PHP-8.1 is now for PHP 8.1.29-dev

Update NEWS

Fix bug GHSA-q6x7-frmf-grcw: password_verify can erroneously return true

Disallow null character in bcrypt password

Fix GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix

The check happened too early as later code paths may perform more
mangling rules. Move the chec

Fix GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix

The check happened too early as later code paths may perform more
mangling rules. Move the check downwards right before adding the actual
variable.

show more ...

Add proc_open escaping for cmd file execution

ci: update caddy job to use GitHub Releases

The caddyserver.com download page is unreliable, and it also recommends to use GitHub releases instead.

Closes #13296

PHP-8.1 is now for PHP 8.1.28-dev

(If released one day!)

Fix bug GH-12705: Segmentation fault in fpm_status_export_to_zval

Closes GH-12706

Fix phpGH-12763: PGSQL pg_untrace(): Argument #1 ($connection) must be of type resource or null, PgSql\Connection given.

Avoid using uninitialised struct

Closes GH-12046.

USE_ZEND_ALLOC=1 in tests with zend_test.observe_opline_in_zendmm=1

Add NEWS entry for GH-12768

Fix invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC (#12768)

* fix segfault in `ZEND_BIND_STATIC`

In case a `ZEND_BIND_STATIC` is being executed, while

Fix invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC (#12768)

* fix segfault in `ZEND_BIND_STATIC`

In case a `ZEND_BIND_STATIC` is being executed, while the current chunk is full,
the `zend_array_dup()` call will trigger a OOM in ZendMM which will crash, as
the opline might be a dangling pointer.

* add missing test

* `assert()`ing seems easier than trying to make the compiler to not optimize

* moved from function call to INI setting, so we can use this in other places as well

* make `assert()` work no NDEBUG builds

* document magic number

* fix segfault in `ZEND_FUNC_GET_ARGS`

In case a `ZEND_FUNC_GET_ARGS` is being executed, while the current chunk is
full, the `zend_new_array()` call will trigger a OOM in ZendMM which will crash,
as the opline might be a dangling pointer.

---------

Co-authored-by: Florian Engelhardt <florian@engelhardt.tc>

show more ...

Fixed GH-12748: Function JIT emits "could not convert to int" warning at the same time as invalid offset Error

Add host_cpu type for FreeBSD

In FreeBSD world x86_64 host type is identified as amd64 so add proper
checks for FreeBSD amd64 hosts.

Close GH-12736

Fix in-place modification of filename in php_message_handler_for_zend

php_strip_url_passwd modifies url in-place. We cannot assume from
php_message_handler_for_zend that data is a tempor

Fix in-place modification of filename in php_message_handler_for_zend

php_strip_url_passwd modifies url in-place. We cannot assume from
php_message_handler_for_zend that data is a temporary, modifiable string.

Fixes oss-fuzz #64209
Closes GH-12733

show more ...

Fix use-after-free of name in var-var with malicious error handler

Fixes oss-fuzz #54325
Closes GH-12732

Fix #50713: openssl_pkcs7_verify() may ignore untrusted CAs

Closes GH-12499

Merge changes to CertificateGenerator.inc from PHP-8.2

This pulls only the changes made to CertificateGenerator.inc in the PHP-8.2
branch from commit 505e8d2a04b258d9982e8994e14f5e75be5e

Merge changes to CertificateGenerator.inc from PHP-8.2

This pulls only the changes made to CertificateGenerator.inc in the PHP-8.2
branch from commit 505e8d2a04b258d9982e8994e14f5e75be5e1cf8.

Co-authored-by: Jakub Zelenka <bukka@php.net>

show more ...

Fix GH-12616: DOM: Removing XMLNS namespace node results in invalid default: prefix

The namespace data is freed and set to NULL, but there remain references
to the namespace declaration

Fix GH-12616: DOM: Removing XMLNS namespace node results in invalid default: prefix

The namespace data is freed and set to NULL, but there remain references
to the namespace declaration nodes. This (rightfully) confuses libxml2
because its invariants are broken. We also have to remove all remaining
references from the subtree. This fixes the data corruption bug.

Closes GH-12681.

show more ...

Fix GH-12702: libxml2 2.12.0 issue building from src

Fixes GH-12702.

Co-authored-by: nono303 <github@nono303.net>

Fix stream fclose_stdiocast_flush_in_progress type

Fix bug #79945: Stream wrappers in imagecreatefrompng causes segfault

Closes GH-12696

Temporarily disable failing zlib tests on travis (#10738)

Skip slow tests on Travis

Closes GH-12697