Sitewide Search

ZendPHP July 2023 Releases
July 11, 2023
Added Platform Support

Added AlmaLinux 9 support to ZendPHP

Added CentOS Stream 9 support to ZendPHP

Added Rocky Linux 9 support to ZendPHP

Added Oracle Linux 9 support to ZendPHP

Added Debian 12 support to ZendPHP

Added Container Registry Support

Added AlmaLinux 9 container images to cr.zend.com

Added Rocky Linux 9 container images to cr.zend.com

Added Debian 12 container images to cr.zend.com

Community Fixes for ZendPHP 8.2.8

CLI

Fixed bug GH-11246: cli/get_set_process_title fails on MacOS.

Core

Fixed build for the riscv64 architecture/GCC 12.

Curl

Fixed bug GH-11433: Unable to set CURLOPT_ACCEPT_ENCODING to NULL.

Date

Fixed bug GH-11455: Segmentation fault with custom object date properties.

DOM

Fixed bugs GH-11288 and GH-11289 and GH-11290 and GH-9142: DOMExceptions and segfaults with replaceWith.

Fixed bug GH-10234: Setting DOMAttr::textContent results in an empty attribute value.

Fix return value in stub file for DOMNodeList::item.

Fix spec compliance error with '*' namespace for DOMDocument::getElementsByTagNameNS.

Fix DOMElement::append() and DOMElement::prepend() hierarchy checks.

Fixed bug GH-11347: Memory leak when calling a static method inside an xpath query.

Fixed bug #67440: append_node of a DOMDocumentFragment does not reconcile namespaces.

Fixed bug #81642: DOMChildNode::replaceWith() bug when replacing a node with itself.

Fixed bug #77686: Removed elements are still returned by getElementById.

Fixed bug #70359: print_r() on DOMAttr causes Segfault in php_libxml_node_free_list().

Fixed bug #78577: Crash in DOMNameSpace debug info handlers.

Fix lifetime issue with getAttributeNodeNS().

Fix "invalid state error" with cloned namespace declarations.

Fixed bug #55294 and #47530 and #47847: various namespace reconciliation issues.

Fixed bug #80332: Completely broken array access functionality with DOMNamedNodeMap.

Opcache

Fix allocation loop in zend_shared_alloc_startup().

Access violation on smm_shared_globals with ALLOC_FALLBACK.

Fixed bug GH-11336: php still tries to unlock the shared memory ZendSem with opcache.file_cache_only=1 but it was never locked.

OpenSSL

Fixed bug GH-9356: Incomplete validation of IPv6 Address fields in subjectAltNames

PCRE

Fix preg_replace_callback_array() pattern validation.

PGSQL

Fixed intermittent segfault with pg_trace.

Phar

Fix cross-compilation check in phar generation for FreeBSD.

SPL

Fixed bug GH-11338: SplFileInfo empty getBasename with more than one slash.

Standard

Fix access on NULL pointer in array_merge_recursive().

Fix exception handling in array_multisort().

SQLite3

Fixed bug GH-11451: Invalid associative array containing duplicate keys.

Community Fixes for ZendPHP 8.1.21

CLI

Fixed bug GH-11246: cli/get_set_process_title fails on MacOS.

Core

Fixed build for the riscv64 architecture/GCC 12.

Curl

Fixed bug GH-11433: Unable to set CURLOPT_ACCEPT_ENCODING to NULL.

DOM

Fixed bugs GH-11288 and GH-11289 and GH-11290 and GH-9142: DOMExceptions and segfaults with replaceWith.

Fixed bug GH-10234: Setting DOMAttr::textContent results in an empty attribute value.

Fix return value in stub file for DOMNodeList::item.

Fix spec compliance error with '*' namespace for DOMDocument::getElementsByTagNameNS.

Fix DOMElement::append() and DOMElement::prepend() hierarchy checks.

Fixed bug GH-11347: Memory leak when calling a static method inside an xpath query.

Fixed bug #67440: append_node of a DOMDocumentFragment does not reconcile namespaces.

Fixed bug #81642: DOMChildNode::replaceWith() bug when replacing a node with itself.

Fixed bug #77686: Removed elements are still returned by getElementById.

Fixed bug #70359: print_r() on DOMAttr causes Segfault in php_libxml_node_free_list().

Fixed bug #78577: Crash in DOMNameSpace debug info handlers.

Fix lifetime issue with getAttributeNodeNS().

Fix "invalid state error" with cloned namespace declarations.

Fixed bug #55294 and #47530 and #47847: various namespace reconciliation issues.

Fixed bug #80332: Completely broken array access functionality with DOMNamedNodeMap.

Opcache

Fix allocation loop in zend_shared_alloc_startup().

Access violation on smm_shared_globals with ALLOC_FALLBACK.

Fixed bug GH-11336: php still tries to unlock the shared memory ZendSem with opcache.file_cache_only=1 but it was never locked.

OpenSSL

Fixed bug GH-9356: Incomplete validation of IPv6 Address fields in subjectAltNames

PGSQL

Fixed intermittent segfault with pg_trace.

Phar

Fix cross-compilation check in phar generation for FreeBSD.

SPL

Fixed bug GH-11338: SplFileInfo empty getBasename with more than one slash.

Standard

Fix access on NULL pointer in array_merge_recursive().

Fix exception handling in array_multisort().
ZendPHP June 2024 Releases
June 5, 2024
ZendPHP Changes

Added

Alpine 3.20 support

Ubuntu 24.04 support

Removed

Alpine 3.16 support

Ubuntu 18.04 support

PHP version 7.2.34.19, 7.3.33.11, 7.4.33.6, 8.0.30.2 changes

Functionality improvements for upgrading IBM i

Community CVE Fixes

PHP version 8.3.8, 8.2.20, 8.1.29 CVE fixes

CGI

Fixed bug GHSA-3qgc-jrrr-25jv: Bypass of CVE-2012-1823, Argument Injection in PHP-CGI (CVE-2024-4577)

Filter

Fixed bug GHSA-w8qr-v226-r27w: Filter bypass in filter_var FILTER_VALIDATE_URL (CVE-2024-5458)

OpenSSL

The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. (CVE-2024-2408)

Standard

Fixed bug GHSA-9fcc-425m-g385: Bypass of CVE-2024-1874 (CVE-2024-5585)

Community Fixes

PHP version 8.3.8, 8.2.20 fixes

CGI

Fixed buffer limit on Windows, replacing read call usage by _read

CLI

Fixed bug GH-14189: PHP Interactive shell input state incorrectly handles quoted heredoc literals.

Core

Fixed bug GH-13970: Incorrect validation of #[Attribute] flags type for non-compile-time expressions

DOM

Fix crashes when entity declaration is removed while still having entity references.

Fix references not handled correctly in C14N

Fix crash when calling childNodes next() when iterator is exhausted.

Fix crash in ParentNode::append() when dealing with a fragment containing text nodes

FPM

Fix bug GH-14175: Show decimal number instead of scientific notation in systemd status

Hash

ext/hash: Swap the checking order of __has_builtin and __GNUC__

Intl

Fixed build regression on systems without C++17 compilers

MySQLnd

Fix bug GH-14255: mysqli_fetch_assoc reports error from nested query

Opcache

Fixed bug GH-14109: Fix accidental persisting of internal class constant in shm

XML

Fixed bug GH-14124: Segmentation fault with XML extension under certain memory limit

XMLReader

Fixed bug GH-14183: XMLReader::open() can't be overridden

PHP version 8.2.20 fixes

Core

Fixed bug GH-14140: Floating point bug in range operation on Apple Silicon hardware

FFI

Fixed bug GH-14215: Cannot use FFI::load on CRLF header file with apache2handler

Ini

Fixed bug GH-14100: Corrected spelling mistake in php.ini files

Backported PHP CVE Fixes

PHP version 7.2.34.19, 7.3.33.11, 7.4.33.6, 8.0.30.2 CVE fixes

CGI

Fixed bug GHSA-3qgc-jrrr-25jv: Bypass of CVE-2012-1823, Argument Injection in PHP-CGI (CVE-2024-4577)

Filter

Fixed bug GHSA-w8qr-v226-r27w: Filter bypass in filter_var FILTER_VALIDATE_URL (CVE-2024-5458)

PHP version 7.4.33.6, 8.0.30.2 CVE fixes

Standard

Fixed bug GHSA-9fcc-425m-g385: Bypass of CVE-2024-1874 (CVE-2024-5585)
ZendPHP November 2023 Releases
November 22, 2023
Added

Added Oracle 9 images to Zend container registry

Added RHEL 8 and 9 images to Zend container registry

Changed

PHP 8.0 packages and container images are now LTS, and only available via a ZendPHP subscription.

CentOS 7 images now include the EPEL repository, due to dependency changes for ZendHQ 1.5.0.

New Release: PHP 8.3

Please see our blog post on features, changes, and deprecations in PHP 8.3 for more detail.

Bcmath

Fixed GH-11761: removing trailing zeros from numbers

CLI

Added pdeathsig to builtin server to terminate workers when the master process is killed.

Fixed bug GH-11104: STDIN/STDOUT/STDERR is not available for CLI without a script.

Implement GH-10024: support linting multiple files at once using php -l.

Core:

Fix GH-11388: Allow final modifier when importing a method from a trait.

Fixed bug GH-11406: segfault with unpacking and magic method closure.

Fixed bug GH-9388: Improve unset property and __get type incompatibility error message.

SA_ONSTACK is now set for signal handlers to be friendlier to other in-process code such as Go's cgo.

SA_ONSTACK is now set when signals are disabled.

Fix GH-9649: Signal handlers now do a no-op instead of crashing when executed on threads not managed by TSRM.

Added shadow stack support for fibers.

Fix bug GH-9965: Fix accidental caching of default arguments with side effects.

Implement GH-10217: Use strlen() for determining the class_name length.

Fix bug GH-8821: Improve line numbers for errors in constant expressions.

Fix bug GH-10083: Allow comments between & and parameter.

Zend Max Execution Timers is now enabled by default for ZTS builds on Linux.

Fix bug GH-10469: Disallow .. in open_basedir paths set at runtime.

Fix bug GH-10168, GH-10582: Various segfaults with destructors and VM return values.

Fix bug GH-10935: Use of trait doesn't redeclare static property if class has inherited it from its parent.

Fix bug GH-11154: Negative indices on empty array don't affect next chosen index.

Fix bug GH-8846: Implement delayed early binding for classes without parents.

Fix bug #79836: Segfault in concat_function.

Fix bug #81705: type confusion/UAF on set_error_handler with concat operation.

Fix GH-11348: Closure created from magic method does not accept named arguments.

Fix GH-11388: Allow final modifier when importing a method from a trait.

Fixed bug GH-11406: segfault with unpacking and magic method closure.

Fixed bug GH-11507: String concatenation performance regression in 8.3.

Fixed GH-11488: Missing "Optional parameter before required" deprecation on union null type.

Implement the #[\Override] attribute RFC.

Fixed bug GH-11601: Incorrect handling of unwind and graceful exit exceptions.

Added zend_call_stack_get implementation for OpenBSD.

Add stack limit check in zend_eval_const_expr().

Expose time spent collecting cycles in gc_status().

Remove WeakMap entries whose key is only reachable through the entry value.

Resolve open_basedir paths on INI update.

Fixed oss-fuzz #60741: Leak in open_basedir.

Fixed segfault during freeing of some incompletely initialized objects due to OOM error (PDO, SPL, XSL).

Introduced Zend guard recursion protection to fix __debugInfo issue.

Fixed oss-fuzz #61712: assertion failure with error handler during binary op.

Fixed GH-11847: DTrace enabled build is broken.

Fixed OSS Fuzz #61865: Undef variable in ++/-- for declared property that is unset in error handler.

Fixed warning emitted when checking if a user stream is castable.

Fixed bug GH-12123: Compile error on MacOS with C++ extension when using ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX.

Fixed bug GH-12189: #[Override] attribute in trait does not check for parent class implementations.

Fixed OSS Fuzz #62294: Unsetting variable after ++/-- on string variable warning.

Fixed buffer underflow when compiling memoized expression.

Fixed oss-fuzz #63802: OP1 leak in error path of post inc/dec.

Curl

Added Curl options and constants up to (including) version 7.87.

Date

Implement "More Appropriate Date/Time Exceptions" RFC.

DOM

Fix bug GH-8388: DOMAttr unescapes character reference.

Fix bug GH-11308: getElementsByTagName() is O(N^2).

Fix #79700: wrong use of libxml oldNs leads to performance problem.

Fix #77894: DOMNode::C14N() very slow on generated DOMDocuments even after normalisation.

Revert changes to DOMAttr::$value and DOMAttr::$nodeValue expansion.

Fixed bug GH-11500: Namespace reuse in createElementNS() generates wrong output.

Implemented DOMDocument::adoptNode(). Previously this always threw a "not yet implemented" exception.

Fixed bug GH-9628: Implicitly removing nodes from \DOMDocument breaks existing references.

Added DOMNode::contains() and DOMNameSpaceNode::contains().

Added DOMElement::getAttributeNames().

Added DOMNode::getRootNode().

Added DOMElement::className and DOMElement::id.

Added DOMParentNode::replaceChildren().

Added DOMNode::isConnected and DOMNameSpaceNode::isConnected.

Added DOMNode::parentElement and DOMNameSpaceNode::parentElement.

Added DOMNode::isEqualNode().

Added DOMElement::insertAdjacentElement() and DOMElement::insertAdjacentText().

Added DOMElement::toggleAttribute().

Fixed bug GH-11792: LIBXML_NOXMLDECL is not implemented or broken.

adoptNode now respects the strict error checking property.

Align DOMChildNode parent checks with spec.

Fixed bug #80927: Removing documentElement after creating attribute node: possible use-after-free.

Fix various namespace prefix conflict resolution bugs.

Fix calling createAttributeNS() without prefix causing the default namespace of the element to change.

Fixed GH-11952: Confusing warning when blocking entity loading via libxml_set_external_entity_loader.

Fix broken cache invalidation with deallocated and reallocated document node.

Fix compile error when php_libxml.h header is included in C++.

Fixed bug #47531: No way of removing redundant xmlns: declarations.

Exif

Removed unneeded codepaths in exif_process_TIFF_in_JPEG().

FFI

Implement GH-11934: Allow to pass CData into struct and/or union fields.

Fileinfo

Upgrade bundled libmagic to 5.43.

Fix GH-11408: Unable to build PHP 8.3.0 alpha 1 / fileinfo extension.

FPM

The status.listen shared pool now uses the same php_values (including expose_php) and php_admin_value as the pool it is shared with.

Added warning to log when fpm socket was not registered on the expected path.

Fixed bug #76067: system() function call leaks php-fpm listening sockets.

Fixed GH-12077: PHP 8.3.0RC1 borked socket-close-on-exec.phpt.

GD

Removed imagerotate "ignore_transparent" argument since it has no effect.

Intl

Added pattern format error infos for numfmt_set_pattern.

Added MIXED_NUMBERS and HIDDEN_OVERLAY constants for the Spoofchecker's class.

Updated datefmt_set_timezone/IntlDateformatter::setTimezone returns type.

Updated IntlBreakInterator::setText return type.

Updated IntlChar::enumCharNames return type.

Removed the BC break on IntlDateFormatter::construct which threw an exception with an invalid locale.

JSON

Added json_validate().

LDAP

Deprecate calling ldap_connect() with separate hostname and port.

LibXML

Fix compile error with -Werror=incompatible-function-pointer-types and old libxml2.

MBString

mb_detect_encoding is better able to identify the correct encoding for Turkish text.

mb_detect_encoding's "non-strict" mode now behaves as described in the documentation. Previously, it would return false if the same byte (for example, the first byte) of the input string was invalid in all candidate encodings. More generally, it would eliminate candidate encodings from consideration when an invalid byte was seen, and if the same input byte eliminated all remaining encodings still under consideration, it would return false. On the other hand, if all candidate encodings but one were eliminated from consideration, it would return the last remaining one without regard for how many encoding errors might be encountered later in the string. This is different from the behavior described in the documentation, which says: "If strict is set to false, the closest matching encoding will be returned."

mb_strtolower, mb_strtotitle, and mb_convert_case implement conditional casing rules for the Greek letter sigma. For mb_convert_case, conditional casing only applies to MB_CASE_LOWER and MB_CASE_TITLE modes, not to MB_CASE_LOWER_SIMPLE and MB_CASE_TITLE_SIMPLE.

mb_detect_encoding is better able to identify UTF-8 and UTF-16 strings with a byte-order mark.

mb_decode_mimeheader interprets underscores in QPrint-encoded MIME encoded words as required by RFC 2047; they are converted to spaces. Underscores must be encoded as "=5F" in such MIME encoded words.

mb_encode_mimeheader no longer drops NUL (zero) bytes when QPrint-encoding the input string. This previously caused strings in certain text encodings, especially UTF-16 and UTF-32, to be corrupted by mb_encode_mimeheader.

Implement mb_str_pad() RFC.

Fixed bug GH-11514: PHP 8.3 build fails with --enable-mbstring enabled.

Fix use-after-free of mb_list_encodings() return value.

Fixed bug GH-11992: utf_encodings.phpt fails on Windows 32-bit.

mysqli

mysqli_fetch_object raises a ValueError instead of an Exception.

Opcache

Added start, restart and force restart time to opcache's phpinfo section.

Fix GH-9139: Allow FFI in opcache.preload when opcache.preload_user=root.

Made opcache.preload_user always optional in the cli and phpdbg SAPIs.

Allows W/X bits on page creation on FreeBSD despite system settings.

Added memfd api usage, on Linux, for zend_shared_alloc_create_lock() to create an abstract anonymous file for the opcache's lock.

Avoid resetting JIT counter handlers from multiple processes/threads.

Fixed COPY_TMP type inference for references.

OpenSSL

Added OPENSSL_CMS_OLDMIMETYPE and PKCS7_NOOLDMIMETYPE constants to switch between mime content types.

Fixed GH-11054: Reset OpenSSL errors when using a PEM public key.

Added support for additional EC parameters in openssl_pkey_new.

PCNTL

SA_ONSTACK is now set for pcntl_signal.

Added SIGINFO constant.

PCRE

Update bundled libpcre2 to 10.42.

PGSQL

pg_fetch_object raises a ValueError instead of an Exception.

pg_cancel use thread safe PQcancel api instead.

pg_trace new PGSQL_TRACE_SUPPRESS_TIMESTAMPS/PGSQL_TRACE_REGRESS_MODE contants support.

pg_set_error_verbosity adding PGSQL_ERRORS_STATE constant.

pg_convert/pg_insert E_WARNING on type errors had been converted to ValueError/TypeError exceptions.

Added pg_set_error_context_visibility to set the context's visibility within the error messages.

Phar

Fix memory leak in phar_rename_archive().

POSIX

Added posix_sysconf.

Added posix_pathconf.

Added posix_fpathconf.

Fixed zend_parse_arg_long's bool pointer argument assignment.

Added posix_eaccess.

Random

Added Randomizer::getBytesFromString().

Added Randomizer::nextFloat(), ::getFloat(), and IntervalBoundary.

Enable getrandom() for NetBSD (from 10.x).

Deprecate MT_RAND_PHP.

Fix Randomizer::getFloat() returning incorrect results under certain circumstances.

Reflection

Fix GH-9470: ReflectionMethod constructor should not find private parent method.

Fix GH-10259 ReflectionClass::getStaticProperties doesn't need null return type.

SAPI

Fixed GH-11141: Could not open input file: should be sent to stderr.

Session

Fixed bug GH-11529: Crash after dealing with an Apache request.

SimpleXML

Fixed bug GH-12192: SimpleXML infinite loop when getName() is called within foreach.

Fixed bug GH-12208: SimpleXML infinite loop when a cast is used inside a foreach.

Fixed bug #55098: SimpleXML iteration produces infinite loop.

Sockets

Added SO_ATTACH_REUSEPORT_CBPF socket option, to give tighter control over socket binding for a cpu core.

Added SKF_AD_QUEUE for cbpf filters.

Added socket_atmark if send/recv needs using MSG_OOB.

Added TCP_QUICKACK constant, to give tighter control over ACK delays.

Added DONTFRAGMENT support for path MTU discovery purpose.

Added AF_DIVERT for raw socket for divert ports.

Added SOL_UPDLITE, UDPLITE_RECV_CSCOV and UDPLITE_SEND_CSCOV for updlite protocol support.

Added SO_RERROR, SO_ZEROIZE and SO_SPLICE netbsd and openbsd constants.

Added TCP_REPAIR for quietly close a connection.

Added SO_REUSEPORT_LB freebsd constant.

Added IP_BIND_ADDRESS_NO_PORT.

SPL

Fixed GH-11573: RecursiveDirectoryIterator::hasChildren is slow.

Standard

E_NOTICEs emitted by unserialize() have been promoted to E_WARNING.

unserialize() now emits a new E_WARNING if the input contains unconsumed bytes.

Make array_pad's $length warning less confusing.

E_WARNING emitted by strtok in the case both arguments are not provided when starting tokenisation.

password_hash() will now chain the original RandomException to the ValueError on salt generation failure.

Fix GH-10239: proc_close after proc_get_status always returns -1.

Improve the warning message for unpack() in case not enough values were provided.

Fix GH-11010: parse_ini_string() now preserves formatting of unquoted strings starting with numbers when the INI_SCANNER_TYPED flag is specified.

Fix GH-10742: http_response_code emits no error when headers were already sent.

Added support for rounding negative places in number_format().

Prevent precision loss on formatting decimal integers in number_format().

Added usage of posix_spawn for proc_open when supported by OS.

Added $before_needle argument to strrchr().

Fixed GH-11982: str_getcsv returns null byte for unterminated enclosure.

Fixed str_decrement() on "1".

Streams

Fixed bug #51056: blocking fread() will block even if data is available.

Added storing of the original path used to open xport stream.

Implement GH-8641: STREAM_NOTIFY_COMPLETED over HTTP never emitted.

Fix bug GH-10406: fgets on a redis socket connection fails on PHP 8.3.

Implemented GH-11242: _php_stream_copy_to_mem: Allow specifying a maximum length without allocating a buffer of that size.

Fixed bug #52335: fseek() on memory stream behavior different than file.

Fixed bug #76857: Can read "non-existant" files.

XSLTProcessor

Fixed bug #69168: DomNode::getNodePath() returns invalid path.

ZIP

zip extension version 1.22.0 for libzip 1.10.0.

add new error macros (ER_DATA_LENGTH and ER_NOT_ALLOWED).

add new archive global flags (ER_AFL_*).

add ZipArchive::setArchiveFlag and ZipArchive::getArchiveFlag methods.

Community Fixes in PHP 8.2.13

Core

Fixed double-free of non-interned enum case name.

Fixed bug GH-12457: Incorrect result of stripos with single character needle.

Fixed bug GH-12468: Double-free of doc_comment when overriding static property via trait.

Fixed segfault caused by weak references to FFI objects.

Fixed max_execution_time: don't delete an unitialized timer.

Fixed bug GH-12558: Arginfo soft-breaks with namespaced class return type if the class name starts with N.

DOM

Fix registerNodeClass with abstract class crashing.

Add missing NULL pointer error check.

Fix validation logic of php:function() callbacks.

Fiber

Fixed bug GH-11121: ReflectionFiber segfault.

FPM

Fixed bug GH-9921: Loading ext in FPM config does not register module handlers.

Fixed bug GH-12232: FPM: segfault dynamically loading extension without opcache.

Fixed bug #76922: FastCGI terminates conn after FCGI_GET_VALUES.

Intl

Removed the BC break on IntlDateFormatter::construct which threw an exception with an invalid locale.

Opcache

Added warning when JIT cannot be enabled.

Fixed bug GH-8143: Crashes in zend_accel_inheritance_cache_find since upgrading to 8.1.3 due to corrupt on-disk file cache.

OpenSSL

Fixed bug GH-12489: Missing sigbio creation checking in openssl_cms_verify.

PCRE

Fixed bug GH-11374: Backport upstream fix, Different preg_match result with -d pcre.jit=0.

SOAP

Fixed bug GH-12392: Segmentation fault on SoapClient::__getTypes.

Fixed bug #66150: SOAP WSDL cache race condition causes Segmentation Fault.

Fixed bug #67617: SOAP leaves incomplete cache file on ENOSPC.

Fix incorrect uri check in SOAP caching.

Fix segfault and assertion failure with refcounted props and arrays.

Fix potential crash with an edge case of persistent encoders.

Fixed bug #75306: Memleak in SoapClient.

Streams

Fixed bug #75708: getimagesize with &$imageinfo fails on StreamWrappers.

XMLReader

Add missing NULL pointer error check.

XMLWriter

Add missing NULL pointer error check.

XSL

Add missing module dependency.

Fix validation logic of php:function() callbacks.

Community Fixes in PHP 8.1.26

Core

Fixed bug GH-12468: Double-free of doc_comment when overriding static property via trait.

Fixed segfault caused by weak references to FFI objects.

Fixed max_execution_time: don't delete an unitialized timer.

DOM

Fix registerNodeClass with abstract class crashing.

Add missing NULL pointer error check.

Fix validation logic of php:function() callbacks.

Fiber

Fixed bug GH-11121: ReflectionFiber segfault.

FPM

Fixed bug GH-9921: Loading ext in FPM config does not register module handlers.

Fixed bug GH-12232: FPM: segfault dynamically loading extension without opcache.

Intl

Removed the BC break on IntlDateFormatter::construct which threw an exception with an invalid locale.

Opcache

Added warning when JIT cannot be enabled.

Fixed bug GH-8143: Crashes in zend_accel_inheritance_cache_find since upgrading to 8.1.3 due to corrupt on-disk file cache.

OpenSSL

Fixed bug GH-12489: Missing sigbio creation checking in openssl_cms_verify.

PCRE

Fixed bug GH-11374: Backport upstream fix, Different preg_match result with -d pcre.jit=0.

SOAP

Fixed bug GH-12392: Segmentation fault on SoapClient::__getTypes.

Fixed bug #66150: SOAP WSDL cache race condition causes Segmentation Fault.

Fixed bug #67617: SOAP leaves incomplete cache file on ENOSPC.

Fix incorrect uri check in SOAP caching.

Fix segfault and assertion failure with refcounted props and arrays.

Fix potential crash with an edge case of persistent encoders.

Fixed bug #75306: Memleak in SoapClient.

Streams

Fixed bug #75708: getimagesize with &$imageinfo fails on StreamWrappers.

XMLReader

Add missing NULL pointer error check.

XMLWriter

Add missing NULL pointer error check.

XSL

Add missing module dependency.

Fix validation logic of php:function() callbacks.
ZendPHP August 2023 Releases
August 13, 2023
Added Platform Support

Added support for IBM i 7.5.

Community fixes for ZendPHP 8.2.9

Build

Fixed bug GH-11522: PHP version check fails with '-' separator.

CLI

Fix interrupted CLI output causing the process to exit.

Core

Fixed oss-fuzz #60011: Mis-compilation of by-reference nullsafe operator.

Fixed line number of JMP instruction over else block.

Fixed use-of-uninitialized-value with ??= on assert.

Fixed oss-fuzz #60411: Fix double-compilation of arrow-functions.

Fixed build for FreeBSD before the 11.0 releases.

Curl

Fix crash when an invalid callback function is passed to CURLMOPT_PUSHFUNCTION.

Date

Fixed bug GH-11368: Date::modify returns invalid datetime.

Fixed bug GH-11600: Can't parse time strings which include (narrow) non-breaking space characters).

DOM

Fixed bug GH-11625: DOMElement::replaceWith() doesn't replace node with DOMDocumentFragment but just deletes node or causes wrapping > depending on libxml2 version.

Fileinfo

Fixed bug GH-11298: finfo returns wrong mime type for xz files.

FTP

Fix context option check for "overwrite".

Fixed bug GH-10562: Memory leak and invalid state with consecutive ftp_nb_fget.

GD

Fix most of the external libgd test failures.

Intl

Fix memory leak in MessageFormatter::format() on failure.

Libxml

Fixed bug GHSA-3qrf-m4j2-pcrr: Security issue with external entity loading in XML without enabling it. (CVE-2023-3823)

MBString

Fix GH-11300: license issue: restricted unicode license headers.

Opcache

Fixed bug GH-10914: OPCache with Enum and Callback functions results in segmentation fault.

Prevent potential deadlock if accelerated globals cannot be allocated.

PCNTL

Fixed bug GH-11498: SIGCHLD is not always returned from proc_open.

PDO

Fix GH-11587: After php8.1, when PDO::ATTR_EMULATE_PREPARES is true and PDO::ATTR_STRINGIFY_FETCHES is true, decimal zeros are no longer filled.

PDO SQLite

Fix GH-11492: Make test failure: ext/pdo_sqlite/tests/bug_42589.phpt.

Phar

Add missing check on EVP_VerifyUpdate() in phar util.

Fixed bug GHSA-jqcx-ccgc-xwhv: Buffer mismanagement in phar_dir_read(). (CVE-2023-3824)

PHPDBG

Fixed bug GH-9669: phpdbg -h options doesn't list the -z option.

Session

Removed broken url support for transferring session ID.

Standard

Fix serialization of RC1 objects appearing in object graph twice.

Streams

Fixed bug GH-11735: Use-after-free when unregistering user stream wrapper from itself.

SQLite3

Fix replaced error handling in SQLite3Stmt::__construct.

XMLReader

Fix GH-11548: Argument corruption when calling XMLReader::open or XMLReader::XML non-statically with observer active).

Community fixes for ZendPHP 8.1.22

Build

Fixed bug GH-11522: PHP version check fails with '-' separator.

CLI

Fix interrupted CLI output causing the process to exit.

Core

Fixed oss-fuzz #60011: Mis-compilation of by-reference nullsafe operator.

Fixed use-of-uninitialized-value with ??= on assert.

Fixed build for FreeBSD before the 11.0 releases.

Curl

Fix crash when an invalid callback function is passed to CURLMOPT_PUSHFUNCTION.

Date

Fixed bug GH-11368: Date::modify returns invalid datetime.

DOM

Fixed bug GH-11625: DOMElement::replaceWith() doesn't replace node with DOMDocumentFragment but just deletes node or causes wrapping > depending on libxml2 version.

Fileinfo

Fixed bug GH-11298: finfo returns wrong mime type for xz files.

FTP

Fix context option check for "overwrite".

Fixed bug GH-10562: Memory leak and invalid state with consecutive ftp_nb_fget.

GD

Fix most of the external libgd test failures.

Hash

Fix use-of-uninitialized-value in hash_pbkdf2(), fix missing $options parameter in signature.

Intl

Fix memory leak in MessageFormatter::format() on failure.

Libxml

Fixed bug GHSA-3qrf-m4j2-pcrr: Security issue with external entity loading in XML without enabling it. (CVE-2023-3823)

MBString

Fix GH-11300: license issue: restricted unicode license headers.

Opcache

Fixed bug GH-10914: OPCache with Enum and Callback functions results in segmentation fault.

Prevent potential deadlock if accelerated globals cannot be allocated.

PCNTL

Fixed bug GH-11498: SIGCHLD is not always returned from proc_open.

PCRE

Mangle PCRE regex cache key with JIT option.

PDO

Fix GH-11587: After php8.1, when PDO::ATTR_EMULATE_PREPARES is true and PDO::ATTR_STRINGIFY_FETCHES is true, decimal zeros are no longer filled.

PDO SQLite

Fix GH-11492: Make test failure: ext/pdo_sqlite/tests/bug_42589.phpt.

Phar

Add missing check on EVP_VerifyUpdate() in phar util.

Fixed bug GHSA-jqcx-ccgc-xwhv: Buffer mismanagement in phar_dir_read(). (CVE-2023-3824)

PHPDBG

Fixed bug GH-9669: phpdbg -h options doesn't list the -z option.

Session

Removed broken url support for transferring session ID.

Standard

Fix serialization of RC1 objects appearing in object graph twice.

SQLite3

Fix replaced error handling in SQLite3Stmt::__construct.

Community Security Fixes for ZendPHP 8.0.30

Libxml

Fixed bug GHSA-3qrf-m4j2-pcrr: Security issue with external entity loading in XML without enabling it. (CVE-2023-3823)

Phar

Fixed bug GHSA-jqcx-ccgc-xwhv: Buffer mismanagement in phar_dir_read(). (CVE-2023-3824)

Backported CVE Fixes for 7.4.33.4, 7.3.33.9, 7.2.34.17

Libxml

Fixed bug GHSA-3qrf-m4j2-pcrr: Security issue with external entity loading in XML without enabling it. (CVE-2023-3823)

Phar

Fixed bug GHSA-jqcx-ccgc-xwhv: Buffer mismanagement in phar_dir_read(). (CVE-2023-3824)
ZendPHP December 2023 Releases
December 26, 2023
ZendPHP Fix

Fixed LDAP extension functionality for TLS on IBM i

Community fixes for 8.3.1

Core

Fixed bug GH-12758 / GH-12768: Invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC.

Fix various missing NULL checks.

Fixed bug GH-12835: Leak of call->extra_named_params on internal __call.

Fixed bug GH-12826: Weird pointers issue in nested loops.

FPM

Fixed bug GH-12705: Segmentation fault in fpm_status_export_to_zval.

FTP

Fixed bug GH-9348: FTP & SSL session reuse.

LibXML

Fixed test failures for libxml2 2.12.0.

MySQLnd

Avoid using uninitialised struct.

Fixed bug GH-12791: Possible dereference of NULL in MySQLnd debug code.

Opcache

Fixed JIT bug: Function JIT emits "Uninitialized string offset" warning at the same time as invalid offset Error.

Fixed JIT bug: JIT emits "Attempt to assign property of non-object" warning at the same time as Error is being thrown.

PDO PGSQL

Fixed the default value of $fetchMode in PDO::pgsqlGetNotify()

SOAP

Fixed bug GH-12838: [SOAP] Temporary WSDL cache files not being deleted.

Standard

Fixed GH-12745: http_build_query() default null argument for $arg_separator is implicitly coerced to string.

Community fixes for 8.2.14

Core

Fixed oss-fuzz #54325: Use-after-free of name in var-var with malicious error handler.

Fixed oss-fuzz #64209: In-place modification of filename in php_message_handler_for_zend.

Fixed bug GH-12758 / GH-12768: Invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC.

Fix various missing NULL checks.

Fixed bug GH-12835: Leak of call->extra_named_params on internal __call.

Date

Fixed improbably integer overflow while parsing really large (or small) Unix timestamps.

DOM

Fixed bug GH-12616: DOM: Removing XMLNS namespace node results in invalid default: prefix.

FPM

Fixed bug GH-12705: Segmentation fault in fpm_status_export_to_zval.

FTP

Fixed bug GH-9348: FTP & SSL session reuse.

Intl

Fixed bug GH-12635: Test bug69398.phpt fails with ICU 74.1.

LibXML

Fixed bug GH-12702: libxml2 2.12.0 issue building from src.

Fixed test failures for libxml2 2.12.0.

MySQLnd

Avoid using uninitialised struct.

Fixed bug GH-12791: Possible dereference of NULL in MySQLnd debug code.

Opcache

Fixed JIT bug: Function JIT emits "Uninitialized string offset" warning at the same time as invalid offset Error.

Fixed JIT bug: JIT emits "Attempt to assign property of non-object" warning at the same time as Error is being thrown.

OpenSSL

Fixed bug #50713: openssl_pkcs7_verify() may ignore untrusted CAs.

PCRE

Fixed bug GH-12628: The gh11374 test fails on Alpinelinux.

PDO PGSQL

Fixed the default value of $fetchMode in PDO::pgsqlGetNotify()

PGSQL

Fixed bug GH-12763: wrong argument type for pg_untrace.

PHPDBG

Fixed bug GH-12675: MEMORY_LEAK in phpdbg_prompt.c.

SOAP

Fixed bug GH-12838: [SOAP] Temporary WSDL cache files not being deleted.

SPL

Fixed bug GH-12721: SplFileInfo::getFilename() segfault in combination with GlobIterator and no directory separator.

SQLite3

Fixed bug GH-12633: sqlite3_defensive.phpt fails with sqlite 3.44.0.

Standard:

Fix memory leak in syslog device handling.

Fixed bug GH-12621: browscap segmentation fault when configured in the vhost.

Fixed bug GH-12655: proc_open() does not take into account references in the descriptor array.

Streams

Fixed bug #79945: Stream wrappers in imagecreatefrompng causes segfault.

Zip:

Fixed bug GH-12661: Inconsistency in ZipArchive::addGlob remove_path Option Behavior.

Community fixes for 8.1.27

Core

Fixed oss-fuzz #54325: Use-after-free of name in var-var with malicious error handler.

Fixed oss-fuzz #64209: In-place modification of filename in php_message_handler_for_zend.

Fixed bug GH-12758 / GH-12768: Invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC.

DOM

Fixed bug GH-12616: DOM: Removing XMLNS namespace node results in invalid default: prefix.

FPM

Fixed bug GH-12705: Segmentation fault in fpm_status_export_to_zval.

Intl

Fixed bug GH-12635: Test bug69398.phpt fails with ICU 74.1.

LibXML

Fixed bug GH-12702: libxml2 2.12.0 issue building from src.

MySQLnd

Avoid using uninitialised struct.

OpenSSL

Fixed bug #50713: openssl_pkcs7_verify() may ignore untrusted CAs.

PCRE

Fixed bug GH-12628: The gh11374 test fails on Alpinelinux.

PGSQL

Fixed bug GH-12763: wrong argument type for pg_untrace.

PHPDBG

Fixed bug GH-12675: MEMORY_LEAK in phpdbg_prompt.c.

SQLite3

Fixed bug GH-12633: sqlite3_defensive.phpt fails with sqlite 3.44.0.

Standard

Fix memory leak in syslog device handling.

Fixed bug GH-12621: browscap segmentation fault when configured in the vhost.

Fixed bug GH-12655: proc_open() does not take into account references in the descriptor array.

Streams

Fixed bug #79945: Stream wrappers in imagecreatefrompng causes segfault.

Zip

Fixed bug GH-12661: Inconsistency in ZipArchive::addGlob remove_path Option Behavior.
ZendPHP January 2024 Releases
January 18, 2024
Community fixes for 8.2.15

Core

Fixed bug GH-12953: false positive SSA integrity verification failed when loading composer classmaps with more than 11k elements.

Fixed bug GH-12966: missing cross-compiling 3rd argument so Autoconf doesn't emit warnings.

Cli:

Fix incorrect timeout in built-in web server when using router script and max_input_time.

FFI:

Fixed bug GH-9698: stream_wrapper_register crashes with FFI\CData.

Fixed bug GH-12905: FFI::new interacts badly with observers.

GD:

Fixed GH-13082: undefined behavior with GdFont instances handling with imageload* and imagechar*.

Intl:

Fixed GH-12943: IntlDateFormatter::__construct accepts 'C' as valid locale.

Hash:

Fixed bug GH-12936: hash() function hangs endlessly if using sha512 on strings >= 4GiB.

ODBC:

Fix crash on Apache shutdown with persistent connections.

Opcache:

Fixed oss-fuzz #64727: JIT undefined array key warning may overwrite DIM with NULL when DIM is the same var as result.

Added workaround for SELinux mprotect execheap issue. See https://bugzilla.kernel.org/show_bug.cgi?id=218258.

OpenSSL:

Fixed bug GH-12987: openssl_csr_sign might leak new cert on error.

PDO:

Fix GH-12969: Fixed PDO::getAttribute() to get PDO::ATTR_STRINGIFY_FETCHES.

PDO_ODBC:

Fixed bug GH-12767: Unable to turn on autocommit mode with setAttribute().

PGSQL:

Fixed auto_reset_persistent handling and allow_persistent type.

Fixed bug GH-12974: Apache crashes on shutdown when using pg_pconnect().

Phar:

Fixed bug #77432: Segmentation fault on including phar file.

PHPDBG:

Fixed bug GH-12962: Double free of init_file in phpdbg_prompt.c.

SimpleXML:

Fix getting the address of an uninitialized property of a SimpleXMLElement resulting in a crash.

Tidy:

Fixed bug GH-12980: tidynode.props.attribute is missing "Boolean Attributes" and empty attributes.

Community fixes for 8.3.2

Core

Fixed bug GH-12953: false positive SSA integrity verification failed when loading composer classmaps with more than 11k elements.

Fixed bug GH-12999: zend_strnlen build when strnlen is unsupported.

Fixed bug GH-12966: missing cross-compiling 3rd argument so Autoconf doesn't emit warnings.

Fixed bug GH-12854: 8.3 - as final trait-used method does not correctly report visibility in Reflection.

Cli:

Fix incorrect timeout in built-in web server when using router script and max_input_time.

DOM:

Fixed bug GH-12870: Creating an xmlns attribute results in a DOMException.

Fix crash when toggleAttribute() is used without a document.

Fix crash in adoptNode with attribute references.

Fixed bug GH-13012: DOMNode::isEqualNode() is incorrect when attribute order is different.

FFI:

Fixed bug GH-9698: stream_wrapper_register crashes with FFI\CData.

Fixed bug GH-12905: FFI::new interacts badly with observers.

GD:

Fixed GH-13082: undefined behavior with GdFont instances handling with imageload* and imagechar*.

Intl:

Fixed GH-12943: IntlDateFormatter::__construct accepts 'C' as valid locale.

Hash:

Fixed bug GH-12936: hash() function hangs endlessly if using sha512 on strings >= 4GiB.

ODBC:

Fix crash on Apache shutdown with persistent connections.

Opcache:

Fixed oss-fuzz #64727: JIT undefined array key warning may overwrite DIM with NULL when DIM is the same var as result.

Added workaround for SELinux mprotect execheap issue. See https://bugzilla.kernel.org/show_bug.cgi?id=218258.

OpenSSL:

Fixed bug GH-12987: openssl_csr_sign might leak new cert on error.

PDO:

Fix GH-12969: Fixed PDO::getAttribute() to get PDO::ATTR_STRINGIFY_FETCHES.

PDO_ODBC:

Fixed bug GH-12767: Unable to turn on autocommit mode with setAttribute().

PGSQL:

Fixed auto_reset_persistent handling and allow_persistent type.

Fixed bug GH-12974: Apache crashes on shutdown when using pg_pconnect().

Phar:

Fixed bug #77432: Segmentation fault on including phar file.

PHPDBG:

Fixed bug GH-12962: Double free of init_file in phpdbg_prompt.c.

SimpleXML:

Fix getting the address of an uninitialized property of a SimpleXMLElement resulting in a crash.

Fixed bug GH-12929: SimpleXMLElement with stream_wrapper_register can segfault.

Tidy:

Fixed bug GH-12980: tidynode.props.attribute is missing "Boolean Attributes" and empty attributes.
ZendPHP October 2023 Releases
October 25, 2023
Community fixes for 8.2.12

Core

Fixed bug GH-12207: memory leak when class using trait with doc block.

Fixed bug GH-12215: Module entry being overwritten causes type errors in ext/dom.

Fixed bug GH-12273: __builtin_cpu_init check.

Fixed bug #80092: ZTS + preload = segfault on shutdown.

CLI

Ensure a single Date header is present.

CType

Fixed bug GH-11997: ctype_alnum 5 times slower in PHP 8.1 or greater.

DOM

Restore old namespace reconciliation behaviour.

Fixed bug GH-8996: DOMNode serialization on PHP ^8.1.

Fileinfo

Fixed bug GH-11891: fileinfo returns text/xml for some svg files.

Filter

Fix explicit FILTER_REQUIRE_SCALAR with FILTER_CALLBACK

Hash

Fixed bug GH-12186: segfault copying/cloning a finalized HashContext.

Intl

Fixed bug GH-12243: segfault on IntlDateFormatter::construct.

Fixed bug GH-12282: IntlDateFormatter::construct should throw an exception on an invalid locale.

MySQLnd

Fixed bug GH-12297: PHP Startup: Invalid library (maybe not a PHP library) 'mysqlnd.so' in Unknown on line.

Opcache

Fixed opcache_invalidate() on deleted file.

Fixed bug GH-12380: JIT+private array property access inside closure accesses private property in child class.

PCRE

Fixed bug GH-11956: Backport upstream fix, PCRE regular expressions with JIT enabled gives different result.

SimpleXML

Fixed bug GH-12170: Can't use xpath with comments in SimpleXML.

Fixed bug GH-12223: Entity reference produces infinite loop in var_dump/print_r.

Fixed bug GH-12167: Unable to get processing instruction contents in SimpleXML.

Fixed bug GH-12169: Unable to get comment contents in SimpleXML.

Streams

Fixed bug GH-12190: binding ipv4 address with both address and port at 0.

XML

Fix return type of stub of xml_parse_into_struct().

Fix memory leak when calling xml_parse_into_struct() twice.

XSL

Fix type error on XSLTProcessor::transformToDoc return value with SimpleXML.

Community fixes for 8.1.25

Core

Fixed bug GH-12207: memory leak when class using trait with doc block.

Fixed bug GH-12215: Module entry being overwritten causes type errors in ext/dom.

Fixed bug GH-12273: __builtin_cpu_init check.

Fixed bug #80092: ZTS + preload = segfault on shutdown.

CLI

Ensure a single Date header is present.

CType

Fixed bug GH-11997: ctype_alnum 5 times slower in PHP 8.1 or greater.

DOM

Restore old namespace reconciliation behaviour.

Fixed bug GH-8996: DOMNode serialization on PHP ^8.1.

Fileinfo

Fixed bug GH-11891: fileinfo returns text/xml for some svg files.

Filter

Fix explicit FILTER_REQUIRE_SCALAR with FILTER_CALLBACK

Hash

Fixed bug GH-12186: segfault copying/cloning a finalized HashContext.

Intl

Fixed bug GH-12243: segfault on IntlDateFormatter::construct.

Fixed bug GH-12282: IntlDateFormatter::construct should throw an exception on an invalid locale.

MySQLnd

Fixed bug GH-12297: PHP Startup: Invalid library (maybe not a PHP library) 'mysqlnd.so' in Unknown on line.

Opcache

Fixed opcache_invalidate() on deleted file.

Fixed bug GH-12380: JIT+private array property access inside closure accesses private property in child class.

PCRE

Fixed bug GH-11956: Backport upstream fix, PCRE regular expressions with JIT enabled gives different result.

SimpleXML

Fixed bug GH-12170: Can't use xpath with comments in SimpleXML.

Fixed bug GH-12223: Entity reference produces infinite loop in var_dump/print_r.

Fixed bug GH-12167: Unable to get processing instruction contents in SimpleXML.

Fixed bug GH-12169: Unable to get comment contents in SimpleXML.

Sockets

Fix socket_export_stream() with wrong protocol

Streams

Fixed bug GH-12190: binding ipv4 address with both address and port at 0.

XML

Fix return type of stub of xml_parse_into_struct().

Fix memory leak when calling xml_parse_into_struct() twice.

XSL

Fix type error on XSLTProcessor::transformToDoc return value with SimpleXML.
ZendPHP February 2024 Releases
February 18, 2024
ZendPHP changes on Windows for 8.1.27.2, 8.2.16 and 8.3.3

Windows opcache jit fix

Windows mbstring with oniguruma, enabling mbstring regex

Community fixes for 8.2.16

Core:

Fixed timer leak in zend-max-execution-timers builds.

Fixed bug GH-12349: linking failure on ARM with mold.

Fixed bug GH-13097: Anonymous class reference in trigger_error / thrown Exception.

Fixed bug GH-13215: GCC 14 build failure.

Curl:

Fix missing error check in curl_multi_init().

FPM:

Fixed bug GH-12996: Incorrect SCRIPT_NAME with Apache ProxyPassMatch when plus in path.

GD:

Fixed bug GH-10344: imagettfbbox() Could not find/open font UNC path.

Fixed bug GH-10614: imagerotate will turn the picture all black, when rotated 90.

MySQLnd:

Fixed bug GH-12107: When running a stored procedure (that returns a result set) twice, PHP crashes.

Opcache:

Fixed bug GH-13232: Segmentation fault will be reported when JIT is off but JIT_debug is still on.

OpenSSL:

Fixed LibreSSL undefined reference when OPENSSL_NO_ENGINE not set.

PDO_Firebird:

Fix GH-13119: Changed to convert float and double values into strings using H format.

Phar:

Fixed bug #71465: PHAR doesn't know about litespeed.

Fixed bug GH-13037: PharData incorrectly extracts zip file.

Random:

Fixed bug GH-13138: Randomizer::pickArrayKeys() does not detect broken engines.

Session:

Fixed bug GH-12504: Corrupted session written when there's a fatal error in autoloader.

Streams:

Fixed bug GH-13071: Copying large files using mmap-able source streams may exhaust available memory and fail.

Community fixes for 8.3.3

Core:

Fixed timer leak in zend-max-execution-timers builds.

Fixed bug GH-12349: linking failure on ARM with mold.

Fixed bug GH-13097: Anonymous class reference in trigger_error / thrown Exception.

Fixed bug GH-13177: PHP 8.3.2: final private constructor not allowed when used in trait.

Fixed bug GH-13215: GCC 14 build failure.

Curl:

Fix missing error check in curl_multi_init().

FPM:

Fixed bug GH-12996: Incorrect SCRIPT_NAME with Apache ProxyPassMatch when plus in path.

GD:

Fixed bug GH-10344: imagettfbbox() Could not find/open font UNC path

Fixed bug GH-10614: imagerotate will turn the picture all black, when rotated 90

LibXML:

Fix crashes with entity references and predefined entities.

MySQLnd:

Fixed bug GH-12107: When running a stored procedure (that returns a result set) twice, PHP crashes.

Opcache:

Fixed bug GH-13145: strtok() is not comptime.

Fixed type inference of range().

Fixed bug GH-13232: Segmentation fault will be reported when JIT is off but JIT_debug is still on.

OpenSSL:

Fixed LibreSSL undefined reference when OPENSSL_NO_ENGINE not set.

PDO_Firebird:

Fix GH-13119: Changed to convert float and double values into strings using H format.

Phar:

Fixed bug #71465: PHAR doesn't know about litespeed.

Fixed bug GH-13037: PharData incorrectly extracts zip file.

Random:

Fixed bug GH-13138: Randomizer::pickArrayKeys() does not detect broken engines.

Session:

Fixed bug GH-12504: Corrupted session written when there's a fatal error in autoloader.

Standard:

Fixed bug GH-13094: range(9.9, '0') causes segmentation fault.

Streams:

Fixed bug GH-13071: Copying large files using mmap-able source streams may exhaust available memory and fail.
ZendPHP March 2024 Releases
March 17, 2024
Community fixes for 8.2.17

Core:

Fix ZTS persistent resource crashes on shutdown.

Curl:

Fix failing tests due to string changes in libcurl 8.6.0.

DOM:

Fix reference access in dimensions for DOMNodeList and DOMNodeMap.

Fileinfo:

Fixed bug GH-13344: finfo::buffer(): Failed identify data 0:(null), backport.

FPM:

Fixed bug #75712: getenv in php-fpm should not read $_ENV, $_SERVER.

GD:

Fixed bug GH-12019: detection of image formats in system gd library.

MySQLnd:

Fixed bug GH-11950: [mysqlnd] Fixed not to set CR_MALFORMED_PACKET to error if CR_SERVER_GONE_ERROR is already set.

PGSQL:

Fixed bug GH-13354: pg_execute/pg_send_query_params/pg_send_execute with null value passed by reference.

Standard:

Fixed array key as hash to string (case insensitive) comparison typo for the second operand buffer size (albeit unused for now).

Community fixes for 8.3.4

Core:

Fix ZTS persistent resource crashes on shutdown.

Curl:

Fix failing tests due to string changes in libcurl 8.6.0.

DOM:

Fix unlikely memory leak in case of namespace removal with extremely deep trees.

Fix reference access in dimensions for DOMNodeList and DOMNodeMap.

Fileinfo:

Fixed bug GH-13344: finfo::buffer(): Failed identify data 0:(null), backport.

FPM:

Fixed bug #75712: getenv in php-fpm should not read $_ENV, $_SERVER.

GD:

Fixed bug GH-12019: detection of image formats in system gd library.

MySQLnd:

Fixed bug GH-11950: [mysqlnd] Fixed not to set CR_MALFORMED_PACKET to error if CR_SERVER_GONE_ERROR is already set.

PDO:

Fix various PDORow bugs.

PGSQL:

Fixed bug GH-13354: pg_execute/pg_send_query_params/pg_send_execute with null value passed by reference.

SPL:

Fixed bug GH-13531: Unable to resize SplfixedArray after being unserialized in PHP 8.2.15.

Standard:

Fixed bug GH-13279: Instable array during in-place modification in uksort.

Fixed array key as hash to string (case insensitive) comparison typo for the second operand buffer size (albeit unused for now).

XML:

Fixed bug GH-13517: Multiple test failures when building with --with-expat.
ZendPHP September 2023 Releases
September 27, 2023
Community fixes for 8.2.11

Core

Fixed bug GH-11937: Constant ASTs containing objects.

Fixed bug GH-11790: On riscv64 require libatomic if actually needed.

Fixed bug GH-11876: ini_parse_quantity() accepts invalid quantities.

Fixed bug GH-12073: Segfault when freeing incompletely initialized closures.

Fixed bug GH-12060: Internal iterator rewind handler is called twice.

Fixed bug GH-12102: Incorrect compile error when using array access on TMP value in function call.

DOM

Fix memory leak when setting an invalid DOMDocument encoding.

Iconv

Fixed build for NetBSD which still uses the old iconv signature.

Intl

Fixed bug GH-12020: intl_get_error_message() broken after MessageFormatter::formatMessage() fails.

MySQLnd

Fixed bug GH-10270: Invalid error message when connection via SSL fails: "trying to connect via (null)".

ODBC

Fixed memory leak with failed SQLPrepare.

Fixed persistent procedural ODBC connections not getting closed.

SimpleXML

Fixed bug #52751: XPath processing-instruction() function is not supported.

SPL

Fixed bug GH-11972: RecursiveCallbackFilterIterator regression in 8.1.18.

SQLite3

Fixed bug GH-11878: SQLite3 callback functions cause a memory leak with a callable array.

Community fixes for 8.1.24

Core

Fixed bug GH-11937: Constant ASTs containing objects.

Fixed bug GH-11790: On riscv64 require libatomic if actually needed.

Fixed bug GH-12073: Segfault when freeing incompletely initialized closures.

Fixed bug GH-12060: Internal iterator rewind handler is called twice.

Fixed bug GH-12102: Incorrect compile error when using array access on TMP value in function call.

DOM

Fix memory leak when setting an invalid DOMDocument encoding.

Iconv

Fixed build for NetBSD which still uses the old iconv signature.

Intl

Fixed bug GH-12020: intl_get_error_message() broken after MessageFormatter::formatMessage() fails.

MySQLnd

Fixed bug GH-10270: Invalid error message when connection via SSL fails: "trying to connect via (null)".

ODBC

Fixed memory leak with failed SQLPrepare.

Fixed persistent procedural ODBC connections not getting closed.

SimpleXML

Fixed bug #52751: XPath processing-instruction() function is not supported.

SPL

Fixed bug GH-11972: RecursiveCallbackFilterIterator regression in 8.1.18.

SQLite3

Fixed bug GH-11878: SQLite3 callback functions cause a memory leak with a callable array.

Added Platform Support

Added Container Registry Support

Community Fixes for ZendPHP 8.2.8

Community Fixes for ZendPHP 8.1.21

ZendPHP Changes

Community CVE Fixes

Community Fixes

Backported PHP CVE Fixes

Added

Changed

New Release: PHP 8.3

Community Fixes in PHP 8.2.13

Community Fixes in PHP 8.1.26

Added Platform Support

Community fixes for ZendPHP 8.2.9

Community fixes for ZendPHP 8.1.22

Community Security Fixes for ZendPHP 8.0.30

Backported CVE Fixes for 7.4.33.4, 7.3.33.9, 7.2.34.17

ZendPHP Fix

Community fixes for 8.3.1

Community fixes for 8.2.14

Community fixes for 8.1.27

Community fixes for 8.2.15

Community fixes for 8.3.2

Community fixes for 8.2.12

Community fixes for 8.1.25

ZendPHP changes on Windows for 8.1.27.2, 8.2.16 and 8.3.3

Community fixes for 8.2.16

Community fixes for 8.3.3

Community fixes for 8.2.17

Community fixes for 8.3.4

Community fixes for 8.2.11

Community fixes for 8.1.24