Fix access on NULL pointer in array_merge_recursive()

Closes GH-11303

Allow FETCH_OBJ_W and FETCH_STATIC_PROP_W to return INDIRECT/UNDEF zval for uninitialized typed properties (#11048)

Revert "Fix GH-10168: heap-buffer-overflow at zval_undefined_cv"

This reverts commit 71ddede5655fe654002ae18af6a18e033f717287.

Fix colletion of unfinished function call in fibers

Fixes GH-10496.

Co-authored-by: Bob Weinand <bobwei9@hotmail.com>

Fix GH-10168: heap-buffer-overflow at zval_undefined_cv

The problem is that we're using the variable_ptr in the opcode handler
*after* it has already been destroyed. The solution is to c

Fix GH-10168: heap-buffer-overflow at zval_undefined_cv

The problem is that we're using the variable_ptr in the opcode handler
*after* it has already been destroyed. The solution is to create a
specialised version of zend_assign_to_variable which takes in two
destination zval pointers.

Closes GH-10524

show more ...

Fix GH-10248: Assertion `!(zval_get_type(&(*(property))) == 10)' failed.

The assertion failure was triggered in a debug code-path that validates
property types for internal classes.

Fix GH-10248: Assertion `!(zval_get_type(&(*(property))) == 10)' failed.

The assertion failure was triggered in a debug code-path that validates
property types for internal classes.
zend_verify_internal_read_property_type was called with retval being a
reference, which is not allowed because that function eventually calls to
i_zend_check_property_type, which does not expect a reference.
The non-debug code-path already takes into account that retval can be a
reference, as it optionally dereferences retval.

Add a dereference in zend_verify_internal_read_property_type just before
the call to zend_verify_property_type, which is how other callers often
behave as well.

show more ...

GC fiber unfinished executions (#9810)

Fix generator memory leaks when interrupted during argument evaluation (#9756)

Disallow assigning reference to unset readonly property

Closes GH-7942
Closes GH-8188

Prevent array modification if it's captured by user error handler during
index conversion

Fixes oss-fuzz #44235

Move common code into helper

Merge branch 'PHP-8.0' into PHP-8.1

* PHP-8.0:
Combine ADDREF/DELREF

Combine ADDREF/DELREF

Merge branch 'PHP-8.0' into PHP-8.1

* PHP-8.0:
Fix array clobering by user error handler

Fix array clobering by user error handler

Fixes oss-fuzz #42234

Separate "cold" code

Fix use after free because of data clobbering by user error handler

Fixes oss-fuzz #41692

Merge branch 'PHP-8.0' into PHP-8.1

* PHP-8.0:
Fix array object clobbering by user error handler

Fix array object clobbering by user error handler

Fixes oss-fuss #41605 and #41610

Merge branch 'PHP-8.0' into PHP-8.1

* PHP-8.0:
Add missing zend_string_release_ex(tmp, 0) and cleanup

Add missing zend_string_release_ex(tmp, 0) and cleanup

- use GC_DELREF() instead of zend_string_release_ex()
- add expectations for exceptional cases
- replace IS_ARRAY_IMMUTABLE by

Add missing zend_string_release_ex(tmp, 0) and cleanup

- use GC_DELREF() instead of zend_string_release_ex()
- add expectations for exceptional cases
- replace IS_ARRAY_IMMUTABLE by IS_STR_INTERNED

show more ...

Merge branch 'PHP-8.0' into PHP-8.1

* PHP-8.0:
Fixed ext/bz2/tests/005.phpt test failure introduesed by 09547c64c28f81957d986b9c6b995b28d1098db6

Fixed ext/bz2/tests/005.phpt test failure introduesed by 09547c64c28f81957d986b9c6b995b28d1098db6

Merge branch 'PHP-8.0' into PHP-8.1

* PHP-8.0:
Fix clobering of operand by error handler in assignment to string offset (optimization and JIT support)

Fix clobering of operand by error handler in assignment to string offset (optimization and JIT support)