Fixed bug #78604

<?php followed by EOF is valid since PHP 7.4.

Add max_depth option to unserialize()

Add a max_depth option to unserialize and an unserialize_max_depth
ini setting, which can be used to control the depth limit. The
default value

Add max_depth option to unserialize()

Add a max_depth option to unserialize and an unserialize_max_depth
ini setting, which can be used to control the depth limit. The
default value is 4096.

This option is intended to prevent stack overflows during the
unserialization of deeply nested structures.

This fixes bug #78549 and addresses oss-fuzz #17581, #17589, #17664,
and #17788.

show more ...

Update NEWS

Merge branch 'PHP-7.2' into PHP-7.3

* PHP-7.2:
Fix NEWS entry

Fix NEWS entry

Cf. <https://bugs.php.net/78590>.

Remove unused parameter

The `$use_include_path` parameter doesn't make sense for
`tidy_repair_string()`, and actually unused, so we remove it.

Remove unused parameter

Cf. <https://bugs.php.net/78579>.

Merge branch 'PHP-7.3' into PHP-7.4

* PHP-7.3:
Fix #78579: mb_decode_numericentity: args number inconsistency

Merge branch 'PHP-7.2' into PHP-7.3

* PHP-7.2:
Fix #78579: mb_decode_numericentity: args number inconsistency

Fix #78579: mb_decode_numericentity: args number inconsistency

mb_decode_numericentity() accepts a fourth optional parameter, which is
unused, however. Since this parameter doesn't do a

Fix #78579: mb_decode_numericentity: args number inconsistency

mb_decode_numericentity() accepts a fourth optional parameter, which is
unused, however. Since this parameter doesn't do any harm, and to avoid
the small BC break, we're keeping this parameter for PHP 7, but adjust
the arginfo.

For PHP 8, we will remove this parameter.

show more ...

Fixed bug #78574 (broken shared build)

Fix #78543: is_callable() on FFI\CData throws Exception

If `Z_OBJ_HANDLER_P(callable, get_closure)` throws, we must not let the
exeception pass to userland, if called through `is_callabl

Fix #78543: is_callable() on FFI\CData throws Exception

If `Z_OBJ_HANDLER_P(callable, get_closure)` throws, we must not let the
exeception pass to userland, if called through `is_callable()`.

show more ...

Fixed bug #78272

Use MAP_JIT only when running under hardened runtime, because MAP_JIT
is incompatible with fork().

The check is based on
https://github.com/mono/mono/commit

Fixed bug #78272

Use MAP_JIT only when running under hardened runtime, because MAP_JIT
is incompatible with fork().

The check is based on
https://github.com/mono/mono/commit/f879e35e3ed7496d819bd766deb8be6992d068ed.

show more ...

Change XMLWriter resources to objects

While we generally prefer objects over resources for quite a while, the
procedural XMLWriter API still uses resources, although there is
already

Change XMLWriter resources to objects

While we generally prefer objects over resources for quite a while, the
procedural XMLWriter API still uses resources, although there is
already an object-oriented API which uses objects. This dichotomy
makes no sense, slightly complicates the implementation, and doesn't
allow a stepwise migration to the object-oriented API, which might be
desired. Thus we completely drop the XMLWriter resources in favor of
XMLWriter objects.

We consider the minor BC break acceptable for a major version, since
only explicit type checks (`is_resource()`, `gettype()` etc.) need to
be adapted.

show more ...

Update NEWS for 7.4.0RC3

Update NEWS for PHP 7.4.0RC2

Revert "Update NEWS for PHP 7.4.0RC2"

This reverts commit 050059cb269f3581901d3ac4d155292fee95d4cf.

Revert "Update NEWS for 7.4.0RC3"

This reverts commit 803dc6b8f2ea1f9314d19eb242365f32a364437e.

Merge branch 'PHP-7.2' into PHP-7.3

Fix #76342: file_get_contents waits twice specified timeout

Update NEWS for 7.4.0RC3

Update NEWS for PHP 7.4.0RC2

Fix #78429: opcache_compile_file(__FILE__); segfaults

We have to ensure that OPcache has been properly started up when
`opcache_compile_file()` is called.

Fix typo

Fix #78516: password_hash(): Memory cost is not in allowed range

libsodium measures the memory cost in bytes, while password_hash() and
friends expect kibibyte values. We have to proper

Fix #78516: password_hash(): Memory cost is not in allowed range

libsodium measures the memory cost in bytes, while password_hash() and
friends expect kibibyte values. We have to properly map between these
scales not only when calling libsodium functions, but also when
checking for allowed values.

We also refactor to rid the code duplication.

show more ...