e2c1d080 100644
--- a/archive/2016.php
+++ b/archive/2016.php
@@ -5,7 +5,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2016.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2016");
+site_header("News Archive - 2016", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2016
diff --git a/archive/2017.php b/archive/2017.php
index 26e7b5a400..c9f2968078 100644
--- a/archive/2017.php
+++ b/archive/2017.php
@@ -5,7 +5,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2017.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2017");
+site_header("News Archive - 2017", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2017
diff --git a/archive/2018.php b/archive/2018.php
index 1db8020b7b..e46d95e24c 100644
--- a/archive/2018.php
+++ b/archive/2018.php
@@ -5,7 +5,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2018.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2018");
+site_header("News Archive - 2018", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2018
diff --git a/archive/2019.php b/archive/2019.php
index 3538aa2daa..12468cf58e 100644
--- a/archive/2019.php
+++ b/archive/2019.php
@@ -5,7 +5,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2019.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2019");
+site_header("News Archive - 2019", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2019
diff --git a/archive/2020.php b/archive/2020.php
index 5a469f6cc9..a9a7030028 100644
--- a/archive/2020.php
+++ b/archive/2020.php
@@ -5,7 +5,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2020.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2020");
+site_header("News Archive - 2020", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2020
diff --git a/archive/2021.php b/archive/2021.php
index 1191c7585b..cf951d8698 100644
--- a/archive/2021.php
+++ b/archive/2021.php
@@ -5,7 +5,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2021.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2021");
+site_header("News Archive - 2021", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2021
diff --git a/archive/2022.php b/archive/2022.php
index abfcee9354..b8e6a90828 100644
--- a/archive/2022.php
+++ b/archive/2022.php
@@ -5,7 +5,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2022.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2022");
+site_header("News Archive - 2022", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2022
diff --git a/archive/2023.php b/archive/2023.php
index b6ef8abde9..a45996fcf3 100644
--- a/archive/2023.php
+++ b/archive/2023.php
@@ -5,7 +5,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2023.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2023");
+site_header("News Archive - 2023", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2023
diff --git a/archive/2024.php b/archive/2024.php
index 9834117665..45a347e957 100644
--- a/archive/2024.php
+++ b/archive/2024.php
@@ -5,7 +5,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2024.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2024");
+site_header("News Archive - 2024", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2024
diff --git a/archive/2025.php b/archive/2025.php
index 2787ee7d73..00a68cc6a6 100644
--- a/archive/2025.php
+++ b/archive/2025.php
@@ -5,7 +5,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2025.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2025");
+site_header("News Archive - 2025", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2025
diff --git a/archive/2026.php b/archive/2026.php
index 6e91b33ddc..81dd22f71d 100644
--- a/archive/2026.php
+++ b/archive/2026.php
@@ -5,7 +5,7 @@
$_SERVER['BASE_PAGE'] = 'archive/2026.php';
include_once __DIR__ . '/../include/prepend.inc';
news_archive_sidebar();
-site_header("News Archive - 2026");
+site_header("News Archive - 2026", ["cache" => true, 'force_new' => true]);
?>
News Archive - 2026
diff --git a/assets/compiled/.gitignore b/assets/compiled/.gitignore
new file mode 100644
index 0000000000..ebdb620863
--- /dev/null
+++ b/assets/compiled/.gitignore
@@ -0,0 +1,3 @@
+# Everything in this folder is a product of the build step and should not be modified
+!.gitignore
+*
diff --git a/fonts/Fira/LICENSE b/assets/fonts/Fira/LICENSE
similarity index 100%
rename from fonts/Fira/LICENSE
rename to assets/fonts/Fira/LICENSE
diff --git a/fonts/Fira/eot/FiraMono-Bold.eot b/assets/fonts/Fira/eot/FiraMono-Bold.eot
similarity index 100%
rename from fonts/Fira/eot/FiraMono-Bold.eot
rename to assets/fonts/Fira/eot/FiraMono-Bold.eot
diff --git a/fonts/Fira/eot/FiraMono-Regular.eot b/assets/fonts/Fira/eot/FiraMono-Regular.eot
similarity index 100%
rename from fonts/Fira/eot/FiraMono-Regular.eot
rename to assets/fonts/Fira/eot/FiraMono-Regular.eot
diff --git a/fonts/Fira/eot/FiraSans-Bold.eot b/assets/fonts/Fira/eot/FiraSans-Bold.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-Bold.eot
rename to assets/fonts/Fira/eot/FiraSans-Bold.eot
diff --git a/fonts/Fira/eot/FiraSans-BoldItalic.eot b/assets/fonts/Fira/eot/FiraSans-BoldItalic.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-BoldItalic.eot
rename to assets/fonts/Fira/eot/FiraSans-BoldItalic.eot
diff --git a/fonts/Fira/eot/FiraSans-Book.eot b/assets/fonts/Fira/eot/FiraSans-Book.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-Book.eot
rename to assets/fonts/Fira/eot/FiraSans-Book.eot
diff --git a/fonts/Fira/eot/FiraSans-BookItalic.eot b/assets/fonts/Fira/eot/FiraSans-BookItalic.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-BookItalic.eot
rename to assets/fonts/Fira/eot/FiraSans-BookItalic.eot
diff --git a/fonts/Fira/eot/FiraSans-Eight.eot b/assets/fonts/Fira/eot/FiraSans-Eight.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-Eight.eot
rename to assets/fonts/Fira/eot/FiraSans-Eight.eot
diff --git a/fonts/Fira/eot/FiraSans-EightItalic.eot b/assets/fonts/Fira/eot/FiraSans-EightItalic.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-EightItalic.eot
rename to assets/fonts/Fira/eot/FiraSans-EightItalic.eot
diff --git a/fonts/Fira/eot/FiraSans-Four.eot b/assets/fonts/Fira/eot/FiraSans-Four.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-Four.eot
rename to assets/fonts/Fira/eot/FiraSans-Four.eot
diff --git a/fonts/Fira/eot/FiraSans-FourItalic.eot b/assets/fonts/Fira/eot/FiraSans-FourItalic.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-FourItalic.eot
rename to assets/fonts/Fira/eot/FiraSans-FourItalic.eot
diff --git a/fonts/Fira/eot/FiraSans-Hair.eot b/assets/fonts/Fira/eot/FiraSans-Hair.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-Hair.eot
rename to assets/fonts/Fira/eot/FiraSans-Hair.eot
diff --git a/fonts/Fira/eot/FiraSans-HairItalic.eot b/assets/fonts/Fira/eot/FiraSans-HairItalic.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-HairItalic.eot
rename to assets/fonts/Fira/eot/FiraSans-HairItalic.eot
diff --git a/fonts/Fira/eot/FiraSans-Heavy.eot b/assets/fonts/Fira/eot/FiraSans-Heavy.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-Heavy.eot
rename to assets/fonts/Fira/eot/FiraSans-Heavy.eot
diff --git a/fonts/Fira/eot/FiraSans-HeavyItalic.eot b/assets/fonts/Fira/eot/FiraSans-HeavyItalic.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-HeavyItalic.eot
rename to assets/fonts/Fira/eot/FiraSans-HeavyItalic.eot
diff --git a/fonts/Fira/eot/FiraSans-Light.eot b/assets/fonts/Fira/eot/FiraSans-Light.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-Light.eot
rename to assets/fonts/Fira/eot/FiraSans-Light.eot
diff --git a/fonts/Fira/eot/FiraSans-LightItalic.eot b/assets/fonts/Fira/eot/FiraSans-LightItalic.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-LightItalic.eot
rename to assets/fonts/Fira/eot/FiraSans-LightItalic.eot
diff --git a/fonts/Fira/eot/FiraSans-Medium.eot b/assets/fonts/Fira/eot/FiraSans-Medium.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-Medium.eot
rename to assets/fonts/Fira/eot/FiraSans-Medium.eot
diff --git a/fonts/Fira/eot/FiraSans-MediumItalic.eot b/assets/fonts/Fira/eot/FiraSans-MediumItalic.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-MediumItalic.eot
rename to assets/fonts/Fira/eot/FiraSans-MediumItalic.eot
diff --git a/fonts/Fira/eot/FiraSans-Regular.eot b/assets/fonts/Fira/eot/FiraSans-Regular.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-Regular.eot
rename to assets/fonts/Fira/eot/FiraSans-Regular.eot
diff --git a/fonts/Fira/eot/FiraSans-RegularItalic.eot b/assets/fonts/Fira/eot/FiraSans-RegularItalic.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-RegularItalic.eot
rename to assets/fonts/Fira/eot/FiraSans-RegularItalic.eot
diff --git a/fonts/Fira/eot/FiraSans-SemiBold.eot b/assets/fonts/Fira/eot/FiraSans-SemiBold.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-SemiBold.eot
rename to assets/fonts/Fira/eot/FiraSans-SemiBold.eot
diff --git a/fonts/Fira/eot/FiraSans-SemiBoldItalic.eot b/assets/fonts/Fira/eot/FiraSans-SemiBoldItalic.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-SemiBoldItalic.eot
rename to assets/fonts/Fira/eot/FiraSans-SemiBoldItalic.eot
diff --git a/fonts/Fira/eot/FiraSans-Thin.eot b/assets/fonts/Fira/eot/FiraSans-Thin.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-Thin.eot
rename to assets/fonts/Fira/eot/FiraSans-Thin.eot
diff --git a/fonts/Fira/eot/FiraSans-ThinItalic.eot b/assets/fonts/Fira/eot/FiraSans-ThinItalic.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-ThinItalic.eot
rename to assets/fonts/Fira/eot/FiraSans-ThinItalic.eot
diff --git a/fonts/Fira/eot/FiraSans-Two.eot b/assets/fonts/Fira/eot/FiraSans-Two.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-Two.eot
rename to assets/fonts/Fira/eot/FiraSans-Two.eot
diff --git a/fonts/Fira/eot/FiraSans-TwoItalic.eot b/assets/fonts/Fira/eot/FiraSans-TwoItalic.eot
similarity index 100%
rename from fonts/Fira/eot/FiraSans-TwoItalic.eot
rename to assets/fonts/Fira/eot/FiraSans-TwoItalic.eot
diff --git a/assets/fonts/Fira/fira.css b/assets/fonts/Fira/fira.css
new file mode 100644
index 0000000000..c8306ce5a5
--- /dev/null
+++ b/assets/fonts/Fira/fira.css
@@ -0,0 +1,83 @@
+@font-face{
+ font-family: 'Fira Sans';
+ src: url('/assets/fonts/Fira/eot/FiraSans-Book.eot');
+ src: local('Fira Sans Book'),
+ local('FiraSans-Book'),
+ url('/assets/fonts/Fira/woff2/FiraSans-Book.woff2') format('woff2'),
+ url('/assets/fonts/Fira/woff/FiraSans-Book.woff') format('woff'),
+ url('/assets/fonts/Fira/eot/FiraSans-Book.eot') format('embedded-opentype'),
+ url('/assets/fonts/Fira/ttf/FiraSans-Book.ttf') format('truetype');
+ font-weight: 400;
+ font-style: normal;
+ font-display: swap;
+}
+
+@font-face{
+ font-family: 'Fira Sans';
+ src: url('/assets/fonts/Fira/eot/FiraSans-BookItalic.eot');
+ src: local('Fira Sans Book Italic'),
+ local('FiraSans-BookItalic'),
+ url('/assets/fonts/Fira/woff2/FiraSans-BookItalic.woff2') format('woff2'),
+ url('/assets/fonts/Fira/woff/FiraSans-BookItalic.woff') format('woff'),
+ url('/assets/fonts/Fira/eot/FiraSans-BookItalic.eot') format('embedded-opentype'),
+ url('/assets/fonts/Fira/ttf/FiraSans-BookItalic.ttf') format('truetype');
+ font-weight: 400;
+ font-style: italic;
+ font-display: swap;
+}
+
+@font-face{
+ font-family: 'Fira Sans';
+ src: url('/assets/fonts/Fira/eot/FiraSans-Medium.eot');
+ src: local('Fira Sans Medium'),
+ local('FiraSans-Medium'),
+ url('/assets/fonts/Fira/woff2/FiraSans-Medium.woff2') format('woff2'),
+ url('/assets/fonts/Fira/woff/FiraSans-Medium.woff') format('woff'),
+ url('/assets/fonts/Fira/eot/FiraSans-Medium.eot') format('embedded-opentype'),
+ url('/assets/fonts/Fira/ttf/FiraSans-Medium.ttf') format('truetype');
+ font-weight: 500;
+ font-style: normal;
+ font-display: swap;
+}
+
+@font-face{
+ font-family: 'Fira Sans';
+ src: url('/assets/fonts/Fira/eot/FiraSans-MediumItalic.eot');
+ src: local('Fira Sans Medium Italic'),
+ local('FiraSans-MediumItalic'),
+ url('/assets/fonts/Fira/woff2/FiraSans-MediumItalic.woff2') format('woff2'),
+ url('/assets/fonts/Fira/woff/FiraSans-MediumItalic.woff') format('woff'),
+ url('/assets/fonts/Fira/eot/FiraSans-MediumItalic.eot') format('embedded-opentype'),
+ url('/assets/fonts/Fira/ttf/FiraSans-MediumItalic.ttf') format('truetype');
+ font-weight: 500;
+ font-style: italic;
+ font-display: swap;
+}
+
+@font-face{
+ font-family: 'Fira Mono';
+ src: url('/assets/fonts/Fira/eot/FiraMono-Regular.eot');
+ src: local('Fira Mono'),
+ local('FiraMono-Regular'),
+ url('/assets/fonts/Fira/woff2/FiraMono-Regular.woff2') format('woff2'),
+ url('/assets/fonts/Fira/woff/FiraMono-Regular.woff') format('woff'),
+ url('/assets/fonts/Fira/eot/FiraMono-Regular.eot') format('embedded-opentype'),
+ url('/assets/fonts/Fira/ttf/FiraMono-Regular.ttf') format('truetype');
+ font-weight: 400;
+ font-style: normal;
+ font-display: swap;
+}
+
+@font-face{
+ font-family: 'Fira Mono';
+ src: url('/assets/fonts/Fira/eot/FiraMono-Bold.eot');
+ src: local('Fira Mono Bold'),
+ local('FiraMono-Bold'),
+ url('/assets/fonts/Fira/woff2/FiraMono-Bold.woff2') format('woff2'),
+ url('/assets/fonts/Fira/woff/FiraMono-Bold.woff') format('woff'),
+ url('/assets/fonts/Fira/eot/FiraMono-Bold.eot') format('embedded-opentype'),
+ url('/assets/fonts/Fira/ttf/FiraMono-Bold.ttf') format('truetype');
+ font-weight: 700;
+ font-style: normal;
+ font-display: swap;
+}
diff --git a/fonts/Fira/otf/FiraMono-Bold.otf b/assets/fonts/Fira/otf/FiraMono-Bold.otf
similarity index 100%
rename from fonts/Fira/otf/FiraMono-Bold.otf
rename to assets/fonts/Fira/otf/FiraMono-Bold.otf
diff --git a/fonts/Fira/otf/FiraMono-Regular.otf b/assets/fonts/Fira/otf/FiraMono-Regular.otf
similarity index 100%
rename from fonts/Fira/otf/FiraMono-Regular.otf
rename to assets/fonts/Fira/otf/FiraMono-Regular.otf
diff --git a/fonts/Fira/otf/FiraSans-Bold.otf b/assets/fonts/Fira/otf/FiraSans-Bold.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-Bold.otf
rename to assets/fonts/Fira/otf/FiraSans-Bold.otf
diff --git a/fonts/Fira/otf/FiraSans-BoldItalic.otf b/assets/fonts/Fira/otf/FiraSans-BoldItalic.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-BoldItalic.otf
rename to assets/fonts/Fira/otf/FiraSans-BoldItalic.otf
diff --git a/fonts/Fira/otf/FiraSans-Book.otf b/assets/fonts/Fira/otf/FiraSans-Book.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-Book.otf
rename to assets/fonts/Fira/otf/FiraSans-Book.otf
diff --git a/fonts/Fira/otf/FiraSans-BookItalic.otf b/assets/fonts/Fira/otf/FiraSans-BookItalic.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-BookItalic.otf
rename to assets/fonts/Fira/otf/FiraSans-BookItalic.otf
diff --git a/fonts/Fira/otf/FiraSans-Eight.otf b/assets/fonts/Fira/otf/FiraSans-Eight.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-Eight.otf
rename to assets/fonts/Fira/otf/FiraSans-Eight.otf
diff --git a/fonts/Fira/otf/FiraSans-EightItalic.otf b/assets/fonts/Fira/otf/FiraSans-EightItalic.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-EightItalic.otf
rename to assets/fonts/Fira/otf/FiraSans-EightItalic.otf
diff --git a/fonts/Fira/otf/FiraSans-Four.otf b/assets/fonts/Fira/otf/FiraSans-Four.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-Four.otf
rename to assets/fonts/Fira/otf/FiraSans-Four.otf
diff --git a/fonts/Fira/otf/FiraSans-FourItalic.otf b/assets/fonts/Fira/otf/FiraSans-FourItalic.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-FourItalic.otf
rename to assets/fonts/Fira/otf/FiraSans-FourItalic.otf
diff --git a/fonts/Fira/otf/FiraSans-Hair.otf b/assets/fonts/Fira/otf/FiraSans-Hair.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-Hair.otf
rename to assets/fonts/Fira/otf/FiraSans-Hair.otf
diff --git a/fonts/Fira/otf/FiraSans-HairItalic.otf b/assets/fonts/Fira/otf/FiraSans-HairItalic.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-HairItalic.otf
rename to assets/fonts/Fira/otf/FiraSans-HairItalic.otf
diff --git a/fonts/Fira/otf/FiraSans-Heavy.otf b/assets/fonts/Fira/otf/FiraSans-Heavy.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-Heavy.otf
rename to assets/fonts/Fira/otf/FiraSans-Heavy.otf
diff --git a/fonts/Fira/otf/FiraSans-HeavyItalic.otf b/assets/fonts/Fira/otf/FiraSans-HeavyItalic.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-HeavyItalic.otf
rename to assets/fonts/Fira/otf/FiraSans-HeavyItalic.otf
diff --git a/fonts/Fira/otf/FiraSans-Light.otf b/assets/fonts/Fira/otf/FiraSans-Light.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-Light.otf
rename to assets/fonts/Fira/otf/FiraSans-Light.otf
diff --git a/fonts/Fira/otf/FiraSans-LightItalic.otf b/assets/fonts/Fira/otf/FiraSans-LightItalic.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-LightItalic.otf
rename to assets/fonts/Fira/otf/FiraSans-LightItalic.otf
diff --git a/fonts/Fira/otf/FiraSans-Medium.otf b/assets/fonts/Fira/otf/FiraSans-Medium.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-Medium.otf
rename to assets/fonts/Fira/otf/FiraSans-Medium.otf
diff --git a/fonts/Fira/otf/FiraSans-MediumItalic.otf b/assets/fonts/Fira/otf/FiraSans-MediumItalic.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-MediumItalic.otf
rename to assets/fonts/Fira/otf/FiraSans-MediumItalic.otf
diff --git a/fonts/Fira/otf/FiraSans-Regular.otf b/assets/fonts/Fira/otf/FiraSans-Regular.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-Regular.otf
rename to assets/fonts/Fira/otf/FiraSans-Regular.otf
diff --git a/fonts/Fira/otf/FiraSans-RegularItalic.otf b/assets/fonts/Fira/otf/FiraSans-RegularItalic.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-RegularItalic.otf
rename to assets/fonts/Fira/otf/FiraSans-RegularItalic.otf
diff --git a/fonts/Fira/otf/FiraSans-SemiBold.otf b/assets/fonts/Fira/otf/FiraSans-SemiBold.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-SemiBold.otf
rename to assets/fonts/Fira/otf/FiraSans-SemiBold.otf
diff --git a/fonts/Fira/otf/FiraSans-SemiBoldItalic.otf b/assets/fonts/Fira/otf/FiraSans-SemiBoldItalic.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-SemiBoldItalic.otf
rename to assets/fonts/Fira/otf/FiraSans-SemiBoldItalic.otf
diff --git a/fonts/Fira/otf/FiraSans-Thin.otf b/assets/fonts/Fira/otf/FiraSans-Thin.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-Thin.otf
rename to assets/fonts/Fira/otf/FiraSans-Thin.otf
diff --git a/fonts/Fira/otf/FiraSans-ThinItalic.otf b/assets/fonts/Fira/otf/FiraSans-ThinItalic.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-ThinItalic.otf
rename to assets/fonts/Fira/otf/FiraSans-ThinItalic.otf
diff --git a/fonts/Fira/otf/FiraSans-Two.otf b/assets/fonts/Fira/otf/FiraSans-Two.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-Two.otf
rename to assets/fonts/Fira/otf/FiraSans-Two.otf
diff --git a/fonts/Fira/otf/FiraSans-TwoItalic.otf b/assets/fonts/Fira/otf/FiraSans-TwoItalic.otf
similarity index 100%
rename from fonts/Fira/otf/FiraSans-TwoItalic.otf
rename to assets/fonts/Fira/otf/FiraSans-TwoItalic.otf
diff --git a/fonts/Fira/ttf/FiraMono-Bold.ttf b/assets/fonts/Fira/ttf/FiraMono-Bold.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraMono-Bold.ttf
rename to assets/fonts/Fira/ttf/FiraMono-Bold.ttf
diff --git a/fonts/Fira/ttf/FiraMono-Regular.ttf b/assets/fonts/Fira/ttf/FiraMono-Regular.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraMono-Regular.ttf
rename to assets/fonts/Fira/ttf/FiraMono-Regular.ttf
diff --git a/fonts/Fira/ttf/FiraSans-Bold.ttf b/assets/fonts/Fira/ttf/FiraSans-Bold.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-Bold.ttf
rename to assets/fonts/Fira/ttf/FiraSans-Bold.ttf
diff --git a/fonts/Fira/ttf/FiraSans-BoldItalic.ttf b/assets/fonts/Fira/ttf/FiraSans-BoldItalic.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-BoldItalic.ttf
rename to assets/fonts/Fira/ttf/FiraSans-BoldItalic.ttf
diff --git a/fonts/Fira/ttf/FiraSans-Book.ttf b/assets/fonts/Fira/ttf/FiraSans-Book.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-Book.ttf
rename to assets/fonts/Fira/ttf/FiraSans-Book.ttf
diff --git a/fonts/Fira/ttf/FiraSans-BookItalic.ttf b/assets/fonts/Fira/ttf/FiraSans-BookItalic.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-BookItalic.ttf
rename to assets/fonts/Fira/ttf/FiraSans-BookItalic.ttf
diff --git a/fonts/Fira/ttf/FiraSans-Eight.ttf b/assets/fonts/Fira/ttf/FiraSans-Eight.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-Eight.ttf
rename to assets/fonts/Fira/ttf/FiraSans-Eight.ttf
diff --git a/fonts/Fira/ttf/FiraSans-EightItalic.ttf b/assets/fonts/Fira/ttf/FiraSans-EightItalic.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-EightItalic.ttf
rename to assets/fonts/Fira/ttf/FiraSans-EightItalic.ttf
diff --git a/fonts/Fira/ttf/FiraSans-Four.ttf b/assets/fonts/Fira/ttf/FiraSans-Four.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-Four.ttf
rename to assets/fonts/Fira/ttf/FiraSans-Four.ttf
diff --git a/fonts/Fira/ttf/FiraSans-FourItalic.ttf b/assets/fonts/Fira/ttf/FiraSans-FourItalic.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-FourItalic.ttf
rename to assets/fonts/Fira/ttf/FiraSans-FourItalic.ttf
diff --git a/fonts/Fira/ttf/FiraSans-Hair.ttf b/assets/fonts/Fira/ttf/FiraSans-Hair.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-Hair.ttf
rename to assets/fonts/Fira/ttf/FiraSans-Hair.ttf
diff --git a/fonts/Fira/ttf/FiraSans-HairItalic.ttf b/assets/fonts/Fira/ttf/FiraSans-HairItalic.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-HairItalic.ttf
rename to assets/fonts/Fira/ttf/FiraSans-HairItalic.ttf
diff --git a/fonts/Fira/ttf/FiraSans-Heavy.ttf b/assets/fonts/Fira/ttf/FiraSans-Heavy.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-Heavy.ttf
rename to assets/fonts/Fira/ttf/FiraSans-Heavy.ttf
diff --git a/fonts/Fira/ttf/FiraSans-HeavyItalic.ttf b/assets/fonts/Fira/ttf/FiraSans-HeavyItalic.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-HeavyItalic.ttf
rename to assets/fonts/Fira/ttf/FiraSans-HeavyItalic.ttf
diff --git a/fonts/Fira/ttf/FiraSans-Light.ttf b/assets/fonts/Fira/ttf/FiraSans-Light.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-Light.ttf
rename to assets/fonts/Fira/ttf/FiraSans-Light.ttf
diff --git a/fonts/Fira/ttf/FiraSans-LightItalic.ttf b/assets/fonts/Fira/ttf/FiraSans-LightItalic.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-LightItalic.ttf
rename to assets/fonts/Fira/ttf/FiraSans-LightItalic.ttf
diff --git a/fonts/Fira/ttf/FiraSans-Medium.ttf b/assets/fonts/Fira/ttf/FiraSans-Medium.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-Medium.ttf
rename to assets/fonts/Fira/ttf/FiraSans-Medium.ttf
diff --git a/fonts/Fira/ttf/FiraSans-MediumItalic.ttf b/assets/fonts/Fira/ttf/FiraSans-MediumItalic.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-MediumItalic.ttf
rename to assets/fonts/Fira/ttf/FiraSans-MediumItalic.ttf
diff --git a/fonts/Fira/ttf/FiraSans-Regular.ttf b/assets/fonts/Fira/ttf/FiraSans-Regular.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-Regular.ttf
rename to assets/fonts/Fira/ttf/FiraSans-Regular.ttf
diff --git a/fonts/Fira/ttf/FiraSans-RegularItalic.ttf b/assets/fonts/Fira/ttf/FiraSans-RegularItalic.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-RegularItalic.ttf
rename to assets/fonts/Fira/ttf/FiraSans-RegularItalic.ttf
diff --git a/fonts/Fira/ttf/FiraSans-SemiBold.ttf b/assets/fonts/Fira/ttf/FiraSans-SemiBold.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-SemiBold.ttf
rename to assets/fonts/Fira/ttf/FiraSans-SemiBold.ttf
diff --git a/fonts/Fira/ttf/FiraSans-SemiBoldItalic.ttf b/assets/fonts/Fira/ttf/FiraSans-SemiBoldItalic.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-SemiBoldItalic.ttf
rename to assets/fonts/Fira/ttf/FiraSans-SemiBoldItalic.ttf
diff --git a/fonts/Fira/ttf/FiraSans-Thin.ttf b/assets/fonts/Fira/ttf/FiraSans-Thin.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-Thin.ttf
rename to assets/fonts/Fira/ttf/FiraSans-Thin.ttf
diff --git a/fonts/Fira/ttf/FiraSans-ThinItalic.ttf b/assets/fonts/Fira/ttf/FiraSans-ThinItalic.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-ThinItalic.ttf
rename to assets/fonts/Fira/ttf/FiraSans-ThinItalic.ttf
diff --git a/fonts/Fira/ttf/FiraSans-Two.ttf b/assets/fonts/Fira/ttf/FiraSans-Two.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-Two.ttf
rename to assets/fonts/Fira/ttf/FiraSans-Two.ttf
diff --git a/fonts/Fira/ttf/FiraSans-TwoItalic.ttf b/assets/fonts/Fira/ttf/FiraSans-TwoItalic.ttf
similarity index 100%
rename from fonts/Fira/ttf/FiraSans-TwoItalic.ttf
rename to assets/fonts/Fira/ttf/FiraSans-TwoItalic.ttf
diff --git a/fonts/Fira/woff/FiraMono-Bold.woff b/assets/fonts/Fira/woff/FiraMono-Bold.woff
similarity index 100%
rename from fonts/Fira/woff/FiraMono-Bold.woff
rename to assets/fonts/Fira/woff/FiraMono-Bold.woff
diff --git a/fonts/Fira/woff/FiraMono-Regular.woff b/assets/fonts/Fira/woff/FiraMono-Regular.woff
similarity index 100%
rename from fonts/Fira/woff/FiraMono-Regular.woff
rename to assets/fonts/Fira/woff/FiraMono-Regular.woff
diff --git a/fonts/Fira/woff/FiraSans-Bold.woff b/assets/fonts/Fira/woff/FiraSans-Bold.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-Bold.woff
rename to assets/fonts/Fira/woff/FiraSans-Bold.woff
diff --git a/fonts/Fira/woff/FiraSans-BoldItalic.woff b/assets/fonts/Fira/woff/FiraSans-BoldItalic.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-BoldItalic.woff
rename to assets/fonts/Fira/woff/FiraSans-BoldItalic.woff
diff --git a/fonts/Fira/woff/FiraSans-Book.woff b/assets/fonts/Fira/woff/FiraSans-Book.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-Book.woff
rename to assets/fonts/Fira/woff/FiraSans-Book.woff
diff --git a/fonts/Fira/woff/FiraSans-BookItalic.woff b/assets/fonts/Fira/woff/FiraSans-BookItalic.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-BookItalic.woff
rename to assets/fonts/Fira/woff/FiraSans-BookItalic.woff
diff --git a/fonts/Fira/woff/FiraSans-Eight.woff b/assets/fonts/Fira/woff/FiraSans-Eight.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-Eight.woff
rename to assets/fonts/Fira/woff/FiraSans-Eight.woff
diff --git a/fonts/Fira/woff/FiraSans-EightItalic.woff b/assets/fonts/Fira/woff/FiraSans-EightItalic.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-EightItalic.woff
rename to assets/fonts/Fira/woff/FiraSans-EightItalic.woff
diff --git a/fonts/Fira/woff/FiraSans-Four.woff b/assets/fonts/Fira/woff/FiraSans-Four.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-Four.woff
rename to assets/fonts/Fira/woff/FiraSans-Four.woff
diff --git a/fonts/Fira/woff/FiraSans-FourItalic.woff b/assets/fonts/Fira/woff/FiraSans-FourItalic.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-FourItalic.woff
rename to assets/fonts/Fira/woff/FiraSans-FourItalic.woff
diff --git a/fonts/Fira/woff/FiraSans-Hair.woff b/assets/fonts/Fira/woff/FiraSans-Hair.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-Hair.woff
rename to assets/fonts/Fira/woff/FiraSans-Hair.woff
diff --git a/fonts/Fira/woff/FiraSans-HairItalic.woff b/assets/fonts/Fira/woff/FiraSans-HairItalic.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-HairItalic.woff
rename to assets/fonts/Fira/woff/FiraSans-HairItalic.woff
diff --git a/fonts/Fira/woff/FiraSans-Heavy.woff b/assets/fonts/Fira/woff/FiraSans-Heavy.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-Heavy.woff
rename to assets/fonts/Fira/woff/FiraSans-Heavy.woff
diff --git a/fonts/Fira/woff/FiraSans-HeavyItalic.woff b/assets/fonts/Fira/woff/FiraSans-HeavyItalic.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-HeavyItalic.woff
rename to assets/fonts/Fira/woff/FiraSans-HeavyItalic.woff
diff --git a/fonts/Fira/woff/FiraSans-Light.woff b/assets/fonts/Fira/woff/FiraSans-Light.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-Light.woff
rename to assets/fonts/Fira/woff/FiraSans-Light.woff
diff --git a/fonts/Fira/woff/FiraSans-LightItalic.woff b/assets/fonts/Fira/woff/FiraSans-LightItalic.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-LightItalic.woff
rename to assets/fonts/Fira/woff/FiraSans-LightItalic.woff
diff --git a/fonts/Fira/woff/FiraSans-Medium.woff b/assets/fonts/Fira/woff/FiraSans-Medium.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-Medium.woff
rename to assets/fonts/Fira/woff/FiraSans-Medium.woff
diff --git a/fonts/Fira/woff/FiraSans-MediumItalic.woff b/assets/fonts/Fira/woff/FiraSans-MediumItalic.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-MediumItalic.woff
rename to assets/fonts/Fira/woff/FiraSans-MediumItalic.woff
diff --git a/fonts/Fira/woff/FiraSans-Regular.woff b/assets/fonts/Fira/woff/FiraSans-Regular.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-Regular.woff
rename to assets/fonts/Fira/woff/FiraSans-Regular.woff
diff --git a/fonts/Fira/woff/FiraSans-RegularItalic.woff b/assets/fonts/Fira/woff/FiraSans-RegularItalic.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-RegularItalic.woff
rename to assets/fonts/Fira/woff/FiraSans-RegularItalic.woff
diff --git a/fonts/Fira/woff/FiraSans-SemiBold.woff b/assets/fonts/Fira/woff/FiraSans-SemiBold.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-SemiBold.woff
rename to assets/fonts/Fira/woff/FiraSans-SemiBold.woff
diff --git a/fonts/Fira/woff/FiraSans-SemiBoldItalic.woff b/assets/fonts/Fira/woff/FiraSans-SemiBoldItalic.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-SemiBoldItalic.woff
rename to assets/fonts/Fira/woff/FiraSans-SemiBoldItalic.woff
diff --git a/fonts/Fira/woff/FiraSans-Thin.woff b/assets/fonts/Fira/woff/FiraSans-Thin.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-Thin.woff
rename to assets/fonts/Fira/woff/FiraSans-Thin.woff
diff --git a/fonts/Fira/woff/FiraSans-ThinItalic.woff b/assets/fonts/Fira/woff/FiraSans-ThinItalic.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-ThinItalic.woff
rename to assets/fonts/Fira/woff/FiraSans-ThinItalic.woff
diff --git a/fonts/Fira/woff/FiraSans-Two.woff b/assets/fonts/Fira/woff/FiraSans-Two.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-Two.woff
rename to assets/fonts/Fira/woff/FiraSans-Two.woff
diff --git a/fonts/Fira/woff/FiraSans-TwoItalic.woff b/assets/fonts/Fira/woff/FiraSans-TwoItalic.woff
similarity index 100%
rename from fonts/Fira/woff/FiraSans-TwoItalic.woff
rename to assets/fonts/Fira/woff/FiraSans-TwoItalic.woff
diff --git a/fonts/Fira/woff2/FiraMono-Bold.woff2 b/assets/fonts/Fira/woff2/FiraMono-Bold.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraMono-Bold.woff2
rename to assets/fonts/Fira/woff2/FiraMono-Bold.woff2
diff --git a/fonts/Fira/woff2/FiraMono-Regular.woff2 b/assets/fonts/Fira/woff2/FiraMono-Regular.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraMono-Regular.woff2
rename to assets/fonts/Fira/woff2/FiraMono-Regular.woff2
diff --git a/fonts/Fira/woff2/FiraSans-Bold.woff2 b/assets/fonts/Fira/woff2/FiraSans-Bold.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-Bold.woff2
rename to assets/fonts/Fira/woff2/FiraSans-Bold.woff2
diff --git a/fonts/Fira/woff2/FiraSans-BoldItalic.woff2 b/assets/fonts/Fira/woff2/FiraSans-BoldItalic.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-BoldItalic.woff2
rename to assets/fonts/Fira/woff2/FiraSans-BoldItalic.woff2
diff --git a/fonts/Fira/woff2/FiraSans-Book.woff2 b/assets/fonts/Fira/woff2/FiraSans-Book.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-Book.woff2
rename to assets/fonts/Fira/woff2/FiraSans-Book.woff2
diff --git a/fonts/Fira/woff2/FiraSans-BookItalic.woff2 b/assets/fonts/Fira/woff2/FiraSans-BookItalic.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-BookItalic.woff2
rename to assets/fonts/Fira/woff2/FiraSans-BookItalic.woff2
diff --git a/fonts/Fira/woff2/FiraSans-Eight.woff2 b/assets/fonts/Fira/woff2/FiraSans-Eight.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-Eight.woff2
rename to assets/fonts/Fira/woff2/FiraSans-Eight.woff2
diff --git a/fonts/Fira/woff2/FiraSans-EightItalic.woff2 b/assets/fonts/Fira/woff2/FiraSans-EightItalic.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-EightItalic.woff2
rename to assets/fonts/Fira/woff2/FiraSans-EightItalic.woff2
diff --git a/fonts/Fira/woff2/FiraSans-Four.woff2 b/assets/fonts/Fira/woff2/FiraSans-Four.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-Four.woff2
rename to assets/fonts/Fira/woff2/FiraSans-Four.woff2
diff --git a/fonts/Fira/woff2/FiraSans-FourItalic.woff2 b/assets/fonts/Fira/woff2/FiraSans-FourItalic.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-FourItalic.woff2
rename to assets/fonts/Fira/woff2/FiraSans-FourItalic.woff2
diff --git a/fonts/Fira/woff2/FiraSans-Hair.woff2 b/assets/fonts/Fira/woff2/FiraSans-Hair.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-Hair.woff2
rename to assets/fonts/Fira/woff2/FiraSans-Hair.woff2
diff --git a/fonts/Fira/woff2/FiraSans-HairItalic.woff2 b/assets/fonts/Fira/woff2/FiraSans-HairItalic.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-HairItalic.woff2
rename to assets/fonts/Fira/woff2/FiraSans-HairItalic.woff2
diff --git a/fonts/Fira/woff2/FiraSans-Heavy.woff2 b/assets/fonts/Fira/woff2/FiraSans-Heavy.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-Heavy.woff2
rename to assets/fonts/Fira/woff2/FiraSans-Heavy.woff2
diff --git a/fonts/Fira/woff2/FiraSans-HeavyItalic.woff2 b/assets/fonts/Fira/woff2/FiraSans-HeavyItalic.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-HeavyItalic.woff2
rename to assets/fonts/Fira/woff2/FiraSans-HeavyItalic.woff2
diff --git a/fonts/Fira/woff2/FiraSans-Light.woff2 b/assets/fonts/Fira/woff2/FiraSans-Light.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-Light.woff2
rename to assets/fonts/Fira/woff2/FiraSans-Light.woff2
diff --git a/fonts/Fira/woff2/FiraSans-LightItalic.woff2 b/assets/fonts/Fira/woff2/FiraSans-LightItalic.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-LightItalic.woff2
rename to assets/fonts/Fira/woff2/FiraSans-LightItalic.woff2
diff --git a/fonts/Fira/woff2/FiraSans-Medium.woff2 b/assets/fonts/Fira/woff2/FiraSans-Medium.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-Medium.woff2
rename to assets/fonts/Fira/woff2/FiraSans-Medium.woff2
diff --git a/fonts/Fira/woff2/FiraSans-MediumItalic.woff2 b/assets/fonts/Fira/woff2/FiraSans-MediumItalic.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-MediumItalic.woff2
rename to assets/fonts/Fira/woff2/FiraSans-MediumItalic.woff2
diff --git a/fonts/Fira/woff2/FiraSans-Regular.woff2 b/assets/fonts/Fira/woff2/FiraSans-Regular.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-Regular.woff2
rename to assets/fonts/Fira/woff2/FiraSans-Regular.woff2
diff --git a/fonts/Fira/woff2/FiraSans-RegularItalic.woff2 b/assets/fonts/Fira/woff2/FiraSans-RegularItalic.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-RegularItalic.woff2
rename to assets/fonts/Fira/woff2/FiraSans-RegularItalic.woff2
diff --git a/fonts/Fira/woff2/FiraSans-SemiBold.woff2 b/assets/fonts/Fira/woff2/FiraSans-SemiBold.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-SemiBold.woff2
rename to assets/fonts/Fira/woff2/FiraSans-SemiBold.woff2
diff --git a/fonts/Fira/woff2/FiraSans-SemiBoldItalic.woff2 b/assets/fonts/Fira/woff2/FiraSans-SemiBoldItalic.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-SemiBoldItalic.woff2
rename to assets/fonts/Fira/woff2/FiraSans-SemiBoldItalic.woff2
diff --git a/fonts/Fira/woff2/FiraSans-Thin.woff2 b/assets/fonts/Fira/woff2/FiraSans-Thin.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-Thin.woff2
rename to assets/fonts/Fira/woff2/FiraSans-Thin.woff2
diff --git a/fonts/Fira/woff2/FiraSans-ThinItalic.woff2 b/assets/fonts/Fira/woff2/FiraSans-ThinItalic.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-ThinItalic.woff2
rename to assets/fonts/Fira/woff2/FiraSans-ThinItalic.woff2
diff --git a/fonts/Fira/woff2/FiraSans-Two.woff2 b/assets/fonts/Fira/woff2/FiraSans-Two.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-Two.woff2
rename to assets/fonts/Fira/woff2/FiraSans-Two.woff2
diff --git a/fonts/Fira/woff2/FiraSans-TwoItalic.woff2 b/assets/fonts/Fira/woff2/FiraSans-TwoItalic.woff2
similarity index 100%
rename from fonts/Fira/woff2/FiraSans-TwoItalic.woff2
rename to assets/fonts/Fira/woff2/FiraSans-TwoItalic.woff2
diff --git a/fonts/Font-Awesome/LICENSE.txt b/assets/fonts/Font-Awesome/LICENSE.txt
similarity index 100%
rename from fonts/Font-Awesome/LICENSE.txt
rename to assets/fonts/Font-Awesome/LICENSE.txt
diff --git a/fonts/Font-Awesome/README.txt b/assets/fonts/Font-Awesome/README.txt
similarity index 100%
rename from fonts/Font-Awesome/README.txt
rename to assets/fonts/Font-Awesome/README.txt
diff --git a/fonts/Font-Awesome/config.json b/assets/fonts/Font-Awesome/config.json
similarity index 100%
rename from fonts/Font-Awesome/config.json
rename to assets/fonts/Font-Awesome/config.json
diff --git a/fonts/Font-Awesome/css/animation.css b/assets/fonts/Font-Awesome/css/animation.css
similarity index 100%
rename from fonts/Font-Awesome/css/animation.css
rename to assets/fonts/Font-Awesome/css/animation.css
diff --git a/fonts/Font-Awesome/css/fontello-codes.css b/assets/fonts/Font-Awesome/css/fontello-codes.css
similarity index 100%
rename from fonts/Font-Awesome/css/fontello-codes.css
rename to assets/fonts/Font-Awesome/css/fontello-codes.css
diff --git a/fonts/Font-Awesome/css/fontello-embedded.css b/assets/fonts/Font-Awesome/css/fontello-embedded.css
similarity index 100%
rename from fonts/Font-Awesome/css/fontello-embedded.css
rename to assets/fonts/Font-Awesome/css/fontello-embedded.css
diff --git a/fonts/Font-Awesome/css/fontello-ie7-codes.css b/assets/fonts/Font-Awesome/css/fontello-ie7-codes.css
similarity index 100%
rename from fonts/Font-Awesome/css/fontello-ie7-codes.css
rename to assets/fonts/Font-Awesome/css/fontello-ie7-codes.css
diff --git a/fonts/Font-Awesome/css/fontello-ie7.css b/assets/fonts/Font-Awesome/css/fontello-ie7.css
similarity index 100%
rename from fonts/Font-Awesome/css/fontello-ie7.css
rename to assets/fonts/Font-Awesome/css/fontello-ie7.css
diff --git a/assets/fonts/Font-Awesome/css/fontello.css b/assets/fonts/Font-Awesome/css/fontello.css
new file mode 100644
index 0000000000..5c19e535ca
--- /dev/null
+++ b/assets/fonts/Font-Awesome/css/fontello.css
@@ -0,0 +1,59 @@
+@font-face {
+ font-family: 'fontello';
+ src: url('/assets/fonts/Font-Awesome/font/fontello.eot?96103027');
+ src: url('/assets/fonts/Font-Awesome/font/fontello.eot?96103027#iefix') format('embedded-opentype'),
+ url('/assets/fonts/Font-Awesome/font/fontello.woff2?96103027') format('woff2'),
+ url('/assets/fonts/Font-Awesome/font/fontello.woff?96103027') format('woff'),
+ url('/assets/fonts/Font-Awesome/font/fontello.ttf?96103027') format('truetype'),
+ url('/assets/fonts/Font-Awesome/font/fontello.svg?96103027#fontello') format('svg');
+ font-weight: normal;
+ font-style: normal;
+}
+/* Chrome hack: SVG is rendered more smooth in Windozze. 100% magic, uncomment if you need it. */
+/* Note, that will break hinting! In other OS-es font will be not as sharp as it could be */
+/*
+@media screen and (-webkit-min-device-pixel-ratio:0) {
+ @font-face {
+ font-family: 'fontello';
+ src: url('../font/fontello.svg?96103027#fontello') format('svg');
+ }
+}
+*/
+[class^="icon-"]:before, [class*=" icon-"]:before {
+ font-family: "fontello";
+ font-style: normal;
+ font-weight: normal;
+ speak: never;
+
+ display: inline-block;
+ text-decoration: inherit;
+ width: 1em;
+ margin-right: .2em;
+ text-align: center;
+ /* opacity: .8; */
+
+ /* For safety - reset parent styles, that can break glyph codes*/
+ font-variant: normal;
+ text-transform: none;
+
+ /* fix buttons height, for twitter bootstrap */
+ line-height: 1em;
+
+ /* Animation center compensation - margins should be symmetric */
+ /* remove if not needed */
+ margin-left: .2em;
+
+ /* you can be more comfortable with increased icons size */
+ /* font-size: 120%; */
+
+ /* Font smoothing. That was taken from TWBS */
+ -webkit-font-smoothing: antialiased;
+ -moz-osx-font-smoothing: grayscale;
+
+ /* Uncomment for 3D effect */
+ /* text-shadow: 1px 1px 1px rgba(127, 127, 127, 0.3); */
+}
+
+.icon-x-twitter:before { content: '\e800'; } /* '' */
+.icon-mastodon:before { content: '\e801'; } /* '' */
+.icon-linkedin:before { content: '\f0e1'; } /* '' */
diff --git a/fonts/Font-Awesome/font/fontello.eot b/assets/fonts/Font-Awesome/font/fontello.eot
similarity index 100%
rename from fonts/Font-Awesome/font/fontello.eot
rename to assets/fonts/Font-Awesome/font/fontello.eot
diff --git a/fonts/Font-Awesome/font/fontello.svg b/assets/fonts/Font-Awesome/font/fontello.svg
similarity index 100%
rename from fonts/Font-Awesome/font/fontello.svg
rename to assets/fonts/Font-Awesome/font/fontello.svg
diff --git a/fonts/Font-Awesome/font/fontello.ttf b/assets/fonts/Font-Awesome/font/fontello.ttf
similarity index 100%
rename from fonts/Font-Awesome/font/fontello.ttf
rename to assets/fonts/Font-Awesome/font/fontello.ttf
diff --git a/fonts/Font-Awesome/font/fontello.woff b/assets/fonts/Font-Awesome/font/fontello.woff
similarity index 100%
rename from fonts/Font-Awesome/font/fontello.woff
rename to assets/fonts/Font-Awesome/font/fontello.woff
diff --git a/fonts/Font-Awesome/font/fontello.woff2 b/assets/fonts/Font-Awesome/font/fontello.woff2
similarity index 100%
rename from fonts/Font-Awesome/font/fontello.woff2
rename to assets/fonts/Font-Awesome/font/fontello.woff2
diff --git a/js/common.js b/assets/js/common.js
similarity index 98%
rename from js/common.js
rename to assets/js/common.js
index 86b4862fd5..33c9925b9f 100644
--- a/js/common.js
+++ b/assets/js/common.js
@@ -879,3 +879,23 @@ function applyTheme(theme) {
}
applyTheme(savedTheme)
+
+function shuffleImmutableArray(array) {
+ const newArray = [...array];
+ for (let i = newArray.length - 1; i > 0; i--) {
+ const j = Math.floor(Math.random() * (i + 1));
+ [newArray[i], newArray[j]] = [newArray[j], newArray[i]];
+ }
+ return newArray;
+}
+
+function shuffleDOMChildrenWithLimit(parent, limit) {
+ const children = Array.from(parent.children);
+ const replacements = shuffleImmutableArray(children).slice(0, limit);
+
+ while (parent.children.length) {
+ parent.removeChild(parent.children[0]);
+ }
+
+ replacements.forEach(n => parent.appendChild(n));
+}
diff --git a/js/ext/FuzzySearch.min.js b/assets/js/ext/FuzzySearch.min.js
similarity index 100%
rename from js/ext/FuzzySearch.min.js
rename to assets/js/ext/FuzzySearch.min.js
diff --git a/js/ext/jquery-3.6.0.min.js b/assets/js/ext/jquery-3.6.0.min.js
similarity index 100%
rename from js/ext/jquery-3.6.0.min.js
rename to assets/js/ext/jquery-3.6.0.min.js
diff --git a/js/ext/jquery.scrollTo.min.js b/assets/js/ext/jquery.scrollTo.min.js
similarity index 100%
rename from js/ext/jquery.scrollTo.min.js
rename to assets/js/ext/jquery.scrollTo.min.js
diff --git a/js/ext/mousetrap.min.js b/assets/js/ext/mousetrap.min.js
similarity index 100%
rename from js/ext/mousetrap.min.js
rename to assets/js/ext/mousetrap.min.js
diff --git a/js/ext/prism.js b/assets/js/ext/prism.js
similarity index 100%
rename from js/ext/prism.js
rename to assets/js/ext/prism.js
diff --git a/js/interactive-examples.js b/assets/js/interactive-examples.js
similarity index 98%
rename from js/interactive-examples.js
rename to assets/js/interactive-examples.js
index eb296c94df..bc44611ad7 100644
--- a/js/interactive-examples.js
+++ b/assets/js/interactive-examples.js
@@ -1,4 +1,4 @@
-import phpBinary from "/js/php-web.mjs";
+import phpBinary from "/assets/js/php-web.mjs";
function generateExampleOutputTitle(phpVersion) {
return "Output of the above example in PHP "+ phpVersion +":";
diff --git a/assets/js/landing.js b/assets/js/landing.js
new file mode 100644
index 0000000000..a50b4f7d8e
--- /dev/null
+++ b/assets/js/landing.js
@@ -0,0 +1,85 @@
+function initInfiniteScroll(parentContainer, speed = 50, setupArgs = {}) {
+ if (!parentContainer) return null;
+
+ // 1. Extract the fixed width from the data-width attribute
+ const dataWidth = parentContainer.dataset.width;
+ if (!dataWidth) {
+ console.error("InfiniteScroll Error: Missing 'data-width' attribute on the container.");
+ return null;
+ }
+
+ const widthNum = parseInt(dataWidth, 10);
+ const widthStr = `${widthNum}px`;
+
+ // 2. Gather the existing child elements currently inside the parent
+ const elements = Array.from(parentContainer.children);
+ if (elements.length === 0) return null;
+
+ // 3. Prepare the parent container styling
+ parentContainer.style.overflow = 'hidden';
+ parentContainer.style.position = 'relative';
+ parentContainer.style.width = '100%';
+
+ // 4. Create the scrolling track
+ const track = document.createElement('div');
+ track.style.display = 'flex';
+ track.style.width = 'max-content';
+ track.style.willChange = 'transform';
+
+ // 5. Apply widths and move existing elements into the track
+ elements.forEach(el => {
+ el.style.width = widthStr;
+ el.style.flexShrink = '0';
+ track.appendChild(el); // Automatically removes it from parentContainer and places it in track
+ });
+
+ // 6. Append the track to the parent container
+ parentContainer.appendChild(track);
+
+ // 7. Clone elements to ensure a seamless loop with no blank gaps
+ const parentWidth = parentContainer.offsetWidth || window.innerWidth;
+ const originalTotalWidth = elements.length * widthNum;
+
+ let currentTrackWidth = originalTotalWidth;
+ while (currentTrackWidth < parentWidth + originalTotalWidth) {
+ elements.forEach(el => {
+ const clone = el.cloneNode(true);
+ clone.style.width = widthStr;
+ clone.style.flexShrink = '0';
+ track.appendChild(clone);
+ });
+ currentTrackWidth += originalTotalWidth;
+ }
+
+ // 8. Generate a unique CSS keyframe animation dynamically
+ const animationName = `infiniteScroll_${Math.random().toString(36).substr(2, 9)}`;
+ const styleNode = document.createElement('style');
+ styleNode.textContent = `
+ @keyframes ${animationName} {
+ 0% { transform: translateX(0); }
+ 100% { transform: translateX(-${originalTotalWidth}px); }
+ }
+ `;
+ document.head.appendChild(styleNode);
+
+ // 9. Apply the animation (speed is pixels per second)
+ const duration = originalTotalWidth / speed;
+ track.style.animation = `${animationName} ${duration}s linear infinite`;
+
+ // 10. Return playback and cleanup controls
+ const tools = {
+ pause: () => track.style.animationPlayState = 'paused',
+ play: () => track.style.animationPlayState = 'running',
+ destroy: () => {
+ // Puts original elements back and cleans up the DOM
+ elements.forEach(el => parentContainer.appendChild(el));
+ track.remove();
+ styleNode.remove();
+ }
+ };
+
+ parentContainer.addEventListener('mouseenter', () => tools.pause());
+ parentContainer.addEventListener('mouseleave', () => tools.play());
+
+ return tools;
+}
diff --git a/js/php-web-README.md b/assets/js/php-web-README.md
similarity index 100%
rename from js/php-web-README.md
rename to assets/js/php-web-README.md
diff --git a/js/php-web.mjs b/assets/js/php-web.mjs
similarity index 100%
rename from js/php-web.mjs
rename to assets/js/php-web.mjs
diff --git a/js/php-web.wasm b/assets/js/php-web.wasm
similarity index 100%
rename from js/php-web.wasm
rename to assets/js/php-web.wasm
diff --git a/assets/js/sandbox.js b/assets/js/sandbox.js
new file mode 100644
index 0000000000..5c9768426a
--- /dev/null
+++ b/assets/js/sandbox.js
@@ -0,0 +1,41 @@
+import phpBinary from "./php-web.mjs";
+
+export class PHPSandbox {
+ constructor(templateFiles) {
+ this.templateFiles = templateFiles;
+ }
+
+ async execute(files) {
+ let buffer = [];
+ let initializing = true;
+
+ files = {...files, ...this.templateFiles};
+
+ const php = await phpBinary({
+ print(data) {
+ if (initializing) {
+ return;
+ }
+
+ console.log('output', data);
+
+ buffer.push(data);
+ }
+ });
+
+ for (const [filename, content] of Object.entries(files)) {
+ const dir = filename.substring(0, filename.lastIndexOf('/'));
+ if (dir) {
+ php.FS_createPath('/', dir, true, true);
+ }
+
+ php.FS.writeFile('/' + filename, content);
+ }
+
+ initializing = false;
+ php.ccall("phpw_run", null, ["string"], ['require "boot.php";']);
+
+ return JSON.parse(buffer.join(""));
+ }
+}
+
diff --git a/js/search-index.php b/assets/js/search-index.php
similarity index 92%
rename from js/search-index.php
rename to assets/js/search-index.php
index cfee19d506..ca137cb94a 100644
--- a/js/search-index.php
+++ b/assets/js/search-index.php
@@ -4,7 +4,7 @@
$lang = $_GET["lang"] ?? "en";
if (empty($_SERVER["DOCUMENT_ROOT"])) {
- $_SERVER["DOCUMENT_ROOT"] = __DIR__ . "/../";
+ $_SERVER["DOCUMENT_ROOT"] = __DIR__ . "/web-php/";
}
include __DIR__ . '/../include/prepend.inc';
if (!isset(Languages::ACTIVE_ONLINE_LANGUAGES[$lang])) {
diff --git a/js/search.js b/assets/js/search.js
similarity index 100%
rename from js/search.js
rename to assets/js/search.js
diff --git a/js/usernotes.js b/assets/js/usernotes.js
similarity index 100%
rename from js/usernotes.js
rename to assets/js/usernotes.js
diff --git a/styles/add-note.css b/assets/styles/add-note.css
similarity index 100%
rename from styles/add-note.css
rename to assets/styles/add-note.css
diff --git a/styles/calendar.css b/assets/styles/calendar.css
similarity index 100%
rename from styles/calendar.css
rename to assets/styles/calendar.css
diff --git a/styles/changelog.css b/assets/styles/changelog.css
similarity index 100%
rename from styles/changelog.css
rename to assets/styles/changelog.css
diff --git a/styles/code-syntax.css b/assets/styles/code-syntax.css
similarity index 99%
rename from styles/code-syntax.css
rename to assets/styles/code-syntax.css
index 02f927911e..c2c41b6904 100644
--- a/styles/code-syntax.css
+++ b/assets/styles/code-syntax.css
@@ -24,6 +24,7 @@ div.code-toolbar > .toolbar {
.code-toolbar {
box-shadow: 0 0 0 1px rgba(0, 0, 0, .15);
+ color: black;
}
.toolbar-item {
diff --git a/styles/credits.css b/assets/styles/credits.css
similarity index 100%
rename from styles/credits.css
rename to assets/styles/credits.css
diff --git a/styles/cse-search.css b/assets/styles/cse-search.css
similarity index 100%
rename from styles/cse-search.css
rename to assets/styles/cse-search.css
diff --git a/styles/home.css b/assets/styles/home.css
similarity index 100%
rename from styles/home.css
rename to assets/styles/home.css
diff --git a/styles/i-love-markdown.css b/assets/styles/i-love-markdown.css
similarity index 100%
rename from styles/i-love-markdown.css
rename to assets/styles/i-love-markdown.css
diff --git a/styles/index.php b/assets/styles/index.php
similarity index 100%
rename from styles/index.php
rename to assets/styles/index.php
diff --git a/assets/styles/landing.css b/assets/styles/landing.css
new file mode 100644
index 0000000000..241f8467c5
--- /dev/null
+++ b/assets/styles/landing.css
@@ -0,0 +1,326 @@
+
+/*
+ * HEADER
+ * Contains the giant PHP and our 3x lead elements
+ */
+.landing-hdr {
+ margin-bottom: 3em;
+}
+
+@media (min-width: 901px) {
+ .landing-hdr {
+ display: grid;
+ grid-template-columns: 2fr 1fr;
+ gap: 1.5em;
+ }
+}
+
+@media (max-width: 900px) {
+ .landing-hdr {
+ display: flex;
+ flex-direction: column;
+ gap: 1em;
+ }
+}
+
+.landing-hdr-block {
+ padding: 1em;
+}
+
+.landing-hdr-block + .landing-hdr-block {
+ border-top: 1px dashed #4a5568;
+}
+
+.landing-hdr-title {
+ font-size: larger;
+ margin-bottom: 0.25em;
+}
+
+.landing-hdr-tagline {
+ margin-bottom: 0;
+ font-size: 24px;
+}
+
+.landing-hdr-content {
+
+}
+
+/*
+ * LAST RELEASE HERO CARD
+ */
+
+.landing-lrel-card {
+ display: flex;
+ flex-direction: column;
+ box-sizing: border-box;
+}
+
+.landing-lrel-card-inner {
+ display: flex;
+ flex-direction: column;
+ flex-grow: 1;
+ overflow: hidden;
+ gap: 1em;
+ padding: 1em;
+}
+
+.landing-lrel-img {
+ width: 100%;
+ height: 60px;
+ object-fit: contain;
+ object-position: center center;
+ margin-top: 1em;
+ margin-bottom: 1em;
+}
+
+.gst-light .landing-lrel-img {
+ background: #aaaaaa;
+ padding: 1em;
+ border-radius: var(--card-radius);
+ box-sizing: border-box;
+}
+
+@media (max-width: 400px) {
+ .landing-lrel-img {
+ height: 40px;
+ margin-top: 0.25em;
+ margin-bottom: 0.25em;
+ }
+}
+
+.landing-lrel-featuring {
+ font-weight: bold;
+ margin-bottom: 0.25em;
+}
+
+.landing-lrel-latest {
+ display: flex;
+ flex-direction: column;
+ gap: 0.5em;
+ text-align: center;
+}
+
+.landing-lrel-features {
+ margin-bottom: 0;
+}
+
+.landing-lrel-label {
+ display: inline-flex;
+ padding: 0.25em 0.75em;
+ border-radius: 0.5em;
+ font-size: 90%;
+}
+
+.landing-lrel-buttons {
+ display: flex;
+ flex-direction: column;
+ gap: 0.25em;
+ width: 100%;
+}
+
+
+/*
+ * LAST RELEASE HERO CARD
+ */
+
+.landing-lrv {
+ overflow: hidden;
+ position: relative;
+ background: #4F5B93;
+ border-radius: var(--card-radius);
+ margin: 0 auto 2em;
+ width: min(1440px, 100%);
+ border: 1px solid #555555;
+}
+
+.landing-lrv-animate {
+ position: absolute;
+ inset: 0;
+ opacity: 0.5;
+}
+
+@media (prefers-reduced-motion: reduce) {
+ .landing-lrv-animate {
+ display: none;
+ }
+}
+
+.landing-lrv-inner-padding {
+ position: relative;
+}
+
+@media (max-width: 900px) {
+ .landing-lrv-inner-padding {
+ padding: 1em;
+ }
+
+ .landing-lrv-inner {
+ display: flex;
+ flex-direction: column;
+ gap: 2em;
+ }
+}
+
+@media (min-width: 901px) {
+ .landing-lrv-inner-padding {
+ padding: 2em;
+ }
+
+ .landing-lrv-inner {
+ display: grid;
+ gap: 2em;
+ align-items: center;
+ grid-template-columns: 1fr 1fr;
+ }
+}
+
+.landing-lrv-highlights {
+ display: grid;
+ gap: 1em;
+ grid-template-columns: repeat(auto-fill, minmax(160px, 1fr));
+}
+
+.landing-lrv-highlight {
+ background: #44444477;
+ color: white;
+ border-radius: 0.5em;
+ padding: 1em;
+ font-size: smaller;
+}
+
+.landing-lrv-highlight-title {
+ font-weight: 500;
+}
+
+/*
+ * ECOSYSTEM BANNER
+ * Full-width banner intended to promote ecosystem components as a single element
+ */
+
+.gst-primary-banner {
+ display: flex;
+ flex-direction: row;
+ gap: 2em;
+ align-items: center;
+ padding: 0 5em;
+ color: var(--primary-container-color);
+}
+
+@media (max-width: 700px) {
+ .gst-primary-banner {
+ flex-direction: column;
+ padding: 0;
+ gap: 1em;
+ text-align: center;
+ }
+}
+
+.gst-primary-text {
+ font-size: 24px;
+ line-height: 1.3;
+}
+
+/*
+ * SECTIONS
+ */
+
+
+.landing-section-header {
+ font-size: 18px;
+ text-align: center;
+ text-decoration: none !important;
+ margin: 0;
+ padding: 0;
+ color: var(--section-title);
+ line-height: 1.3;
+ font-weight: 500;
+}
+
+
+/*
+ * MICRO LABEL
+ * Key-Value label intended to be used for versions
+ */
+
+.landing-ml {
+ font-size: smaller;
+ border-radius: 0.75em;
+ border: 1px solid #77777755;
+ overflow: hidden;
+ display: inline-flex;
+ align-items: center;
+}
+
+.landing-ml-label {
+ padding: 0.15em 0.5em;
+ background: #00000044;
+ border-right: 1px solid #777777;
+}
+
+.landing-ml-value {
+ padding: 0.15em 0.5em;
+}
+
+/*
+ * CARD BUTTON
+ */
+
+.landing-card-btn {
+ display: flex;
+ align-items: center;
+ justify-content: center;
+ width: 100%;
+ box-sizing: border-box;
+
+ /* "Chunk" styling: chunky padding and thick borders */
+ padding: 14px 32px;
+ font-family: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+ font-size: 1.1rem;
+ font-weight: 700;
+ text-decoration: none;
+ text-align: center;
+ letter-spacing: 0.5px;
+ cursor: pointer;
+
+ /* Colors & Border */
+ color: #111111 !important;
+ background-color: #ffffff;
+ border: 2px solid #111111;
+ border-radius: 0.5em;
+
+ /* Smooth transitions for hover/active states */
+ transition: all 0.2s ease-in-out;
+}
+
+@media (max-width: 600px) {
+ .landing-card-btn {
+ padding: 4px 16px !important;
+ }
+}
+
+/* Hover state */
+.landing-card-ovh:hover .landing-card-btn,
+.landing-card-ovh:active .landing-card-btn,
+.landing-card-btn:hover {
+ color: #ffffff !important;
+ background-color: #222222;
+ /* Shifts the button slightly and expands shadow for a "lifting" effect */
+ transform: translate(-2px, -2px);
+ box-shadow: 6px 6px 0px 0px #000000;
+ border-color: transparent;
+}
+
+/* Focus state for accessibility */
+.landing-card-btn:focus-visible {
+ outline: 4px solid #818cf8;
+}
+
+#foundation-sponsor-carousel {
+ mask-image: linear-gradient(
+ to right,
+ transparent 0%,
+ black 10%,
+ black 90%,
+ transparent 100%
+ );
+}
diff --git a/styles/mirror.css b/assets/styles/mirror.css
similarity index 100%
rename from styles/mirror.css
rename to assets/styles/mirror.css
diff --git a/styles/php8.css b/assets/styles/php8.css
similarity index 100%
rename from styles/php8.css
rename to assets/styles/php8.css
diff --git a/styles/php85.css b/assets/styles/php85.css
similarity index 100%
rename from styles/php85.css
rename to assets/styles/php85.css
diff --git a/styles/print.css b/assets/styles/print.css
similarity index 100%
rename from styles/print.css
rename to assets/styles/print.css
diff --git a/styles/prism.css b/assets/styles/prism.css
similarity index 100%
rename from styles/prism.css
rename to assets/styles/prism.css
diff --git a/styles/releases.css b/assets/styles/releases.css
similarity index 100%
rename from styles/releases.css
rename to assets/styles/releases.css
diff --git a/styles/rtl.css b/assets/styles/rtl.css
similarity index 100%
rename from styles/rtl.css
rename to assets/styles/rtl.css
diff --git a/styles/supported-versions.css b/assets/styles/supported-versions.css
similarity index 100%
rename from styles/supported-versions.css
rename to assets/styles/supported-versions.css
diff --git a/styles/theme-base.css b/assets/styles/theme-base.css
similarity index 99%
rename from styles/theme-base.css
rename to assets/styles/theme-base.css
index faeab9d6b4..531dc79641 100644
--- a/styles/theme-base.css
+++ b/assets/styles/theme-base.css
@@ -538,6 +538,7 @@ div.classsynopsisinfo_comment {
pre.info {
border: 1px solid;
margin: 1rem 0.8rem 1.3rem 2rem;
+ color: black;
}
#langform {
diff --git a/assets/styles/theme-gst.css b/assets/styles/theme-gst.css
new file mode 100644
index 0000000000..68fca14df9
--- /dev/null
+++ b/assets/styles/theme-gst.css
@@ -0,0 +1,361 @@
+:root {
+ --card-radius: 0.5em;
+}
+
+.gst-dark {
+ background-image: url(/images/bg-texture-00.svg);
+
+ /* dedicated block style for header */
+ --main-header-bg: #202020;
+ --main-header-color: #eeeeee;
+ --main-header-border: #333333;
+
+ /* spec: main content area, solid background */
+ --primary-container-bg: #252525;
+ --primary-container-color: whitesmoke;
+ --primary-container-border: #333333;
+ --primary-card-bg: #303030;
+ --primary-card-color: whitesmoke;
+ --primary-card-border: #222222;
+
+ /* spec: secondary content area, allows background to show through, not for main text */
+ --secondary-container-bg: transparent;
+ --secondary-container-color: whitesmoke;
+ --secondary-card-bg: #444444;
+ --secondary-card-color: whitesmoke;
+ --secondary-card-border: #222222;
+
+ --section-title: whitesmoke;
+ --leader-color: whitesmoke;
+}
+
+.gst-light {
+ background-color: #fafafa;
+ background-image: url(/images/bg-texture-light.png);
+ background-repeat: repeat;
+
+ /* dedicated block style for header */
+ --main-header-bg: #202020;
+ --main-header-color: #eeeeee;
+ --main-header-border: #cccccc;
+
+ /* spec: main content area, solid background */
+ --primary-container-bg: #ffffff;
+ --primary-container-color: #333333;
+ --primary-container-border: #eeeeee;
+ --primary-card-bg: #fcfcfc;
+ --primary-card-color: #222222;
+ --primary-card-border: #f7f7f7;
+
+ /* spec: secondary content area, allows background to show through, not for main text */
+ --secondary-card-bg: #ffffff;
+ --secondary-card-color: #222222;
+ --secondary-card-border: #eeeeee;
+
+ --section-title: #222222;
+ --leader-color: #222222;
+}
+
+/*
+ * Global Theming
+ */
+
+.gst-header-block {
+ background: var(--main-header-bg) !important;
+ color: var(--main-header-color) !important;
+ border-bottom: 1px solid var(--main-header-border);
+}
+
+.gst-footer-block {
+ background: var(--main-header-bg) !important;
+ color: var(--main-header-color) !important;
+ border-top: 1px solid var(--main-header-border);
+}
+
+.gst-primary {
+ --card-bg: var(--primary-card-bg);
+ --card-color: var(--primary-card-color);
+ --card-border: var(--primary-card-border);
+}
+
+.gst-primary-container {
+ position: relative;
+ background: var(--primary-container-bg);
+ /*border-top: 1px solid var(--primary-container-border);*/
+ /*border-bottom: 1px solid var(--primary-container-border);*/
+ color: var(--primary-container-color);
+
+ & h1, h2, h3, h4, h5, h6 {
+ color: var(--primary-container-color);
+ border-bottom: none;
+ }
+}
+
+.gst-secondary {
+ --card-bg: var(--secondary-card-bg);
+ --card-color: var(--secondary-card-color);
+ --card-border: var(--secondary-card-border);
+}
+
+.gst-secondary-container {
+ position: relative;
+ background-color: var(--secondary-container-bg);
+ color: var(--secondary-container-color);
+
+ background-image: url(/images/bg-texture-dark.png);
+}
+
+.gst-content, .gst-content-p {
+ width: min(1220px, 100%);
+ margin: 0 auto;
+ box-sizing: border-box;
+}
+
+.gst-content-wide, .gst-content-p-wide {
+ width: min(1440px, 100%);
+ margin: 0 auto;
+ box-sizing: border-box;
+}
+
+.gst-content-p-thin {
+ width: min(800px, 100%);
+ margin: 0 auto;
+ box-sizing: border-box;
+}
+
+.gst-content-p-wide h1, .gst-content-p-wide h2, .gst-content-p-wide h3 {
+ color: var(--card-color);
+}
+
+.gst-content-p-wide, .gst-content-p, .gst-content-p-thin {
+ padding: 5em 1em;
+}
+
+.gst-readable {
+ width: min(800px, 100%);
+ margin-left: auto;
+ margin-right: auto;
+ line-height: 1.5;
+}
+
+.gst-sbc {
+ display: flex;
+ flex-direction: row;
+ gap: 2em;
+}
+
+.gst-sbc-main {
+ flex: 1 0 300px;
+}
+
+.gst-sbc-sidebar {
+ flex: 0 0 320px;
+}
+
+@media (max-width: 600px) {
+ .gst-content-p-wide {
+ padding: 1em 1em;
+ }
+}
+
+/*
+ * Section Titles
+ */
+
+.gst-section-title {
+ padding-top: 5em;
+ padding-bottom: 3em;
+ text-align: center;
+}
+
+.gst-section-title:first-child {
+ padding-top: 0;
+}
+
+.gst-content-p-wide .gst-section-title:first-child {
+ padding-top: 0;
+}
+
+/*
+ * Sidebar
+ */
+
+/* maintain compatibility with previous versions by only knocking out padding if we have a card in it */
+aside.tips:has(.gst-card) {
+ padding: 0 !important;
+}
+
+/*
+ * Clickable Navigation Card
+ */
+
+.gst-navcard {
+ all: unset;
+ border-radius: var(--card-radius);
+ display: flex;
+ flex-direction: row;
+ flex-grow: 1;
+ gap: 0.25em;
+ overflow: hidden;
+ cursor: pointer;
+ background: var(--card-bg);
+ color: var(--card-color) !important;
+ outline: 3px transparent;
+ transition: all 0.2s ease-in-out;
+ border: 1px solid var(--card-border);
+}
+
+.gst-navcard:hover {
+ outline: 3px solid #53576d;
+ overflow: hidden;;
+ transition: all 0.2s ease-in-out;
+}
+
+.gst-navcad:focus {
+ outline: 3px solid #eeeeee;
+}
+
+/*
+ * Basic Card
+ */
+
+.gst-card {
+ border-radius: var(--card-radius);
+ display: flex;
+ flex-direction: column;
+ flex-grow: 1;
+ overflow: hidden;
+ background: var(--card-bg);
+ color: var(--card-color);
+ border: 1px solid var(--card-border);
+}
+
+.gst-card-title {
+ padding: 1.5em;
+ font-weight: bold;
+}
+
+.gst-card-content {
+ padding: 1.5em;
+}
+
+/*
+ * CGRID
+ *
+ * Displays in an auto-repeating grid, however, when the space is too small, it significantly collapses
+ * the gap and changes the separation from such large padding, into a vertical list
+ */
+
+.gst-cgrid {
+ display: grid;
+ grid-template-columns: repeat(auto-fill, minmax(min(340px, 100%), 1fr));
+ gap: 1.5em;
+ margin: 0;
+ padding: 0;
+ list-style-type: none;
+}
+
+.gst-cgrid-card {
+ border-radius: var(--card-radius);
+ overflow: hidden;
+}
+
+@media (max-width: 700px) {
+ .gst-cgrid {
+ gap: 0;
+ overflow: hidden;
+ border-radius: var(--card-radius);
+ animation: ease;
+ }
+
+ .gst-cgrid-card {
+ border-radius: 0 !important;
+ overflow: hidden;
+ }
+
+ .gst-cgrid-card + .gst-cgrid-card {
+ margin-top: 3px;
+ }
+}
+
+/*
+ * Micro Label
+ */
+
+/*
+ * MICRO LABEL
+ * Key-Value label intended to be used for versions
+ */
+
+.gst-statuslabel {
+ font-size: smaller;
+ border-radius: 0.75em;
+ border: 1px solid #77777755;
+ overflow: hidden;
+ display: inline-flex;
+ align-items: center;
+}
+
+.gst-statuslabel-label {
+ padding: 0.15em 0.5em;
+ background: #00000044;
+ border-right: 1px solid #777777;
+}
+
+.gst-statuslabel-value {
+ padding: 0.15em 0.5em;
+}
+
+/*
+ * Banners
+ */
+
+
+.gst-warning {
+ border-radius: var(--card-border);
+ padding: 1em;
+ background: #5d3b3b;
+ border: 1px solid #442c2c;
+ color: white;
+}
+
+.gst-tip {
+ border-radius: var(--card-border);
+ padding: 1em;
+ background: #5c5d3b;
+ border: 1px solid #44442c;
+ color: white;
+}
+
+/**
+ * Clickable cards - need to rename
+ */
+
+
+/*
+ * CARD LAYOUT
+ */
+
+.landing-cc-card-img {
+ height: 80px;
+ width: 80px;
+ object-fit: contain;
+ overflow: hidden;
+}
+
+.landing-cc-card-content {
+ padding: 1.5em;
+ flex: 1 1;
+ display: flex;
+ flex-direction: column;
+ gap: 1em;
+}
+
+.landing-cc-card-title {
+ font-size: 125%;
+ font-weight: 500;
+}
+
+.landing-cc-card-body {
+ flex: 1 1;
+}
diff --git a/styles/theme-medium.css b/assets/styles/theme-medium.css
similarity index 99%
rename from styles/theme-medium.css
rename to assets/styles/theme-medium.css
index c086e06c1f..474cb6231e 100644
--- a/styles/theme-medium.css
+++ b/assets/styles/theme-medium.css
@@ -153,6 +153,7 @@ div.caution {
div.warning {
background:#F4DFDF;
border-color: #EABFBF;
+ color: black;
}
.docs .classsynopsis,
diff --git a/bin/build.php b/bin/build.php
new file mode 100644
index 0000000000..098bf1fc73
--- /dev/null
+++ b/bin/build.php
@@ -0,0 +1,43 @@
+getMessage());
+ exit(1);
+ } catch (Throwable $e) {
+ fwrite(STDERR, 'Unhandled exception building ' . $classId . ': ' . $e->getMessage() . "\n");
+ fwrite(STDERR, $e->getTraceAsString() . "\n");
+ die($e);
+ exit(1);
+ }
+}
diff --git a/bin/bumpRelease b/bin/bumpRelease
deleted file mode 100755
index f03c2c6da9..0000000000
--- a/bin/bumpRelease
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/usr/bin/env php
- "/releases/" . str_replace(".", "_", $version) . ".php");
-}
-
-$OLDRELEASES[$major] = array_merge(
- array($version => $info),
- $OLDRELEASES[$major] ?? []
-);
-
-file_put_contents(__DIR__ . "/../include/releases.inc", [
- "setSummary($summary);
+ }
+
return $entry;
}
diff --git a/bin/createReleaseEntry b/bin/createReleaseEntry
index a9dcf1e658..592db95641 100755
--- a/bin/createReleaseEntry
+++ b/bin/createReleaseEntry
@@ -50,24 +50,6 @@ $entry = (new Entry)
$entry->save()->updateArchiveXML();
$addedFiles = [Entry::ARCHIVE_ENTRIES_REL . $entry->getId() . '.xml'];
-// Mint the releases/x_y_z.php archive.
-const RELEASES_REL = 'releases/';
-const RELEASES_ABS = __DIR__ . '/../' . RELEASES_REL;
-if (isset($opts['r'])) {
- $release = strtr($version, '.', '_') . '.php';
- file_put_contents(RELEASES_ABS . $release, "
-PHP $version Release Announcement
-
-$template
- $releases) {
+ /*
+ * Look for the most recent version as it's the one most likely to have the fullest
+ * set of data within it
+ */
+
+ $highestVersion = null;
+ foreach (array_keys($releases) as $releaseId) {
+ [$major, $minor] = explode('.', $releaseId);
+
+ $br = $major . '.' . $minor;
+ $highestVersion = (!$highestVersion || Utils::versionCompareOp($releaseId, $highestVersion, 'gt'))
+ ? $releaseId
+ : $highestVersion;
+ }
+
+ if (!$highestVersion) {
+ printf("Warning! There is no highest release of " . $versionId . " available; skipping\n");
+ continue;
+ }
+
+ $cachePath = sys_get_temp_dir() . '/php-news-' . $highestVersion . '.txt';
+ if (!file_exists($cachePath)) {
+ /* the file could be in one of a number of locations depending on how it was committed */
+ $options = [
+ /* normal branch */
+ 'https://raw.githubusercontent.com/php/php-src/refs/heads/PHP-' . $highestVersion . '/NEWS',
+
+ /* tag */
+ 'https://raw.githubusercontent.com/php/php-src/refs/tags/php-' . $highestVersion . '/NEWS',
+ ];
+
+ foreach ($options as $fetchUrl) {
+ $content = @file_get_contents($fetchUrl);
+ if (!$content) {
+ fwrite(STDERR, "Could not read raw data for $fetchUrl\n");
+ continue;
+ }
+
+ fwrite(STDOUT, "Successfully imported read data from $fetchUrl\n");
+ FS::writeContents($cachePath, $content);
+ }
+
+ if (!$content) {
+ fwrite(STDERR, "Could not find a suitable data source for $highestVersion\n");
+ continue;
+ }
+ } else {
+ $content = FS::readContents($cachePath);
+ }
+
+ /*
+ * We should now, theoretically, have a complete news file that has the highest release and
+ * everything before it.
+ *
+ * Some of them have a ton of data before, some get reset at the start of each major.minor version
+ */
+ foreach (ChangeLogDataLoader::parseNewsFileToReleaseSections($content) as $releaseId => $data) {
+ /* only write the sections that belong to us */
+ if (!str_starts_with($releaseId, $versionId . '.')) {
+ continue;
+ }
+
+ /* special case for 5.1.0 which doesn't have the release in the original NEWS */
+ if ($releaseId === '5.1') {
+ $releaseId = '5.1.0';
+ }
+
+ $path = ProjectGlobals::getDataPathForRelease($releaseId, create: true) . '/changes.txt';
+ if (FS::writeContentsIfChanged($path, $data)) {
+ printf("Writing NEWS block to %s %s\n", $path, md5($data));
+ }
+ }
+}
diff --git a/bin/migrations/migrate-releases.php b/bin/migrations/migrate-releases.php
new file mode 100644
index 0000000000..e7fea7d798
--- /dev/null
+++ b/bin/migrations/migrate-releases.php
@@ -0,0 +1,66 @@
+ $releases) {
+ foreach ($releases as $releaseId => $release) {
+ if (str_starts_with($releaseId, '3.0.')) {
+ continue; // can't be dealing with this
+ }
+
+ [$major, $minor] = explode('.', $releaseId);
+ $versionId = $major . '.' . $minor;
+
+ $savePath = ProjectGlobals::getDataPathForRelease($releaseId) . '/release.json';
+
+ unset($release['announcement']);
+
+ if (isset($release['museum']) && !$release['museum']) {
+ unset($release['museum']);
+ }
+
+ $sources = [];
+ foreach ($release['source'] as $source) {
+ unset($source['date']);
+ $sources[] = $source;
+ }
+
+ $data = [
+ 'version' => $releaseId,
+ 'date' => $release['date'],
+ 'tags' => $release['tags'] ?? [],
+ 'source' => $sources,
+ ];
+
+ /* do not overwrite unless explicitly told to (early stage dev needing format refreshes) */
+ if (!$force && file_exists($savePath)) {
+ continue;
+ }
+
+ if (FS::writeContentsIfChanged($savePath, json_encode($data, JSON_PRETTY_PRINT))) {
+ printf("Writing data to %s\n", $savePath);
+ }
+ }
+ }
+}
+
+printf("Completed import of all release.json files\n");
diff --git a/bin/move-release-announcements.php b/bin/move-release-announcements.php
new file mode 100644
index 0000000000..5ad9b38350
--- /dev/null
+++ b/bin/move-release-announcements.php
@@ -0,0 +1,68 @@
+';
+ $htmlStartPosition = strpos($content, $htmlStartToken);
+ if ($htmlStartPosition === false) {
+ throw new RuntimeException('Unable to find PHP closing tag in ' . $fullPath);
+ }
+
+ $htmlStartPosition+= strlen($htmlStartToken);
+
+ $htmlEndToken = 'The PHP development team announces the immediate availability of PHP {{release}}. This is a {{tags}} release.
+
+All PHP {{version}} users are encouraged to upgrade to this version.
+
+For source downloads, change lists and more information, please visit the release page.
diff --git a/bin/rm/create-release.php b/bin/rm/create-release.php
new file mode 100644
index 0000000000..455a68793d
--- /dev/null
+++ b/bin/rm/create-release.php
@@ -0,0 +1,230 @@
+getMessage());
+ }
+ } else {
+ $manifestUpdated = true;
+ $manifestArray = [
+ 'version' => $releaseId,
+ 'date' => date('Y-m-d'),
+ 'tags' => [],
+ 'source' => array_map(fn(string $fmt) => [
+ 'filename' => 'php-' . $releaseId . '.tar.' . $fmt,
+ 'name' => 'PHP ' . $releaseId . ' (tar.' . $fmt . ')',
+ 'sha256' => '',
+ ], $expectedSourceExtensions),
+ ];
+ }
+
+ $sourcesPath = $opts['sources'] ?? null;
+ if (is_string($sourcesPath)) {
+ if (!file_exists($sourcesPath) || !is_file($sourcesPath)) {
+ throw new ValueError('Sources file "' . $sourcesPath . '" is not readable');
+ }
+
+ $fileName = null;
+ $hashPrefix = 'sha256 hash:';
+ $lines = explode("\n", str_replace("\r\n", "\n", FS::readContents($sourcesPath)));
+ $locatedFileHashes = [];
+
+ $pattern = '/^php-' . preg_quote($releaseId, '/') . '\.tar\.(bz2|gz|xz)$/i';
+
+ foreach ($lines as $ldx => $line) {
+ $line = trim($line);
+ if (!preg_match($pattern, $line, $matches)) {
+ continue;
+ }
+
+ $formatType = $matches[1];
+ $fileName = $line;
+ $isHash = fn(string $hash) => (bool)preg_match('/^[a-f0-9]{64}$/i', $hash);
+ $cursor = $ldx;
+
+ $nextLine = trim($lines[++$cursor] ?? '');
+ if (!str_starts_with(strtolower($nextLine), $hashPrefix)) {
+ throw new ValueError(
+ 'Expected line beginning with prefix "' . $hashPrefix . '" after "' . $nextLine . "\"\n"
+ );
+ }
+
+ /* the hash is on the same line e.g.
+ * SHA256 hash: a0fa6673ba4b0c8335fbab08afb7c2e13a3791f2b5a0928c7ad3d7ad872edf26 */
+ $sameLineHash = trim(substr($nextLine, strlen($hashPrefix)));
+ if ($isHash($sameLineHash)) {
+ $locatedFileHashes[$formatType] = $sameLineHash;
+ continue;
+ }
+
+ /* The signature may also be on the line after */
+ $nextLine = trim($lines[++$cursor] ?? '');
+ if (!$isHash($nextLine)) {
+ throw new ValueError('Unable to extract sha256 hash for ' . $line . ' got ' . $nextLine);
+ }
+
+ $locatedFileHashes[$formatType] = $nextLine;
+ }
+
+ $generatedSources = [];
+ foreach ($locatedFileHashes as $formatType => $hash) {
+ $generatedSources[] = [
+ 'filename' => 'php-' . $releaseId . '.tar.' . $formatType,
+ 'name' => 'PHP ' . $releaseId . ' (tar.' . $formatType . ')',
+ 'sha256' => $hash,
+ ];
+ }
+
+ $manifestArray['source'] = $generatedSources;
+ $manifestUpdated = true;
+ }
+
+ if (array_key_exists('tags', $opts) && is_string($opts['tags'])) {
+ $tags = array_filter(array_map(trim(...), explode(',', (string)$opts['tags'])));
+
+ $manifestArray['tags'] = $tags;
+ $manifestUpdated = true;
+ }
+
+ if (array_key_exists('date', $opts) && is_string($opts['date'])) {
+ $updateDate = $opts['date'];
+ if ($updateDate === 'today') {
+ $updateDate = date('Y-m-d');
+ } else {
+ try {
+ $updateDate = new DateTimeImmutable($updateDate)->format('Y-m-d');
+ } catch (DateMalformedStringException $e) {
+ throw new ValueError('Unable to update date. Input is malformed; ' . $e->getMessage());
+ }
+ }
+
+ echo "Updating manifest date to '$updateDate'\n";
+ $manifestArray['date'] = $updateDate;
+ $manifestUpdated = true;
+ }
+
+ /*
+ * If anything has changed the manifest, this is our time to write it back to
+ * disk. We don't ask for overwrite permission here as it's provided for by
+ * item-specific flags
+ */
+ if ($manifestUpdated) {
+ if (FS::writeContentsIfChanged($jsonPath, json_encode($manifestArray, JSON_PRETTY_PRINT | JSON_THROW_ON_ERROR))) {
+ echo "Writing manifest back to $jsonPath\n";
+ }
+ }
+
+ /*
+ * The announcement template always gets created here, with the updated content from
+ * the payload.
+ *
+ * It will be created if it doesn't exist, but can be force upgraded using the --force flag
+ */
+ $announcementPath = $releaseDir . '/announcement.html';
+ $templateTokens = [
+ '{{version}}' => $versionId,
+ '{{release}}' => $releaseId,
+ '{{tags}}' => implode(', ', $manifestArray['tags']) ?: 'bugfix',
+ '{{release_url}}' => 'https://www.php.net/releases/' . str_replace('.', '_', $releaseId) . '.php',
+ ];
+
+ $announcementHtml = str_replace(
+ array_keys($templateTokens),
+ array_values($templateTokens),
+ FS::readContents(__DIR__ . '/announcement-template.html')
+ );
+
+ $force = array_key_exists('update-announcement', $opts);
+ if (!file_exists($announcementPath) || $force) {
+ echo "Writing announcements to $announcementPath\n";
+ FS::writeContentsIfChanged($announcementPath, $announcementHtml);
+ }
+
+ /*
+ * Everything written back at this point, so we're in a position to check
+ */
+ if (!isset($opts['skip-checks'])) {
+ $errors = [];
+ if ($manifestArray['version'] !== $releaseId) {
+ $errors[] = "Manifest version does not match expected release.";
+ }
+
+ if (empty($manifestArray['source'])) {
+ $errors[] = "Manifest contains no source files.";
+ }
+
+ foreach (($manifestArray['source'] ?? []) as $sIdx => $sourceData) {
+ foreach (['filename', 'name', 'sha256'] as $wantedKey) {
+ if (empty($sourceData[$wantedKey])) {
+ $errors[] = "Manifest source[$sIdx] does not provide value for '$wantedKey'.";
+ }
+ }
+ }
+
+ if (!is_file($targetNewsPath)) {
+ $errors[] = "There is no news.txt file present in the release directory.";
+ }
+
+ if ($errors) {
+ echo "The following errors were detected:\n";
+ foreach ($errors as $error) {
+ echo "- $error\n";
+ }
+
+ exit(1);
+ }
+ }
+} catch (ValueError $e) {
+ fwrite(STDERR, $e->getMessage() . "\n");
+ exit(1);
+}
diff --git a/bin/rm/create-release.txt b/bin/rm/create-release.txt
new file mode 100644
index 0000000000..c79800a851
--- /dev/null
+++ b/bin/rm/create-release.txt
@@ -0,0 +1,54 @@
+Create release data CLI for php.net
+
+Usage:
+--------------------------------------------------------
+php create-release.php [--flags] x.y.z
+
+The same command is used to create, as well as modify the files, if needed.
+
+--news=/path/to/file Optional (for updates)
+ The path to the php-src NEWS file for this release.
+ It MUST contain a section matching this release label.
+
+--sources=/path/to/sources Optional (for updates)
+ The path to the file containing the file names, sha256
+ hashes and pgp signatures.
+
+--tags=security Optional (for updates)
+ Specify a comma separated list of tags. If no tags are
+ given this will be considered a bugfix release.
+
+--date=today|date Optional (for updates)
+ Overrides the date in the release manifest.
+ Specify 'today' to detect automatically, or provide a
+ date manually.
+
+--update-announcement Allows overwriting the existing announcement.html file
+ with a newly generated template created from the manifest.
+ Protects against accidental overwriting if the file was
+ changed.
+
+--skip-checks Do not perform the normal integrity checks on the data after
+ changes have been applied. Exits with 0 even if errors detected.
+
+
+First Setup:
+--------------------------------------------------------
+ php create-release.php --news=/path/to/news --sources=/path/to/sources 1.2.3
+
+
+Sources File Format:
+--------------------------------------------------------
+ php-x.y.z.tar.bz2
+ SHA256 hash: 800b7b6ed50b73c8ee7844ee5f2f7cc612faa7875a0aa7c4529e8ed5866a5030
+ -----BEGIN PGP SIGNATURE-----
+ ...
+ -----END PGP SIGNATURE-----
+
+ php-x.y.z.tar.gz
+ SHA256 hash: e587dc95fb7f62730299fa7b36b6e4f91e6708aaefa2fff68a0098d320c16386
+ -----BEGIN PGP SIGNATURE-----
+ ...
+ -----END PGP SIGNATURE-----
+
+ ... etc ...
diff --git a/bin/rm/examples/news.txt b/bin/rm/examples/news.txt
new file mode 100644
index 0000000000..d54023d1b3
--- /dev/null
+++ b/bin/rm/examples/news.txt
@@ -0,0 +1,20 @@
+PHP NEWS
+|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+?? ??? ????, PHP 1.2.3
+
+- CLI:
+ . Fixed bug GH-21901 (Stale getopt() optional value). (onthebed)
+
+- Date:
+ . Fixed bug GH-18422 (int overflow in php_date_llabs). (iliaal)
+
+07 May 2026, PHP 1.2.2
+
+- Core:
+ . Fixed bug GH-19983 (GC assertion failure with fibers, generators and
+ destructors). (iliaal)
+ . Fixed ZEND_API mismatch on zend_ce_closure forward decl for Windows+Clang.
+ (henderkes)
+ . Fixed bug GH-21504 (Incorrect RC-handling for ZEND_EXT_STMT op1). (ilutov)
+ . Fixed bug GH-21478 (Forward property operations to real instance for
+ initialized lazy proxies). (iliaal)
diff --git a/bin/rm/examples/sources.txt b/bin/rm/examples/sources.txt
new file mode 100644
index 0000000000..9c7ec1677e
--- /dev/null
+++ b/bin/rm/examples/sources.txt
@@ -0,0 +1,35 @@
+The PHP development team announces the immediate availability of PHP 1.2.3. This is a security
+release.
+
+All PHP 1.2 users are encouraged to upgrade to this version.
+
+Release Announcement:
+Downloads:
+Windows downloads:
+Changelog:
+
+Many thanks to all the contributors and supporters!
+
+Regards,
+Fake
+
+php-1.2.3.tar.bz2
+SHA256 hash: c7337212e655325d499ea8108fa76f69ddde2fff7cb0fad36aa63eed540cb8a5
+PGP signature:
+-----BEGIN PGP SIGNATURE-----
+-----END PGP SIGNATURE-----
+
+
+php-1.2.3.tar.gz
+SHA256 hash: 8565fa8733c640b60da5ab4944bf2d4081f859915b39e29b3af26cf23443ed97
+PGP signature:
+-----BEGIN PGP SIGNATURE-----
+-----END PGP SIGNATURE-----
+
+
+php-1.2.3.tar.xz
+SHA256 hash:
+f7950ca034b15a78f5de9f1b22f4d9bad1dd497114d175cb1672a4ca78077af5
+PGP signature:
+-----BEGIN PGP SIGNATURE-----
+-----END PGP SIGNATURE-----
diff --git a/bin/sync-pregen.php b/bin/sync-pregen.php
new file mode 100644
index 0000000000..a210d62688
--- /dev/null
+++ b/bin/sync-pregen.php
@@ -0,0 +1,49 @@
+ $varPath . '/pregen-events.inc',
+ 'include/pregen-news.inc' => $varPath . '/pregen-news.inc',
+ 'include/pregen-confs.inc' => $varPath . '/pregen-confs.inc',
+];
+
+fwrite(STDOUT, "Copying data from production server into local directories:\n");
+fwrite(STDOUT, "Do not commit these files!\n");
+
+foreach ($overridePaths as $sourcePath => $saveTo) {
+ $url = 'https://www.php.net/' . $sourcePath;
+ $source = @file_get_contents($url);
+ if ($source === false) {
+ fwrite(STDERR, "Unable to read " . $url . "\n");
+ exit(1);
+ }
+
+ $success = file_put_contents($saveTo, $source);
+ if ($success === false) {
+ fwrite(STDERR, "Unable to write to " . $saveTo . "\n");
+ exit(1);
+ }
+
+ fwrite(STDOUT, "Copied " . $url . " to " . $saveTo . "\n");
+}
diff --git a/bin/util.php b/bin/util.php
new file mode 100644
index 0000000000..880ea6b332
--- /dev/null
+++ b/bin/util.php
@@ -0,0 +1,6 @@
+#!/usr/bin/env php
+
-
-
- This page is intended to help set up a development environment for PHP, if mistakes are found
- please report them.
-
-
-
-';
-
-site_header(
- "Operating System Preparation",
- [
- "current" => "community",
- "css" => [
- "code-syntax.css",
- ],
- ],
-);
-
-?>
-
-
-
- Improving PHP requires a working build environment to test changes, the following section deals with setting up a working build environment.
-
-
- Your build environment should have an appropriate toolchain that includes a working C compiler.
- For those not working in Microsoft Windows, you will need a working, compatible autotools installation, and at the very least a shared copy of zlib.
-
-
- For most *nix like operating systems, some external dependencies may be required to bring a build to completion;
- if a build fails because of missing headers or libraries, issuing a variant of the following command should resolve those dependencies, allowing the build to continue.
-
-
-
- For those working in Ubuntu Linux, you can run the following command to automate the installation of dependencies.
-
-
-
- If the compilation of an extension fails because of missing dependencies, Ubuntu Linux can attempt to automate the resolution of those dependencies by issuing:
-
-
-
- The following table shows what is required for Microsoft Windows users to build supported PHP versions:
-
-
-
- | PHP |
- Visual C++ |
- MS SDK |
- DEPS |
- PHP SDK |
-
-
- | 8.2 |
- Visual Studio 2019 |
- VS16 |
-
- x86,
- x64
- |
- tools |
-
-
- | 8.3 |
- Visual Studio 2019 |
- VS16 |
-
- x86,
- x64
- |
- tools |
-
-
- | 8.4 |
- Visual Studio 2022 |
- VS17 |
-
- x86,
- x64
- |
- tools |
-
-
- | 8.5 |
- Visual Studio 2022 |
- VS17 |
-
- x86,
- x64
- |
- tools |
-
-
-
Note: If a Windows SDK is required, it is advised to install the SDK before Visual Studio.
-
-
-
-
-
- Windows users should now download and unzip the PHP SDK to their workspace and execute the following commands in an appropriate Visual Studio 2019/2022 Developer Command Prompt:
-
-
- Visual Studio 2019 and 2022:
-
-
-
- Windows should now change to the directory C:\path-to-workspace\phpdev\VSXX\XARCH, and consider it the root of the workspace for the current build.
-
-
- The next step for everyone is to obtain the versioned PHP sources via git:
-
-
-
- BRANCH should be replaced with an appropriate branch name, for example, PHP-8.5.
-
-
- At this point you have a working build environment and the vanilla sources for your chosen branch of PHP, it is a good idea, before you change anything at all, to create a new branch and switch to it, in preparation for your awesome changes to come.
-
-
-
-
-
-
-
-
- All operating systems now converge on (near as makes no difference) the same solutions for the rest of the build process:
-
-
- buildconf: generates the configure script for PHP
- configure: configures the build of PHP and creates Makefile
- make: builds PHP
- make test: runs testsuite
- make install: installs PHP
-
-
- For Microsoft Windows operating systems, those commands look like this:
-
-
-
- While for the rest of us, those commands look like this:
-
-
-
- The configure script can customize almost every aspect of PHP, to elicit help at the console pass --help
- as the only argument to configure
-
- When configure executes, it saves the options passed in to a re-usable config.nice which executes configure when invoked.
-
-
- Upon successful completion of a build, it is recommended to run the test suite; this will help you to identify regression problems in your work,
- running the test suite can take a while; go out for a run, or a burger.
-
-
- It is also possible to run a set (directory) of tests in the following way:
-
-
-
- $SIDEBAR_DATA]);
diff --git a/composer.json b/composer.json
index 3dab8c84cc..187145c510 100644
--- a/composer.json
+++ b/composer.json
@@ -8,10 +8,12 @@
"source": "https://github.com/php/web-php"
},
"require": {
- "php": "~8.2.0"
+ "php": "~8.4.0",
+ "ext-dom": "*"
},
"require-dev": {
"ext-curl": "*",
+ "phpstan/phpstan": "*",
"friendsofphp/php-cs-fixer": "^3.95.4",
"phpunit/phpunit": "^11.5.50"
},
@@ -27,8 +29,9 @@
},
"config": {
"platform": {
- "php": "8.2.0"
+ "php": "8.4.0"
},
- "sort-packages": true
+ "sort-packages": true,
+ "vendor-dir": "var/composer"
}
}
diff --git a/composer.lock b/composer.lock
index 89ea0775ae..c09d1af79b 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
"This file is @generated automatically"
],
- "content-hash": "280fe9d13360b92d08e3f0620566e9e1",
+ "content-hash": "a66bc998652d2a106a37a3e30e4f0434",
"packages": [],
"packages-dev": [
{
@@ -472,16 +472,16 @@
},
{
"name": "friendsofphp/php-cs-fixer",
- "version": "v3.95.4",
+ "version": "v3.95.5",
"source": {
"type": "git",
"url": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer.git",
- "reference": "3f8f68856837a77e1f1d870354eca3c8747f2f72"
+ "reference": "7f86d8763063f5d2e2e2d0e1e45bb2f15895361d"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/PHP-CS-Fixer/PHP-CS-Fixer/zipball/3f8f68856837a77e1f1d870354eca3c8747f2f72",
- "reference": "3f8f68856837a77e1f1d870354eca3c8747f2f72",
+ "url": "https://api.github.com/repos/PHP-CS-Fixer/PHP-CS-Fixer/zipball/7f86d8763063f5d2e2e2d0e1e45bb2f15895361d",
+ "reference": "7f86d8763063f5d2e2e2d0e1e45bb2f15895361d",
"shasum": ""
},
"require": {
@@ -499,7 +499,7 @@
"react/event-loop": "^1.5",
"react/socket": "^1.16",
"react/stream": "^1.4",
- "sebastian/diff": "^4.0.6 || ^5.1.1 || ^6.0.2 || ^7.0 || ^8.0",
+ "sebastian/diff": "^4.0.6 || ^5.1.1 || ^6.0.2 || ^7.0 || ^8.0 || ^9.0",
"symfony/console": "^5.4.47 || ^6.4.24 || ^7.0 || ^8.0",
"symfony/event-dispatcher": "^5.4.45 || ^6.4.24 || ^7.0 || ^8.0",
"symfony/filesystem": "^5.4.45 || ^6.4.24 || ^7.0 || ^8.0",
@@ -565,7 +565,7 @@
],
"support": {
"issues": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/issues",
- "source": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/tree/v3.95.4"
+ "source": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/tree/v3.95.5"
},
"funding": [
{
@@ -573,7 +573,7 @@
"type": "github"
}
],
- "time": "2026-06-03T18:02:44+00:00"
+ "time": "2026-06-09T14:55:16+00:00"
},
{
"name": "myclabs/deep-copy",
@@ -811,6 +811,70 @@
},
"time": "2022-02-21T01:04:05+00:00"
},
+ {
+ "name": "phpstan/phpstan",
+ "version": "2.2.2",
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/phpstan/phpstan/zipball/e5cc34d491a90e79c216d824f60fe21fd4d93bd6",
+ "reference": "e5cc34d491a90e79c216d824f60fe21fd4d93bd6",
+ "shasum": ""
+ },
+ "require": {
+ "php": "^7.4|^8.0"
+ },
+ "conflict": {
+ "phpstan/phpstan-shim": "*"
+ },
+ "bin": [
+ "phpstan",
+ "phpstan.phar"
+ ],
+ "type": "library",
+ "autoload": {
+ "files": [
+ "bootstrap.php"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Ondřej Mirtes"
+ },
+ {
+ "name": "Markus Staab"
+ },
+ {
+ "name": "Vincent Langlet"
+ }
+ ],
+ "description": "PHPStan - PHP Static Analysis Tool",
+ "keywords": [
+ "dev",
+ "static analysis"
+ ],
+ "support": {
+ "docs": "https://phpstan.org/user-guide/getting-started",
+ "forum": "https://github.com/phpstan/phpstan/discussions",
+ "issues": "https://github.com/phpstan/phpstan/issues",
+ "security": "https://github.com/phpstan/phpstan/security/policy",
+ "source": "https://github.com/phpstan/phpstan-src"
+ },
+ "funding": [
+ {
+ "url": "https://github.com/ondrejmirtes",
+ "type": "github"
+ },
+ {
+ "url": "https://github.com/phpstan",
+ "type": "github"
+ }
+ ],
+ "time": "2026-06-05T09:00:01+00:00"
+ },
{
"name": "phpunit/php-code-coverage",
"version": "11.0.12",
@@ -903,28 +967,28 @@
},
{
"name": "phpunit/php-file-iterator",
- "version": "5.1.0",
+ "version": "5.1.1",
"source": {
"type": "git",
"url": "https://github.com/sebastianbergmann/php-file-iterator.git",
- "reference": "118cfaaa8bc5aef3287bf315b6060b1174754af6"
+ "reference": "2f3a64888c814fc235386b7387dd5b5ed92ad903"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/php-file-iterator/zipball/118cfaaa8bc5aef3287bf315b6060b1174754af6",
- "reference": "118cfaaa8bc5aef3287bf315b6060b1174754af6",
+ "url": "https://api.github.com/repos/sebastianbergmann/php-file-iterator/zipball/2f3a64888c814fc235386b7387dd5b5ed92ad903",
+ "reference": "2f3a64888c814fc235386b7387dd5b5ed92ad903",
"shasum": ""
},
"require": {
"php": ">=8.2"
},
"require-dev": {
- "phpunit/phpunit": "^11.0"
+ "phpunit/phpunit": "^11.3"
},
"type": "library",
"extra": {
"branch-alias": {
- "dev-main": "5.0-dev"
+ "dev-main": "5.1-dev"
}
},
"autoload": {
@@ -952,15 +1016,27 @@
"support": {
"issues": "https://github.com/sebastianbergmann/php-file-iterator/issues",
"security": "https://github.com/sebastianbergmann/php-file-iterator/security/policy",
- "source": "https://github.com/sebastianbergmann/php-file-iterator/tree/5.1.0"
+ "source": "https://github.com/sebastianbergmann/php-file-iterator/tree/5.1.1"
},
"funding": [
{
"url": "https://github.com/sebastianbergmann",
"type": "github"
+ },
+ {
+ "url": "https://liberapay.com/sebastianbergmann",
+ "type": "liberapay"
+ },
+ {
+ "url": "https://thanks.dev/u/gh/sebastianbergmann",
+ "type": "thanks_dev"
+ },
+ {
+ "url": "https://tidelift.com/funding/github/packagist/phpunit/php-file-iterator",
+ "type": "tidelift"
}
],
- "time": "2024-08-27T05:02:59+00:00"
+ "time": "2026-02-02T13:52:54+00:00"
},
{
"name": "phpunit/php-invoker",
@@ -1148,16 +1224,16 @@
},
{
"name": "phpunit/phpunit",
- "version": "11.5.50",
+ "version": "11.5.55",
"source": {
"type": "git",
"url": "https://github.com/sebastianbergmann/phpunit.git",
- "reference": "fdfc727f0fcacfeb8fcb30c7e5da173125b58be3"
+ "reference": "adc7262fccc12de2b30f12a8aa0b33775d814f00"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/fdfc727f0fcacfeb8fcb30c7e5da173125b58be3",
- "reference": "fdfc727f0fcacfeb8fcb30c7e5da173125b58be3",
+ "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00",
+ "reference": "adc7262fccc12de2b30f12a8aa0b33775d814f00",
"shasum": ""
},
"require": {
@@ -1172,7 +1248,7 @@
"phar-io/version": "^3.2.1",
"php": ">=8.2",
"phpunit/php-code-coverage": "^11.0.12",
- "phpunit/php-file-iterator": "^5.1.0",
+ "phpunit/php-file-iterator": "^5.1.1",
"phpunit/php-invoker": "^5.0.1",
"phpunit/php-text-template": "^4.0.1",
"phpunit/php-timer": "^7.0.1",
@@ -1184,6 +1260,7 @@
"sebastian/exporter": "^6.3.2",
"sebastian/global-state": "^7.0.2",
"sebastian/object-enumerator": "^6.0.1",
+ "sebastian/recursion-context": "^6.0.3",
"sebastian/type": "^5.1.3",
"sebastian/version": "^5.0.2",
"staabm/side-effects-detector": "^1.0.5"
@@ -1229,7 +1306,7 @@
"support": {
"issues": "https://github.com/sebastianbergmann/phpunit/issues",
"security": "https://github.com/sebastianbergmann/phpunit/security/policy",
- "source": "https://github.com/sebastianbergmann/phpunit/tree/11.5.50"
+ "source": "https://github.com/sebastianbergmann/phpunit/tree/11.5.55"
},
"funding": [
{
@@ -1253,7 +1330,7 @@
"type": "tidelift"
}
],
- "time": "2026-01-27T05:59:18+00:00"
+ "time": "2026-02-18T12:37:06+00:00"
},
{
"name": "psr/container",
@@ -2974,47 +3051,39 @@
},
{
"name": "symfony/console",
- "version": "v7.4.13",
+ "version": "v8.0.13",
"source": {
"type": "git",
"url": "https://github.com/symfony/console.git",
- "reference": "85095d2573eaefaf35e40b9513a9bf09f72cd217"
+ "reference": "f200be111431cff4aeae8d086b91180bc4d7efd7"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/console/zipball/85095d2573eaefaf35e40b9513a9bf09f72cd217",
- "reference": "85095d2573eaefaf35e40b9513a9bf09f72cd217",
+ "url": "https://api.github.com/repos/symfony/console/zipball/f200be111431cff4aeae8d086b91180bc4d7efd7",
+ "reference": "f200be111431cff4aeae8d086b91180bc4d7efd7",
"shasum": ""
},
"require": {
- "php": ">=8.2",
- "symfony/deprecation-contracts": "^2.5|^3",
- "symfony/polyfill-mbstring": "~1.0",
+ "php": ">=8.4",
+ "symfony/polyfill-mbstring": "^1.0",
"symfony/service-contracts": "^2.5|^3",
- "symfony/string": "^7.2|^8.0"
- },
- "conflict": {
- "symfony/dependency-injection": "<6.4",
- "symfony/dotenv": "<6.4",
- "symfony/event-dispatcher": "<6.4",
- "symfony/lock": "<6.4",
- "symfony/process": "<6.4"
+ "symfony/string": "^7.4|^8.0"
},
"provide": {
"psr/log-implementation": "1.0|2.0|3.0"
},
"require-dev": {
"psr/log": "^1|^2|^3",
- "symfony/config": "^6.4|^7.0|^8.0",
- "symfony/dependency-injection": "^6.4|^7.0|^8.0",
- "symfony/event-dispatcher": "^6.4|^7.0|^8.0",
- "symfony/http-foundation": "^6.4|^7.0|^8.0",
- "symfony/http-kernel": "^6.4|^7.0|^8.0",
- "symfony/lock": "^6.4|^7.0|^8.0",
- "symfony/messenger": "^6.4|^7.0|^8.0",
- "symfony/process": "^6.4|^7.0|^8.0",
- "symfony/stopwatch": "^6.4|^7.0|^8.0",
- "symfony/var-dumper": "^6.4|^7.0|^8.0"
+ "symfony/config": "^7.4|^8.0",
+ "symfony/dependency-injection": "^7.4|^8.0",
+ "symfony/event-dispatcher": "^7.4|^8.0",
+ "symfony/http-foundation": "^7.4|^8.0",
+ "symfony/http-kernel": "^7.4|^8.0",
+ "symfony/lock": "^7.4|^8.0",
+ "symfony/messenger": "^7.4|^8.0",
+ "symfony/process": "^7.4|^8.0",
+ "symfony/stopwatch": "^7.4|^8.0",
+ "symfony/var-dumper": "^7.4|^8.0"
},
"type": "library",
"autoload": {
@@ -3048,7 +3117,7 @@
"terminal"
],
"support": {
- "source": "https://github.com/symfony/console/tree/v7.4.13"
+ "source": "https://github.com/symfony/console/tree/v8.0.13"
},
"funding": [
{
@@ -3068,7 +3137,7 @@
"type": "tidelift"
}
],
- "time": "2026-05-24T08:56:14+00:00"
+ "time": "2026-05-24T08:59:15+00:00"
},
{
"name": "symfony/deprecation-contracts",
@@ -3143,24 +3212,24 @@
},
{
"name": "symfony/event-dispatcher",
- "version": "v7.4.9",
+ "version": "v8.0.9",
"source": {
"type": "git",
"url": "https://github.com/symfony/event-dispatcher.git",
- "reference": "e4a2e29753c7801f7a8340e066cfa788f3bc8101"
+ "reference": "0c3c1a17604c4dbbec4b93fe162c538482096e1f"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/event-dispatcher/zipball/e4a2e29753c7801f7a8340e066cfa788f3bc8101",
- "reference": "e4a2e29753c7801f7a8340e066cfa788f3bc8101",
+ "url": "https://api.github.com/repos/symfony/event-dispatcher/zipball/0c3c1a17604c4dbbec4b93fe162c538482096e1f",
+ "reference": "0c3c1a17604c4dbbec4b93fe162c538482096e1f",
"shasum": ""
},
"require": {
- "php": ">=8.2",
+ "php": ">=8.4",
"symfony/event-dispatcher-contracts": "^2.5|^3"
},
"conflict": {
- "symfony/dependency-injection": "<6.4",
+ "symfony/security-http": "<7.4",
"symfony/service-contracts": "<2.5"
},
"provide": {
@@ -3169,14 +3238,14 @@
},
"require-dev": {
"psr/log": "^1|^2|^3",
- "symfony/config": "^6.4|^7.0|^8.0",
- "symfony/dependency-injection": "^6.4|^7.0|^8.0",
- "symfony/error-handler": "^6.4|^7.0|^8.0",
- "symfony/expression-language": "^6.4|^7.0|^8.0",
- "symfony/framework-bundle": "^6.4|^7.0|^8.0",
- "symfony/http-foundation": "^6.4|^7.0|^8.0",
+ "symfony/config": "^7.4|^8.0",
+ "symfony/dependency-injection": "^7.4|^8.0",
+ "symfony/error-handler": "^7.4|^8.0",
+ "symfony/expression-language": "^7.4|^8.0",
+ "symfony/framework-bundle": "^7.4|^8.0",
+ "symfony/http-foundation": "^7.4|^8.0",
"symfony/service-contracts": "^2.5|^3",
- "symfony/stopwatch": "^6.4|^7.0|^8.0"
+ "symfony/stopwatch": "^7.4|^8.0"
},
"type": "library",
"autoload": {
@@ -3204,7 +3273,7 @@
"description": "Provides tools that allow your application components to communicate with each other by dispatching events and listening to them",
"homepage": "https://symfony.com",
"support": {
- "source": "https://github.com/symfony/event-dispatcher/tree/v7.4.9"
+ "source": "https://github.com/symfony/event-dispatcher/tree/v8.0.9"
},
"funding": [
{
@@ -3224,7 +3293,7 @@
"type": "tidelift"
}
],
- "time": "2026-04-18T13:18:21+00:00"
+ "time": "2026-04-18T13:51:42+00:00"
},
{
"name": "symfony/event-dispatcher-contracts",
@@ -3308,25 +3377,25 @@
},
{
"name": "symfony/filesystem",
- "version": "v7.4.11",
+ "version": "v8.0.11",
"source": {
"type": "git",
"url": "https://github.com/symfony/filesystem.git",
- "reference": "d721ea61b4a5fba8c5b6e7c1feda19efea144b50"
+ "reference": "224db910898ce1317b892a9a1338f1f8f17eb7c7"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/filesystem/zipball/d721ea61b4a5fba8c5b6e7c1feda19efea144b50",
- "reference": "d721ea61b4a5fba8c5b6e7c1feda19efea144b50",
+ "url": "https://api.github.com/repos/symfony/filesystem/zipball/224db910898ce1317b892a9a1338f1f8f17eb7c7",
+ "reference": "224db910898ce1317b892a9a1338f1f8f17eb7c7",
"shasum": ""
},
"require": {
- "php": ">=8.2",
+ "php": ">=8.4",
"symfony/polyfill-ctype": "~1.8",
"symfony/polyfill-mbstring": "~1.8"
},
"require-dev": {
- "symfony/process": "^6.4|^7.0|^8.0"
+ "symfony/process": "^7.4|^8.0"
},
"type": "library",
"autoload": {
@@ -3354,7 +3423,7 @@
"description": "Provides basic utilities for the filesystem",
"homepage": "https://symfony.com",
"support": {
- "source": "https://github.com/symfony/filesystem/tree/v7.4.11"
+ "source": "https://github.com/symfony/filesystem/tree/v8.0.11"
},
"funding": [
{
@@ -3374,27 +3443,27 @@
"type": "tidelift"
}
],
- "time": "2026-05-11T16:38:44+00:00"
+ "time": "2026-05-11T16:39:47+00:00"
},
{
"name": "symfony/finder",
- "version": "v7.4.8",
+ "version": "v8.0.8",
"source": {
"type": "git",
"url": "https://github.com/symfony/finder.git",
- "reference": "e0be088d22278583a82da281886e8c3592fbf149"
+ "reference": "8da41214757b87d97f181e3d14a4179286151007"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/finder/zipball/e0be088d22278583a82da281886e8c3592fbf149",
- "reference": "e0be088d22278583a82da281886e8c3592fbf149",
+ "url": "https://api.github.com/repos/symfony/finder/zipball/8da41214757b87d97f181e3d14a4179286151007",
+ "reference": "8da41214757b87d97f181e3d14a4179286151007",
"shasum": ""
},
"require": {
- "php": ">=8.2"
+ "php": ">=8.4"
},
"require-dev": {
- "symfony/filesystem": "^6.4|^7.0|^8.0"
+ "symfony/filesystem": "^7.4|^8.0"
},
"type": "library",
"autoload": {
@@ -3422,7 +3491,7 @@
"description": "Finds files and directories via an intuitive fluent interface",
"homepage": "https://symfony.com",
"support": {
- "source": "https://github.com/symfony/finder/tree/v7.4.8"
+ "source": "https://github.com/symfony/finder/tree/v8.0.8"
},
"funding": [
{
@@ -3442,24 +3511,24 @@
"type": "tidelift"
}
],
- "time": "2026-03-24T13:12:05+00:00"
+ "time": "2026-03-30T15:14:47+00:00"
},
{
"name": "symfony/options-resolver",
- "version": "v7.4.8",
+ "version": "v8.0.8",
"source": {
"type": "git",
"url": "https://github.com/symfony/options-resolver.git",
- "reference": "2888fcdc4dc2fd5f7c7397be78631e8af12e02b4"
+ "reference": "b48bce0a70b914f6953dafbd10474df232ed4de8"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/options-resolver/zipball/2888fcdc4dc2fd5f7c7397be78631e8af12e02b4",
- "reference": "2888fcdc4dc2fd5f7c7397be78631e8af12e02b4",
+ "url": "https://api.github.com/repos/symfony/options-resolver/zipball/b48bce0a70b914f6953dafbd10474df232ed4de8",
+ "reference": "b48bce0a70b914f6953dafbd10474df232ed4de8",
"shasum": ""
},
"require": {
- "php": ">=8.2",
+ "php": ">=8.4",
"symfony/deprecation-contracts": "^2.5|^3"
},
"type": "library",
@@ -3493,7 +3562,7 @@
"options"
],
"support": {
- "source": "https://github.com/symfony/options-resolver/tree/v7.4.8"
+ "source": "https://github.com/symfony/options-resolver/tree/v8.0.8"
},
"funding": [
{
@@ -3513,7 +3582,7 @@
"type": "tidelift"
}
],
- "time": "2026-03-24T13:12:05+00:00"
+ "time": "2026-03-30T15:14:47+00:00"
},
{
"name": "symfony/polyfill-ctype",
@@ -3767,16 +3836,16 @@
},
{
"name": "symfony/polyfill-mbstring",
- "version": "v1.38.1",
+ "version": "v1.38.2",
"source": {
"type": "git",
"url": "https://github.com/symfony/polyfill-mbstring.git",
- "reference": "14c5439eec4ccff081ac14eca2dc57feb2a66d92"
+ "reference": "d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/14c5439eec4ccff081ac14eca2dc57feb2a66d92",
- "reference": "14c5439eec4ccff081ac14eca2dc57feb2a66d92",
+ "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6",
+ "reference": "d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6",
"shasum": ""
},
"require": {
@@ -3828,7 +3897,7 @@
"shim"
],
"support": {
- "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.38.1"
+ "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.38.2"
},
"funding": [
{
@@ -3848,7 +3917,7 @@
"type": "tidelift"
}
],
- "time": "2026-05-26T12:51:13+00:00"
+ "time": "2026-05-27T06:59:30+00:00"
},
{
"name": "symfony/polyfill-php80",
@@ -4096,20 +4165,20 @@
},
{
"name": "symfony/process",
- "version": "v7.4.13",
+ "version": "v8.0.13",
"source": {
"type": "git",
"url": "https://github.com/symfony/process.git",
- "reference": "f5804be144caceb570f6747519999636b664f24c"
+ "reference": "4f23d9c7637ead9ed19f697fe93cb87fd9b379d4"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/process/zipball/f5804be144caceb570f6747519999636b664f24c",
- "reference": "f5804be144caceb570f6747519999636b664f24c",
+ "url": "https://api.github.com/repos/symfony/process/zipball/4f23d9c7637ead9ed19f697fe93cb87fd9b379d4",
+ "reference": "4f23d9c7637ead9ed19f697fe93cb87fd9b379d4",
"shasum": ""
},
"require": {
- "php": ">=8.2"
+ "php": ">=8.4"
},
"type": "library",
"autoload": {
@@ -4137,7 +4206,7 @@
"description": "Executes commands in sub-processes",
"homepage": "https://symfony.com",
"support": {
- "source": "https://github.com/symfony/process/tree/v7.4.13"
+ "source": "https://github.com/symfony/process/tree/v8.0.13"
},
"funding": [
{
@@ -4157,7 +4226,7 @@
"type": "tidelift"
}
],
- "time": "2026-05-23T16:05:06+00:00"
+ "time": "2026-05-23T18:05:53+00:00"
},
{
"name": "symfony/service-contracts",
@@ -4248,20 +4317,20 @@
},
{
"name": "symfony/stopwatch",
- "version": "v7.4.8",
+ "version": "v8.0.8",
"source": {
"type": "git",
"url": "https://github.com/symfony/stopwatch.git",
- "reference": "70a852d72fec4d51efb1f48dcd968efcaf5ccb89"
+ "reference": "85954ed72d5440ea4dc9a10b7e49e01df766ffa3"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/stopwatch/zipball/70a852d72fec4d51efb1f48dcd968efcaf5ccb89",
- "reference": "70a852d72fec4d51efb1f48dcd968efcaf5ccb89",
+ "url": "https://api.github.com/repos/symfony/stopwatch/zipball/85954ed72d5440ea4dc9a10b7e49e01df766ffa3",
+ "reference": "85954ed72d5440ea4dc9a10b7e49e01df766ffa3",
"shasum": ""
},
"require": {
- "php": ">=8.2",
+ "php": ">=8.4",
"symfony/service-contracts": "^2.5|^3"
},
"type": "library",
@@ -4290,7 +4359,7 @@
"description": "Provides a way to profile code",
"homepage": "https://symfony.com",
"support": {
- "source": "https://github.com/symfony/stopwatch/tree/v7.4.8"
+ "source": "https://github.com/symfony/stopwatch/tree/v8.0.8"
},
"funding": [
{
@@ -4310,39 +4379,38 @@
"type": "tidelift"
}
],
- "time": "2026-03-24T13:12:05+00:00"
+ "time": "2026-03-30T15:14:47+00:00"
},
{
"name": "symfony/string",
- "version": "v7.4.13",
+ "version": "v8.0.13",
"source": {
"type": "git",
"url": "https://github.com/symfony/string.git",
- "reference": "961683010db3b27ec6ebcd7308e6e1ee8fa7ffde"
+ "reference": "f2e3e4d33579350d1b12001ef2872f86b27ed3dc"
},
"dist": {
"type": "zip",
- "url": "https://api.github.com/repos/symfony/string/zipball/961683010db3b27ec6ebcd7308e6e1ee8fa7ffde",
- "reference": "961683010db3b27ec6ebcd7308e6e1ee8fa7ffde",
+ "url": "https://api.github.com/repos/symfony/string/zipball/f2e3e4d33579350d1b12001ef2872f86b27ed3dc",
+ "reference": "f2e3e4d33579350d1b12001ef2872f86b27ed3dc",
"shasum": ""
},
"require": {
- "php": ">=8.2",
- "symfony/deprecation-contracts": "^2.5|^3.0",
- "symfony/polyfill-ctype": "~1.8",
- "symfony/polyfill-intl-grapheme": "~1.33",
- "symfony/polyfill-intl-normalizer": "~1.0",
- "symfony/polyfill-mbstring": "~1.0"
+ "php": ">=8.4",
+ "symfony/polyfill-ctype": "^1.8",
+ "symfony/polyfill-intl-grapheme": "^1.33",
+ "symfony/polyfill-intl-normalizer": "^1.0",
+ "symfony/polyfill-mbstring": "^1.0"
},
"conflict": {
"symfony/translation-contracts": "<2.5"
},
"require-dev": {
- "symfony/emoji": "^7.1|^8.0",
- "symfony/http-client": "^6.4|^7.0|^8.0",
- "symfony/intl": "^6.4|^7.0|^8.0",
+ "symfony/emoji": "^7.4|^8.0",
+ "symfony/http-client": "^7.4|^8.0",
+ "symfony/intl": "^7.4|^8.0",
"symfony/translation-contracts": "^2.5|^3.0",
- "symfony/var-exporter": "^6.4|^7.0|^8.0"
+ "symfony/var-exporter": "^7.4|^8.0"
},
"type": "library",
"autoload": {
@@ -4381,7 +4449,7 @@
"utf8"
],
"support": {
- "source": "https://github.com/symfony/string/tree/v7.4.13"
+ "source": "https://github.com/symfony/string/tree/v8.0.13"
},
"funding": [
{
@@ -4401,7 +4469,7 @@
"type": "tidelift"
}
],
- "time": "2026-05-23T15:23:29+00:00"
+ "time": "2026-05-23T18:05:53+00:00"
},
{
"name": "theseer/tokenizer",
@@ -4460,13 +4528,14 @@
"prefer-stable": false,
"prefer-lowest": false,
"platform": {
- "php": "~8.2.0"
+ "php": "~8.4.0",
+ "ext-dom": "*"
},
"platform-dev": {
"ext-curl": "*"
},
"platform-overrides": {
- "php": "8.2.0"
+ "php": "8.4.0"
},
"plugin-api-version": "2.9.0"
}
diff --git a/contact.php b/contact.php
deleted file mode 100644
index 6e0e7b8e21..0000000000
--- a/contact.php
+++ /dev/null
@@ -1,64 +0,0 @@
- "community"]);
-?>
-
-
-Advertising at PHP.net and mirror sites
-
-
- The maintainers of PHP.net are definitely not interested in graphical
- banner or text ad placement deals.
-
-
-
-Contact
-
-
- Please report problems you find on PHP.net and mirror sites on GitHub.
- This allows us to follow the progress of the
- problem until it is fixed.
-
-
- For security related issues (in PHP or our websites) please contact security@php.net, or report a vulnerability on
- GitHub.
-
-
- We have published a Vulnerability Disclosure
- Policy.
-
-
- Please note that the following are NOT security issues:
-
- - Requests for help with using PHP. Please use the
- PHP General mailing list.
- - Source code to the PHP website(s) being publicly readable.
- This is on purpose.
- All of the php.net websites are available publicly on github.
- For example, you can find this site at github.com/php/web-php.
- - Requests for bug bounty payments.
- PHP is run by volunteers with literally zero budget.
- The servers are donated hardware and bandwidth.
- Your bug reports and patches are appreciated, but we can not pay you for them.
-
-
-
- If you have problems setting up PHP or using some functionality,
- or especially a program written in PHP, please ask your question on a
- support channel, since the webmasters will
- not answer any such questions.
-
-
- If you would like to contact the webmasters for some other reason, please
- write to php-webmaster@lists.php.net.
- Note that this address is mapped to a mailing list and a newsgroup, so
- every message you send will be stored in public archives at multiple
- servers.
-
-
-
diff --git a/copyright.php b/copyright.php
deleted file mode 100644
index 57233ded2c..0000000000
--- a/copyright.php
+++ /dev/null
@@ -1,52 +0,0 @@
- "footer"]);
-?>
-
-
-Website Copyright
-
-
- The code, text, PHP logo, and graphical elements on this website
- and the mirror websites (the "Site") are Copyright © 2001-
- the PHP Group. All rights reserved.
-
-
-
- Except as otherwise indicated elsewhere on this Site, you are free
- to view, download and print the documents and information available
- on this Site subject to the following conditions:
-
-
-
- -
- You may not remove any copyright or other proprietary notices
- contained in the documents and information on this Site.
-
- -
- The rights granted to you constitute a license and not a transfer
- of title.
-
- -
- The rights specified above to view, download and print the
- documents and information available on this Site are not applicable
- to the graphical elements, design or layout of this Site. These
- elements of the Site are protected by trade dress and other laws
- and may not be copied or imitated in whole or in part.
-
-
-
-
- For more information on the PHP Group and the PHP project, please see
- the PHP homepage.
-
-
-PHP Manual
-
-
- The PHP Manual is covered by a separate license, which is available
- from within the manual itself.
-
-
-(.*)