Extend CURLFile to support streams

Due to former restrictions of the libcurl API, curl multipart/formdata
file uploads supported only proper files. However, as of curl 7.56.0
the ne

Extend CURLFile to support streams

Due to former restrictions of the libcurl API, curl multipart/formdata
file uploads supported only proper files. However, as of curl 7.56.0
the new `curl_mime_*()` API is available (and already supported by
PHP[1]), which allows us to support arbitrary *seekable* streams, which
is generally desirable, and particularly resolves issues with the
transparent Unicode and long part support on Windows (see bug #77711).

Note that older curl versions are still supported, but CURLFile is
still restricted to proper files in this case.

[1] <http://git.php.net/?p=php-src.git;a=commit;h=a83b68ba56714bfa06737a61af795460caa4a105>

(cherry picked from commit c68dc6b5e37e74d89e0a387079139c054c8faa81)

show more ...

Fix #78923: Artifacts when convoluting image with transparency

We have to properly initialize `pxl` before using it.

Fix ported from <https://github.com/libgd/libgd/pull/559>.

Next is 7.3.14

Fix #78814: strip_tags allows / in tag name => whitelist bypass

When normalizing tags to check whether they are contained in the set
of allowable tags, we must not strip slashes, unless

Fix #78814: strip_tags allows / in tag name => whitelist bypass

When normalizing tags to check whether they are contained in the set
of allowable tags, we must not strip slashes, unless they come
immediately after the opening `<`, or immediately before the closing
`>`.

show more ...

Fix #78296: is_file fails to detect file

If we're constructing extended-length paths (i.e. paths prefixed with
`\\?\`), we have to replace all forward slashes with backward slashes,

Fix #78296: is_file fails to detect file

If we're constructing extended-length paths (i.e. paths prefixed with
`\\?\`), we have to replace all forward slashes with backward slashes,
because the former are not supported by Windows for extended-length
paths.

The more efficient and likely cleaner alternative solution would be to
cater to this in `php_win32_ioutil_normalize_path_w()` by always
replacing forward slashes, but that might break existing code. It
might be sensible to change that for `master`, though.

show more ...

Fix #78833: Integer overflow in pack causes out-of-bound access

We check for potential signed integer overflow, and bail out
gracefully, in that case.

Upgrade to Oniguruma 6.9.4

Oniguruma 6.9.4 fixes several CVEs.

Fix #78840: imploding $GLOBALS crashes

We add support for IS_INDIRECT zvals to implode().

Fix #77638: var_export'ing certain class instances segfaults

If objects return immutable property hash tables (typically,
`zend_empty_array`), we must not try to apply recursion protecti

Fix #77638: var_export'ing certain class instances segfaults

If objects return immutable property hash tables (typically,
`zend_empty_array`), we must not try to apply recursion protection on
those.

show more ...

Fixed bug #78868 (Calling __autoload() with incorrect EG(fake_scope) value)

Fix #78853: preg_match() may return integer > 1

Commit 54ebebd[1] optimized the match loop, but for this case it has
been overlooked, that we must only loop if we're doing global matchin

Fix #78853: preg_match() may return integer > 1

Commit 54ebebd[1] optimized the match loop, but for this case it has
been overlooked, that we must only loop if we're doing global matching.

[1] <http://git.php.net/?p=php-src.git;a=commit;h=54ebebd686255c5f124af718c966edb392782d4a>

show more ...

Fix #78849: GD build broken with -D SIGNED_COMPARE_SLOW

Apparently, this has not been tested for a long time, and might be a
refactoring relict. Anyhow, we have to pass the context to

Fix #78849: GD build broken with -D SIGNED_COMPARE_SLOW

Apparently, this has not been tested for a long time, and might be a
refactoring relict. Anyhow, we have to pass the context to
`GIFNextPixel` as well.

show more ...

Update NEWS

Fix ASLR related invalid opline handler issues

Opcache stores `opline->handler`s in shared memory. These pointers are
invalid, if the main PHP DLL is loaded at another base address due

Fix ASLR related invalid opline handler issues

Opcache stores `opline->handler`s in shared memory. These pointers are
invalid, if the main PHP DLL is loaded at another base address due to
ASLR. We therefore store the address of `execute_ex` in the mmap base
file, and check on startup whether it matches its current address. If
not, we fall back on the file cache if enabled, and bail out otherwise.

This still does not address cases where the opline handler is located
inside of another DLL (e.g. for some profilers, debuggers), but there
seems to be no general solution for now.

(cherry picked from commit 8ba10b8fbc020dc225d3b19d8f088f1351a3e304)

show more ...

Fix bug #78804 - Segmentation fault in Locale::filterMatches

Fixed bug #78759

Handle INDIRECT values in array.

Fixed bug #78787

Not the first time inheritance of shadow properties causes an issue,
thankfully this whole concept is gone in PHP 7.4.

7.3.13 is next

Bump for 7.2.26-dev

Fixed bug #78775

Clear the OpenSSL error queue before performing SSL stream operations.
As we don't control all code that could possibly be using OpenSSL,
we can't rely on the error

Fixed bug #78775

Clear the OpenSSL error queue before performing SSL stream operations.
As we don't control all code that could possibly be using OpenSSL,
we can't rely on the error queue being empty.

show more ...

Fixed bug #78689

Fix #78751: Serialising DatePeriod converts DateTimeImmutable

When getting the properties of a DatePeriod instance we have to retain
the proper classes, and when restoring a DatePeriod i

Fix #78751: Serialising DatePeriod converts DateTimeImmutable

When getting the properties of a DatePeriod instance we have to retain
the proper classes, and when restoring a DatePeriod instance we have to
cater to DateTimeImmutable instances as well.

show more ...

Fix bug #78752

NULL out the execute_data before destroying it, otherwise GC may
trigger while the execute_data is partially destroyed, resulting
in double-frees.

The handlin

Fix bug #78752

NULL out the execute_data before destroying it, otherwise GC may
trigger while the execute_data is partially destroyed, resulting
in double-frees.

The handling of call stack unfreezing is a bit awkward because it's
a ZEND_API function, so we can't change the signature.

show more ...

Fixed bug #78747

bump version