Fix uninitialized lineno in constant AST of internal enums

Closes GH-15806

Fix bug #61525: SOAP functions require at least one space after HTTP header colon

HTTP/1.1 does not require a single whitespace after the colon, and
SoapServer does implement HTTP/1.1. T

Fix bug #61525: SOAP functions require at least one space after HTTP header colon

HTTP/1.1 does not require a single whitespace after the colon, and
SoapServer does implement HTTP/1.1. The header value is already correctly
whitespace-trimmed, so no behaviour change happens w.r.t. header values.

Closes GH-15793.

show more ...

Fix GH-15752: `finfo_file()` - parameter validation error messages

Show the correct parameter names and numbers - the errors are caused by the
second parameter being empty or having null

Fix GH-15752: `finfo_file()` - parameter validation error messages

Show the correct parameter names and numbers - the errors are caused by the
second parameter being empty or having null bytes, not the first.

close GH-15755

show more ...

[skip ci] update NEWS for GH-15731 (#15756)

Fix GH-15742: php_hash_sha.h incompatible with C++

Not only MSVC doesn't support this construct, but apparently it is
generally not supported by C++ compilers.

Closes GH-15745.

ext/curl: No-op `CURLOPT_DNS_USE_GLOBAL_CACHE` constant (GH-15127)

Libcurl `CURLOPT_DNS_USE_GLOBAL_CACHE` constant is no longer supported
since libcurl[^1] 7.62. This no-ops the constant

ext/curl: No-op `CURLOPT_DNS_USE_GLOBAL_CACHE` constant (GH-15127)

Libcurl `CURLOPT_DNS_USE_GLOBAL_CACHE` constant is no longer supported
since libcurl[^1] 7.62. This no-ops the constant, but without causing
any deprecation notices.

[^1]: [CURLOPT_DNS_USE_GLOBAL_CACHE](https://curl.se/libcurl/c/CURLOPT_DNS_USE_GLOBAL_CACHE.html)

show more ...

[RFC] Support object types in BCMath (#13741)

Added BcMath\Number class. It is an immutable object, has methods that are
equivalent to existing BCMath calculation functions, and can also

[RFC] Support object types in BCMath (#13741)

Added BcMath\Number class. It is an immutable object, has methods that are
equivalent to existing BCMath calculation functions, and can also be calculated
using operators.

The existing BCMath function returned a string for each calculation, but this
class returns an object.

RFC: https://wiki.php.net/rfc/support_object_type_in_bcmath,
https://wiki.php.net/rfc/fix_up_bcmath_number_class

---------

Co-authored-by: Niels Dossche <7771979+nielsdos@users.noreply.github.com>

show more ...

Close-GH 15685: improve proc_open error reporting on Windows

While similar errors are already reported via `strerror()` on other
platforms, this has apparently overlooked for Windows, wh

Close-GH 15685: improve proc_open error reporting on Windows

While similar errors are already reported via `strerror()` on other
platforms, this has apparently overlooked for Windows, where only the
error code has been reported so far.

We adapt the affected test cases, but since there is no PHP userland
function which allows us to get the current system locale, we work
around.

Closes GH-15687.

show more ...

[skip ci] Fix NEWS reflection category

ReflectionProperty::get{Hook,Hooks}(): handle dynamic properties

For dynamic properties, instead of crashing with a segmentation fault, just say
that there are no hooks. Also includes a

ReflectionProperty::get{Hook,Hooks}(): handle dynamic properties

For dynamic properties, instead of crashing with a segmentation fault, just say
that there are no hooks. Also includes a test to prevent regression.

Fixes GH-15718
Closes GH-15721

show more ...

Fix GH-15693: Unnecessary include in main.c bloats binary

Closes GH-15700.

Forbid a-vis on unilateral virtual prop

The get-only case is obvious, there is no set operation so specifying its
visibility is senseless. The set-only case is also questionable, since t

Forbid a-vis on unilateral virtual prop

The get-only case is obvious, there is no set operation so specifying its
visibility is senseless. The set-only case is also questionable, since there is
no operation other than set, so changing the visibility of the entire property
is preferable.

Closes GH-15698

show more ...

[ci skip] NEWS and UPGRADING for PASSWORD_ARGON2 on openssl

Autotools: Fix iconv shared build with external library (#15686)

When building iconv as shared and with external library (for example, libiconv):

./configure --with-iconv=shared

Autotools: Fix iconv shared build with external library (#15686)

When building iconv as shared and with external library (for example, libiconv):

./configure --with-iconv=shared,/path/to/libiconv

the iconv couldn't be found due to a linker error.

Autoconf places LDFLAGS before the conftest.c file in the test compile
command and LIBS after it. GCC also requires this:

gcc -L... conftest.c -liconv

Similar issue discovered at
https://github.com/remicollet/php-xpass/pull/1

show more ...

ext/curl: Update `UPGRADING` and `NEWS` for GH-13255 (#15668)

[ci skip]

Fix GH-15552: Signed integer overflow in ext/standard/scanf.c

We ensure that the argnum `value` is in the allowed range, *before*
mapping it to the `objIndex`, not *afterwards*.

Fix GH-15552: Signed integer overflow in ext/standard/scanf.c

We ensure that the argnum `value` is in the allowed range, *before*
mapping it to the `objIndex`, not *afterwards*.

Closes GH-15581.

show more ...

Fix GH-15628: php_stream_memory_get_buffer() not zero-terminated

We're reasonably sure that appending the NUL is not an OOB write, since
the memory stream implementation uses `zend_strin

Fix GH-15628: php_stream_memory_get_buffer() not zero-terminated

We're reasonably sure that appending the NUL is not an OOB write, since
the memory stream implementation uses `zend_string` APIs instead of
fiddling with the buffer.

We don't add a regression test because that would require to set up
something in the zend_test extension, and regressions are supposed
to be caught by external consumers of this API, such as mailparse.

Closes GH-15648.

show more ...

Don't export php_pdo_int.h

This is, as the name and a comment in the header imply, an internal
header which is not supposed to be used by extensions other than PDO
(not even by drive

Don't export php_pdo_int.h

This is, as the name and a comment in the header imply, an internal
header which is not supposed to be used by extensions other than PDO
(not even by drivers).

Since there is apparently no need to include this header in the parsers
of the drivers, we remove these includes, and no longer declare the
header to be installed. Given that the header is only exported for a
couple of weeks[1], this is not considered to be a BC break, because
it's unlikely that external drivers have already been adjusted to use
this header, and otherwise they can still be fixed; PHP 8.4 is still in
the pre-release stage.

[1] <https://github.com/php/php-src/pull/14797>

Closes GH-15688.

show more ...

ext/curl: libcurl `CURLOPT_{FTP_RESPONSE_TIMEOUT,ENCODING}` replacements (#15126)

Fix GH-15654: Signed integer overflow in ext/dom/nodelist.c

There's implicit truncation casts from zend_long to int which cause
issues because checks are done against the zend_longs. Sin

Fix GH-15654: Signed integer overflow in ext/dom/nodelist.c

There's implicit truncation casts from zend_long to int which cause
issues because checks are done against the zend_longs. Since the
iterator infrastructure uses zend_longs, just convert everything to
zend_long.

Closes GH-15669.

show more ...

[skip ci] NEWS for Fixed LONG_MAX in BCMath ext (#15663)

NEWS for ext/bcmath: Fixed bcdiv() div by one (#15629)

ext/pdo_firebird: Fixed GH-15604 Always make input parameters nullable (#15605)

Fixes #15604
Closes #15605

Fix GH-15653: fgetcsv overflow on length parameter.

close GH-15655

Lazy objects

RFC: https://wiki.php.net/rfc/lazy-objects

Closes GH-15019